deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FakeM_Generic
Repository: Yara-Rules/rules
Detects: Detects FakeM malware samples
Author: Florian Roth
Reference: http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/

Pattern signatures:
$a1 = "\\system32\\kernel32.dll" fullword ascii
		$a2 = "\\boot.lnk" fullword ascii
		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */

		$b1 = "Wizard.EXE" fullword wide
		$b2 = "CommandLineA" fullword ascii

		$c1 = "\\system32\\kernel32.dll" fullword ascii
		$c2 = "\\aapz.tmp" fullword ascii

		$e1 = "C:\\Documents and Settings\\A\\" fullword ascii
		$e2 = "\\svchost.exe" fullword ascii
		$e3 = "\\Perform\\Release\\Perform.pdb" fullword ascii

		$f1 = "Browser.EXE" fullword wide
		$f2 = "\\browser.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and
		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )

Full rule:
rule FakeM_Generic {
	meta:
		description = "Detects FakeM malware samples"
		author = "Florian Roth"
		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
		date = "2016-01-25"
		score = 85
		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
		hash6 = "12dedcdda853da[PII_REDACTED]e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
		hash10 = "53cecc0d0f6924eacd23c49d0d95a[PII_REDACTED]fbbe2356778feb8dd396d723e"
		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
	strings:
		$a1 = "\\system32\\kernel32.dll" fullword ascii
		$a2 = "\\boot.lnk" fullword ascii
		$a3 = "%USERPROFILE%" fullword ascii /* Goodware String - occured 16 times */

		$b1 = "Wizard.EXE" fullword wide
		$b2 = "CommandLineA" fullword ascii

		$c1 = "\\system32\\kernel32.dll" fullword ascii
		$c2 = "\\aapz.tmp" fullword ascii

		$e1 = "C:\\Documents and Settings\\A\\" fullword ascii
		$e2 = "\\svchost.exe" fullword ascii
		$e3 = "\\Perform\\Release\\Perform.pdb" fullword ascii

		$f1 = "Browser.EXE" fullword wide
		$f2 = "\\browser.exe" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and
		( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*) )
}
YARA Detection Rule: Generic_ATMPot
Repository: Yara-Rules/rules
Detects: Generic rule for Winpot aka ATMPot
Author: xylitol@temari.fr
Reference: https://securelist.com/atm-robber-winpot/89611/

Pattern signatures:
$api1 = "CSCCNG" ascii wide
        $api2 = "CscCngOpen" ascii wide
        $api3 = "CscCngClose" ascii wide
        $string1 = "%d,%02d;" ascii wide
/*
0xD:
.text:004022EC FF 15 20 70 40 00             CALL DWORD PTR DS:[407020]  ; cscwcng.CscCngDispense
.text:004022F2 F6 C4 80                      TEST AH,80
winpot:
.text:004019D4 FF 15 24 60 40 00             CALL DWORD PTR DS:[406024]  ; cscwcng.CscCngDispense
.text:004019DA F6 C4 80                      TEST AH,80
*/
        $hex1 = { FF 15 ?? ?? ?? ?? F6 C4 80 }
/*
0xD...: 0040506E  25 31 5B 31 2D 34 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D: %1[1-4]VAL=%8[0-9]
winpot: 0040404D  25 31 5B 30 2D 39 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D: %1[0-9]VAL=%8[0-9]
*/
        $hex2 = { 25 31 5B ?? 2D ?? 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D }

