MALPEDIA_Win_Laturo_Auto

rule MALPEDIA_Win_Laturo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "98d40c94-b7bc-59a3-90e9-3d3cbb975d15"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laturo"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.laturo_auto.yar#L1-L179"
		license_url = "N/A"
		logic_hash = "527994ff8a64611a3b4923dfec436ab105c6a6829fbdd226093aaafb3854beb4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 25fd000000 3de9000000 0f85e4000000 0fb6442450 488b4c2430 4803c8 488bc1 }
		$sequence_1 = { 488b4c2428 894120 8b442478 83e001 c1e002 }
		$sequence_2 = { 48894c2428 89542420 4c8d0d574effff 4c8b4570 8b5568 }
		$sequence_3 = { 660feb15???????? 660feb0d???????? 4c8d0de4910000 f20f5cca f2410f590cc1 660f28d1 660f28c1 }
		$sequence_4 = { 8b4021 83c820 488b8c24a8000000 894121 488b8424a8000000 488b4c2410 }
		$sequence_5 = { 39442420 7342 8b442420 488b4c2440 488b09 448b0481 33d2 }
		$sequence_6 = { eb76 488b8424a8000000 0fb60c24 884802 0fb6442401 83c820 88442401 }
		$sequence_7 = { 4889442440 0fb644245b 25f0000000 83f870 7411 }
		$sequence_8 = { 8a4dfc be04000000 0fb6c0 83e800 741f 83e801 }
		$sequence_9 = { c1fa06 8934b8 8bc7 83e03f 6bc830 8b049530430110 8b440818 }
		$sequence_10 = { eb07 8b0cc5fc1b0110 894de4 85c9 7455 }
		$sequence_11 = { c1ea03 33c9 83e20f 7640 8b5e08 0fb6440e20 03c3 }
		$sequence_12 = { 0fbe45b8 03c8 8b5de8 8b03 3bc1 7718 83c005 }
		$sequence_13 = { 33f6 c745fc00000000 56 6a01 }
		$sequence_14 = { 8b03 03de 894214 8b45f0 eb30 }
		$sequence_15 = { 8a65fb 8bf7 84e4 754e 80fdd9 7249 80fddf }

	condition:
		7 of them and filesize < 253952
}