MALPEDIA_Win_Snowflake_Stealer_Auto

rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "c0b96cf9-e624-56f3-823a-f283f32ffd30"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snowflake_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.snowflake_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "eb4c7359191bec957d1c92cb77cda613c742d7f8051b1e8b99c514eca893bd9b"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 83c40c eb14 f30f7e00 f20f104808 f20f114c1008 660fd60410 }
		$sequence_1 = { f3a5 66899880000000 66899082000000 8d8c24b0000000 832000 e8???????? e9???????? }
		$sequence_2 = { f7472400100000 740c ff36 e8???????? 59 85c0 7504 }
		$sequence_3 = { f644242407 5f 5e 5d 5b 740a ff74241c }
		$sequence_4 = { f20f108424c0000000 f20f108c24c8000000 8d8c2490000000 8d7c2418 896f08 f20f114908 f20f1101 }
		$sequence_5 = { e9???????? 89f9 8d9424a4000000 e8???????? 807c243809 0f844ffdffff 8dbc2400010000 }
		$sequence_6 = { ff74241c e8???????? e9???????? f6450408 8b4d1c 745c 8b9c24b4000000 }
		$sequence_7 = { ff700c 57 e8???????? 83c40c 8b442450 8b4c2434 49 }
		$sequence_8 = { f6c301 750f c6463800 eb09 f6c301 0f84903c0000 b101 }
		$sequence_9 = { ff15???????? 688cb50000 ff761c 68???????? 50 680a180000 894614 }

	condition:
		7 of them and filesize < 6196224
}