MALPEDIA_Win_Dyre_Auto

rule MALPEDIA_Win_Dyre_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "879fa518-5ec4-5357-9185-f9232454f0a1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.dyre_auto.yar#L1-L219"
		license_url = "N/A"
		logic_hash = "2b303cca8d128a9a4485286d6382ca7c5e74c54a7012acc9a782dd63fd41e54f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6800004000 6800000400 ff15???????? a3???????? }
		$sequence_1 = { 32c0 5d c3 55 8bec 56 8bf0 }
		$sequence_2 = { 6801010000 ff15???????? 8b4d18 663901 }
		$sequence_3 = { 7707 0fbec0 2bc1 eb1e 8d58bf }
		$sequence_4 = { 0540060000 c3 8d440064 c3 55 8bec }
		$sequence_5 = { 50 ff75f8 ff75f4 ff36 }
		$sequence_6 = { 32c0 5e 5d c3 8bc6 }
		$sequence_7 = { 0fb7c0 0bc1 c9 c3 }
		$sequence_8 = { 4433c0 418bc4 418bd3 c1c806 4433c0 8bc5 }
		$sequence_9 = { 4883ec40 488bc2 33ff 4c8be1 48897c2430 4533c9 }
		$sequence_10 = { 6689442444 33c0 498bf8 488bf2 }
		$sequence_11 = { 488bd9 83fa04 763b 0f1f00 0fb74b02 ff15???????? 440fb7d8 }
		$sequence_12 = { 23cd 418bc5 c1c806 8bd3 4433c0 }
		$sequence_13 = { 488bd9 b910270000 ff15???????? 488bcb }
		$sequence_14 = { 4433c0 418bc4 4123c5 33c8 8bc3 4403c1 418bcb }
		$sequence_15 = { 443bdf 7725 663933 7432 }
		$sequence_16 = { 668b1401 668910 83c002 4e 75f3 }
		$sequence_17 = { 90 ff15???????? 8a0437 8806 46 4b }
		$sequence_18 = { 56 8bf1 85db 7416 }
		$sequence_19 = { 57 8bfa 2bfe 90 ff15???????? 8a0437 }
		$sequence_20 = { 85db 7416 57 8bfa }
		$sequence_21 = { 751b 6a00 6800004000 6800000400 }
		$sequence_22 = { a1???????? 6a08 50 ff15???????? 8bd8 }

	condition:
		7 of them and filesize < 590848
}