deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CorkowDLL
Repository: Yara-Rules/rules
Detects: Rule to detect the Corkow DLL files
Reference: IB-Group | http://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf

Pattern signatures:
$mz = { 4d 5a }
        $binary1 = {60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3}
        $binary2 = {(FF75??|53)FF7510FF750CFF7508E8????????[3-9]C9C20C 00}
        $export1 = "Control_RunDLL"
        $export2 = "ServiceMain"
        $export3 = "DllGetClassObject"

Detection condition:
($mz at 0) and ($binary1 and $binary2) and any of ($export*)

Full rule:
rule CorkowDLL
{

    meta:
        description = "Rule to detect the Corkow DLL files"
        reference = "IB-Group | http://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"

    strings:
        $mz = { 4d 5a }
        $binary1 = {60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3}
        $binary2 = {(FF75??|53)FF7510FF750CFF7508E8????????[3-9]C9C20C 00}
        $export1 = "Control_RunDLL"
        $export2 = "ServiceMain"
        $export3 = "DllGetClassObject"

    condition:
        ($mz at 0) and ($binary1 and $binary2) and any of ($export*)
}
YARA Detection Rule: Batel_export_function
Repository: Yara-Rules/rules
Detects: Batel backdoor
Author: @j0sm1
Reference: https://www.symantec.com/security_response/writeup.jsp?docid=2016[PII_REDACTED]-99

Detection condition:
pe.exports("run_shell") and pe.imports("kernel32.dll","GetTickCount") and pe.imports("kernel32.dll","IsDebuggerPresent") and pe.imports("msvcr100.dll","_crt_debugger_hook") and pe.imports("kernel32.dll","TerminateProcess") and pe.imports("kernel32.dll","UnhandledExceptionFilter")

Full rule:
rule Batel_export_function
{

    meta:
        author = "@j0sm1"
        date = "2016/10/15"
        description = "Batel backdoor"
        reference = "https://www.symantec.com/security_response/writeup.jsp?docid=2016[PII_REDACTED]-99"
        filetype = "binary"

    condition:
        pe.exports("run_shell") and pe.imports("kernel32.dll","GetTickCount") and pe.imports("kernel32.dll","IsDebuggerPresent") and pe.imports("msvcr100.dll","_crt_debugger_hook") and pe.imports("kernel32.dll","TerminateProcess") and pe.imports("kernel32.dll","UnhandledExceptionFilter")
}
YARA Detection Rule: NetWiredRC_B
Repository: Yara-Rules/rules
Detects: NetWiredRC
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$mutex = "LmddnIkX"

		$str1 = "%s.Identifier"
		$str2 = "%d:%I64u:%s%s;"
		$str3 = "%s%.2d-%.2d-%.4d"
		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d"
		
		$klg1 = "[Backspace]"
		$klg2 = "[Enter]"
		$klg3 = "[Tab]"
		$klg4 = "[Arrow Left]"
		$klg5 = "[Arrow Up]"
		$klg6 = "[Arrow Right]"
		$klg7 = "[Arrow Down]"
		$klg8 = "[Home]"
		$klg9 = "[Page Up]"
		$klg10 = "[Page Down]"
		$klg11 = "[End]"
		$klg12 = "[Break]"
		$klg13 = "[Delete]"
		$klg14 = "[Insert]"
		$klg15 = "[Print Screen]"
		$klg16 = "[Scroll Lock]"
		$klg17 = "[Caps Lock]"
		$klg18 = "[Alt]"
		$klg19 = "[Esc]"
		$klg20 = "[Ctrl+%c]"

Detection condition:
$mutex or (1 of ($str*) and 1 of ($klg*))

Full rule:
rule NetWiredRC_B : RAT
{
	meta:
		description = "NetWiredRC"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2014-12-23"
		filetype = "memory"
		version = "1.1" 

	strings:
		$mutex = "LmddnIkX"

		$str1 = "%s.Identifier"
		$str2 = "%d:%I64u:%s%s;"
		$str3 = "%s%.2d-%.2d-%.4d"
		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$str5 = "%.2d/%.2d/%d %.2d:%.2d:%.2d"
		
		$klg1 = "[Backspace]"
		$klg2 = "[Enter]"
		$klg3 = "[Tab]"
		$klg4 = "[Arrow Left]"
		$klg5 = "[Arrow Up]"
		$klg6 = "[Arrow Right]"
		$klg7 = "[Arrow Down]"
		$klg8 = "[Home]"
		$klg9 = "[Page Up]"
		$klg10 = "[Page Down]"
		$klg11 = "[End]"
		$klg12 = "[Break]"
		$klg13 = "[Delete]"
		$klg14 = "[Insert]"
		$klg15 = "[Print Screen]"
		$klg16 = "[Scroll Lock]"
		$klg17 = "[Caps Lock]"
		$klg18 = "[Alt]"
		$klg19 = "[Esc]"
		$klg20 = "[Ctrl+%c]"

	condition: 
		$mutex or (1 of ($str*) and 1 of ($klg*))
}
YARA Detection Rule: skeleton_key_patcher
Repository: Yara-Rules/rules
Detects: Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN
Author: Dell SecureWorks Counter Threat Unit
Reference: http://goo.gl/aAk3lN

