MALPEDIA_Win_Revenant_Auto

rule MALPEDIA_Win_Revenant_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6753dc62-5f76-5215-97ad-3a994241e584"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenant"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.revenant_auto.yar#L1-L123"
		license_url = "N/A"
		logic_hash = "93e08a376b4592c0adfe0e614b23602d5bc006d17b5a20a6bf8aaa7547387746"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4883c308 e8???????? 4839df 75cd 4c01e7 }
		$sequence_1 = { 4883ec60 4889cb e8???????? 488d0dea380000 e8???????? }
		$sequence_2 = { 85c0 7521 488b542428 b940000000 41ffd6 4885c0 4889c2 }
		$sequence_3 = { 4883ec28 4889cd 4889d3 4c89c7 4a8d0c0a 4c89ce }
		$sequence_4 = { 4c8b3d???????? 4889c3 488d44244f 31d2 4d89f1 4889542420 41b800040000 }
		$sequence_5 = { ff15???????? f644245c01 41b90a000000 7406 440fb74c2460 }
		$sequence_6 = { 5f c3 4889c8 803800 7405 }
		$sequence_7 = { b90a000000 f3ab 4889d9 4889f0 4883c420 5b 5e }
		$sequence_8 = { 0fb7942448010000 4889d9 e8???????? 8b542440 4889d9 e8???????? 418b542404 }
		$sequence_9 = { 89c5 4889ea 896c244c ff15???????? 448b44244c }

	condition:
		7 of them and filesize < 99328
}