MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71
SHA3-384 hash:	7559acd8ed3d8485f44553b254df613373374f89589f133810c77fe29d8d6807640d6fc51c6e1bb4d2ffaeeda973d48a
SHA1 hash:	258dba8367360efce0d5eabab9823a96dca342c2
MD5 hash:	f0fb12685475ca9e8a87db89bbf5fb3d
humanhash:	early-sierra-network-twenty
File name:	emotet_exe_e3_8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71_2020-09-25__000324._exe
Download:	download sample
Signature	Heodo Create hunting rule
File size:	278'528 bytes
First seen:	2020-09-25 00:03:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a5bdbc5ebc2d3acc030fbc71b2b2facb (107 x Heodo)
ssdeep	6144:AIFpoLPsjOe5Rq2btO4oKAOMK+z32E2UomN25:hOe5A2gOTG7N25
TLSH	9B449F2236D2C073E4AB013149E58BB977F7BC52AF32924FBF903B4D6E315568A25361
Reporter	Cryptolaemus1
Tags:	Emotet epoch3 exe Heodo

Cryptolaemus1

Emotet epoch3 exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Emotet

Link:

https://www.capesandbox.com/analysis/65651/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Emotet.dh.10398.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending an HTTP POST request

Connection attempt to an infection source

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71/

Threat name:

Win32.Trojan.Emotet

Status:

Malicious

First seen:

2020-09-25 00:05:19 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rr3fwbwgvwigvnlrktdzrpcd6ubqyax2egqbx5giz3datfzs7zyq._file

Result

Malware family:

emotet

Score:

10/10

Tags:

trojan banker family:emotet

Link:

https://tria.ge/reports/200925-alqfd5essn/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Emotet Payload

Emotet

Malware Config

C2 Extraction:

49.243.9.118:80
162.241.41.111:7080
190.85.46.52:7080
162.144.42.60:8080
157.245.138.101:7080
103.133.66.57:443
167.71.227.113:8080
80.200.62.81:20
78.186.65.230:80
185.142.236.163:443
78.114.175.216:80
202.166.170.43:80
37.205.9.252:7080
118.243.83.70:80
116.202.10.123:8080
223.135.30.189:80
120.51.34.254:80
139.59.61.215:443
8.4.9.137:8080
202.153.220.157:80
179.5.118.12:80
75.127.14.170:8080
45.177.120.37:8080
41.185.29.128:8080
79.133.6.236:8080
192.241.220.183:8080
203.153.216.178:7080
115.176.16.221:80
113.161.148.81:80
178.33.167.120:8080
183.77.227.38:80
46.105.131.68:8080
181.95.133.104:80
93.20.157.143:80
172.105.78.244:8080
139.59.12.63:8080
190.192.39.136:80
41.212.89.128:80
27.73.70.219:8080
109.206.139.119:80
192.163.221.191:8080
113.160.248.110:80
182.227.240.189:443
185.208.226.142:8080
126.126.139.26:443
185.80.172.199:80
103.229.73.17:8080
5.79.70.250:8080
95.216.205.155:8080
190.194.12.132:80
37.46.129.215:8080
51.38.201.19:7080
195.201.56.70:8080
175.103.38.146:80
73.55.128.120:80
74.208.173.91:8080
189.150.209.206:80
91.83.93.103:443
86.57.216.23:80
36.91.44.183:80
181.80.129.181:80
50.116.78.109:8080
14.241.182.160:80
60.125.114.64:443
113.156.82.32:80
190.191.171.72:80
67.121.104.51:20
111.89.241.139:80
220.106.127.191:443
46.32.229.152:8080
115.79.59.157:80
58.27.215.3:8080
192.210.217.94:8080
118.33.121.37:80
169.1.211.133:80
54.38.143.245:8080
198.57.203.63:8080
138.201.45.2:8080
172.96.190.154:8080
143.95.101.72:8080
45.239.204.100:80
103.93.220.182:80
185.86.148.68:443
119.92.77.17:80
186.20.52.237:80
115.79.195.246:80
223.17.215.76:80
77.74.78.80:443
113.203.238.130:80
220.147.247.145:80
153.229.219.1:443
187.189.66.200:8080
103.80.51.61:8080
27.7.14.122:80
200.116.93.61:80
182.253.83.234:7080
91.75.75.46:80
128.106.187.110:80
113.193.239.51:443
180.148.4.130:8080
157.7.164.178:8081
88.247.58.26:80
37.187.100.220:7080

