MALPEDIA_Win_Andromeda_Auto

rule MALPEDIA_Win_Andromeda_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b2db6139-0ee4-5e8d-86e7-2ff7173b97ea"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.andromeda_auto.yar#L1-L313"
		license_url = "N/A"
		logic_hash = "05ee29e80de3d90a97ea2b212851cd6156ac3e7bdf52b5dc9978b3709eae2c9a"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 3b5d0c 74cf ebcf 33c0 33db }
		$sequence_1 = { 3688b42800ffffff 3688942b00ffffff 02d6 81e2ff000000 368a942a00ffffff 301439 41 }
		$sequence_2 = { 8bec 81c400ffffff 60 b940000000 8d7dfc b8fcfdfeff fd }
		$sequence_3 = { 8b7d10 fec0 368a942800ffffff 02da 368ab42b00ffffff 3688b42800ffffff }
		$sequence_4 = { 41 3b4d14 75c3 61 }
		$sequence_5 = { e2f8 fc 33c0 8b7508 33db 368a942900ffffff }
		$sequence_6 = { b8fcfdfeff fd ab 2d04040404 e2f8 fc 33c0 }
		$sequence_7 = { 020433 368ab42800ffffff 3688b42900ffffff 3688942800ffffff fec1 7408 43 }
		$sequence_8 = { 60 e8???????? 5d 81ed???????? }
		$sequence_9 = { 50 e8???????? 83c40c 6800000100 e8???????? }
		$sequence_10 = { 6a00 6a30 8d45d0 50 6a01 ff7508 }
		$sequence_11 = { 8a06 33c9 3c5a 0f9ec1 }
		$sequence_12 = { 0fb64601 84c0 7905 0d00ffffff }
		$sequence_13 = { 33d2 3c41 0f9dc2 85ca 7404 0420 8806 }
		$sequence_14 = { 56 ff7508 c745f805000000 c745fc40000000 e8???????? }
		$sequence_15 = { 6a02 ffd3 6a32 ffd6 57 57 }
		$sequence_16 = { 6a10 8d45e0 50 ff75f0 e8???????? }
		$sequence_17 = { 83f800 0f8458010000 6804010000 ff75f8 68???????? e8???????? }
		$sequence_18 = { c745e400000000 6a00 6a00 6a00 6a06 }
		$sequence_19 = { 6a00 6a00 68???????? 6a00 e8???????? eba9 6a00 }
		$sequence_20 = { 8945d8 8945dc 66c745cc0000 c745c801010000 8d458c }
		$sequence_21 = { 6a00 6a06 6a01 6a02 e8???????? 8945f0 83f8ff }
		$sequence_22 = { 0f8476010000 6804010000 6a00 ff35???????? e8???????? 8945f8 }
		$sequence_23 = { e8???????? 6804010000 ff75fc 6a00 }
		$sequence_24 = { 83656000 ff560c 0fafd8 ff5638 33f8 81ffb19e42da }
		$sequence_25 = { 81ef21181d2d 81c6daf05740 894568 8b4568 81efe681e610 81ce9e5aef4c }
		$sequence_26 = { 0f859c000000 81f639913fa9 81e7ca3b0a91 81fe12cdd543 0f84d6fdffff 8d45e0 50 }
		$sequence_27 = { 0bf8 81f66cfd417a 81ff6ef42c67 0f84ec070000 }
		$sequence_28 = { ff75d4 35ebb0598f 50 ff75cc e8???????? }
		$sequence_29 = { 64a130000000 89456c ff5634 2bd8 81ef54666d24 81fb0965812b 0f8406010000 }
		$sequence_30 = { ff5630 2bd8 8b4558 81cf23aceabc 39456c 7519 8bc7 }
		$sequence_31 = { 69ff903caf90 ff55f4 0faff0 81febed4f06f 0f844bf7ffff 8d45e0 }

	condition:
		7 of them and filesize < 204800
}