MALPEDIA_Win_Graphsteel_Auto

rule MALPEDIA_Win_Graphsteel_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "002d4f69-04f1-5e03-80bc-b5ac9cab1bdb"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.graphsteel_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0d13092c745c3a7a45f6cae4ad1356a333a840eb25ef3d3836be36a3d9bc8246"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c7400c00000000 48c7401000000000 c7007e000000 4489542420 448b442450 4589f9 4889f9 }
		$sequence_1 = { 4c898c24b8010000 4889bc24c0010000 4c8b9424b8010000 4d85d2 7422 450fb65a17 4589dc }
		$sequence_2 = { e8???????? b801000000 89e9 d3e0 410985cc000000 83fd01 741a }
		$sequence_3 = { f7466000ffff00 753b 8b96d4000000 c6466101 85d2 7e0a c7866001000001000000 }
		$sequence_4 = { bb16000000 e8???????? 4889842498020000 48899c2498010000 4889d9 4889c3 488d056e743e00 }
		$sequence_5 = { ff5030 85c0 752a 48638bbc000000 488b442428 4801c8 4883e801 }
		$sequence_6 = { ffd0 488b6c2448 4883c450 c3 31c0 488d1df2193a00 b926000000 }
		$sequence_7 = { 8b54244c 4c8b742430 4189c4 498916 4889d0 4180fc04 0f84dc000000 }
		$sequence_8 = { c3 488d05c9d85e00 bb0a000000 0f1f440000 e8???????? 488b4c2428 890d???????? }
		$sequence_9 = { eb0c 488d3df63c8600 e8???????? 488b0d???????? 48898c2498030000 488d05f3085500 e8???????? }

	condition:
		7 of them and filesize < 19812352
}