Unpacked files

SH256 hash:

8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71

MD5 hash:

f0fb12685475ca9e8a87db89bbf5fb3d

SHA1 hash:

258dba8367360efce0d5eabab9823a96dca342c2

Link:

https://www.unpac.me/results/721d4c77-4425-4341-8ee6-a34d1e06620e/

SH256 hash:

d69ee370517eb778567c6bf854faceb41bacd01c53a83d7a8aa666927d894fac

MD5 hash:

6e22264d1ed36e82337544f77b853e48

SHA1 hash:

5e512bd7aa19a52c104493c1648d70a4c7234cc7

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/721d4c77-4425-4341-8ee6-a34d1e06620e/

Parent samples :

b89f4a56e2151d1ecafd83a6a41595a6e0d6449d21154f620c0c214e4ae8d2b0
4df4b740e1e529d04289e80010a2f941247cbdf0d3ddf098004acf1801ce3cba
8f06b5a365445129e40c986501d1776d171dccc68f9e0d253f9b816a402bf290
22777674debfef15fe9bdc2f281888685e17544f649132d891aa97ec1bbb6942
3a9cd442e209cf4f2b0053f17fc2d7108d2aa24fff7b4a1eb9f67630a198ef95
52355b5d0e3bbcf206c4babc53e26b21747b74d14173c7be8a19c84880ea3f16
e725846299b557faf8e4116074ad5fe96dd5e0d8f03f1f2fddc515bf94650486
8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71
e97ddfc02ee6a34ac71806d69435cd41ee25f0ea8f7c34da6f13d1a3fc5ed9eb
1d74495c874aff77b34a8f1fe530ce8e709da00c00500cb963d0d0990626dd5b
0e9a4ea0cee62e173d94c30ad9366bf1e42e92d73f446716ede1a2d3685e8eab
796506c5c7ab8c42149a650013840d16ba8d2fc1d9115c2eddd1a8223b630c48
c89aea2ddb51ea4ce6a9ebeae6038fe7647cdf07fa25689ffc6aa1e1890e0877
ed35916f044382fde248ad3268b15033aadfcb2e98360aade23ed3e386f9d1ce
bfeada8afaa97c11e49d2c32af18e14b893a0e73832405e58a4dcfec718b3ae5
1bd148158eae05de8dc9328f797332918431bcb04b11cf0ff26bb2c7dea61b96
a88484e820568761badf6ec197667f96fc8590c2fdd97d563e11cf45b643c788
8c34f38d928a1aa8967fe3f887a2abb294b44feff6315a992a239712ad77d755
b6ceab77dd0e3faed6bb543248578e086e5a8674d4b5ae7a04d6118ddaa56f04
bbb4e1f9dad96ffb9e36df8913d2d1ac61f581b3177b95c5e51b0043ee120249
916916b5fe9b7a53c1a65e28c1784c95d5f7ccbf68c05c20173cd4592d5e9af7
fc8b6c2c161b9cab4292f3ed3c1945e43e0088294d501c69b50c3d5d4865991d

SH256 hash:

e5c488c73f34f4df7b85a0b6fa8f667fed7364dbceec8e18f426d53989af9045

MD5 hash:

3e2cb3c2f6991faaabffcfdc3b05313e

SHA1 hash:

