MALPEDIA_Win_Bqtlock_Auto

rule MALPEDIA_Win_Bqtlock_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "a487119a-e7ca-5338-8f6e-4bc772de2ab2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bqtlock"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.bqtlock_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "3551b5a08b9fb2b57803a409650d4a5f2efcf5d251961b29f758577d6968c250"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 837c2460ff 742b 410fb64720 31db 41bcffffffff e9???????? 31d2 }
		$sequence_1 = { 4c894c2450 48897c2448 f6411801 0f85e6000000 4889842480000000 488d8424d4000000 4c8d842490000000 }
		$sequence_2 = { 4d8b5908 4c8b8424b8000000 4c8b8c24c0000000 488b06 4889442468 488b02 4889cb }
		$sequence_3 = { 4c0f44d8 e9???????? 498b4510 493b4518 0f83d0030000 0fb700 6683f8ff }
		$sequence_4 = { e8???????? 488b8424f0000000 498d5520 488d8c2480010000 4889842468010000 e8???????? 4c89fa }
		$sequence_5 = { 4c8b48e8 4901d9 4d89c8 4183ff20 0f85ccfeffff 418b5120 85d2 }
		$sequence_6 = { e8???????? 488945f8 488b45f8 483b4518 7320 0fbe4d20 488b4518 }
		$sequence_7 = { 83e0df 83f845 0f8505e6ffff c744245800000000 4189dd 4531f6 c744244401000000 }
		$sequence_8 = { 498b4510 493b4518 0f8332010000 66662e0f1f840000000000 0f1f4000 440fb708 664183f9ff }
		$sequence_9 = { 488d442460 4889442428 e8???????? 8b542460 85d2 7521 488b3d???????? }

	condition:
		7 of them and filesize < 4444160
}