deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: DestructiveTargetCleaningTool8
Repository: Yara-Rules/rules

Pattern signatures:
$license = {E903FFFF820050006F[PII_REDACTED]69006F006E[PII_REDACTED]63006F[PII_REDACTED][PII_REDACTED][PII_REDACTED]200052006F[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2C0020004A006F[PII_REDACTED][PII_REDACTED]0061006E[PII_REDACTED]61006E[PII_REDACTED]69006A006B002C[PII_REDACTED]65006C[PII_REDACTED]6E[PII_REDACTED][PII_REDACTED]0000000A002200CE000800EA03FFFF8200}
		$PuTTY= {[PII_REDACTED][PII_REDACTED]}

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY

Full rule:
rule DestructiveTargetCleaningTool8
{
	strings:
		$license = {E903FFFF820050006F[PII_REDACTED]69006F006E[PII_REDACTED]63006F[PII_REDACTED][PII_REDACTED][PII_REDACTED]200052006F[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]2C0020004A006F[PII_REDACTED][PII_REDACTED]0061006E[PII_REDACTED]61006E[PII_REDACTED]69006A006B002C[PII_REDACTED]65006C[PII_REDACTED]6E[PII_REDACTED][PII_REDACTED]0000000A002200CE000800EA03FFFF8200}
		$PuTTY= {[PII_REDACTED][PII_REDACTED]}
	
	condition:
		(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $license and not $PuTTY
}
YARA Detection Rule: Malwareusedbycyberthreatactor1
Repository: Yara-Rules/rules

Pattern signatures:
// vvv---- this sig hits on a legit CRT function it seems. 
		$heapCreateFunction_0 = {33C06A[PII_REDACTED][PII_REDACTED]0F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
		
		$heapCreateFunction = { 55 8B EC B8 2C 12 00 00 E8 ?? ?? FF FF 8D 85 68 FF FF FF 53 50 C7 85 68 FF FF FF 94 00 00 00 FF 1? ?? ?? ?? ?0 85 C0 74 1A 83 BD 78 FF FF FF 02 75 11 83 BD 6C FF FF FF 05 72 08 6A 01 58 E9 02 01 00 00 8D 85 D4 ED FF F6 89 01 00 00 05 06 8? ?? ?? ?? 0F F1 5? ?? ?? ?? 08 5C 00 F8 4D 00 00 00 03 3D B8 D8 DD 4E DF FF F3 89 DD DF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 5D 4E DF FF F6 A1 65 06 8? ?? ?? ?? 0E 8? ?? ?0 00 08 3C 40 C8 5C 07 50 88 D8 5D 4E DF FF FE B4 98 D8 56 4F EF FF F6 80 40 10 00 05 05 3F F1 5? ?? ?? ?? 03 89 D6 4F EF FF F8 D8 D6 4F EF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 56 4F EF FF F5 08 D8 5D 4E DF FF F5 0E 

Detection condition:
all of them

Full rule:
rule Malwareusedbycyberthreatactor1
{
	strings:
		// vvv---- this sig hits on a legit CRT function it seems. 
		$heapCreateFunction_0 = {33C06A[PII_REDACTED][PII_REDACTED]0F94C050FF15????????85C0A3???????07436E893FEFFFF83F803A3???????0750D68F8030000E8??00000059EB0A83F8027518E8????000085C0750FFF35???????0FF15???????033C0C36A0158C3}
		
		$heapCreateFunction = { 55 8B EC B8 2C 12 00 00 E8 ?? ?? FF FF 8D 85 68 FF FF FF 53 50 C7 85 68 FF FF FF 94 00 00 00 FF 1? ?? ?? ?? ?0 85 C0 74 1A 83 BD 78 FF FF FF 02 75 11 83 BD 6C FF FF FF 05 72 08 6A 01 58 E9 02 01 00 00 8D 85 D4 ED FF F6 89 01 00 00 05 06 8? ?? ?? ?? 0F F1 5? ?? ?? ?? 08 5C 00 F8 4D 00 00 00 03 3D B8 D8 DD 4E DF FF F3 89 DD DF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 5D 4E DF FF F6 A1 65 06 8? ?? ?? ?? 0E 8? ?? ?0 00 08 3C 40 C8 5C 07 50 88 D8 5D 4E DF FF FE B4 98 D8 56 4F EF FF F6 80 40 10 00 05 05 3F F1 5? ?? ?? ?? 03 89 D6 4F EF FF F8 D8 D6 4F EF FF F7 41 38 A0 13 C6 17 C0 83 C7 A7 F0 42 C2 08 80 14 13 81 97 5E D8 D8 56 4F EF FF F5 08 D8 5D 4E DF FF F5 0E 8? ?? ?? ?? ?5 95 93 BC 37 43 E6 A2 C5 0E 8? ?? ?? ?? ?5 93 BC 35 97 43 04 08 BC 83 81 87 40 E8 03 93 B7 50 48 81 9E B0 14 13 81 97 5F 26 A0 A5 35 0E 8? ?? ?0 00 08 3C 40 C8 3F 80 27 41 D8 3F 80 37 41 88 3F 80 17 41 38 D4 5F C5 0E 89 8F EF FF F8 07 DF C0 65 91 BC 08 3C 00 35 BC 9C}
		
