MALPEDIA_Win_Ghostsocks_Auto

rule MALPEDIA_Win_Ghostsocks_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5c1cb11a-0850-5d40-b71f-408c9daae878"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ghostsocks_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "c337a9e96f9dca2a0a87fca084e46544266617e7aebed208b795d0bb71baeab6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb0b e8???????? 8b4c2434 890f 8908 8b4c241c 8b5130 }
		$sequence_1 = { e9???????? 89f1 e8???????? 89f9 89f2 e8???????? 89f8 }
		$sequence_2 = { eb18 891c24 897c2404 e8???????? 8b6c2408 8b5c2414 8b7c241c }
		$sequence_3 = { eb09 c644243c01 83c428 c3 89c8 89e9 e8???????? }
		$sequence_4 = { e8???????? 890f 8b8424a8000000 8b5020 895704 894820 8b4808 }
		$sequence_5 = { e8???????? ebb0 8b0d???????? 648b09 8b09 3b6108 0f8646020000 }
		$sequence_6 = { e8???????? 837c246803 75cf 8b4c2464 668139646e 75c4 80790273 }
		$sequence_7 = { eb3a 894c2424 89442444 891424 894c2404 89742408 894c240c }
		$sequence_8 = { f20f114c242c 83c414 c3 8b44241c f30f1000 f30f104804 f30f5ac0 }
		$sequence_9 = { e9???????? 0fb64c2412 e9???????? 83f806 0f84b1010000 83f808 751e }

	condition:
		7 of them and filesize < 16646144
}