rule win_lalia_ransomware_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.lalia_ransomware."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lalia_ransomware"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b112 4989c6 e9???????? 4c8b4558 4983f82e 440fb64d77 488b4568 }
            // n = 7, score = 100
            //   b112                 | mov                 cl, 1
            //   4989c6               | dec                 eax
            //   e9????????           |                     
            //   4c8b4558             | mov                 dword ptr [ebp + 0x120], ecx
            //   4983f82e             | dec                 eax
            //   440fb64d77           | mov                 dword ptr [ebp + 0xa0], eax
            //   488b4568             | dec                 eax

        $sequence_1 = { 4d21da 4909ca 49c1ea3f 4c89d1 4989f0 4939f7 }
            // n = 6, score = 100
            //   4d21da               | add                 esp, dword ptr [ecx + ebp*8 + 8]
            //   4909ca               | dec                 ebp
            //   49c1ea3f             | mov                 dword ptr [ebp + ebp*8], esp
            //   4c89d1               | dec                 eax
            //   4989f0               | lea                 ebp, [ebp + 2]
            //   4939f7               | dec                 ecx

        $sequence_2 = { 7406 31c0 5b 5f 5e c3 488b01 }
            // n = 7, score = 100
            //   7406                 | xor                 ecx, ecx
            //   31c0                 | dec                 eax
            //   5b                   | lea                 eax, [0x1e76a]
            //   5f                   | dec                 eax
            //   5e                   | mov                 dword ptr [ebp - 0x50], eax
            //   c3                   | dec                 eax
            //   488b01               | mov                 dword ptr [ebp - 0x48], 1

        $sequence_3 = { 4c896550 488d4df8 4889f2 41b800002000 e8???????? 837df802 7553 }
            // n = 7, score = 100
            //   4c896550             | dec                 esp
            //   488d4df8             | lea                 eax, [0x1b56a]
            //   4889f2               | dec                 esp
            //   41b800002000         | mov                 dword ptr [ebp - 0x48], eax
            //   e8????????           |                     
            //   837df802             | dec                 esp
            //   7553                 | mov                 dword ptr [ebp - 0x50], ecx

        $sequence_4 = { 4d09d1 f30f6f842438010000 4589c2 41c1ea08 eb13 c68424f40000000c 4531c0 }
            // n = 7, score = 100
            //   4d09d1               | lea                 eax, [ecx + ebp]
            //   f30f6f842438010000     | dec    eax
            //   4589c2               | add                 eax, -0x50
            //   41c1ea08             | dec                 esp
            //   eb13                 | lea                 ecx, [ecx - 1]
            //   c68424f40000000c     | cmp                 eax, 0xf
            //   4531c0               | inc                 esp

        $sequence_5 = { eb7d 4d89c3 49c1eb20 ba0c000000 31c0 eb77 c684248c00000001 }
            // n = 7, score = 100
            //   eb7d                 | mov                 dword ptr [ebp + 0x148], eax
            //   4d89c3               | dec                 esp
            //   49c1eb20             | lea                 eax, [0x22bc0]
            //   ba0c000000           | dec                 eax
            //   31c0                 | mov                 ecx, dword ptr [ebp + 0x148]
            //   eb77                 | dec                 esp
            //   c684248c00000001     | mov                 edx, esp

        $sequence_6 = { 4c896630 48c7464800000000 e9???????? e8???????? 89c7 48c1e720 4883cf02 }
            // n = 7, score = 100
            //   4c896630             | je                  0x363
            //   48c7464800000000     | dec                 eax
            //   e9????????           |                     
            //   e8????????           |                     
            //   89c7                 | mov                 edi, dword ptr [ecx + 0x28]
            //   48c1e720             | dec                 eax
            //   4883cf02             | mov                 edx, dword ptr [ecx + 0x38]

        $sequence_7 = { 750f 4c89e1 488d15219f0800 e8???????? 488bac2418010000 6642c7446d002200 49ffc5 }
            // n = 7, score = 100
            //   750f                 | shl                 eax, 1
            //   4c89e1               | dec                 eax
            //   488d15219f0800       | test                eax, eax
            //   e8????????           |                     
            //   488bac2418010000     | jne                 0x1c
            //   6642c7446d002200     | xor                 eax, eax
            //   49ffc5               | xchg                byte ptr [ecx], al

        $sequence_8 = { 4c8b842450020000 4c89442448 4c8b842458020000 4c89442450 410f10413f f3410f6f494f 0f29842490000000 }
            // n = 7, score = 100
            //   4c8b842450020000     | add                 edx, -0x20
            //   4c89442448           | dec                 ecx
            //   4c8b842458020000     | mov                 ebx, ebx
            //   4c89442450           | dec                 ecx
            //   410f10413f           | shl                 ebx, 5
            //   f3410f6f494f         | dec                 esp
            //   0f29842490000000     | cmp                 edx, dword ptr [eax]

        $sequence_9 = { 83e103 83f901 746f 4885db 0f84e2000000 488b85e00f0000 89c1 }
            // n = 7, score = 100
            //   83e103               | cmp                 eax, ecx
            //   83f901               | jb                  0x177c
            //   746f                 | cmp                 dword ptr [edx], 1
            //   4885db               | jne                 0x17d7
            //   0f84e2000000         | dec                 esp
            //   488b85e00f0000       | mov                 eax, dword ptr [edx + 8]
            //   89c1                 | dec                 esp

    condition:
        7 of them and filesize < 1455104
}