rule win_ati_agent_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 48895c2408 4889742410 48897c2418 4154 4883ec20 4c8d25a8c70000 }
            // n = 6, score = 100
            //   48895c2408           | dec                 eax
            //   4889742410           | lea                 eax, [0xc31e]
            //   48897c2418           | dec                 ecx
            //   4154                 | sar                 esp, 5
            //   4883ec20             | inc                 ecx
            //   4c8d25a8c70000       | and                 edi, 0x1f

        $sequence_1 = { 0fb6040a 3438 6633c1 48ffc1 664123c0 6689844cee000000 4883f90a }
            // n = 7, score = 100
            //   0fb6040a             | mov                 dword ptr [esp + 0x44], edi
            //   3438                 | dec                 esp
            //   6633c1               | mov                 edi, dword ptr [esp + 0x60]
            //   48ffc1               | dec                 ecx
            //   664123c0             | mov                 ecx, dword ptr [edi + ecx]
            //   6689844cee000000     | dec                 esp
            //   4883f90a             | lea                 ecx, [esp + 0x48]

        $sequence_2 = { 488d0d469b0000 488bc2 83e21f 48c1f805 }
            // n = 4, score = 100
            //   488d0d469b0000       | dec                 eax
            //   488bc2               | test                eax, eax
            //   83e21f               | jne                 0x27a
            //   48c1f805             | mov                 eax, 0x80040005

        $sequence_3 = { 4533c0 418d5001 e9???????? 4881ec28050000 }
            // n = 4, score = 100
            //   4533c0               | cmp                 dword ptr [edx], 0
            //   418d5001             | jne                 0x117
            //   e9????????           |                     
            //   4881ec28050000       | dec                 eax

        $sequence_4 = { 6689bc2404010000 ff15???????? 85c0 0f85f7000000 }
            // n = 4, score = 100
            //   6689bc2404010000     | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | add                 esp, 0x28
            //   0f85f7000000         | dec                 eax

        $sequence_5 = { e8???????? 488d3d0cd80000 41b804010000 33c9 488bd7 c605????????00 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   488d3d0cd80000       | dec                 eax
            //   41b804010000         | cmp                 edx, 0x13
            //   33c9                 | jb                  0x25c
            //   488bd7               | dec                 eax
            //   c605????????00       |                     

        $sequence_6 = { 488d05c1530000 488981a0000000 83611000 c7411c01000000 }
            // n = 4, score = 100
            //   488d05c1530000       | jmp                 0x221
            //   488981a0000000       | dec                 eax
            //   83611000             | test                eax, eax
            //   c7411c01000000       | jne                 0x224

        $sequence_7 = { 488d051ec30000 49c1fc05 4183e71f 4a8b0ce0 4c89642450 4d6bff58 418a740f38 }
            // n = 7, score = 100
            //   488d051ec30000       | je                  0x419
            //   49c1fc05             | ret                 
            //   4183e71f             | xor                 eax, eax
            //   4a8b0ce0             | dec                 eax
            //   4c89642450           | mov                 ecx, dword ptr [esp + 0x510]
            //   4d6bff58             | dec                 eax
            //   418a740f38           | xor                 ecx, esp

        $sequence_8 = { 4c8d2506c30000 488b0d???????? eb6c e8???????? }
            // n = 4, score = 100
            //   4c8d2506c30000       | lea                 ecx, [0x893b]
            //   488b0d????????       |                     
            //   eb6c                 | dec                 eax
            //   e8????????           |                     

        $sequence_9 = { 42888401e0e80000 ffc7 ebde 488b05???????? f0ff08 7511 }
            // n = 6, score = 100
            //   42888401e0e80000     | lea                 edx, [0xa208]
            //   ffc7                 | dec                 eax
            //   ebde                 | mov                 ecx, esi
            //   488b05????????       |                     
            //   f0ff08               | dec                 eax
            //   7511                 | mov                 ecx, eax

    condition:
        7 of them and filesize < 172032
}