MALPEDIA_Win_Batel_Auto

rule MALPEDIA_Win_Batel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c91d0b1c-2fe0-51d7-a49d-7d6cffcd2786"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batel"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.batel_auto.yar#L1-L231"
		license_url = "N/A"
		logic_hash = "a9cd956e2178bd46c61a7442a0a8fdeafc2cb5e9b8c9fa3dfaa648b03338c845"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 33c0 5b c21000 3b0d???????? 7502 }
		$sequence_1 = { 68ee020000 ff15???????? 689d020000 8d8561fdffff 6a00 50 }
		$sequence_2 = { 6868212300 e8???????? 33db 895de4 }
		$sequence_3 = { 83c003 41 3d???????? 7cec 56 57 }
		$sequence_4 = { 56 ffd3 68005c2605 ffd5 47 }
		$sequence_5 = { 8b4508 2d00002300 50 6800002300 e8???????? 83c408 85c0 }
		$sequence_6 = { ff750c ff7508 6862102300 6800302300 e8???????? }
		$sequence_7 = { 83c40c 33c9 b8???????? 8a10 88940d60fdffff 83c003 }
		$sequence_8 = { ff15???????? 8bf0 85f6 7429 68f4202300 }
		$sequence_9 = { ff15???????? 85c0 7412 ffd0 56 ffd3 }
		$sequence_10 = { 85f6 7422 68???????? 56 ff15???????? 85c0 7412 }
		$sequence_11 = { 6a00 50 c68560fdffff00 e8???????? 83c40c 33c9 }
		$sequence_12 = { ffd5 47 83ff5a 7ccd }
		$sequence_13 = { 8db560fdffff f3a5 66a5 ffd0 5f 5e }
		$sequence_14 = { 56 57 68a00f0000 ffd5 8b1d???????? }
		$sequence_15 = { 7505 e8???????? 33c0 5d c20400 685f142300 ff15???????? }
		$sequence_16 = { a1???????? 85c0 752c 8935???????? 68d0202300 }
		$sequence_17 = { 8b1d???????? bf01000000 8d642400 68???????? ff15???????? 8bf0 }
		$sequence_18 = { ff15???????? 8b1d???????? bf01000000 8da42400000000 68e0202300 ff15???????? }
		$sequence_19 = { 8bec 81eca0020000 68ee020000 ff15???????? }
		$sequence_20 = { 7cec 56 57 6a40 6800100000 689e020000 }
		$sequence_21 = { 83ff5a 7ccd 5f 5e 5d 33c0 5b }
		$sequence_22 = { 8bf8 b9a7000000 8db560fdffff f3a5 }

	condition:
		7 of them and filesize < 49152
}