MALPEDIA_Win_Kiwistealer_Auto

rule MALPEDIA_Win_Kiwistealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "03031c87-ec9e-548f-8440-76f03c3e7c2a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kiwistealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.kiwistealer_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "f883b5c67ed6c65669f99076aeae0c368f0044861db0cb06fafc1de5c8e39db3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 4885c0 751f 488b442460 48634804 488d442460 4803c8 }
		$sequence_1 = { 744b 4c8bcb 48837b1808 7203 4c8b0b 488b5310 488b4618 }
		$sequence_2 = { 663bd5 7509 410fb7c7 e9???????? 488b4140 488b38 488b4158 }
		$sequence_3 = { 488d15ec550100 488d8c2498030000 e8???????? 90 4c8d842498030000 488d942460080000 488d8c2430060000 }
		$sequence_4 = { c3 488d0541da0100 41c70074000000 49894008 498bc0 41c6400401 c3 }
		$sequence_5 = { 4883f81f 7607 ff15???????? cc e8???????? 660f6f05???????? f30f7f842420020000 }
		$sequence_6 = { 660f1f440000 488b4120 48898390000000 4885c0 7507 4889ab98000000 }
		$sequence_7 = { 488bcf 4b8d1c3e 488d53c0 e8???????? 488d53e0 488d4f20 e8???????? }
		$sequence_8 = { 48f7fb 4869c800ca9a3b 498bc0 4899 48f7fb 4869c200ca9a3b 4899 }
		$sequence_9 = { 4803c8 b20a ff15???????? 440fb6c0 488d9424d8060000 488d8c24e0070000 e8???????? }

	condition:
		7 of them and filesize < 403456
}