Pattern signatures:
$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"

		$name = "HookDC.dll"

		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"

Detection condition:
all of them

Full rule:
rule skeleton_key_patcher
{
	meta:
		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
	strings:
		$target_process = "lsass.exe" wide
		$dll1 = "cryptdll.dll"
		$dll2 = "samsrv.dll"

		$name = "HookDC.dll"

		$patched1 = "CDLocateCSystem"
		$patched2 = "SamIRetrievePrimaryCredentials"
		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
	condition:
		all of them
}
YARA Detection Rule: skeleton_key_injected_code
Repository: Yara-Rules/rules
Detects: Skeleton Key injected Code http://goo.gl/aAk3lN
Author: Dell SecureWorks Counter Threat Unit
Reference: http://goo.gl/aAk3lN

Pattern signatures:
$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }

		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }

		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 4

Detection condition:
any of them

Full rule:
rule skeleton_key_injected_code
{
	meta:
		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
		author = "Dell SecureWorks Counter Threat Unit"
		reference = "http://goo.gl/aAk3lN"
		date = "2015/01/13"
		score = 70
	strings:
		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }

		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }

		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

		$patch_SamIRetrieveMultiplePrimaryCredential  = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }

	condition:
		any of them
}
YARA Detection Rule: PrikormkaDropper
Repository: Yara-Rules/rules

Pattern signatures:
$mz = { 4D 5A }
        $kd1 = "KDSTORAGE" wide
        $kd2 = "KDSTORAGE_64" wide
        $kd3 = "KDRUNDRV32" wide
        $kd4 = "KDRAR" wide
        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
        $inj1 = "?AVCinj2008Dlg@@" ascii
        $inj2 = "?AVCinj2008App@@" ascii

Detection condition:
($mz at 0) and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))

Full rule:
rule PrikormkaDropper
{
    
    strings:
        $mz = { 4D 5A }
        $kd1 = "KDSTORAGE" wide
        $kd2 = "KDSTORAGE_64" wide
        $kd3 = "KDRUNDRV32" wide
        $kd4 = "KDRAR" wide
        $bin1 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
        $bin2 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
        $bin3 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
        $inj1 = "?AVCinj2008Dlg@@" ascii
        $inj2 = "?AVCinj2008App@@" ascii

    condition:
        ($mz at 0) and ((any of ($bin*)) or (3 of ($kd*)) or (all of ($inj*)))
}
YARA Detection Rule: PrikormkaModule
Repository: Yara-Rules/rules

Pattern signatures:
$mz = { 4D 5A }

        // binary
        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}

        // encrypted
        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}

        // mutex
        $str13 = "ZxWinDeffContex" ascii wide
        $str14 = "Paramore756Contex43" wide
       

Detection condition:
($mz at 0) and (any of ($str*))

Full rule:
rule PrikormkaModule
{
    
    strings:
        $mz = { 4D 5A }

        // binary
        $str1 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str2 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
        $str3 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
        $str4 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
        $str5 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
        $str6 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
        $str7 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}

        // encrypted
        $str8 = {50 52 55 5C 17 51 58 17 5E 4A}
        $str9 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
        $str10 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
        $str11 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
        $str12 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}

        // mutex
        $str13 = "ZxWinDeffContex" ascii wide
        $str14 = "Paramore756Contex43" wide
        $str15 = "Zw_&one@ldrContext43" wide

        // other
        $str16 = "A95BL765MNG2GPRS"

        // dll names
        $str17 = "helpldr.dll" wide fullword
        $str18 = "swma.dll" wide fullword
        $str19 = "iomus.dll" wide fullword
        $str20 = "atiml.dll"  wide fullword
        $str21 = "hlpuctf.dll" wide fullword
        $str22 = "hauthuid.dll" ascii wide fullword

        // rbcon
        $str23 = "[roboconid][%s]" ascii fullword
        $str24 = "[objectset][%s]" ascii fullword
        $str25 = "rbcon.ini" wide fullword

        // files and logs
        $str26 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
        $str27 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword

        // pdb strings
        $str28 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
        $str29 = "\\PZZ\\RMO\\" ascii
        $str30 = ":\\work\\PZZ" ascii
        $str31 = "C:\\Users\\mlk\\" ascii
        $str32 = ":\\W o r k S p a c e\\"
YARA Detection Rule: PrikormkaEarlyVersion
Repository: Yara-Rules/rules

