rule win_lazardoor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.lazardoor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazardoor"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 57 4154 4883ec60 488b05???????? 4833c4 4889442430 }
            // n = 6, score = 200
            //   57                   | dec                 ecx
            //   4154                 | mov                 dword ptr [ecx + 8], edx
            //   4883ec60             | shr                 eax, cl
            //   488b05????????       |                     
            //   4833c4               | dec                 edx
            //   4889442430           | movsx               eax, byte ptr [ecx + edx + 0x1a588]

        $sequence_1 = { 488b8b20010000 e8???????? 488db328010000 bd06000000 488d7b38 488d05b6370100 483947f0 }
            // n = 7, score = 200
            //   488b8b20010000       | jb                  0xf3e
            //   e8????????           |                     
            //   488db328010000       | paddd               xmm4, xmm5
            //   bd06000000           | movdqa              xmm0, xmm4
            //   488d7b38             | psrldq              xmm0, 8
            //   488d05b6370100       | paddd               xmm4, xmm0
            //   483947f0             | movdqa              xmm0, xmm4

        $sequence_2 = { 85c0 7474 4533f6 0f1f00 }
            // n = 4, score = 200
            //   85c0                 | lea                 ecx, [eax + eax]
            //   7474                 | dec                 esp
            //   4533f6               | mov                 eax, ebp
            //   0f1f00               | dec                 eax

        $sequence_3 = { e9???????? 488d05e51d0200 c3 4883ec28 e8???????? 48830824 e8???????? }
            // n = 7, score = 200
            //   e9????????           |                     
            //   488d05e51d0200       | inc                 ebp
            //   c3                   | mov                 eax, esi
            //   4883ec28             | je                  0x7cc
            //   e8????????           |                     
            //   48830824             | nop                 dword ptr [eax]
            //   e8????????           |                     

        $sequence_4 = { 41b800100000 488bd0 4c8bf8 ff15???????? 4885c0 0f8425010000 8b0b }
            // n = 7, score = 200
            //   41b800100000         | mov                 esi, dword ptr [esi + esi*8 + 0x1c4a0]
            //   488bd0               | xor                 edx, edx
            //   4c8bf8               | dec                 ecx
            //   ff15????????         |                     
            //   4885c0               | mov                 ecx, esi
            //   0f8425010000         | inc                 ecx
            //   8b0b                 | mov                 eax, 0x800

        $sequence_5 = { 750d 488d0db2aa0100 e8???????? 90 488b03 833800 7513 }
            // n = 7, score = 200
            //   750d                 | mov                 ecx, eax
            //   488d0db2aa0100       | dec                 ecx
            //   e8????????           |                     
            //   90                   | xchg                dword ptr [edi + edi*8 + 0x27440], ecx
            //   488b03               | dec                 ecx
            //   833800               | mov                 edx, edi
            //   7513                 | dec                 eax

        $sequence_6 = { eb02 33db 4c8d356100ffff 4885db 750d 488bc7 }
            // n = 6, score = 200
            //   eb02                 | ret                 
            //   33db                 | dec                 eax
            //   4c8d356100ffff       | mov                 dword ptr [esp + 0x70], ebx
            //   4885db               | dec                 eax
            //   750d                 | mov                 dword ptr [esp + 0x78], esi
            //   488bc7               | dec                 eax

        $sequence_7 = { 48894230 33c0 488b0e 448bf0 }
            // n = 4, score = 200
            //   48894230             | xor                 eax, eax
            //   33c0                 | inc                 ebp
            //   488b0e               | test                ecx, ecx
            //   448bf0               | je                  0x59d

        $sequence_8 = { ff15???????? 488bf0 4883f8ff 0f8474010000 448d4b02 4533c0 }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   488bf0               | movsx               eax, byte ptr [ecx + edx + 0x1a588]
            //   4883f8ff             | inc                 edx
            //   0f8474010000         | mov                 cl, byte ptr [ecx + edx + 0x1a598]
            //   448d4b02             | shr                 eax, cl
            //   4533c0               | inc                 ecx

        $sequence_9 = { 0f1f4000 660f1f840000000000 458b5304 498d5308 448bc8 458bc7 4c03cf }
            // n = 7, score = 200
            //   0f1f4000             | mov                 dword ptr [eax], 0x16
            //   660f1f840000000000     | dec    esp
            //   458b5304             | cmp                 dword ptr [esp + 0x50], edi
            //   498d5308             | jl                  0x48e
            //   448bc8               | jmp                 0x720
            //   458bc7               | jmp                 0x716
            //   4c03cf               | dec                 esp

    condition:
        7 of them and filesize < 405504
}