rule win_turla_rpc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.turla_rpc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 660f6f05???????? 66c785ec0000000255 c785a0000000193a3431 c785a4000000193c3727 c785a800000034272c02 }
            // n = 5, score = 200
            //   660f6f05????????     |                     
            //   66c785ec0000000255     | mov    dword ptr [ebp + 0x118], 0x2630363a
            //   c785a0000000193a3431     | mov    word ptr [ebp + 0x11c], 0x226
            //   c785a4000000193c3727     | mov    byte ptr [ebp + 0x11e], 0x55
            //   c785a800000034272c02     | mov    dword ptr [ebp + 0x90], 0x34302716

        $sequence_1 = { 4885c0 744e 4c8b4708 488b17 488bcb }
            // n = 5, score = 200
            //   4885c0               | dec                 eax
            //   744e                 | test                eax, eax
            //   4c8b4708             | je                  0x50
            //   488b17               | dec                 esp
            //   488bcb               | mov                 eax, dword ptr [edi + 8]

        $sequence_2 = { 660f6f05???????? c7858000000012302101 c7858400000030382505 c7858800000034213d02 f30f7f8530010000 }
            // n = 5, score = 200
            //   660f6f05????????     |                     
            //   c7858000000012302101     | dec    eax
            //   c7858400000030382505     | mov    edx, dword ptr [edi]
            //   c7858800000034213d02     | dec    eax
            //   f30f7f8530010000     | mov                 ecx, ebx

        $sequence_3 = { c645bc55 c7854001000030163930 c78544010000343b2025 c6854801000055 c78560010000013c3830 c785640100003a202155 c785a8010000271c3367 }
            // n = 7, score = 200
            //   c645bc55             | mov                 byte ptr [ebp - 0x44], 0x55
            //   c7854001000030163930     | mov    dword ptr [ebp + 0x140], 0x30391630
            //   c78544010000343b2025     | mov    dword ptr [ebp + 0x144], 0x25203b34
            //   c6854801000055       | mov                 byte ptr [ebp + 0x148], 0x55
            //   c78560010000013c3830     | mov    dword ptr [ebp + 0x160], 0x30383c01
            //   c785640100003a202155     | mov    dword ptr [ebp + 0x164], 0x5521203a
            //   c785a8010000271c3367     | mov    dword ptr [ebp + 0x1a8], 0x67331c27

        $sequence_4 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? }
            // n = 4, score = 200
            //   c745b06970746f       | mov                 dword ptr [ebp - 0x50], 0x6f747069
            //   c745b472536163       | mov                 dword ptr [ebp - 0x4c], 0x63615372
            //   66c745b86c00         | mov                 word ptr [ebp - 0x48], 0x6c
            //   ff15????????         |                     

        $sequence_5 = { c785900100002130271c 66c785940100003355 c7857801000026302410 66c7857c0100002502 c6857e01000055 c7452038262336 }
            // n = 6, score = 200
            //   c785900100002130271c     | mov    dword ptr [ebp + 0x190], 0x1c273021
            //   66c785940100003355     | mov    word ptr [ebp + 0x194], 0x5533
            //   c7857801000026302410     | mov    dword ptr [ebp + 0x178], 0x10243026
            //   66c7857c0100002502     | mov    word ptr [ebp + 0x17c], 0x225
            //   c6857e01000055       | mov                 byte ptr [ebp + 0x17e], 0x55
            //   c7452038262336       | mov                 dword ptr [ebp + 0x20], 0x36232638

        $sequence_6 = { 66c745082133 c6450a55 c745980a22333a c7459c25303b55 }
            // n = 4, score = 200
            //   66c745082133         | mov                 dword ptr [ebp + 0xe0], 0x3213012
            //   c6450a55             | mov                 dword ptr [ebp + 0xe4], 0x3c262730
            //   c745980a22333a       | mov                 dword ptr [ebp + 0xe8], 0x2d103b3a
            //   c7459c25303b55       | movdqu              xmmword ptr [ebp + 0x1e0], xmm0

