deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_GreyEnergy_Malware_Oct18_4
Repository: Neo23x0/signature-base
Detects: Detects samples from Grey Energy report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/

Pattern signatures:
$x1 = "iiodttd.eWt" fullword ascii
      $x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
      $x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "279adfbd42308a07b3131ee57d067b3e" or
         1 of them
      )

Full rule:
rule APT_GreyEnergy_Malware_Oct18_4 {
   meta:
      description = "Detects samples from Grey Energy report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
      date = "2018-10-17"
      hash1 = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
      hash2 = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc[PII_REDACTED]40"
      hash3 = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
      hash4 = "c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79"
      id = "1a2df257-a639-5868-a005-690d64cfbf2b"
   strings:
      $x1 = "iiodttd.eWt" fullword ascii
      $x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
      $x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
         pe.imphash() == "279adfbd42308a07b3131ee57d067b3e" or
         1 of them
      )
}
YARA Detection Rule: APT_GreyEnergy_Malware_Oct18_5
Repository: Neo23x0/signature-base
Detects: Detects samples from Grey Energy report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/

Pattern signatures:
$s12 = "WespySSld.eQ" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 1 of them

Full rule:
rule APT_GreyEnergy_Malware_Oct18_5 {
   meta:
      description = "Detects samples from Grey Energy report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
      date = "2018-10-17"
      hash1 = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
      hash2 = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
      id = "a8c4517d-912d-5264-b9ab-acdf37fc4d56"
   strings:
      $s12 = "WespySSld.eQ" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 1 of them
}
YARA Detection Rule: Malware_Floxif_mpsvc_dll
Repository: Neo23x0/signature-base
Detects: Malware - Floxif
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
      $op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
      $op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule Malware_Floxif_mpsvc_dll : HIGHVOL {
   meta:
      description = "Malware - Floxif"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-04-07"
      hash1 = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
      id = "37af366a-24b2-5402-b0b5-6e2c80f8c903"
   strings:
      $op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
      $op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
      $op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_1
Repository: Neo23x0/signature-base
Detects: Detects Red Delta samples
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556

Pattern signatures:
$x1 = "InjectShellCode" ascii fullword

      $s1 = "DotNetLoader.exe" wide ascii fullword
      $s2 = "clipboardinject" ascii fullword
      $s3 = "download.php?raw=1" wide
      $s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
      $s5 = "FlashUpdate.exe" wide
      $s6 = "raw_cc_url" ascii fullword

      $op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
      $op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 200KB and
      $x1 or 3 of them

Full rule:
rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_1 {
   meta:
      description = "Detects Red Delta samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556"
      date = "2020-10-14"
      hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
      hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
      hash3 = "480a8c[PII_REDACTED]61c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
      hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
      id = "47417488-e843-5346-9baa-fcce30b884d1"
   strings:
      $x1 = "InjectShellCode" ascii fullword

      $s1 = "DotNetLoader.exe" wide ascii fullword
      $s2 = "clipboardinject" ascii fullword
      $s3 = "download.php?raw=1" wide
      $s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
      $s5 = "FlashUpdate.exe" wide
      $s6 = "raw_cc_url" ascii fullword

      $op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
      $op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 200KB and
      $x1 or 3 of them
}
YARA Detection Rule: APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2
Repository: Neo23x0/signature-base
Detects: Detects Red Delta samples
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556

Pattern signatures:
$x1 = "\\CLRLoader.exe" wide fullword
      $x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword

      $s1 = "DotNetLoader.Program" wide fullword
      $s2 = "/download.php?api=40" ascii fullword
      $s3 = "get %d URLDir" ascii fullword
      $s4 = "Read code failed" ascii fullword
      $s5 = "OpenFile fail!" wide fullword
      $s6 = "Writefile success" wide fullword

      $op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and
      1 of ($x*) or 4 of them

Full rule:
rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_2 {
   meta:
      description = "Detects Red Delta samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556"
      date = "2020-10-14"
      hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
      hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
      hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
      id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"
   strings:
      $x1 = "\\CLRLoader.exe" wide fullword
      $x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword

      $s1 = "DotNetLoader.Program" wide fullword
      $s2 = "/download.php?api=40" ascii fullword
      $s3 = "get %d URLDir" ascii fullword
      $s4 = "Read code failed" ascii fullword
      $s5 = "OpenFile fail!" wide fullword
      $s6 = "Writefile success" wide fullword

      $op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and
      1 of ($x*) or 4 of them
}
YARA Detection Rule: APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_3
Repository: Neo23x0/signature-base
Detects: Detects Red Delta samples
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556

Pattern signatures:
$s1 = "Taskschd.dll" ascii fullword
      $s2 = "AddTaskPlanDllVerson.dll" ascii fullword
      $s3 = "\\FlashUpdate.exe" ascii
      $s4 = "D:\\Project\\FBIRedTeam" ascii fullword
      $s5 = "Error %s:%d, ErrorCode: %x" ascii fullword