9e4f4e5b24e21abb2b7943da54d7ebe850a55bf0

Detections:

win_emotet_a2

Link:

https://www.unpac.me/results/721d4c77-4425-4341-8ee6-a34d1e06620e/

Parent samples :

f0028fdb662c50f1460eeac62c3e32fff284dca021e838a8d04a6f515d225cd9
6b65f0b6628aea60c260412eb80dffc3d3f8b2b87b9dd00570d3e55f0864a420
1179a5661f9312c8a4e4172b8adfe90073124b2262c254eaec90bf16b1bea318
f0ef726c4afdb2f483306f9a7cc5e1d7eb163ba7db636ed6adaecc442b2b5411
57a4f5ea7377f36f7e856067e8280f198ef6bba59d68b82e3efa669f026a5d76
383e967a0f4bf4ddc2c11129da8ef04a9217b05123d45a62107de146b62b5c04
d2afeec4c8b753d37ff7ea6b50db41ba65e6659d0adffef6b9880e5f38e23860
8c0a851158466d0bc7abad09987827e36e679a2b9d5efe9443f1b103d269c062
a871b09a55c0d83a8ac4043aee39a3e236edc5df5cf67950f3bd31c4255c27cd
254c79c80a0818150dfc816a82eb32a17d1d765c9f364cf8d20eeaf641f06a7b
49aaa5eace4bbcb33ca0a78acf239b3de6c784f6cea312ccb94e56c632770290
d929afb02b799921419995d74d0dfd939b5021738d84e04fb52031040dc10e93
807c6bf3f7b5a8244bc1fb24e648738aa36d68541719a87c40541f2f051fe692
0aa375e21ab71a7a70486f57f5cb884f8e6a524eee6a3ca5275fe237a417a41d
755d41ca7a8f2b0b33889b186e3b124bc53600319c8686f96aa2d6e853a36944
cb6221098dac507ea8ccfa15a821bd7f492d369d56d9f6c7c1a59260754d63e6
a512efbc77b9a2e99830bc882222a54c7d71d2880eb33cbc8e8e70b7f9b13b8b
802bab62f56622ba0e61f7db5649398e06103ff1eed5eac75e3224ff19c88ac7
ed80a8b01d96de90f846e6970e104f1f2d5a758f5487812f97be1e15b1c97f1a
dec973f6b7fcc08513e2e6c0c0356a3db9400776380b80aaa136228d1784da62
8206902f9bebe24d899e7f3a1b33df230c66335f67c839610de5913978277c60
a2b02052f591b90de36ff9637dd6eacb927619d14b24d753ebac3a71fb95e078
80b3d8adcd1d0f056785f095ddec96fccb10d8aeac832ee8365a436619756889
6eb02a821908a6408d3b47c817d94717436098e398be21924c9832ddaa28fde3
758709586964be1325cfd6e4844c0b82def1b292496c9ffcbf6296a365f06166
b20f7ac89700e2a8323e94c9e365a31eeb7208ad522e19f48e32cb6b79028ab4
606c4804c3c58fc2a5ccadb7c74106041d6e07143f1e2e61a33da59b55dd6880
12886f7945bcd10f1e6e971fc099ffc02929acd61f7a2e5d0dca0cfdb075c480
edaa4b3c7a1603e4adfe284b3df21eb644dcaf7652e58bcbe8751d0b360ac509
a06205116139cfd50d6b827ae8ead76f82cddf3fd476688f23951a15da39a695
e4cafad75a6827365549a346191b3cc54fb7766d4af8ca44f5024fb4a906e10e
6dac3300f7d562117a5b334b223a9497c6edd5d1244833379f91a0adf811a950
e3d2587dab9b6816f739826cbc88bba70d6847caa778b05ab0bce5d627ca5457
23ce100077748490180f8d3bcc7bde6d368ed4302613e496e587c12f5c48aed3
ed0581dfb5d6ed0d85fd725e37976fe5acd83f3b6c02f538fff32cf837e79af4