  	// vvv---- this sig hits on a legit CRT function it seems. 
		$getMajorMinorLinker = {568B7424086A00832600FF15???????06681384D5A75148B483C85C9740D03C18A481A880E8A401B8846015EC3}

		$openServiceManager = {FF15???0?0?08B?885??74????????????????5?FF15???0?0?08B?????0?0?08BF?85F?74}
	
	condition:
	
		all of them
}
YARA Detection Rule: Malwareusedbycyberthreatactor2
Repository: Yara-Rules/rules

Pattern signatures:
$str1 = "_quit"
		$str2 = "_exe"
		$str3 = "_put"
		$str4 = "_got"
		$str5 = "_get"
		$str6 ="_del"
		$str7 = "_dir"
		$str8 = { C7 44 24 18 1F F7}

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them

Full rule:
rule Malwareusedbycyberthreatactor2
{
	strings:
		$str1 = "_quit"
		$str2 = "_exe"
		$str3 = "_put"
		$str4 = "_got"
		$str5 = "_get"
		$str6 ="_del"
		$str7 = "_dir"
		$str8 = { C7 44 24 18 1F F7}
	
	condition:
		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0  or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
YARA Detection Rule: Malwareusedbycyberthreatactor3
Repository: Yara-Rules/rules

Pattern signatures:
$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them

Full rule:
rule Malwareusedbycyberthreatactor3
{
	strings:
		$STR1 = { 50 68 80 00 00 00 68 FF FF 00 00 51 C7 44 24 1C 3a 8b 00 00 }
	
	condition:
		(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}
YARA Detection Rule: WhiskeyCharlie
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		66 89 55 DC     mov     [ebp+SystemTime.wYear], dx
		E8 1E 16 00 00  call    _rand
		6A 0C           push    0Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		42              inc     edx
		66 89 55 DE     mov     [ebp+SystemTime.wMonth], dx
		E8 0E 16 00 00  call    _rand
		6A 1C           push    1Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		42              inc     edx
		66 89 55 E2     mov     [ebp+SystemTime.wDay], dx
		E8 FE 15 00 00  call    _rand
		6A 18           push    18h
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		66 89 55 E4     mov     [ebp+SystemTime.wHour], dx
		E8 EF 15 00 00  call    _rand
		6A 3C           push    3Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		66 89 55 E6     mov     [ebp+SystemTime.wMinute], dx
		E8 E0 15 00 00  call    _rand
		6A 3C           push    3Ch
		99              cdq
		59      

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule WhiskeyCharlie
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "47ff4f73738acc2f8433dccb2caf980d7444d723ccf2968d69f88f8f96405f96"

	strings:
	/*
		66 89 55 DC     mov     [ebp+SystemTime.wYear], dx
		E8 1E 16 00 00  call    _rand
		6A 0C           push    0Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		42              inc     edx
		66 89 55 DE     mov     [ebp+SystemTime.wMonth], dx
		E8 0E 16 00 00  call    _rand
		6A 1C           push    1Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		42              inc     edx
		66 89 55 E2     mov     [ebp+SystemTime.wDay], dx
		E8 FE 15 00 00  call    _rand
		6A 18           push    18h
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		66 89 55 E4     mov     [ebp+SystemTime.wHour], dx
		E8 EF 15 00 00  call    _rand
		6A 3C           push    3Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
		66 89 55 E6     mov     [ebp+SystemTime.wMinute], dx
		E8 E0 15 00 00  call    _rand
		6A 3C           push    3Ch
		99              cdq
		59              pop     ecx
		F7 F9           idiv    ecx
	*/

	$a = {66 89 55 DC E8 [4] 6A 0C 	99 59 F7 F9 42 66 89 55 DE E8 [4] 6A 1C 99 59 F7 F9 42 66 89 55 E2 E8 [4] 6A 18 99 59 F7 F9 66 89 55 E4 E8 [4] 6A 3C 99 59 F7 F9 66 89 55 E6 E8 [4] 6A 3C 99 59 F7 F9 }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: IndiaAlfa_One
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
$ = "HwpFilePathCheck.dll"
		$ = "AdobeArm.exe"
		$ = "OpenDocument"

