MALPEDIA_Win_Rustyrocket_Auto

rule MALPEDIA_Win_Rustyrocket_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "43f1bcd1-44c4-5210-ba05-68e3a5d52df4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustyrocket"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rustyrocket_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "ff3cc83b3d1dd755ceab49439ee02182c6c28d21fe475a34f3b57f76a51792f4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b5008 e9???????? 56 57 53 4883ec40 4889ce }
		$sequence_1 = { f048ff08 750c 488b8f48010000 e8???????? 48b80200000000000080 48394768 740c }
		$sequence_2 = { ff15???????? 31c0 48898424b0010000 48c78424b801000001000000 48898424c0010000 807c243700 7452 }
		$sequence_3 = { e8???????? 488bbc2480000000 448b74243c eb12 488b4c2448 488d942490000000 e8???????? }
		$sequence_4 = { c3 83f909 751b 89d8 2500ff0000 0fb7c0 3d00030000 }
		$sequence_5 = { eb26 483b442420 4c8b442428 0f83b3010000 486bc068 49833c0000 0f84ea010000 }
		$sequence_6 = { eb10 85c0 0f849cf4ffff 4c8d8424b0000000 41c60008 488d05ac9f1400 4889442420 }
		$sequence_7 = { eb33 0f10442470 0f108c2480000000 0f294c2430 0f29442420 0f10842490000000 0f108c24a0000000 }
		$sequence_8 = { bd04000000 e9???????? b802000000 31ff 41bc04000000 c744242c00000000 488d150a852a00 }
		$sequence_9 = { ba48000000 4c8b44d440 4d89c1 49c1e908 4d31c1 4921c1 4d31c8 }

	condition:
		7 of them and filesize < 6786048
}