MALPEDIA_Win_Beast_Auto

rule MALPEDIA_Win_Beast_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d914f9f4-6d02-5995-8691-12d109b9048f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beast"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.beast_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "8c032fa2be13beeba9324234662f5be61f2a18a7ee3115f943ef626f84a68e88"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b74243c 33c0 50 8d442418 50 ffb424bc040000 ff36 }
		$sequence_1 = { 83fa17 72ea 885c242b c64424387b c644243908 c644243a7c c644243b08 }
		$sequence_2 = { 8b4e04 ba???????? e8???????? 59 8bc3 5f 5e }
		$sequence_3 = { 8b442424 0423 8844244b 8b442424 0424 346f 8844244c }
		$sequence_4 = { 0f84c8000000 48 83e801 0f8486010000 48 83e801 0f840d010000 }
		$sequence_5 = { 33b1373e5000 8b4c2420 c1e910 0fb6c9 c1e104 8b542444 33b9323e5000 }
		$sequence_6 = { 8884249c000000 8b44247c 041d 8884249d000000 8b44247c 041e 3465 }
		$sequence_7 = { 85c0 0f8471030000 83f826 7603 6a26 58 0fb60c854e6c5000 }
		$sequence_8 = { 56 8b35???????? 50 ffd6 8d0c4502000000 e8???????? 57 }
		$sequence_9 = { 330c8550a84f00 894c2424 8b4c241c 8b742424 0fb6c1 c1e908 0fb6c9 }

	condition:
		7 of them and filesize < 2411520
}