SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24

rule SIGNATURE_BASE_Mal_Lockbit4_Hashing_Alg_Win_Feb24 : FILE
{
	meta:
		description = "This rule detects the custom hashing algorithm of Lockbit4.0 unpacked"
		author = "0x0d4y"
		id = "e91aedba-6f70-4ca2-9217-2991cbbc6e8d"
		date = "2024-02-16"
		modified = "2026-05-15"
		reference = "https://0x0d4y.blog/lockbit4-0-evasion-tales/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_lockbit4_hashing_alg_win_feb24.yar#L1-L22"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "062311f136d83f64497fd81297360cd4"
		logic_hash = "41497ea30a4cfdd111726a5819ec404a1eeba1693f5d6b89ac38558eb1c6bde9"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.lockbit"

	strings:
		$hashing_alg = { 41 89 d0 46 0f be 04 00 45 09 c0 74 ?? 45 8d 48 ?? 45 8d 50 ?? 41 80 f9 ?? 45 0f 43 d0 44 31 d1 44 8d 04 3a 45 0f af c2 41 01 c8 89 d1 31 f9 09 d2 0f 44 ca 41 0f af c8 44 01 d1 ff c2 eb ?? 49 ff c6 }

	condition:
		uint16( 0 ) == 0x5a4d and $hashing_alg
}