MALPEDIA_Win_Spider_Rat_Auto

rule MALPEDIA_Win_Spider_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "b0d90359-2598-5519-ad5e-e2cd0ed58518"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.spider_rat_auto.yar#L1-L131"
		license_url = "N/A"
		logic_hash = "b0533445a9bbea3abbfea008098be4356c285de1302cc31eddd214e7a9d0fb61"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 488b442440 83a0c8000000fd 33c0 eb1a 1bc0 83e002 ffc8 }
		$sequence_1 = { 448d4201 e8???????? 4c8d0d7d60feff 4c8bd8 4b8b84f1e07a0700 4c895c3040 4b8b84f1e07a0700 }
		$sequence_2 = { 5f c3 4053 4883ec20 83a12001000000 83a12401000000 488bd9 }
		$sequence_3 = { 4889442428 33d2 33c9 897c2420 e8???????? 488983c0020000 }
		$sequence_4 = { 498b00 488d153a400200 4c8d442438 498bc9 ff10 488b4c2438 4885c9 }
		$sequence_5 = { 4885c9 7406 e8???????? 90 488d050720feff eb00 4883c420 }
		$sequence_6 = { 0fb64308 488907 4903f8 eb1f 480fbe4308 }
		$sequence_7 = { 5f c3 c60300 33c0 ebe4 e8???????? cc }
		$sequence_8 = { ff15???????? 458d9c249a130000 4183fb12 0f8781070000 488d151a83fdff 4963c3 8b8c8290840200 }
		$sequence_9 = { 4883a3f001000000 83a3f801000000 83a3fc01000000 4883a30802000000 488bcb e8???????? 89bb08010000 }

	condition:
		7 of them and filesize < 1107968
}