MALPEDIA_Win_Mqsttang_Auto

rule MALPEDIA_Win_Mqsttang_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "31e470ea-5daf-55d5-9ab9-daffe03ba419"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.mqsttang_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d63f74e1b4cf54690499c28bf36f092d5dc58ca7c560cdfd72180b19011ef687"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e9???????? c744240804000000 c744240402000000 890424 e8???????? e9???????? 8d4590 }
		$sequence_1 = { f0832801 740f 89f1 e8???????? 83c424 89d8 5b }
		$sequence_2 = { e8???????? 8b560c 8b4208 8b4a0c 29c1 85c9 7e22 }
		$sequence_3 = { e8???????? 89f9 e8???????? 891c24 e8???????? 89c3 ebed }
		$sequence_4 = { f0830201 8b500c 8b4010 89530c 894310 f0830301 8b06 }
		$sequence_5 = { e9???????? 8b85e0fdffff 8d9dacfdffff 891c24 89442404 e8???????? 8b85acfdffff }
		$sequence_6 = { f20f111424 dd0424 0f840d020000 ddd8 f20f1005???????? 660f2ec4 0f8701040000 }
		$sequence_7 = { f0832801 0f8444010000 8b4604 8b10 85d2 0f845f010000 83faff }
		$sequence_8 = { f0832801 8b44241c 7478 8b0b 80791400 7411 c7042420000000 }
		$sequence_9 = { f7d7 89b424a0000000 89fe 21c6 f7d0 21d0 89f7 }

	condition:
		7 of them and filesize < 12651520
}