MALPEDIA_Win_Ghostemperor_Auto

rule MALPEDIA_Win_Ghostemperor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03561f3b-0abe-57dc-b978-3c939c0fe915"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ghostemperor_auto.yar#L1-L226"
		license_url = "N/A"
		logic_hash = "3fa3d4eb8704961c7c97c6073c0242bdef28b1790df0c9cdaa55e317b1e02d8f"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff15???????? 89f0 4883c420 5b 5d 5f }
		$sequence_1 = { 44894648 49c1e003 488d5108 e8???????? 8b4648 85c0 }
		$sequence_2 = { c3 4489d6 83e603 4929f3 4e8d0cd9 4a8d04da 4529da }
		$sequence_3 = { 4889ce b920000000 e8???????? 4889c7 0f57c0 }
		$sequence_4 = { 4989d6 4889ce 498b4808 4885c9 740d e8???????? 48c7470800000000 }
		$sequence_5 = { 4585d2 0f84b9000000 418d42ff 4c8d5801 4983fb04 7222 }
		$sequence_6 = { 89ce c1ee1d c1e103 09ce }
		$sequence_7 = { 4989c9 4889d0 458d5aff 41f6c203 7427 4489d1 83e103 }
		$sequence_8 = { 7567 8b542450 33c9 ff15???????? 488bf8 }
		$sequence_9 = { 00c2 488b8568020000 8854080c 488b85b0020000 }
		$sequence_10 = { 0fb78316010000 c1e208 0bd1 0fb6c8 }
		$sequence_11 = { 052797fa04 351337a665 8945f4 488b4510 }
		$sequence_12 = { 01c3 69cbe8030000 81c130750000 4883ec20 }
		$sequence_13 = { 0552f0384d 358e257f87 894530 488b4570 }
		$sequence_14 = { 4885c0 7405 493bc0 7538 0f31 48c1e220 488d0db130ffff }
		$sequence_15 = { c7858c000000bf00d200 0f108580000000 c78590000000f0000000 8b8590000000 }
		$sequence_16 = { ffc0 4881c200010000 413bc0 72ed eb1b }
		$sequence_17 = { 8bf0 85c0 792e 4c8d442470 }
		$sequence_18 = { 05f226dac9 35bcfe1eea 894534 488b4550 }
		$sequence_19 = { 01c1 89ca c1ea1f c1f904 }
		$sequence_20 = { 01d1 89ca c1e205 89cb }
		$sequence_21 = { 48897c2448 448bc5 89442440 498bd6 }
		$sequence_22 = { 00c1 488b8568020000 488b95b0020000 884c100c }
		$sequence_23 = { 4983f90f 72bf 66895df5 c745f701000000 488bcb 0fb7440dd7 6689440d17 }

	condition:
		7 of them and filesize < 1115136
}