deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Parallels_Detection
Repository: Yara-Rules/rules
Detects: Looks for Parallels presence

Pattern signatures:
$a0 = "magi"
        $a1 = "c!nu"
        $a2 = "mber"

        // PCI Vendor IDs, from Hacking Team's leak
        $parallels_vid_1 = "VEN_80EE" nocase wide ascii

Detection condition:
all of them

Full rule:
rule Parallels_Detection : AntiVM
{
    meta:
        description = "Looks for Parallels presence"
    strings:
        $a0 = "magi"
        $a1 = "c!nu"
        $a2 = "mber"

        // PCI Vendor IDs, from Hacking Team's leak
        $parallels_vid_1 = "VEN_80EE" nocase wide ascii
    condition:
        all of them
}
YARA Detection Rule: Qemu_Detection
Repository: Yara-Rules/rules
Detects: Looks for Qemu presence

Pattern signatures:
$a0 = "qemu" nocase wide ascii

Detection condition:
any of them

Full rule:
rule Qemu_Detection : AntiVM
{
    meta:
        description = "Looks for Qemu presence"
    strings:
        $a0 = "qemu" nocase wide ascii
    condition:
        any of them
}
YARA Detection Rule: Dropper_Strings
Repository: Yara-Rules/rules
Detects: May have dropper capabilities
Author: Ivan Kwiatkowski (@JusticeRage)

Pattern signatures:
$a0 = "CurrentVersion\\Run" nocase wide ascii
        $a1 = "CurrentControlSet\\Services" nocase wide ascii
        $a2 = "Programs\\Startup" nocase wide ascii
        $a3 = "%temp%" nocase wide ascii
        $a4 = "%allusersprofile%" nocase wide ascii

Detection condition:
any of them

Full rule:
rule Dropper_Strings
{
    meta:
        description = "May have dropper capabilities"
        author = "Ivan Kwiatkowski (@JusticeRage)"
    strings:
        $a0 = "CurrentVersion\\Run" nocase wide ascii
        $a1 = "CurrentControlSet\\Services" nocase wide ascii
        $a2 = "Programs\\Startup" nocase wide ascii
        $a3 = "%temp%" nocase wide ascii
        $a4 = "%allusersprofile%" nocase wide ascii
    condition:
        any of them
}
YARA Detection Rule: AutoIT_compiled_script
Repository: Yara-Rules/rules
Detects: Is an AutoIT compiled script
Author: Ivan Kwiatkowski (@JusticeRage)

Pattern signatures:
$a0 = "AutoIt Error" ascii wide
        $a1 = "reserved for AutoIt internal use" ascii wide

Detection condition:
any of them

Full rule:
rule AutoIT_compiled_script
{
    meta:
        description = "Is an AutoIT compiled script"
        author = "Ivan Kwiatkowski (@JusticeRage)"
    strings:
        $a0 = "AutoIt Error" ascii wide
        $a1 = "reserved for AutoIt internal use" ascii wide
    condition:
        any of them
}
YARA Detection Rule: WMI_strings
Repository: Yara-Rules/rules
Detects: Accesses the WMI
Author: Ivan Kwiatkowski (@JusticeRage)

Pattern signatures:
// WMI namespaces which may be referenced in the ConnectServer call. All in the form of "ROOT\something"
        $a0 = /ROOT\\(CIMV2|AccessLogging|ADFS|aspnet|Cli|Hardware|interop|InventoryLogging|Microsoft.{10}|Policy|RSOP|SECURITY|ServiceModel|snmpStandardCimv2|subscription|virtualization|WebAdministration|WMI)/ nocase ascii wide

