MALPEDIA_Win_Lemonduck_Auto

rule MALPEDIA_Win_Lemonduck_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "2d48fcac-5269-5f0d-8787-5b8524b15885"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.lemonduck_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "0023b707dc3a00b96c075fb32bb74e99f47bf8ecc22af5c76474a720aa3589cb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { eb0a c0ea06 f6c201 7408 8b00 8905???????? 498b06 }
		$sequence_1 = { e9???????? 488b8a70000000 4883c158 e9???????? 488b8a70000000 4883c168 e9???????? }
		$sequence_2 = { e8???????? 90 40f6c701 743d 488b542478 4883fa10 7232 }
		$sequence_3 = { ff15???????? 488bf8 4885c0 0f841f020000 33c0 f0480fb13d???????? 488bf0 }
		$sequence_4 = { e9???????? 66837e0e03 0f8547010000 488bcf 4883fb01 0f852f010000 488b07 }
		$sequence_5 = { ffe0 418b03 0fafc3 418903 eb4e 418b4154 03c3 }
		$sequence_6 = { 660f7f85c0000000 e8???????? 660f7f85d0000000 488bcf 4883f120 498bc6 48f7e7 }
		$sequence_7 = { e8???????? eb36 488d8ea8000000 488d55e8 e8???????? 90 488d0d24cd1400 }
		$sequence_8 = { e8???????? 488d6c2450 eb07 488d2d3d081300 488b03 488bcb ff5018 }
		$sequence_9 = { f30f7f07 488d4c2420 f30f6f8780000000 660f7f442420 660f7f4c2430 e8???????? f30f6f9700ffffff }

	condition:
		7 of them and filesize < 10011648
}