Detection condition:
2 of them

Full rule:
rule IndiaAlfa_One
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = "HwpFilePathCheck.dll"
		$ = "AdobeArm.exe"
		$ = "OpenDocument"
		
	condition:
		2 of them

}
YARA Detection Rule: IndiaAlfa_Two
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
$ = "ExePath: %s\nXlsPath: %s\nTmpPath: %s\n"

Detection condition:
any of them

Full rule:
rule IndiaAlfa_Two
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = "ExePath: %s\nXlsPath: %s\nTmpPath: %s\n"
		
	condition:
		any of them

}
YARA Detection Rule: RomeoDelta
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		E8 78 00 00 00  call    GenerateRandomBuffer
		33 C0           xor     eax, eax
		8A 4C 04 04     mov     cl, [esp+eax+24h+buffer]
		80 E9 22        sub     cl, 22h
		80 F1 AD        xor     cl, 0ADh
		88 4C 04 04     mov     [esp+eax+24h+buffer], cl
		40              inc     eax
		83 F8 10        cmp     eax, 10h
		7C EC           jl      short loc_1000117A
		6A 01           push    1               ; fEncode
		8D 54 24 08     lea     edx, [esp+28h+buffer]
		6A 10           push    10h             ; dwDataLength
		52              push    edx             ; pvData
		8B CB           mov     ecx, ebx        ; this
		E8 A2 00 00 00  call    CSocket__Send
	*/

	$loginInit = { E8 [4] 33 C0 8A [3] 80 [2] 80 [2] 88 [3] 40 83 F8 10 7C ?? 6A 01 8D [3] 6A 10 5? 8B CB E8	}

Detection condition:
$loginInit in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule RomeoDelta
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "1df2af99fb3b6e31067b06df07b96d0ed0632f85111541a416da9ceda709237c"

	strings:
	/*
		E8 78 00 00 00  call    GenerateRandomBuffer
		33 C0           xor     eax, eax
		8A 4C 04 04     mov     cl, [esp+eax+24h+buffer]
		80 E9 22        sub     cl, 22h
		80 F1 AD        xor     cl, 0ADh
		88 4C 04 04     mov     [esp+eax+24h+buffer], cl
		40              inc     eax
		83 F8 10        cmp     eax, 10h
		7C EC           jl      short loc_1000117A
		6A 01           push    1               ; fEncode
		8D 54 24 08     lea     edx, [esp+28h+buffer]
		6A 10           push    10h             ; dwDataLength
		52              push    edx             ; pvData
		8B CB           mov     ecx, ebx        ; this
		E8 A2 00 00 00  call    CSocket__Send
	*/

	$loginInit = { E8 [4] 33 C0 8A [3] 80 [2] 80 [2] 88 [3] 40 83 F8 10 7C ?? 6A 01 8D [3] 6A 10 5? 8B CB E8	}

	condition:
		$loginInit in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: HotelAlfa
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
$resourceHTML = "RSRC_HTML"
	/*
		8A 0C 18  mov     cl, [eax+ebx]
		80 F1 63  xor     cl, 63h
		88 0C 18  mov     [eax+ebx], cl
		8B 4D 00  mov     ecx, [ebp+0]
		40        inc     eax
		3B C1     cmp     eax, ecx
		72 EF     jb      short loc_4010B4
	*/

	$rscsDecoderLoop = {8A [2] 80 F1 ?? 88 [2] 8B [2] 40 3B ?? 72 EF}

Detection condition:
$resourceHTML and $rscsDecoderLoop in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule HotelAlfa
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "58dab205ecb1e0972027eb92f68cec6d208e5ab5.ex_"

	strings:
	
	$resourceHTML = "RSRC_HTML"
	/*
		8A 0C 18  mov     cl, [eax+ebx]
		80 F1 63  xor     cl, 63h
		88 0C 18  mov     [eax+ebx], cl
		8B 4D 00  mov     ecx, [ebp+0]
		40        inc     eax
		3B C1     cmp     eax, ecx
		72 EF     jb      short loc_4010B4
	*/

	$rscsDecoderLoop = {8A [2] 80 F1 ?? 88 [2] 8B [2] 40 3B ?? 72 EF}

	condition:
		$resourceHTML and $rscsDecoderLoop in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: IndiaBravo_PapaAlfa
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
$ = "pmsconfig.msi" wide
		$ = "scvrit001.bat"

