MALPEDIA_Win_Whiskerspy_Auto

rule MALPEDIA_Win_Whiskerspy_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4650a155-71e3-5ebe-a61c-a966bb9c472b"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.whiskerspy_auto.yar#L1-L148"
		license_url = "N/A"
		logic_hash = "2630783c91cbe95946721b24ba2881caf0995b4882ab207ac281b90db6db950c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 33ff 8b06 8bcf d3e8 a801 }
		$sequence_1 = { 8d4a28 8d5301 e8???????? 488bf8 }
		$sequence_2 = { 2c05 3441 88840d080b0000 48ffc1 }
		$sequence_3 = { 8845e0 0fb64102 8845e1 0fb64101 8845e2 }
		$sequence_4 = { ba01000000 8bca e8???????? 4c8be8 488945c7 }
		$sequence_5 = { e8???????? badd9a1c2d 488905???????? 488bce e8???????? }
		$sequence_6 = { 6689480c 0f1045ef 488b03 0f11400e 0f104dff }
		$sequence_7 = { e8???????? c7474000000000 4c8d9c24b0010000 498b5b30 498b7340 }
		$sequence_8 = { 0175d0 eb0c 51 8d4dcc }
		$sequence_9 = { 015508 85ff 0f8f6cffffff 7c08 }
		$sequence_10 = { 015dd0 eb09 51 8d4dcc }
		$sequence_11 = { 015de8 eb09 50 8d4de4 }
		$sequence_12 = { 01742418 83c40c 8b412c 2930 }
		$sequence_13 = { 0144241c 2bd8 83c410 8bd3 }
		$sequence_14 = { 0130 8b7510 83794c00 8bd3 7451 e8???????? 8bd3 }

	condition:
		7 of them and filesize < 591872
}