rule win_petit_potato_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.petit_potato."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petit_potato"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488b442430 48898598000000 48b8fcac01f024f90591 4889442430 }
            // n = 4, score = 100
            //   488b442430           | cmp                 cl, dh
            //   48898598000000       | popfd               
            //   48b8fcac01f024f90591     | pop    edx
            //   4889442430           | dec                 eax

        $sequence_1 = { 660feb0d???????? 4c8d0d3d650100 488d15466d0100 660f2f3d???????? 0f82a8040000 f20f5cca }
            // n = 6, score = 100
            //   660feb0d????????     |                     
            //   4c8d0d3d650100       | movdqa              xmmword ptr [ebp + 0x120], xmm0
            //   488d15466d0100       | movdqa              xmm1, xmmword ptr [ebp + 0x410]
            //   660f2f3d????????     |                     
            //   0f82a8040000         | dec                 eax
            //   f20f5cca             | mov                 dword ptr [ebp + 0x458], eax

        $sequence_2 = { 4889742418 57 4154 4155 4156 4157 4881ec500a0000 }
            // n = 7, score = 100
            //   4889742418           | mov                 dword ptr [esp + 0x30], ebp
            //   57                   | dec                 eax
            //   4154                 | mov                 dword ptr [ebp + 0x4a0], eax
            //   4155                 | dec                 eax
            //   4156                 | mov                 eax, dword ptr [esp + 0x30]
            //   4157                 | dec                 eax
            //   4881ec500a0000       | mov                 dword ptr [ebp + 0x4a8], eax

        $sequence_3 = { 83e13f 488b04c2 488d0cc9 488d14c8 eb07 488d1584ea0100 f6423820 }
            // n = 7, score = 100
            //   83e13f               | dec                 eax
            //   488b04c2             | mov                 edx, edi
            //   488d0cc9             | dec                 eax
            //   488d14c8             | mov                 ecx, esi
            //   eb07                 | je                  0x21c
            //   488d1584ea0100       | dec                 eax
            //   f6423820             | lea                 eax, [0xa5dc]

        $sequence_4 = { 488b842490000000 49894398 48b87e292df484885557 4889842490000000 488b842490000000 498943a0 4889942490000000 }
            // n = 7, score = 100
            //   488b842490000000     | dec                 eax
            //   49894398             | mov                 eax, dword ptr [esp + 0x50]
            //   48b87e292df484885557     | dec    eax
            //   4889842490000000     | mov                 dword ptr [esp + 0x398], eax
            //   488b842490000000     | dec                 eax
            //   498943a0             | mov                 eax, 0xac7803ee
            //   4889942490000000     | insb                byte ptr es:[edi], dx

        $sequence_5 = { 660fef8424c0090000 660f7f842490060000 660f6f8c24a0060000 660fef8c24d0090000 660f7f8c24a0060000 660f6f8424b0060000 660fef8424e0090000 }
            // n = 7, score = 100
            //   660fef8424c0090000     | movdqa    xmmword ptr [esp + 0x470], xmm0
            //   660f7f842490060000     | movdqa    xmm1, xmmword ptr [esp + 0x480]
            //   660f6f8c24a0060000     | pxor    xmm1, xmmword ptr [esp + 0x9b0]
            //   660fef8c24d0090000     | movdqa    xmmword ptr [esp + 0x480], xmm1
            //   660f7f8c24a0060000     | movdqa    xmm0, xmmword ptr [esp + 0x490]
            //   660f6f8424b0060000     | movdqa    xmm0, xmmword ptr [esp + 0x570]
            //   660fef8424e0090000     | pxor    xmm0, xmmword ptr [esp + 0x9a0]

        $sequence_6 = { 4889442430 488b442430 488985f0030000 48b8a819f97887eee72e }
            // n = 4, score = 100
            //   4889442430           | lea                 edi, [eax + 0x27]
            //   488b442430           | dec                 eax
            //   488985f0030000       | and                 edi, 0xffffffe0
            //   48b8a819f97887eee72e     | dec    eax

        $sequence_7 = { 668930 48830202 e9???????? 488bcf e8???????? 488d2db3840200 4c8d351caa0200 }
            // n = 7, score = 100
            //   668930               | add                 byte ptr [esi + 0xf], ah
            //   48830202             | jg                  0x1383
            //   e9????????           |                     
            //   488bcf               | and                 al, 0x20
            //   e8????????           |                     
            //   488d2db3840200       | dec                 eax
            //   4c8d351caa0200       | mov                 dword ptr [esp + 0x90], eax

        $sequence_8 = { 4533c0 ba03000040 ffd0 488bd8 4885c0 0f84c4050000 }
            // n = 6, score = 100
            //   4533c0               | inc                 eax
            //   ba03000040           | push                ebx
            //   ffd0                 | dec                 eax
            //   488bd8               | sub                 esp, 0x20
            //   4885c0               | xor                 ebx, ebx
            //   0f84c4050000         | dec                 eax

        $sequence_9 = { 488b442450 48898424d8030000 48b8cb8c59b626902cf4 4889442450 488b442450 48898424e0030000 48b8f83d64c152fdfb69 }
            // n = 7, score = 100
            //   488b442450           | movdqa              xmmword ptr [ebp + 0x1b0], xmm0
            //   48898424d8030000     | movdqa              xmm0, xmmword ptr [ebp + 0x1d0]
            //   48b8cb8c59b626902cf4     | dec    eax
            //   4889442450           | mov                 eax, dword ptr [esp + 0x30]
            //   488b442450           | movdqa              xmm0, xmmword ptr [ebp + 0x3c0]
            //   48898424e0030000     | movdqa              xmm1, xmmword ptr [ebp + 0x3d0]
            //   48b8f83d64c152fdfb69     | pxor    xmm0, xmmword ptr [ebp + 0x3e0]

    condition:
        7 of them and filesize < 628736
}