rule win_lumar_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.lumar."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumar"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d0441 8945f4 e9???????? 8b45b0 83e002 744c 837d0c03 }
            // n = 7, score = 100
            //   8d0441               | lea                 eax, [ecx + eax*2]
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   e9????????           |                     
            //   8b45b0               | mov                 eax, dword ptr [ebp - 0x50]
            //   83e002               | and                 eax, 2
            //   744c                 | je                  0x4e
            //   837d0c03             | cmp                 dword ptr [ebp + 0xc], 3

        $sequence_1 = { 5f 5e 5b 5d c3 2bca 0fb702 }
            // n = 7, score = 100
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   2bca                 | sub                 ecx, edx
            //   0fb702               | movzx               eax, word ptr [edx]

        $sequence_2 = { 663b5dfc 0f8e08010000 83ea01 895518 0f84fc000000 8b4df4 0fbfc3 }
            // n = 7, score = 100
            //   663b5dfc             | cmp                 bx, word ptr [ebp - 4]
            //   0f8e08010000         | jle                 0x10e
            //   83ea01               | sub                 edx, 1
            //   895518               | mov                 dword ptr [ebp + 0x18], edx
            //   0f84fc000000         | je                  0x102
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   0fbfc3               | movsx               eax, bx

        $sequence_3 = { f7d8 1bc0 83c004 ebeb f60210 6a00 }
            // n = 6, score = 100
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83c004               | add                 eax, 4
            //   ebeb                 | jmp                 0xffffffed
            //   f60210               | test                byte ptr [edx], 0x10
            //   6a00                 | push                0

        $sequence_4 = { ffb7e4910000 8d55fc 51 53 6a02 56 8d8fac970000 }
            // n = 7, score = 100
            //   ffb7e4910000         | push                dword ptr [edi + 0x91e4]
            //   8d55fc               | lea                 edx, [ebp - 4]
            //   51                   | push                ecx
            //   53                   | push                ebx
            //   6a02                 | push                2
            //   56                   | push                esi
            //   8d8fac970000         | lea                 ecx, [edi + 0x97ac]

        $sequence_5 = { 833c9600 74f9 ff0c96 8344960402 83ef01 79c4 5f }
            // n = 7, score = 100
            //   833c9600             | cmp                 dword ptr [esi + edx*4], 0
            //   74f9                 | je                  0xfffffffb
            //   ff0c96               | dec                 dword ptr [esi + edx*4]
            //   8344960402           | add                 dword ptr [esi + edx*4 + 4], 2
            //   83ef01               | sub                 edi, 1
            //   79c4                 | jns                 0xffffffc6
            //   5f                   | pop                 edi

        $sequence_6 = { 8b45ec 663b45fc 0f8e85010000 8b7508 8bce e8???????? }
            // n = 6, score = 100
            //   8b45ec               | mov                 eax, dword ptr [ebp - 0x14]
            //   663b45fc             | cmp                 ax, word ptr [ebp - 4]
            //   0f8e85010000         | jle                 0x18b
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     

        $sequence_7 = { 81feba499307 7432 81fe0f766ed2 742a }
            // n = 4, score = 100
            //   81feba499307         | cmp                 esi, 0x79349ba
            //   7432                 | je                  0x34
            //   81fe0f766ed2         | cmp                 esi, 0xd26e760f
            //   742a                 | je                  0x2c

        $sequence_8 = { 3bd0 7209 8bd0 4a }
            // n = 4, score = 100
            //   3bd0                 | cmp                 edx, eax
            //   7209                 | jb                  0xb
            //   8bd0                 | mov                 edx, eax
            //   4a                   | dec                 edx

        $sequence_9 = { 6a1b 59 66890d???????? 8d4877 eb52 }
            // n = 5, score = 100
            //   6a1b                 | push                0x1b
            //   59                   | pop                 ecx
            //   66890d????????       |                     
            //   8d4877               | lea                 ecx, [eax + 0x77]
            //   eb52                 | jmp                 0x54

    condition:
        7 of them and filesize < 81920
}