Detection condition:
any of them

Full rule:
rule WMI_strings
{
    meta:
        description = "Accesses the WMI"
        author = "Ivan Kwiatkowski (@JusticeRage)"
    strings:
        // WMI namespaces which may be referenced in the ConnectServer call. All in the form of "ROOT\something"
        $a0 = /ROOT\\(CIMV2|AccessLogging|ADFS|aspnet|Cli|Hardware|interop|InventoryLogging|Microsoft.{10}|Policy|RSOP|SECURITY|ServiceModel|snmpStandardCimv2|subscription|virtualization|WebAdministration|WMI)/ nocase ascii wide
    condition:
        any of them
}
YARA Detection Rule: Base64d_PE
Repository: Yara-Rules/rules
Detects: Contains a base64-encoded executable
Author: Florian Roth

Pattern signatures:
$s0 = "TVqQAAIAAAAEAA8A//8AALgAAAA" wide ascii
		$s1 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii

Detection condition:
any of them

Full rule:
rule Base64d_PE
{
	meta:
		description = "Contains a base64-encoded executable"
		author = "Florian Roth"
		date = "2017-04-21"
		
	strings:
		$s0 = "TVqQAAIAAAAEAA8A//8AALgAAAA" wide ascii
		$s1 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii
		
	condition:
		any of them
}
YARA Detection Rule: Misc_Suspicious_Strings
Repository: Yara-Rules/rules
Detects: Miscellaneous malware strings
Author: Ivan Kwiatkowski (@JusticeRage)

Pattern signatures:
$a0 = "backdoor" nocase ascii wide
        $a1 = "virus" nocase ascii wide fullword
        $a2 = "hack" nocase ascii wide fullword
        $a3 = "exploit" nocase ascii wide
        $a4 = "cmd.exe" nocase ascii wide
        $a5 = "CWSandbox" nocase wide ascii // Found in some Zeus/Citadel samples
        $a6 = "System32\\drivers\\etc\\hosts" nocase wide ascii

Detection condition:
any of them

Full rule:
rule Misc_Suspicious_Strings
{
    meta:
        description = "Miscellaneous malware strings"
        author = "Ivan Kwiatkowski (@JusticeRage)"
    strings:
        $a0 = "backdoor" nocase ascii wide
        $a1 = "virus" nocase ascii wide fullword
        $a2 = "hack" nocase ascii wide fullword
        $a3 = "exploit" nocase ascii wide
        $a4 = "cmd.exe" nocase ascii wide
        $a5 = "CWSandbox" nocase wide ascii // Found in some Zeus/Citadel samples
        $a6 = "System32\\drivers\\etc\\hosts" nocase wide ascii
    condition:
        any of them
}
YARA Detection Rule: BITS_CLSID
Repository: Yara-Rules/rules
Detects: References the BITS service.
Author: Ivan Kwiatkowski (@JusticeRage)

Pattern signatures:
$uuid_background_copy_manager_1_5 =     { 1F 77 87 F0 4F D7 1A 4C BB 8A E1 6A CA 91 24 EA }
        $uuid_background_copy_manager_2_0 =     { 12 AD 18 6D E3 BD 93 43 B3 11 09 9C 34 6E 6D F9 }
        $uuid_background_copy_manager_2_5 =     { D6 98 CA 03 5D FF B8 49 AB C6 03 DD 84 12 70 20 }
        $uuid_background_copy_manager_3_0 =     { A7 DE 9C 65 9E 48 D9 11 A9 CD 00 0D 56 96 52 51 }
        $uuid_background_copy_manager_4_0 =     { 6B F5 6D BB CE CA DC 11 99 92 00 19 B9 3A 3A 84 }
        $uuid_background_copy_manager_5_0 =     { 4C A3 CC 1E 8A E8 E3 44 8D 6A 89 21 BD E9 E4 52 }
        $uuid_background_copy_manager =         { 4B D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97 }
        $uuid_ibackground_copy_manager =        { 0D 4C E3 5C C9 0D 1F 4C 89 7C DA A1 B7 8C EE 7C }
        $uuid_background_copy_qmanager =        { 69 AD 4A EE 51 BE 43 9B A9 2C 86 AE 49 0E 8B 30 }
        $uuid_ibits_peer_cache_administration = { AD DE 9C 65 9E 48 D9 11 A9 CD 00 0D 56 96 52 51 }
        

