rule win_pandabanker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.pandabanker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0fbed0 83ea37 eb16 3c61 0f8ca5000000 }
            // n = 5, score = 8600
            //   0fbed0               | movsx               edx, al
            //   83ea37               | sub                 edx, 0x37
            //   eb16                 | jmp                 0x18
            //   3c61                 | cmp                 al, 0x61
            //   0f8ca5000000         | jl                  0xab

        $sequence_1 = { 3b0f 7ce2 8b2f 03f5 }
            // n = 4, score = 8600
            //   3b0f                 | cmp                 ecx, dword ptr [edi]
            //   7ce2                 | jl                  0xffffffe4
            //   8b2f                 | mov                 ebp, dword ptr [edi]
            //   03f5                 | add                 esi, ebp

        $sequence_2 = { e8???????? 8b7500 8d7c2414 8b442410 03f3 }
            // n = 5, score = 8600
            //   e8????????           |                     
            //   8b7500               | mov                 esi, dword ptr [ebp]
            //   8d7c2414             | lea                 edi, [esp + 0x14]
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   03f3                 | add                 esi, ebx

        $sequence_3 = { 85db 7404 c6000a 40 c60000 8b442434 }
            // n = 6, score = 8600
            //   85db                 | test                ebx, ebx
            //   7404                 | je                  6
            //   c6000a               | mov                 byte ptr [eax], 0xa
            //   40                   | inc                 eax
            //   c60000               | mov                 byte ptr [eax], 0
            //   8b442434             | mov                 eax, dword ptr [esp + 0x34]

        $sequence_4 = { f3a4 5f 5e 8bcd 5d }
            // n = 5, score = 8600
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   8bcd                 | mov                 ecx, ebp
            //   5d                   | pop                 ebp

        $sequence_5 = { 33c0 85c9 740b 394104 7406 394108 7401 }
            // n = 7, score = 8600
            //   33c0                 | xor                 eax, eax
            //   85c9                 | test                ecx, ecx
            //   740b                 | je                  0xd
            //   394104               | cmp                 dword ptr [ecx + 4], eax
            //   7406                 | je                  8
            //   394108               | cmp                 dword ptr [ecx + 8], eax
            //   7401                 | je                  3

        $sequence_6 = { e8???????? 84c0 746d 83caff 8bce e8???????? 8bf8 }
            // n = 7, score = 8600
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   746d                 | je                  0x6f
            //   83caff               | or                  edx, 0xffffffff
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   8bf8                 | mov                 edi, eax

        $sequence_7 = { 8b74243c 8d7801 8b4c2440 f3a4 8b7c2440 8b742444 47 }
            // n = 7, score = 8600
            //   8b74243c             | mov                 esi, dword ptr [esp + 0x3c]
            //   8d7801               | lea                 edi, [eax + 1]
            //   8b4c2440             | mov                 ecx, dword ptr [esp + 0x40]
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   8b7c2440             | mov                 edi, dword ptr [esp + 0x40]
            //   8b742444             | mov                 esi, dword ptr [esp + 0x44]
            //   47                   | inc                 edi

        $sequence_8 = { 8bce 50 e8???????? 8b7c2424 84c0 744e ff742428 }
            // n = 7, score = 8600
            //   8bce                 | mov                 ecx, esi
            //   50                   | push                eax
            //   e8????????           |                     
            //   8b7c2424             | mov                 edi, dword ptr [esp + 0x24]
            //   84c0                 | test                al, al
            //   744e                 | je                  0x50
            //   ff742428             | push                dword ptr [esp + 0x28]

        $sequence_9 = { 8b4b54 83c018 03c3 f3a4 89442410 33c9 }
            // n = 6, score = 8600
            //   8b4b54               | mov                 ecx, dword ptr [ebx + 0x54]
            //   83c018               | add                 eax, 0x18
            //   03c3                 | add                 eax, ebx
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   89442410             | mov                 dword ptr [esp + 0x10], eax
            //   33c9                 | xor                 ecx, ecx

    condition:
        7 of them and filesize < 417792
}