rule win_rekoobew_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.rekoobew."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 333495e0744000 8b55e4 0fb6fe 3334bde0784000 0fb655e0 8b3c95e07c4000 33bb94010000 }
            // n = 7, score = 100
            //   333495e0744000       | xor                 esi, dword ptr [edx*4 + 0x4074e0]
            //   8b55e4               | mov                 edx, dword ptr [ebp - 0x1c]
            //   0fb6fe               | movzx               edi, dh
            //   3334bde0784000       | xor                 esi, dword ptr [edi*4 + 0x4078e0]
            //   0fb655e0             | movzx               edx, byte ptr [ebp - 0x20]
            //   8b3c95e07c4000       | mov                 edi, dword ptr [edx*4 + 0x407ce0]
            //   33bb94010000         | xor                 edi, dword ptr [ebx + 0x194]

        $sequence_1 = { 8b4de0 0fb6f5 8b34b5e08c4000 31fe }
            // n = 4, score = 100
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   0fb6f5               | movzx               esi, ch
            //   8b34b5e08c4000       | mov                 esi, dword ptr [esi*4 + 0x408ce0]
            //   31fe                 | xor                 esi, edi

        $sequence_2 = { 89e5 57 56 53 83ec1c c7442404???????? c70424???????? }
            // n = 7, score = 100
            //   89e5                 | mov                 ebp, esp
            //   57                   | push                edi
            //   56                   | push                esi
            //   53                   | push                ebx
            //   83ec1c               | sub                 esp, 0x1c
            //   c7442404????????     |                     
            //   c70424????????       |                     

        $sequence_3 = { c1c31e 8b55cc 3355d4 3355c0 3355e8 d1c2 }
            // n = 6, score = 100
            //   c1c31e               | rol                 ebx, 0x1e
            //   8b55cc               | mov                 edx, dword ptr [ebp - 0x34]
            //   3355d4               | xor                 edx, dword ptr [ebp - 0x2c]
            //   3355c0               | xor                 edx, dword ptr [ebp - 0x40]
            //   3355e8               | xor                 edx, dword ptr [ebp - 0x18]
            //   d1c2                 | rol                 edx, 1

        $sequence_4 = { 8b34b5e08c4000 31fe 8975e4 0fb6fd 0fb675ec 8b3cbde08c4000 333cb5e0904000 }
            // n = 7, score = 100
            //   8b34b5e08c4000       | mov                 esi, dword ptr [esi*4 + 0x408ce0]
            //   31fe                 | xor                 esi, edi
            //   8975e4               | mov                 dword ptr [ebp - 0x1c], esi
            //   0fb6fd               | movzx               edi, ch
            //   0fb675ec             | movzx               esi, byte ptr [ebp - 0x14]
            //   8b3cbde08c4000       | mov                 edi, dword ptr [edi*4 + 0x408ce0]
            //   333cb5e0904000       | xor                 edi, dword ptr [esi*4 + 0x4090e0]

        $sequence_5 = { 89d1 330cbde08c4000 0fb6f1 8b3cb5e0904000 337b54 8b75ec c1ee18 }
            // n = 7, score = 100
            //   89d1                 | mov                 ecx, edx
            //   330cbde08c4000       | xor                 ecx, dword ptr [edi*4 + 0x408ce0]
            //   0fb6f1               | movzx               esi, cl
            //   8b3cb5e0904000       | mov                 edi, dword ptr [esi*4 + 0x4090e0]
            //   337b54               | xor                 edi, dword ptr [ebx + 0x54]
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   c1ee18               | shr                 esi, 0x18

        $sequence_6 = { 750c c705????????faffffff b001 8b5df4 8b75f8 8b7dfc 89ec }
            // n = 7, score = 100
            //   750c                 | jne                 0xe
            //   c705????????faffffff     |     
            //   b001                 | mov                 al, 1
            //   8b5df4               | mov                 ebx, dword ptr [ebp - 0xc]
            //   8b75f8               | mov                 esi, dword ptr [ebp - 8]
            //   8b7dfc               | mov                 edi, dword ptr [ebp - 4]
            //   89ec                 | mov                 esp, ebp

        $sequence_7 = { 8b5de8 c1eb18 33349de0704000 8b5dec c1eb10 0fb6db }
            // n = 6, score = 100
            //   8b5de8               | mov                 ebx, dword ptr [ebp - 0x18]
            //   c1eb18               | shr                 ebx, 0x18
            //   33349de0704000       | xor                 esi, dword ptr [ebx*4 + 0x4070e0]
            //   8b5dec               | mov                 ebx, dword ptr [ebp - 0x14]
            //   c1eb10               | shr                 ebx, 0x10
            //   0fb6db               | movzx               ebx, bl

        $sequence_8 = { 0345f0 89cf c1c705 01f8 c1c61e 8b7dcc 8d9c1f9979825a }
            // n = 7, score = 100
            //   0345f0               | add                 eax, dword ptr [ebp - 0x10]
            //   89cf                 | mov                 edi, ecx
            //   c1c705               | rol                 edi, 5
            //   01f8                 | add                 eax, edi
            //   c1c61e               | rol                 esi, 0x1e
            //   8b7dcc               | mov                 edi, dword ptr [ebp - 0x34]
            //   8d9c1f9979825a       | lea                 ebx, [edi + ebx + 0x5a827999]

        $sequence_9 = { c74050e0644000 c74054f0644000 c740241cb04000 8910 c7401898654000 c7401ca06a4000 c74020a86a4000 }
            // n = 7, score = 100
            //   c74050e0644000       | mov                 dword ptr [eax + 0x50], 0x4064e0
            //   c74054f0644000       | mov                 dword ptr [eax + 0x54], 0x4064f0
            //   c740241cb04000       | mov                 dword ptr [eax + 0x24], 0x40b01c
            //   8910                 | mov                 dword ptr [eax], edx
            //   c7401898654000       | mov                 dword ptr [eax + 0x18], 0x406598
            //   c7401ca06a4000       | mov                 dword ptr [eax + 0x1c], 0x406aa0
            //   c74020a86a4000       | mov                 dword ptr [eax + 0x20], 0x406aa8

    condition:
        7 of them and filesize < 248832
}