MALPEDIA_Win_Karsto_Rat_Auto

rule MALPEDIA_Win_Karsto_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c34bf4f5-4b74-55dd-a22e-8744ec3fa2a0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karsto_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.karsto_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "9bd1e4ab59a6417a010bca0942b95855a3ad41d78472f9a8e3faff9facca4a0f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c744242000000080 4533c9 4533c0 498bce ff15???????? 4c8bf8 4885c0 }
		$sequence_1 = { 4883e6e0 488946f8 eb08 e8???????? 488bf0 4c8bc7 }
		$sequence_2 = { d2e0 2206 48ffc6 0ad0 8817 48ffc7 498bd9 }
		$sequence_3 = { 83ff02 0f84b1020000 83f802 0f84a8020000 f7437000010000 440fb67374 742b }
		$sequence_4 = { 4883f90f 7603 488b3b 488d05f26a0100 41bc1c000000 4c8d3dc96a0100 }
		$sequence_5 = { 483bd8 773f 48897c2440 488d0419 48894610 488bc6 4983f80f }
		$sequence_6 = { 0f104f10 0f114b10 0f1117 0f115f10 4883c420 415e }
		$sequence_7 = { ff15???????? 488d4de8 48837d000f 480f474de8 4533c9 4533c0 33d2 }
		$sequence_8 = { 837b7c5e 488d737c 7569 488b4348 83700c01 488b03 488b5310 }
		$sequence_9 = { 48ffc1 4883c90f 493bcf 7613 498bff 48b90000000000000080 4883c127 }

	condition:
		7 of them and filesize < 336896
}