MALPEDIA_Win_Earthworm_Auto

rule MALPEDIA_Win_Earthworm_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f464d0d5-2848-5f1d-b0da-be4baede011b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.earthworm"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.earthworm_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7914f56bbea8d8d38e0c4986096d097094f54727a3ceb9106fff83fd37dd59b4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 41b99a010000 4c8d0543500500 ba02000000 b928020000 e8???????? 488bd0 488d4c2420 }
		$sequence_1 = { 837c243800 753a 488d057c2a0c00 4889442428 488d0578980b00 4889442420 4533c9 }
		$sequence_2 = { eb0f 488d05a5150a00 4889842480000000 488b842480000000 4889842488000000 48c744244800000000 48c744247800000000 }
		$sequence_3 = { eba0 488b842498010000 488b4010 448b08 488b842498010000 4c8b4008 488d942428010000 }
		$sequence_4 = { e8???????? eb1e 488d0de2680700 e8???????? eb10 488d0ddc680700 e8???????? }
		$sequence_5 = { e8???????? 488bd0 488d8c24e0020000 e8???????? 90 e8???????? 85c0 }
		$sequence_6 = { 488b942418090000 488d4c2428 e8???????? 90 8b442420 2500800000 85c0 }
		$sequence_7 = { 488b4008 4889442430 488b442470 488b4008 488b00 488b4018 4889442428 }
		$sequence_8 = { 753a 488d057fa60900 4889442428 488d05ab910900 4889442420 4533c9 41b884060000 }
		$sequence_9 = { 89442424 488b442470 8b00 39442424 7d5b 8b442478 39442424 }

	condition:
		7 of them and filesize < 2659328
}