Detection condition:
any of them

Full rule:
rule BITS_CLSID
{
    meta:
        description = "References the BITS service."
        author = "Ivan Kwiatkowski (@JusticeRage)"
        // The BITS service seems to be used heavily by EquationGroup.
    strings:
        $uuid_background_copy_manager_1_5 =     { 1F 77 87 F0 4F D7 1A 4C BB 8A E1 6A CA 91 24 EA }
        $uuid_background_copy_manager_2_0 =     { 12 AD 18 6D E3 BD 93 43 B3 11 09 9C 34 6E 6D F9 }
        $uuid_background_copy_manager_2_5 =     { D6 98 CA 03 5D FF B8 49 AB C6 03 DD 84 12 70 20 }
        $uuid_background_copy_manager_3_0 =     { A7 DE 9C 65 9E 48 D9 11 A9 CD 00 0D 56 96 52 51 }
        $uuid_background_copy_manager_4_0 =     { 6B F5 6D BB CE CA DC 11 99 92 00 19 B9 3A 3A 84 }
        $uuid_background_copy_manager_5_0 =     { 4C A3 CC 1E 8A E8 E3 44 8D 6A 89 21 BD E9 E4 52 }
        $uuid_background_copy_manager =         { 4B D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97 }
        $uuid_ibackground_copy_manager =        { 0D 4C E3 5C C9 0D 1F 4C 89 7C DA A1 B7 8C EE 7C }
        $uuid_background_copy_qmanager =        { 69 AD 4A EE 51 BE 43 9B A9 2C 86 AE 49 0E 8B 30 }
        $uuid_ibits_peer_cache_administration = { AD DE 9C 65 9E 48 D9 11 A9 CD 00 0D 56 96 52 51 }
        $uuid_background_copy_callback =        { C7 99 EA 97 86 01 D4 4A 8D F9 C5 B4 E0 ED 6B 22 }
    condition:
        any of them
}
YARA Detection Rule: HexEncodedTextPE
Repository: Yara-Rules/rules
Detects: Text string with hexadecimal encoded MZ/PE and comma+ separation
Author: Malware Utkonos
Reference: https://blog.reversinglabs.com/blog/rats-in-the-library

Pattern signatures:
$mz = /4D,.{0,6}5A/ nocase
        $pe = /50,.{0,6}45/

Detection condition:
all of them

Full rule:
rule HexEncodedTextPE
{
    meta:
        author = "Malware Utkonos"
        date = "2020-01-28"
        reference = "https://blog.reversinglabs.com/blog/rats-in-the-library"
        description = "Text string with hexadecimal encoded MZ/PE and comma+ separation"
    strings:
        $mz = /4D,.{0,6}5A/ nocase
        $pe = /50,.{0,6}45/
    condition:
        all of them
}
YARA Detection Rule: url
Repository: Yara-Rules/rules
Author: Antonio S. <asanchez@plutec.net>

Pattern signatures:
$url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/ wide ascii

Detection condition:
$url_regex

Full rule:
rule url {
    meta:
        author = "Antonio S. <asanchez@plutec.net>"
    strings:
        $url_regex = /https?:\/\/([\w\.-]+)([\/\w \.-]*)/ wide ascii
    condition:
        $url_regex
}
YARA Detection Rule: FE_PCAPs
Repository: Yara-Rules/rules
Detects: All pcaps uploaded to VT
Author: @abhinavbom

Pattern signatures:
$magic = {D4 C3 B2 A1}

Detection condition:
$magic at 0

Full rule:
rule FE_PCAPs
{
meta:
	author = "@abhinavbom"
	maltype = "NA"
	version = "0.1"
	description = "All pcaps uploaded to VT"
	date = "29/07/2015"
strings:
	$magic = {D4 C3 B2 A1}
condition:
	$magic at 0
}
YARA Detection Rule: pcap_positives
Repository: Yara-Rules/rules
Detects: All pcaps uploaded to VT with +3 detection rate
Author: @abhinavbom

