deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ransomware_PetrWrap
Repository: Yara-Rules/rules
Detects: Rule to detect PetrWrap ransomware samples
Author: Kaspersky Lab
Reference: https://securelist.com/schroedingers-petya/78870/

Pattern signatures:
$a1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu" fullword wide
	$a2 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls" fullword wide
	$a3 = "DESTROY ALL OF YOUR DATA PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" fullword ascii
	$a4 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" fullword ascii
	$a5 = "wowsmith123456posteo.net." fullword wide

Detection condition:
uint16(0) == 0x5A4D and filesize < 1000000 and any of them

Full rule:
rule ransomware_PetrWrap 
{
meta:
	copyright= "Kaspersky Lab"
	description = "Rule to detect PetrWrap ransomware samples"
    reference = "https://securelist.com/schroedingers-petya/78870/"
	last_modified = "2017-06-27"
	author = "Kaspersky Lab"
	hash = "71B6A493388E7D0B40C83CE903BC6B04"
	version = "1.0"
strings:
	$a1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcqYLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgqCXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu" fullword wide
	$a2 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls" fullword wide
	$a3 = "DESTROY ALL OF YOUR DATA PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" fullword ascii
	$a4 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" fullword ascii
	$a5 = "wowsmith123456posteo.net." fullword wide
condition:
	uint16(0) == 0x5A4D and filesize < 1000000 and any of them 
}
YARA Detection Rule: LinuxBew
Repository: Yara-Rules/rules
Detects: Linux.Bew Backdoor
Author: Joan Soriano / @w0lfvan

Pattern signatures:
$a = "src/secp256k1.c"
		$b = "hfir.u230.org"
		$c = "tempfile-x11session"

Detection condition:
all of them

Full rule:
rule LinuxBew: MALW
{
	meta:
		description = "Linux.Bew Backdoor"
		author = "Joan Soriano / @w0lfvan"
		date = "2017-07-10"
		version = "1.0"
		MD5 = "27d857e12b9be5d43f935b8cc86eaabf"
		SHA256 = "80c4d1a1ef433ac44c4fe72e6ca42395261fbca36eff243b07438263a1b1cf06"
	strings:
		$a = "src/secp256k1.c"
		$b = "hfir.u230.org"
		$c = "tempfile-x11session"
	condition:
		all of them
}
YARA Detection Rule: Crimson
Repository: Yara-Rules/rules
Detects: Crimson Rat
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a1 = "com/crimson/PK"
		$a2 = "com/crimson/bootstrapJar/PK"
		$a3 = "com/crimson/permaJarMulti/PermaJarReporter$1.classPK"
		$a4 = "com/crimson/universal/containers/KeyloggerLog.classPK"
        $a5 = "com/crimson/universal/UploadTransfer.classPK"

Detection condition:
all of ($a*)

Full rule:
rule Crimson: RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		Description = "Crimson Rat"
		date = "2015/05"
		ref = "http://malwareconfig.com/stats/Crimson"
		maltype = "Remote Access Trojan"
		filetype = "jar"

	strings:
		$a1 = "com/crimson/PK"
		$a2 = "com/crimson/bootstrapJar/PK"
		$a3 = "com/crimson/permaJarMulti/PermaJarReporter$1.classPK"
		$a4 = "com/crimson/universal/containers/KeyloggerLog.classPK"
        $a5 = "com/crimson/universal/UploadTransfer.classPK"
        
	condition:
        all of ($a*)
}
YARA Detection Rule: easterjackpos
Repository: Yara-Rules/rules
Detects: Identify JackPOS
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "updateinterval="
        $s2 = "cardinterval="
        $s3 = "{[!17!]}{[!18!]}"

Detection condition:
all of them

Full rule:
rule easterjackpos {
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-09-02"
        description = "Identify JackPOS"
	strings:
	    $s1 = "updateinterval="
        $s2 = "cardinterval="
        $s3 = "{[!17!]}{[!18!]}"
    condition:
        all of them
}
YARA Detection Rule: IronTiger_ASPXSpy
Repository: Yara-Rules/rules
Detects: ASPXSpy detection. It might be used by other fraudsters
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "ASPXSpy" nocase wide ascii
        $str2 = "IIS Spy" nocase wide ascii
        $str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii

Detection condition:
any of ($str*)