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 400KB and
      4 of them

Full rule:
rule APT_CN_MAL_RedDelta_Shellcode_Loader_Oct20_3 {
   meta:
      description = "Detects Red Delta samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]08119556"
      date = "2020-10-14"
      modified = "2022-12-21"
      hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
      id = "b52836bb-cdef-5416-a8e1-72d0b2298546"
   strings:
      $s1 = "Taskschd.dll" ascii fullword
      $s2 = "AddTaskPlanDllVerson.dll" ascii fullword
      $s3 = "\\FlashUpdate.exe" ascii
      $s4 = "D:\\Project\\FBIRedTeam" ascii fullword
      $s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and
      4 of them
}
YARA Detection Rule: SUSP_EXPL_Msg_CVE_2023_23397_Mar23
Repository: Neo23x0/signature-base
Detects: MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397
Author: delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl
Reference: https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/

Pattern signatures:
/* https://interoperability.blob.core.windows.net/files/MS-OXPROPS/%5bMS-OXPROPS%5d.pdf */
      /* PSETID_Appointment */
      $psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
      /* PSETID_Meeting */
      $psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
      /* PSETID Task */
      $psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }

      /* PidLidReminderFileParameter */
      $rfp = { 1F 85 00 00 }
      /* \\ UNC path prefix - wide formatted */
      $u1 = { 00 00 5C 00 5C 00 }
      /* not MSI */
      $fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
      /* not ASD */
      $fp_asd = "theme/theme1.xml"

Detection condition:
uint32be(0) == 0xD0CF11E0
      and uint32be(4) == 0xA1B11AE1
      and 1 of ($psetid*)
      and $rfp
      and $u1
      and not 1 of ($fp*)

Full rule:
rule SUSP_EXPL_Msg_CVE_2023_23397_Mar23 {
   meta:
      description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
      author = "delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
      date = "2023-03-15"
      modified = "2024-12-03"
      score = 60
      reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
      hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
      hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
      hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
      hash = "7fb7a2394e03cc4a[PII_REDACTED]a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
      hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
      id = "0a4d7bbe-1e17-5240-ad0f-29511752b267"
   strings:
      /* https://interoperability.blob.core.windows.net/files/MS-OXPROPS/%5bMS-OXPROPS%5d.pdf */
      /* PSETID_Appointment */
      $psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
      /* PSETID_Meeting */
      $psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
      /* PSETID Task */
      $psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }

      /* PidLidReminderFileParameter */
      $rfp = { 1F 85 00 00 }
      /* \\ UNC path prefix - wide formatted */
      $u1 = { 00 00 5C 00 5C 00 }
      /* not MSI */
      $fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
      /* not ASD */
      $fp_asd = "theme/theme1.xml"
   condition:
      uint32be(0) == 0xD0CF11E0
      and uint32be(4) == 0xA1B11AE1
      and 1 of ($psetid*)
      and $rfp
      and $u1
      and not 1 of ($fp*)
}
YARA Detection Rule: EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23
Repository: Neo23x0/signature-base
Detects: Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix.
Author: Nils Kuhnert
Reference: https://twitter.com/wdormann/status/[PII_REDACTED]86622723

Pattern signatures:
// From:
      $mail1 = { 0A 46 72 6F 6D 3A 20 }
      // To: 
      $mail2 = { 0A 54 6F 3A }
      // Received:
      $mail3 = { 0A 52 65 63 65 69 76 65 64 3A }

      // Indicates that attachment is TNEF
      $tnef1 = "Content-Type: application/ms-tnef" ascii
      $tnef2 = "\x78\x9f\x3e\x22" base64

      // Check if it's an IPM.Task or IPM.Appointment
      $ipm1 = "IPM.Task" base64
      $ipm2 = "IPM.Appointment" base64

      // UNC prefix in TNEF
      $unc = "\x00\x00\x00\x5c\x5c" base64

Detection condition:
all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc

Full rule:
rule EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 {
   meta:
      author = "Nils Kuhnert"
      date = "2023-03-17"
      modified = "2023-03-24"
      description = "Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix."
      score = 60
      reference = "https://twitter.com/wdormann/status/[PII_REDACTED]86622723"
      id = "922fae73-520d-5659-8331-f242c7c55810"
   strings:
      // From:
      $mail1 = { 0A 46 72 6F 6D 3A 20 }
      // To: 
      $mail2 = { 0A 54 6F 3A }
      // Received:
      $mail3 = { 0A 52 65 63 65 69 76 65 64 3A }

      // Indicates that attachment is TNEF
      $tnef1 = "Content-Type: application/ms-tnef" ascii
      $tnef2 = "\x78\x9f\x3e\x22" base64

      // Check if it's an IPM.Task or IPM.Appointment
      $ipm1 = "IPM.Task" base64
      $ipm2 = "IPM.Appointment" base64

