rule win_sdbbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6683f803 750b 81e1ff0f0000 013c31 eb27 }
            // n = 5, score = 700
            //   6683f803             | cmp                 ax, 3
            //   750b                 | jne                 0xd
            //   81e1ff0f0000         | and                 ecx, 0xfff
            //   013c31               | add                 dword ptr [ecx + esi], edi
            //   eb27                 | jmp                 0x29

        $sequence_1 = { 895df0 ff7350 6a00 ff55f4 ff7350 8bf0 }
            // n = 6, score = 700
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   ff7350               | push                dword ptr [ebx + 0x50]
            //   6a00                 | push                0
            //   ff55f4               | call                dword ptr [ebp - 0xc]
            //   ff7350               | push                dword ptr [ebx + 0x50]
            //   8bf0                 | mov                 esi, eax

        $sequence_2 = { 03d3 33c9 8a02 660f1f440000 }
            // n = 4, score = 700
            //   03d3                 | add                 edx, ebx
            //   33c9                 | xor                 ecx, ecx
            //   8a02                 | mov                 al, byte ptr [edx]
            //   660f1f440000         | nop                 word ptr [eax + eax]

        $sequence_3 = { 8b45e8 83c002 8945e8 85db 759d 8b45e4 8b55ec }
            // n = 7, score = 700
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]
            //   83c002               | add                 eax, 2
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   85db                 | test                ebx, ebx
            //   759d                 | jne                 0xffffff9f
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]

        $sequence_4 = { 7516 8b4f3c 8d41c0 3dbf030000 7709 813c3950450000 7403 }
            // n = 7, score = 700
            //   7516                 | jne                 0x18
            //   8b4f3c               | mov                 ecx, dword ptr [edi + 0x3c]
            //   8d41c0               | lea                 eax, [ecx - 0x40]
            //   3dbf030000           | cmp                 eax, 0x3bf
            //   7709                 | ja                  0xb
            //   813c3950450000       | cmp                 dword ptr [ecx + edi], 0x4550
            //   7403                 | je                  5

        $sequence_5 = { 8b470c 03c6 50 ff55e8 }
            // n = 4, score = 700
            //   8b470c               | mov                 eax, dword ptr [edi + 0xc]
            //   03c6                 | add                 eax, esi
            //   50                   | push                eax
            //   ff55e8               | call                dword ptr [ebp - 0x18]

        $sequence_6 = { 03cf 46 6685d2 75e4 81f95bbc4a6a 0f85cf000000 }
            // n = 6, score = 700
            //   03cf                 | add                 ecx, edi
            //   46                   | inc                 esi
            //   6685d2               | test                dx, dx
            //   75e4                 | jne                 0xffffffe6
            //   81f95bbc4a6a         | cmp                 ecx, 0x6a4abc5b
            //   0f85cf000000         | jne                 0xd5

        $sequence_7 = { 66c1e80c 6683f80a 750b 81e2ff0f0000 013c32 eb38 }
            // n = 6, score = 700
            //   66c1e80c             | shr                 ax, 0xc
            //   6683f80a             | cmp                 ax, 0xa
            //   750b                 | jne                 0xd
            //   81e2ff0f0000         | and                 edx, 0xfff
            //   013c32               | add                 dword ptr [edx + esi], edi
            //   eb38                 | jmp                 0x3a

        $sequence_8 = { 4156 4157 4883ec50 48896c2448 4533f6 }
            // n = 5, score = 300
            //   4156                 | add                 edx, ecx
            //   4157                 | dec                 ebp
            //   4883ec50             | add                 ebx, ecx
            //   48896c2448           | inc                 ecx
            //   4533f6               | mov                 ecx, dword ptr [edx]

        $sequence_9 = { 498bcd 4885d2 7417 4d8bc6 4d2bc5 }
            // n = 5, score = 300
            //   498bcd               | dec                 ecx
            //   4885d2               | add                 edi, edx
            //   7417                 | dec                 eax
            //   4d8bc6               | mov                 dword ptr [esp + 0x78], edi
            //   4d2bc5               | dec                 ecx

        $sequence_10 = { ffd6 418b5750 488bc8 4c8bf0 }
            // n = 4, score = 300
            //   ffd6                 | sub                 eax, ebp
            //   418b5750             | inc                 esi
            //   488bc8               | mov                 ebx, dword ptr [edi + ecx + 0x24]
            //   4c8bf0               | dec                 ebp

        $sequence_11 = { 410fb711 4903ca 8b3c91 4903fa 48897c2478 }
            // n = 5, score = 300
            //   410fb711             | inc                 ecx
            //   4903ca               | movzx               edx, word ptr [ecx]
            //   8b3c91               | dec                 ecx
            //   4903fa               | add                 ecx, edx
            //   48897c2478           | mov                 edi, dword ptr [ecx + edx*4]

        $sequence_12 = { 75ed 81f9b80a4c53 751b 428b4c131c 410fb711 }
            // n = 5, score = 300
            //   75ed                 | inc                 ecx
            //   81f9b80a4c53         | mov                 edx, dword ptr [edi + 0x50]
            //   751b                 | dec                 eax
            //   428b4c131c           | mov                 ecx, eax
            //   410fb711             | dec                 esp

        $sequence_13 = { 468b5c0f24 4d03d1 4d03d9 418b0a 4903c9 4533c0 0fb601 }
            // n = 7, score = 300
            //   468b5c0f24           | mov                 ecx, ebp
            //   4d03d1               | dec                 eax
            //   4d03d9               | test                edx, edx
            //   418b0a               | je                  0x1c
            //   4903c9               | dec                 ebp
            //   4533c0               | mov                 eax, esi
            //   0fb601               | dec                 ebp

        $sequence_14 = { 488d4901 4883ea01 75ef 450fb74f14 450fb75706 4983c12c }
            // n = 6, score = 300
            //   488d4901             | sub                 esp, 0x50
            //   4883ea01             | dec                 eax
            //   75ef                 | mov                 dword ptr [esp + 0x48], ebp
            //   450fb74f14           | inc                 ebp
            //   450fb75706           | xor                 esi, esi
            //   4983c12c             | dec                 eax

        $sequence_15 = { eb10 488b17 488bce 4883c202 4903d6 41ffd4 488907 }
            // n = 7, score = 300
            //   eb10                 | sub                 esp, 0x50
            //   488b17               | dec                 eax
            //   488bce               | mov                 dword ptr [esp + 0x48], ebp
            //   4883c202             | inc                 ebp
            //   4903d6               | xor                 esi, esi
            //   41ffd4               | dec                 eax
            //   488907               | mov                 dword ptr [esp + 0x40], esi

    condition:
        7 of them and filesize < 1015808
}