MALPEDIA_Win_Zeus_Action_Auto

rule MALPEDIA_Win_Zeus_Action_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "378c6095-d42a-5bf9-9fb1-ed9c51a5bf48"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_action"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.zeus_action_auto.yar#L1-L133"
		license_url = "N/A"
		logic_hash = "caae1a669867320f43a9d91c38e71681c37072fd4c5e5df67047c94e16d1bf5e"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 51 56 57 8bf0 e8???????? 8bf8 85ff }
		$sequence_1 = { 0f84d1000000 53 6800040000 e8???????? 8bd8 59 85db }
		$sequence_2 = { ebdd 8b45ec 25ff000000 8b4dfc 8801 8b45fc 40 }
		$sequence_3 = { ffb3c4020000 8d45e0 6a05 50 ffb360010000 e8???????? 83c410 }
		$sequence_4 = { f7fe 8945bc 8b4508 0fafc1 99 f7fe }
		$sequence_5 = { 3b45bc 0f85a4000000 33c0 40 6bc005 8b4df0 0fb60401 }
		$sequence_6 = { 8b7df0 49 3bdf 7507 894dec 8bc1 eb03 }
		$sequence_7 = { 6a01 ff750c ff75f4 ff15???????? 8365e000 6a02 8d45e0 }
		$sequence_8 = { 57 8d45f4 50 68???????? 33ff 6a01 57 }
		$sequence_9 = { 51 50 0fb74304 50 52 56 e8???????? }

	condition:
		7 of them and filesize < 827392
}