MALPEDIA_Win_Coinminer_Auto

rule MALPEDIA_Win_Coinminer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "dd71a564-9751-5c18-a6bf-b9b0587239f2"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.coinminer_auto.yar#L1-L121"
		license_url = "N/A"
		logic_hash = "c6e378240c8214f1ad0ec61fc8d57006e837b16f1716923b20f2ac30be5b248c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8b8d24e5ffff 8b0485a05f9a00 f644010440 7409 803a1a 7504 33c0 }
		$sequence_1 = { 8b85f0feffff 85c0 7509 33d2 }
		$sequence_2 = { 83c801 85c0 741d 8d85d4fdffff }
		$sequence_3 = { ebcc 5f 5e 33c0 5b 8be5 }
		$sequence_4 = { c7465c60fd8f00 83660800 33ff 47 897e14 }
		$sequence_5 = { ff15???????? 6683bc24b002000000 8d8c24b0020000 ba???????? }
		$sequence_6 = { 7e58 bc80304a3e 60 4c 1c00 59 6443 }
		$sequence_7 = { 57 6868060000 0f57c0 894c2440 8d8424ec000000 c744242400004000 }
		$sequence_8 = { c3 8b04c50c509000 5d c3 55 8bec 8b4508 }
		$sequence_9 = { 8304240d cb 8d85b0fdffff 8945fc 85c0 745d 8b4df0 }

	condition:
		7 of them and filesize < 1523712
}