rule win_lumma_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.lumma." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 57 53 ff767c ff7678 ff7644 } // n = 5, score = 1100 // 57 | push edi // 53 | push ebx // ff767c | push dword ptr [esi + 0x7c] // ff7678 | push dword ptr [esi + 0x78] // ff7644 | push dword ptr [esi + 0x44] $sequence_1 = { ffd0 83c40c 894648 85c0 } // n = 4, score = 1000 // ffd0 | call eax // 83c40c | add esp, 0xc // 894648 | mov dword ptr [esi + 0x48], eax // 85c0 | test eax, eax $sequence_2 = { 833800 740a e8???????? 833822 } // n = 4, score = 1000 // 833800 | cmp dword ptr [eax], 0 // 740a | je 0xc // e8???????? | // 833822 | cmp dword ptr [eax], 0x22 $sequence_3 = { ff7678 ff7644 ff563c 83c414 } // n = 4, score = 1000 // ff7678 | push dword ptr [esi + 0x78] // ff7644 | push dword ptr [esi + 0x44] // ff563c | call dword ptr [esi + 0x3c] // 83c414 | add esp, 0x14 $sequence_4 = { 894614 8b461c c1e002 50 } // n = 4, score = 1000 // 894614 | mov dword ptr [esi + 0x14], eax // 8b461c | mov eax, dword ptr [esi + 0x1c] // c1e002 | shl eax, 2 // 50 | push eax $sequence_5 = { 66894338 8b4626 89433c 8b462a 894340 } // n = 5, score = 900 // 66894338 | mov word ptr [ebx + 0x38], ax // 8b4626 | mov eax, dword ptr [esi + 0x26] // 89433c | mov dword ptr [ebx + 0x3c], eax // 8b462a | mov eax, dword ptr [esi + 0x2a] // 894340 | mov dword ptr [ebx + 0x40], eax $sequence_6 = { 8b4610 894320 8b4614 894328 } // n = 4, score = 900 // 8b4610 | mov eax, dword ptr [esi + 0x10] // 894320 | mov dword ptr [ebx + 0x20], eax // 8b4614 | mov eax, dword ptr [esi + 0x14] // 894328 | mov dword ptr [ebx + 0x28], eax $sequence_7 = { 66894316 0fb7560e 0fb74e0c e8???????? } // n = 4, score = 900 // 66894316 | mov word ptr [ebx + 0x16], ax // 0fb7560e | movzx edx, word ptr [esi + 0xe] // 0fb74e0c | movzx ecx, word ptr [esi + 0xc] // e8???????? | $sequence_8 = { 017e78 83567c00 017e68 83566c00 } // n = 4, score = 800 // 017e78 | add dword ptr [esi + 0x78], edi // 83567c00 | adc dword ptr [esi + 0x7c], 0 // 017e68 | add dword ptr [esi + 0x68], edi // 83566c00 | adc dword ptr [esi + 0x6c], 0 $sequence_9 = { e8???????? 83c40c 6a02 6804010000 e8???????? } // n = 5, score = 800 // e8???????? | // 83c40c | add esp, 0xc // 6a02 | push 2 // 6804010000 | push 0x104 // e8???????? | $sequence_10 = { 3b7e08 72ec ff7604 ff15???????? 83c404 56 ff15???????? } // n = 7, score = 700 // 3b7e08 | cmp edi, dword ptr [esi + 8] // 72ec | jb 0xffffffee // ff7604 | push dword ptr [esi + 4] // ff15???????? | // 83c404 | add esp, 4 // 56 | push esi // ff15???????? | $sequence_11 = { 29f8 89f1 89fa 50 e8???????? } // n = 5, score = 700 // 29f8 | sub eax, edi // 89f1 | mov ecx, esi // 89fa | mov edx, edi // 50 | push eax // e8???????? | $sequence_12 = { 01c9 39dd ba00000000 19c2 } // n = 4, score = 700 // 01c9 | add ecx, ecx // 39dd | cmp ebp, ebx // ba00000000 | mov edx, 0 // 19c2 | sbb edx, eax $sequence_13 = { 0f94c3 89d5 09cd 0f95c7 } // n = 4, score = 700 // 0f94c3 | sete bl // 89d5 | mov ebp, edx // 09cd | or ebp, ecx // 0f95c7 | setne bh $sequence_14 = { 53 41 55 49 c7c200000000 49 } // n = 6, score = 700 // 53 | push ebx // 41 | inc ecx // 55 | push ebp // 49 | dec ecx // c7c200000000 | mov edx, 0 // 49 | dec ecx $sequence_15 = { 31ed 89ae88000000 c7868c00000000000000 899e80000000 833e00 0f94c3 89d5 } // n = 7, score = 700 // 31ed | xor ebp, ebp // 89ae88000000 | mov dword ptr [esi + 0x88], ebp // c7868c00000000000000 | mov dword ptr [esi + 0x8c], 0 // 899e80000000 | mov dword ptr [esi + 0x80], ebx // 833e00 | cmp dword ptr [esi], 0 // 0f94c3 | sete bl // 89d5 | mov ebp, edx $sequence_16 = { 50 57 ff7618 e8???????? 83c40c 894618 85db } // n = 7, score = 700 // 50 | push eax // 57 | push edi // ff7618 | push dword ptr [esi + 0x18] // e8???????? | // 83c40c | add esp, 0xc // 894618 | mov dword ptr [esi + 0x18], eax // 85db | test ebx, ebx $sequence_17 = { 89ec 5d c3 41 52 } // n = 5, score = 700 // 89ec | mov esp, ebp // 5d | pop ebp // c3 | ret // 41 | inc ecx // 52 | push edx $sequence_18 = { 09cd 0f95c7 30df 7514 837e6c00 750e } // n = 6, score = 700 // 09cd | or ebp, ecx // 0f95c7 | setne bh // 30df | xor bh, bl // 7514 | jne 0x16 // 837e6c00 | cmp dword ptr [esi + 0x6c], 0 // 750e | jne 0x10 $sequence_19 = { 19c2 72f1 55 6a01 ff7748 } // n = 5, score = 700 // 19c2 | sbb edx, eax // 72f1 | jb 0xfffffff3 // 55 | push ebp // 6a01 | push 1 // ff7748 | push dword ptr [edi + 0x48] $sequence_20 = { 83f900 75f1 83ec04 8b4508 e8???????? } // n = 5, score = 700 // 83f900 | cmp ecx, 0 // 75f1 | jne 0xfffffff3 // 83ec04 | sub esp, 4 // 8b4508 | mov eax, dword ptr [ebp + 8] // e8???????? | condition: 7 of them and filesize < 1115136 }