deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Agenttesla_type1
Repository: Yara-Rules/rules
Detects: detect Agenttesla in memory
Author: JPCERT/CC Incident Response Group
Reference: internal research

Pattern signatures:
$iestr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\IELibrary\\\\IELibrary\\\\obj\\\\Debug\\\\IELibrary.pdb"
            $atstr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\ConsoleApp1\\\\ConsoleApp1\\\\obj\\\\Debug\\\\ConsoleApp1.pdb"
            $sqlitestr = "Not a valid SQLite 3 Database File" wide

Detection condition:
all of them

Full rule:
rule Agenttesla_type1 {
          meta:
            description = "detect Agenttesla in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"

          strings:
            $iestr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\IELibrary\\\\IELibrary\\\\obj\\\\Debug\\\\IELibrary.pdb"
            $atstr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\ConsoleApp1\\\\ConsoleApp1\\\\obj\\\\Debug\\\\ConsoleApp1.pdb"
            $sqlitestr = "Not a valid SQLite 3 Database File" wide
          condition: all of them
}
YARA Detection Rule: Agenttesla_type2
Repository: Yara-Rules/rules
Detects: detect Agenttesla in memory
Author: JPCERT/CC Incident Response Group
Reference: internal research

Pattern signatures:
$type2db1 = "1.85 (Hash, version 2, native byte-order)" wide
            $type2db2 = "Unknow database format" wide
            $type2db3 = "SQLite format 3" wide

Detection condition:
all of them

Full rule:
rule Agenttesla_type2 {
          meta:
            description = "detect Agenttesla in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "internal research"
            hash1 = "670a00c65eb6f7c48c1e961068a1cb7fd3653bd29377161cd04bf15c9d010da2 "

          strings:
            $type2db1 = "1.85 (Hash, version 2, native byte-order)" wide
            $type2db2 = "Unknow database format" wide
            $type2db3 = "SQLite format 3" wide
          condition: all of them
}
YARA Detection Rule: Noderat
Repository: Yara-Rules/rules
Detects: detect Noderat in memory
Author: JPCERT/CC Incident Response Group
Reference: https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html

Pattern signatures:
$config = "/config/app.json"
            $key = "/config/.regeditKey.rc"
            $message = "uninstall error when readFileSync: "

Detection condition:
all of them

Full rule:
rule Noderat {
          meta:
            description = "detect Noderat in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"

          strings:
            $config = "/config/app.json"
            $key = "/config/.regeditKey.rc"
            $message = "uninstall error when readFileSync: "

          condition: all of them
}
YARA Detection Rule: Njrat2
Repository: Yara-Rules/rules
Detects: detect njRAT in memory
Author: JPCERT/CC Incident Response Group

Pattern signatures:
$reg = "SEE_MASK_NOZONECHECKS" wide fullword
            $msg = "Execute ERROR" wide fullword
            $ping = "cmd.exe /c ping 0 -n 2 & del" wide fullword

Detection condition:
all of them

Full rule:
rule Njrat2 {
          meta:
            description = "detect njRAT in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "d5f63213ce[PII_REDACTED]b0e9b0d1b68d55f7727758ec8c120e370699a41379d"

          strings:
            $reg = "SEE_MASK_NOZONECHECKS" wide fullword
            $msg = "Execute ERROR" wide fullword
            $ping = "cmd.exe /c ping 0 -n 2 & del" wide fullword
          condition: all of them
}
YARA Detection Rule: Trickbot
Repository: Yara-Rules/rules
Detects: detect TrickBot in memory
Author: JPCERT/CC Incident Response Group

Pattern signatures:
$tagm1 = "<mcconf><ver>" wide
            $tagm2 = "</autorun></mcconf>" wide
            $tagc1 = "<moduleconfig><autostart>" wide
            $tagc2 = "</autoconf></moduleconfig>" wide
            $tagi1 = "<igroup><dinj>" wide
            $tagi2 = "</dinj></igroup>" wide
            $tags1 = "<servconf><expir>" wide
            $tags2 = "</plugins></servconf>" wide
            $tagl1 = "<slist><sinj>" wide
            $tagl2 = "</sinj></slist>" wide

