rule win_rhysida_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.rhysida."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ba28000000 4889c1 e8???????? 8945f8 837df800 7407 b804000000 }
            // n = 7, score = 300
            //   ba28000000           | dec                 ebp
            //   4889c1               | lea                 edx, [eax + 0x10]
            //   e8????????           |                     
            //   8945f8               | inc                 ebp
            //   837df800             | mov                 ebx, esi
            //   7407                 | inc                 ecx
            //   b804000000           | sub                 ebx, edi

        $sequence_1 = { 4863d0 488b4510 4801d0 0fb600 0fb6c0 8b55f4 c1ea06 }
            // n = 7, score = 300
            //   4863d0               | ucomiss             xmm0, xmm1
            //   488b4510             | jbe                 0xd48
            //   4801d0               | dec                 eax
            //   0fb600               | mov                 eax, dword ptr [ebp + 0x28]
            //   0fb6c0               | movss               xmm0, dword ptr [eax + 0x1c]
            //   8b55f4               | subss               xmm0, dword ptr [ebp + 0x30]
            //   c1ea06               | movss               xmm0, dword ptr [ebp - 0x34]

        $sequence_2 = { f6431920 0f84c7feffff 4983c101 e9???????? 4531c0 4889f2 89e9 }
            // n = 7, score = 300
            //   f6431920             | inc                 ecx
            //   0f84c7feffff         | mov                 eax, 0x4f3
            //   4983c101             | dec                 eax
            //   e9????????           |                     
            //   4531c0               | lea                 edx, [0x68369]
            //   4889f2               | dec                 eax
            //   89e9                 | lea                 ecx, [0x683b2]

        $sequence_3 = { 8b45fc 4863c8 4889c8 48c1e002 4801c8 48c1e003 4889c1 }
            // n = 7, score = 300
            //   8b45fc               | mov                 ecx, ecx
            //   4863c8               | inc                 ecx
            //   4889c8               | mov                 eax, 1
            //   48c1e002             | dec                 eax
            //   4801c8               | mov                 ecx, eax
            //   48c1e003             | mov                 dword ptr [ebp + 0x10326c], eax
            //   4889c1               | cmp                 dword ptr [ebp + 0x10326c], 1

        $sequence_4 = { baafa96e5e 89c8 f7ea c1fa0b 89c8 c1f81f 29c2 }
            // n = 7, score = 300
            //   baafa96e5e           | lea                 esi, [0x3e089]
            //   89c8                 | dec                 eax
            //   f7ea                 | lea                 ecx, [0x3d482]
            //   c1fa0b               | dec                 esp
            //   89c8                 | lea                 edx, [0x3dc7b]
            //   c1f81f               | dec                 esp
            //   29c2                 | lea                 eax, [0x3d874]

        $sequence_5 = { 8b45f8 4863d0 488b4510 4801d0 0fb600 0fb6d0 8b45f8 }
            // n = 7, score = 300
            //   8b45f8               | mov                 eax, eax
            //   4863d0               | dec                 eax
            //   488b4510             | shrd                eax, edx, 0x3c
            //   4801d0               | dec                 ebp
            //   0fb600               | and                 eax, edi
            //   0fb6d0               | dec                 esp
            //   8b45f8               | mov                 dword ptr [ecx], eax

        $sequence_6 = { e8???????? eb01 90 8b45f0 0faf45b8 89c2 488d45a0 }
            // n = 7, score = 300
            //   e8????????           |                     
            //   eb01                 | punpcklwd           mm1, mm5
            //   90                   | inc                 sp
            //   8b45f0               | punpcklwd           mm7, mm3
            //   0faf45b8             | movdqa              xmm2, xmm1
            //   89c2                 | inc                 bp
            //   488d45a0             | punpcklwd           mm3, mm4

        $sequence_7 = { 85c0 74da 85db 4889742428 0f848d010000 8d4bff 488d742460 }
            // n = 7, score = 300
            //   85c0                 | mov                 eax, dword ptr [ebp - 0x10]
            //   74da                 | lea                 ecx, [eax - 1]
            //   85db                 | mov                 eax, dword ptr [ebp - 0xc]
            //   4889742428           | sub                 eax, dword ptr [ebp - 8]
            //   0f848d010000         | dec                 eax
            //   8d4bff               | lea                 edx, [eax*4]
            //   488d742460           | dec                 eax

        $sequence_8 = { c1e903 f348ab ff15???????? 83f812 7472 488b8b38020000 e8???????? }
            // n = 7, score = 300
            //   c1e903               | mov                 eax, ebx
            //   f348ab               | dec                 esp
            //   ff15????????         |                     
            //   83f812               | lea                 esp, [esp + 0x40]
            //   7472                 | dec                 esp
            //   488b8b38020000       | mov                 ecx, esp
            //   e8????????           |                     

        $sequence_9 = { 5f 5d 415c 415d c3 b80d000000 ebd7 }
            // n = 7, score = 300
            //   5f                   | mov                 ecx, dword ptr [ebp + 0x28]
            //   5d                   | dec                 eax
            //   415c                 | mov                 ebp, esp
            //   415d                 | dec                 eax
            //   c3                   | sub                 esp, 0x50
            //   b80d000000           | dec                 eax
            //   ebd7                 | mov                 dword ptr [ebp + 0x10], ecx

    condition:
        7 of them and filesize < 2369536
}