rule win_usbferry_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.usbferry."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 ff5134 33c0 40 5b 8b4dfc }
            // n = 6, score = 200
            //   56                   | push                esi
            //   ff5134               | call                dword ptr [ecx + 0x34]
            //   33c0                 | xor                 eax, eax
            //   40                   | inc                 eax
            //   5b                   | pop                 ebx
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]

        $sequence_1 = { 0f8583000000 8b4518 8945d8 8b4dd8 }
            // n = 4, score = 200
            //   0f8583000000         | jne                 0x89
            //   8b4518               | mov                 eax, dword ptr [ebp + 0x18]
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]

        $sequence_2 = { 8bd7 8d8df8fbffff e8???????? eb5b 6800040000 8d8df8f7ffff }
            // n = 6, score = 200
            //   8bd7                 | mov                 edx, edi
            //   8d8df8fbffff         | lea                 ecx, [ebp - 0x408]
            //   e8????????           |                     
            //   eb5b                 | jmp                 0x5d
            //   6800040000           | push                0x400
            //   8d8df8f7ffff         | lea                 ecx, [ebp - 0x808]

        $sequence_3 = { 742c 8b4de0 51 ff15???????? c745c000000000 }
            // n = 5, score = 200
            //   742c                 | je                  0x2e
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   c745c000000000       | mov                 dword ptr [ebp - 0x40], 0

        $sequence_4 = { c685b5faffff69 c685b6faffff6d c685b7faffff20 c685b8faffff00 68ef030000 }
            // n = 5, score = 200
            //   c685b5faffff69       | mov                 byte ptr [ebp - 0x54b], 0x69
            //   c685b6faffff6d       | mov                 byte ptr [ebp - 0x54a], 0x6d
            //   c685b7faffff20       | mov                 byte ptr [ebp - 0x549], 0x20
            //   c685b8faffff00       | mov                 byte ptr [ebp - 0x548], 0
            //   68ef030000           | push                0x3ef

        $sequence_5 = { 0f570d???????? c645a72d eb14 f6c104 7406 }
            // n = 5, score = 200
            //   0f570d????????       |                     
            //   c645a72d             | mov                 byte ptr [ebp - 0x59], 0x2d
            //   eb14                 | jmp                 0x16
            //   f6c104               | test                cl, 4
            //   7406                 | je                  8

        $sequence_6 = { 8bec 81ec880a0000 a1???????? 33c5 8945fc 56 57 }
            // n = 7, score = 200
            //   8bec                 | mov                 ebp, esp
            //   81ec880a0000         | sub                 esp, 0xa88
            //   a1????????           |                     
            //   33c5                 | xor                 eax, ebp
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_7 = { 57 8d45fb c645fb00 50 8bce e8???????? }
            // n = 6, score = 200
            //   57                   | push                edi
            //   8d45fb               | lea                 eax, [ebp - 5]
            //   c645fb00             | mov                 byte ptr [ebp - 5], 0
            //   50                   | push                eax
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     

        $sequence_8 = { c645c069 c645c16e c645c264 c645c36f c645c477 }
            // n = 5, score = 200
            //   c645c069             | mov                 byte ptr [ebp - 0x40], 0x69
            //   c645c16e             | mov                 byte ptr [ebp - 0x3f], 0x6e
            //   c645c264             | mov                 byte ptr [ebp - 0x3e], 0x64
            //   c645c36f             | mov                 byte ptr [ebp - 0x3d], 0x6f
            //   c645c477             | mov                 byte ptr [ebp - 0x3c], 0x77

        $sequence_9 = { 83c40c 6a00 6a2e 8d8da8feffff }
            // n = 4, score = 200
            //   83c40c               | add                 esp, 0xc
            //   6a00                 | push                0
            //   6a2e                 | push                0x2e
            //   8d8da8feffff         | lea                 ecx, [ebp - 0x158]

        $sequence_10 = { 8a02 8845df 8345d801 807ddf00 75ee 8b4dd8 2b4dc8 }
            // n = 7, score = 200
            //   8a02                 | mov                 al, byte ptr [edx]
            //   8845df               | mov                 byte ptr [ebp - 0x21], al
            //   8345d801             | add                 dword ptr [ebp - 0x28], 1
            //   807ddf00             | cmp                 byte ptr [ebp - 0x21], 0
            //   75ee                 | jne                 0xfffffff0
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   2b4dc8               | sub                 ecx, dword ptr [ebp - 0x38]

        $sequence_11 = { 838598f5ffff01 80bda1f5ffff00 75e2 8b9598f5ffff 2b9588f5ffff 8b8588f5ffff 89857cf5ffff }
            // n = 7, score = 200
            //   838598f5ffff01       | add                 dword ptr [ebp - 0xa68], 1
            //   80bda1f5ffff00       | cmp                 byte ptr [ebp - 0xa5f], 0
            //   75e2                 | jne                 0xffffffe4
            //   8b9598f5ffff         | mov                 edx, dword ptr [ebp - 0xa68]
            //   2b9588f5ffff         | sub                 edx, dword ptr [ebp - 0xa78]
            //   8b8588f5ffff         | mov                 eax, dword ptr [ebp - 0xa78]
            //   89857cf5ffff         | mov                 dword ptr [ebp - 0xa84], eax

        $sequence_12 = { d3e0 844415e0 75d9 8bfe }
            // n = 4, score = 200
            //   d3e0                 | shl                 eax, cl
            //   844415e0             | test                byte ptr [ebp + edx - 0x20], al
            //   75d9                 | jne                 0xffffffdb
            //   8bfe                 | mov                 edi, esi

        $sequence_13 = { 8bc6 f7f3 8bf0 8a043a 88440da4 }
            // n = 5, score = 200
            //   8bc6                 | mov                 eax, esi
            //   f7f3                 | div                 ebx
            //   8bf0                 | mov                 esi, eax
            //   8a043a               | mov                 al, byte ptr [edx + edi]
            //   88440da4             | mov                 byte ptr [ebp + ecx - 0x5c], al

        $sequence_14 = { ffb5acfaffff e8???????? 59 59 eb1e }
            // n = 5, score = 200
            //   ffb5acfaffff         | push                dword ptr [ebp - 0x554]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   eb1e                 | jmp                 0x20

        $sequence_15 = { 83ceff 89542410 8944240c 89742418 80f930 }
            // n = 5, score = 200
            //   83ceff               | or                  esi, 0xffffffff
            //   89542410             | mov                 dword ptr [esp + 0x10], edx
            //   8944240c             | mov                 dword ptr [esp + 0xc], eax
            //   89742418             | mov                 dword ptr [esp + 0x18], esi
            //   80f930               | cmp                 cl, 0x30

    condition:
        7 of them and filesize < 638976
}