rule win_warezov_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.warezov."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warezov"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c644246108 c6442462ca c644246326 c644246406 c644246578 33c0 8a5c0c58 }
            // n = 7, score = 100
            //   c644246108           | mov                 byte ptr [esp + 0x61], 8
            //   c6442462ca           | mov                 byte ptr [esp + 0x62], 0xca
            //   c644246326           | mov                 byte ptr [esp + 0x63], 0x26
            //   c644246406           | mov                 byte ptr [esp + 0x64], 6
            //   c644246578           | mov                 byte ptr [esp + 0x65], 0x78
            //   33c0                 | xor                 eax, eax
            //   8a5c0c58             | mov                 bl, byte ptr [esp + ecx + 0x58]

        $sequence_1 = { 8ac1 b238 f6ea 0fb6c0 33c8 894c2410 }
            // n = 6, score = 100
            //   8ac1                 | mov                 al, cl
            //   b238                 | mov                 dl, 0x38
            //   f6ea                 | imul                dl
            //   0fb6c0               | movzx               eax, al
            //   33c8                 | xor                 ecx, eax
            //   894c2410             | mov                 dword ptr [esp + 0x10], ecx

        $sequence_2 = { c68424e9020000ec c68424ea0200000d c68424eb02000003 c68424ec02000003 c68424ed0200007d c684248401000060 c68424850100000c }
            // n = 7, score = 100
            //   c68424e9020000ec     | mov                 byte ptr [esp + 0x2e9], 0xec
            //   c68424ea0200000d     | mov                 byte ptr [esp + 0x2ea], 0xd
            //   c68424eb02000003     | mov                 byte ptr [esp + 0x2eb], 3
            //   c68424ec02000003     | mov                 byte ptr [esp + 0x2ec], 3
            //   c68424ed0200007d     | mov                 byte ptr [esp + 0x2ed], 0x7d
            //   c684248401000060     | mov                 byte ptr [esp + 0x184], 0x60
            //   c68424850100000c     | mov                 byte ptr [esp + 0x185], 0xc

        $sequence_3 = { c6454f45 c645507a c6455178 c6455255 c6455363 c645540c c64555a4 }
            // n = 7, score = 100
            //   c6454f45             | mov                 byte ptr [ebp + 0x4f], 0x45
            //   c645507a             | mov                 byte ptr [ebp + 0x50], 0x7a
            //   c6455178             | mov                 byte ptr [ebp + 0x51], 0x78
            //   c6455255             | mov                 byte ptr [ebp + 0x52], 0x55
            //   c6455363             | mov                 byte ptr [ebp + 0x53], 0x63
            //   c645540c             | mov                 byte ptr [ebp + 0x54], 0xc
            //   c64555a4             | mov                 byte ptr [ebp + 0x55], 0xa4

        $sequence_4 = { 8b4500 50 ff15???????? 5f 5e b143 2acb }
            // n = 7, score = 100
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   b143                 | mov                 cl, 0x43
            //   2acb                 | sub                 cl, bl

        $sequence_5 = { 889424e0000000 8a9424ea000000 888c24e1000000 8a8c24eb000000 80f26d 80f1fe 889424e2000000 }
            // n = 7, score = 100
            //   889424e0000000       | mov                 byte ptr [esp + 0xe0], dl
            //   8a9424ea000000       | mov                 dl, byte ptr [esp + 0xea]
            //   888c24e1000000       | mov                 byte ptr [esp + 0xe1], cl
            //   8a8c24eb000000       | mov                 cl, byte ptr [esp + 0xeb]
            //   80f26d               | xor                 dl, 0x6d
            //   80f1fe               | xor                 cl, 0xfe
            //   889424e2000000       | mov                 byte ptr [esp + 0xe2], dl

        $sequence_6 = { 32ca 888c049c020000 40 83f809 7ce3 8d8424a8020000 50 }
            // n = 7, score = 100
            //   32ca                 | xor                 cl, dl
            //   888c049c020000       | mov                 byte ptr [esp + eax + 0x29c], cl
            //   40                   | inc                 eax
            //   83f809               | cmp                 eax, 9
            //   7ce3                 | jl                  0xffffffe5
            //   8d8424a8020000       | lea                 eax, [esp + 0x2a8]
            //   50                   | push                eax

        $sequence_7 = { 6a00 e8???????? 83c40c 8d542460 52 ffd6 83f8ff }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8d542460             | lea                 edx, [esp + 0x60]
            //   52                   | push                edx
            //   ffd6                 | call                esi
            //   83f8ff               | cmp                 eax, -1

        $sequence_8 = { 88442417 51 8d4c2414 b810000000 c644243c30 c644243d8f c644243e59 }
            // n = 7, score = 100
            //   88442417             | mov                 byte ptr [esp + 0x17], al
            //   51                   | push                ecx
            //   8d4c2414             | lea                 ecx, [esp + 0x14]
            //   b810000000           | mov                 eax, 0x10
            //   c644243c30           | mov                 byte ptr [esp + 0x3c], 0x30
            //   c644243d8f           | mov                 byte ptr [esp + 0x3d], 0x8f
            //   c644243e59           | mov                 byte ptr [esp + 0x3e], 0x59

        $sequence_9 = { c684247e0100007c c684247f01000085 c684248001000088 33c0 8bff 8a9404a0010000 }
            // n = 6, score = 100
            //   c684247e0100007c     | mov                 byte ptr [esp + 0x17e], 0x7c
            //   c684247f01000085     | mov                 byte ptr [esp + 0x17f], 0x85
            //   c684248001000088     | mov                 byte ptr [esp + 0x180], 0x88
            //   33c0                 | xor                 eax, eax
            //   8bff                 | mov                 edi, edi
            //   8a9404a0010000       | mov                 dl, byte ptr [esp + eax + 0x1a0]

    condition:
        7 of them and filesize < 827392
}