rule win_ragnarlocker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.ragnarlocker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b5584 8bf1 0facd113 c1e60d 0bd9 c1ea13 0bf2 }
            // n = 7, score = 300
            //   8b5584               | mov                 edx, dword ptr [ebp - 0x7c]
            //   8bf1                 | mov                 esi, ecx
            //   0facd113             | shrd                ecx, edx, 0x13
            //   c1e60d               | shl                 esi, 0xd
            //   0bd9                 | or                  ebx, ecx
            //   c1ea13               | shr                 edx, 0x13
            //   0bf2                 | or                  esi, edx

        $sequence_1 = { 0bd8 8b45e8 8bf0 0facc812 c1e60e c1e912 }
            // n = 6, score = 300
            //   0bd8                 | or                  ebx, eax
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]
            //   8bf0                 | mov                 esi, eax
            //   0facc812             | shrd                eax, ecx, 0x12
            //   c1e60e               | shl                 esi, 0xe
            //   c1e912               | shr                 ecx, 0x12

        $sequence_2 = { 8b5598 f7d6 23b518ffffff f7d2 239514ffffff 8b8d1cffffff 33d0 }
            // n = 7, score = 300
            //   8b5598               | mov                 edx, dword ptr [ebp - 0x68]
            //   f7d6                 | not                 esi
            //   23b518ffffff         | and                 esi, dword ptr [ebp - 0xe8]
            //   f7d2                 | not                 edx
            //   239514ffffff         | and                 edx, dword ptr [ebp - 0xec]
            //   8b8d1cffffff         | mov                 ecx, dword ptr [ebp - 0xe4]
            //   33d0                 | xor                 edx, eax

        $sequence_3 = { 3375d8 3355dc 8b4de4 8b45d0 }
            // n = 4, score = 300
            //   3375d8               | xor                 esi, dword ptr [ebp - 0x28]
            //   3355dc               | xor                 edx, dword ptr [ebp - 0x24]
            //   8b4de4               | mov                 ecx, dword ptr [ebp - 0x1c]
            //   8b45d0               | mov                 eax, dword ptr [ebp - 0x30]

        $sequence_4 = { 33f1 2355cc 8b4dd8 33fa }
            // n = 4, score = 300
            //   33f1                 | xor                 esi, ecx
            //   2355cc               | and                 edx, dword ptr [ebp - 0x34]
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   33fa                 | xor                 edi, edx

        $sequence_5 = { 0bf0 3155ec 3175d8 33d2 8b4df4 8bf1 8b45e8 }
            // n = 7, score = 300
            //   0bf0                 | or                  esi, eax
            //   3155ec               | xor                 dword ptr [ebp - 0x14], edx
            //   3175d8               | xor                 dword ptr [ebp - 0x28], esi
            //   33d2                 | xor                 edx, edx
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   8bf1                 | mov                 esi, ecx
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]

        $sequence_6 = { c1ea12 3175fc 0bfa 8b4de8 33df 8b55f4 8bf9 }
            // n = 7, score = 300
            //   c1ea12               | shr                 edx, 0x12
            //   3175fc               | xor                 dword ptr [ebp - 4], esi
            //   0bfa                 | or                  edi, edx
            //   8b4de8               | mov                 ecx, dword ptr [ebp - 0x18]
            //   33df                 | xor                 ebx, edi
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8bf9                 | mov                 edi, ecx

        $sequence_7 = { 895db0 33db c1e60d c1ea13 0bf2 0bd9 8b9554ffffff }
            // n = 7, score = 300
            //   895db0               | mov                 dword ptr [ebp - 0x50], ebx
            //   33db                 | xor                 ebx, ebx
            //   c1e60d               | shl                 esi, 0xd
            //   c1ea13               | shr                 edx, 0x13
            //   0bf2                 | or                  esi, edx
            //   0bd9                 | or                  ebx, ecx
            //   8b9554ffffff         | mov                 edx, dword ptr [ebp - 0xac]

        $sequence_8 = { 0f8277ffffff eb0c 56 ff15???????? }
            // n = 4, score = 300
            //   0f8277ffffff         | jb                  0xffffff7d
            //   eb0c                 | jmp                 0xe
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_9 = { c1e108 0bc8 0fb64604 c1e108 0bc8 894b14 0f114318 }
            // n = 7, score = 300
            //   c1e108               | shl                 ecx, 8
            //   0bc8                 | or                  ecx, eax
            //   0fb64604             | movzx               eax, byte ptr [esi + 4]
            //   c1e108               | shl                 ecx, 8
            //   0bc8                 | or                  ecx, eax
            //   894b14               | mov                 dword ptr [ebx + 0x14], ecx
            //   0f114318             | movups              xmmword ptr [ebx + 0x18], xmm0

    condition:
        7 of them and filesize < 147456
}