MALPEDIA_Win_Hesperbot_Auto

rule MALPEDIA_Win_Hesperbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f6aea63c-f69e-55d4-97f0-3c40d77d24ea"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.hesperbot_auto.yar#L1-L129"
		license_url = "N/A"
		logic_hash = "04a0a757bd6a1abed3c2e9cc240e3b373104813c31a80bae17dca4ea598f10fc"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0f84e2000000 8bce e8???????? 8b4d10 }
		$sequence_1 = { 8d4610 50 8d4608 50 56 ff15???????? 50 }
		$sequence_2 = { 77ec eb04 8d744102 8bc6 5e c3 6a00 }
		$sequence_3 = { 75f8 8d45e0 50 e8???????? e8???????? 8945ef }
		$sequence_4 = { 85ff 742b 6a20 58 48 c6043800 75f9 }
		$sequence_5 = { 7414 8b450c 894710 8b4510 33db 894714 43 }
		$sequence_6 = { 33f6 46 8937 c7470466864173 c7470867864173 89770c e8???????? }
		$sequence_7 = { 8a45fe 8a5dff 2403 004109 7418 2a5508 800940 }
		$sequence_8 = { 33f6 56 8d45f8 50 8d45f4 50 ff7508 }
		$sequence_9 = { 13f7 034c2458 1374245c 8344241440 894c2418 8974241c }

	condition:
		7 of them and filesize < 188416
}