rule win_sdbbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.sdbbot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 03c6 8945e4 8b4804 85c9 0f8495000000 8b30 }
            // n = 6, score = 700
            //   03c6                 | add                 eax, esi
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   85c9                 | test                ecx, ecx
            //   0f8495000000         | je                  0x9b
            //   8b30                 | mov                 esi, dword ptr [eax]

        $sequence_1 = { 03c3 eb0f 8b07 83c202 03c2 50 }
            // n = 6, score = 700
            //   03c3                 | add                 eax, ebx
            //   eb0f                 | jmp                 0x11
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   83c202               | add                 edx, 2
            //   03c2                 | add                 eax, edx
            //   50                   | push                eax

        $sequence_2 = { 0f8560ffffff 8b5df0 8b7328 8b5dfc }
            // n = 4, score = 700
            //   0f8560ffffff         | jne                 0xffffff66
            //   8b5df0               | mov                 ebx, dword ptr [ebp - 0x10]
            //   8b7328               | mov                 esi, dword ptr [ebx + 0x28]
            //   8b5dfc               | mov                 ebx, dword ptr [ebp - 4]

        $sequence_3 = { 8945e4 eb1e 3d54caaf91 7509 }
            // n = 4, score = 700
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   eb1e                 | jmp                 0x20
            //   3d54caaf91           | cmp                 eax, 0x91afca54
            //   7509                 | jne                 0xb

        $sequence_4 = { 8b5b10 8b433c 8b441878 03c3 8945dc 8b7820 8b7024 }
            // n = 7, score = 700
            //   8b5b10               | mov                 ebx, dword ptr [ebx + 0x10]
            //   8b433c               | mov                 eax, dword ptr [ebx + 0x3c]
            //   8b441878             | mov                 eax, dword ptr [eax + ebx + 0x78]
            //   03c3                 | add                 eax, ebx
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax
            //   8b7820               | mov                 edi, dword ptr [eax + 0x20]
            //   8b7024               | mov                 esi, dword ptr [eax + 0x24]

        $sequence_5 = { 8b0e 85c9 791c 8b433c 0fb7c9 8b441878 2b4c1810 }
            // n = 7, score = 700
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   85c9                 | test                ecx, ecx
            //   791c                 | jns                 0x1e
            //   8b433c               | mov                 eax, dword ptr [ebx + 0x3c]
            //   0fb7c9               | movzx               ecx, cx
            //   8b441878             | mov                 eax, dword ptr [eax + ebx + 0x78]
            //   2b4c1810             | sub                 ecx, dword ptr [eax + ebx + 0x10]

        $sequence_6 = { 83c704 83c602 6685c0 75aa 8b5df4 837de800 7416 }
            // n = 7, score = 700
            //   83c704               | add                 edi, 4
            //   83c602               | add                 esi, 2
            //   6685c0               | test                ax, ax
            //   75aa                 | jne                 0xffffffac
            //   8b5df4               | mov                 ebx, dword ptr [ebp - 0xc]
            //   837de800             | cmp                 dword ptr [ebp - 0x18], 0
            //   7416                 | je                  0x18

        $sequence_7 = { 50 ff55e8 8bd8 85db 7460 8b37 8b55fc }
            // n = 7, score = 700
            //   50                   | push                eax
            //   ff55e8               | call                dword ptr [ebp - 0x18]
            //   8bd8                 | mov                 ebx, eax
            //   85db                 | test                ebx, ebx
            //   7460                 | je                  0x62
            //   8b37                 | mov                 esi, dword ptr [edi]
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]

        $sequence_8 = { c3 803d????????00 750c c605????????01 }
            // n = 4, score = 400
            //   c3                   | ret                 
            //   803d????????00       |                     
            //   750c                 | jne                 0xe
            //   c605????????01       |                     

        $sequence_9 = { 4181f854caaf91 7508 8b3491 4903f1 eb0f }
            // n = 5, score = 300
            //   4181f854caaf91       | inc                 ebp
            //   7508                 | xor                 esp, esp
            //   8b3491               | dec                 esp
            //   4903f1               | mov                 dword ptr [esp + 0x28], ebp
            //   eb0f                 | xor                 ebp, ebp