Pattern signatures:
$mz = { 4D 5A }
        $str36 = "IntelRestore" ascii fullword
        $str37 = "Resent" wide fullword
        $str38 = "ocp8.1" wide fullword
        $str39 = "rsfvxd.dat" ascii fullword
        $str40 = "tsb386.dat" ascii fullword
        $str41 = "frmmlg.dat" ascii fullword
        $str42 = "smdhost.dll" ascii fullword
        $str43 = "KDLLCFX" wide fullword
        $str44 = "KDLLRUNDRV" wide fullword

Detection condition:
($mz at 0) and (2 of ($str*))

Full rule:
rule PrikormkaEarlyVersion
{
    
    strings:
        $mz = { 4D 5A }
        $str36 = "IntelRestore" ascii fullword
        $str37 = "Resent" wide fullword
        $str38 = "ocp8.1" wide fullword
        $str39 = "rsfvxd.dat" ascii fullword
        $str40 = "tsb386.dat" ascii fullword
        $str41 = "frmmlg.dat" ascii fullword
        $str42 = "smdhost.dll" ascii fullword
        $str43 = "KDLLCFX" wide fullword
        $str44 = "KDLLRUNDRV" wide fullword
  
    condition:
        ($mz at 0) and (2 of ($str*))
}
YARA Detection Rule: Prikormka
Repository: Yara-Rules/rules
Detects: Operation Groundbait
Author: Anton Cherepanov

Detection condition:
PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion

Full rule:
rule Prikormka
{
    
    meta:
        Author      = "Anton Cherepanov"
        Date        = "2016/05/10"
        Description = "Operation Groundbait"
        Source = "https://github.com/eset/malware-ioc/"
        Contact = "threatintel@eset.com"
        License = "BSD 2-Clause"
    
    condition:
        PrikormkaDropper or PrikormkaModule or PrikormkaEarlyVersion
}
YARA Detection Rule: CAP_HookExKeylogger
Repository: Yara-Rules/rules
Author: Brian C. Bell -- @biebsmalwareguy
Reference: https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Pattern signatures:
$str_Win32hookapi = "SetWindowsHookEx" nocase
    $str_Win32llkey = "WH_KEYBOARD_LL" nocase
    $str_Win32key = "WH_KEYBOARD" nocase

Detection condition:
2 of them

Full rule:
rule CAP_HookExKeylogger
{

meta:
    author = "Brian C. Bell -- @biebsmalwareguy"
    reference = "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar"

    strings:
    $str_Win32hookapi = "SetWindowsHookEx" nocase
    $str_Win32llkey = "WH_KEYBOARD_LL" nocase
    $str_Win32key = "WH_KEYBOARD" nocase

    condition:
        2 of them
}
YARA Detection Rule: Emdivi_SFX
Repository: Yara-Rules/rules
Detects: Detects Emdivi malware in SFX Archive
Author: Florian Roth @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "Setup=unsecess.exe" fullword ascii
        $x2 = "Setup=leassnp.exe" fullword ascii
        $s1 = "&Enter password for the encrypted file:" fullword wide
        $s2 = ";The comment below contains SFX script commands" fullword ascii
        $s3 = "Path=%temp%" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))

Full rule:
rule Emdivi_SFX
 {

    meta:
        description = "Detects Emdivi malware in SFX Archive"
        author = "Florian Roth @Cyber0ps"
        reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
        date = "2015-08-20"
        score = 70
        hash1 = "7a3c81b2b3c14b9cd[PII_REDACTED]19887b607c54152b348d6d3ccd3ecfd406196"
        hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
    
    strings:
        $x1 = "Setup=unsecess.exe" fullword ascii
        $x2 = "Setup=leassnp.exe" fullword ascii
        $s1 = "&Enter password for the encrypted file:" fullword wide
        $s2 = ";The comment below contains SFX script commands" fullword ascii
        $s3 = "Path=%temp%" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
}
YARA Detection Rule: Emdivi_Gen1
Repository: Yara-Rules/rules
Detects: Detects Emdivi Malware
Author: Florian Roth @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
        $s0 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
        $x3 = "userControl-v80.exe" fullword ascii
        $s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
        $s2 = "http://www.msftncsi.com" fullword wide
        $s3 = "net use | find /i \"c$\"" fullword wide
        $s4 = " /del /y & " fullword wide
        $s5 = "\\auto.cfg" fullword wide
        $s6 = "/ncsi.txt" fullword wide
        $s7 = "Dcmd /c" fullword wide
        $s8 = "/PROXY" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of them

