LockerGoga Yara

rule LockerGoga_Payload_v1 {

   meta:

      description = "LockerGoga HR from @88d149f3e47dc337695d76da52b25660e3a454768af0d7e59c913995af496a0f golden hash"
	    tlp = "white"

   strings:

    $h1 = { 55 8bec 57 8b???? 85?? 74?? 8b?? 56 6a??  }
	  $h2 = { 55 8bec 53 8b???? 56 57 83???? 0f 84 86?? }
	  $h3 = { 55 8bec 56 8b?? 8b?? ff?????????? 8b??    }
	  $h4 = { 55 8bec 51 53 8b?? 57 89???? 8b???? ff 70 }
	  $h5 = { 55 8bec 80?????? 53 8b?? 74?? 56 57 8b bb }

   condition:
      (uint16(0) == 0x5a4d and filesize > 1000KB and 5 of ($h*))
}