MALPEDIA_Win_Sdbbot_Auto

rule MALPEDIA_Win_Sdbbot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7d5002c0-d7fd-50b1-bfb2-c37fa40b27a7"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.sdbbot_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "de9dc7d37c5bc02342c2b5aae7b7fbfc11a387ed4ab52ccf3403110a8ec7f197"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 7413 8a02 8d4901 8841ff 8d5201 }
		$sequence_1 = { 0f8495000000 8b30 8d59f8 0375fc }
		$sequence_2 = { 8b5820 8b4024 03de 03c6 8945f0 0f1f4000 }
		$sequence_3 = { 0f855effffff e9???????? 81f95d68fa3c 757c }
		$sequence_4 = { 8d4901 88440fff 83ea01 75f2 0fb77b14 03fb 0fb75b06 }
		$sequence_5 = { d1eb 8945e8 746e 0fb710 }
		$sequence_6 = { 8955ec 85d2 0f84ae000000 8b83a0000000 }
		$sequence_7 = { ebe2 64a130000000 897df8 8b400c 8b4014 8945fc }
		$sequence_8 = { c3 803d????????00 750c c605????????01 e8???????? }
		$sequence_9 = { 41b9ffff0000 458d6b03 66660f1f840000000000 498b5750 }
		$sequence_10 = { 4c89ac2488000000 488b4818 4c8b7920 4d85ff 0f840e020000 }
		$sequence_11 = { 410fb7dd 41bdffff0000 4963413c 428bbc0888000000 }
		$sequence_12 = { 33ed 4c89b42480000000 48895c2478 e8???????? 4c8be8 }
		$sequence_13 = { 4983c12c 4d85d2 7446 4d03cf 0f1f840000000000 418b49f8 49ffca }
		$sequence_14 = { 0f84a7000000 0f1f840000000000 8b4304 85c0 0f8494000000 448b03 }
		$sequence_15 = { 66660f1f840000000000 498b5750 33c0 450fb74748 0f1f440000 0fb60a }
		$sequence_16 = { 7405 49ffcd ebd9 65488b042560000000 }

	condition:
		7 of them and filesize < 1015808
}