Pattern signatures:
$magic = {D4 C3 B2 A1}

Detection condition:
$magic at 0 and positives > 3

Full rule:
rule pcap_positives
{
meta:
	author = "@abhinavbom"
	maltype = "NA"
	version = "0.1"
	description = "All pcaps uploaded to VT with +3 detection rate"
	date = "21/06/2015"
strings:
	$magic = {D4 C3 B2 A1}
condition:
	$magic at 0 and positives > 3
}
YARA Detection Rule: ek_submissions
Repository: Yara-Rules/rules
Detects: Detects pcaps uploaded to VT and matches IDS detections for Exploit kits
Author: @abhinavbom

Pattern signatures:
$magic = {D4 C3 B2 A1}

Detection condition:
$magic at 0 and tags contains "exploit-kit"

Full rule:
rule ek_submissions				
{
meta:
	author = "@abhinavbom"
	maltype = "NA"
	version = "0.1"
	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
	date = "23/06/2015"
strings:
	$magic = {D4 C3 B2 A1}
condition:
	$magic at 0 and tags contains "exploit-kit"
}
YARA Detection Rule: ek_submissions_2
Repository: Yara-Rules/rules
Detects: Detects pcaps uploaded to VT and matches IDS detections for Exploit kits
Author: @abhinavbom

Pattern signatures:
$magic = {D4 C3 B2 A1}

Detection condition:
$magic at 0 and tags contains "exploit-kit" and positives >3

Full rule:
rule ek_submissions_2				
{
meta:
	author = "@abhinavbom"
	maltype = "NA"
	version = "0.1"
	description = "Detects pcaps uploaded to VT and matches IDS detections for Exploit kits"
	date = "23/06/2015"
strings:
	$magic = {D4 C3 B2 A1}
condition:
	$magic at 0 and tags contains "exploit-kit" and positives >3
}
YARA Detection Rule: jRat
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$meta = "META-INF"
        $key = "key.dat"
        $conf = "config.dat"
 		$jra1 = "enc.dat"
		$jra2 = "a.class"
		$jra3 = "b.class"
		$jra4 = "c.class"
        $reClass1 = /[a-z]\.class/
        $reClass2 = /[a-z][a-f]\.class/

Detection condition:
($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*))

Full rule:
rule jRat
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/jRat"
		maltype = "Remote Access Trojan"
		filetype = "Java"

    strings:
        $meta = "META-INF"
        $key = "key.dat"
        $conf = "config.dat"
 		$jra1 = "enc.dat"
		$jra2 = "a.class"
		$jra3 = "b.class"
		$jra4 = "c.class"
        $reClass1 = /[a-z]\.class/
        $reClass2 = /[a-z][a-f]\.class/

    condition:
       ($meta and $key and $conf and #reClass1 > 10 and #reClass2 > 10) or ($meta and $key and all of ($jra*))
}
YARA Detection Rule: adWind
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$meta = "META-INF"
		$conf = "config.xml"
		$a = "Adwind.class"
		$b = "Principal.adwind"

Detection condition:
all of them

Full rule:
rule adWind
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/AAR"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$meta = "META-INF"
		$conf = "config.xml"
		$a = "Adwind.class"
		$b = "Principal.adwind"

	condition:
		all of them
}
YARA Detection Rule: Xtreme
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "XTREME" wide
		$b = "ServerStarted" wide
		$c = "XtremeKeylogger" wide
		$d = "x.html" wide
		$e = "Xtreme RAT" wide

Detection condition:
all of them

Full rule:
rule Xtreme
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Xtreme"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		ver = "2.9, 3.1, 3.2, 3.5"

	strings:
		$a = "XTREME" wide
		$b = "ServerStarted" wide
		$c = "XtremeKeylogger" wide
		$d = "x.html" wide
		$e = "Xtreme RAT" wide

	condition:
		all of them
}
YARA Detection Rule: LuxNet
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