Full rule:
rule IronTiger_ASPXSpy
{
    
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "ASPXSpy detection. It might be used by other fraudsters"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "ASPXSpy" nocase wide ascii
        $str2 = "IIS Spy" nocase wide ascii
        $str3 = "protected void DGCoW(object sender,EventArgs e)" nocase wide ascii
    
    condition:
        any of ($str*)
}
YARA Detection Rule: IronTiger_ChangePort_Toolkit_driversinstall
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - Changeport Toolkit driverinstall
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "openmydoor" nocase wide ascii
        $str2 = "Install service error" nocase wide ascii
        $str3 = "start remove service" nocase wide ascii
        $str4 = "NdisVersion" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_ChangePort_Toolkit_driversinstall 
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - Changeport Toolkit driverinstall"   
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "openmydoor" nocase wide ascii
        $str2 = "Install service error" nocase wide ascii
        $str3 = "start remove service" nocase wide ascii
        $str4 = "NdisVersion" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_ChangePort_Toolkit_ChangePortExe
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - Toolkit ChangePort
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Unable to alloc the adapter!" nocase wide ascii
        $str2 = "Wait for master fuck" nocase wide ascii
        $str3 = "xx.exe <HOST> <PORT>" nocase wide ascii
        $str4 = "chkroot2007" nocase wide ascii
        $str5 = "Door is bind on %s" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_ChangePort_Toolkit_ChangePortExe 
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - Toolkit ChangePort"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "Unable to alloc the adapter!" nocase wide ascii
        $str2 = "Wait for master fuck" nocase wide ascii
        $str3 = "xx.exe <HOST> <PORT>" nocase wide ascii
        $str4 = "chkroot2007" nocase wide ascii
        $str5 = "Door is bind on %s" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_dllshellexc2010
Repository: Yara-Rules/rules
Detects: dllshellexc2010 Exchange backdoor + remote shell
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Microsoft.Exchange.Clients.Auth.dll" nocase ascii wide
        $str2 = "Dllshellexc2010" nocase wide ascii
        $str3 = "Users\\ljw\\Documents" nocase wide ascii
        $bla1 = "please input path" nocase wide ascii
        $bla2 = "auth.owa" nocase wide ascii

Detection condition:
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_dllshellexc2010 
{
    
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "dllshellexc2010 Exchange backdoor + remote shell"
        reference = "http://goo.gl/T5fSJC"
    
    strings:
        $str1 = "Microsoft.Exchange.Clients.Auth.dll" nocase ascii wide
        $str2 = "Dllshellexc2010" nocase wide ascii
        $str3 = "Users\\ljw\\Documents" nocase wide ascii
        $bla1 = "please input path" nocase wide ascii
        $bla2 = "auth.owa" nocase wide ascii
    
    condition:
        (uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_dnstunnel
Repository: Yara-Rules/rules
Detects: This rule detects a dns tunnel tool used in Operation Iron Tiger
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "\\DnsTunClient\\" nocase wide ascii
        $str2 = "\\t-DNSTunnel\\" nocase wide ascii
        $str3 = "xssok.blogspot" nocase wide ascii
        $str4 = "dnstunclient" nocase wide ascii
        $mistake1 = "because of error, can not analysis" nocase wide ascii
        $mistake2 = "can not deal witn the error" nocase wide ascii
        $mistake3 = "the other retun one RST" nocase wide ascii
        $mistake4 = "Coversation produce one error" nocase wide ascii
        $mistake5 = "Program try to use the have deleted the buffer" nocase wide ascii

Detection condition:
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))

Full rule:
rule IronTiger_dnstunnel 
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "\\DnsTunClient\\" nocase wide ascii
        $str2 = "\\t-DNSTunnel\\" nocase wide ascii
        $str3 = "xssok.blogspot" nocase wide ascii
        $str4 = "dnstunclient" nocase wide ascii
        $mistake1 = "because of error, can not analysis" nocase wide ascii
        $mistake2 = "can not deal witn the error" nocase wide ascii
        $mistake3 = "the other retun one RST" nocase wide ascii
        $mistake4 = "Coversation produce one error" nocase wide ascii
        $mistake5 = "Program try to use the have deleted the buffer" nocase wide ascii
    
    condition:
        (uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
}
YARA Detection Rule: IronTiger_EFH3_encoder
Repository: Yara-Rules/rules
Detects: Iron Tiger EFH3 Encoder
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" nocase wide ascii
        $str2 = "123.EXE 123.EFH" nocase wide ascii
        $str3 = "ENCODER: b[i]: = " nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_EFH3_encoder 
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger EFH3 Encoder"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" nocase wide ascii
        $str2 = "123.EXE 123.EFH" nocase wide ascii
        $str3 = "ENCODER: b[i]: = " nocase wide ascii
  
