rule win_strelastealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.strelastealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bf0 89742418 83feff 0f8476020000 8d542428 52 }
            // n = 6, score = 100
            //   8bf0                 | mov                 esi, eax
            //   89742418             | mov                 dword ptr [esp + 0x18], esi
            //   83feff               | cmp                 esi, -1
            //   0f8476020000         | je                  0x27c
            //   8d542428             | lea                 edx, [esp + 0x28]
            //   52                   | push                edx

        $sequence_1 = { 50 8bc7 8bcb c744240c00000000 }
            // n = 4, score = 100
            //   50                   | push                eax
            //   8bc7                 | mov                 eax, edi
            //   8bcb                 | mov                 ecx, ebx
            //   c744240c00000000     | mov                 dword ptr [esp + 0xc], 0

        $sequence_2 = { 8b4c2428 89442440 89442444 89442434 }
            // n = 4, score = 100
            //   8b4c2428             | mov                 ecx, dword ptr [esp + 0x28]
            //   89442440             | mov                 dword ptr [esp + 0x40], eax
            //   89442444             | mov                 dword ptr [esp + 0x44], eax
            //   89442434             | mov                 dword ptr [esp + 0x34], eax

        $sequence_3 = { 01c7 897d14 8d1401 81c200040000 }
            // n = 4, score = 100
            //   01c7                 | dec                 eax
            //   897d14               | mov                 edx, edi
            //   8d1401               | dec                 esp
            //   81c200040000         | mov                 ecx, dword ptr [ebp - 0x39]

        $sequence_4 = { 03c7 751f 488b85a0010000 488b8888000000 488d0505540100 }
            // n = 5, score = 100
            //   03c7                 | mov                 dword ptr [ebp - 0x20], ecx
            //   751f                 | add                 ecx, eax
            //   488b85a0010000       | mov                 eax, 0xd35688dc
            //   488b8888000000       | sub                 eax, ecx
            //   488d0505540100       | mov                 ecx, 0xd35688dd

        $sequence_5 = { 08c1 20ca 80f101 89c8 }
            // n = 4, score = 100
            //   08c1                 | or                  cl, al
            //   20ca                 | or                  bl, dl
            //   80f101               | mov                 edx, ecx
            //   89c8                 | and                 dl, 1

        $sequence_6 = { 015304 eb55 4d85c0 7e27 488bd7 4c8b4dc7 4b8b8ccbc0120600 }
            // n = 7, score = 100
            //   015304               | xor                 edx, edx
            //   eb55                 | dec                 ecx
            //   4d85c0               | mov                 ecx, esi
            //   7e27                 | test                eax, eax
            //   488bd7               | je                  0x97
            //   4c8b4dc7             | jg                  0x27e
            //   4b8b8ccbc0120600     | dec                 eax

        $sequence_7 = { 895c2420 4533c0 33d2 498bce ff15???????? 85c0 0f848a000000 }
            // n = 7, score = 100
            //   895c2420             | lea                 eax, [0x188c]
            //   4533c0               | dec                 ecx
            //   33d2                 | mov                 ecx, dword ptr [ebx]
            //   498bce               | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | mov                 dword ptr [ebp - 0x71], eax
            //   0f848a000000         | dec                 eax

        $sequence_8 = { 08c1 08d3 89ca 80e201 }
            // n = 4, score = 100
            //   08c1                 | sub                 esp, 0x20
            //   08d3                 | add                 edi, eax
            //   89ca                 | mov                 dword ptr [ebp + 0x14], edi
            //   80e201               | lea                 edx, [ecx + eax]

        $sequence_9 = { ff15???????? ff15???????? 3db7000000 740a e8???????? e8???????? }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   ff15????????         |                     
            //   3db7000000           | cmp                 eax, 0xb7
            //   740a                 | je                  0xc
            //   e8????????           |                     
            //   e8????????           |                     

        $sequence_10 = { 08c1 08da 80f201 89c8 }
            // n = 4, score = 100
            //   08c1                 | mov                 ecx, dword ptr [eax + 0x88]
            //   08da                 | dec                 eax
            //   80f201               | lea                 eax, [0x15405]
            //   89c8                 | add                 eax, edi

        $sequence_11 = { 0f8f78020000 488bcf 4a8d14fd3e000000 4b0394cb70b00100 8a02 88440dff }
            // n = 6, score = 100
            //   0f8f78020000         | mov                 eax, dword ptr [ebp + 0x4f]
            //   488bcf               | mov                 al, byte ptr [esi]
            //   4a8d14fd3e000000     | mov                 byte ptr [ebp - 0x71], al
            //   4b0394cb70b00100     | mov                 dword ptr [ebp - 0x6d], edi
            //   8a02                 | inc                 ecx
            //   88440dff             | mov                 esp, 1

        $sequence_12 = { 4c897c2420 ff15???????? 85c0 0f85fb000000 488d15be640100 }
            // n = 5, score = 100
            //   4c897c2420           | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | cmp                 ecx, ebx
            //   0f85fb000000         | mov                 ecx, dword ptr [esp + 0x88]
            //   488d15be640100       | test                ecx, ecx

        $sequence_13 = { 48898190000000 488d058c180000 498b0b 4889458f 488b454f }
            // n = 5, score = 100
            //   48898190000000       | je                  0x89
            //   488d058c180000       | add                 esi, ecx
            //   498b0b               | dec                 esp
            //   4889458f             | mov                 dword ptr [esp + 0x20], edi
            //   488b454f             | test                eax, eax

