MALPEDIA_Win_Monero_Miner_Auto

rule MALPEDIA_Win_Monero_Miner_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "955a70cb-c816-5b42-9b0c-1983c59598b3"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.monero_miner_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "d2f2a6810c44d021f6177132ec88906ab8d6f27abfdaa192f7272f78210ff8f2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8bbc2484000000 89f5 01f0 11fa 89442470 0facfe1c 89542474 }
		$sequence_1 = { 8bac2430010000 89b3fc000000 c6835802000001 89742408 c7442404???????? 892c24 e8???????? }
		$sequence_2 = { 8b5c2414 8b7c2410 83fb00 7708 81ffff010000 767a 8b742410 }
		$sequence_3 = { 8b4b04 894a04 8b4b04 8b730c 8911 8b6b08 8b4b14 }
		$sequence_4 = { 137c2424 03442440 89ac2468050000 8b6c247c 136c2444 89b4246c050000 894c2468 }
		$sequence_5 = { 0fb68532030000 0f95835d020000 888365020000 8b851c040000 85c0 0fb6854c030000 }
		$sequence_6 = { 8bb424b8010000 31d5 894f74 8b8c2430030000 89ac24ac010000 897770 89cb }
		$sequence_7 = { 8bac2490000000 23ac24b8010000 89b424cc010000 8bb42494000000 23b424bc010000 31d5 8b542408 }
		$sequence_8 = { f20f2ac9 8974240c f20f2af8 f20f1005???????? f20f106c2438 f20f116c2418 f20f58f4 }
		$sequence_9 = { f7d0 81f2ffffff7f 09c2 0f8437020000 c7432001000000 e9???????? 0fb64500 }

	condition:
		7 of them and filesize < 1425408
}