MALPEDIA_Win_Nimplant_Auto

rule MALPEDIA_Win_Nimplant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "870b5109-701b-5d4f-8a26-34c2122520c5"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.nimplant_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "7a7e7b774774c259400a940032df06cc3e28ab52483cbaf161ce0c62a938050b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 4889c3 4883fffe 0f8d63010000 f30f6f0d???????? 488d9424f0000000 41b8e1ca4f41 }
		$sequence_1 = { 4c8d0d8e570500 4c8b10 488b83b0000000 894c2428 894c2420 48c744243000000000 4883c008 }
		$sequence_2 = { 83f907 0f87b3090000 89d1 4401c0 01d2 48c1e10d 899424c0000000 }
		$sequence_3 = { 4c89e1 4801ea e8???????? 4c8b5c2478 4c8b542470 4c8b8c2490000000 4d85c9 }
		$sequence_4 = { b901000000 31d2 4c89542468 49b8ffffffffffffff7f 48c1e13f e8???????? 4c8b5c2468 }
		$sequence_5 = { 4c8da42480000000 48c784248000000000000000 48c784248800000000000000 4c89e1 e8???????? 4c89e1 48c784248000000000000000 }
		$sequence_6 = { 807d0000 0f84dffeffff e9???????? 4889542440 4c894c2428 e8???????? 807d0000 }
		$sequence_7 = { 803b00 488b8424f0010000 488b9424f8010000 0f855a3d0000 4c8b5c2428 4c8b542458 4989f0 }
		$sequence_8 = { 4c89c2 e8???????? 4c8b442438 4c8b4c2440 4d85c0 0f8e98feffff 4c894c2438 }
		$sequence_9 = { 4c8b542438 4989c1 4c01d7 0f802a050000 4e8d4c2f08 4989fa 4c89d0 }

	condition:
		7 of them and filesize < 1811456
}