6c3598947a01986ca213ef4e99c6464ab3ad09bbf8c913f39b68620212ea0775
c751aa956d1389f16489b9826759bd4411c8cb2ef35f2a9d16b2b8122755834d
9f4dbaafb63c52d5799ef76ddd5ee357c33a4cc0e241fc059deb3db5711f0a3a
6c42f33650fdedf99f91b1c19247b688dc6f30b00a514e7730d229cd96710a2d
88dc90b2ccebf4a972dac230150d5617fe0a1e0fb0b37ccb1165c8b849efbf2d
c3c12b9d5f842c01d4e7f73790d64c4b002c751b51a406a081b51b70434ea794
c5a7144a8d81f7b2a5f8b3fcbb10f8bf8bcc8b90c72f1d989f8e8a72743eb831
8fe4907e0e825f8ed20f63ab301447b8f6db720801966a9fcd6c877a0a5be335
7e0de993aa9ec48d67185e4a46a3a0d9e464d1337b084d9df8202f214681cc4f
aba70f46ab693234b5ebe28dc8aa3d988ff1c8c87da889b84158eecf115a1841
14159ac30c1aeaaeac70f521fe6d9f160e03b5ae7fdfdb4ffc653145520bf4e4
b53de981ee47361a595c4b44990914207605fe8646db383fd7b7814db836fbc8
b9719c555bc7fa10cad10e50e4be93ed0216ee95a162b2ae4be12a3a1ffe7e3b
8424f95b5aed6fe4e6407b4d15066c67c0646f17bc4c33c5239462e6f82d12d1
465114308e3b01654c3bc593c1f300be2639187ccaddf641a0ef66fe58d58d1d
96bb1052bc0bbf88503410a3e819bb6e4e876ca3a935b256dc7a7176c910282e
9190de9e6ffa14044020dd35525813f692bf31e14908923723e7dc91c78d27fa
7b73cc89294f762b78b361443feb50255d97ab5a02e5700a4004d69d62da8307
1ca5a62083dc99c1a37803e718359a0579f7f71fdbb7c9f7ec3cc8e0bd6cd72e
0787812cd093625c4aacce2d2e7bb62ae05d8ce62cb864b2998987f1cdbb5be0
112808fdb0fbf7bfe08d1ad28011e75cd7f780d601acad554c4169ad61c50241
85a1a48e995801885d6da5b4f0de9738b285a597614bd101c2281d556b046a89
586aec530f25af61d0c6fad8ed9592f7bec368f8e7b26483b242669985f1b717
b167dbba27cab8514ea5e1c74f3b3e53bce1bd95269a3604d8ef6942919e7ec3
4180d7d1e41d9efb59f08bd7aa6b1c2955d484e664065a5eebe262253ca0a238
c839496a1a8b48bb4c16228063b2d042ef6263195add72b735ed42871ac95ad6
28135e1a84f2ada5437f74f8509faaccf67cc5407e52f500cedb2c408dcda22e
2aea8b95aac58765eba5813b48a7c341401bcbe95578902516c4cd9fef2366d3
159d93f6f8c8463b79e9073d742284ea89a49c386566ad3d45cf0b8e0b7811a3
9910c07061ae3bff199c8d1f3e49b2e0102320f199c798b5fb16af2f79a2b192
e32b19bf66c3b83c739bef908ed5a2d383e643a4cae848a7ffde0e81ae3ddd1f
1bf15d74e0ff17d00bf275c653380bbf57dd5a3d463f797680a2704ef828526a
afd2bc6be45dec1a22336f2309a4947fe1a07a63f0e37ec1f9066727c55e301c
836d0bddc01a54cf60355b7ec084afe61764985564cda4eab496885abb060bc3
15e348c01fb176ba950086ff22c02b8817cb2777abc7cff80f62a9ec4f791610
1424bd30bb2a866ce2f4320202e205ec234da334833f47401a2555df05419159
d8cc8369defb65bc690d0a99e15762f6c8aa7574035fa176446541b32ab6a502
b00c95d8ff6df7fa7b6d6dd136323d4752c24c519e777ebe3ab18a9e492e1d9d
