rule win_vohuk_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.vohuk."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c1e81f 03c2 69c0cc000000 2bc8 81c1e1000000 66314c7596 46 }
            // n = 7, score = 100
            //   c1e81f               | shr                 eax, 0x1f
            //   03c2                 | add                 eax, edx
            //   69c0cc000000         | imul                eax, eax, 0xcc
            //   2bc8                 | sub                 ecx, eax
            //   81c1e1000000         | add                 ecx, 0xe1
            //   66314c7596           | xor                 word ptr [ebp + esi*2 - 0x6a], cx
            //   46                   | inc                 esi

        $sequence_1 = { c745eab7008d00 c745ee87009500 c745f28d00d300 c745f6ca00ce00 c745fa80009e00 668945fe b815024d21 }
            // n = 7, score = 100
            //   c745eab7008d00       | mov                 dword ptr [ebp - 0x16], 0x8d00b7
            //   c745ee87009500       | mov                 dword ptr [ebp - 0x12], 0x950087
            //   c745f28d00d300       | mov                 dword ptr [ebp - 0xe], 0xd3008d
            //   c745f6ca00ce00       | mov                 dword ptr [ebp - 0xa], 0xce00ca
            //   c745fa80009e00       | mov                 dword ptr [ebp - 6], 0x9e0080
            //   668945fe             | mov                 word ptr [ebp - 2], ax
            //   b815024d21           | mov                 eax, 0x214d0215

        $sequence_2 = { ffb5bcfeffff e8???????? 6a00 6841db0100 ffb5c8feffff 898554ffffff ffb5c4feffff }
            // n = 7, score = 100
            //   ffb5bcfeffff         | push                dword ptr [ebp - 0x144]
            //   e8????????           |                     
            //   6a00                 | push                0
            //   6841db0100           | push                0x1db41
            //   ffb5c8feffff         | push                dword ptr [ebp - 0x138]
            //   898554ffffff         | mov                 dword ptr [ebp - 0xac], eax
            //   ffb5c4feffff         | push                dword ptr [ebp - 0x13c]

        $sequence_3 = { c4e37d468500ffffff31 c5fdef87a0000000 c5fe7f80a0000000 c5fe6f85a0feffff c4e37d4645c031 c5fdef87c0000000 }
            // n = 6, score = 100
            //   c4e37d468500ffffff31     | vperm2i128    ymm0, ymm0, ymmword ptr [ebp - 0x100], 0x31
            //   c5fdef87a0000000     | vpxor               ymm0, ymm0, ymmword ptr [edi + 0xa0]
            //   c5fe7f80a0000000     | vmovdqu             ymmword ptr [eax + 0xa0], ymm0
            //   c5fe6f85a0feffff     | vmovdqu             ymm0, ymmword ptr [ebp - 0x160]
            //   c4e37d4645c031       | vperm2i128          ymm0, ymm0, ymmword ptr [ebp - 0x40], 0x31
            //   c5fdef87c0000000     | vpxor               ymm0, ymm0, ymmword ptr [edi + 0xc0]

        $sequence_4 = { 33ff eb28 8b45f4 ba7d2225c4 8b0d???????? 8b75f0 }
            // n = 6, score = 100
            //   33ff                 | xor                 edi, edi
            //   eb28                 | jmp                 0x2a
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   ba7d2225c4           | mov                 edx, 0xc425227d
            //   8b0d????????         |                     
            //   8b75f0               | mov                 esi, dword ptr [ebp - 0x10]

        $sequence_5 = { c745c698008c00 c745cad900b500 c745ce8b009900 c745d29300de00 c745d6b9006901 c745da6d016701 c745de39012401 }
            // n = 7, score = 100
            //   c745c698008c00       | mov                 dword ptr [ebp - 0x3a], 0x8c0098
            //   c745cad900b500       | mov                 dword ptr [ebp - 0x36], 0xb500d9
            //   c745ce8b009900       | mov                 dword ptr [ebp - 0x32], 0x99008b
            //   c745d29300de00       | mov                 dword ptr [ebp - 0x2e], 0xde0093
            //   c745d6b9006901       | mov                 dword ptr [ebp - 0x2a], 0x16900b9
            //   c745da6d016701       | mov                 dword ptr [ebp - 0x26], 0x167016d
            //   c745de39012401       | mov                 dword ptr [ebp - 0x22], 0x1240139

        $sequence_6 = { b8fc000000 c745b8d900a700 c745bcb900ad00 33f6 }
            // n = 4, score = 100
            //   b8fc000000           | mov                 eax, 0xfc
            //   c745b8d900a700       | mov                 dword ptr [ebp - 0x48], 0xa700d9
            //   c745bcb900ad00       | mov                 dword ptr [ebp - 0x44], 0xad00b9
            //   33f6                 | xor                 esi, esi

        $sequence_7 = { 2bc8 81c1e1000000 66310c77 46 83fe33 72d5 57 }
            // n = 7, score = 100
            //   2bc8                 | sub                 ecx, eax
            //   81c1e1000000         | add                 ecx, 0xe1
            //   66310c77             | xor                 word ptr [edi + esi*2], cx
            //   46                   | inc                 esi
            //   83fe33               | cmp                 esi, 0x33
            //   72d5                 | jb                  0xffffffd7
            //   57                   | push                edi

        $sequence_8 = { 56 ffd0 85c0 0f8442030000 c745e090009100 33f6 c745e4eb00a300 }
            // n = 7, score = 100
            //   56                   | push                esi
            //   ffd0                 | call                eax
            //   85c0                 | test                eax, eax
            //   0f8442030000         | je                  0x348
            //   c745e090009100       | mov                 dword ptr [ebp - 0x20], 0x910090
            //   33f6                 | xor                 esi, esi
            //   c745e4eb00a300       | mov                 dword ptr [ebp - 0x1c], 0xa300eb

        $sequence_9 = { 8bec 81ec1c020000 8b0d???????? baf47a81b9 6884000000 c745f400000000 c745e800010000 }
            // n = 7, score = 100
            //   8bec                 | mov                 ebp, esp
            //   81ec1c020000         | sub                 esp, 0x21c
            //   8b0d????????         |                     
            //   baf47a81b9           | mov                 edx, 0xb9817af4
            //   6884000000           | push                0x84
            //   c745f400000000       | mov                 dword ptr [ebp - 0xc], 0
            //   c745e800010000       | mov                 dword ptr [ebp - 0x18], 0x100

    condition:
        7 of them and filesize < 260096
}

rule win_vohuk_w0 {
    meta:
	    description = "Detect_Vohuk_ransomware"
	    author = "@malgamy12"
	    date = "8/12/2022"
	    license = "DRL 1.1"
        hash= "e27b637abe523503b19e6b57b95489ea"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
        malpedia_rule_date = "20221212"
        malpedia_hash = ""
        malpedia_version = "20221212"
        malpedia_sharing = "TLP:WHITE"
                
    strings:
        $p1 = {B8 [4] 8B CE F7 EE C1 FA ?? 8B C2 C1 E8 ?? 03 C2 69 C0 [4] 2B C8 83 C1 ?? 66 31 4C 75 ?? 46 83 FE ?? 72}
        $p2 = {8B 34 B8 BA [4] 0F BE 04 1E 03 F3}
        
    condition:
        uint16(0) == 0x5A4D and all of them
}