Detection condition:
all of ($tagm*) or all of ($tagc*) or all of ($tagi*) or all of ($tags*) or all of ($tagl*)

Full rule:
rule Trickbot {
          meta:
            description = "detect TrickBot in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "2153be5c6f73f4816d90809febf4122a7b065cbfddaa4e2bf[PII_REDACTED]af34c"

          strings:
            $tagm1 = "<mcconf><ver>" wide
            $tagm2 = "</autorun></mcconf>" wide
            $tagc1 = "<moduleconfig><autostart>" wide
            $tagc2 = "</autoconf></moduleconfig>" wide
            $tagi1 = "<igroup><dinj>" wide
            $tagi2 = "</dinj></igroup>" wide
            $tags1 = "<servconf><expir>" wide
            $tags2 = "</plugins></servconf>" wide
            $tagl1 = "<slist><sinj>" wide
            $tagl2 = "</sinj></slist>" wide
          condition: all of ($tagm*) or all of ($tagc*) or all of ($tagi*) or all of ($tags*) or all of ($tagl*)
}
YARA Detection Rule: Remcos
Repository: Yara-Rules/rules
Detects: detect Remcos in memory
Author: JPCERT/CC Incident Response Group

Pattern signatures:
$remcos = "Remcos" ascii fullword
            $url = "Breaking-Security.Net" ascii fullword
            $resource = "SETTINGS" wide fullword

Detection condition:
all of them

Full rule:
rule Remcos {
          meta:
            description = "detect Remcos in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5"

          strings:
            $remcos = "Remcos" ascii fullword
            $url = "Breaking-Security.Net" ascii fullword
            $resource = "SETTINGS" wide fullword
          condition:  all of them
}
YARA Detection Rule: Quasar
Repository: Yara-Rules/rules
Detects: detect Remcos in memory
Author: JPCERT/CC Incident Response Group

Pattern signatures:
$quasarstr1 = "Client.exe" wide
            $quasarstr2 = "({0}:{1}:{2})" wide
            $class = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 80 }

Detection condition:
all of them

Full rule:
rule Quasar {
          meta:
            description = "detect Remcos in memory"
            author = "JPCERT/CC Incident Response Group"
            rule_usage = "memory scan"
            hash1 = "390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724"

          strings:
            $quasarstr1 = "Client.exe" wide
            $quasarstr2 = "({0}:{1}:{2})" wide
            $class = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 80 }
          condition: all of them
}
YARA Detection Rule: APT_WIN_Gh0st_ver
Repository: Yara-Rules/rules
Author: @BryanNolen

Pattern signatures:
$library = "deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly"
   $capability = "GetClipboardData"
   $capability1 = "capCreateCaptureWindowA"
   $capability2 = "CreateRemoteThread"
   $capability3 = "WriteProcessMemory"
   $capability4 = "LsaRetrievePrivateData"
   $capability5 = "AdjustTokenPrivileges"
   $function = "ResetSSDT"
   $window = "WinSta0\\Default"
   $magic = {47 6C 6F 62 61 6C 5C [5-9] 20 25 64}    /* $magic = "Gh0st" */

Detection condition:
all of them

Full rule:
rule APT_WIN_Gh0st_ver : RAT
{
meta:
   author = "@BryanNolen"
   date = "2012-12"
   type = "APT"
   version = "1.1"
   ref = "Detection of Gh0st RAT server DLL component"
   ref1 = "http://www.mcafee.com/au/resources/white-papers/foundstone/wp-know-your-digital-enemy.pdf"
 strings:  
   $library = "deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly"
   $capability = "GetClipboardData"
   $capability1 = "capCreateCaptureWindowA"
   $capability2 = "CreateRemoteThread"
   $capability3 = "WriteProcessMemory"
   $capability4 = "LsaRetrievePrivateData"
   $capability5 = "AdjustTokenPrivileges"
   $function = "ResetSSDT"
   $window = "WinSta0\\Default"
   $magic = {47 6C 6F 62 61 6C 5C [5-9] 20 25 64}    /* $magic = "Gh0st" */
 condition:
   all of them
}
YARA Detection Rule: Gh0st
Repository: Yara-Rules/rules
Detects: Gh0st
Author: botherder https://github.com/botherder

