rule win_stabuniq_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.stabuniq."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stabuniq"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 81c2e8110000 52 8b4510 ff5050 50 8b4d10 }
            // n = 6, score = 100
            //   81c2e8110000         | add                 edx, 0x11e8
            //   52                   | push                edx
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   ff5050               | call                dword ptr [eax + 0x50]
            //   50                   | push                eax
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]

        $sequence_1 = { 8b5508 0fbe840a1c0c0000 85c0 0f84b2000000 c745b800000000 8b4dc0 6bc924 }
            // n = 7, score = 100
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   0fbe840a1c0c0000     | movsx               eax, byte ptr [edx + ecx + 0xc1c]
            //   85c0                 | test                eax, eax
            //   0f84b2000000         | je                  0xb8
            //   c745b800000000       | mov                 dword ptr [ebp - 0x48], 0
            //   8b4dc0               | mov                 ecx, dword ptr [ebp - 0x40]
            //   6bc924               | imul                ecx, ecx, 0x24

        $sequence_2 = { 8b8204010000 8985c4feffff ebd2 83bdc8feffff00 743c 8b8dc8feffff }
            // n = 6, score = 100
            //   8b8204010000         | mov                 eax, dword ptr [edx + 0x104]
            //   8985c4feffff         | mov                 dword ptr [ebp - 0x13c], eax
            //   ebd2                 | jmp                 0xffffffd4
            //   83bdc8feffff00       | cmp                 dword ptr [ebp - 0x138], 0
            //   743c                 | je                  0x3e
            //   8b8dc8feffff         | mov                 ecx, dword ptr [ebp - 0x138]

        $sequence_3 = { 50 8b4d0c ff9178010000 8945f8 837df800 7507 33c0 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   ff9178010000         | call                dword ptr [ecx + 0x178]
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   837df800             | cmp                 dword ptr [ebp - 8], 0
            //   7507                 | jne                 9
            //   33c0                 | xor                 eax, eax

        $sequence_4 = { 50 8b4d08 ff9194010000 83f801 0f8524010000 8b5508 }
            // n = 6, score = 100
            //   50                   | push                eax
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   ff9194010000         | call                dword ptr [ecx + 0x194]
            //   83f801               | cmp                 eax, 1
            //   0f8524010000         | jne                 0x12a
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]

        $sequence_5 = { 8b951cfdffff 8b4210 50 8b8d1cfdffff 8b550c 035114 }
            // n = 6, score = 100
            //   8b951cfdffff         | mov                 edx, dword ptr [ebp - 0x2e4]
            //   8b4210               | mov                 eax, dword ptr [edx + 0x10]
            //   50                   | push                eax
            //   8b8d1cfdffff         | mov                 ecx, dword ptr [ebp - 0x2e4]
            //   8b550c               | mov                 edx, dword ptr [ebp + 0xc]
            //   035114               | add                 edx, dword ptr [ecx + 0x14]

        $sequence_6 = { ff15???????? 837d0c00 0f8488010000 837d1400 0f847e010000 8b4508 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   837d0c00             | cmp                 dword ptr [ebp + 0xc], 0
            //   0f8488010000         | je                  0x18e
            //   837d1400             | cmp                 dword ptr [ebp + 0x14], 0
            //   0f847e010000         | je                  0x184
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]

        $sequence_7 = { 52 8b4508 ff909c000000 8b4d08 8981d8010000 ba01000000 85d2 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   ff909c000000         | call                dword ptr [eax + 0x9c]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8981d8010000         | mov                 dword ptr [ecx + 0x1d8], eax
            //   ba01000000           | mov                 edx, 1
            //   85d2                 | test                edx, edx

        $sequence_8 = { ff90a0010000 837df401 7707 33c0 e9???????? 8b4df4 51 }
            // n = 7, score = 100
            //   ff90a0010000         | call                dword ptr [eax + 0x1a0]
            //   837df401             | cmp                 dword ptr [ebp - 0xc], 1
            //   7707                 | ja                  9
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   51                   | push                ecx

        $sequence_9 = { 894df4 c745e800000000 8b55f4 833a00 747c 8b45f4 }
            // n = 6, score = 100
            //   894df4               | mov                 dword ptr [ebp - 0xc], ecx
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   833a00               | cmp                 dword ptr [edx], 0
            //   747c                 | je                  0x7e
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]

    condition:
        7 of them and filesize < 57344
}