MALPEDIA_Win_Rekoobew_Auto

rule MALPEDIA_Win_Rekoobew_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8ee2b2ef-cb3c-5ded-93b0-251a94d316dc"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rekoobew_auto.yar#L1-L130"
		license_url = "N/A"
		logic_hash = "611d5d6376ad3bfd0022c8516f8f73ea917b68256cff7e917d5134c7e5ac0c95"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 29d8 89442408 89742404 8b4508 890424 e8???????? 85c0 }
		$sequence_1 = { c740241cb04000 8910 c7401898654000 c7401ca06a4000 c74020a86a4000 c74044b06a4000 }
		$sequence_2 = { 0f85c4020000 a1???????? 8945d8 a1???????? 8945dc a1???????? 8945e0 }
		$sequence_3 = { 8b47fc 8b3495e0984000 3377e0 0fb6d8 8b1c9de0944000 c1e308 31de }
		$sequence_4 = { 334dec d1c1 894dd8 8d8408a1ebd96e 8945f0 89d0 31f8 }
		$sequence_5 = { 884610 0fb7431a 884611 8b4318 c1e808 884612 }
		$sequence_6 = { c1ea10 0fb6d2 333495e0884000 0fb6d5 8b1495e08c4000 31f2 8955e8 }
		$sequence_7 = { 897dc8 8d9c3bdcbc1b8f 89d7 09cf 21c7 897d98 89d7 }
		$sequence_8 = { 8b7d08 8807 83c701 897d08 80f93d }
		$sequence_9 = { 89c2 c1ea08 8855f6 8845f7 c1e803 83e03f 83f837 }

	condition:
		7 of them and filesize < 248832
}