MALPEDIA_Win_Carrotbat_Auto

rule MALPEDIA_Win_Carrotbat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9c5a3a20-60c2-5dcf-a60f-f619d67554ce"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.carrotbat_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "d882602801007a1975bc3e96f8f6fca5dd27c0a35d61f2403626f094b8ddf9f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8bec 8b4508 ff34c5a0d54000 ff15???????? 5d c3 6a0c }
		$sequence_1 = { 668b4c4310 66890c4584ec4000 40 ebe8 33c0 8945e4 3d01010000 }
		$sequence_2 = { eb05 68???????? 8d85f8feffff 50 8d85f4fdffff e8???????? }
		$sequence_3 = { 42 3bd1 7cf1 8b550c 8d7201 8a1a 42 }
		$sequence_4 = { 46 3bf2 7cf2 5f 03d1 5e }
		$sequence_5 = { 8a1a 42 84db 75f9 2bd6 33f6 85d2 }
		$sequence_6 = { 84c0 75f8 6a1a 59 be???????? }
		$sequence_7 = { 68???????? 50 e8???????? 6a02 8bf8 6af8 }
		$sequence_8 = { 8dbdf4f9ffff a5 a5 a5 8d85f4fdffff }
		$sequence_9 = { 57 e8???????? e8???????? 6803010000 8d85f9feffff 6a00 50 }

	condition:
		7 of them and filesize < 360448
}