Detection condition:
all of them

Full rule:
rule LuxNet
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/LuxNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

	condition:
		all of them
}
YARA Detection Rule: Adzok
Repository: kevthehermit/YaraRules
Detects: Adzok Rat
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
    $a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"

Detection condition:
7 of ($a*)

Full rule:
rule Adzok
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		Description = "Adzok Rat"
		Versions = "Free 1.0.0.3,"
		date = "2015/05"
		ref = "http://malwareconfig.com/stats/Adzok"
		maltype = "Remote Access Trojan"
		filetype = "jar"

	strings:
		$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
    $a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"
        
	condition:
    7 of ($a*)
}
YARA Detection Rule: Xena
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "HuntHTTPDownload"
		$b = "KuInstallation"
		$c = "PcnRawinput"
		$d = "untCMDList"
		$e = "%uWebcam"
		$f = "KACMConvertor"
		$g = "$VarUtils"
        $h = "****##"

Detection condition:
all of them

Full rule:
rule Xena
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2015/06"
		ref = "http://malwareconfig.com/stats/Xena"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "HuntHTTPDownload"
		$b = "KuInstallation"
		$c = "PcnRawinput"
		$d = "untCMDList"
		$e = "%uWebcam"
		$f = "KACMConvertor"
		$g = "$VarUtils"
        $h = "****##"

	condition:
		all of them
}
YARA Detection Rule: Infinity
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

Detection condition:
all of them

Full rule:
rule Infinity
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Infinity"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

	condition:
		all of them
}
YARA Detection Rule: NanoCore
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "NanoCore"
        $b = "ClientPlugin"
        $c = "ProjectData"
        $d = "DESCrypto"
        $e = "KeepAlive"
        $f = "IPNETROW"
        $g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
        $key = {43 6f 24 cb 95 30 38 39}

Detection condition:
6 of them

Full rule:
rule NanoCore
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/NanoCore"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "NanoCore"
        $b = "ClientPlugin"
        $c = "ProjectData"
        $d = "DESCrypto"
        $e = "KeepAlive"
        $f = "IPNETROW"
        $g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
        $key = {43 6f 24 cb 95 30 38 39}


    condition:
        6 of them
}
YARA Detection Rule: njRat
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
		$s2 = "netsh firewall add allowedprogram" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "yyyy-MM-dd" wide

		$v1 = "cmd.exe /k ping 0 & del" wide
		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide

Detection condition:
all of ($s*) and any of ($v*)

Full rule:
rule njRat
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/njRat"
		maltype = "Remote Access Trojan"
		filetype = "exe"
 
	strings:

		$s1 = {7C 00 27 00 7C 00 27 00 7C} // |'|'|
		$s2 = "netsh firewall add allowedprogram" wide
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$s4 = "yyyy-MM-dd" wide

		$v1 = "cmd.exe /k ping 0 & del" wide
		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide


	condition:
		all of ($s*) and any of ($v*)
}
YARA Detection Rule: BlackShades
Repository: kevthehermit/YaraRules
Malware family: blackshades
Author: Brian Wallace (@botnet_hunter)

Pattern signatures:
$string1 = "bss_server"
        $string2 = "txtChat"
        $string3 = "UDPFlood"

Detection condition:
all of them

Full rule:
rule BlackShades
{
    meta:
        author = "Brian Wallace (@botnet_hunter)"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/PoisonIvy"
        ref = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
        family = "blackshades"

    strings:
        $string1 = "bss_server"
        $string2 = "txtChat"
        $string3 = "UDPFlood"
    condition:
        all of them
}
YARA Detection Rule: Paradox
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

Detection condition:
all of them

Full rule:
rule Paradox
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Paradox"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

	condition:
		all of them
}
YARA Detection Rule: AlienSpy
Repository: kevthehermit/YaraRules
Author: Kevin Breen