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_GetPassword_x64
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - GetPassword x64
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "(LUID ERROR)" nocase wide ascii
        $str2 = "Users\\K8team\\Desktop\\GetPassword" nocase wide ascii
        $str3 = "Debug x64\\GetPassword.pdb" nocase wide ascii
        $bla1 = "Authentication Package:" nocase wide ascii
        $bla2 = "Authentication Domain:" nocase wide ascii
        $bla3 = "* Password:" nocase wide ascii
        $bla4 = "Primary User:" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_GetPassword_x64
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - GetPassword x64"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "(LUID ERROR)" nocase wide ascii
        $str2 = "Users\\K8team\\Desktop\\GetPassword" nocase wide ascii
        $str3 = "Debug x64\\GetPassword.pdb" nocase wide ascii
        $bla1 = "Authentication Package:" nocase wide ascii
        $bla2 = "Authentication Domain:" nocase wide ascii
        $bla3 = "* Password:" nocase wide ascii
        $bla4 = "Primary User:" nocase wide ascii
  
    condition:
        uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_GetUserInfo
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - GetUserInfo
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "getuserinfo username" nocase wide ascii
        $str2 = "joe@joeware.net" nocase wide ascii
        $str3 = "If . specified for userid," nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_GetUserInfo
{
    
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - GetUserInfo"
        reference = "http://goo.gl/T5fSJC"
    
    strings:
        $str1 = "getuserinfo username" nocase wide ascii
        $str2 = "joe@joeware.net" nocase wide ascii
        $str3 = "If . specified for userid," nocase wide ascii
    
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_Gh0stRAT_variant
Repository: Yara-Rules/rules
Detects: This is a detection for a s.exe variant seen in Op. Iron Tiger
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Game Over Good Luck By Wind" nocase wide ascii
        $str2 = "ReleiceName" nocase wide ascii
        $str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
        $str4 = "Winds Update" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_Gh0stRAT_variant
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "This is a detection for a s.exe variant seen in Op. Iron Tiger"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "Game Over Good Luck By Wind" nocase wide ascii
        $str2 = "ReleiceName" nocase wide ascii
        $str3 = "jingtisanmenxiachuanxiao.vbs" nocase wide ascii
        $str4 = "Winds Update" nocase wide ascii
  
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_GTalk_Trojan
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - GTalk Trojan
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "gtalklite.com" nocase wide ascii
        $str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
        $str3 = "D13idmAdm" nocase wide ascii
        $str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_GTalk_Trojan 
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - GTalk Trojan"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "gtalklite.com" nocase wide ascii
        $str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" nocase wide ascii
        $str3 = "D13idmAdm" nocase wide ascii
        $str4 = "Error: PeekNamedPipe failed with %i" nocase wide ascii
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_HTTPBrowser_Dropper
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - HTTPBrowser Dropper
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = ".dllUT" nocase wide ascii
        $str2 = ".exeUT" nocase wide ascii
        $str3 = ".urlUT" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_HTTPBrowser_Dropper 
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - HTTPBrowser Dropper"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = ".dllUT" nocase wide ascii
        $str2 = ".exeUT" nocase wide ascii
        $str3 = ".urlUT" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_HTTP_SOCKS_Proxy_soexe
Repository: Yara-Rules/rules
Detects: Iron Tiger Toolset - HTTP SOCKS Proxy soexe
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "listen SOCKET error." nocase wide ascii
        $str2 = "WSAAsyncSelect SOCKET error." nocase wide ascii
        $str3 = "new SOCKETINFO error!" nocase wide ascii
        $str4 = "Http/1.1 403 Forbidden" nocase wide ascii
        $str5 = "Create SOCKET error." nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (3 of ($str*))

