rule win_skynet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.skynet."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skynet"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4c29f2 4839da 0f82fc020000 4d39f9 0f8484020000 488b9424a0000000 4839fa }
            // n = 7, score = 100
            //   4c29f2               | mov                 ebp, dword ptr [ecx + 8]
            //   4839da               | dec                 esp
            //   0f82fc020000         | mov                 esi, dword ptr [esp + 0x108]
            //   4d39f9               | dec                 eax
            //   0f8484020000         | mov                 esi, ecx
            //   488b9424a0000000     | dec                 eax
            //   4839fa               | lea                 ecx, [0x90e985]

        $sequence_1 = { 4883c102 0f8818080000 4c8da424a0000000 e8???????? 4c8bbc24a0000000 4989c4 }
            // n = 6, score = 100
            //   4883c102             | dec                 eax
            //   0f8818080000         | add                 eax, 0x10
            //   4c8da424a0000000     | dec                 eax
            //   e8????????           |                     
            //   4c8bbc24a0000000     | mov                 dword ptr [ebx + 0x10], eax
            //   4989c4               | dec                 eax

        $sequence_2 = { 488d1524788a00 48c7401800000000 48895010 c6402000 c640482e 488b4310 c640492c }
            // n = 7, score = 100
            //   488d1524788a00       | dec                 eax
            //   48c7401800000000     | mov                 dword ptr [ebx], eax
            //   48895010             | cmp                 byte ptr [esi], 0x43
            //   c6402000             | jne                 0x1342
            //   c640482e             | dec                 eax
            //   488b4310             | lea                 eax, [0x8d8af7]
            //   c640492c             | dec                 eax

        $sequence_3 = { 4889f3 e8???????? 4c89e9 e8???????? e9???????? 4889d9 4889f3 }
            // n = 7, score = 100
            //   4889f3               | lea                 eax, [0x8abd06]
            //   e8????????           |                     
            //   4c89e9               | dec                 eax
            //   e8????????           |                     
            //   e9????????           |                     
            //   4889d9               | mov                 dword ptr [ebx], eax
            //   4889f3               | dec                 eax

        $sequence_4 = { e8???????? 4883f8ff 0f84b2feffff f30f6f8398000000 488b5370 31c0 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   4883f8ff             | test                al, 3
            //   0f84b2feffff         | jne                 0x11d4
            //   f30f6f8398000000     | dec                 eax
            //   488b5370             | lea                 ecx, [esp + 0x20]
            //   31c0                 | dec                 eax

        $sequence_5 = { 4889ea 4889f1 e8???????? 488b0b 4c8b842488000000 488dbc2490000000 488b842480000000 }
            // n = 7, score = 100
            //   4889ea               | dec                 eax
            //   4889f1               | mov                 dword ptr [esi], eax
            //   e8????????           |                     
            //   488b0b               | lock add            dword ptr [ebx + 8], 1
            //   4c8b842488000000     | dec                 eax
            //   488dbc2490000000     | lea                 eax, [0x95222e]
            //   488b842480000000     | dec                 eax

        $sequence_6 = { 5e c3 4989d0 4989d9 488d159e039500 488d0d08039500 e8???????? }
            // n = 7, score = 100
            //   5e                   | dec                 eax
            //   c3                   | sub                 esp, 0x28
            //   4989d0               | dec                 eax
            //   4989d9               | lea                 edi, [0x952a29]
            //   488d159e039500       | dec                 eax
            //   488d0d08039500       | mov                 dword ptr [edx], 0
            //   e8????????           |                     

        $sequence_7 = { c7000b000000 48895008 c3 488d1551e89400 c7001b000000 48895008 c3 }
            // n = 7, score = 100
            //   c7000b000000         | dec                 eax
            //   48895008             | lea                 ecx, [eax + 1]
            //   c3                   | movzx               eax, byte ptr [edx]
            //   488d1551e89400       | mov                 byte ptr [ecx], al
            //   c7001b000000         | dec                 esp
            //   48895008             | mov                 edx, dword ptr [esp + 0x38]
            //   c3                   | mov                 ecx, 0x20

        $sequence_8 = { e9???????? e8???????? 31d2 e9???????? 488d0d4dd29700 e8???????? }
            // n = 6, score = 100
            //   e9????????           |                     
            //   e8????????           |                     
            //   31d2                 | dec                 eax
            //   e9????????           |                     
            //   488d0d4dd29700       | lea                 ecx, [0x97257b]
            //   e8????????           |                     

        $sequence_9 = { 89542428 8b5520 89542420 4d89c1 4989c8 89c2 488d0554e09500 }
            // n = 7, score = 100
            //   89542428             | mov                 byte ptr [esi + edx + 1], al
            //   8b5520               | dec                 eax
            //   89542420             | lea                 eax, [edx + 2]
            //   4d89c1               | dec                 eax
            //   4989c8               | cmp                 eax, ebx
            //   89c2                 | jae                 0x183
            //   488d0554e09500       | movzx               eax, byte ptr [edi + edx + 2]

    condition:
        7 of them and filesize < 20419584
}