MALPEDIA_Win_Industrial_Spy_Auto

rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86751493-28b0-577c-bc7a-18a9ce5ff38e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industrial_spy"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.industrial_spy_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "3d02a84d39c81bff432f4a4e8d820eec44463a51de2b7fbd0c8e498b622347de"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 448bcf 4c8d442460 488bd6 488bce 4103dc e8???????? }
		$sequence_1 = { 0f8f8dfeffff 4c8bb424a8010000 ff15???????? 488bc8 4d8bc5 33d2 ff15???????? }
		$sequence_2 = { 0f8408010000 8b4c2448 488d1502dffeff 2b4c244c 41b826000000 894c2448 0f8542fcffff }
		$sequence_3 = { 0f31 48c1e220 480bc2 833900 e9???????? 83650b00 488d5567 }
		$sequence_4 = { 41c1e608 440bf0 420fb6441201 41c1e608 440bf0 83bb9001000000 7419 }
		$sequence_5 = { eb18 4885c9 750b 488d0d3df40000 }
		$sequence_6 = { 85c0 0f840b010000 488d05f6030100 4a8b04e8 42385cf838 }
		$sequence_7 = { e8???????? 488d4c2450 ff15???????? 488364242000 4c8d4d88 448bc0 }
		$sequence_8 = { 837c8dc000 7508 ffca 4883e901 }
		$sequence_9 = { 418be9 48c1f806 488d0de0080100 4183e23f }

	condition:
		7 of them and filesize < 339968
}