MALPEDIA_Win_Snake_Disk_Auto

rule MALPEDIA_Win_Snake_Disk_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "86a91047-7721-509e-9428-5943ccd33d29"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snake_disk"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.snake_disk_auto.yar#L1-L93"
		license_url = "N/A"
		logic_hash = "e3a90a61952999ecca57fcbf79005364fd6ba06d48c543b4f3fe48fb8c119e3f"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 898558ffffff 85c0 0f84a30b0000 }
		$sequence_1 = { e8???????? 898548ffffff 8b08 8b8184010000 8d4db4 898544ffffff 397dac }
		$sequence_2 = { e8???????? 898550ffffff 897dbc 3bf8 }
		$sequence_3 = { e8???????? 89855cffffff ff7720 e8???????? }
		$sequence_4 = { e8???????? 898560ffffff 85c0 0f8410070000 }
		$sequence_5 = { e8???????? 898550ffffff 59 59 }
		$sequence_6 = { e8???????? 89855cffffff 85c0 7874 }
		$sequence_7 = { e8???????? 898550ffffff 85c0 0f84a4000000 }

	condition:
		7 of them and filesize < 28734464
}