        $sequence_10 = { 4a8d0c00 498bc1 48c1e810 660101 eb10 }
            // n = 5, score = 300
            //   4a8d0c00             | dec                 esp
            //   498bc1               | mov                 dword ptr [esp + 0x80], esi
            //   48c1e810             | dec                 eax
            //   660101               | mov                 dword ptr [esp + 0x78], ebx
            //   eb10                 | inc                 ecx

        $sequence_11 = { 56 8d8424b0000000 50 ff542468 83f8ff }
            // n = 5, score = 300
            //   56                   | test                edi, edi
            //   8d8424b0000000       | jne                 0xfffffe1c
            //   50                   | dec                 esp
            //   ff542468             | mov                 ebp, dword ptr [esp + 0x88]
            //   83f8ff               | dec                 ebp

        $sequence_12 = { 4c89642430 33f6 4533e4 4c896c2428 33ed 4c89b42480000000 48895c2478 }
            // n = 7, score = 300
            //   4c89642430           | sub                 ecx, dword ptr [edi + 0x30]
            //   33f6                 | dec                 esp
            //   4533e4               | mov                 ebp, dword ptr [esp + 0x28]
            //   4c896c2428           | dec                 esp
            //   33ed                 | mov                 esp, dword ptr [esp + 0x30]
            //   4c89b42480000000     | dec                 eax
            //   48895c2478           | mov                 esi, dword ptr [esp + 0x40]

        $sequence_13 = { 7405 49ffcd ebd9 65488b042560000000 41bb01000000 }
            // n = 5, score = 300
            //   7405                 | mov                 ebx, dword ptr [ebp - 4]
            //   49ffcd               | add                 esi, ebx
            //   ebd9                 | push                0
            //   65488b042560000000     | movzx    edi, byte ptr [esi]
            //   41bb01000000         | ror                 ecx, 0xd

        $sequence_14 = { 4181f854caaf91 7409 4181f8f232f60e 7554 428b4c0f1c 410fb713 }
            // n = 6, score = 300
            //   4181f854caaf91       | inc                 ecx
            //   7409                 | cmp                 eax, 0x91afca54
            //   4181f8f232f60e       | je                  0xb
            //   7554                 | inc                 ecx
            //   428b4c0f1c           | cmp                 eax, 0xef632f2
            //   410fb713             | jne                 0x56

        $sequence_15 = { 4d2b4f30 4c8b6c2428 4c8b642430 488b742440 488b6c2448 }
            // n = 5, score = 300
            //   4d2b4f30             | inc                 edx
            //   4c8b6c2428           | mov                 ecx, dword ptr [edi + ecx + 0x1c]
            //   4c8b642430           | inc                 ecx
            //   488b742440           | movzx               edx, word ptr [ebx]
            //   488b6c2448           | dec                 ebp

        $sequence_16 = { 750c 4d8b3f 4d85ff 0f850efeffff 4c8bac2488000000 4d637d3c 33c9 }
            // n = 7, score = 300
            //   750c                 | mov                 ebp, dword ptr [edi + 0x90]
            //   4d8b3f               | dec                 ecx
            //   4d85ff               | add                 ebp, esi
            //   0f850efeffff         | cmp                 dword ptr [ebp], 0
            //   4c8bac2488000000     | je                  0xaf
            //   4d637d3c             | dec                 esp
            //   33c9                 | mov                 ebp, dword ptr [esp + 0x80]

        $sequence_17 = { 418baf90000000 4903ee 837d0000 0f849b000000 4c8bac2480000000 }
            // n = 5, score = 300
            //   418baf90000000       | dec                 eax
            //   4903ee               | mov                 ebp, dword ptr [esp + 0x48]
            //   837d0000             | dec                 esp
            //   0f849b000000         | mov                 dword ptr [esp + 0x30], esp
            //   4c8bac2480000000     | xor                 esi, esi

    condition:
        7 of them and filesize < 1015808
}