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule Generic_ATMPot : Generic_ATMPot
{
    meta:
        description = "Generic rule for Winpot aka ATMPot"
        author = "xylitol@temari.fr"
        date = "2019-02-24"
        reference = "https://securelist.com/atm-robber-winpot/89611/"
        // May only the challenge guide you
    strings:
        $api1 = "CSCCNG" ascii wide
        $api2 = "CscCngOpen" ascii wide
        $api3 = "CscCngClose" ascii wide
        $string1 = "%d,%02d;" ascii wide
/*
0xD:
.text:004022EC FF 15 20 70 40 00             CALL DWORD PTR DS:[407020]  ; cscwcng.CscCngDispense
.text:004022F2 F6 C4 80                      TEST AH,80
winpot:
.text:004019D4 FF 15 24 60 40 00             CALL DWORD PTR DS:[406024]  ; cscwcng.CscCngDispense
.text:004019DA F6 C4 80                      TEST AH,80
*/
        $hex1 = { FF 15 ?? ?? ?? ?? F6 C4 80 }
/*
0xD...: 0040506E  25 31 5B 31 2D 34 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D: %1[1-4]VAL=%8[0-9]
winpot: 0040404D  25 31 5B 30 2D 39 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D: %1[0-9]VAL=%8[0-9]
*/
        $hex2 = { 25 31 5B ?? 2D ?? 5D 56 41 4C 3D 25 38 5B 30 2D 39 5D }
    condition:  
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: FUDCrypter
Repository: Yara-Rules/rules
Detects: Detects unmodified FUDCrypt samples
Author: https://github.com/hwvs
Reference: https://github.com/gigajew/FudCrypt/

Pattern signatures:
$ = "OcYjzPUtJkNbLOABqYvNbvhZf" wide ascii
        $ = "gwiXxyIDDtoYzgMSRGMckRbJi" wide ascii
        $ = "BclWgISTcaGjnwrzSCIuKruKm" wide ascii
        $ = "CJyUSiUNrIVbgksjxpAMUkAJJ" wide ascii
        $ = "fAMVdoPUEyHEWdxQIEJPRYbEN" wide ascii
        $ = "CIGQUctdcUPqUjoucmcoffECY" wide ascii
        $ = "wcZfHOgetgAExzSoWFJFQdAyO" wide ascii
        $ = "DqYKDnIoLeZDWYlQWoxZnpfPR" wide ascii
        $ = "MkhMoOHCbGUMqtnRDJKnBYnOj" wide ascii
        $ = "sHEqLMGglkBAOIUfcSAgMvZfs" wide ascii
        $ = "JtZApJhbFAIFxzHLjjyEQvtgd" wide ascii
        $ = "IIQrSWZEMmoQIKGuxxwoTwXka" wide ascii

Detection condition:
1 of them

Full rule:
rule FUDCrypter
{
    meta:
        description = "Detects unmodified FUDCrypt samples"
        reference = "https://github.com/gigajew/FudCrypt/"
        author = "https://github.com/hwvs"
        last_modified = "2019-11-21"

    strings:
        $ = "OcYjzPUtJkNbLOABqYvNbvhZf" wide ascii
        $ = "gwiXxyIDDtoYzgMSRGMckRbJi" wide ascii
        $ = "BclWgISTcaGjnwrzSCIuKruKm" wide ascii
        $ = "CJyUSiUNrIVbgksjxpAMUkAJJ" wide ascii
        $ = "fAMVdoPUEyHEWdxQIEJPRYbEN" wide ascii
        $ = "CIGQUctdcUPqUjoucmcoffECY" wide ascii
        $ = "wcZfHOgetgAExzSoWFJFQdAyO" wide ascii
        $ = "DqYKDnIoLeZDWYlQWoxZnpfPR" wide ascii
        $ = "MkhMoOHCbGUMqtnRDJKnBYnOj" wide ascii
        $ = "sHEqLMGglkBAOIUfcSAgMvZfs" wide ascii
        $ = "JtZApJhbFAIFxzHLjjyEQvtgd" wide ascii
        $ = "IIQrSWZEMmoQIKGuxxwoTwXka" wide ascii

    condition:
        1 of them
}
YARA Detection Rule: PoetRat_Python
Repository: Yara-Rules/rules
Detects: A yara rule to catch PoetRat python scripts
Author: Nishan Maharjan

Pattern signatures:
// Any of the strings that stand out in the files, these are for the multiple python files, not just for a single file
        $encrptionFunction = "Affine"
        $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
        $domain = "dellgenius.hopto.org"
        $grammer_massacre = /BADD|Bad Error Happened|/
        $mayBePresent = /self\.DIE|THE_GUID_KEY/
        $pipe_out = "Abibliophobia23"
        $shot = "shot_{0}_{1}.png"

