MALPEDIA_Win_Cargobay_Auto

rule MALPEDIA_Win_Cargobay_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "d1c395b9-93cb-55d6-a8a1-d5d9301250e6"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cargobay"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.cargobay_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "535fe4668c33a2d7c01573f2e50f9f413ad5d474304a9cec1def23e30f2c89b6"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 5e 415c 415d 415e 415f c3 488b8424e8010000 }
		$sequence_1 = { e8???????? 488b9c24b0000000 488b4308 0fb64808 48ffc9 4883f902 7304 }
		$sequence_2 = { 89ca 80e21f 0fb6d2 0fb67001 83e63f 80f9df 763c }
		$sequence_3 = { e8???????? e9???????? 56 57 4883ec48 4889ce 488b4110 }
		$sequence_4 = { e8???????? 4c8bbd90000000 488bbd98000000 4d89fe 4929fe 4d89f0 4929d8 }
		$sequence_5 = { e9???????? b91f000000 31d2 e8???????? 0f1005???????? 0f1100 0f1005???????? }
		$sequence_6 = { 4c8d05cf070b00 488db42470020000 41b92c000000 4889f1 e8???????? 4889df 4883c710 }
		$sequence_7 = { f6c101 755a 89d5 4c8bb42480000000 488bbc2488000000 4c39f7 7416 }
		$sequence_8 = { e8???????? 4c8d05f3e20c00 ba0b000000 4889f9 e8???????? 4989d0 4489f9 }
		$sequence_9 = { eb5e 41b800001c00 eb56 41b800001d00 eb4e 41b800001e00 eb46 }

	condition:
		7 of them and filesize < 3432448
}