rule win_shadow_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.shadow_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadow_rat"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 48634804 488d05faec0300 48890439 488b07 }
            // n = 4, score = 100
            //   48634804             | jmp                 0x70
            //   488d05faec0300       | inc                 ecx
            //   48890439             | call                dword ptr [eax]
            //   488b07               | inc                 esp

        $sequence_1 = { 488d05cb2c0300 eb04 4883c020 4883c428 c3 48895c2408 48896c2410 }
            // n = 7, score = 100
            //   488d05cb2c0300       | lea                 ecx, [ebp - 0x60]
            //   eb04                 | dec                 eax
            //   4883c020             | arpl                word ptr [eax + 4], cx
            //   4883c428             | dec                 eax
            //   c3                   | mov                 eax, dword ptr [ebp + ecx - 0x40]
            //   48895c2408           | dec                 eax
            //   48896c2410           | mov                 ecx, dword ptr [eax + 8]

        $sequence_2 = { 4883f81f 0f87b20c0000 e8???????? 90 488b9588000000 4883fa0f 0f86630b0000 }
            // n = 7, score = 100
            //   4883f81f             | mov                 dword ptr [ebp + 0x80], esp
            //   0f87b20c0000         | dec                 eax
            //   e8????????           |                     
            //   90                   | mov                 dword ptr [ebp + 0x88], 0xf
            //   488b9588000000       | inc                 esp
            //   4883fa0f             | mov                 byte ptr [ebp + 0x70], ah
            //   0f86630b0000         | movups              xmm0, xmmword ptr [ebx]

        $sequence_3 = { 4d3bf8 755e 488bcf 493bc0 744e 488d5018 4c8bcf }
            // n = 7, score = 100
            //   4d3bf8               | dec                 eax
            //   755e                 | mov                 edi, ecx
            //   488bcf               | xorps               xmm0, xmm0
            //   493bc0               | movups              xmmword ptr [edx], xmm0
            //   744e                 | dec                 eax
            //   488d5018             | lea                 ecx, [ebx + 8]
            //   4c8bcf               | dec                 eax

        $sequence_4 = { 488d3d97380200 eb10 488d3d9e380200 eb07 488d3d7d380200 4533ed 4584f6 }
            // n = 7, score = 100
            //   488d3d97380200       | lea                 eax, [esi + edi]
            //   eb10                 | dec                 eax
            //   488d3d9e380200       | mov                 dword ptr [esp + 0x28], eax
            //   eb07                 | dec                 eax
            //   488d3d7d380200       | lea                 esi, [eax + 0x20]
            //   4533ed               | dec                 eax
            //   4584f6               | mov                 dword ptr [esp + 0x40], esi

        $sequence_5 = { 4883ec70 488bf1 488d050d780400 4533ed 418bfd 4489ac24b8000000 }
            // n = 6, score = 100
            //   4883ec70             | dec                 esp
            //   488bf1               | lea                 edi, [0xfffea774]
            //   488d050d780400       | dec                 eax
            //   4533ed               | add                 edx, dword ptr [ebp + 8]
            //   418bfd               | je                  0x4e5
            //   4489ac24b8000000     | inc                 esp

        $sequence_6 = { 488d05faec0300 48890439 488b07 48634804 8d9150ffffff 895439fc 48895c2458 }
            // n = 7, score = 100
            //   488d05faec0300       | dec                 eax
            //   48890439             | mov                 dword ptr [ecx + edi], eax
            //   488b07               | dec                 eax
            //   48634804             | mov                 eax, dword ptr [edi]
            //   8d9150ffffff         | dec                 eax
            //   895439fc             | arpl                word ptr [eax + 4], cx
            //   48895c2458           | lea                 edx, [ecx - 0xb0]

        $sequence_7 = { 488b07 48634804 8d9150ffffff 895439fc 48895c2458 488bcb }
            // n = 6, score = 100
            //   488b07               | push                ebx
            //   48634804             | dec                 eax
            //   8d9150ffffff         | sub                 esp, 0x20
            //   895439fc             | dec                 eax
            //   48895c2458           | mov                 ebx, ecx
            //   488bcb               | dec                 eax

        $sequence_8 = { 41b802000000 488d1526610400 488bc8 e8???????? }
            // n = 4, score = 100
            //   41b802000000         | je                  0x24d
            //   488d1526610400       | dec                 eax
            //   488bc8               | arpl                word ptr [edi + 8], dx
            //   e8????????           |                     

        $sequence_9 = { 83cdff 498bd8 83791000 4c8bd2 0f84ac000000 4c634910 4c8d35f5c3feff }
            // n = 7, score = 100
            //   83cdff               | dec                 ecx
            //   498bd8               | mov                 ecx, eax
            //   83791000             | and                 ecx, 0x3f
            //   4c8bd2               | dec                 eax
            //   0f84ac000000         | lea                 ecx, [ecx + ecx*8]
            //   4c634910             | dec                 ecx
            //   4c8d35f5c3feff       | mov                 eax, dword ptr [edx + eax*8]

    condition:
        7 of them and filesize < 727040
}