MALPEDIA_Win_Socksproxygo_Auto

rule MALPEDIA_Win_Socksproxygo_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ca75341b-6658-565f-95d6-74f231ce44e9"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksproxygo"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.socksproxygo_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "dae101b13021abf8406ff6df83b23a76fef8534b33d21e36035ee793df6e14d3"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e9???????? 48ffc6 4c89d1 4889d7 488b542448 4885c9 0f84ec000000 }
		$sequence_1 = { e9???????? 4c8b9424e8010000 0f1f00 4d85d2 742b 498b02 498b5a08 }
		$sequence_2 = { eb08 488bb42420010000 48899424a0000000 4889b424a8000000 488bbc24a0000000 4885ff 7421 }
		$sequence_3 = { eb3a 498b02 498b5a08 498b4a10 488b942408020000 488b3a 488b7208 }
		$sequence_4 = { 90 488d05c3392300 0f1f00 e8???????? 488b942418010000 48895008 833d????????00 }
		$sequence_5 = { c64424216b c744242200000203 66c74424260202 31c0 eb1a 440fb64c341d 418d1411 }
		$sequence_6 = { 4989c0 4989ca 488b842420020000 41c6043805 b901000000 e9???????? 4983fb01 }
		$sequence_7 = { e8???????? 488bac24f8000000 4881c400010000 c3 e8???????? e8???????? 4889c3 }
		$sequence_8 = { 7331 488d05b4513000 4889d9 4889fb 4889f7 4c89c6 e8???????? }
		$sequence_9 = { c7442464345c35c5 c7442467c5fab82a 31c0 e9???????? 488b9424a8000000 4885d2 b801000000 }

	condition:
		7 of them and filesize < 14221312
}