MALPEDIA_Win_Gozi_Auto

rule MALPEDIA_Win_Gozi_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9aa10efd-66c7-5e31-9851-226298d161da"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.gozi_auto.yar#L1-L307"
		license_url = "N/A"
		logic_hash = "dac9feb06c684c42ada85b54c60ce95ba475c3e84edfabcc82c47570c2d13d67"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 45 43 6f 6d 7061 63743200 c808bf35 }
		$sequence_1 = { 6a00 6a00 8b4d18 e8???????? 8b45e0 50 }
		$sequence_2 = { 94 6e 8ee1 54 257c693a5c 48 fb }
		$sequence_3 = { c7400402000000 e9???????? 817df800001000 7607 c745f800001000 }
		$sequence_4 = { 8bf0 8b450c 8b4010 83660c00 894604 }
		$sequence_5 = { ff7514 ff7510 ff750c ff7508 8d8715050000 ff10 }
		$sequence_6 = { 7447 56 53 ff15???????? 8945d8 56 }
		$sequence_7 = { e8???????? 6af4 dbe9 68912b4384 2383e08985e4 0572b6e2f4 fd }
		$sequence_8 = { f6c5fe 0fbed0 4a d2ca 86f2 }
		$sequence_9 = { e8???????? 6a00 8d879a040000 50 ff750c e8???????? }
		$sequence_10 = { 36110b 33745571 de7e75 cd18 4a 51 d2b8c512294e }
		$sequence_11 = { 85c0 7417 8b55f0 8b75f0 2bd1 }
		$sequence_12 = { 86f2 84c1 0fadea 86f2 0fafd5 }
		$sequence_13 = { 8a11 3a140e 750e 47 41 }
		$sequence_14 = { b606 d2ca 0fafd5 8af4 a1???????? }
		$sequence_15 = { 7502 eb20 8d458c 50 }
		$sequence_16 = { 741f 0faccef6 0fbdd5 0fc0d6 }
		$sequence_17 = { ff15???????? 8945e4 57 68???????? e8???????? }
		$sequence_18 = { ff15???????? 85c0 7454 83a5d0fdffff00 6800040000 e8???????? 59 }
		$sequence_19 = { c22800 55 8bec 56 8b752c 57 }
		$sequence_20 = { e9???????? 395dec 0f8415010000 c745fc02000000 c745f801000000 e9???????? }
		$sequence_21 = { 743b 0fc0d6 80ca72 b6e6 }
		$sequence_22 = { 0fbdd5 0ad0 bef48d351e b6f6 c0caaa }
		$sequence_23 = { 41 b87e8da638 e022 3a56b9 }
		$sequence_24 = { 8d45e0 50 68???????? 6802000080 ff15???????? 85c0 7517 }
		$sequence_25 = { 036890 2b02 9a102a6715fb53 31db b0a6 46 }
		$sequence_26 = { 8c6a38 55 f79bfe7ca80d a7 ad b710 }
		$sequence_27 = { e9???????? ff75d8 ff7514 8d87f2030000 ff10 0bc0 }
		$sequence_28 = { fb 5c 3c32 7e02 19c1 a6 3327 }
		$sequence_29 = { 83c40c c20400 6a0c 68???????? e8???????? }
		$sequence_30 = { ff7618 8f461c 8b13 8b12 }
		$sequence_31 = { 0fbdf1 4e d2ee b6d6 }

	condition:
		7 of them and filesize < 568320
}