MALPEDIA_Win_Blacklotus_Auto

rule MALPEDIA_Win_Blacklotus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d42cbe72-e785-5fef-a32b-e74b59c876d0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.blacklotus_auto.yar#L1-L119"
		license_url = "N/A"
		logic_hash = "2d20a8fdb754913b5c048ddcf6b114f120d6fc7b1bb4332f4602a2e54686d4b8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488bf0 e8???????? 4533c0 8d530d 488d0da31c0000 }
		$sequence_1 = { 4c8bf0 e8???????? 4c8bf8 4885f6 }
		$sequence_2 = { 663905???????? 0f85c2000000 be06000000 488d15741d0000 448bc6 488bcb }
		$sequence_3 = { 7c10 6642837cc11010 7507 42395cc114 }
		$sequence_4 = { c745487fff0400 e8???????? 488bcf 488bd8 e8???????? 498bce 488bf8 }
		$sequence_5 = { 418a400e 4188480a 418a4806 41884006 418a4007 4188480e }
		$sequence_6 = { 488b4940 e8???????? 3db01d0000 7277 3df0230000 }
		$sequence_7 = { 4889742410 57 4883ec20 488364244000 488bf2 }
		$sequence_8 = { ffc8 03c3 44888430d8070000 453bd1 72b9 8b15???????? ffca }
		$sequence_9 = { 8bda 488bf9 83fa02 0f824d010000 488d35b1160100 4585c0 }

	condition:
		7 of them and filesize < 181248
}