MALPEDIA_Win_Spybot_Auto

rule MALPEDIA_Win_Spybot_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f487b739-5a23-52d3-8b27-57437fc4fe82"
		date = "2026-01-05"
		modified = "2026-01-06"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spybot"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.spybot_auto.yar#L1-L132"
		license_url = "N/A"
		logic_hash = "086db381edc017239cf316ebb3a9419f50149c95f9ac3a29e8ecb7d10b4a280d"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260105"
		malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
		malpedia_version = "20251219"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8975f8 8975f0 68???????? ff750c ff7508 e8???????? 83c418 }
		$sequence_1 = { 6a03 8b5c2414 99 59 33ff f7f9 8bf2 }
		$sequence_2 = { 59 e9???????? 57 68???????? e8???????? 59 85c0 }
		$sequence_3 = { 33f6 ff7508 56 ff15???????? 85c0 7429 }
		$sequence_4 = { 33f6 ffb56cffffff 57 e8???????? 59 85c0 59 }
		$sequence_5 = { 8945f0 8945f4 8945f8 8945fc a1???????? 85c0 7411 }
		$sequence_6 = { 8bb43570ffffff 3bf3 897508 0f8469a4ffff 399d54ffffff 0f855da4ffff 68???????? }
		$sequence_7 = { ff7020 8d85fcfdffff 68???????? 50 e8???????? 6a01 }
		$sequence_8 = { ff7514 8975fc e8???????? 56 8945ec ff7510 897514 }
		$sequence_9 = { e9???????? ffb570ffffff 68???????? e8???????? 59 85c0 59 }

	condition:
		7 of them and filesize < 2367488
}