MALPEDIA_Win_Atlantida_Auto

rule MALPEDIA_Win_Atlantida_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d0ff3011-2574-579c-b095-c8e52ea9b664"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlantida"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.atlantida_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "6618f7d3df9f19fc9e20bc9d09a7f245a55b15399a81cb4ebcd6bce5c256b3a8"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { d0c2 80f20a 0bc1 33c8 f6da 32da 23c0 }
		$sequence_1 = { ffe2 8b17 b8ae3fbb95 660fb60c22 66894c2702 0fbfc8 8b8c314ec0ffff }
		$sequence_2 = { ffe6 f7d9 f7d1 41 0fbef5 4a c7843c6ceb46ec07f22abc }
		$sequence_3 = { e9???????? d3840c9e29cbff 8994483c5396ff 8bd1 23ca 5a 8b940da629cbff }
		$sequence_4 = { ff742400 9d 48 8d642408 e8???????? b9336dacca f7d9 }
		$sequence_5 = { e8???????? 4a 51 66c1f8a7 89840c0600a1e9 f7d2 13d0 }
		$sequence_6 = { ffe0 8a943a1e001185 f6d0 0fa3c9 51 66194c2410 f6d2 }
		$sequence_7 = { ffce 51 0f8f9f51eaff 8bbc1c7c69e2ac e8???????? ffc7 81e292291ace }
		$sequence_8 = { ffc7 4a 8d8c361e280a7a 4e 23ac6c92feadb6 4e 898c6ca2feadb6 }
		$sequence_9 = { ff75e8 c645cc00 ff75cc 51 8d4dd0 e8???????? 46 }

	condition:
		7 of them and filesize < 13793280
}