MALPEDIA_Win_Mount_Locker_Auto

rule MALPEDIA_Win_Mount_Locker_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "63bbcac5-b955-5b5d-aa2d-70707a28fbd4"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.mount_locker_auto.yar#L1-L158"
		license_url = "N/A"
		logic_hash = "fb8e6328f63d69a9ce7f54925d54c5554693b50d0c29d597a972ebecbfcd31cd"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { f30f5905???????? 0f5ad0 66490f7ed0 e8???????? }
		$sequence_1 = { 488bcb 488b15???????? e8???????? 85c0 }
		$sequence_2 = { 4c8bf2 8bf1 33d2 33c9 }
		$sequence_3 = { 498be8 4d8bc8 4c8bc2 4c8bf2 8bf1 }
		$sequence_4 = { 488d4df0 4889442428 4533c9 4533c0 }
		$sequence_5 = { 8bc8 81e10000ffff 81f900000780 7503 0fb7c0 }
		$sequence_6 = { 488364242800 4c8d442430 488364242000 4533c9 488b4c2458 33d2 c744243001000000 }
		$sequence_7 = { 488b0b 41b902000000 4533c0 33d2 }
		$sequence_8 = { ff15???????? 85c0 7509 f0ff05???????? }
		$sequence_9 = { 488b4d6f 8bd8 ff15???????? 488b4d77 }
		$sequence_10 = { 7505 e8???????? 833d????????00 7409 833d????????00 }
		$sequence_11 = { 57 ff7608 8d85b0fdffff ff7604 50 e8???????? 85c0 }
		$sequence_12 = { d1c0 2da55a0000 d1c8 f7d0 }
		$sequence_13 = { 8bc6 83d100 f00fc74d00 3bc6 75d7 }
		$sequence_14 = { 89442428 8d442410 50 896c2414 896c2418 }
		$sequence_15 = { 89860c020000 ebd5 83be0c02000000 74cd 837f0401 }

	condition:
		7 of them and filesize < 368640
}