MALPEDIA_Win_Kikothac_Auto

rule MALPEDIA_Win_Kikothac_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1fa78b73-bb1f-57f6-a8e9-b622d8e0ede4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.kikothac_auto.yar#L1-L114"
		license_url = "N/A"
		logic_hash = "b02af1756199e51401b4155e33587ee753667afd908709121e8fdd68d090d98d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 9c 688f9a75da 668910 c60424cd }
		$sequence_1 = { 660fb6f2 66c704242554 0fb6f1 9c 894c2420 ff742404 }
		$sequence_2 = { 59 59 8b7508 8d34f5e0214100 391e }
		$sequence_3 = { 9c 8f442444 9c 89742444 5e 66f7d6 8db3afd65e6a }
		$sequence_4 = { 48 9c 40 00749c40 }
		$sequence_5 = { 8d34e5363be8b1 8b742458 882c24 66c744240865f2 }
		$sequence_6 = { f5 f6d8 9c 28c3 f9 }
		$sequence_7 = { 89742424 60 894c2440 660fbef0 660fce }
		$sequence_8 = { c64424080e 50 38c6 98 }
		$sequence_9 = { 9c 8d64242c e9???????? f6dc 8b4500 d2d6 }

	condition:
		7 of them and filesize < 581632
}