MALPEDIA_Win_Onionduke_Auto

rule MALPEDIA_Win_Onionduke_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "71e82643-c451-5cee-a54f-f2f1027d62a5"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.onionduke_auto.yar#L1-L115"
		license_url = "N/A"
		logic_hash = "8162ef402e46513fc9aae2241eef790e5a3e093ead89108a1e0c2f51f5d76e98"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 42 3bd7 72b9 5e c6047800 5f 5d }
		$sequence_1 = { 5f 895e24 5b b801000000 5e }
		$sequence_2 = { 8a441103 3245ff 41 0fb6d0 6689544ffe 3bce }
		$sequence_3 = { 7202 8b00 8b4d08 51 50 e8???????? }
		$sequence_4 = { 8b03 7922 8b5008 56 }
		$sequence_5 = { 84c9 7421 8b55fc 8a12 }
		$sequence_6 = { 8b4604 8b4e08 2bc8 c1f903 3bcf 770a }
		$sequence_7 = { 83c40c 33c9 eb08 8b56d0 }
		$sequence_8 = { 83c404 8903 85c0 7443 }
		$sequence_9 = { 33c9 c7070f000000 894ffc 880b 833e10 }

	condition:
		7 of them and filesize < 671744
}