MALPEDIA_Win_Dratzarus_Auto

rule MALPEDIA_Win_Dratzarus_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b05b6cf3-df9c-5822-94de-c2d1dd169a66"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.dratzarus_auto.yar#L1-L126"
		license_url = "N/A"
		logic_hash = "28b394085017763658cb32f571c0bc3ead50b44836e5d19cbb1fb8a91890baf5"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 33d2 33c9 4889442420 48895c2448 c744244001000000 }
		$sequence_1 = { c6453c5b e8???????? 488bc8 ff15???????? 488bd8 4885c0 7511 }
		$sequence_2 = { c785380400004e70775d c7853c04000063706229 c745b002332420 c745b435240728 c745b82d240041 c74424607a2ed60d }
		$sequence_3 = { 6689440afe 6685c0 75ef 33c0 4883c9ff 488dbc2480060000 }
		$sequence_4 = { 4883c430 5f 5e 5b c3 488b4c2468 41b902000000 }
		$sequence_5 = { bf01000000 488bcb ff15???????? 8bc7 488b8c2460020000 4833cc e8???????? }
		$sequence_6 = { c785f0000000fd77f4c4 c785f4000000ba55a70a c785f8000000d01a40b1 66c785fc00000064ca c685fe000000e4 }
		$sequence_7 = { e8???????? 488bcb 488bd0 ff15???????? 488d8d58020000 ba13000000 488905???????? }
		$sequence_8 = { 89842454020000 e8???????? b902000000 8d5701 4533c0 }
		$sequence_9 = { 488d4de0 ba16000000 e8???????? 488bcb 488bd0 ff15???????? 488b5c2460 }

	condition:
		7 of them and filesize < 1606656
}