Pattern signatures:
$ = /(G)host/
        $ = /(i)nflate 1\.1\.4 Copyright 1995-2002 Mark Adler/
        $ = /(d)eflate 1\.1\.4 Copyright 1995-2002 Jean-loup Gailly/
        $ = /(%)s\\shell\\open\\command/
        $ = /(G)etClipboardData/
        $ = /(W)riteProcessMemory/
        $ = /(A)djustTokenPrivileges/
        $ = /(W)inSta0\\Default/
        $ = /(#)32770/
        $ = /(#)32771/
        $ = /(#)32772/
        $ = /(#)32774/

Detection condition:
all of them

Full rule:
rule Gh0st : RAT
{
    meta:
        description = "Gh0st"
	author = "botherder https://github.com/botherder"

    strings:
        $ = /(G)host/
        $ = /(i)nflate 1\.1\.4 Copyright 1995-2002 Mark Adler/
        $ = /(d)eflate 1\.1\.4 Copyright 1995-2002 Jean-loup Gailly/
        $ = /(%)s\\shell\\open\\command/
        $ = /(G)etClipboardData/
        $ = /(W)riteProcessMemory/
        $ = /(A)djustTokenPrivileges/
        $ = /(W)inSta0\\Default/
        $ = /(#)32770/
        $ = /(#)32771/
        $ = /(#)32772/
        $ = /(#)32774/

    condition:
        all of them
}
YARA Detection Rule: gh0st
Repository: Yara-Rules/rules
Author: https://github.com/jackcr/

Pattern signatures:
$a = { 47 68 30 73 74 ?? ?? ?? ?? ?? ?? ?? ?? 78 9C }
      $b = "Gh0st Update"

Detection condition:
any of them

Full rule:
rule gh0st

{

meta:
	author = "https://github.com/jackcr/"

   strings:
      $a = { 47 68 30 73 74 ?? ?? ?? ?? ?? ?? ?? ?? 78 9C }
      $b = "Gh0st Update"

   condition:
      any of them

}
YARA Detection Rule: YayihCode
Repository: Yara-Rules/rules
Detects: Yayih code features
Author: Seth Hardy

Pattern signatures:
//  encryption
        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }

Detection condition:
any of them

Full rule:
rule YayihCode : Yayih Family 
{
    meta:
        description = "Yayih code features"
        author = "Seth Hardy"
        last_modified = "2014-07-11"
    
    strings:
        //  encryption
        $ = { 80 04 08 7A 03 C1 8B 45 FC 80 34 08 19 03 C1 41 3B 0A 7C E9 }
    
    condition:
        any of them
}
YARA Detection Rule: YayihStrings
Repository: Yara-Rules/rules
Detects: Yayih Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "/bbs/info.asp"
        $ = "\\msinfo.exe"
        $ = "%s\\%srcs.pdf"
        $ = "\\aumLib.ini"

Detection condition:
any of them

Full rule:
rule YayihStrings : Yayih Family
{
    meta:
        description = "Yayih Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-11"
        
    strings:
        $ = "/bbs/info.asp"
        $ = "\\msinfo.exe"
        $ = "%s\\%srcs.pdf"
        $ = "\\aumLib.ini"

    condition:
       any of them
}
YARA Detection Rule: Yayih
Repository: Yara-Rules/rules
Detects: Yayih
Author: Seth Hardy

Detection condition:
YayihCode or YayihStrings

Full rule:
rule Yayih : Family
{
    meta:
        description = "Yayih"
        author = "Seth Hardy"
        last_modified = "2014-07-11"
        
    condition:
        YayihCode or YayihStrings
}
YARA Detection Rule: mimikatz_kirbi_ticket
Repository: Yara-Rules/rules
Detects: KiRBi ticket for mimikatz
Author: Benjamin DELPY (gentilkiwi); Didier Stevens

