rule win_subzero_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.subzero."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.subzero"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f1005???????? 0f294590 33db 48895c2478 498b06 488d55b8 498bce }
            // n = 7, score = 100
            //   0f1005????????       |                     
            //   0f294590             | nop                 
            //   33db                 | test                al, al
            //   48895c2478           | jne                 0x7df
            //   498b06               | dec                 eax
            //   488d55b8             | mov                 ecx, dword ptr [ebx]
            //   498bce               | jne                 0x7ef

        $sequence_1 = { 8bf8 85c0 7856 48832600 488d15ea3d0100 488d0d53570100 e8???????? }
            // n = 7, score = 100
            //   8bf8                 | dec                 eax
            //   85c0                 | inc                 eax
            //   7856                 | inc                 ecx
            //   48832600             | cmp                 byte ptr [eax + eax], dh
            //   488d15ea3d0100       | jne                 0x5f4
            //   488d0d53570100       | dec                 eax
            //   e8????????           |                     

        $sequence_2 = { e8???????? 4d397d60 7409 4d8b4568 49ffc0 eb03 4d8bc7 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4d397d60             | lea                 ecx, [ecx + eax*2]
            //   7409                 | dec                 ecx
            //   4d8b4568             | lea                 ebx, [edx + ecx*8]
            //   49ffc0               | dec                 eax
            //   eb03                 | mov                 eax, dword ptr [ebx]
            //   4d8bc7               | dec                 eax

        $sequence_3 = { e8???????? 90 e9???????? 4c8bc6 488d542430 488d4c2450 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   90                   | dec                 eax
            //   e9????????           |                     
            //   4c8bc6               | mov                 eax, dword ptr [edx + 0x10]
            //   488d542430           | mov                 eax, esi
            //   488d4c2450           | dec                 eax
            //   e8????????           |                     

        $sequence_4 = { e8???????? 498b5210 44387a19 0f858d000000 488b0a 40386918 750a }
            // n = 7, score = 100
            //   e8????????           |                     
            //   498b5210             | mov                 ecx, ecx
            //   44387a19             | dec                 eax
            //   0f858d000000         | mov                 ebx, eax
            //   488b0a               | dec                 ecx
            //   40386918             | mov                 edi, eax
            //   750a                 | dec                 ebp

        $sequence_5 = { 57 4883ec30 48c7442420feffffff 48895c2458 8bfa 488bd9 488d7160 }
            // n = 7, score = 100
            //   57                   | mov                 byte ptr [ebx + 0x18], al
            //   4883ec30             | mov                 byte ptr [edi + 0x18], cl
            //   48c7442420feffffff     | inc    eax
            //   48895c2458           | mov                 ch, 1
            //   8bfa                 | dec                 eax
            //   488bd9               | mov                 eax, dword ptr [edi + 0x10]
            //   488d7160             | dec                 eax

        $sequence_6 = { 488bc3 ff15???????? 85c0 7803 40b701 488d4c2440 e8???????? }
            // n = 7, score = 100
            //   488bc3               | mov                 ecx, eax
            //   ff15????????         |                     
            //   85c0                 | dec                 esp
            //   7803                 | lea                 eax, [0x33c58]
            //   40b701               | mov                 edx, 0x120f
            //   488d4c2440           | nop                 
            //   e8????????           |                     

        $sequence_7 = { 90 488b4f70 4885c9 7406 e8???????? 90 488b4f60 }
            // n = 7, score = 100
            //   90                   | mov                 eax, dword ptr [edi]
            //   488b4f70             | inc                 esp
            //   4885c9               | mov                 ecx, eax
            //   7406                 | inc                 ecx
            //   e8????????           |                     
            //   90                   | or                  ecx, 0xff000000
            //   488b4f60             | inc                 ecx

        $sequence_8 = { 0f8831a60100 4c897c2458 488d442458 4889442420 4c8d0d53860400 bf01000000 448bc7 }
            // n = 7, score = 100
            //   0f8831a60100         | test                ebp, ebp
            //   4c897c2458           | mov                 dword ptr [esp + 0x28], 0x1f0003
            //   488d442458           | dec                 esp
            //   4889442420           | lea                 ecx, [esp + 0x30]
            //   4c8d0d53860400       | inc                 esp
            //   bf01000000           | mov                 dword ptr [esp + 0x20], edi
            //   448bc7               | cmovne              edi, ebp

        $sequence_9 = { 488b01 488b80d0000000 ff15???????? 488b4e08 4533c0 33d2 488b01 }
            // n = 7, score = 100
            //   488b01               | dec                 eax
            //   488b80d0000000       | mov                 ecx, dword ptr [esp + 0x20]
            //   ff15????????         |                     
            //   488b4e08             | dec                 eax
            //   4533c0               | test                ecx, ecx
            //   33d2                 | jne                 0x1e8a2
            //   488b01               | jne                 0x15e9f

    condition:
        7 of them and filesize < 1420288
}