MALPEDIA_Win_Xpertrat_Auto

rule MALPEDIA_Win_Xpertrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ba3a6b4f-dabd-5198-a8f0-bcecdc7a8cd1"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.xpertrat_auto.yar#L1-L159"
		license_url = "N/A"
		logic_hash = "46ada561a557d5653f02082143df27ce692fd4a3b6839f44225d1aa292544237"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ff08 40 0430 ff0a 4c 000c00 }
		$sequence_1 = { 008a3800cc1c 5e 006c70ff 0808 008f38001b26 001b 0d002a2364 }
		$sequence_2 = { 001b 0d002a2364 ff08 0800 }
		$sequence_3 = { ff05???????? 000d???????? 0878ff 0d98000700 6e 74ff }
		$sequence_4 = { 000d???????? 0870ff 0d80000700 0474 ff0478 }
		$sequence_5 = { 0000 ae 045c ff4d40 ff08 40 }
		$sequence_6 = { 0000 00a1cc004400 0bc0 7402 }
		$sequence_7 = { 6c 70ff 0808 008a3800cc1c }
		$sequence_8 = { ff15???????? 83bbd800000001 8d83fc000000 898534f6ffff }
		$sequence_9 = { ff15???????? 83bd1cffffff00 7505 e9???????? }
		$sequence_10 = { ff15???????? 83bd8cfeffff00 0f84b0050000 c745fc0a000000 }
		$sequence_11 = { ff15???????? 83bd8cfeffff00 7405 e9???????? }
		$sequence_12 = { ff15???????? 83bd70ffffff00 0f84ca010000 c745fc1a000000 }
		$sequence_13 = { ff15???????? 83bbd800000001 0f8546010000 8d4dd8 }
		$sequence_14 = { ff15???????? 83bc24a000000005 7c0c 5f }
		$sequence_15 = { ff15???????? 83bb9400000001 8d83b8000000 89853cf6ffff 8985b4fcffff c785acfcffff03400000 0f8533010000 }

	condition:
		7 of them and filesize < 8560640
}