deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: QuarianStrings
Repository: Yara-Rules/rules
Detects: Quarian Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "s061779s061750"
        $ = "[OnUpLoadFile]"
        $ = "[OnDownLoadFile]"
        $ = "[FileTransfer]"
        $ = "---- Not connect the Manager, so start UnInstall ----"
        $ = "------- Enter CompressDownLoadDir ---------"
        $ = "------- Enter DownLoadDirectory ---------"
        $ = "[HandleAdditionalData]"
        $ = "[mswsocket.dll]"
        $ = "msupdate.dll........Enter ThreadCmd!"
        $ = "ok1-1"
        $ = "msupdate_tmp.dll"
        $ = "replace Rpcss.dll successfully!"
        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
        $ = "\\drivercashe\\" wide ascii
        $ = "\\microsoft\\windwos\\" wide ascii
        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
        $ = "Global\\state_maping" wide ascii
        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
        $ = "Global\\unInstall_event_1554_Ower" wide

Detection condition:
any of them

Full rule:
rule QuarianStrings : Quarian Family
{
    meta:
        description = "Quarian Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
        
    strings:
        $ = "s061779s061750"
        $ = "[OnUpLoadFile]"
        $ = "[OnDownLoadFile]"
        $ = "[FileTransfer]"
        $ = "---- Not connect the Manager, so start UnInstall ----"
        $ = "------- Enter CompressDownLoadDir ---------"
        $ = "------- Enter DownLoadDirectory ---------"
        $ = "[HandleAdditionalData]"
        $ = "[mswsocket.dll]"
        $ = "msupdate.dll........Enter ThreadCmd!"
        $ = "ok1-1"
        $ = "msupdate_tmp.dll"
        $ = "replace Rpcss.dll successfully!"
        $ = "f:\\loadhiddendriver-mdl\\objfre_win7_x86\\i386\\intelnat.pdb"
        $ = "\\drivercashe\\" wide ascii
        $ = "\\microsoft\\windwos\\" wide ascii
        $ = "\\DosDevices\\LOADHIDDENDRIVER" wide ascii
        $ = "\\Device\\LOADHIDDENDRIVER" wide ascii
        $ = "Global\\state_maping" wide ascii
        $ = "E:\\Code\\2.0\\2.0_multi-port\\2.0\\ServerInstall_New-2010-0913_sp3\\msupdataDll\\Release\\msupdate_tmp.pdb"
        $ = "Global\\unInstall_event_1554_Ower" wide ascii
        
    condition:
       any of them
}
YARA Detection Rule: QuarianCode
Repository: Yara-Rules/rules
Detects: Quarian code features
Author: Seth Hardy

Pattern signatures:
// decrypt in intelnat.sys
        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
        // decrypt in mswsocket.dll
        $ = { C1 EF 05 C1 E3 04 33 FB }
        $ = { 33 D8 81 EE 47 86 C8 61 }
        // loop in msupdate.dll
        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }

Detection condition:
any of them

Full rule:
rule QuarianCode : Quarian Family 
{
    meta:
        description = "Quarian code features"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
    
    strings:
        // decrypt in intelnat.sys
        $ = { C1 E? 04 8B ?? F? C1 E? 05 33 C? }
        // decrypt in mswsocket.dll
        $ = { C1 EF 05 C1 E3 04 33 FB }
        $ = { 33 D8 81 EE 47 86 C8 61 }
        // loop in msupdate.dll
        $ = { FF 45 E8 81 45 EC CC 00 00 00 E9 95 FE FF FF }
    
    condition:
        any of them
}
YARA Detection Rule: Quarian
Repository: Yara-Rules/rules
Detects: Quarian
Author: Seth Hardy

