MALPEDIA_Win_Iconic_Stealer_Auto

rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "78d0531f-cb60-5e1b-b308-a28befc6e8f0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.iconic_stealer_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "f9fdaf5eeb127db1a364ec0c3c0cd341bb3ef0d9c84f03f63d4efe4393d5c87c"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb19 453b7e28 7ef3 45896e2c 448b6c2430 45897e28 eb04 }
		$sequence_1 = { e8???????? e9???????? 80be2c01000002 0f83b3000000 498b4c2460 bb0080ffff 4885c9 }
		$sequence_2 = { 4c8d7f10 488b5708 488bce e8???????? 418b07 c6043000 4885f6 }
		$sequence_3 = { 8d506c 448d4001 e8???????? eb33 8d4101 ba03000000 41894500 }
		$sequence_4 = { 458bc2 418bd3 488bcb e8???????? eb39 4183fa01 743b }
		$sequence_5 = { 4c63c7 4c03c0 4c89ac2410010000 488b842498000000 4533ed 4883c0e0 4c89442458 }
		$sequence_6 = { 8b4c2460 85c9 7412 0fb6461f 3c08 730a 898c86e0000000 }
		$sequence_7 = { f30f7f45cf 4885ff 740c 488bd7 488d4db7 e8???????? 4488b32c010000 }
		$sequence_8 = { e8???????? 488945b7 4c8be8 4885c0 0f8439030000 498b542430 4533c9 }
		$sequence_9 = { f6406008 7504 c6452301 488bcd e8???????? 4c8b942488000000 488bd8 }

	condition:
		7 of them and filesize < 2401280
}