        $sequence_14 = { 01c1 b8dc8856d3 29c8 b9dd8856d3 }
            // n = 4, score = 100
            //   01c1                 | mov                 ecx, edi
            //   b8dc8856d3           | dec                 edx
            //   29c8                 | lea                 edx, [edi*8 + 0x3e]
            //   b9dd8856d3           | dec                 ebx

        $sequence_15 = { 8a06 88458f 897d93 41bc01000000 4c8d1dbe37ffff 81f9e9fd0000 }
            // n = 6, score = 100
            //   8a06                 | jne                 0x108
            //   88458f               | dec                 eax
            //   897d93               | lea                 edx, [0x164be]
            //   41bc01000000         | dec                 eax
            //   4c8d1dbe37ffff       | mov                 dword ptr [ecx + 0x90], eax
            //   81f9e9fd0000         | dec                 eax

        $sequence_16 = { 6a1a 6a00 ff15???????? 68???????? ff15???????? 6a17 }
            // n = 6, score = 100
            //   6a1a                 | push                0x1a
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   68????????           |                     
            //   ff15????????         |                     
            //   6a17                 | push                0x17

        $sequence_17 = { 48897c2438 448d4750 897c2430 488d15e8680100 c744242803000000 4533c9 }
            // n = 6, score = 100
            //   48897c2438           | dec                 eax
            //   448d4750             | mov                 dword ptr [esp + 0x38], edi
            //   897c2430             | inc                 esp
            //   488d15e8680100       | lea                 eax, [edi + 0x50]
            //   c744242803000000     | mov                 dword ptr [esp + 0x30], edi
            //   4533c9               | dec                 eax

        $sequence_18 = { 8b35???????? 51 8d8c246c010000 51 ffd6 6804010000 }
            // n = 6, score = 100
            //   8b35????????         |                     
            //   51                   | push                ecx
            //   8d8c246c010000       | lea                 ecx, [esp + 0x16c]
            //   51                   | push                ecx
            //   ffd6                 | call                esi
            //   6804010000           | push                0x104

        $sequence_19 = { 8d442410 50 6800040000 56 53 896c2420 ffd7 }
            // n = 7, score = 100
            //   8d442410             | lea                 eax, [esp + 0x10]
            //   50                   | push                eax
            //   6800040000           | push                0x400
            //   56                   | push                esi
            //   53                   | push                ebx
            //   896c2420             | mov                 dword ptr [esp + 0x20], ebp
            //   ffd7                 | call                edi

        $sequence_20 = { 08c1 0f1f440000 b810000000 e8???????? }
            // n = 4, score = 100
            //   08c1                 | cmp                 ecx, eax
            //   0f1f440000           | je                  0x1f
            //   b810000000           | or                  cl, al
            //   e8????????           |                     

        $sequence_21 = { 51 8d94247c030000 52 e8???????? 8be8 8d442420 }
            // n = 6, score = 100
            //   51                   | push                ecx
            //   8d94247c030000       | lea                 edx, [esp + 0x37c]
            //   52                   | push                edx
            //   e8????????           |                     
            //   8be8                 | mov                 ebp, eax
            //   8d442420             | lea                 eax, [esp + 0x20]

        $sequence_22 = { 83c8ff f00fc101 83f801 751f 488b0d???????? 488d1d99350100 483bcb }
            // n = 7, score = 100
            //   83c8ff               | lea                 edx, [0x168e8]
            //   f00fc101             | mov                 dword ptr [esp + 0x28], 3
            //   83f801               | inc                 ebp
            //   751f                 | xor                 ecx, ecx
            //   488b0d????????       |                     
            //   488d1d99350100       | or                  eax, 0xffffffff
            //   483bcb               | lock xadd           dword ptr [ecx], eax

        $sequence_23 = { 8b8c2488000000 85c9 0f8483000000 03f1 }
            // n = 4, score = 100
            //   8b8c2488000000       | cmp                 eax, 1
            //   85c9                 | jne                 0x24
            //   0f8483000000         | dec                 eax
            //   03f1                 | lea                 ebx, [0x13599]

    condition:
        7 of them and filesize < 872448
}

rule win_strelastealer_w0 {
    meta:
	    description = "detect_StrelaStealer"
	    author = "@malgamy12"
	    date = "2022/11/12"
	    license = "DRL 1.1"
        hash = "6e8a3ffffd2f7a91f3f845b78dd90011feb80d30b4fe48cb174b629afa273403"
        
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
        malpedia_rule_date = "20230118"
        malpedia_hash = ""
        malpedia_version = "20230118"
        malpedia_license = "DRL 1.1"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $pdb = "StrelaDLLCompile.pdb" ascii

        $s1 = "4f3855aa-af7e-4fd2-b04e-55e63653d2f7" ascii
        $s2 = "StrelaDLLCompile.dll" ascii

        $chunk_1 = {33 D2 8B C7 F7 F3 8D 04 2E 83 C7 ?? 83 C6 ?? 8A 92 [4] 30 56 ?? 33 D2 F7 F3 8A 82 [4] 30 46 ?? 83 FF ??} 

        
    condition:
        uint16(0) == 0x5A4D  and ($pdb  or  (1 of ($s*) and $chunk_1 ))

}