rule win_xfilesstealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.xfilesstealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd3 33c9 85c0 7524 448b4c2450 4c8d05c3f12600 ba00040000 }
            // n = 7, score = 100
            //   ffd3                 | inc                 ebp
            //   33c9                 | test                esi, esi
            //   85c0                 | jne                 0x1838
            //   7524                 | test                cl, cl
            //   448b4c2450           | jne                 0x1838
            //   4c8d05c3f12600       | cmp                 ebx, 0x2c
            //   ba00040000           | cmp                 ebx, 0x27

        $sequence_1 = { e8???????? 8bf8 488d4dc0 e8???????? 85ff 0f88cb000000 488d55c0 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8bf8                 | inc                 esp
            //   488d4dc0             | mov                 eax, esi
            //   e8????????           |                     
            //   85ff                 | inc                 ecx
            //   0f88cb000000         | mov                 edx, esi
            //   488d55c0             | dec                 eax

        $sequence_2 = { ffd3 498b4f58 894114 498b4758 33ff 897818 498b4758 }
            // n = 7, score = 100
            //   ffd3                 | jne                 0x97
            //   498b4f58             | dec                 eax
            //   894114               | mov                 edx, edi
            //   498b4758             | dec                 eax
            //   33ff                 | mov                 ecx, esi
            //   897818               | test                al, al
            //   498b4758             | je                  0x97

        $sequence_3 = { eb00 90 488d4d48 e8???????? 90 837d5800 7411 }
            // n = 7, score = 100
            //   eb00                 | je                  0x1286
            //   90                   | dec                 eax
            //   488d4d48             | lea                 ecx, [ebp + 0x1f0]
            //   e8????????           |                     
            //   90                   | jne                 0x1195
            //   837d5800             | inc                 ecx
            //   7411                 | mov                 ecx, dword ptr [eax]

        $sequence_4 = { e8???????? 4c392b 7439 488b05???????? 488906 488d0d439c8900 48894e08 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c392b               | mov                 ecx, dword ptr [ecx + 0x4b0]
            //   7439                 | inc                 ecx
            //   488b05????????       |                     
            //   488906               | mov                 edx, eax
            //   488d0d439c8900       | dec                 ecx
            //   48894e08             | mov                 ecx, ecx

        $sequence_5 = { ffd3 4c63c0 48c744243080060000 4c89442428 48c744242020205248 4c8d0dee771b00 ba00400000 }
            // n = 7, score = 100
            //   ffd3                 | mov                 eax, dword ptr [esp + 0x30]
            //   4c63c0               | test                al, al
            //   48c744243080060000     | jne    0x4b
            //   4c89442428           | dec                 eax
            //   48c744242020205248     | lea    ecx, [esp + 0x20]
            //   4c8d0dee771b00       | mov                 dword ptr [esp + 0x28], 0x3d2
            //   ba00400000           | mov                 eax, dword ptr [esp + 0x30]

        $sequence_6 = { b801000000 e9???????? 85ed 7512 4d8bc6 488bd6 488bcb }
            // n = 7, score = 100
            //   b801000000           | mov                 ebx, eax
            //   e9????????           |                     
            //   85ed                 | mov                 ecx, ebx
            //   7512                 | dec                 esp
            //   4d8bc6               | lea                 eax, [0x3857e8]
            //   488bd6               | mov                 edx, 0x104
            //   488bcb               | dec                 eax

        $sequence_7 = { ff15???????? 8bd8 85c0 7e09 0fb7d8 81cb00000780 488d4db0 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8bd8                 | mov                 ecx, dword ptr [esi]
            //   85c0                 | dec                 eax
            //   7e09                 | mov                 eax, dword ptr [esi + 0x108]
            //   0fb7d8               | sub                 ecx, 0x10
            //   81cb00000780         | dec                 eax
            //   488d4db0             | add                 ecx, ecx

        $sequence_8 = { 89742428 4489742420 4c8d4df8 4c8d45d8 488b55f0 488d8d30010000 e8???????? }
            // n = 7, score = 100
            //   89742428             | mov                 dword ptr [esi + eax*2], edi
            //   4489742420           | cmp                 eax, -1
            //   4c8d4df8             | je                  0x618
            //   4c8d45d8             | dec                 ecx
            //   488b55f0             | mov                 ecx, esi
            //   488d8d30010000       | dec                 eax
            //   e8????????           |                     

        $sequence_9 = { ff5208 33c0 4883c448 c3 488d4c2420 c744242890010000 e8???????? }
            // n = 7, score = 100
            //   ff5208               | mov                 eax, edi
            //   33c0                 | dec                 ecx
            //   4883c448             | mov                 edx, ebp
            //   c3                   | dec                 ecx
            //   488d4c2420           | mov                 ecx, edi
            //   c744242890010000     | cmp                 eax, 5
            //   e8????????           |                     

    condition:
        7 of them and filesize < 20821780
}

rule win_xfilesstealer_w0 {

    meta:
        author      = "Johannes Bader @viql"
        date        = "2022-04-15"
        version     = "v1.0"
        description = "detects XFiles-Stealer"
        hash        = "d06072f959d895f2fc9a57f44bf6357596c5c3410e90dabe06b171161f37d690"
        tlp         = "TLP:WHITE"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer"
        malpedia_rule_date = "20220425"
        malpedia_hash = ""
        malpedia_version = "20220425"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $ad_1 = "Telegram bot - @XFILESShop_Bot" wide
        $ad_2 = "Telegram support - @XFILES_Seller" wide

        $names_1 = "XFiles.Models.Yeti"
        $names_2 = "anti_vzlom_popki" // анти взлом попки
        $names_3 = "assType"
        $names_4 = "hackrjaw"

        $upload_1  = "zipx" wide
        $upload_2  = "user_id" wide
        $upload_3  = "passworlds_x" wide
        $upload_4  = "ip_x" wide
        $upload_5  = "cc_x" wide
        $upload_6  = "cookies_x" wide
        $upload_7  = "zip_x" wide
        $upload_8  = "contry_x" wide
        $upload_9  = "tag_x" wide
        $upload_10 = "piece" wide
            
    condition:
        uint16(0) == 0x5A4D and 
        (
            all of ($ad_*) or 
            all of ($names_*) or 
            all of ($upload_*)
        )
}