MALPEDIA_Win_Credraptor_Auto

rule MALPEDIA_Win_Credraptor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d0b1027-08e6-50d3-a781-8fb7ecf31e45"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.credraptor_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "fe9ed9ed58c22287dd1af580d8d6d2ff7795312c2dc30f56a9c696ba71ba8156"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b54080c f6424e01 753a 83fb01 7435 8b4508 50 }
		$sequence_1 = { ffd3 6804010000 6a00 85c0 7435 8d95f8feffff 52 }
		$sequence_2 = { ddd8 83c8ff 8be5 5d c3 dc0d???????? e8???????? }
		$sequence_3 = { eb06 891e c6460401 8b4610 83f8ff 7449 8d48d0 }
		$sequence_4 = { 8d55a8 52 8945a8 8945ac 8b45ec 6a12 50 }
		$sequence_5 = { b801000000 014748 8945d8 8b4748 50 6a00 6a1c }
		$sequence_6 = { c3 8b5018 53 8b5838 56 8b31 895588 }
		$sequence_7 = { f6411604 8945ac 8944bde8 7440 8b9cbd64ffffff 8b55ac 8bc3 }
		$sequence_8 = { e8???????? 50 8bf3 68???????? 8d5f04 e8???????? 8b5df8 }
		$sequence_9 = { ff2485b1024900 838de8fdffffff 89b594fdffff 89b5bcfdffff 89b5ccfdffff 89b5d0fdffff 89b5f0fdffff }

	condition:
		7 of them and filesize < 1728512
}