Detection condition:
3 of them

Full rule:
rule PoetRat_Python
{
    meta:
        Author = "Nishan Maharjan"
        Description = "A yara rule to catch PoetRat python scripts"
        Data = "6th May 2020"
    strings:

        // Any of the strings that stand out in the files, these are for the multiple python files, not just for a single file
        $encrptionFunction = "Affine"
        $commands = /version|ls|cd|sysinfo|download|upload|shot|cp|mv|link|register|hid|compress|jobs|exit|tasklist|taskkill/
        $domain = "dellgenius.hopto.org"
        $grammer_massacre = /BADD|Bad Error Happened|/
        $mayBePresent = /self\.DIE|THE_GUID_KEY/
        $pipe_out = "Abibliophobia23"
        $shot = "shot_{0}_{1}.png"
    condition:
        3 of them        
}
YARA Detection Rule: Win32OPCHavex
Repository: Yara-Rules/rules
Detects: Rule for identifying OPC version of HAVEX
Author: BAE Systems
Reference: www.f-secure.com/weblog/archives/00002718.html

Pattern signatures:
$mzhdr = "MZ"
        $dll = "7CFC52CD3F87.dll"
        $a1 = "Start finging of LAN hosts..." wide
        $a2 = "Finding was fault. Unexpective error" wide
        $a3 = "Was found %i hosts in LAN:" wide
        $a4 = "Hosts was't found." wide
        $a5 = "Start finging of OPC Servers..." wide
        $a6 = "Was found %i OPC Servers." wide
        $a7 = "OPC Servers not found. Programm finished" wide
        $a8 = "%s[%s]!!!EXEPTION %i!!!" wide
        $a9 = "Start finging of OPC Tags..." wide

Detection condition:
$mzhdr at 0 and ($dll or (any of ($a*)))

Full rule:
rule Win32OPCHavex
{
    meta:
        Author      = "BAE Systems"
        Date        = "2014/06/23"
        Description = "Rule for identifying OPC version of HAVEX"
        Reference   = "www.f-secure.com/weblog/archives/00002718.html"

    strings:
        $mzhdr = "MZ"
        $dll = "7CFC52CD3F87.dll"
        $a1 = "Start finging of LAN hosts..." wide
        $a2 = "Finding was fault. Unexpective error" wide
        $a3 = "Was found %i hosts in LAN:" wide
        $a4 = "Hosts was't found." wide
        $a5 = "Start finging of OPC Servers..." wide
        $a6 = "Was found %i OPC Servers." wide
        $a7 = "OPC Servers not found. Programm finished" wide
        $a8 = "%s[%s]!!!EXEPTION %i!!!" wide
        $a9 = "Start finging of OPC Tags..." wide

    condition:
        $mzhdr at 0 and ($dll or (any of ($a*)))
}
YARA Detection Rule: Win32FertgerHavex
Repository: Yara-Rules/rules
Detects: Rule for identifying Fertger version of HAVEX
Author: BAE Systems
Reference: www.f-secure.com/weblog/archives/00002718.html

Pattern signatures:
$mz = "MZ"
        $a1="\\\\.\\pipe\\mypipe-f" wide
        $a2="\\\\.\\pipe\\mypipe-h" wide
        $a3="\\qln.dbx" wide
        $a4="*.yls" wide
        $a5="\\*.xmd" wide
        $a6="fertger" wide
        $a7="havex"

Detection condition:
$mz at 0 and 3 of ($a*)

Full rule:
rule Win32FertgerHavex
{
    meta:
        Author      = "BAE Systems"
        Date        = "2014/06/23"
        Description = "Rule for identifying Fertger version of HAVEX"
        Reference   = "www.f-secure.com/weblog/archives/00002718.html"

    strings:
        $mz = "MZ"
        $a1="\\\\.\\pipe\\mypipe-f" wide
        $a2="\\\\.\\pipe\\mypipe-h" wide
        $a3="\\qln.dbx" wide
        $a4="*.yls" wide
        $a5="\\*.xmd" wide
        $a6="fertger" wide
        $a7="havex"
    
    condition:
        $mz at 0 and 3 of ($a*) 
}
YARA Detection Rule: Havex_Trojan_PHP_Server
Repository: Yara-Rules/rules
Detects: Detects the PHP server component of the Havex RAT
Author: Florian Roth
Reference: www.f-secure.com/weblog/archives/00002718.html