5125a6de754604a080e5f166d035ab1004a9650afa016f585e2dd4ccfe007750
2254affd858677ff83e6273ce4d9c98d5074bd1b1a2ad78c6ede6ca789a1e24b
a3a2752ae43bb26ce9a8cc1e458a0b469ef4619febcb887a154db7733f2b6e08
dc255086d51eaa37c61d8d9b9c44af3e32f2be7113deec943c29cc0bb8298172
72265a5f34b5cf05363d09b2d3bd8007a09248605960909d3ee4f575467adf37
c93f9c8da65a43ffae3816085a5f6c178e1d3c29e4e1f6fa593fadf27e0c72e5
af20a64a5a6d1b655aa02155f1aa7c9e5a61e2456cc2431b72f450104897a973
c3c1163d855c2c67126786f73bc5b0c45b146f5a3db8633bbdb0e737a6aca2ad
3110063d9959d46f74710b25179a798281bb6b2d5ea4472fd3b7988ceee5f8cf
5e51d1dc0de40ea32ad6a856599a3b5f4da77077a3744f30b80c49023e906b05
aa21a3d7a7046492c7c2da6fb1bb291b814794374bb8770654fa666a8b609392
d67f83bf3f243614cd6ade643a9b464a9d363ddf5217b8916e3bcc3beb04854d
27b66aef1517f8856db2b232d7da1bff9d309a620e7c1edd3426fcc1ed341b81
e4662780d12c8ac6557c14bd848d50bdbaea77730151d90bb5995e9dcea14248
b89f4a56e2151d1ecafd83a6a41595a6e0d6449d21154f620c0c214e4ae8d2b0
4df4b740e1e529d04289e80010a2f941247cbdf0d3ddf098004acf1801ce3cba
8f06b5a365445129e40c986501d1776d171dccc68f9e0d253f9b816a402bf290
22777674debfef15fe9bdc2f281888685e17544f649132d891aa97ec1bbb6942
3a9cd442e209cf4f2b0053f17fc2d7108d2aa24fff7b4a1eb9f67630a198ef95
52355b5d0e3bbcf206c4babc53e26b21747b74d14173c7be8a19c84880ea3f16
e725846299b557faf8e4116074ad5fe96dd5e0d8f03f1f2fddc515bf94650486
8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71
e97ddfc02ee6a34ac71806d69435cd41ee25f0ea8f7c34da6f13d1a3fc5ed9eb
1d74495c874aff77b34a8f1fe530ce8e709da00c00500cb963d0d0990626dd5b
0e9a4ea0cee62e173d94c30ad9366bf1e42e92d73f446716ede1a2d3685e8eab
796506c5c7ab8c42149a650013840d16ba8d2fc1d9115c2eddd1a8223b630c48
c89aea2ddb51ea4ce6a9ebeae6038fe7647cdf07fa25689ffc6aa1e1890e0877
ed35916f044382fde248ad3268b15033aadfcb2e98360aade23ed3e386f9d1ce
bfeada8afaa97c11e49d2c32af18e14b893a0e73832405e58a4dcfec718b3ae5
1bd148158eae05de8dc9328f797332918431bcb04b11cf0ff26bb2c7dea61b96
a88484e820568761badf6ec197667f96fc8590c2fdd97d563e11cf45b643c788
8c34f38d928a1aa8967fe3f887a2abb294b44feff6315a992a239712ad77d755
b6ceab77dd0e3faed6bb543248578e086e5a8674d4b5ae7a04d6118ddaa56f04
bbb4e1f9dad96ffb9e36df8913d2d1ac61f581b3177b95c5e51b0043ee120249
916916b5fe9b7a53c1a65e28c1784c95d5f7ccbf68c05c20173cd4592d5e9af7
fc8b6c2c161b9cab4292f3ed3c1945e43e0088294d501c69b50c3d5d4865991d
a149461d928cfa9a6b2134b5aefc1e7997d4f9222fc761808d5fc89d4446f793
ac552d8f044b68b03884522e7a4bd0bb6dc9c140e0fb180d34389db600be2266
