rule win_topinambour_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.topinambour."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.topinambour"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 2b1d 09 1106 1107 }
            // n = 4, score = 100
            //   2b1d                 | or                  ch, byte ptr [eax]
            //   09                   | or                  byte ptr [eax], al
            //   1106                 | add                 byte ptr [edx], cl
            //   1107                 | and                 eax, 0x33dd20

        $sequence_1 = { 02 282100000a 6f2200000a 25 6f1d00000a 16 6f2300000a }
            // n = 7, score = 100
            //   02                   | inc                 ebp
            //   282100000a           | add                 byte ptr [eax], al
            //   6f2200000a           | jo                  0x168
            //   25                   | and                 byte ptr [eax], al
            //   6f1d00000a           | add                 byte ptr [edx], cl
            //   16                   | and                 eax, 0x1d6f
            //   6f2300000a           | or                  dh, byte ptr [edx + 0x55]

        $sequence_2 = { 1105 8d0f000001 1306 16 1307 }
            // n = 5, score = 100
            //   1105                 | adc                 dword ptr [edi], eax
            //   8d0f000001           |                     
            //   1306                 | adc                 dword ptr [ecx], ecx
            //   16                   | outsd               dx, dword ptr [esi]
            //   1307                 | sbb                 byte ptr [eax], al

        $sequence_3 = { 6f1d00000a 7245000070 6f2000000a 25 6f1d00000a 7255000070 02 }
            // n = 7, score = 100
            //   6f1d00000a           | add                 byte ptr [esi], al
            //   7245000070           | adc                 ecx, dword ptr [eax]
            //   6f2000000a           | sub                 byte ptr [ebx], dl
            //   25                   | add                 byte ptr [eax], al
            //   6f1d00000a           | or                  dl, byte ptr [ecx]
            //   7255000070           | or                  byte ptr [edi + 0x15], ch
            //   02                   | add                 byte ptr [eax], al

        $sequence_4 = { 20204e0000 6f0c00000a 09 2060ea0000 6f0d00000a }
            // n = 5, score = 100
            //   20204e0000           | or                  dl, byte ptr [esi]
            //   6f0c00000a           | outsd               dx, dword ptr [esi]
            //   09                   | adc                 al, byte ptr [eax]
            //   2060ea0000           | add                 byte ptr [edx], cl
            //   6f0d00000a           | adc                 ecx, dword ptr [ebx]

        $sequence_5 = { 25 721d000070 6f0500000a 25 }
            // n = 4, score = 100
            //   25                   | add                 byte ptr [eax], al
            //   721d000070           |                     
            //   6f0500000a           | outsd               dx, dword ptr [esi]
            //   25                   | pop                 ss

        $sequence_6 = { 730900000a 0c 6f0a00000a 17 1c 730b00000a }
            // n = 6, score = 100
            //   730900000a           | adc                 al, 0
            //   0c                   | add                 byte ptr [edx], cl
            //   6f0a00000a           | sub                 byte ptr [edx], al
            //   17                   | add                 byte ptr [eax], al
            //   1c                   | push                es
            //   730b00000a           | adc                 ecx, dword ptr [eax]

        $sequence_7 = { 25 6f1d00000a 7255000070 02 282100000a }
            // n = 5, score = 100
            //   25                   | jae                 0x4b
            //   6f1d00000a           | add                 byte ptr [eax], al
            //   7255000070           | or                  cl, byte ptr [0x4e202009]
            //   02                   | add                 byte ptr [eax], al
            //   282100000a           | and                 byte ptr [eax], ah

        $sequence_8 = { 2e06 731000000a 7a 1104 16 }
            // n = 5, score = 100
            //   2e06                 | or                  dword ptr es:[ecx], edx
            //   731000000a           | or                  dword ptr [edi + 0x18], ebp
            //   7a                   | add                 byte ptr [eax], al
            //   1104                 | or                  ah, byte ptr [esi]
            //   16                   | or                  dword ptr es:[edi + 0x19], ebp

        $sequence_9 = { 6f1400000a 2802000006 1308 281300000a 1108 6f1500000a }
            // n = 6, score = 100
            //   6f1400000a           | outsd               dx, dword ptr [esi]
            //   2802000006           | and                 eax, dword ptr [eax]
            //   1308                 | add                 byte ptr [edx], cl
            //   281300000a           | sub                 ebx, dword ptr [0x11061109]
            //   1108                 | pop                 es
            //   6f1500000a           | adc                 dword ptr [0xd2c0711], eax

    condition:
        7 of them and filesize < 50176
}