rule win_atlantida_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.atlantida."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlantida"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffe6 81c912b9077d 13f8 8b442404 0559d0e2ff ffe0 c74424008ccbc3b2 }
            // n = 7, score = 100
            //   ffe6                 | jmp                 esi
            //   81c912b9077d         | or                  ecx, 0x7d07b912
            //   13f8                 | adc                 edi, eax
            //   8b442404             | mov                 eax, dword ptr [esp + 4]
            //   0559d0e2ff           | add                 eax, 0xffe2d059
            //   ffe0                 | jmp                 eax
            //   c74424008ccbc3b2     | mov                 dword ptr [esp], 0xb2c3cb8c

        $sequence_1 = { ffc2 4c 8d3cb5993c185c 6645 33ff 6645 1bf7 }
            // n = 7, score = 100
            //   ffc2                 | inc                 edx
            //   4c                   | dec                 esp
            //   8d3cb5993c185c       | lea                 edi, [esi*4 + 0x5c183c99]
            //   6645                 | inc                 bp
            //   33ff                 | xor                 edi, edi
            //   6645                 | inc                 bp
            //   1bf7                 | sbb                 esi, edi

        $sequence_2 = { ffcf 48 c1efa8 80f181 4a c14424065a f6d9 }
            // n = 7, score = 100
            //   ffcf                 | dec                 edi
            //   48                   | dec                 eax
            //   c1efa8               | shr                 edi, 0xa8
            //   80f181               | xor                 cl, 0x81
            //   4a                   | dec                 edx
            //   c14424065a           | rol                 dword ptr [esp + 6], 0x5a
            //   f6d9                 | neg                 cl

        $sequence_3 = { ffe0 b92645319b 0fbaf110 660fb60427 0fbed1 42 c0f1a2 }
            // n = 7, score = 100
            //   ffe0                 | jmp                 eax
            //   b92645319b           | mov                 ecx, 0x9b314526
            //   0fbaf110             | btr                 ecx, 0x10
            //   660fb60427           | movzx               ax, byte ptr [edi]
            //   0fbed1               | movsx               edx, cl
            //   42                   | inc                 edx
            //   c0f1a2               | sal                 cl, 0xa2

        $sequence_4 = { ffe6 689a7db94c 8b442400 81b404668246b33bfb8de9 8db406628246b3 8b9406668246b3 308404688246b3 }
            // n = 7, score = 100
            //   ffe6                 | jmp                 esi
            //   689a7db94c           | push                0x4cb97d9a
            //   8b442400             | mov                 eax, dword ptr [esp]
            //   81b404668246b33bfb8de9     | xor    dword ptr [esp + eax - 0x4cb97d9a], 0xe98dfb3b
            //   8db406628246b3       | lea                 esi, [esi + eax - 0x4cb97d9e]
            //   8b9406668246b3       | mov                 edx, dword ptr [esi + eax - 0x4cb97d9a]
            //   308404688246b3       | xor                 byte ptr [esp + eax - 0x4cb97d98], al

        $sequence_5 = { e9???????? fb 5c ca6c9e 2e61 50 ff6f71 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   fb                   | sti                 
            //   5c                   | pop                 esp
            //   ca6c9e               | retf                0x9e6c
            //   2e61                 | popal               
            //   50                   | push                eax
            //   ff6f71               | ljmp                [edi + 0x71]

        $sequence_6 = { f7da f7d9 f7d2 660fa3c0 0fbae898 81f2aeb0b703 03c0 }
            // n = 7, score = 100
            //   f7da                 | neg                 edx
            //   f7d9                 | neg                 ecx
            //   f7d2                 | not                 edx
            //   660fa3c0             | bt                  ax, ax
            //   0fbae898             | bts                 eax, 0x98
            //   81f2aeb0b703         | xor                 edx, 0x3b7b0ae
            //   03c0                 | add                 eax, eax

        $sequence_7 = { f6d0 6681c28772 23d1 33d1 32d8 33ca 2b4c4cfe }
            // n = 7, score = 100
            //   f6d0                 | not                 al
            //   6681c28772           | add                 dx, 0x7287
            //   23d1                 | and                 edx, ecx
            //   33d1                 | xor                 edx, ecx
            //   32d8                 | xor                 bl, al
            //   33ca                 | xor                 ecx, edx
            //   2b4c4cfe             | sub                 ecx, dword ptr [esp + ecx*2 - 2]

        $sequence_8 = { ffb590fdffff 51 e8???????? 8985e8fdffff 83f8ff 0f84920b0000 90 }
            // n = 7, score = 100
            //   ffb590fdffff         | push                dword ptr [ebp - 0x270]
            //   51                   | push                ecx
            //   e8????????           |                     
            //   8985e8fdffff         | mov                 dword ptr [ebp - 0x218], eax
            //   83f8ff               | cmp                 eax, -1
            //   0f84920b0000         | je                  0xb98
            //   90                   | nop                 

        $sequence_9 = { ff75e8 c645cc00 ff75cc 51 8d4dd0 e8???????? 46 }
            // n = 7, score = 100
            //   ff75e8               | push                dword ptr [ebp - 0x18]
            //   c645cc00             | mov                 byte ptr [ebp - 0x34], 0
            //   ff75cc               | push                dword ptr [ebp - 0x34]
            //   51                   | push                ecx
            //   8d4dd0               | lea                 ecx, [ebp - 0x30]
            //   e8????????           |                     
            //   46                   | inc                 esi

    condition:
        7 of them and filesize < 13793280
}