rule Lich_ransomware_1 {
    meta:
        description = "Detects Lich ransomware"
        author = "RansomwareMonitor"
        date = "2026-03-06"
        hash = "5ddf4779693ed2e67d6caff1ee879e29faf39de29b95ec4e91ff357005d7fa2c"

    strings:
        $s0 = "Do not rename" nocase
        $s1 = "Do not modify" nocase
        $s2 = "YOUR FILES" nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        3 of them
}