Full rule:
rule Emdivi_Gen1 
{

    meta:
        description = "Detects Emdivi Malware"
        author = "Florian Roth @Cyber0ps"
        reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
        date = "2015-08-20"
        score = 80
        super_rule = 1
        hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
        hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
        hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
        hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
    
    strings:
        $x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
        $s0 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
        $x3 = "userControl-v80.exe" fullword ascii
        $s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
        $s2 = "http://www.msftncsi.com" fullword wide
        $s3 = "net use | find /i \"c$\"" fullword wide
        $s4 = " /del /y & " fullword wide
        $s5 = "\\auto.cfg" fullword wide
        $s6 = "/ncsi.txt" fullword wide
        $s7 = "Dcmd /c" fullword wide
        $s8 = "/PROXY" fullword wide
    
    condition:
        uint16(0) == 0x5a4d and filesize < 800KB and all of them
}
YARA Detection Rule: Emdivi_Gen2
Repository: Yara-Rules/rules
Detects: Detects Emdivi Malware
Author: Florian Roth @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$s1 = "%TEMP%\\IELogs\\" fullword ascii
        $s2 = "MSPUB.EXE" fullword ascii
        $s3 = "%temp%\\" fullword ascii
        $s4 = "\\NOTEPAD.EXE" fullword ascii
        $s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
        $s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
        $s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them

Full rule:
rule Emdivi_Gen2 
{

    meta:
        description = "Detects Emdivi Malware"
        author = "Florian Roth @Cyber0ps"
        reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
        date = "2015-08-20"
        super_rule = 1
        score = 80
        hash1 = "9a351885bf5f6fec466f[PII_REDACTED]4d96e9db10309622ed[PII_REDACTED]7add1"
        hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
        hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
    
    strings:
        $s1 = "%TEMP%\\IELogs\\" fullword ascii
        $s2 = "MSPUB.EXE" fullword ascii
        $s3 = "%temp%\\" fullword ascii
        $s4 = "\\NOTEPAD.EXE" fullword ascii
        $s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
        $s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
        $s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
}
YARA Detection Rule: Emdivi_Gen3
Repository: Yara-Rules/rules
Detects: Detects Emdivi Malware
Author: Florian Roth @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
        $s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii
        $s4 = "\\auto.cfg" fullword ascii
        $s5 = "/ncsi.txt" fullword ascii
        $s6 = "/en-us/default.aspx" fullword ascii
        $s7 = "cmd /c" fullword ascii
        $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 850KB and (( $x1 and 1 of ($s*)) or ( 4 of ($s*)))

Full rule:
rule Emdivi_Gen3 
{

    meta:
        description = "Detects Emdivi Malware"
        author = "Florian Roth @Cyber0ps"
        reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
        date = "2015-08-20"
        super_rule = 1
        score = 80
        hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c[PII_REDACTED]e"
        hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
  
    strings:
        $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
        $s2 = "\\Mozilla\\Firefox\\Profiles\\" fullword ascii
        $s4 = "\\auto.cfg" fullword ascii
        $s5 = "/ncsi.txt" fullword ascii
        $s6 = "/en-us/default.aspx" fullword ascii
        $s7 = "cmd /c" fullword ascii
        $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
   
    condition:
        uint16(0) == 0x5a4d and filesize < 850KB and (( $x1 and 1 of ($s*)) or ( 4 of ($s*)))
}
YARA Detection Rule: Emdivi_Gen4
Repository: Yara-Rules/rules
Detects: Detects Emdivi Malware
Author: Florian Roth @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$s1 = ".http_port\", " fullword wide
        $s2 = "UserAgent: " fullword ascii
        $s3 = "AUTH FAILED" fullword ascii
        $s4 = "INVALID FILE PATH" fullword ascii
        $s5 = ".autoconfig_url\", \"" fullword wide
        $s6 = "FAILED TO WRITE FILE" fullword ascii
        $s7 = ".proxy" fullword wide
        $s8 = "AuthType: " fullword ascii
        $s9 = ".no_proxies_on\", \"" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 853KB and all of them

Full rule:
rule Emdivi_Gen4
 {

    meta:
        description = "Detects Emdivi Malware"
        author = "Florian Roth @Cyber0ps"
        reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
        date = "2015-08-20"
        super_rule = 1
        score = 80
        hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c[PII_REDACTED]e"
        hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
        hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
        hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
        hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
        hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
  
    strings:
        $s1 = ".http_port\", " fullword wide
        $s2 = "UserAgent: " fullword ascii
        $s3 = "AUTH FAILED" fullword ascii
        $s4 = "INVALID FILE PATH" fullword ascii
        $s5 = ".autoconfig_url\", \"" fullword wide
        $s6 = "FAILED TO WRITE FILE" fullword ascii
        $s7 = ".proxy" fullword wide
        $s8 = "AuthType: " fullword ascii
        $s9 = ".no_proxies_on\", \"" fullword wide
  
    condition:
        uint16(0) == 0x5a4d and filesize < 853KB and all of them
}