MALPEDIA_Win_Ziyangrat_Auto

rule MALPEDIA_Win_Ziyangrat_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "25e524a5-eba0-5c32-83d3-3afde1b8e5de"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.ziyangrat_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "9108b91275ac2a1e4658df30ca253567f8a6e50bf090392d9fbc56695be2a574"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 0f8539ffffff 50 ff15???????? 8bfd 83c9ff 33c0 f2ae }
		$sequence_1 = { 3bf1 8bf8 7e2a 8bd6 6a00 2bd1 }
		$sequence_2 = { 7ce6 85ff 897c2418 896c2420 750a 5f 5e }
		$sequence_3 = { 89742414 e8???????? b9fb030000 b820202020 bf???????? c644242800 f3ab }
		$sequence_4 = { 85ff 897c2418 896c2420 750a 5f }
		$sequence_5 = { 46 8d0c17 3bcb 7ce7 5f 5e }
		$sequence_6 = { 8b4c241c 46 81e6ff0f0000 8d4101 25ff0f0000 }
		$sequence_7 = { 5f 5e 5b 81c494000000 c3 8b9c24a4000000 }
		$sequence_8 = { 89742448 e8???????? 5e 83f8ff 5b 7515 a1???????? }
		$sequence_9 = { 8b7c240c 8b04bd10894000 8d1cbd10894000 3d00100000 0f84c8000000 8b04bd20094100 56 }

	condition:
		7 of them and filesize < 188416
}