MALPEDIA_Win_Zeoticus_Auto

rule MALPEDIA_Win_Zeoticus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "02062136-4ff6-5a0d-a2b7-9e52e208dc4c"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.zeoticus_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "1938f528cac13c2816df475085910aa07eeddab6b22755098f5f4dade956f9bd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a0e b9b7070247 e8???????? 83c408 a3???????? 8d4c2408 51 }
		$sequence_1 = { 5e 0f28ac2408020000 660feff1 660fd4ac2458010000 660f380035???????? 0f28a42448010000 660fd4eb }
		$sequence_2 = { 0f29742460 660fd4c3 0f294c2410 0f298424d0000000 660fd4cc 660fefc5 }
		$sequence_3 = { 8bf0 e8???????? 83c408 a3???????? 8d4c241c 51 56 }
		$sequence_4 = { ba???????? 6811e7c138 6a14 b93c0b0ae9 e8???????? 83c408 a3???????? }
		$sequence_5 = { 2b8564ffffff 898534ffffff 8b45b8 2b8568ffffff 898530ffffff 8b45bc 2b856cffffff }
		$sequence_6 = { 660f6e5c244c 660f62d8 0f294c2410 660f6e4c2448 0f29542460 0f295c2470 }
		$sequence_7 = { 83e904 79ed 8b4c2444 8d51fe 85d2 }
		$sequence_8 = { 53 ffd0 85c0 7511 39742414 750b }
		$sequence_9 = { 68ebe5da62 6a10 e8???????? 83c408 a3???????? 8d4c2418 51 }

	condition:
		7 of them and filesize < 468992
}