Pattern signatures:
$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }

Detection condition:
$asn1 at 0 or $asn1_84 at 0

Full rule:
rule mimikatz_kirbi_ticket
{
	meta:
		description		= "KiRBi ticket for mimikatz"
		author			= "Benjamin DELPY (gentilkiwi); Didier Stevens"

	strings:
		$asn1			= { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
		$asn1_84		= { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }

	condition:
		$asn1 at 0 or $asn1_84 at 0
}
YARA Detection Rule: petya_eternalblue
Repository: Yara-Rules/rules
Detects: Based on spreading petya version: 2017-06-28
Author: blueliv
Reference: https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/

Pattern signatures:
/* Some commands executed by the Petya variant */
       $cmd01 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%0" wide
       $cmd02 = "shutdown.exe /r /f" wide
       $cmd03 = "%s \\\\%s -accepteula -s" wide
       $cmd04 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1" wide
       /* Strings of encrypted files */
       $str01 = "they have been encrypted. Perhaps you are busy looking" wide
        /* MBR/VBR payload */
        $mbr01 = {00 00 00 55 aa e9 ?? ??}

Detection condition:
all of them

Full rule:
rule petya_eternalblue : petya_eternalblue {
    meta:
        author      = "blueliv"
        description =  "Based on spreading petya version: 2017-06-28"
        reference = "https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/"
    strings:
        /* Some commands executed by the Petya variant */
       $cmd01 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%0" wide
       $cmd02 = "shutdown.exe /r /f" wide
       $cmd03 = "%s \\\\%s -accepteula -s" wide
       $cmd04 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1" wide
       /* Strings of encrypted files */
       $str01 = "they have been encrypted. Perhaps you are busy looking" wide
        /* MBR/VBR payload */
        $mbr01 = {00 00 00 55 aa e9 ?? ??}
    condition:
        all of them
}
YARA Detection Rule: LURK0Header
Repository: Yara-Rules/rules
Detects: 5 char code for LURK0
Author: Katie Kleemola

Pattern signatures:
$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }

Detection condition:
any of them

Full rule:
rule LURK0Header : Family LURK0 {
	meta:
		description = "5 char code for LURK0"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = { C6 [5] 4C C6 [5] 55 C6 [5] 52 C6 [5] 4B C6 [5] 30 }

	condition:
		any of them
}
YARA Detection Rule: CCTV0Header
Repository: Yara-Rules/rules
Detects: 5 char code for LURK0
Author: Katie Kleemola

Pattern signatures:
//if its just one char a time
		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
		// bit hacky but for when samples dont just simply mov 1 char at a time
		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }

Detection condition:
any of them

Full rule:
rule CCTV0Header : Family CCTV0 {
        meta:  
		description = "5 char code for LURK0"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"

	strings:
		//if its just one char a time
		$ = { C6 [5] 43 C6 [5] 43 C6 [5] 54 C6 [5] 56 C6 [5] 30 }
		// bit hacky but for when samples dont just simply mov 1 char at a time
		$ = { B0 43 88 [3] 88 [3] C6 [3] 54 C6 [3] 56 [0-12] (B0 30 | C6 [3] 30) }

	condition:
		any of them
}
YARA Detection Rule: SharedStrings
Repository: Yara-Rules/rules
Detects: Internal names found in LURK0/CCTV0 samples
Author: Katie Kleemola

Pattern signatures:
// internal names
		$i1 = "Butterfly.dll"
		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
		$i3 = "ETClientDLL"

		// dbx
		$d1 = "\\DbxUpdateET\\" wide
		$d2 = "\\DbxUpdateBT\\" wide
		$d3 = "\\DbxUpdate\\" wide
		
		// other folders
		$mc1 = "\\Micet\\"

		// embedded file names
		$n1 = "IconCacheEt.dat" wide
		$n2 = "IconConfigEt.dat" wide

		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
		$m2 = "\x00\x00111\x00\x00" wide
		$m3 = "\x00\x00ETUN\x00\x00" wide
		$m4 = "\x00\x00ER\x00\x00" wide

