MALPEDIA_Win_Satellite_Turla_Auto

rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "380bb34a-b441-5469-b067-9a330cefb4ab"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.satellite_turla_auto.yar#L1-L165"
		license_url = "N/A"
		logic_hash = "7d3f52e1205d8c60b6cabcd56aa5d1c15cddf10acd1230d433c9234ed0035bb0"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0105???????? 81c3b0020000 2945e0 75ae 837dd400 }
		$sequence_1 = { 0108 833e00 7c1f 8b542410 }
		$sequence_2 = { 0105???????? 83c410 29442418 75a9 }
		$sequence_3 = { 50 e8???????? 83c410 5f 5e 8d45fb }
		$sequence_4 = { 0105???????? 83c410 29442420 75aa }
		$sequence_5 = { 0108 833a00 7c23 8b442428 }
		$sequence_6 = { 0108 833e00 7fc7 db46fc }
		$sequence_7 = { 0108 833e00 7cc7 7e39 }
		$sequence_8 = { a3???????? 6a28 8d45c4 6a0c 50 }
		$sequence_9 = { 8d85ecfdffff 6804010000 50 53 ff15???????? 53 53 }
		$sequence_10 = { 56 57 e8???????? ff15???????? 6a40 }
		$sequence_11 = { 53 ff15???????? 6a04 6a03 53 }
		$sequence_12 = { 56 ff15???????? 56 56 ff15???????? ff15???????? 56 }
		$sequence_13 = { 53 56 56 ff15???????? 53 53 }
		$sequence_14 = { c6459f02 c645a009 c645a11e c645a21f c645a30e c645a418 c645a52a }
		$sequence_15 = { 57 ffd6 a3???????? 6a55 8d45b8 6a0c }

	condition:
		7 of them and filesize < 1040384
}