MALPEDIA_Win_Turla_Rpc_Auto

rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "326b499c-0af4-5613-8e0d-6f601ed9cd8d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.turla_rpc_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "e8da3a197a3100c5d1e348ee2c0f0030f7886aae6c71efe765467e397297edf2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 488bd8 4885c0 744e 4c8b4708 488b17 488bcb }
		$sequence_1 = { c744245033273034 66c74424543155 c744243033273030 c644243455 }
		$sequence_2 = { c745803322273c 66c745842130 c6458655 c744246838343939 66c744246c3a36 c644246e55 }
		$sequence_3 = { 74e7 4883c440 5b c3 488d053bda0000 }
		$sequence_4 = { c745c007303431 c745c4133c3930 c645c855 c744244806393030 66c744244c2555 }
		$sequence_5 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? }
		$sequence_6 = { c7456839300255 c7851001000016273034 c7851401000021300527 c785180100003a363026 66c7851c0100002602 }
		$sequence_7 = { 660f6f05???????? 66c785ec0000000255 c785a0000000193a3431 c785a4000000193c3727 c785a800000034272c02 f30f7f8568010000 c685ac00000055 }
		$sequence_8 = { c745ac393a3655 c744247026212739 66c7442474303b c644247655 c744246022362636 }
		$sequence_9 = { 7434 8da42400000000 8d047d02000000 50 }
		$sequence_10 = { 74ab 8d45c4 50 57 6a00 6a00 ff75c0 }
		$sequence_11 = { b802000000 5f 5e 5b 8b8c2480020000 33cc }
		$sequence_12 = { c745d453002d00 c745d831002d00 c745dc31003600 c745e02d003000 c745e429000000 c745e861006400 c745ec76006100 }
		$sequence_13 = { 8d8548ffffff 50 8d8554ffffff 50 ffb54cffffff ffd6 }
		$sequence_14 = { 8d4518 c7451840540110 50 8d4dc4 }
		$sequence_15 = { 7527 ff15???????? 83c404 57 ff15???????? ff15???????? 5f }

	condition:
		7 of them and filesize < 311296
}