Detection condition:
any of them //todo: finetune this

Full rule:
rule SharedStrings : Family {
	meta:
		description = "Internal names found in LURK0/CCTV0 samples"
		author = "Katie Kleemola"
		last_updated = "07-22-2014"
	
	strings:
		// internal names
		$i1 = "Butterfly.dll"
		$i2 = /\\BT[0-9.]+\\ButterFlyDLL\\/
		$i3 = "ETClientDLL"

		// dbx
		$d1 = "\\DbxUpdateET\\" wide
		$d2 = "\\DbxUpdateBT\\" wide
		$d3 = "\\DbxUpdate\\" wide
		
		// other folders
		$mc1 = "\\Micet\\"

		// embedded file names
		$n1 = "IconCacheEt.dat" wide
		$n2 = "IconConfigEt.dat" wide

		$m1 = "\x00\x00ERXXXXXXX\x00\x00" wide
		$m2 = "\x00\x00111\x00\x00" wide
		$m3 = "\x00\x00ETUN\x00\x00" wide
		$m4 = "\x00\x00ER\x00\x00" wide

	condition:
		any of them //todo: finetune this

}
YARA Detection Rule: LURK0
Repository: Yara-Rules/rules
Detects: rule for lurk0
Author: Katie Kleemola

Detection condition:
LURK0Header and SharedStrings

Full rule:
rule LURK0 : Family LURK0 {
	
	meta:
		description = "rule for lurk0"
		author = "Katie Kleemola"
		last_updated = "07-22-2014"

	condition:
		LURK0Header and SharedStrings

}
YARA Detection Rule: CCTV0
Repository: Yara-Rules/rules
Detects: rule for cctv0
Author: Katie Kleemola

Detection condition:
CCTV0Header and SharedStrings

Full rule:
rule CCTV0 : Family CCTV0 {

	meta:
		description = "rule for cctv0"
		author = "Katie Kleemola"
		last_updated = "07-22-2014"

	condition:
		CCTV0Header and SharedStrings

}
YARA Detection Rule: Mirai_Okiru
Repository: Yara-Rules/rules
Detects: Detects Mirai Okiru MALW
Reference: https://www.reddit.com/r/LinuxMalware/comments/7p00i3/quick_notes_for_okiru_satori_variant_of_mirai/

Pattern signatures:
$hexsts01 = { 68 7f 27 70 60 62 73 3c 27 28 65 6e 69 28 65 72 }
		$hexsts02 = { 74 7e 65 68 7f 27 73 61 73 77 3c 27 28 65 6e 69 }
		// noted some Okiru variant doesnt have below function, uncomment to seek specific x86 bins
    // $st07 = "iptables -F\n" fullword nocase wide ascii

Detection condition:
all of them
		and is__elf
		and is__Mirai_gen7
		and filesize < 100KB

Full rule:
rule Mirai_Okiru {
	meta:
		description = "Detects Mirai Okiru MALW"
		reference = "https://www.reddit.com/r/LinuxMalware/comments/7p00i3/quick_notes_for_okiru_satori_variant_of_mirai/"
		date = "2018-01-05"

	strings:
		$hexsts01 = { 68 7f 27 70 60 62 73 3c 27 28 65 6e 69 28 65 72 }
		$hexsts02 = { 74 7e 65 68 7f 27 73 61 73 77 3c 27 28 65 6e 69 }
		// noted some Okiru variant doesnt have below function, uncomment to seek specific x86 bins
    // $st07 = "iptables -F\n" fullword nocase wide ascii
    
	condition:
    		all of them
		and is__elf
		and is__Mirai_gen7
		and filesize < 100KB 
}
YARA Detection Rule: Maze
Repository: Yara-Rules/rules
Detects: Identifies Maze ransomware in memory or unpacked.
Author: @bartblaze

