rule win_tclient_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.tclient."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tclient"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 33c7 81c79979825a 03c8 8b45fc 03ce 8b75ac 894da8 }
            // n = 7, score = 100
            //   33c7                 | xor                 eax, edi
            //   81c79979825a         | add                 edi, 0x5a827999
            //   03c8                 | add                 ecx, eax
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   03ce                 | add                 ecx, esi
            //   8b75ac               | mov                 esi, dword ptr [ebp - 0x54]
            //   894da8               | mov                 dword ptr [ebp - 0x58], ecx

        $sequence_1 = { 745f 83e801 7449 48 83e801 7432 83e801 }
            // n = 7, score = 100
            //   745f                 | je                  0x61
            //   83e801               | sub                 eax, 1
            //   7449                 | je                  0x4b
            //   48                   | dec                 eax
            //   83e801               | sub                 eax, 1
            //   7432                 | je                  0x34
            //   83e801               | sub                 eax, 1

        $sequence_2 = { 8b4508 83c40c 8b38 0fb683de010000 897de4 8d0cc508000000 e8???????? }
            // n = 7, score = 100
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   83c40c               | add                 esp, 0xc
            //   8b38                 | mov                 edi, dword ptr [eax]
            //   0fb683de010000       | movzx               eax, byte ptr [ebx + 0x1de]
            //   897de4               | mov                 dword ptr [ebp - 0x1c], edi
            //   8d0cc508000000       | lea                 ecx, [eax*8 + 8]
            //   e8????????           |                     

        $sequence_3 = { 33c6 894db0 2345a8 33c6 c1c105 034a40 81c69979825a }
            // n = 7, score = 100
            //   33c6                 | xor                 eax, esi
            //   894db0               | mov                 dword ptr [ebp - 0x50], ecx
            //   2345a8               | and                 eax, dword ptr [ebp - 0x58]
            //   33c6                 | xor                 eax, esi
            //   c1c105               | rol                 ecx, 5
            //   034a40               | add                 ecx, dword ptr [edx + 0x40]
            //   81c69979825a         | add                 esi, 0x5a827999

        $sequence_4 = { 7794 0fb63439 0fb6443901 83c702 66c1e608 660bf0 89bddcfdffff }
            // n = 7, score = 100
            //   7794                 | ja                  0xffffff96
            //   0fb63439             | movzx               esi, byte ptr [ecx + edi]
            //   0fb6443901           | movzx               eax, byte ptr [ecx + edi + 1]
            //   83c702               | add                 edi, 2
            //   66c1e608             | shl                 si, 8
            //   660bf0               | or                  si, ax
            //   89bddcfdffff         | mov                 dword ptr [ebp - 0x224], edi

        $sequence_5 = { c786f801000001142800 668996ec010000 668996f0010000 eb86 83e833 0f84dc000000 48 }
            // n = 7, score = 100
            //   c786f801000001142800     | mov    dword ptr [esi + 0x1f8], 0x281401
            //   668996ec010000       | mov                 word ptr [esi + 0x1ec], dx
            //   668996f0010000       | mov                 word ptr [esi + 0x1f0], dx
            //   eb86                 | jmp                 0xffffff88
            //   83e833               | sub                 eax, 0x33
            //   0f84dc000000         | je                  0xe2
            //   48                   | dec                 eax

        $sequence_6 = { 8985a4fdffff e8???????? 83f807 7f04 6a02 eb16 83f824 }
            // n = 7, score = 100
            //   8985a4fdffff         | mov                 dword ptr [ebp - 0x25c], eax
            //   e8????????           |                     
            //   83f807               | cmp                 eax, 7
            //   7f04                 | jg                  6
            //   6a02                 | push                2
            //   eb16                 | jmp                 0x18
            //   83f824               | cmp                 eax, 0x24

        $sequence_7 = { 8955fc 57 8bf9 8d4e01 8a06 46 84c0 }
            // n = 7, score = 100
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   57                   | push                edi
            //   8bf9                 | mov                 edi, ecx
            //   8d4e01               | lea                 ecx, [esi + 1]
            //   8a06                 | mov                 al, byte ptr [esi]
            //   46                   | inc                 esi
            //   84c0                 | test                al, al

        $sequence_8 = { 8b4724 8983e4000000 8b4728 8983e8000000 8b472c 8983ec000000 8b4730 }
            // n = 7, score = 100
            //   8b4724               | mov                 eax, dword ptr [edi + 0x24]
            //   8983e4000000         | mov                 dword ptr [ebx + 0xe4], eax
            //   8b4728               | mov                 eax, dword ptr [edi + 0x28]
            //   8983e8000000         | mov                 dword ptr [ebx + 0xe8], eax
            //   8b472c               | mov                 eax, dword ptr [edi + 0x2c]
            //   8983ec000000         | mov                 dword ptr [ebx + 0xec], eax
            //   8b4730               | mov                 eax, dword ptr [edi + 0x30]

        $sequence_9 = { 8955fc 2145f4 8bf1 57 33ff 8945f8 }
            // n = 6, score = 100
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   2145f4               | and                 dword ptr [ebp - 0xc], eax
            //   8bf1                 | mov                 esi, ecx
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

    condition:
        7 of them and filesize < 1063936
}