rule win_lockbit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.lockbit."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a06 8d8c24d5000000 e8???????? 8d8c24d1000000 c60000 e8???????? 6a47 }
            // n = 7, score = 100
            //   6a06                 | push                6
            //   8d8c24d5000000       | lea                 ecx, dword ptr [esp + 0xd5]
            //   e8????????           |                     
            //   8d8c24d1000000       | lea                 ecx, dword ptr [esp + 0xd1]
            //   c60000               | mov                 byte ptr [eax], 0
            //   e8????????           |                     
            //   6a47                 | push                0x47

        $sequence_1 = { 8a442413 32e9 32c1 889424bf060000 888424c4060000 b643 32f1 }
            // n = 7, score = 100
            //   8a442413             | mov                 al, byte ptr [esp + 0x13]
            //   32e9                 | xor                 ch, cl
            //   32c1                 | xor                 al, cl
            //   889424bf060000       | mov                 byte ptr [esp + 0x6bf], dl
            //   888424c4060000       | mov                 byte ptr [esp + 0x6c4], al
            //   b643                 | mov                 dh, 0x43
            //   32f1                 | xor                 dh, cl

        $sequence_2 = { 72f2 8d44247f c68424a200000000 50 e8???????? 83c404 }
            // n = 6, score = 100
            //   72f2                 | jb                  0xfffffff4
            //   8d44247f             | lea                 eax, dword ptr [esp + 0x7f]
            //   c68424a200000000     | mov                 byte ptr [esp + 0xa2], 0
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_3 = { 03d9 895de0 8bce c1c10f 8b9c059cfeffff 8bd3 c1c20e }
            // n = 7, score = 100
            //   03d9                 | add                 ebx, ecx
            //   895de0               | mov                 dword ptr [ebp - 0x20], ebx
            //   8bce                 | mov                 ecx, esi
            //   c1c10f               | rol                 ecx, 0xf
            //   8b9c059cfeffff       | mov                 ebx, dword ptr [ebp + eax - 0x164]
            //   8bd3                 | mov                 edx, ebx
            //   c1c20e               | rol                 edx, 0xe

        $sequence_4 = { 03f1 8b4dec 0375dc 8bd1 0175f4 8bc1 c1c00a }
            // n = 7, score = 100
            //   03f1                 | add                 esi, ecx
            //   8b4dec               | mov                 ecx, dword ptr [ebp - 0x14]
            //   0375dc               | add                 esi, dword ptr [ebp - 0x24]
            //   8bd1                 | mov                 edx, ecx
            //   0175f4               | add                 dword ptr [ebp - 0xc], esi
            //   8bc1                 | mov                 eax, ecx
            //   c1c00a               | rol                 eax, 0xa

        $sequence_5 = { 85c0 7448 8d462c 6a00 50 e8???????? 83c408 }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   7448                 | je                  0x4a
            //   8d462c               | lea                 eax, dword ptr [esi + 0x2c]
            //   6a00                 | push                0
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_6 = { e8???????? 57 8d4c2476 8a00 89442410 e8???????? ff74240c }
            // n = 7, score = 100
            //   e8????????           |                     
            //   57                   | push                edi
            //   8d4c2476             | lea                 ecx, dword ptr [esp + 0x76]
            //   8a00                 | mov                 al, byte ptr [eax]
            //   89442410             | mov                 dword ptr [esp + 0x10], eax
            //   e8????????           |                     
            //   ff74240c             | push                dword ptr [esp + 0xc]

        $sequence_7 = { 88842492050000 e8???????? 6a73 8d8c2470050000 88842493050000 e8???????? 6a70 }
            // n = 7, score = 100
            //   88842492050000       | mov                 byte ptr [esp + 0x592], al
            //   e8????????           |                     
            //   6a73                 | push                0x73
            //   8d8c2470050000       | lea                 ecx, dword ptr [esp + 0x570]
            //   88842493050000       | mov                 byte ptr [esp + 0x593], al
            //   e8????????           |                     
            //   6a70                 | push                0x70

        $sequence_8 = { 8b0cb0 e8???????? 46 3b75f8 7cbd 8b35???????? 6a0a }
            // n = 7, score = 100
            //   8b0cb0               | mov                 ecx, dword ptr [eax + esi*4]
            //   e8????????           |                     
            //   46                   | inc                 esi
            //   3b75f8               | cmp                 esi, dword ptr [ebp - 8]
            //   7cbd                 | jl                  0xffffffbf
            //   8b35????????         |                     
            //   6a0a                 | push                0xa

        $sequence_9 = { 6a63 8d8c243e020000 88842447020000 e8???????? 6a65 8d8c243e020000 88842448020000 }
            // n = 7, score = 100
            //   6a63                 | push                0x63
            //   8d8c243e020000       | lea                 ecx, dword ptr [esp + 0x23e]
            //   88842447020000       | mov                 byte ptr [esp + 0x247], al
            //   e8????????           |                     
            //   6a65                 | push                0x65
            //   8d8c243e020000       | lea                 ecx, dword ptr [esp + 0x23e]
            //   88842448020000       | mov                 byte ptr [esp + 0x248], al

    condition:
        7 of them and filesize < 337568
}