MALPEDIA_Win_Satana_Auto

rule MALPEDIA_Win_Satana_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6ac5752e-900f-508b-8a43-5d1260606d7f"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satana"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.satana_auto.yar#L1-L127"
		license_url = "N/A"
		logic_hash = "887ae7387cc24afa23134d1618119c1d4b81112cec1e098d94578e5bdf1bb2a2"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { e8???????? 33c0 0fb78820b04000 668988a8404100 83c002 }
		$sequence_1 = { eb0f 8d0437 2bd0 8a08 880c02 40 84c9 }
		$sequence_2 = { 3006 8b45ec 47 46 3bf8 72c6 8b35???????? }
		$sequence_3 = { 3463 0fb6d0 8881a83f4100 888a30f24000 41 81f900010000 7cbf }
		$sequence_4 = { 8b45dc 8945d4 8b4de0 894dd8 6a10 ff15???????? }
		$sequence_5 = { 8da42400000000 8a88703f4100 888c05e4feffff 40 }
		$sequence_6 = { 40 84c9 75f6 c785e0feffff65000000 33c0 8da42400000000 }
		$sequence_7 = { 75ee b941000000 b8???????? 8d642400 8818 40 49 }
		$sequence_8 = { 6a00 6a00 ff15???????? 0fb60d???????? 89048df8864100 6a32 ffd7 }
		$sequence_9 = { 8b1d???????? 83c408 6a00 6a00 ffd3 8bf8 a1???????? }

	condition:
		7 of them and filesize < 221184
}