MALPEDIA_Win_Keyboy_Auto

rule MALPEDIA_Win_Keyboy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "5e160c48-e34a-5517-92e8-230d3035758a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.keyboy_auto.yar#L1-L209"
		license_url = "N/A"
		logic_hash = "c15a0dcb88ac9b4f1072ba3c5286b611b6bc324bd869ec34304793a506654e59"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a00 8945f2 8d45f8 50 6a0e 8d45e8 }
		$sequence_1 = { 51 ff75d8 6a00 ff75c0 }
		$sequence_2 = { c705????????3abf261f c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????2086e659 }
		$sequence_3 = { 5d c3 3b0d???????? f27502 f2c3 f2e953030000 55 }
		$sequence_4 = { c705????????d468bcb5 c705????????2086e659 c705????????eec45abf c705????????bbee2bd1 }
		$sequence_5 = { c705????????0caa6c89 c705????????a856701f c705????????597e743c c705????????0a9769e0 c705????????c4b85363 c705????????3abf261f }
		$sequence_6 = { c745ec5c417070 c745f06c655c55 8bf2 c745f470646174 66c745f86500 }
		$sequence_7 = { 8a043e 0fbe4c8de0 3401 0fbec0 0fafc8 }
		$sequence_8 = { 24a0 3ca0 7518 b800080000 }
		$sequence_9 = { 6683f806 7404 32c9 eb02 }
		$sequence_10 = { 56 6a00 ff33 ff15???????? 8945f8 85c0 }
		$sequence_11 = { 7207 b901000000 eb0f 3cfe 7509 }
		$sequence_12 = { e8???????? 85c0 755e 83ff20 }
		$sequence_13 = { 880c3e 46 3bf2 7cd6 5f 5e }
		$sequence_14 = { ffd0 e9???????? bbfeffffff eb05 }
		$sequence_15 = { c745e06c333200 50 ff15???????? 8bf8 }
		$sequence_16 = { f7d9 85db 0f44c2 23c8 }
		$sequence_17 = { 8d46d6 99 83e23f 03c2 }
		$sequence_18 = { c7852cfdffff07000100 50 ff7304 ff15???????? 85c0 }
		$sequence_19 = { 7e2a 8bce 81e107000080 7905 49 }
		$sequence_20 = { 2408 f6d8 1ac0 24dd 88474e }
		$sequence_21 = { 53 56 57 68cc020000 8d852cfdffff 8bf2 6a00 }

	condition:
		7 of them and filesize < 2170880
}