MALPEDIA_Win_Rovnix_Auto

rule MALPEDIA_Win_Rovnix_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "96cca0a7-218f-5ee0-9ffd-50cbfca54b67"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rovnix_auto.yar#L1-L326"
		license_url = "N/A"
		logic_hash = "09bad611863bfd4b106094172a565d95276a93c2f1fd033ad8314dfd7e9f170e"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { be???????? 8b15???????? 83e7f0 89542418 83c710 }
		$sequence_1 = { 837c242c00 7405 57 6a00 ffd2 }
		$sequence_2 = { 6a00 ffd2 89442408 8bcf }
		$sequence_3 = { c1e902 ad 2bc3 ab e2fa }
		$sequence_4 = { 8bf8 83c335 c1e902 ad }
		$sequence_5 = { 60 bf40090000 be???????? 8b15???????? }
		$sequence_6 = { 85c0 e8???????? 8be5 5d }
		$sequence_7 = { 7703 83c220 85c0 7404 }
		$sequence_8 = { 8d4e1c 8908 8b4508 c7461801000000 }
		$sequence_9 = { 8975d4 8975dc 8975e0 ff15???????? 85c0 }
		$sequence_10 = { 894804 8b4608 8b4e0c 8901 894804 8b4718 85c0 }
		$sequence_11 = { eb06 8b5d0c 8b7d08 8bcf }
		$sequence_12 = { 8d7e08 897f04 893f 894e14 895e10 }
		$sequence_13 = { c745ec40020000 8975e8 8975f0 8975f4 ff15???????? 85c0 }
		$sequence_14 = { 8b4d0c 897604 8936 8d7e08 897f04 }
		$sequence_15 = { 8b00 3bc1 75f3 395e14 }
		$sequence_16 = { 23c9 16 85c9 23d2 }
		$sequence_17 = { 5d c3 85c0 e8???????? }
		$sequence_18 = { 23db 81e1ff000000 23c9 83440c0404 }
		$sequence_19 = { 55 8bec 85db 85c9 }
		$sequence_20 = { 8be5 5d c3 85c9 e8???????? }
		$sequence_21 = { 9f ed c43f d332 92 33d3 3a922fd34292 }
		$sequence_22 = { 6689442444 0fb7c1 66c1e909 66c1e805 6683e00f 6689442442 }
		$sequence_23 = { 83c710 8bea b89b97d1c2 05???????? 05???????? 2d9b97d0c2 837c242c00 }
		$sequence_24 = { 488364245800 488364247000 488364247800 488d442430 4c8d4c2440 }
		$sequence_25 = { 45 7d58 95 08c1 a3???????? }
		$sequence_26 = { 0b616c 16 00ef 7d18 48 f1 7067 }
		$sequence_27 = { ab e2fa 61 ba54060000 03ea }
		$sequence_28 = { 488d4c2448 448d4228 e8???????? 488d0503fcffff }
		$sequence_29 = { 488b442438 443838 7409 ffc1 }
		$sequence_30 = { 498943f0 49895bf8 41c643bbe0 488b0d???????? 488bd7 ff15???????? }
		$sequence_31 = { 4489742428 448bc9 894c2420 488b4d00 450fafcc 4c034d10 }
		$sequence_32 = { 488b4ccb08 e8???????? ff0b 3933 75e5 }
		$sequence_33 = { 74e5 01c4 035dfc 022464 b428 40 40 }
		$sequence_34 = { 16 d24055 2672f7 6232 ce 3d2033ce3d 6215???????? }
		$sequence_35 = { 46 92 c55151 a2???????? d24b46 92 c55151 }

	condition:
		7 of them and filesize < 548864
}