MALPEDIA_Win_Kimsuky_Auto

rule MALPEDIA_Win_Kimsuky_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f6b89441-1987-5ba0-8edf-1ab8837a162a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.kimsuky_auto.yar#L1-L298"
		license_url = "N/A"
		logic_hash = "0302f9bb4ba03cc69300f88428cb54ddc311de48a95ef36985a3fb1ba768c7bd"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff15???????? 3db7000000 7503 56 eb18 6a00 6a00 }
		$sequence_1 = { 8d85f0feffff 50 68???????? ff15???????? 6a04 6a00 }
		$sequence_2 = { 56 85ff 740a 33ff }
		$sequence_3 = { ffd7 a3???????? 8d85ecfbffff 50 53 ffd7 }
		$sequence_4 = { 7516 ff15???????? 8bd8 e8???????? 0fafd8 }
		$sequence_5 = { 50 8d85f8feffff 50 8d85f4fdffff 68???????? 50 e8???????? }
		$sequence_6 = { 6a00 68???????? ff15???????? 6a00 8d85e8fdffff 50 }
		$sequence_7 = { 56 ffd7 a3???????? 8d85ccf3ffff 50 56 }
		$sequence_8 = { ffd6 8bd8 85db 7510 5e 5b 8b4dfc }
		$sequence_9 = { 4c897c2468 41bb01000000 418d5b02 4d85ed }
		$sequence_10 = { 4c897c2460 ffd6 458b4754 488bd5 4c8bf0 4d85c0 }
		$sequence_11 = { 4889742438 4533ff 4c89642428 4c896c2420 33f6 4533ed 4533e4 }
		$sequence_12 = { 4d8b36 4d85f6 0f8540feffff 488b6c2460 4c637d3c 33c9 }
		$sequence_13 = { 488b6c2470 4d8bc6 4d2b4730 4183bfb400000000 }
		$sequence_14 = { 4c8b7c2460 4c8b6c2420 4c8b642428 488b7c2430 488b742438 488b6c2470 4d8bc6 }
		$sequence_15 = { 4d03d1 4d03d9 666666660f1f840000000000 418b0a }
		$sequence_16 = { 488d8a38000000 e9???????? 488d8a28010000 e9???????? }
		$sequence_17 = { 8bd7 3bd8 0f94c2 85d2 7419 }
		$sequence_18 = { 894d90 8bc1 81fb00000001 0f97c0 }
		$sequence_19 = { 4c89642430 c744242880000000 c744242002000000 4533c9 4533c0 ba00000040 }
		$sequence_20 = { 8b7590 660f1f440000 837df000 0f841b020000 }
		$sequence_21 = { 83f809 8d7340 7405 be20000000 c68424a000000000 33d2 }
		$sequence_22 = { 8b442468 6683f809 7508 83f809 }
		$sequence_23 = { 898521010000 66898525010000 888527010000 8b742450 }
		$sequence_24 = { 85c0 0f94c1 85c9 0f8494020000 89bda0000000 897d30 }
		$sequence_25 = { 488dac24d0c1ffff b8303f0000 e8???????? 482be0 }
		$sequence_26 = { 488dac24c0fdffff 4881ec40030000 488b05???????? 4833c4 48898530020000 488bf1 }
		$sequence_27 = { 488dac24d0fbffff 4881ec30050000 488b05???????? 4833c4 48898520040000 488bf9 }
		$sequence_28 = { 488dac24a0feffff 4881ec60020000 488b05???????? 4833c4 48898558010000 4c8bf9 }
		$sequence_29 = { 488dac2490f5ffff 4881ec700b0000 488b05???????? 4833c4 488985600a0000 8a4208 4c8d1d5a98fcff }
		$sequence_30 = { 488dac2480feffff 4881ec80020000 488b05???????? 4833c4 48898570010000 488bf1 488d4dc8 }

	condition:
		7 of them and filesize < 1021952
}