MALPEDIA_Win_Conti_Auto

rule MALPEDIA_Win_Conti_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "243432c5-f0f7-5b86-b633-89ff78c7e694"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conti"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.conti_auto.yar#L1-L230"
		license_url = "N/A"
		logic_hash = "20c829c3c99980f53d00293a720f0b57b6132e54bd1517f31879bd40125146b9"
		score = 75
		quality = 73
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 8d7f01 0fb6c0 b957000000 2bc8 }
		$sequence_1 = { 0f1f4000 8a07 8d7f01 0fb6c0 b96c000000 }
		$sequence_2 = { 8d7f01 0fb6c0 b918000000 2bc8 }
		$sequence_3 = { 56 8bf1 8975fc 803e00 7542 53 bb0e000000 }
		$sequence_4 = { 57 bf0a000000 8d7101 8d5f75 8a06 }
		$sequence_5 = { 8d7f01 0fb6c0 b95d000000 2bc8 }
		$sequence_6 = { 57 bf0e000000 8d7101 8d5f71 8a06 8d7601 0fb6c0 }
		$sequence_7 = { 7542 53 bb0e000000 57 8d7e01 8d7371 0f1f4000 }
		$sequence_8 = { 85c0 7508 6a01 ff15???????? 6aff 8d45fc 50 }
		$sequence_9 = { 7408 57 56 ff15???????? ff75f8 56 }
		$sequence_10 = { 68???????? ff75f8 ff15???????? 85c0 7508 6a01 }
		$sequence_11 = { 780e 7f07 3d00005000 7605 b800005000 6a00 8d4c2418 }
		$sequence_12 = { 6810660000 ff7508 ff15???????? 85c0 }
		$sequence_13 = { ff15???????? ff75f4 ff15???????? ff75f0 ff15???????? 5e }
		$sequence_14 = { 50 6a20 ff15???????? 68???????? }
		$sequence_15 = { 740d 83f001 50 ff7608 }
		$sequence_16 = { 4881ec38010000 488b05???????? 4833c4 4889842420010000 ba15000000 }
		$sequence_17 = { 4881ec20010000 488b05???????? 4833c4 48898424e0000000 448b5114 }
		$sequence_18 = { 4889542458 8b4c2424 448bfb 448b6c2430 }
		$sequence_19 = { 03d0 6bc27f 442bc0 46884415c0 }
		$sequence_20 = { 03d0 8d0452 3bc8 7548 }
		$sequence_21 = { 2bc8 884c3c31 48ffc7 4883ff72 }
		$sequence_22 = { 4889542458 44894c2448 4c896c2460 e9???????? 4c8bbc24f0000000 418d41ff 4c8bb424f8000000 }
		$sequence_23 = { 03d1 8d0c52 3bf9 744c }

	condition:
		7 of them and filesize < 520192
}