MALPEDIA_Win_Ccleaner_Backdoor_Auto

rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "e8260c1e-b548-521c-a918-476d59ec0485"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ccleaner_backdoor_auto.yar#L1-L273"
		license_url = "N/A"
		logic_hash = "ada2e84c2cbbbc990519610580881a1a417e954076eefea9f77cc173589a8dfe"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ffd6 50 ff15???????? 8b3d???????? 59 }
		$sequence_1 = { b900010000 5f c60000 40 49 }
		$sequence_2 = { 03c6 85c0 7f09 488b0a 488b01 ff5008 488b4b28 }
		$sequence_3 = { 0f8302020000 8bc3 2bc2 83f803 0f82f1010000 }
		$sequence_4 = { 012e 33c0 5f 5e }
		$sequence_5 = { 013e 33c0 8b16 83c410 }
		$sequence_6 = { 03c6 4863d0 4c8d0c12 4c8d4718 }
		$sequence_7 = { 48 03d5 49 83f902 760b 41 }
		$sequence_8 = { 01cc cc 48895c2408 57 }
		$sequence_9 = { 8d45f8 50 e8???????? 0fb645fb 83c414 }
		$sequence_10 = { 50 6a00 8d8500ffffff 6a10 50 68e0000000 }
		$sequence_11 = { 03c7 4863c8 488d1c4b 493bdc }
		$sequence_12 = { 6a02 ff15???????? 56 e8???????? 8d45f8 53 }
		$sequence_13 = { 50 8b07 83e804 50 }
		$sequence_14 = { 01442418 03c8 8954242c 8b542470 }
		$sequence_15 = { 4c 03d5 48 63c8 4c 2bc9 4d }
		$sequence_16 = { 014c2464 40 89542418 89442430 }
		$sequence_17 = { 01461c 8b542424 85d2 7405 }
		$sequence_18 = { 01442454 03d1 294c2450 8b4c2410 }
		$sequence_19 = { 01442424 eb30 8b4508 897518 }
		$sequence_20 = { 00cc cc 4057 4883ec50 }
		$sequence_21 = { ebc2 83e10f 8b348d68c60210 23751c d36d1c }
		$sequence_22 = { 01460c 488b3f 493bfc 0f8554ffffff }
		$sequence_23 = { 8802 8a4701 42 47 }
		$sequence_24 = { 46 83fe3c 7cd0 33c0 5e c9 c3 }
		$sequence_25 = { 03c0 894340 8b7340 418bc4 }
		$sequence_26 = { 8b4508 c70609000000 c7471830b30210 894620 }
		$sequence_27 = { 00cc cc 4883ec28 488b11 }
		$sequence_28 = { 83c0fc 8d4f08 53 50 51 }
		$sequence_29 = { 013d???????? 8b04b5d8970210 0500080000 3bc8 }
		$sequence_30 = { ff75f8 ff15???????? 85c0 7518 8d856cfdffff }

	condition:
		7 of them and filesize < 377856
}