MALPEDIA_Win_Etumbot_Auto

rule MALPEDIA_Win_Etumbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a44590c-476a-596a-b348-9adff5cd4282"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.etumbot_auto.yar#L1-L328"
		license_url = "N/A"
		logic_hash = "2541b1e1314c0309767c3abbf1fef376036fad0806f0510c9f7058d5374fb3bc"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8a00 02c2 0fb6c0 8a8405fcfeffff 320437 8806 46 }
		$sequence_1 = { c1e004 03c1 8bc8 81e1000000f0 7407 8bf9 }
		$sequence_2 = { 23c1 42 4e 75df }
		$sequence_3 = { ff15???????? ffd7 2bc3 3bc6 72ed 5f 5e }
		$sequence_4 = { 7407 8bf9 c1ef18 33c7 }
		$sequence_5 = { c745ac5c5c4d69 c745b063726f73 c745b46f66745c c745b85c57696e }
		$sequence_6 = { 8d45a4 50 6801000080 c745a4536f6674 }
		$sequence_7 = { 8b3d???????? ffd7 8b7508 8bd8 69f660ea0000 }
		$sequence_8 = { c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 c745c47272656e c745c874566572 }
		$sequence_9 = { 56 57 0fbe38 33f6 }
		$sequence_10 = { 55 8bec 53 56 57 8b3d???????? ffd7 }
		$sequence_11 = { 33c7 f7d1 23c1 42 }
		$sequence_12 = { c745c874566572 c745cc73696f6e c745d05c5c496e c745d47465726e c745d865742053 c745dc65747469 }
		$sequence_13 = { 6820a10700 50 68???????? 68???????? }
		$sequence_14 = { c645be74 c645bf69 c645c062 c645c16c }
		$sequence_15 = { 8d540964 52 e8???????? 83c404 }
		$sequence_16 = { 83c204 3b5514 7608 83c8ff }
		$sequence_17 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? }
		$sequence_18 = { 80e10f c0e102 c0eb06 02cb }
		$sequence_19 = { 0345f0 8b4d08 034dec 8a11 }
		$sequence_20 = { 83c101 894d08 8b550c 83ea03 }
		$sequence_21 = { 81ec30030000 8065ff00 56 57 }
		$sequence_22 = { 8d8560ffffff 68???????? 50 e8???????? ffb63cb64000 }
		$sequence_23 = { c645e96c c645ea20 c645eb73 c645ec6c }
		$sequence_24 = { 83c104 3b4d14 7608 83c8ff }
		$sequence_25 = { e8???????? 59 50 8d45f8 57 50 }
		$sequence_26 = { c645c265 c645c33b c645c420 c645c54d }
		$sequence_27 = { c645a52d c645a643 c645a76f c645a86e c645a974 c645aa72 }
		$sequence_28 = { 034dec 8a11 8810 8b45f0 83c001 }
		$sequence_29 = { c645d577 c645d673 c645d720 c645d84e c645d954 }
		$sequence_30 = { 8b4df4 034df0 8b5508 0355ec 8a02 }
		$sequence_31 = { c645c653 c645c749 c645c845 c645c920 }
		$sequence_32 = { 895da0 895dfc c645e050 c645e172 c645e26f }
		$sequence_33 = { c644242d45 c644242e6e c644242f61 c644243062 c64424316c c644243265 c644243300 }
		$sequence_34 = { 6a00 c644243457 c644243569 c64424366e }
		$sequence_35 = { 83c404 8bd1 c1e902 f3ab 8bca 83e103 }
		$sequence_36 = { 3b1cfda0674100 7406 47 83ff17 7cf1 83ff17 }

	condition:
		7 of them and filesize < 450560
}