rule win_polyvice_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.polyvice."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4431e5 4401d5 4589c2 896c2420 458d8c29dca9b05c }
            // n = 5, score = 200
            //   4431e5               | rol                 eax, 0xa
            //   4401d5               | inc                 ecx
            //   4589c2               | xor                 ecx, eax
            //   896c2420             | inc                 esp
            //   458d8c29dca9b05c     | mov                 eax, eax

        $sequence_1 = { 4489ee 09c6 21fe 09ee 4401d6 4589fa 01f3 }
            // n = 7, score = 200
            //   4489ee               | inc                 esp
            //   09c6                 | mov                 edx, edi
            //   21fe                 | inc                 ecx
            //   09ee                 | ror                 esi, 7
            //   4401d6               | rol                 edx, 0xe
            //   4589fa               | inc                 esp
            //   01f3                 | xor                 edx, esi

        $sequence_2 = { 85c0 0f853afeffff ff15???????? 488d0d8fb00100 89c2 e8???????? 90 }
            // n = 7, score = 200
            //   85c0                 | dec                 eax
            //   0f853afeffff         | cmp                 edx, eax
            //   ff15????????         |                     
            //   488d0d8fb00100       | jne                 0x1c2c
            //   89c2                 | dec                 ecx
            //   e8????????           |                     
            //   90                   | lea                 eax, [eax + 0xf]

        $sequence_3 = { 0f8ec0000000 488b14de 4889e9 ffd7 85c0 75b3 488d5cde08 }
            // n = 7, score = 200
            //   0f8ec0000000         | mov                 dword ptr [ecx], ecx
            //   488b14de             | inc                 ebp
            //   4889e9               | xor                 ebx, edx
            //   ffd7                 | inc                 esp
            //   85c0                 | mov                 dword ptr [ecx + 4], edx
            //   75b3                 | inc                 esp
            //   488d5cde08           | xor                 ebx, ebx

        $sequence_4 = { 4489df 448b5c240c 43333cbe 46332c92 478b1c99 47331ca0 4189fa }
            // n = 7, score = 200
            //   4489df               | inc                 esp
            //   448b5c240c           | mov                 edi, ebp
            //   43333cbe             | inc                 ecx
            //   46332c92             | mov                 ebp, esi
            //   478b1c99             | inc                 esp
            //   47331ca0             | and                 edi, ebx
            //   4189fa               | inc                 ecx

        $sequence_5 = { c1ef10 400fb6ff 331cba 0fb6fc 89e8 41331cbf 4489df }
            // n = 7, score = 200
            //   c1ef10               | dec                 eax
            //   400fb6ff             | mov                 edx, edi
            //   331cba               | dec                 ebp
            //   0fb6fc               | lea                 eax, [ebp + eax + 1]
            //   89e8                 | movzx               eax, byte ptr [edx]
            //   41331cbf             | jle                 0x1030
            //   4489df               | mov                 eax, dword ptr [esp + 0x110]

        $sequence_6 = { 21c8 c1c902 44895c2424 4431c8 4401d0 4189d2 }
            // n = 6, score = 200
            //   21c8                 | xor                 edi, dword ptr [esp + 0xc]
            //   c1c902               | inc                 ecx
            //   44895c2424           | rol                 edi, 1
            //   4431c8               | inc                 esp
            //   4401d0               | mov                 ecx, edi
            //   4189d2               | inc                 ebp

        $sequence_7 = { 89f0 89f7 4489642410 896c2418 89dd 0fb6c4 }
            // n = 6, score = 200
            //   89f0                 | add                 esi, dword ptr [esp + 0x28]
            //   89f7                 | inc                 esp
            //   4489642410           | mov                 dword ptr [esp + 0xc], eax
            //   896c2418             | inc                 esp
            //   89dd                 | mov                 eax, dword ptr [esp + 8]
            //   0fb6c4               | inc                 esp

        $sequence_8 = { 438d940cd6c162ca 448b642420 4101d7 4501c7 448b442418 4531e5 4531e8 }
            // n = 7, score = 200
            //   438d940cd6c162ca     | xor                 eax, ebx
            //   448b642420           | inc                 esp
            //   4101d7               | mov                 dword ptr [esp + 8], ebx
            //   4501c7               | inc                 esp
            //   448b442418           | mov                 ebx, dword ptr [esp + 0xc]
            //   4531e5               | rol                 ebp, 0xc
            //   4531e8               | inc                 ecx

        $sequence_9 = { 41c1cc06 31f7 8dac05015b8312 89442410 01fd 4489e7 4589cc }
            // n = 7, score = 200
            //   41c1cc06             | add                 ecx, esi
            //   31f7                 | mov                 esi, dword ptr [esp + 8]
            //   8dac05015b8312       | inc                 ecx
            //   89442410             | mov                 ebp, esi
            //   01fd                 | inc                 ecx
            //   4489e7               | mov                 edi, esi
            //   4589cc               | inc                 esp

    condition:
        7 of them and filesize < 369664
}

rule win_polyvice_w0 {
  meta:
    author = "Antonio Cocomazzi @ SentinelOne"
    description = "Detect a custom branded version of Vice Society ransomware"
    date = "2022-11-28"
    reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development"
    hash = "c8e7ecbbe78a26bea813eeed6801a0ac9d1eacac"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
    malpedia_rule_date = "20230102"
    malpedia_hash = ""
    malpedia_version = "20230102"
    malpedia_license = "CC BY-NC-SA 4.0"
    malpedia_sharing = "TLP:WHITE"
  strings:
    $code1 = {4? 8B ?? 28 00 02 00 }
    $code2 = {4? C7 ?? 18 03 02 00 A3 00 00 00}
    $code3 = {(48|49) 8D 8? 58 00 02 00}
    $code4 = {(48|49) 8D 9? E8 02 02 00}
    $code5 = {(48|4C) 89 ?? 24 38}
    $code6 = {4? 8B ?? F8 02 02 00}
    $code7 = {C7 44 24 48 01 00 00 00}
    $string1 = "vsociet" nocase wide ascii
 
  condition:
    uint16(0) == 0x5A4D and all of them
}

rule win_polyvice_w1 {
  meta:
    author = "Antonio Cocomazzi @ SentinelOne"
    description = "Detect a windows ransomware variant tracked as PolyVice adopted by multiple threat actors"
    date = "2022-11-28"
    reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development"
    hash1 = "c8e7ecbbe78a26bea813eeed6801a0ac9d1eacac"
    hash2 = "6cfb5b4a68100678d95270e3d188572a30abd568"
    hash3 = "2b3fea431f342c7b8bcff4b89715002e44d662c7"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
    malpedia_rule_date = "20230102"
    malpedia_hash = ""
    malpedia_version = "20230102"
    malpedia_license = "CC BY-NC-SA 4.0"
    malpedia_sharing = "TLP:WHITE"
  strings:
    $code1 = {4? 8B ?? 28 00 02 00 }
    $code2 = {4? C7 ?? 18 03 02 00 A3 00 00 00}
    $code3 = {(48|49) 8D 8? 58 00 02 00}
    $code4 = {(48|49) 8D 9? E8 02 02 00}
    $code5 = {(48|4C) 89 ?? 24 38}
    $code6 = {4? 8B ?? F8 02 02 00}
    $code7 = {C7 44 24 48 01 00 00 00}
 
  condition:
    uint16(0) == 0x5A4D and all of them
}