rule win_xfilesstealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.xfilesstealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd3 488b4def 4833cc e8???????? 4881c4a8000000 415f 415e }
            // n = 7, score = 100
            //   ffd3                 | dec                 eax
            //   488b4def             | cmp                 dword ptr [ebx + 0x68], edi
            //   4833cc               | je                  0xc40
            //   e8????????           |                     
            //   4881c4a8000000       | nop                 
            //   415f                 | dec                 eax
            //   415e                 | lea                 ecx, [ebx + 0x70]

        $sequence_1 = { ff15???????? 85db 0f8503010000 664439a5b0010000 0f84f5000000 83f87a 0f85e9000000 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   85db                 | mov                 eax, eax
            //   0f8503010000         | mov                 edx, 0x2bc3
            //   664439a5b0010000     | dec                 eax
            //   0f84f5000000         | mov                 ecx, ebp
            //   83f87a               | mov                 ebx, eax
            //   0f85e9000000         | test                eax, eax

        $sequence_2 = { ff15???????? 8b542450 488bce ffd3 33c9 85c0 7524 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b542450             | inc                 esp
            //   488bce               | mov                 eax, eax
            //   ffd3                 | mov                 edx, 0x5442
            //   33c9                 | dec                 eax
            //   85c0                 | mov                 ecx, edi
            //   7524                 | mov                 ebx, eax

        $sequence_3 = { f6d0 0fbec8 83e101 d3ea ffca 443bc2 7233 }
            // n = 7, score = 100
            //   f6d0                 | inc                 ecx
            //   0fbec8               | cmp                 eax, -1
            //   83e101               | je                  0x76c
            //   d3ea                 | dec                 esp
            //   ffca                 | cmp                 dword ptr [ebp + 0x1228], edi
            //   443bc2               | test                eax, eax
            //   7233                 | js                  0x155fdf

        $sequence_4 = { ff4f28 f605????????02 0f856b672c00 8b4328 a890 7416 a810 }
            // n = 7, score = 100
            //   ff4f28               | cmp                 dword ptr [esi + 0x30], esi
            //   f605????????02       |                     
            //   0f856b672c00         | dec                 eax
            //   8b4328               | lea                 edx, [esi + 0x30]
            //   a890                 | je                  0xf0d
            //   7416                 | mov                 edi, eax
            //   a810                 | test                eax, eax

        $sequence_5 = { eb6f 41b915000000 4c8d05ff121c00 8bd3 488bcf e8???????? 85c0 }
            // n = 7, score = 100
            //   eb6f                 | cmovne              esi, edi
            //   41b915000000         | dec                 esp
            //   4c8d05ff121c00       | mov                 esp, eax
            //   8bd3                 | dec                 eax
            //   488bcf               | mov                 dword ptr [esp + 0x1a8], eax
            //   e8????????           |                     
            //   85c0                 | dec                 eax

        $sequence_6 = { ff15???????? 85c0 0f8434192c00 c644243800 803d????????00 0f8534192c00 488b5c2460 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   85c0                 | js                  0x81e
            //   0f8434192c00         | mov                 edi, 0x131202
            //   c644243800           | cmp                 esi, edi
            //   803d????????00       |                     
            //   0f8534192c00         | je                  0x81c
            //   488b5c2460           | mov                 ebx, eax

        $sequence_7 = { e8???????? eb70 498b5500 488b12 488d4c2455 e8???????? 90 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   eb70                 | dec                 eax
            //   498b5500             | mov                 dword ptr [esp + 0x60], eax
            //   488b12               | mov                 dword ptr [esp + 0x68], ebx
            //   488d4c2455           | mov                 ecx, ebx
            //   e8????????           |                     
            //   90                   | dec                 eax

        $sequence_8 = { ffd6 8bd8 488d4d40 e8???????? 90 488d4dc0 e8???????? }
            // n = 7, score = 100
            //   ffd6                 | mov                 eax, 0x8003
            //   8bd8                 | test                esi, esi
            //   488d4d40             | mov                 ecx, 0x80
            //   e8????????           |                     
            //   90                   | dec                 eax
            //   488d4dc0             | mov                 dword ptr [esp + 0x68], eax
            //   e8????????           |                     

        $sequence_9 = { eb3a 488b7d60 488b07 488b9818020000 488bcb ff15???????? 488d4550 }
            // n = 7, score = 100
            //   eb3a                 | inc                 ebp
            //   488b7d60             | xor                 ecx, ecx
            //   488b07               | mov                 edx, edi
            //   488b9818020000       | dec                 ecx
            //   488bcb               | mov                 edx, esi
            //   ff15????????         |                     
            //   488d4550             | dec                 eax

    condition:
        7 of them and filesize < 20821780
}

rule win_xfilesstealer_w0 {

    meta:
        author      = "Johannes Bader @viql"
        date        = "2022-04-15"
        version     = "v1.0"
        description = "detects XFiles-Stealer"
        hash        = "d06072f959d895f2fc9a57f44bf6357596c5c3410e90dabe06b171161f37d690"
        tlp         = "TLP:WHITE"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer"
        malpedia_rule_date = "20220425"
        malpedia_hash = ""
        malpedia_version = "20220425"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $ad_1 = "Telegram bot - @XFILESShop_Bot" wide
        $ad_2 = "Telegram support - @XFILES_Seller" wide

        $names_1 = "XFiles.Models.Yeti"
        $names_2 = "anti_vzlom_popki" // анти взлом попки
        $names_3 = "assType"
        $names_4 = "hackrjaw"

        $upload_1  = "zipx" wide
        $upload_2  = "user_id" wide
        $upload_3  = "passworlds_x" wide
        $upload_4  = "ip_x" wide
        $upload_5  = "cc_x" wide
        $upload_6  = "cookies_x" wide
        $upload_7  = "zip_x" wide
        $upload_8  = "contry_x" wide
        $upload_9  = "tag_x" wide
        $upload_10 = "piece" wide
            
    condition:
        uint16(0) == 0x5A4D and 
        (
            all of ($ad_*) or 
            all of ($names_*) or 
            all of ($upload_*)
        )
}