rule win_archer_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.archer_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.archer_rat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 84c0 0f84df000000 48c7c0ffffffff 89d9 48d3e8 f6c340 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   84c0                 | movzx               eax, byte ptr [esp + 0xf8]
            //   0f84df000000         | add                 eax, -0x10
            //   48c7c0ffffffff       | cmp                 eax, 0x35
            //   89d9                 | ja                  0x458
            //   48d3e8               | dec                 esp
            //   f6c340               | lea                 esp, [esp + 0x200]

        $sequence_1 = { 7441 48c70201000000 4c897a08 b9e0000000 4889c7 4889de f3a4 }
            // n = 7, score = 100
            //   7441                 | dec                 ebp
            //   48c70201000000       | test                esp, esp
            //   4c897a08             | jns                 0x57
            //   b9e0000000           | je                  0x40
            //   4889c7               | dec                 esp
            //   4889de               | mov                 eax, dword ptr [esp + 0xb28]
            //   f3a4                 | dec                 eax

        $sequence_2 = { e8???????? 488b4710 48898424c0000000 0f1007 0f298424b0000000 488b8c2450050000 488b942458050000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488b4710             | je                  0xf7e
            //   48898424c0000000     | dec                 ecx
            //   0f1007               | mov                 esp, eax
            //   0f298424b0000000     | dec                 eax
            //   488b8c2450050000     | mov                 ebx, edx
            //   488b942458050000     | dec                 eax

        $sequence_3 = { 48898d48010000 4883a55001000000 f30f6f8424e0050000 0f108c24f0050000 488b842420030000 0f114810 f30f7f00 }
            // n = 7, score = 100
            //   48898d48010000       | mov                 dword ptr [ebp + 0xe8], eax
            //   4883a55001000000     | dec                 eax
            //   f30f6f8424e0050000     | lea    eax, [0x6e345]
            //   0f108c24f0050000     | dec                 eax
            //   488b842420030000     | mov                 dword ptr [ebp + 0x50], eax
            //   0f114810             | dec                 eax
            //   f30f7f00             | mov                 dword ptr [ebp + 0x58], 1

        $sequence_4 = { 55 53 4881ec98000000 4c894c2438 4c89c6 4889cf 488b842408010000 }
            // n = 7, score = 100
            //   55                   | cmovae              eax, ecx
            //   53                   | dec                 ecx
            //   4881ec98000000       | shl                 eax, 4
            //   4c894c2438           | dec                 ecx
            //   4c89c6               | add                 eax, edi
            //   4889cf               | dec                 esp
            //   488b842408010000     | cmp                 ecx, eax

        $sequence_5 = { c3 488b442448 8a4c2450 4c8d442430 498900 41884808 488d0571a10b00 }
            // n = 7, score = 100
            //   c3                   | mov                 esi, dword ptr [esp + eax + 0xcf8]
            //   488b442448           | inc                 esi
            //   8a4c2450             | add                 esi, dword ptr [esp + eax*4 + 0x8f8]
            //   4c8d442430           | inc                 ecx
            //   498900               | xor                 esi, edx
            //   41884808             | inc                 esp
            //   488d0571a10b00       | mov                 dword ptr [esp + edi*4 + 0x104], esi

        $sequence_6 = { 4883c438 c3 488b442460 4889442420 488d0559f40800 4c8d542437 4c89c1 }
            // n = 7, score = 100
            //   4883c438             | lea                 ecx, [0x38a9c]
            //   c3                   | dec                 eax
            //   488b442460           | add                 ebx, 3
            //   4889442420           | dec                 eax
            //   488d0559f40800       | lea                 esi, [esp + 0x40]
            //   4c8d542437           | mov                 ecx, 0x55
            //   4c89c1               | dec                 eax

        $sequence_7 = { e8???????? 83c624 ebad 4489f9 e8???????? 488d8c2480000000 89c2 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c624               | mov                 ecx, edi
            //   ebad                 | dec                 esp
            //   4489f9               | lea                 eax, [esp + 0x48]
            //   e8????????           |                     
            //   488d8c2480000000     | dec                 ecx
            //   89c2                 | mov                 dword ptr [eax + 8], eax

        $sequence_8 = { 7306 44882408 eb74 4489e2 80e23f 80ca80 4589e0 }
            // n = 7, score = 100
            //   7306                 | mov                 eax, 0x80410600
            //   44882408             | stc                 
            //   eb74                 | das                 
            //   4489e2               | dec                 ebp
            //   80e23f               | mov                 esp, edx
            //   80ca80               | jne                 0xc68
            //   4589e0               | inc                 cx

        $sequence_9 = { e8???????? bb40000000 4883fb43 7719 488d0c1e e8???????? 33043b }
            // n = 7, score = 100
            //   e8????????           |                     
            //   bb40000000           | test                ax, bp
            //   4883fb43             | je                  0x80e
            //   7719                 | mov                 ebp, eax
            //   488d0c1e             | dec                 esp
            //   e8????????           |                     
            //   33043b               | mov                 ecx, esp

    condition:
        7 of them and filesize < 2612224
}