rule win_session_manager_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.session_manager."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4c89b8d8080000 4c89b8e0080000 4c89b8e8080000 4c89b8f0080000 }
            // n = 4, score = 100
            //   4c89b8d8080000       | dec                 esp
            //   4c89b8e0080000       | mov                 dword ptr [eax + 0x1558], edi
            //   4c89b8e8080000       | dec                 esp
            //   4c89b8f0080000       | mov                 dword ptr [eax + 0x1560], edi

        $sequence_1 = { 4c89b898220000 4c89b8a0220000 4c89b8a8220000 4c89b8b0220000 4c89b8b8220000 4c89b8c0220000 }
            // n = 6, score = 100
            //   4c89b898220000       | je                  0x60
            //   4c89b8a0220000       | jne                 0x73
            //   4c89b8a8220000       | dec                 eax
            //   4c89b8b0220000       | lea                 eax, [0x18ba7]
            //   4c89b8b8220000       | dec                 edx
            //   4c89b8c0220000       | mov                 eax, dword ptr [eax + ebp*8]

        $sequence_2 = { 4885c9 741e 83c8ff f00fc101 83f801 7512 488d05be730100 }
            // n = 7, score = 100
            //   4885c9               | dec                 esp
            //   741e                 | mov                 dword ptr [eax + 0x2330], edi
            //   83c8ff               | dec                 esp
            //   f00fc101             | mov                 dword ptr [eax + 0x2338], edi
            //   83f801               | dec                 esp
            //   7512                 | mov                 dword ptr [eax + 0x2340], edi
            //   488d05be730100       | dec                 esp

        $sequence_3 = { 0f8239010000 48ffc0 488b4df7 483d00100000 0f8221010000 f6c11f }
            // n = 6, score = 100
            //   0f8239010000         | mov                 dword ptr [eax + 0x2020], edi
            //   48ffc0               | dec                 esp
            //   488b4df7             | mov                 dword ptr [eax + 0x2028], edi
            //   483d00100000         | dec                 esp
            //   0f8221010000         | mov                 dword ptr [eax + 0x2030], edi
            //   f6c11f               | dec                 esp

        $sequence_4 = { 4c89b8b8240000 4c89b8c0240000 4c89b8c8240000 4c89b8d0240000 4c89b8d8240000 4c89b8e0240000 4c89b8e8240000 }
            // n = 7, score = 100
            //   4c89b8b8240000       | dec                 esp
            //   4c89b8c0240000       | mov                 dword ptr [eax + 0x3f8], edi
            //   4c89b8c8240000       | dec                 esp
            //   4c89b8d0240000       | mov                 dword ptr [eax + 0x400], edi
            //   4c89b8d8240000       | dec                 esp
            //   4c89b8e0240000       | mov                 dword ptr [eax + 0x408], edi
            //   4c89b8e8240000       | dec                 esp

        $sequence_5 = { 498b06 498bce ff5018 4c8b08 4533c0 488d15f71a0200 488bc8 }
            // n = 7, score = 100
            //   498b06               | dec                 esp
            //   498bce               | mov                 dword ptr [eax + 0x188], edi
            //   ff5018               | dec                 esp
            //   4c8b08               | mov                 dword ptr [eax + 0x190], edi
            //   4533c0               | dec                 esp
            //   488d15f71a0200       | mov                 dword ptr [eax + 0x198], edi
            //   488bc8               | dec                 esp

        $sequence_6 = { 4c89b830160000 4c89b838160000 4c89b840160000 4c89b848160000 4c89b850160000 }
            // n = 5, score = 100
            //   4c89b830160000       | mov                 eax, dword ptr [esp + 0x44]
            //   4c89b838160000       | dec                 esp
            //   4c89b840160000       | mov                 ecx, esi
            //   4c89b848160000       | mov                 edx, 1
            //   4c89b850160000       | inc                 ecx

        $sequence_7 = { 488bd0 488d4d68 e8???????? 488d8de8000000 e8???????? }
            // n = 5, score = 100
            //   488bd0               | dec                 esp
            //   488d4d68             | mov                 dword ptr [eax + 0x600], edi
            //   e8????????           |                     
            //   488d8de8000000       | dec                 esp
            //   e8????????           |                     

        $sequence_8 = { 33c0 498be8 4c8d0d7b55ffff 4c8bea f04f0fb1bcf100830200 4c8b05???????? 4883cfff }
            // n = 7, score = 100
            //   33c0                 | lea                 ebx, [0x147f8]
            //   498be8               | jmp                 0xa00
            //   4c8d0d7b55ffff       | dec                 eax
            //   4c8bea               | lea                 ebx, [0x147ff]
            //   f04f0fb1bcf100830200     | jmp    0xa00
            //   4c8b05????????       |                     
            //   4883cfff             | dec                 eax

        $sequence_9 = { 4c89b838080000 4c89b840080000 4c89b848080000 4c89b850080000 4c89b858080000 4c89b860080000 }
            // n = 6, score = 100
            //   4c89b838080000       | mov                 dword ptr [eax + 0xde8], edi
            //   4c89b840080000       | dec                 esp
            //   4c89b848080000       | mov                 dword ptr [eax + 0xec8], edi
            //   4c89b850080000       | dec                 esp
            //   4c89b858080000       | mov                 dword ptr [eax + 0xed0], edi
            //   4c89b860080000       | dec                 esp

    condition:
        7 of them and filesize < 372736
}