MALPEDIA_Win_Doppeldridex_Auto

rule MALPEDIA_Win_Doppeldridex_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "ced8a78a-6ad2-5841-bcfe-93ef4e5f8449"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.doppeldridex_auto.yar#L1-L171"
		license_url = "N/A"
		logic_hash = "e97f34858f91b22015eeed214768462d60fe5ddb269feac9b9f5d517cceb6eca"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { ffb424a0010000 8d5380 e8???????? 8b842494010000 }
		$sequence_1 = { 8b9998010000 895c2410 8ba984010000 896c2414 660fd6442418 660fd6442420 e8???????? }
		$sequence_2 = { 89442404 660fd6442408 895c2410 8bb980000000 0fb602 897c2414 89442418 }
		$sequence_3 = { 8b760c 89842494010000 89b424a8010000 6a00 8d8c24b0000000 }
		$sequence_4 = { c78424a401000000000000 83c4d8 660fefc0 893424 }
		$sequence_5 = { 50 8d4890 e8???????? 8b8424a4010000 8d9c24e8010000 }
		$sequence_6 = { 33c0 48 8bfe 8bda 2bf8 2bd8 0bfb }
		$sequence_7 = { 8d8c248c010000 e8???????? 8d8c24d0010000 e8???????? 8d8c24c8010000 }
		$sequence_8 = { e8???????? 8b4588 2b45f0 8b4da8 890c24 89442404 }
		$sequence_9 = { 83f800 8945f4 894df0 8955ec 752b }
		$sequence_10 = { 8955ec 752b 8b45ec 83c418 5b 5d }
		$sequence_11 = { 8b45d4 0fb708 8b55dc 83c201 }
		$sequence_12 = { 8b0d???????? 8945c8 ffd1 8b4dec }
		$sequence_13 = { 83fe00 0f94c3 39ce 0f94c7 08fb f6c301 8975d8 }
		$sequence_14 = { 8b4508 b902000000 8d55cc bed092c50d 31ff c745f0d08ec50d }
		$sequence_15 = { 57 83ec44 8b4508 31c9 ba00100000 beb0af4e67 c745f0b09f4c67 }

	condition:
		7 of them and filesize < 360448
}