MALPEDIA_Win_Ntospy_Auto

rule MALPEDIA_Win_Ntospy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8131d4ba-7ab9-5f25-bfe1-80fb81c429a4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ntospy"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ntospy_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "8fbd4c5ffc79f2d95a93b5deb7321b5b82d08f35463db086df64bd3e92a52647"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 5f c3 48897c2408 488d3dacf90000 }
		$sequence_1 = { eb74 85c9 7858 3b15???????? 7350 488bca 4c8d05e5b40000 }
		$sequence_2 = { 8bfa 4c8d0d5d740000 488bd9 488d1553740000 b916000000 4c8d053f740000 e8???????? }
		$sequence_3 = { b808000000 486bc000 488d0deaad0000 48c7040102000000 b808000000 }
		$sequence_4 = { 48890d???????? 488d0512f50000 488d0d3bf70000 488905???????? 48890d???????? e8???????? }
		$sequence_5 = { 4c8d0578760000 488d15016d0000 e8???????? 4885c0 740f 488bcb }
		$sequence_6 = { f20f1000 8b5808 e9???????? 488d05dfc70000 4a8b0ce8 }
		$sequence_7 = { 488d0d4c710000 8364242800 41b803000000 4533c9 }
		$sequence_8 = { c3 4883ec28 e8???????? 488bc8 488d1501040100 }
		$sequence_9 = { 4533f6 4863ce 488d3d20f90000 488bc1 }

	condition:
		7 of them and filesize < 208896
}