MALPEDIA_Win_Stowaway_Auto

rule MALPEDIA_Win_Stowaway_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "8d802ea2-325f-542a-981f-8c2375a02e81"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.stowaway_auto.yar#L1-L193"
		license_url = "N/A"
		logic_hash = "719a82249e2c6544bd756b12bedc1fae86c5b47e6e2fdd1af6a4e45f9d15ac20"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8a7cbe46 a3???????? 4e fb b501 }
		$sequence_1 = { f67be8 7ce8 7de8 7ee8 }
		$sequence_2 = { 78e8 79e8 7ae8 ce }
		$sequence_3 = { 76e8 77e8 78e8 79e8 }
		$sequence_4 = { 7ae8 ce f67be8 7ce8 }
		$sequence_5 = { e2d9 8dbe00903a00 8b07 09c0 743c 8b5f04 8d843000a03b00 }
		$sequence_6 = { 8bae34a03b00 8dbe00f0ffff bb00100000 50 }
		$sequence_7 = { 0e d8f4 ef 28f8 386849 }
		$sequence_8 = { 5c 72e4 633e 6c e4e4 }
		$sequence_9 = { 3e8059805b 805c805d80 5e 8083c65df85f80 60 8061fc63 8064ffdff1 }
		$sequence_10 = { b567 8110932238ba 81f82f2437b0 645b f257 326640 b117 }
		$sequence_11 = { 68b890e66c 195039 d0f1 1e }
		$sequence_12 = { 9c 5c 4d 79c7 4d e081 025c51c9 }
		$sequence_13 = { 01a334a1f20b 19e4 1108 4e 10827e53f706 f9 850c2c }
		$sequence_14 = { f60904 9c 26b696 7a19 }
		$sequence_15 = { 0f11c1 7875 52 43 6b8ad456ed7902 a2???????? 6b89130a83d644 }
		$sequence_16 = { 30c2 01420f 9f d8682a 1f d204c6 06 }
		$sequence_17 = { 8e4ec2 0c79 72c9 85cd 4f }
		$sequence_18 = { 080a 0c11 1214151617181a 1b1c1f 2126 }

	condition:
		7 of them and filesize < 8003584
}