MALPEDIA_Win_Acr_Stealer_Auto

rule MALPEDIA_Win_Acr_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "1003329d-aff7-559b-894c-14706d73c37d"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.acr_stealer_auto.yar#L1-L172"
		license_url = "N/A"
		logic_hash = "d919e082eb04a99d443b28730bcbf6127cc892ba025c69b26f242c19d1e8c686"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 891481 8b45f8 83c001 8945f8 8b4d08 51 e8???????? }
		$sequence_1 = { 8b55fc 0fb602 8b4df8 0fb611 2bc2 eb16 }
		$sequence_2 = { 52 8d4508 50 e8???????? 8945d8 8955dc 6a00 }
		$sequence_3 = { 895510 eb94 33c0 8be5 5d c3 55 }
		$sequence_4 = { 83c001 8945e4 8b4de4 3b4df8 7314 }
		$sequence_5 = { 8d45e0 50 6803200100 8b4df8 e8???????? 0fb6c8 }
		$sequence_6 = { 035508 81fa806cfa0b 7604 33c0 }
		$sequence_7 = { 8b048a 50 e8???????? 83c404 ebc9 8b4dfc }
		$sequence_8 = { 33c0 8bd1 0fa4f11f d1ea }
		$sequence_9 = { 0f57c0 6a01 0f1101 68???????? c7411000000000 c7411400000000 e8???????? }
		$sequence_10 = { 68???????? 68???????? 6a03 83ec10 }
		$sequence_11 = { 5d c3 85f6 747e }
		$sequence_12 = { 33c5 8945fc 56 8bf1 8b06 0fb600 }
		$sequence_13 = { 41 03d8 8b849574ffffff d3e0 }
		$sequence_14 = { 57 8b7e24 0bc7 741e 8bca 8bc7 83c1ff }
		$sequence_15 = { 3c5c 0fb6c8 b82f000000 0f44c8 47 880a }

	condition:
		7 of them and filesize < 2160640
}