MALPEDIA_Win_Kagent_Auto

rule MALPEDIA_Win_Kagent_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "451a4eff-6ce7-5f9f-99c4-8fedb39d353b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kagent"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.kagent_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "ac140ab97dc52a57935b92c8b15bdbef0312eaf71c152b1c54098c93e06c68f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 85f6 0f858cfcffff 8b542420 8d0411 39442438 8b5378 }
		$sequence_1 = { 7604 2bf9 eb02 33ff 8b4314 8b742418 }
		$sequence_2 = { 51 e8???????? 33c9 a3???????? c605????????01 c705????????00000000 }
		$sequence_3 = { 83c8ff 5b 8be5 5d c3 66833b2d }
		$sequence_4 = { 8bf8 83c40c 897d98 85ff }
		$sequence_5 = { f7d9 0bc8 51 e8???????? 894304 c6430801 }
		$sequence_6 = { 6683790200 7507 40 8906 3bc3 7ce7 8b3e }
		$sequence_7 = { ff15???????? 85c0 7428 8b5678 8b7d08 017e74 52 }
		$sequence_8 = { 57 53 8bce e8???????? 3bc7 7526 }
		$sequence_9 = { c645fc21 8b430c 8b4b14 8d444003 8d0481 }

	condition:
		7 of them and filesize < 4972544
}