MALPEDIA_Win_Vx_Rat_Auto

rule MALPEDIA_Win_Vx_Rat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "941970f3-acd1-5d76-a161-eb83ac443b4a"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vx_rat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.vx_rat_auto.yar#L1-L122"
		license_url = "N/A"
		logic_hash = "6e0437926602f26dec13f159f210507f9809f0c1e755d4de82980349c13c6c34"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 894de8 33f6 8955ec 6a00 50 }
		$sequence_1 = { ffb574f7ffff ffd6 e9???????? 80f921 7527 a1???????? 85c0 }
		$sequence_2 = { c645fc08 8b9530ffffff c78544ffffff00000000 c78548ffffff07000000 66898534ffffff 83fa08 }
		$sequence_3 = { ff742424 ff15???????? e8???????? 85c0 7509 e8???????? }
		$sequence_4 = { 8b45e4 0f4355d4 03c0 8b4dac }
		$sequence_5 = { b9???????? 8601 6a00 6a00 6a00 56 }
		$sequence_6 = { 8d8518f8ffff 50 e8???????? 83c40c eb1d e8???????? }
		$sequence_7 = { 8b148d10df4300 0355b0 8a0c03 03d3 43 }
		$sequence_8 = { 8d500d a1???????? 8945e8 8bc1 894dec 8955e4 85c9 }
		$sequence_9 = { e8???????? c745fcffffffff e9???????? 83c8ff 8b4df4 64890d00000000 }

	condition:
		7 of them and filesize < 550912
}