rule win_ati_agent_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-08-05"
        version = "1"
        description = "Detects win.ati_agent."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
        malpedia_rule_date = "20220805"
        malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
        malpedia_version = "20220808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4883ec20 8bd9 488d0d51370000 ff15???????? 4885c0 }
            // n = 5, score = 100
            //   4883ec20             | lea                 esp, [0x6b43]
            //   8bd9                 | test                eax, eax
            //   488d0d51370000       | jne                 0x8c9
            //   ff15????????         |                     
            //   4885c0               | dec                 esp

        $sequence_1 = { 33c0 eb05 b801000000 488bb424d8070000 488b8c24b0070000 }
            // n = 5, score = 100
            //   33c0                 | dec                 esp
            //   eb05                 | lea                 esp, [0xd60a]
            //   b801000000           | and                 ebx, 0x1f
            //   488bb424d8070000     | dec                 eax
            //   488b8c24b0070000     | imul                ebx, ebx, 0x58

        $sequence_2 = { e8???????? 448be8 85c0 0f850a010000 488b8eb8000000 4c8d25436b0000 f0ff09 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   448be8               | test                eax, eax
            //   85c0                 | je                  0x202
            //   0f850a010000         | cmp                 dword ptr [eax], 0
            //   488b8eb8000000       | dec                 eax
            //   4c8d25436b0000       | lea                 ecx, [0x1d3d]
            //   f0ff09               | nop                 

        $sequence_3 = { 48894c2430 4885c9 741c f0ff09 7517 488d0593b90000 488b4c2430 }
            // n = 7, score = 100
            //   48894c2430           | lea                 edx, [0xc02d]
            //   4885c9               | inc                 edi
            //   741c                 | dec                 edx
            //   f0ff09               | mov                 ecx, dword ptr [edx]
            //   7517                 | jae                 0xcce
            //   488d0593b90000       | dec                 eax
            //   488b4c2430           | arpl                cx, dx

        $sequence_4 = { c3 4883ec28 8b0d???????? 83f9ff }
            // n = 4, score = 100
            //   c3                   | mov                 eax, dword ptr [ebx]
            //   4883ec28             | dec                 eax
            //   8b0d????????         |                     
            //   83f9ff               | test                eax, eax

        $sequence_5 = { 4c8b05???????? 32c9 33d2 6666666666660f1f840000000000 }
            // n = 4, score = 100
            //   4c8b05????????       |                     
            //   32c9                 | mov                 eax, esi
            //   33d2                 | dec                 eax
            //   6666666666660f1f840000000000     | lea    edx, [0x9bcc]

        $sequence_6 = { 897c2428 897c2420 c784248000000068000000 ff15???????? }
            // n = 4, score = 100
            //   897c2428             | dec                 eax
            //   897c2420             | sar                 eax, 5
            //   c784248000000068000000     | dec    eax
            //   ff15????????         |                     

        $sequence_7 = { 4533c0 33c9 897c2428 897c2420 c784248000000068000000 }
            // n = 5, score = 100
            //   4533c0               | mov                 word ptr [esp + ecx*2 + 0x6e], ax
            //   33c9                 | dec                 eax
            //   897c2428             | cmp                 ecx, 0x3d
            //   897c2420             | jb                  0x37e
            //   c784248000000068000000     | mov    word ptr [esp + ecx*2 + 0x10e], ax

        $sequence_8 = { ff15???????? 488d1548a20000 488bce 488905???????? }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   488d1548a20000       | mov                 dword ptr [esp + 0x18], ebx
            //   488bce               | dec                 ecx
            //   488905????????       |                     

        $sequence_9 = { 488d9424f0000000 4889442428 488d842490010000 4533c9 }
            // n = 4, score = 100
            //   488d9424f0000000     | mov                 ebx, eax
            //   4889442428           | test                eax, eax
            //   488d842490010000     | mov                 esi, 2
            //   4533c9               | dec                 eax

    condition:
        7 of them and filesize < 172032
}