MALPEDIA_Win_Blackbyte_Auto

rule MALPEDIA_Win_Blackbyte_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86ddcdb3-f98f-5fed-8acf-8f25a59fe9d8"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.blackbyte_auto.yar#L1-L150"
		license_url = "N/A"
		logic_hash = "cae52a5068af3fb259038670fdc83a0ab679783080eb29a6c75f1c00c83ab95b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 3bc2 72f4 b8ffffffff 4883c420 }
		$sequence_1 = { 3bd0 0f8f7f000000 4c63c2 498bcf }
		$sequence_2 = { 3bc7 7ce0 eb03 488bda }
		$sequence_3 = { 3bc1 7f4d 33c9 4c63c8 }
		$sequence_4 = { 48ffc2 4c8b842458010000 0f1f00 4939d0 0f8feefeffff }
		$sequence_5 = { 4b8d0413 90 e8???????? 488b542458 }
		$sequence_6 = { 48c744247000000000 c744247800000000 c744246800000000 48c744247000000000 }
		$sequence_7 = { 3bc8 757b 498bc8 6685d2 }
		$sequence_8 = { 4939c9 490f4cc9 90 4939c8 }
		$sequence_9 = { 3bc2 7f2f 4c63d8 85c0 }
		$sequence_10 = { 4989c1 48c1e004 4c8b940400020000 4c8b9c0408020000 }
		$sequence_11 = { 3bc7 7f38 33d2 4c63c8 }
		$sequence_12 = { 3bc8 7708 41034908 3bc1 }
		$sequence_13 = { 4989f8 4d85c9 0f8ebb000000 488b4828 }
		$sequence_14 = { 4989c1 4989c8 488b842480000000 488b8c2488000000 }
		$sequence_15 = { 4939c9 0f8234020000 48014840 4829cf 4929c9 4989f8 48f7df }

	condition:
		7 of them and filesize < 9435136
}