4a01e28b4ba4a4572c738e629c034e036acfaeebe4c0b8b824cda6d94c3d83f6
40dfe6600545f8a775f8991cdbc94234299e5d0e460155fa7c495f8c1e7a974f
3dd8a68f7a6447e9fed9d87d1e209fa3d483230410641ee02e3c659a46d1c245
a4a522d18316774c805392dec6e45142b23085485b10e43abf7343c29c3015ea
22830f02750f58606af776016f46bf02034632479a09653e3dd81947b9675f13
a757942074fc9e44992f09a45002492d35cb619967dfd7e4437fa1df92fb1334
363b8b9a2f60607ef28ea03c8b302c254e551b59b26f79f8dd8c71b5fe3e376c
daa57c761963b708c3a2414e7c783292a7ced40b9da36be20ce5b0ef87634ef9
25015c3611d11fc12825e7104eeee4f8587e8992f421fd5a85d8b5f0bbf3b06f
2c0b6c34f49aece09bb77117492699acfb6dd87bbef9d7b144bfae08d1fb41e1
ec44bdc5868d8a1fb74ba36b669a96ee17716a658c9728e40a1de172af6db33f
c11d5b0539f22d16051a2411fdaaa431976ad83b4476261ab62ea3f286b7ba97
0c10e91063021ecc878992880022843c8b4594197379cf324e9c0ec17a6cfe79
f21ad6e67518c37587f2958048b54330d39af18345d92636d82176e9c8f0bba2
9dbbefc6467a187b2acdfc4611af38dd15b7954623478f0e7677057a3e56d2ec
80e54cf538d46fcdb0261804ff12e04b07c41be5970d501be4e5877fc4633a7a
22e8b2bf38edc216416fd51d4b434762edfa2a0c0a825327b1302d2092bc4ec7
0f350fc4e5fb367ea1a724f200c84b2b67444485f7f483786d97e0b8e5138d68
67baea198a8a4970f564908a436a2bf5ee4a25f081cf047c8961d94ede8db98c
0193e89f29de41631da9ad469ee52143a01df538c99e073c7b83ecc2186d8e33
d70afa860aa34e64f62b8e73a01eeeb4fbd44a3e2c5ebd4c3c9413cf42fd11d3
c8b0e221769318980ad09391ca7ac271a5029578e41419ffd92475bfc59c65ce
90387ba7c182a410e747b3a2649994a5d75f08195f6c3db1458642cc13eb6ed9
314927f6043323747567f05365f321787f7fa89c1dc6ff1c4deec1dedd0a33c4
a332936307968adb81ad7f103b327b5df9ac76e564bf5ea2ba0fd51562dd243c
cb79b3769e2186d1dbc29905cad5b083650a1a1b192e6172543f78a5295549d4
3ff15902f38c269ac5e5d5856cf2409d5839f7a6792ceb42f024cfe0eb0ceb45
cd7b13e6ffb2b09d13896784a13e1746643a0f6ee54ba4b09f193bcc3a9b32a2
a9e9c95a181b6c7ce2b6e9ba53716acd70a2881ccf413ec3d4ae76775fabd458
f21838338dee5fe502e6ff6ba0a44fa98f374d4a731d39116c975a4059dc0804

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Emotet

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8c765b06c6ad906ab57154c798bc43f5030c02fa21a01bf4c8cec6099732fe71

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Cobalt_functions Create hunting rule
Author:	@j0sm1
Description:	Detect functions coded with ROR edi,D; Detect CobaltStrike used by differents groups APT

Rule name:	win_sisfader_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator