MALPEDIA_Win_Miya_Rat_Auto

rule MALPEDIA_Win_Miya_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2fa09cd0-d97e-5ef1-8afd-e504ebc4635f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miya_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.miya_rat_auto.yar#L1-L168"
		license_url = "N/A"
		logic_hash = "82308fdb4facad37689505ec7cf7b431c129eb6fc4d51d1c40907638216c7b5c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0fbf45fc c9 c3 8bff 55 8bec 83ec18 }
		$sequence_1 = { 68a00f0000 ff15???????? 6a00 6a00 }
		$sequence_2 = { 837c240800 75be ddd8 db2d???????? b802000000 833d????????00 0f85e00c0000 }
		$sequence_3 = { 7541 d9ec d9c9 d9f1 833d????????00 0f854c0d0000 }
		$sequence_4 = { 6a00 6a06 6a01 6a02 ff15???????? a3???????? }
		$sequence_5 = { 833d????????00 0f84fa0f0000 83ec08 0fae5c2404 8b442404 25807f0000 3d801f0000 }
		$sequence_6 = { 0f85c90f0000 eb00 f30f7e442404 660f2815???????? 660f28c8 660f28f8 660f73d034 }
		$sequence_7 = { 6683e07f 6683f87f 8d642408 0f85c90f0000 }
		$sequence_8 = { 03bc24b8000000 488b542440 488d2d5c080300 488b44d500 }
		$sequence_9 = { 03c0 2bc8 0f84adfdffff 8d41ff 8b8482f83d0700 }
		$sequence_10 = { 0308 3bcf 0f84ff000000 488d8c2470010000 }
		$sequence_11 = { 03c0 2bc8 0f8456f9ffff 8d41ff 418b8480f83d0700 }
		$sequence_12 = { 03c0 442bc0 0f8423010000 418d40ff 418b8484f83d0700 }
		$sequence_13 = { 03c0 442be8 0f84a1000000 418d45ff 418b8484f83d0700 }
		$sequence_14 = { 03c0 442be8 0f84bd000000 418d45ff 488d1d6debfaff }
		$sequence_15 = { 03c0 442be0 7443 418d4424ff 8b8483f83d0700 }

	condition:
		7 of them and filesize < 1238016
}