        $sequence_7 = { c7851001000016273034 c7851401000021300527 c785180100003a363026 66c7851c0100002602 c6851e01000055 c7859000000016273034 }
            // n = 6, score = 200
            //   c7851001000016273034     | mov    dword ptr [ebp + 0x80], 0x1213012
            //   c7851401000021300527     | mov    dword ptr [ebp + 0x84], 0x5253830
            //   c785180100003a363026     | mov    dword ptr [ebp + 0x88], 0x23d2134
            //   66c7851c0100002602     | movdqu    xmmword ptr [ebp + 0x130], xmm0
            //   c6851e01000055       | mov                 dword ptr [ebp + 0x110], 0x34302716
            //   c7859000000016273034     | mov    dword ptr [ebp + 0x114], 0x27053021

        $sequence_8 = { c785e000000012302103 c785e40000003027263c c785e80000003a3b102d f30f7f85e0010000 660f6f05???????? }
            // n = 5, score = 200
            //   c785e000000012302103     | mov    dword ptr [ebp + 0xe0], 0x3213012
            //   c785e40000003027263c     | mov    dword ptr [ebp + 0xe4], 0x3c262730
            //   c785e80000003a3b102d     | mov    dword ptr [ebp + 0xe8], 0x2d103b3a
            //   f30f7f85e0010000     | movdqu              xmmword ptr [ebp + 0x1e0], xmm0
            //   660f6f05????????     |                     

        $sequence_9 = { 83e11f c1e106 83c10c 8b0485d8860110 }
            // n = 4, score = 100
            //   83e11f               | and                 ecx, 0x1f
            //   c1e106               | shl                 ecx, 6
            //   83c10c               | add                 ecx, 0xc
            //   8b0485d8860110       | mov                 eax, dword ptr [eax*4 + 0x100186d8]

        $sequence_10 = { 40 83f80b 72f5 c78528feffff5f736e70 }
            // n = 4, score = 100
            //   40                   | inc                 eax
            //   83f80b               | cmp                 eax, 0xb
            //   72f5                 | jb                  0xfffffff7
            //   c78528feffff5f736e70     | mov    dword ptr [ebp - 0x1d8], 0x706e735f

        $sequence_11 = { 50 e8???????? 818da0fdffff01010000 0f57c0 33c0 c78574fdffff44000000 53 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   e8????????           |                     
            //   818da0fdffff01010000     | or    dword ptr [ebp - 0x260], 0x101
            //   0f57c0               | xorps               xmm0, xmm0
            //   33c0                 | xor                 eax, eax
            //   c78574fdffff44000000     | mov    dword ptr [ebp - 0x28c], 0x44
            //   53                   | push                ebx

        $sequence_12 = { c745e870006500 c745ec5c006100 c745f074006300 c745f474006c00 }
            // n = 4, score = 100
            //   c745e870006500       | mov                 dword ptr [ebp - 0x18], 0x650070
            //   c745ec5c006100       | mov                 dword ptr [ebp - 0x14], 0x61005c
            //   c745f074006300       | mov                 dword ptr [ebp - 0x10], 0x630074
            //   c745f474006c00       | mov                 dword ptr [ebp - 0xc], 0x6c0074

        $sequence_13 = { 6a00 68???????? ff15???????? 8b4dfc b801000000 33cd }
            // n = 6, score = 100
            //   6a00                 | push                0
            //   68????????           |                     
            //   ff15????????         |                     
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   b801000000           | mov                 eax, 1
            //   33cd                 | xor                 ecx, ebp

        $sequence_14 = { ff9570fdffff 8987a8000000 8d45ec 50 53 8b9d70fdffff ffd3 }
            // n = 7, score = 100
            //   ff9570fdffff         | call                dword ptr [ebp - 0x290]
            //   8987a8000000         | mov                 dword ptr [edi + 0xa8], eax
            //   8d45ec               | lea                 eax, [ebp - 0x14]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   8b9d70fdffff         | mov                 ebx, dword ptr [ebp - 0x290]
            //   ffd3                 | call                ebx

        $sequence_15 = { 8d8578ffffff 50 53 ff9570fdffff 898784000000 }
            // n = 5, score = 100
            //   8d8578ffffff         | lea                 eax, [ebp - 0x88]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   ff9570fdffff         | call                dword ptr [ebp - 0x290]
            //   898784000000         | mov                 dword ptr [edi + 0x84], eax

    condition:
        7 of them and filesize < 311296
}