Pattern signatures:
$s1 = "havex--></body></head>"
        $s2 = "ANSWERTAG_START"
        $s3 = "PATH_BLOCKFILE"

Detection condition:
all of them

Full rule:
rule Havex_Trojan_PHP_Server
{
    meta:
        Author      = "Florian Roth"
        Date        = "2014/06/24"
        Description = "Detects the PHP server component of the Havex RAT"
        Reference   = "www.f-secure.com/weblog/archives/00002718.html"

    strings:
        $s1 = "havex--></body></head>"
        $s2 = "ANSWERTAG_START"
        $s3 = "PATH_BLOCKFILE"

    condition:
        all of them
}
YARA Detection Rule: SANS_ICS_Cybersecurity_Challenge_400_Havex_Memdump
Repository: Yara-Rules/rules
Detects: Detects Havex Windows process executable from memory dump
Author: Chris Sistrunk

Pattern signatures:
$magic = { 4d 5a }	
	
	        $s1 = "~tracedscn.yls" fullword wide
		$s2 = "[!]Start" fullword wide
		$s3 = "[+]Get WSADATA" fullword wide
		$s4 = "[-]Can not get local ip" fullword wide
		$s5 = "[+]Local:" fullword wide
		$s6 = "[-]Threads number > Hosts number" fullword wide
		$s7 = "[-]Connection error" fullword wide
		
		$x1 = "bddd4e2b84fa2ad61eb065e7797270ff.exe" fullword wide

Detection condition:
$magic at 0 and ( 3 of ($s*) or $x1 )

Full rule:
rule SANS_ICS_Cybersecurity_Challenge_400_Havex_Memdump : memory
	{
	meta:
		description = "Detects Havex Windows process executable from memory dump"
		date = "2015-12-2"
		author = "Chris Sistrunk"
		hash = "8065674de8d79d1c0e7b3baf81246e7d"
	strings:
		$magic = { 4d 5a }	
	
	        $s1 = "~tracedscn.yls" fullword wide
		$s2 = "[!]Start" fullword wide
		$s3 = "[+]Get WSADATA" fullword wide
		$s4 = "[-]Can not get local ip" fullword wide
		$s5 = "[+]Local:" fullword wide
		$s6 = "[-]Threads number > Hosts number" fullword wide
		$s7 = "[-]Connection error" fullword wide
		
		$x1 = "bddd4e2b84fa2ad61eb065e7797270ff.exe" fullword wide
	condition:
	    $magic at 0 and ( 3 of ($s*) or $x1 )
}
YARA Detection Rule: RegSubDatCode
Repository: Yara-Rules/rules
Detects: RegSubDat code features
Author: Seth Hardy

Pattern signatures:
// decryption loop
        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
        // push then pop values
        $ = { 68 FF FF 7F 00 5? }
        $ = { 68 FF 7F 00 00 5? }

Detection condition:
all of them

Full rule:
rule RegSubDatCode : RegSubDat Family 
{
    meta:
        description = "RegSubDat code features"
        author = "Seth Hardy"
        last_modified = "2014-07-14"
    
    strings:
        // decryption loop
        $ = { 80 34 3? 99 40 (3D FB 65 00 00 | 3B C6) 7? F? }
        // push then pop values
        $ = { 68 FF FF 7F 00 5? }
        $ = { 68 FF 7F 00 00 5? }
    
    condition:
        all of them
}
YARA Detection Rule: RegSubDatStrings
Repository: Yara-Rules/rules
Detects: RegSubDat Identifying Strings
Author: Seth Hardy