Full rule:
rule IronTiger_HTTP_SOCKS_Proxy_soexe
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "listen SOCKET error." nocase wide ascii
        $str2 = "WSAAsyncSelect SOCKET error." nocase wide ascii
        $str3 = "new SOCKETINFO error!" nocase wide ascii
        $str4 = "Http/1.1 403 Forbidden" nocase wide ascii
        $str5 = "Create SOCKET error." nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (3 of ($str*))
}
YARA Detection Rule: IronTiger_NBDDos_Gh0stvariant_dropper
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - NBDDos Gh0stvariant Dropper
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "This service can't be stoped." nocase wide ascii
        $str2 = "Provides support for media palyer" nocase wide ascii
        $str4 = "CreaetProcess Error" nocase wide ascii
        $bla1 = "Kill You" nocase wide ascii
        $bla2 = "%4.2f GB" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_NBDDos_Gh0stvariant_dropper
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "This service can't be stoped." nocase wide ascii
        $str2 = "Provides support for media palyer" nocase wide ascii
        $str4 = "CreaetProcess Error" nocase wide ascii
        $bla1 = "Kill You" nocase wide ascii
        $bla2 = "%4.2f GB" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_PlugX_DosEmulator
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - PlugX DosEmulator
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Dos Emluator Ver" nocase wide ascii
        $str2 = "\\PIPE\\FASTDOS" nocase wide ascii
        $str3 = "FastDos.cpp" nocase wide ascii
        $str4 = "fail,error code = %d." nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_PlugX_DosEmulator
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - PlugX DosEmulator"  
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "Dos Emluator Ver" nocase wide ascii
        $str2 = "\\PIPE\\FASTDOS" nocase wide ascii
        $str3 = "FastDos.cpp" nocase wide ascii
        $str4 = "fail,error code = %d." nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_PlugX_FastProxy
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - PlugX FastProxy
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
        $str2 = "Useage: %s pid" nocase wide ascii
        $str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
        $str4 = "p0: port for listener" nocase wide ascii
        $str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
        $str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_PlugX_FastProxy
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - PlugX FastProxy"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "SAFEPROXY HTServerTimer Quit!" nocase wide ascii
        $str2 = "Useage: %s pid" nocase wide ascii
        $str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" nocase wide ascii
        $str4 = "p0: port for listener" nocase wide ascii
        $str5 = "\\users\\whg\\desktop\\plug\\" nocase wide ascii
        $str6 = "[+Y] cwnd : %3d, fligth:" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_PlugX_Server
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - PlugX Server
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "\\UnitFrmManagerKeyLog.pas" nocase wide ascii
        $str2 = "\\UnitFrmManagerRegister.pas" nocase wide ascii
        $str3 = "Input Name..." nocase wide ascii
        $str4 = "New Value#" nocase wide ascii
        $str5 = "TThreadRControl.Execute SEH!!!" nocase wide ascii
        $str6 = "\\UnitFrmRControl.pas" nocase wide ascii
        $str7 = "OnSocket(event is error)!" nocase wide ascii
        $str8 = "Make 3F Version Ok!!!" nocase wide ascii
        $str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" nocase wide ascii
        $str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_PlugX_Server
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - PlugX Server"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "\\UnitFrmManagerKeyLog.pas" nocase wide ascii
        $str2 = "\\UnitFrmManagerRegister.pas" nocase wide ascii
        $str3 = "Input Name..." nocase wide ascii
        $str4 = "New Value#" nocase wide ascii
        $str5 = "TThreadRControl.Execute SEH!!!" nocase wide ascii
        $str6 = "\\UnitFrmRControl.pas" nocase wide ascii
        $str7 = "OnSocket(event is error)!" nocase wide ascii
        $str8 = "Make 3F Version Ok!!!" nocase wide ascii
        $str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" nocase wide ascii
        $str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_ReadPWD86
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - ReadPWD86
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Fail To Load LSASRV" nocase wide ascii
        $str2 = "Fail To Search LSASS Data" nocase wide ascii
        $str3 = "User Principal" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and (all of ($str*))

Full rule:
rule IronTiger_ReadPWD86
{
   
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - ReadPWD86"
        reference = "http://goo.gl/T5fSJC"
   
    strings:
        $str1 = "Fail To Load LSASRV" nocase wide ascii
        $str2 = "Fail To Search LSASS Data" nocase wide ascii
        $str3 = "User Principal" nocase wide ascii
   
    condition:
        uint16(0) == 0x5a4d and (all of ($str*))
}