MALPEDIA_Win_Darkmegi_Auto

rule MALPEDIA_Win_Darkmegi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "16948d4e-0905-5953-bba2-03b9cf86640e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.darkmegi_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "89c060c560a9e4be803246e0865acc99796bfbee031faaea9ee388f598eb37b2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a03 6a00 6a00 8d542478 6800000080 }
		$sequence_1 = { 5d 33c0 5b 81c474100000 c3 55 8b2d???????? }
		$sequence_2 = { 52 e8???????? 83c404 8bd8 85f6 7426 8b35???????? }
		$sequence_3 = { 7425 0fb6d2 f6820196b40204 740c }
		$sequence_4 = { f2ae 8bcd 4f c1e902 f3a5 8b842464020000 }
		$sequence_5 = { 0f8c74ffffff 5f 5e 8bc3 5d }
		$sequence_6 = { b941000000 33c0 8d7c2414 5b f3ab 837c240c05 7556 }
		$sequence_7 = { f7d1 2bf9 c644246300 8bf7 8be9 8bfa }
		$sequence_8 = { 6a00 ff15???????? 8bf0 ff15???????? 3db7000000 7517 }
		$sequence_9 = { 66899c247c060000 f3ab 85d2 66ab 0f8ea1010000 53 8d442448 }

	condition:
		7 of them and filesize < 90304
}