MALPEDIA_Win_Jessiecontea_Auto

rule MALPEDIA_Win_Jessiecontea_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "9d64ca7e-a0bd-52a7-a577-888415a044a2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.jessiecontea_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "cd5290a2f328f5ae54af9983eccd2c6f7265487a9f01ecabfc45226fcef81bba"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a00 50 e8???????? 83c424 56 6a00 6810040000 }
		$sequence_1 = { bb01000000 57 8bfa 898d84fbffff 57 }
		$sequence_2 = { 57 89bd8cfbffff 898590fbffff ffd6 }
		$sequence_3 = { 50 ff15???????? 8d85d8fbffff 8bd7 }
		$sequence_4 = { b900010000 8db5f8f3ffff 8dbdf8fbffff f3a5 }
		$sequence_5 = { 83c420 85c0 0f843effffff 68???????? }
		$sequence_6 = { 83c261 668956fe 66833e00 75e8 }
		$sequence_7 = { 50 e8???????? 83c40c 8d85f8fbffff 50 6804010000 }
		$sequence_8 = { 488b4de8 ff15???????? 488b4de0 33d2 ff15???????? }
		$sequence_9 = { 6690 8d4701 4c8d0c40 8bc7 }
		$sequence_10 = { 4533c9 4533c0 c744242003000000 ba00000040 ff15???????? 4533c9 }
		$sequence_11 = { 0f284c2460 0f114020 0f28442470 0f114830 }
		$sequence_12 = { 4881c4a0120000 5f 5e 5d c3 }
		$sequence_13 = { ff15???????? 488b0d???????? 4c8d442440 41b904000000 c744244020bf0200 }
		$sequence_14 = { 4c89bc24d0120000 448b7c2470 c744242004000000 c7442450959dd460 f20f1145e0 }
		$sequence_15 = { 488d82f9ffff7f 4885c0 7417 410fb70408 }

	condition:
		7 of them and filesize < 413696
}