rule win_lockbit_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.lockbit." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 51 e8???????? 83c628 4f } // n = 4, score = 300 // 51 | push ecx // e8???????? | // 83c628 | add esi, 0x28 // 4f | dec edi $sequence_1 = { 8d8550fdffff 50 6a00 ff15???????? } // n = 4, score = 300 // 8d8550fdffff | lea eax, [ebp - 0x2b0] // 50 | push eax // 6a00 | push 0 // ff15???????? | $sequence_2 = { 6a00 6a00 6800000040 ff75d4 } // n = 4, score = 300 // 6a00 | push 0 // 6a00 | push 0 // 6800000040 | push 0x40000000 // ff75d4 | push dword ptr [ebp - 0x2c] $sequence_3 = { f7d2 ab c1c005 33c2 ab 8d77f0 } // n = 6, score = 300 // f7d2 | not edx // ab | stosd dword ptr es:[edi], eax // c1c005 | rol eax, 5 // 33c2 | xor eax, edx // ab | stosd dword ptr es:[edi], eax // 8d77f0 | lea esi, [edi - 0x10] $sequence_4 = { 6683f866 7706 6683e857 eb14 6683f830 720c } // n = 6, score = 300 // 6683f866 | cmp ax, 0x66 // 7706 | ja 8 // 6683e857 | sub ax, 0x57 // eb14 | jmp 0x16 // 6683f830 | cmp ax, 0x30 // 720c | jb 0xe $sequence_5 = { 0f28c8 660f73f904 660fefc8 0f28c1 } // n = 4, score = 300 // 0f28c8 | movaps xmm1, xmm0 // 660f73f904 | pslldq xmm1, 4 // 660fefc8 | pxor xmm1, xmm0 // 0f28c1 | movaps xmm0, xmm1 $sequence_6 = { b801000000 8d7df0 33c9 53 0fa2 8bf3 5b } // n = 7, score = 300 // b801000000 | mov eax, 1 // 8d7df0 | lea edi, [ebp - 0x10] // 33c9 | xor ecx, ecx // 53 | push ebx // 0fa2 | cpuid // 8bf3 | mov esi, ebx // 5b | pop ebx $sequence_7 = { 5b 8907 897704 894f08 89570c f745f800000002 } // n = 6, score = 300 // 5b | pop ebx // 8907 | mov dword ptr [edi], eax // 897704 | mov dword ptr [edi + 4], esi // 894f08 | mov dword ptr [edi + 8], ecx // 89570c | mov dword ptr [edi + 0xc], edx // f745f800000002 | test dword ptr [ebp - 8], 0x2000000 $sequence_8 = { 33d0 8bc1 c1e810 0fb6c0 c1e208 } // n = 5, score = 300 // 33d0 | xor edx, eax // 8bc1 | mov eax, ecx // c1e810 | shr eax, 0x10 // 0fb6c0 | movzx eax, al // c1e208 | shl edx, 8 $sequence_9 = { f745f800000002 740c 5f 5e } // n = 4, score = 300 // f745f800000002 | test dword ptr [ebp - 8], 0x2000000 // 740c | je 0xe // 5f | pop edi // 5e | pop esi $sequence_10 = { 8bec 56 57 8b7508 8b7d0c 66ad } // n = 6, score = 300 // 8bec | mov ebp, esp // 56 | push esi // 57 | push edi // 8b7508 | mov esi, dword ptr [ebp + 8] // 8b7d0c | mov edi, dword ptr [ebp + 0xc] // 66ad | lodsw ax, word ptr [esi] $sequence_11 = { 8d45f8 50 8d45fc 50 ff75fc ff75f4 } // n = 6, score = 300 // 8d45f8 | lea eax, [ebp - 8] // 50 | push eax // 8d45fc | lea eax, [ebp - 4] // 50 | push eax // ff75fc | push dword ptr [ebp - 4] // ff75f4 | push dword ptr [ebp - 0xc] $sequence_12 = { 90 02f1 2af1 8bc8 d3ca } // n = 5, score = 300 // 90 | nop // 02f1 | add dh, cl // 2af1 | sub dh, cl // 8bc8 | mov ecx, eax // d3ca | ror edx, cl $sequence_13 = { 6683f846 7706 6683e837 eb26 6683f861 720c 6683f866 } // n = 7, score = 300 // 6683f846 | cmp ax, 0x46 // 7706 | ja 8 // 6683e837 | sub ax, 0x37 // eb26 | jmp 0x28 // 6683f861 | cmp ax, 0x61 // 720c | jb 0xe // 6683f866 | cmp ax, 0x66 $sequence_14 = { 85c9 7512 8bca 894dfc 8b7d0c f366a5 6633c0 } // n = 7, score = 300 // 85c9 | test ecx, ecx // 7512 | jne 0x14 // 8bca | mov ecx, edx // 894dfc | mov dword ptr [ebp - 4], ecx // 8b7d0c | mov edi, dword ptr [ebp + 0xc] // f366a5 | rep movsw word ptr es:[edi], word ptr [esi] // 6633c0 | xor ax, ax $sequence_15 = { 53 56 57 33c0 8d7df0 33c9 53 } // n = 7, score = 300 // 53 | push ebx // 56 | push esi // 57 | push edi // 33c0 | xor eax, eax // 8d7df0 | lea edi, [ebp - 0x10] // 33c9 | xor ecx, ecx // 53 | push ebx $sequence_16 = { 660fefc8 0f28c1 660f73f804 660fefc1 } // n = 4, score = 300 // 660fefc8 | pxor xmm1, xmm0 // 0f28c1 | movaps xmm0, xmm1 // 660f73f804 | pslldq xmm0, 4 // 660fefc1 | pxor xmm0, xmm1 $sequence_17 = { 8b6d10 8a540d00 02d3 8a5c1500 8a541d00 8a541500 fec2 } // n = 7, score = 300 // 8b6d10 | mov ebp, dword ptr [ebp + 0x10] // 8a540d00 | mov dl, byte ptr [ebp + ecx] // 02d3 | add dl, bl // 8a5c1500 | mov bl, byte ptr [ebp + edx] // 8a541d00 | mov dl, byte ptr [ebp + ebx] // 8a541500 | mov dl, byte ptr [ebp + edx] // fec2 | inc dl condition: 7 of them and filesize < 2049024 }