rule win_kasperagent_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.kasperagent."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd0 a1???????? 83c0f0 50 e8???????? }
            // n = 5, score = 200
            //   ffd0                 | call                eax
            //   a1????????           |                     
            //   83c0f0               | add                 eax, -0x10
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 7f17 8970f4 8b5500 33c0 66890472 }
            // n = 5, score = 200
            //   7f17                 | jg                  0x19
            //   8970f4               | mov                 dword ptr [eax - 0xc], esi
            //   8b5500               | mov                 edx, dword ptr [ebp]
            //   33c0                 | xor                 eax, eax
            //   66890472             | mov                 word ptr [edx + esi*2], ax

        $sequence_2 = { 8b542414 8b442410 0fb74c2418 81c26c070000 40 668916 }
            // n = 6, score = 200
            //   8b542414             | mov                 edx, dword ptr [esp + 0x14]
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   0fb74c2418           | movzx               ecx, word ptr [esp + 0x18]
            //   81c26c070000         | add                 edx, 0x76c
            //   40                   | inc                 eax
            //   668916               | mov                 word ptr [esi], dx

        $sequence_3 = { 8d442408 c7470800000000 894c240c e8???????? 84c0 }
            // n = 5, score = 200
            //   8d442408             | lea                 eax, [esp + 8]
            //   c7470800000000       | mov                 dword ptr [edi + 8], 0
            //   894c240c             | mov                 dword ptr [esp + 0xc], ecx
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_4 = { 8b742414 8b7c241c 5d 5b 2bc1 33d2 }
            // n = 6, score = 200
            //   8b742414             | mov                 esi, dword ptr [esp + 0x14]
            //   8b7c241c             | mov                 edi, dword ptr [esp + 0x1c]
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   2bc1                 | sub                 eax, ecx
            //   33d2                 | xor                 edx, edx

        $sequence_5 = { 2bc1 2bc3 8d3c00 57 8d145e 52 }
            // n = 6, score = 200
            //   2bc1                 | sub                 eax, ecx
            //   2bc3                 | sub                 eax, ebx
            //   8d3c00               | lea                 edi, [eax + eax]
            //   57                   | push                edi
            //   8d145e               | lea                 edx, [esi + ebx*2]
            //   52                   | push                edx

        $sequence_6 = { ffd0 c645fc03 8b45bc 83c0f0 8d480c }
            // n = 5, score = 200
            //   ffd0                 | call                eax
            //   c645fc03             | mov                 byte ptr [ebp - 4], 3
            //   8b45bc               | mov                 eax, dword ptr [ebp - 0x44]
            //   83c0f0               | add                 eax, -0x10
            //   8d480c               | lea                 ecx, [eax + 0xc]

        $sequence_7 = { 57 33ff 66837c24182d 897c2414 7472 8b4500 8b70f4 }
            // n = 7, score = 200
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   66837c24182d         | cmp                 word ptr [esp + 0x18], 0x2d
            //   897c2414             | mov                 dword ptr [esp + 0x14], edi
            //   7472                 | je                  0x74
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   8b70f4               | mov                 esi, dword ptr [eax - 0xc]

        $sequence_8 = { 75f5 2bd9 d1fb 85db 750a }
            // n = 5, score = 200
            //   75f5                 | jne                 0xfffffff7
            //   2bd9                 | sub                 ebx, ecx
            //   d1fb                 | sar                 ebx, 1
            //   85db                 | test                ebx, ebx
            //   750a                 | jne                 0xc

        $sequence_9 = { 8b45d8 83c0f0 8d480c 8bd6 f00fc111 4a }
            // n = 6, score = 200
            //   8b45d8               | mov                 eax, dword ptr [ebp - 0x28]
            //   83c0f0               | add                 eax, -0x10
            //   8d480c               | lea                 ecx, [eax + 0xc]
            //   8bd6                 | mov                 edx, esi
            //   f00fc111             | lock xadd           dword ptr [ecx], edx
            //   4a                   | dec                 edx

    condition:
        7 of them and filesize < 1605632
}