MALPEDIA_Win_Chrgetpdsi_Stealer_Auto

rule MALPEDIA_Win_Chrgetpdsi_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "4b33cd5b-8079-52fc-b7ed-b1adf7d885ba"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chrgetpdsi_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.chrgetpdsi_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "e320738bdce66bcf9e9b4d1435fc683c80facbe71e20f18a2db06792d0965432"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 803800 7532 488b5008 4889d9 48c1eb06 660f1f440000 48395810 }
		$sequence_1 = { ffd2 488b4c2478 488b5940 488b5148 488d05723b1400 4889d1 e8???????? }
		$sequence_2 = { c3 e8???????? e8???????? 488d0548981800 488d1d31832000 90 e8???????? }
		$sequence_3 = { e8???????? 488b0d???????? 48898c24a8060000 488d05734e1900 e8???????? 833d????????00 750e }
		$sequence_4 = { 85db 754d 8b5920 4863411c 85c0 7924 48f7d8 }
		$sequence_5 = { e9???????? c70301000000 458b4c2458 89442430 4585c9 0f85cdfdffff 31c9 }
		$sequence_6 = { e9???????? 488d15d94f2300 48895068 e9???????? 488d15c14f2300 48895070 4889d0 }
		$sequence_7 = { e8???????? 488b442438 488b5c2428 e8???????? 488d0584982e00 bb0f000000 e8???????? }
		$sequence_8 = { f30f6f6810 410f116a18 f30f6f6020 410f116228 f30f6f6830 410f116a38 f30f6f6040 }
		$sequence_9 = { 81f992d74abd 0f8783000000 0f1f00 81f90241adbb 7538 488d0d911c2c00 4839c8 }

	condition:
		7 of them and filesize < 10027008
}