MALPEDIA_Win_Darkvision_Rat_Auto

rule MALPEDIA_Win_Darkvision_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d8f88a61-3b53-5e7f-a245-28c27259198d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvision_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.darkvision_rat_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "8ccc68ca17af1f5ed3d9e6c6f99e00360018c95702d9b72c49381c60586654b0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 89842408040000 83bc240804000004 7d1f 4863842408040000 488b94c4e8030000 488b8c24e0030000 e8???????? }
		$sequence_1 = { 837c242000 7426 448b442420 33d2 b901001000 ff15???????? 4889442428 }
		$sequence_2 = { 48638c2420010000 486bc91c 48837c081800 7464 4863842408010000 4869c0040b0000 }
		$sequence_3 = { 4889442460 c784249801000000000000 eb10 8b842498010000 ffc0 89842498010000 }
		$sequence_4 = { 488d840108010000 4889842498020000 c78424f402000000000000 eb10 8b8424f4020000 ffc0 898424f4020000 }
		$sequence_5 = { 8b8c24ac000000 03c8 8bc1 898424ac000000 48638424a8000000 488b8c2430010000 4803c8 }
		$sequence_6 = { 488d9424f0000000 48c7c101000080 ff15???????? bafeff0000 b940000000 ff15???????? 48898424e8000000 }
		$sequence_7 = { 48c784246002000000000000 b9e8030000 ff15???????? 833d????????01 0f85ba000000 4883bc247802000000 0f85ab000000 }
		$sequence_8 = { 8b440124 8984249c010000 c78424a401000000000000 8b84249c010000 2500000004 85c0 7412 }
		$sequence_9 = { 4889442460 488b442460 4863403c 488b4c2460 4803c8 488bc1 4889442420 }

	condition:
		7 of them and filesize < 618496
}