Pattern signatures:
$avg1 = "Button"
        $avg2 = "Allow"
        $avg3 = "Identity Protection"
        $avg4 = "Allow for all"
        $avg5 = "AVG Firewall Asks For Confirmation"
        $mutex = "0x1A7B4C9F"

Detection condition:
all of ($avg*) or $mutex

Full rule:
rule RegSubDatStrings : RegSubDat Family
{
    meta:
        description = "RegSubDat Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-14"
        
    strings:
        $avg1 = "Button"
        $avg2 = "Allow"
        $avg3 = "Identity Protection"
        $avg4 = "Allow for all"
        $avg5 = "AVG Firewall Asks For Confirmation"
        $mutex = "0x1A7B4C9F"
        
    condition:
       all of ($avg*) or $mutex
}
YARA Detection Rule: RegSubDat
Repository: Yara-Rules/rules
Detects: RegSubDat
Author: Seth Hardy

Detection condition:
RegSubDatCode or RegSubDatStrings

Full rule:
rule RegSubDat : Family
{
    meta:
        description = "RegSubDat"
        author = "Seth Hardy"
        last_modified = "2014-07-14"
        
    condition:
        RegSubDatCode or RegSubDatStrings
}
YARA Detection Rule: poisonivy_1
Repository: Yara-Rules/rules
Detects: Poison Ivy
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C }

Detection condition:
$a

Full rule:
rule poisonivy_1 : rat
{
	meta:
		description = "Poison Ivy"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0" 
		ref1 = "https://code.google.com/p/volatility/source/browse/trunk/contrib/plugins/malware/poisonivy.py"

	strings:
		$a = { 53 74 75 62 50 61 74 68 ?? 53 4F 46 54 57 41 52 45 5C 43 6C 61 73 73 65 73 5C 68 74 74 70 5C 73 68 65 6C 6C 5C 6F 70 65 6E 5C 63 6F 6D 6D 61 6E 64 [22] 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 41 63 74 69 76 65 20 53 65 74 75 70 5C 49 6E 73 74 61 6C 6C 65 64 20 43 6F 6D 70 6F 6E 65 6E 74 73 5C } 
		
	condition:
		$a
}
YARA Detection Rule: PoisonIvy_Generic_3
Repository: Yara-Rules/rules
Detects: PoisonIvy RAT Generic Rule
Author: Florian Roth

Pattern signatures:
$k1 = "Tiger324{" fullword ascii
		
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and
			( 
				$k1 or all of ($s*) or all of ($h*)
			)

Full rule:
rule PoisonIvy_Generic_3 {
	meta:
		description = "PoisonIvy RAT Generic Rule"
		author = "Florian Roth"
		date = "2015-05-14"
		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
	strings:
		$k1 = "Tiger324{" fullword ascii
		
		$s2 = "WININET.dll" fullword ascii
		$s3 = "mscoree.dll" fullword wide
		$s4 = "WS2_32.dll" fullword
		$s5 = "Explorer.exe" fullword wide
		$s6 = "USER32.DLL"
		$s7 = "CONOUT$"
		$s8 = "login.asp"
		
		$h1 = "HTTP/1.0"
		$h2 = "POST"
		$h3 = "login.asp"
		$h4 = "check.asp"
		$h5 = "result.asp"
		$h6 = "upload.asp"
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and
			( 
				$k1 or all of ($s*) or all of ($h*)
			)
}
YARA Detection Rule: PoisonIvy_2
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
        $string1 = "CONNECT %s:%i HTTP/1.0"
        $string2 = "ws2_32"
        $string3 = "cks=u"
        $string4 = "thj@h"
        $string5 = "advpack"

Detection condition:
$stub at 0x1620 and all of ($string*) or (all of them)

Full rule:
rule PoisonIvy_2
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/PoisonIvy"
		maltype = "Remote Access Trojan"
		filetype = "exe"

    strings:
    	$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
        $string1 = "CONNECT %s:%i HTTP/1.0"
        $string2 = "ws2_32"
        $string3 = "cks=u"
        $string4 = "thj@h"
        $string5 = "advpack"
    condition:
		$stub at 0x1620 and all of ($string*) or (all of them)
}
YARA Detection Rule: marap
Repository: Yara-Rules/rules
Author:  J from THL <j@techhelplist.com>

