MALPEDIA_Win_Vawtrak_Auto

rule MALPEDIA_Win_Vawtrak_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "779e17e2-0a5b-503c-9ec0-b238e6b49565"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.vawtrak_auto.yar#L1-L207"
		license_url = "N/A"
		logic_hash = "ba996f83019663a7eecfbae0747c28c946b24c8682ad79bc04bea8c2b6f7a6d5"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 6a01 ff35???????? 6a04 6a01 50 }
		$sequence_1 = { 6a00 6a00 e8???????? 50 ff15???????? }
		$sequence_2 = { e8???????? 837d1040 752d 8b4d04 e8???????? 85c0 7421 }
		$sequence_3 = { ba00ff0000 8bc1 23c2 3bc2 }
		$sequence_4 = { 69d26d4ec641 81c239300000 2ac2 8801 }
		$sequence_5 = { 0fb6c9 81c900ff0000 e8???????? 85c0 }
		$sequence_6 = { ff15???????? a3???????? 85c0 74e7 }
		$sequence_7 = { 7528 68???????? ff15???????? 85c0 7504 }
		$sequence_8 = { 6a08 68???????? 56 ffd7 85c0 }
		$sequence_9 = { e8???????? 33d2 b9ff3f0000 f7f1 }
		$sequence_10 = { 59 57 8bf0 ff15???????? 8bc6 }
		$sequence_11 = { 8bc6 8703 3bc6 74f8 }
		$sequence_12 = { eb04 8b01 8907 e8???????? }
		$sequence_13 = { ff750c ff7508 e8???????? 83c40c 8d45fc }
		$sequence_14 = { f3aa 5f 5d c3 55 8bec 51 }
		$sequence_15 = { c1e910 e9???????? 8ac1 c1e904 c0e004 }
		$sequence_16 = { 8ac8 240f 80e1f0 80c110 }
		$sequence_17 = { 3c41 7c11 3c46 7f0d }
		$sequence_18 = { 488364242000 4c8d442430 4533c9 33d2 c744243001000000 c744243c02000000 }
		$sequence_19 = { 40883c08 ff430c e9???????? 0f86bf000000 81c7fffeffff 83ff1d }
		$sequence_20 = { 4885c0 7523 488b0b ff15???????? }
		$sequence_21 = { 4885c9 7504 33c0 eb43 ff15???????? 8d7001 }

	condition:
		7 of them and filesize < 1027072
}