MALPEDIA_Win_Tenzor_Auto

rule MALPEDIA_Win_Tenzor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2d9a68e0-7439-5536-8c66-b65ca640a395"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tenzor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.tenzor_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "43ff9e2d2f97513275a98969c46a749f90e855c4ccaebee02a82dfd51704b200"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4821ca 48d1e2 48b9cf2b17374d3a5263 4801c8 4829d0 8885a8030000 0fb685bd030000 }
		$sequence_1 = { 4989c0 4931c8 4931d0 448d4814 4121d1 49f7d1 4d21c1 }
		$sequence_2 = { 4883c420 4c8b7db8 4c8b65c0 488b7de0 eb00 4883ec20 488b4df0 }
		$sequence_3 = { 410fb6c4 4401f0 488b542428 01d0 488d0c16 4883c102 4801d6 }
		$sequence_4 = { 0fb685bf030000 48b9976fc8d3723f315c 4801c8 48b9cc2b17374d3a5263 4889c2 4821ca 48d1e2 }
		$sequence_5 = { 2401 0fb6c0 09c6 83fe00 400f95c6 c68538020000e3 c6853902000001 }
		$sequence_6 = { 4488841504010000 4883c201 ebb7 31d2 f7b504010000 8b09 0faf0e }
		$sequence_7 = { 4901c7 48c744242000000000 4c8d442444 41b902000000 4889f9 4c89fa e8???????? }
		$sequence_8 = { 31c9 48bad3dd07263824c491 90 440fb64c0c20 4989ca 4909d2 }
		$sequence_9 = { 48ffc0 4883f804 75d8 440b442454 4889742420 4c89f1 488d542468 }

	condition:
		7 of them and filesize < 548864
}