MALPEDIA_Win_Ksl0T_Auto

rule MALPEDIA_Win_Ksl0T_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2870abe6-5db4-5e5a-a968-46d1ac11caff"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ksl0t_auto.yar#L1-L173"
		license_url = "N/A"
		logic_hash = "e36653d3134f0d8f3891988f3daa92e765abf5eacde9d9ce4affe6397f1c8183"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 52 53 894648 ffd7 89464c 8d842468020000 50 }
		$sequence_1 = { 85c0 7531 4c8d056c3d0000 488d0da6a70000 bafb020000 e8???????? 85c0 }
		$sequence_2 = { ffd7 89465c 8d442438 50 53 }
		$sequence_3 = { 888424d3020000 c68424d402000026 c68424d502000026 c68424d60200001c c68424d702000031 }
		$sequence_4 = { 4881c22c010000 41b804000000 488d0d05e40000 ff15???????? e9???????? 488d1533c10000 }
		$sequence_5 = { 488d8c2400030000 e8???????? ba18000000 488d8c24a0000000 e8???????? ba0d000000 488d8c2480030000 }
		$sequence_6 = { 4883c202 488d8c24b0020000 ff15???????? 488b8c2400090000 ff15???????? }
		$sequence_7 = { 8138a3000000 744c 488b442450 8138a2000000 743f 4881bc242816000000010000 }
		$sequence_8 = { c684248900000039 c684248a00000039 888c248b000000 c644244438 c644244526 }
		$sequence_9 = { c684246d01000027 889c246e010000 c684246f01000020 c684247001000034 c684247101000039 }
		$sequence_10 = { 03c0 50 8d85000c0000 50 68???????? }
		$sequence_11 = { 53 ff15???????? 85c0 0f85b6000000 6a1c 68???????? 57 }
		$sequence_12 = { 68???????? e8???????? 83c40c 8b9510150000 }
		$sequence_13 = { c684249500000036 c68424960000003a c684249700000031 c684249800000030 c684249900000010 }
		$sequence_14 = { 488dbc2492040000 33c0 b9fe030000 f3aa 33c0 }
		$sequence_15 = { 4c89442418 4889542410 48894c2408 4881ec08040000 488b05???????? 4833c4 48898424f0030000 }

	condition:
		7 of them and filesize < 196608
}