      // UNC prefix in TNEF
      $unc = "\x00\x00\x00\x5c\x5c" base64
   condition:
      all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc
}
YARA Detection Rule: SUSP_LNX_SH_CryptoMiner_Indicators_Dec20_1
Repository: Neo23x0/signature-base
Detects: Detects helper script used in a crypto miner campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/

Pattern signatures:
$x1 = "miner running" fullword ascii
      $x2 = "miner runing" fullword ascii
      $x3 = " --donate-level 1 "
      $x4 = " -o pool.minexmr.com:5555 " ascii

Detection condition:
filesize < 20KB and 1 of them

Full rule:
rule SUSP_LNX_SH_CryptoMiner_Indicators_Dec20_1 {
   meta:
      description = "Detects helper script used in a crypto miner campaign"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
      date = "2020-12-31"
      hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
      id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"
   strings:
      $x1 = "miner running" fullword ascii
      $x2 = "miner runing" fullword ascii
      $x3 = " --donate-level 1 "
      $x4 = " -o pool.minexmr.com:5555 " ascii
   condition:
      filesize < 20KB and 1 of them
}
YARA Detection Rule: PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20
Repository: Neo23x0/signature-base
Detects: Detects XMRIG crypto coin miners
Author: Florian Roth (Nextron Systems)
Reference: https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/

Pattern signatures:
$x1 = "xmrig.exe" fullword wide
      $x2 = "xmrig.com" fullword wide
      $x3 = "* for x86, CRYPTOGAMS" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and 2 of them or all of them

Full rule:
rule PUA_WIN_XMRIG_CryptoCoin_Miner_Dec20 {
   meta:
      description = "Detects XMRIG crypto coin miners"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
      date = "2020-12-31"
      hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
      id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"
   strings:
      $x1 = "xmrig.exe" fullword wide
      $x2 = "xmrig.com" fullword wide
      $x3 = "* for x86, CRYPTOGAMS" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 6000KB and 2 of them or all of them
}
YARA Detection Rule: Dexter_Malware
Repository: Neo23x0/signature-base
Detects: Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/oBvy8b

Pattern signatures:
$s0 = "Java Security Plugin" fullword wide
		$s1 = "%s\\%s\\%s.exe" fullword wide
		$s2 = "Sun Java Security Plugin" fullword wide
		$s3 = "\\Internet Explorer\\iexplore.exe" wide

Detection condition:
all of them

Full rule:
rule Dexter_Malware {
	meta:
		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/oBvy8b"
		date = "2015/02/10"
		score = 70
		id = "8be328ec-ba29-50ba-8d35-e2c4dfcae45e"
	strings:
		$s0 = "Java Security Plugin" fullword wide
		$s1 = "%s\\%s\\%s.exe" fullword wide
		$s2 = "Sun Java Security Plugin" fullword wide
		$s3 = "\\Internet Explorer\\iexplore.exe" wide
	condition:
		all of them
}
YARA Detection Rule: MAL_crime_win32_rat_parallax_shell_bin
Repository: Neo23x0/signature-base
Detects: Detects Parallax injected code
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]02937088

Pattern signatures:
$ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
      $call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?

Detection condition:
uint16(0) == 0x5a4d and 2 of them or all of them

Full rule:
rule MAL_crime_win32_rat_parallax_shell_bin {
   meta:
      description = "Detects Parallax injected code"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]02937088"
      tlp = "white"
      date = "2020-05-05"
      id = "6bb337ef-3156-589a-9b2f-fa1b21699433"
   strings:
      $ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
      $call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
      $cryp_hex =  {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
   condition:
      uint16(0) == 0x5a4d and 2 of them or all of them
}
YARA Detection Rule: OilRig_RGDoor_Gen1
Repository: Neo23x0/signature-base
Detects: Detects RGDoor backdoor used by OilRig group
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/

Pattern signatures:
$c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
              61 64 24 }
      $c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }

      $s1 = "MyNativeModule.dll" fullword ascii
      $s2 = "RGSESSIONID=" fullword ascii
      $s3 = "download$" fullword ascii
      $s4 = ".?AVCHelloWorld@@" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "47cb127aad6c7c9954058e61a2a6429a" or
        1 of ($c*) or
        2 of them
      )

Full rule:
rule OilRig_RGDoor_Gen1 {
   meta:
      description = "Detects RGDoor backdoor used by OilRig group"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
      date = "2018-01-27"
      score = 80
      hash1 = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
      id = "68ac1f35-4eaa-5899-b66c-296d7c5fa462"
   strings:
      $c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
              61 64 24 }
      $c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }

      $s1 = "MyNativeModule.dll" fullword ascii
      $s2 = "RGSESSIONID=" fullword ascii
      $s3 = "download$" fullword ascii
      $s4 = ".?AVCHelloWorld@@" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
        pe.imphash() == "47cb127aad6c7c9954058e61a2a6429a" or
        1 of ($c*) or
        2 of them
      )
}