MALPEDIA_Win_Rustonotto_Auto

rule MALPEDIA_Win_Rustonotto_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "15abc477-d851-5dfb-b220-8c9208492544"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustonotto"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rustonotto_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "65ca2e6702959df21644c6b75936481ebda3164f1edd2df59ea9fbcb8d0d437c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 755f ba010000c0 f00fc111 81c2010000c0 81fa00000040 72a4 e8???????? }
		$sequence_1 = { c3 488d0523461b00 4889ce 4889c1 e8???????? 4889f1 89c2 }
		$sequence_2 = { 83f902 0f83e1040000 488b0f c6850f04000001 e8???????? 84c0 0f84d2040000 }
		$sequence_3 = { c6859309000001 0f28742440 0f287c2430 4883c458 5b 5f 5e }
		$sequence_4 = { f00fb04e10 7566 b901000000 31c0 f0480fb10e 0f94c1 7534 }
		$sequence_5 = { e8???????? e9???????? 4c8d05e5491b00 4889f1 4889fa e8???????? e9???????? }
		$sequence_6 = { ba35000000 e8???????? eb68 48899da8010000 4c89adb0010000 4c897d68 4889b5b8010000 }
		$sequence_7 = { 7408 488908 e9???????? 6641c746220100 6641895624 4c8b7c2430 488b542438 }
		$sequence_8 = { 7714 4489c0 83e003 4983f804 7343 4531db e9???????? }
		$sequence_9 = { 85c0 0f8462fbffff 488b0d???????? e8???????? 89c2 84c0 0f859afeffff }

	condition:
		7 of them and filesize < 5989376
}