MALPEDIA_Win_Scranos_Auto

rule MALPEDIA_Win_Scranos_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ce7511d4-9f42-54c9-acac-77edbe055210"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.scranos_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "d1149f3696074172322e1c9b718c78bd06ed86bf6f6714e9a671da9ed742f38a"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b8f20030000 895004 8b9724030000 894808 8b4c242c 89500c 8b542430 }
		$sequence_1 = { 8d44242c 50 56 e8???????? 83c40c 8bd8 e8???????? }
		$sequence_2 = { f7d9 1bc9 83c101 884de3 837d1400 0f8451010000 c745dc00000000 }
		$sequence_3 = { 8b8dbcfeffff 83c101 51 8b5510 52 8d45c0 50 }
		$sequence_4 = { 8d4dd4 e8???????? 50 8b4d2c e8???????? 8d4dd8 e8???????? }
		$sequence_5 = { ebce 0fb645ce 85c0 740f 8b4dec c6012e 8b55ec }
		$sequence_6 = { 8b8350030000 85c0 89442414 7504 89742414 83bd180c000000 740e }
		$sequence_7 = { 8b5508 66894a10 8b450c 50 8b4d08 51 e8???????? }
		$sequence_8 = { 83c404 85c0 7544 68???????? 8d8d5cfdffff e8???????? 8985c8fcffff }
		$sequence_9 = { eb54 bd???????? bf???????? eb09 bd???????? 8bdd 8bfd }

	condition:
		7 of them and filesize < 2859008
}