MALPEDIA_Win_Railsetter_Auto

rule MALPEDIA_Win_Railsetter_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c45e5098-e995-5824-9e1f-fff841727b35"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.railsetter"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.railsetter_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "621471e8e170b617c4c45d2d76a4272856dd60bf407e6bda7ff43a732023d384"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 33c9 894c2448 4585c9 742d 488d05e6f40200 488903 48894b18 }
		$sequence_1 = { 0f1006 0f294517 4883781000 7415 41b802000000 488d153e310500 }
		$sequence_2 = { 488d0d24f60200 0f57c0 4889442420 48890b 488d5308 488d4c2420 0f1102 }
		$sequence_3 = { b903000000 4c8d05a7920200 e8???????? 488bd3 8bcf 4885c0 7408 }
		$sequence_4 = { 488d1d9eef0000 eb52 bac0020000 b901000000 e8???????? 488bd8 4885c0 }
		$sequence_5 = { 33d2 41b810010000 488d4df4 e8???????? c745f014010000 488d4df0 ff15???????? }
		$sequence_6 = { 48896810 48897018 48897820 4156 33ed 4c8d3576470100 }
		$sequence_7 = { 498bc2 458bf1 48c1f806 488d0d08bf0200 4183e23f 4d03f0 49c1e206 }
		$sequence_8 = { 48c745780f000000 44886d60 ba20000000 488d0def160500 e8???????? c744243010000000 488d542430 }
		$sequence_9 = { 48894517 c6451f01 488d4d17 e8???????? 488d05b94a0400 488903 488b55e7 }

	condition:
		7 of them and filesize < 866304
}