rule win_rekoobew_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.rekoobew."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 29d8 89442408 89742404 8b4508 890424 e8???????? 85c0 }
            // n = 7, score = 100
            //   29d8                 | sub                 eax, ebx
            //   89442408             | mov                 dword ptr [esp + 8], eax
            //   89742404             | mov                 dword ptr [esp + 4], esi
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_1 = { c740241cb04000 8910 c7401898654000 c7401ca06a4000 c74020a86a4000 c74044b06a4000 }
            // n = 6, score = 100
            //   c740241cb04000       | mov                 dword ptr [eax + 0x24], 0x40b01c
            //   8910                 | mov                 dword ptr [eax], edx
            //   c7401898654000       | mov                 dword ptr [eax + 0x18], 0x406598
            //   c7401ca06a4000       | mov                 dword ptr [eax + 0x1c], 0x406aa0
            //   c74020a86a4000       | mov                 dword ptr [eax + 0x20], 0x406aa8
            //   c74044b06a4000       | mov                 dword ptr [eax + 0x44], 0x406ab0

        $sequence_2 = { 0f85c4020000 a1???????? 8945d8 a1???????? 8945dc a1???????? 8945e0 }
            // n = 7, score = 100
            //   0f85c4020000         | jne                 0x2ca
            //   a1????????           |                     
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   a1????????           |                     
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax
            //   a1????????           |                     
            //   8945e0               | mov                 dword ptr [ebp - 0x20], eax

        $sequence_3 = { 8b47fc 8b3495e0984000 3377e0 0fb6d8 8b1c9de0944000 c1e308 31de }
            // n = 7, score = 100
            //   8b47fc               | mov                 eax, dword ptr [edi - 4]
            //   8b3495e0984000       | mov                 esi, dword ptr [edx*4 + 0x4098e0]
            //   3377e0               | xor                 esi, dword ptr [edi - 0x20]
            //   0fb6d8               | movzx               ebx, al
            //   8b1c9de0944000       | mov                 ebx, dword ptr [ebx*4 + 0x4094e0]
            //   c1e308               | shl                 ebx, 8
            //   31de                 | xor                 esi, ebx

        $sequence_4 = { 334dec d1c1 894dd8 8d8408a1ebd96e 8945f0 89d0 31f8 }
            // n = 7, score = 100
            //   334dec               | xor                 ecx, dword ptr [ebp - 0x14]
            //   d1c1                 | rol                 ecx, 1
            //   894dd8               | mov                 dword ptr [ebp - 0x28], ecx
            //   8d8408a1ebd96e       | lea                 eax, [eax + ecx + 0x6ed9eba1]
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   89d0                 | mov                 eax, edx
            //   31f8                 | xor                 eax, edi

        $sequence_5 = { 884610 0fb7431a 884611 8b4318 c1e808 884612 }
            // n = 6, score = 100
            //   884610               | mov                 byte ptr [esi + 0x10], al
            //   0fb7431a             | movzx               eax, word ptr [ebx + 0x1a]
            //   884611               | mov                 byte ptr [esi + 0x11], al
            //   8b4318               | mov                 eax, dword ptr [ebx + 0x18]
            //   c1e808               | shr                 eax, 8
            //   884612               | mov                 byte ptr [esi + 0x12], al

        $sequence_6 = { c1ea10 0fb6d2 333495e0884000 0fb6d5 8b1495e08c4000 31f2 8955e8 }
            // n = 7, score = 100
            //   c1ea10               | shr                 edx, 0x10
            //   0fb6d2               | movzx               edx, dl
            //   333495e0884000       | xor                 esi, dword ptr [edx*4 + 0x4088e0]
            //   0fb6d5               | movzx               edx, ch
            //   8b1495e08c4000       | mov                 edx, dword ptr [edx*4 + 0x408ce0]
            //   31f2                 | xor                 edx, esi
            //   8955e8               | mov                 dword ptr [ebp - 0x18], edx

        $sequence_7 = { 897dc8 8d9c3bdcbc1b8f 89d7 09cf 21c7 897d98 89d7 }
            // n = 7, score = 100
            //   897dc8               | mov                 dword ptr [ebp - 0x38], edi
            //   8d9c3bdcbc1b8f       | lea                 ebx, [ebx + edi - 0x70e44324]
            //   89d7                 | mov                 edi, edx
            //   09cf                 | or                  edi, ecx
            //   21c7                 | and                 edi, eax
            //   897d98               | mov                 dword ptr [ebp - 0x68], edi
            //   89d7                 | mov                 edi, edx

        $sequence_8 = { 8b7d08 8807 83c701 897d08 80f93d }
            // n = 5, score = 100
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   8807                 | mov                 byte ptr [edi], al
            //   83c701               | add                 edi, 1
            //   897d08               | mov                 dword ptr [ebp + 8], edi
            //   80f93d               | cmp                 cl, 0x3d

        $sequence_9 = { 89c2 c1ea08 8855f6 8845f7 c1e803 83e03f 83f837 }
            // n = 7, score = 100
            //   89c2                 | mov                 edx, eax
            //   c1ea08               | shr                 edx, 8
            //   8855f6               | mov                 byte ptr [ebp - 0xa], dl
            //   8845f7               | mov                 byte ptr [ebp - 9], al
            //   c1e803               | shr                 eax, 3
            //   83e03f               | and                 eax, 0x3f
            //   83f837               | cmp                 eax, 0x37

    condition:
        7 of them and filesize < 248832
}