Pattern signatures:
$PK = "PK"
        $MF = "META-INF/MANIFEST.MF"
    
        $a1 = "a.txt"
        $a2 = "b.txt"
        $a3 = "Main.class"
    
        $b1 = "ID"
        $b2 = "Main.class"
        $b3 = "plugins/Server.class"
    
        $c1 = "resource/password.txt"
        $c2 = "resource/server.dll"
    
        $d1 = "java/stubcito.opp"
        $d2 = "java/textito.isn"
    
        $e1 = "java/textito.text"
        $e2 = "java/resources.xsx"
    
        $f1 = "amarillo/asdasd.asd"
        $f2 = "amarillo/adqwdqwd.asdwf"

        $g1 = "config/config.perl"
        $g2 = "main/Start.class"
        
        $o1 = "config/config.ini"
        $o2 = "windows/windows.ini"
        $o3 = "components/linux.plsk"
        $o4 = "components/manifest.ini"
        $o5 = "components/mac.hwid"

Detection condition:
$PK at 0 and $MF and
        (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*) or all of ($e*) or all of ($f*) or all of ($g*) or any of ($o*))

Full rule:
rule AlienSpy
{
    meta:
        author = "Kevin Breen"
        ref = "http://malwareconfig.com/stats/AlienSpy"
        maltype = "Remote Access Trojan"
        filetype = "jar"

    strings:
        $PK = "PK"
        $MF = "META-INF/MANIFEST.MF"
    
        $a1 = "a.txt"
        $a2 = "b.txt"
        $a3 = "Main.class"
    
        $b1 = "ID"
        $b2 = "Main.class"
        $b3 = "plugins/Server.class"
    
        $c1 = "resource/password.txt"
        $c2 = "resource/server.dll"
    
        $d1 = "java/stubcito.opp"
        $d2 = "java/textito.isn"
    
        $e1 = "java/textito.text"
        $e2 = "java/resources.xsx"
    
        $f1 = "amarillo/asdasd.asd"
        $f2 = "amarillo/adqwdqwd.asdwf"

        $g1 = "config/config.perl"
        $g2 = "main/Start.class"
        
        $o1 = "config/config.ini"
        $o2 = "windows/windows.ini"
        $o3 = "components/linux.plsk"
        $o4 = "components/manifest.ini"
        $o5 = "components/mac.hwid"
        

    condition:
        $PK at 0 and $MF and
        (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*) or all of ($e*) or all of ($f*) or all of ($g*) or any of ($o*))
}
YARA Detection Rule: SpyGate
Repository: kevthehermit/YaraRules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$split = "abccba"
		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
		$a2 = "StubX.pdb" 
		$a3 = "abccbaDanabccb"
		$b1 = "monikerString" nocase //$b = Version 2.0
		$b2 = "virustotal1"
		$b3 = "get_CurrentDomain"
		$c1 = "shutdowncomputer" wide //$c = Version 2.9
		$c2 = "shutdown -r -t 00" wide
		$c3 = "set cdaudio door closed" wide
		$c4 = "FileManagerSplit" wide
		$c5 = "Chating With >> [~Hacker~]" wide

Detection condition:
(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))

Full rule:
rule SpyGate
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/SpyGate"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$split = "abccba"
		$a1 = "abccbaSpyGateRATabccba" //$a = Version 0.2.6
		$a2 = "StubX.pdb" 
		$a3 = "abccbaDanabccb"
		$b1 = "monikerString" nocase //$b = Version 2.0
		$b2 = "virustotal1"
		$b3 = "get_CurrentDomain"
		$c1 = "shutdowncomputer" wide //$c = Version 2.9
		$c2 = "shutdown -r -t 00" wide
		$c3 = "set cdaudio door closed" wide
		$c4 = "FileManagerSplit" wide
		$c5 = "Chating With >> [~Hacker~]" wide

	condition:
		(all of ($a*) and #split > 40) or (all of ($b*) and #split > 10) or (all of ($c*))
}