MALPEDIA_Win_Mrac_Auto

rule MALPEDIA_Win_Mrac_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "88171e5e-9c24-5782-abfb-8337ed9a4dfa"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrac"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.mrac_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "e11a99e612e507640597f11e8b4184164080099e30421a7ac342c05566021711"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 88842475060000 e8???????? 3451 8d8c2464060000 6a0b 88842476060000 e8???????? }
		$sequence_1 = { 888424eb020000 8b8424dc020000 040c 3420 888424ec020000 8b8424dc020000 040d }
		$sequence_2 = { c68424c804000025 c68424c904000043 c68424ca04000053 c68424cb0400005a c68424cc04000051 c68424cd04000025 c68424ce04000037 }
		$sequence_3 = { 0407 3453 8845a7 8b459c 0408 3465 }
		$sequence_4 = { c3 682680acc8 ba01000000 33c9 e8???????? 83c404 56 }
		$sequence_5 = { 8d8c2418030000 6a43 8884242d030000 e8???????? 0463 8d8c2418030000 6a43 }
		$sequence_6 = { e8???????? 8bc8 e8???????? 6a00 8d8c2438080000 c784243808000062000000 e8???????? }
		$sequence_7 = { c644242100 8a442410 e8???????? 8bc8 e8???????? 6a49 8d4c2450 }
		$sequence_8 = { c684241402000079 c68424150200007a c684241602000075 c684241702000076 c684241802000026 c68424190200004b c684241a02000079 }
		$sequence_9 = { c684244b0900006c c684244c0900007e c684244d09000072 c684244e0900007e c684244f0900001f c684245009000010 c684245109000046 }

	condition:
		7 of them and filesize < 745472
}