MALPEDIA_Win_Oatboat_Auto

rule MALPEDIA_Win_Oatboat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b70deb15-907c-57e5-93db-769ef748fca1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oatboat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.oatboat_auto.yar#L1-L110"
		license_url = "N/A"
		logic_hash = "4fd89130628ae6dae46c069641713f47111051d9b2170bf05ebbd8e8d8374841"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c745e872747561 c745ec6c4d656d c745f06f727900 e8???????? 41b900800000 4c8d4540 488d5548 }
		$sequence_1 = { 4c896538 c745e04e74416c c745e46c6f6361 c745e874655669 c745ec72747561 c745f06c4d656d }
		$sequence_2 = { 488d48d8 c740dc64006c00 33db c740e06c002e00 c740e464006c00 c740e86c000000 e8???????? }
		$sequence_3 = { 55 4156 4157 488bec 4883ec30 65488b042560000000 }
		$sequence_4 = { c740e86c000000 e8???????? 4885c0 740e 488bd7 488bc8 }
		$sequence_5 = { e8???????? 488bd8 488b7c2458 488bc3 488b5c2450 4883c440 5d }
		$sequence_6 = { c745f04c6f6164 c745f44c696272 c745f861727957 44887dfc e8???????? 488bcf }
		$sequence_7 = { 66895df8 c745e845004c00 c745ec33003200 c745f02e004400 c745f44c004c00 e8???????? 4885c0 }

	condition:
		7 of them and filesize < 58368
}