Detection condition:
all of them

Full rule:
rule IndiaBravo_PapaAlfa
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$ = "pmsconfig.msi" wide
		$ = "scvrit001.bat"
	condition:
		all of them
}
YARA Detection Rule: IndiaBravo_RomeoCharlie
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		50                 push    eax             ; argp
		68 7E 66 04 80     push    8004667Eh       ; cmd
		8B 8D DC FE FF FF  mov     ecx, [ebp+skt]
		51                 push    ecx             ; s
		FF 15 58 31 41 00  call    ioctlsocket
		83 F8 FF           cmp     eax, 0FFFFFFFFh
		75 08              jnz     short loc_4043F0
	*/

	$a = {50 68 7E 66 04 80 8B 8D [4] 51 FF 15 [4] 83 F8 FF 75}
	$b1 = "xc123465-efff-87cc-37abcdef9"
	$b2 = "[Check] - PORT ERROR..." wide
	$b3 = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"

Detection condition:
2 of ($b*) or 
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule IndiaBravo_RomeoCharlie
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "58ad28ac4fb911abb6a20382456c4ad6fe5c8ee5.ex_"
		Status = "Signature is too loose to be useful."
		
	strings:
	/*
		50                 push    eax             ; argp
		68 7E 66 04 80     push    8004667Eh       ; cmd
		8B 8D DC FE FF FF  mov     ecx, [ebp+skt]
		51                 push    ecx             ; s
		FF 15 58 31 41 00  call    ioctlsocket
		83 F8 FF           cmp     eax, 0FFFFFFFFh
		75 08              jnz     short loc_4043F0
	*/

	$a = {50 68 7E 66 04 80 8B 8D [4] 51 FF 15 [4] 83 F8 FF 75}
	$b1 = "xc123465-efff-87cc-37abcdef9"
	$b2 = "[Check] - PORT ERROR..." wide
	$b3 = "%sd.e%sc n%ssh%srewa%s ad%s po%sop%sing T%s %d"

	condition:
		2 of ($b*) or 
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: IndiaBravo_RomeoBravo
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		E8 C3 FE FF FF     call    generate64ByteRandomNumber
		68 C8 01 00 00     push    1C8h            ; dwLength
		68 D8 E8 40 00     push    offset g_Config ; pvBuffer
		A3 80 EA 40 00     mov     dword ptr g_Config.qwIdentifier, eax
		89 15 84 EA 40 00  mov     dword ptr g_Config.qwIdentifier+4, edx
		E8 F9 E9 FF FF     call    DNSCALCDecode
		83 C4 08           add     esp, 8
		8D 4C 24 08        lea     ecx, [esp+214h+var_20C]
		6A 00              push    0
		51                 push    ecx
		68 C8 01 00 00     push    1C8h
		68 D8 E8 40 00     push    offset g_Config
		56                 push    esi
		FF 15 74 E7 40 00  call    WriteFile_9
		56                 push    esi
		FF 15 6C E7 40 00  call    CloseHandle_9
	*/

	$a = {E8 [4] 68 [2] 00 00 68 [4] A3 [4]	89 15 [4] E8 [4] 83 C4 08 8D [3] 6A 00 5? 68 [2] 00 00 	68 [4] 5? FF 15 [4] 5? 	FF 15}
		
		$b1 = "tmscompg.msi" wide
		$b2 = "cvrit000.bat"

Detection condition:
2 of ($b*) or 
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule IndiaBravo_RomeoBravo
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "6e3db4da27f12eaba005217eba7cd9133bc258c97fe44605d12e20a556775009"

	strings:
	/*
		E8 C3 FE FF FF     call    generate64ByteRandomNumber
		68 C8 01 00 00     push    1C8h            ; dwLength
		68 D8 E8 40 00     push    offset g_Config ; pvBuffer
		A3 80 EA 40 00     mov     dword ptr g_Config.qwIdentifier, eax
		89 15 84 EA 40 00  mov     dword ptr g_Config.qwIdentifier+4, edx
		E8 F9 E9 FF FF     call    DNSCALCDecode
		83 C4 08           add     esp, 8
		8D 4C 24 08        lea     ecx, [esp+214h+var_20C]
		6A 00              push    0
		51                 push    ecx
		68 C8 01 00 00     push    1C8h
		68 D8 E8 40 00     push    offset g_Config
		56                 push    esi
		FF 15 74 E7 40 00  call    WriteFile_9
		56                 push    esi
		FF 15 6C E7 40 00  call    CloseHandle_9
	*/

	$a = {E8 [4] 68 [2] 00 00 68 [4] A3 [4]	89 15 [4] E8 [4] 83 C4 08 8D [3] 6A 00 5? 68 [2] 00 00 	68 [4] 5? FF 15 [4] 5? 	FF 15}
		
