rule win_rokku_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.rokku."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokku"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bcf 0facc808 33d2 c1e618 0bd0 c1e908 }
            // n = 6, score = 200
            //   8bcf                 | mov                 ecx, edi
            //   0facc808             | shrd                eax, ecx, 8
            //   33d2                 | xor                 edx, edx
            //   c1e618               | shl                 esi, 0x18
            //   0bd0                 | or                  edx, eax
            //   c1e908               | shr                 ecx, 8

        $sequence_1 = { 53 bfe9fd0000 8bf2 57 }
            // n = 4, score = 200
            //   53                   | push                ebx
            //   bfe9fd0000           | mov                 edi, 0xfde9
            //   8bf2                 | mov                 esi, edx
            //   57                   | push                edi

        $sequence_2 = { 0f85e3feffff 8b7c2424 8d442430 33d2 52 52 }
            // n = 6, score = 200
            //   0f85e3feffff         | jne                 0xfffffee9
            //   8b7c2424             | mov                 edi, dword ptr [esp + 0x24]
            //   8d442430             | lea                 eax, [esp + 0x30]
            //   33d2                 | xor                 edx, edx
            //   52                   | push                edx
            //   52                   | push                edx

        $sequence_3 = { f76c2438 03e8 8b442474 13da f76c2448 03e8 13da }
            // n = 7, score = 200
            //   f76c2438             | imul                dword ptr [esp + 0x38]
            //   03e8                 | add                 ebp, eax
            //   8b442474             | mov                 eax, dword ptr [esp + 0x74]
            //   13da                 | adc                 ebx, edx
            //   f76c2448             | imul                dword ptr [esp + 0x48]
            //   03e8                 | add                 ebp, eax
            //   13da                 | adc                 ebx, edx

        $sequence_4 = { 8b44240c 56 8b721c 57 8b4824 f7de }
            // n = 6, score = 200
            //   8b44240c             | mov                 eax, dword ptr [esp + 0xc]
            //   56                   | push                esi
            //   8b721c               | mov                 esi, dword ptr [edx + 0x1c]
            //   57                   | push                edi
            //   8b4824               | mov                 ecx, dword ptr [eax + 0x24]
            //   f7de                 | neg                 esi

        $sequence_5 = { 7509 83433801 7503 ff433c 5f 5e 5d }
            // n = 7, score = 200
            //   7509                 | jne                 0xb
            //   83433801             | add                 dword ptr [ebx + 0x38], 1
            //   7503                 | jne                 5
            //   ff433c               | inc                 dword ptr [ebx + 0x3c]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp

        $sequence_6 = { 0facf919 8bea ba42db0100 c1ff19 897c2430 8bf8 8b442410 }
            // n = 7, score = 200
            //   0facf919             | shrd                ecx, edi, 0x19
            //   8bea                 | mov                 ebp, edx
            //   ba42db0100           | mov                 edx, 0x1db42
            //   c1ff19               | sar                 edi, 0x19
            //   897c2430             | mov                 dword ptr [esp + 0x30], edi
            //   8bf8                 | mov                 edi, eax
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]

        $sequence_7 = { f76c2438 898c24c0000000 8bf8 8bea 8b44246c f76c2460 03f8 }
            // n = 7, score = 200
            //   f76c2438             | imul                dword ptr [esp + 0x38]
            //   898c24c0000000       | mov                 dword ptr [esp + 0xc0], ecx
            //   8bf8                 | mov                 edi, eax
            //   8bea                 | mov                 ebp, edx
            //   8b44246c             | mov                 eax, dword ptr [esp + 0x6c]
            //   f76c2460             | imul                dword ptr [esp + 0x60]
            //   03f8                 | add                 edi, eax

        $sequence_8 = { 8b442468 894d18 8b4c2418 0fa4c119 8b4c244c c1e019 2bf8 }
            // n = 7, score = 200
            //   8b442468             | mov                 eax, dword ptr [esp + 0x68]
            //   894d18               | mov                 dword ptr [ebp + 0x18], ecx
            //   8b4c2418             | mov                 ecx, dword ptr [esp + 0x18]
            //   0fa4c119             | shld                ecx, eax, 0x19
            //   8b4c244c             | mov                 ecx, dword ptr [esp + 0x4c]
            //   c1e019               | shl                 eax, 0x19
            //   2bf8                 | sub                 edi, eax

        $sequence_9 = { 397218 744c 8b5a30 8be9 0fbe7d00 45 0fb70b }
            // n = 7, score = 200
            //   397218               | cmp                 dword ptr [edx + 0x18], esi
            //   744c                 | je                  0x4e
            //   8b5a30               | mov                 ebx, dword ptr [edx + 0x30]
            //   8be9                 | mov                 ebp, ecx
            //   0fbe7d00             | movsx               edi, byte ptr [ebp]
            //   45                   | inc                 ebp
            //   0fb70b               | movzx               ecx, word ptr [ebx]

    condition:
        7 of them and filesize < 548864
}