MALPEDIA_Win_Powersniff_Auto

rule MALPEDIA_Win_Powersniff_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d9a15ab2-f4aa-5861-a29d-0a1142275d5d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.powersniff_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "16f88330ecf20551c60ee3117d183ea0c8f76719f3c28b652c50ef00521f303c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 3314b590800010 8b75ec c1ee18 3314b590780010 0fb675fc }
		$sequence_1 = { 7558 8d45f0 50 8d45f8 }
		$sequence_2 = { 6800000020 8d4590 50 ffd3 50 8d4590 50 }
		$sequence_3 = { 8b4d0c 8364241000 8901 8b44242c }
		$sequence_4 = { 68???????? ffd6 85c0 0f8592000000 68???????? ffd6 85c0 }
		$sequence_5 = { 8d45ec 50 8d45f8 50 ff75f4 e8???????? }
		$sequence_6 = { 85db 7521 e8???????? 8bd8 85db 7516 ff75f8 }
		$sequence_7 = { 85c0 7405 3b4508 7210 ff45fc }
		$sequence_8 = { 393d???????? 7578 8b35???????? 6800010000 57 ff35???????? }
		$sequence_9 = { ff7614 ffd7 8b4d74 8b4570 03c1 8b4d7c 03c1 }

	condition:
		7 of them and filesize < 90112
}