		$b1 = "tmscompg.msi" wide
		$b2 = "cvrit000.bat"

	condition:
		2 of ($b*) or 
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: IndiaBravo_generic
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
$extractDll = "[2] - Extract Dll..." wide
		$createSvc = "[3] - CreateSVC..." wide

Detection condition:
all of them

Full rule:
rule IndiaBravo_generic
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"

	strings:
		$extractDll = "[2] - Extract Dll..." wide
		$createSvc = "[3] - CreateSVC..." wide

	condition:
		all of them
	
}
YARA Detection Rule: RomeoWhiskey_Two
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		FF 15 78 A2 00 10  call    GetTickCount_9
		66 8B C8           mov     cx, ax

		// the next op is a mov or a push/pop depending on the code version
		53                 push    ebx
		8F 45 F4           pop     dword ptr [ebp-0Ch]
		//or
		89 5D F4           mov     dword ptr [ebp+var_C], ebx
		
		
		66 81 F1 40 1C     xor     cx, 1C40h
		66 D1 E9           shr     cx, 1
		81 C1 E0 56 00 00  add     ecx, 56E0h
		0F B7 C9           movzx   ecx, cx
		0F B7 C0           movzx   eax, ax
		81 F1 30 32 00 00  xor     ecx, 3230h
		C1 E0 10           shl     eax, 10h
		0B C8              or      ecx, eax
	*/

	$a = {FF 15 [4] 66 8B C8 [3-4] 	66 81 F1 40 1C 	66 D1 E9 81 C1 E0 56 00 00 0F B7 C9 0F B7 C0 81 F1 30 32 00 00 	C1 E0 10 0B C8 }

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule RomeoWhiskey_Two
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "a8d88714f0bc643e76163d1b8972565e78a159292d45a8218d0ad0754c8f561d"

	strings:
	/*
		FF 15 78 A2 00 10  call    GetTickCount_9
		66 8B C8           mov     cx, ax

		// the next op is a mov or a push/pop depending on the code version
		53                 push    ebx
		8F 45 F4           pop     dword ptr [ebp-0Ch]
		//or
		89 5D F4           mov     dword ptr [ebp+var_C], ebx
		
		
		66 81 F1 40 1C     xor     cx, 1C40h
		66 D1 E9           shr     cx, 1
		81 C1 E0 56 00 00  add     ecx, 56E0h
		0F B7 C9           movzx   ecx, cx
		0F B7 C0           movzx   eax, ax
		81 F1 30 32 00 00  xor     ecx, 3230h
		C1 E0 10           shl     eax, 10h
		0B C8              or      ecx, eax
	*/

	$a = {FF 15 [4] 66 8B C8 [3-4] 	66 81 F1 40 1C 	66 D1 E9 81 C1 E0 56 00 00 0F B7 C9 0F B7 C0 81 F1 30 32 00 00 	C1 E0 10 0B C8 }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: RomeoWhiskey_One
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		FF 15 D8 5B 00 10  call    GetTickCount_9
		0F B7 C0           movzx   eax, ax
		8B C8              mov     ecx, eax
		// skipped: 6A 01              push    1               ; fDecode
		C1 E9 34           shr     ecx, 34h         <--- this value could change
		81 F1 C0 F3 00 00  xor     ecx, 0F3C0h			<--- this value could change
		// skipped: 6A 04              push    4               ; dwLength
		C1 E0 10           shl     eax, 10h
		0B C8              or      ecx, eax
	*/

	$a = {	FF 15 [4]  0F B7 C0 8B C8 [2-4] C1 E9 ?? 81 F1 [2] 00 00 [0-2] 	C1 E0 10 0B C8 	}

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule RomeoWhiskey_One
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "5d21e865d57e9798ac7c14a6ad09c4034d103f3ea993295dcdf8a208ea825ad7"

	strings:
	/*
		FF 15 D8 5B 00 10  call    GetTickCount_9
		0F B7 C0           movzx   eax, ax
		8B C8              mov     ecx, eax
		// skipped: 6A 01              push    1               ; fDecode
		C1 E9 34           shr     ecx, 34h         <--- this value could change
		81 F1 C0 F3 00 00  xor     ecx, 0F3C0h			<--- this value could change
		// skipped: 6A 04              push    4               ; dwLength
		C1 E0 10           shl     eax, 10h
		0B C8              or      ecx, eax
	*/

	$a = {	FF 15 [4]  0F B7 C0 8B C8 [2-4] C1 E9 ?? 81 F1 [2] 00 00 [0-2] 	C1 E0 10 0B C8 	}

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}