Pattern signatures:
$ = "Enc: %s" ascii wide
	$ = "Encrypting whole system" ascii wide
	$ = "Encrypting specified folder in --path parameter..." ascii wide
	$ = "!Finished in %d ms!" ascii wide
	$ = "--logging" ascii wide
	$ = "--nomutex" ascii wide
	$ = "--noshares" ascii wide
	$ = "--path" ascii wide
	$ = "Logging enabled | Maze" ascii wide
	$ = "NO SHARES | " ascii wide
	$ = "NO MUTEX | " ascii wide
	$ = "Encrypting:" ascii wide
	$ = "You need to buy decryptor in order to restore the files." ascii wide
	$ = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" ascii wide
	$ = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" ascii wide
	$ = "DECRYPT-FILES.txt" ascii wide fullword

Detection condition:
5 of them

Full rule:
rule Maze
{
meta:
	description = "Identifies Maze ransomware in memory or unpacked."
	author = "@bartblaze"
	date = "2019-11"
	tlp = "White"

strings:	
	$ = "Enc: %s" ascii wide
	$ = "Encrypting whole system" ascii wide
	$ = "Encrypting specified folder in --path parameter..." ascii wide
	$ = "!Finished in %d ms!" ascii wide
	$ = "--logging" ascii wide
	$ = "--nomutex" ascii wide
	$ = "--noshares" ascii wide
	$ = "--path" ascii wide
	$ = "Logging enabled | Maze" ascii wide
	$ = "NO SHARES | " ascii wide
	$ = "NO MUTEX | " ascii wide
	$ = "Encrypting:" ascii wide
	$ = "You need to buy decryptor in order to restore the files." ascii wide
	$ = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" ascii wide
	$ = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" ascii wide
	$ = "DECRYPT-FILES.txt" ascii wide fullword

condition:
	5 of them
}
YARA Detection Rule: TidePool_Malware
Repository: Yara-Rules/rules
Detects: Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks
Author: Florian Roth
Reference: http://goo.gl/m2CXWR

Pattern signatures:
$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
        $x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
        $x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
        $x4 = "IEComDll.dat" fullword ascii
        $s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
        $s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
        $s3 = "network.proxy.socks_port\", " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )

Full rule:
rule TidePool_Malware
{

    meta:
        description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
        author = "Florian Roth"
        reference = "http://goo.gl/m2CXWR"
        date = "2016-05-24"
        hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
        hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
        hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
        hash4 = "38f2c86041e[PII_REDACTED]cdb9c530298c0c[PII_REDACTED]c4e7446544fd6dcac9f"
        hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"

    strings:
        $x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
        $x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
        $x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
        $x4 = "IEComDll.dat" fullword ascii
        $s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
        $s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
        $s3 = "network.proxy.socks_port\", " fullword ascii
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) ) ) or ( 4 of them )
}
YARA Detection Rule: Dexter_Malware
Repository: Yara-Rules/rules
Detects: Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b
Author: Florian Roth
Reference: http://goo.gl/oBvy8b

Pattern signatures:
$s0 = "Java Security Plugin" fullword wide
        $s1 = "%s\\%s\\%s.exe" fullword wide
        $s2 = "Sun Java Security Plugin" fullword wide
        $s3 = "\\Internet Explorer\\iexplore.exe" fullword wide

Detection condition:
all of them

Full rule:
rule Dexter_Malware 
{

    meta:
        description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
        author = "Florian Roth"
        reference = "http://goo.gl/oBvy8b"
        date = "2015/02/10"
        score = 70

    strings:
        $s0 = "Java Security Plugin" fullword wide
        $s1 = "%s\\%s\\%s.exe" fullword wide
        $s2 = "Sun Java Security Plugin" fullword wide
        $s3 = "\\Internet Explorer\\iexplore.exe" fullword wide

    condition:
        all of them
}
YARA Detection Rule: dexter_strings
Repository: Yara-Rules/rules
Detects: Identify Dexter POSGrabber
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "UpdateMutex:"
        $s2 = "response="
        $s3 = "page="
        $s4 = "scanin:"

Detection condition:
all of them

Full rule:
rule dexter_strings
{
   
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-09-10"
        description = "Identify Dexter POSGrabber"
   
    strings:
        $s1 = "UpdateMutex:"
        $s2 = "response="
        $s3 = "page="
        $s4 = "scanin:"
   
    condition:
        all of them
}