MALPEDIA_Win_Agendacrypt_Auto

rule MALPEDIA_Win_Agendacrypt_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "f32548e8-d6b6-5ddb-8fba-1bbeef55cbbc"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.agendacrypt_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f293479bb07328906630a1bbbaedfa64198cff7a5f05989036ed1c27febacd22"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { c1ef14 0fa4d001 81e7ff070000 25ffff1f00 83c6ff 81d3ffff0f00 897c2404 }
		$sequence_1 = { e8???????? 83c40c 8b45ec 8907 895f04 c7470801000000 837dbc00 }
		$sequence_2 = { eb2d 31c9 837d1000 894df0 0f852efdffff c745e000000000 8b45e8 }
		$sequence_3 = { 8d8c2490000000 0fb69c24d0000000 8b442468 8b74246c 0fa4c609 c1e009 8d3cdd00000000 }
		$sequence_4 = { 895008 5d c3 55 89e5 8b4508 f20f100d???????? }
		$sequence_5 = { 8d4c3bff 39d1 0f83c4030000 8d47ff 8954240c 897c2414 89442428 }
		$sequence_6 = { c1e808 83f81f 7f1e 85c0 743d 83f816 0f85fe000000 }
		$sequence_7 = { ff30 e8???????? e9???????? 8b442434 f20f1044242c f20f1054241c f20f104c2424 }
		$sequence_8 = { a1???????? ff75d0 6a00 ff30 e8???????? 83c438 5e }
		$sequence_9 = { c745dca8935600 c745e001000000 c745e400000000 c745ec50675600 c745f000000000 68???????? 56 }

	condition:
		7 of them and filesize < 3340288
}