Pattern signatures:
$text01 = "%02X-%02X-%02X-%02X-%02X-%02X" wide
        $text02 = "%s, base=0x%p" wide
        $text03 = "pid=%d" wide
        $text04 = "%s %s" wide
        $text05 = "%d|%d|%s|%s|%s" wide
        $text06 = "%s|1|%d|%d|%d|%d|%d|%s" wide
        $text07 = "%d#%s#%s#%s#%d#%s#%s#%d#%s#%s#%s#%s#%d" wide
        $text08 = "%s|1|%d|%d|%d|%d|%d|%s#%s#%s#%s#%d#%d#%d" wide
        $text09 = "%s|0|%d" wide
        $text10 = "%llx" wide
        $text11 = "%s -a" wide

Detection condition:
7 of them

Full rule:
rule marap 
{

    meta:
        author = " J from THL <j@techhelplist.com>"
        date = "2018-08-19"
        reference1 = "https://www.virustotal.com/#/file/61dfc4d535d86359c2f09dbdd8f14c0a2e6367e5bb7377812f323a94d32341ba/detection"
        reference2 = "https://www.virustotal.com/#/file/c0c85f93a4f425a23c2659dce11e3b1c8b9353b566751b32fcb76b3d8b723b94/detection"
        reference3 = "https://threatpost.com/highly-flexible-marap-malware-enters-the-financial-scene/136623/"
        reference4 = "https://www.bleepingcomputer.com/news/security/necurs-botnet-pushing-new-marap-malware/"
        version = 1
        maltype = "Downloader"
        filetype = "memory"

    strings:
        $text01 = "%02X-%02X-%02X-%02X-%02X-%02X" wide
        $text02 = "%s, base=0x%p" wide
        $text03 = "pid=%d" wide
        $text04 = "%s %s" wide
        $text05 = "%d|%d|%s|%s|%s" wide
        $text06 = "%s|1|%d|%d|%d|%d|%d|%s" wide
        $text07 = "%d#%s#%s#%s#%d#%s#%s#%d#%s#%s#%s#%s#%d" wide
        $text08 = "%s|1|%d|%d|%d|%d|%d|%s#%s#%s#%s#%d#%d#%d" wide
        $text09 = "%s|0|%d" wide
        $text10 = "%llx" wide
        $text11 = "%s -a" wide

    condition:
        7 of them
}
YARA Detection Rule: PE_File_pyinstaller
Repository: Yara-Rules/rules
Detects: Detect PE file produced by pyinstaller
Author: Didier Stevens (https://DidierStevens.com)
Reference: https://isc.sans.edu/diary/21057

Pattern signatures:
$a = "pyi-windows-manifest-filename"

Detection condition:
pe.number_of_resources > 0 and $a

Full rule:
rule PE_File_pyinstaller
{
    meta:
        author = "Didier Stevens (https://DidierStevens.com)"
        description = "Detect PE file produced by pyinstaller"
        reference = "https://isc.sans.edu/diary/21057"
    strings:
        $a = "pyi-windows-manifest-filename"
    condition:
        pe.number_of_resources > 0 and $a
}
YARA Detection Rule: Powerkatz_DLL_Generic
Repository: Yara-Rules/rules
Detects: Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Author: Florian Roth
Reference: PowerKatz Analysis

Pattern signatures:
$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
		$s2 = "%*s  pPublicKey         : " fullword wide
		$s3 = "ad_hoc_network_formed" fullword wide
		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
		$s5 = "\\*.kirbi" fullword wide

		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them

Full rule:
rule Powerkatz_DLL_Generic {
	meta:
		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
		author = "Florian Roth"
		reference = "PowerKatz Analysis"
		date = "2016-02-05"
		super_rule = 1
		score = 80
		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
	strings:
		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
		$s2 = "%*s  pPublicKey         : " fullword wide
		$s3 = "ad_hoc_network_formed" fullword wide
		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
		$s5 = "\\*.kirbi" fullword wide

		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or 2 of them
}