rule LockBit3
{
	meta:
		author = "rivitna"
		family = "ransomware.lockbit3.windows"
		description = "BlackMatter/LockBit3 ransomware Windows payload"
		severity = 10
		score = 100

	strings:
		$h0 = { 64 A1 30 00 00 00 8B B0 A4 00 00 00 8B B8 A8 00 00 00
                83 FE 05 75 05 83 FF 01 }
		$h1 = { 02 F1 2A F1 [2-16] D3 CA 03 D0 }
		$h2 = { 3C 2B 75 04 B0 78 EB 0E 3C 2F 75 04 B0 69 EB 06 3C 3D
                75 02 B0 7A }
		$h3 = { 33 C0 40 40 8D 0C C5 01 00 00 00 83 7D 0? 00 75 04 F7 D8
                EB 0? }
		$h4 = { C1 C0 09 33 ?8 8D 04 ?? C1 C0 0D 33 ?8 8D 04 ?? C1 C8 0E
                33 ?8 83 6C 24 ?? 01 }
		$h5 = { 3D B2 EB AA D4 74 07 3D C0 18 20 01 75 }
		$h6 = { B9 0D 66 19 00 [0-16] F7 E1 [0-16] 05 5F F3 6E 3C [0-16]
                25 FF FF FF 07 }
		$h7 = { 3D 75 BA 0E 64 75 ?? 83 C7 02 66 83 3F 20 74 F7 }
		$h8 = { 3D 75 80 91 76 74 0E 3D 1B A4 04 00 74 07 3D 9B B4 84 0B 75 }

	condition:
		(( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) ) and ( ( 3 of ( $h* ) ) )
}