MALPEDIA_Win_Computrace_Auto

rule MALPEDIA_Win_Computrace_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6f20e231-3e83-5c1b-a86b-862cf0047b96"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.computrace_auto.yar#L1-L124"
		license_url = "N/A"
		logic_hash = "0bfe1ea1d3adbe04823d462a95cbcd8254c592d8730a9742e5565547142a82a1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d45cc 50 ff75dc 8d8540f2ffff 50 ff75d8 53 }
		$sequence_1 = { 53 53 56 e8???????? ebd5 }
		$sequence_2 = { 0f85fbfeffff 8d8558ffffff 50 e8???????? 397de4 7420 }
		$sequence_3 = { 7433 817de413010000 750b 8b8658440000 3b45e8 741f 8d45e0 }
		$sequence_4 = { 3bf3 7505 83f8ff 750f 53 53 }
		$sequence_5 = { 8d7e20 e8???????? 8d83401b0000 8bc8 2b8b481b0000 }
		$sequence_6 = { 56 e8???????? 56 e8???????? 0fb64e18 c1e904 80e107 }
		$sequence_7 = { 48 7407 035d0c 8a1b eb19 8a5e1a eb1e }
		$sequence_8 = { 894104 8b5004 85d2 7504 8901 }
		$sequence_9 = { 897dfc 397dd8 7507 57 53 }

	condition:
		7 of them and filesize < 73728
}