rule win_ati_agent_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.ati_agent."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bd7 89542420 81fa01010000 7d13 4863ca 8a44191c 42888401d0e70000 }
            // n = 7, score = 100
            //   8bd7                 | add                 esp, 0x48
            //   89542420             | ret                 
            //   81fa01010000         | xor                 cl, cl
            //   7d13                 | dec                 eax
            //   4863ca               | mov                 ecx, dword ptr [esp + 0x38]
            //   8a44191c             | dec                 eax
            //   42888401d0e70000     | lea                 eax, [esp + 0x30]

        $sequence_1 = { 7326 e9???????? 8a03 488d152dc00000 ffc7 }
            // n = 5, score = 100
            //   7326                 | add                 ebx, 0x10
            //   e9????????           |                     
            //   8a03                 | dec                 eax
            //   488d152dc00000       | dec                 esi
            //   ffc7                 | jne                 0x491

        $sequence_2 = { 48c1f805 486bc958 48030cc2 eb07 488d0dc4690000 f6410820 7417 }
            // n = 7, score = 100
            //   48c1f805             | movzx               edx, cl
            //   486bc958             | dec                 eax
            //   48030cc2             | cmp                 edx, 0x11
            //   eb07                 | jb                  0x24b
            //   488d0dc4690000       | dec                 eax
            //   f6410820             | lea                 edx, [esp + 0x20]
            //   7417                 | dec                 ecx

        $sequence_3 = { 4883ec48 488b05???????? 4833c4 4889442438 e8???????? 4c8bd8 }
            // n = 6, score = 100
            //   4883ec48             | dec                 eax
            //   488b05????????       |                     
            //   4833c4               | mov                 dword ptr [esp + 0x18], ebx
            //   4889442438           | push                ebp
            //   e8????????           |                     
            //   4c8bd8               | dec                 ecx

        $sequence_4 = { 48897c2418 4154 4883ec20 4c8d25a8c70000 33f6 }
            // n = 5, score = 100
            //   48897c2418           | mov                 byte ptr [ecx + 0x1f7], 0x43
            //   4154                 | dec                 eax
            //   4883ec20             | lea                 eax, [0x9640]
            //   4c8d25a8c70000       | mov                 dword ptr [esp + 0x80], 0x68
            //   33f6                 | test                eax, eax

        $sequence_5 = { 4883ec28 e8???????? 4885c0 7509 488d058fc70000 eb04 4883c010 }
            // n = 7, score = 100
            //   4883ec28             | dec                 esp
            //   e8????????           |                     
            //   4885c0               | mov                 ebp, edi
            //   7509                 | dec                 ecx
            //   488d058fc70000       | sar                 ebp, 5
            //   eb04                 | dec                 esp
            //   4883c010             | lea                 esi, [0xd8e8]

        $sequence_6 = { 4c8d253b6a0000 493bdc 7408 488bcb }
            // n = 4, score = 100
            //   4c8d253b6a0000       | dec                 esp
            //   493bdc               | mov                 ebp, edi
            //   7408                 | dec                 ecx
            //   488bcb               | sar                 ebp, 5

        $sequence_7 = { f0800c2400 e9???????? 48895c2408 4889742410 48897c2418 4154 }
            // n = 6, score = 100
            //   f0800c2400           | mov                 esi, 0x40
            //   e9????????           |                     
            //   48895c2408           | dec                 eax
            //   4889742410           | mov                 edi, dword ptr [ebx]
            //   48897c2418           | dec                 eax
            //   4154                 | test                edi, edi

        $sequence_8 = { 33c0 ebdb 48895c2418 55 56 57 }
            // n = 6, score = 100
            //   33c0                 | dec                 eax
            //   ebdb                 | mov                 ecx, dword ptr [esp + 0x30]
            //   48895c2418           | dec                 eax
            //   55                   | cmp                 ecx, eax
            //   56                   | je                  0x3ee
            //   57                   | dec                 eax

        $sequence_9 = { 488d0da07b0000 483bd9 723e 488d05247f0000 }
            // n = 4, score = 100
            //   488d0da07b0000       | mov                 dword ptr [esp + 0x20], eax
            //   483bd9               | jmp                 0x124
            //   723e                 | dec                 eax
            //   488d05247f0000       | lea                 edx, [0x1d4f]

    condition:
        7 of them and filesize < 172032
}