Detection condition:
QuarianCode or QuarianStrings

Full rule:
rule Quarian : Family
{
    meta:
        description = "Quarian"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
        
    condition:
        QuarianCode or QuarianStrings
}
YARA Detection Rule: Locky_Ransomware
Repository: Yara-Rules/rules
Detects: Detects Locky Ransomware (matches also on Win32/Kuluoz)
Author: Florian Roth (with the help of binar.ly)
Reference: https://goo.gl/qScSrE

Pattern signatures:
$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863

Detection condition:
all of ($o*)

Full rule:
rule Locky_Ransomware : ransom {
	meta:
		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
		author = "Florian Roth (with the help of binar.ly)"
		reference = "https://goo.gl/qScSrE"
		date = "2016-02-17"
		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
	strings:
		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
	condition:
		all of ($o*)
}
YARA Detection Rule: Locky_Ransomware_2
Repository: Yara-Rules/rules
Detects: Regla para detectar RANSOM.LOCKY
Author: CCN-CERT

Pattern signatures:
$a1 = { 2E 00 6C 00 6F 00 63 00 6B 00 79 00 00 }
    $a2 = { 00 5F 00 4C 00 6F 00 63 00 6B 00 79 00 }
    $a3 = { 5F 00 72 00 65 00 63 00 6F 00 76 00 65 }
    $a4 = { 00 72 00 5F 00 69 00 6E 00 73 00 74 00 }
    $a5 = { 72 00 75 00 63 00 74 00 69 00 6F 00 6E }
    $a6 = { 00 73 00 2E 00 74 00 78 00 74 00 00 }
    $a7 = { 53 6F 66 74 77 61 72 65 5C 4C 6F 63 6B 79 00 }

Detection condition:
all of them

Full rule:
rule Locky_Ransomware_2: ransom {
meta:
    description = "Regla para detectar RANSOM.LOCKY"
    author = "CCN-CERT"
    version = "1.0"
strings:
    $a1 = { 2E 00 6C 00 6F 00 63 00 6B 00 79 00 00 }
    $a2 = { 00 5F 00 4C 00 6F 00 63 00 6B 00 79 00 }
    $a3 = { 5F 00 72 00 65 00 63 00 6F 00 76 00 65 }
    $a4 = { 00 72 00 5F 00 69 00 6E 00 73 00 74 00 }
    $a5 = { 72 00 75 00 63 00 74 00 69 00 6F 00 6E }
    $a6 = { 00 73 00 2E 00 74 00 78 00 74 00 00 }
    $a7 = { 53 6F 66 74 77 61 72 65 5C 4C 6F 63 6B 79 00 }
condition:
    all of them
}
YARA Detection Rule: TROJAN_Notepad
Repository: Yara-Rules/rules
Author: RSA_IR

Pattern signatures:
$s1 = "75BAA77C842BE168B0F66C42C7885997"
        $s2 = "B523F63566F407F3834BCC54AAA32524"

Detection condition:
$s1 or $s2

Full rule:
rule TROJAN_Notepad {
    meta:
        Author = "RSA_IR"
        Date     = "4Jun13"
        File     = "notepad.exe v 1.1"
        MD5      = "106E63DBDA3A76BEEB53A8BBD8F98927"
    strings:
        $s1 = "75BAA77C842BE168B0F66C42C7885997"
        $s2 = "B523F63566F407F3834BCC54AAA32524"
    condition:
        $s1 or $s2
}
YARA Detection Rule: MALW_trickbot_bankBot
Repository: Yara-Rules/rules
Detects: Detects Trickbot Banking Trojan
Author: Marc Salinas @Bondey_m

Pattern signatures:
$str_trick_01 = "moduleconfig"
$str_trick_02 = "Start"
$str_trick_03 = "Control"
$str_trick_04 = "FreeBuffer"
$str_trick_05 = "Release"

Detection condition:
all of ($str_trick_*)

Full rule:
rule MALW_trickbot_bankBot : Trojan
{
meta:
 author = "Marc Salinas @Bondey_m"
 description = "Detects Trickbot Banking Trojan"
strings:
$str_trick_01 = "moduleconfig"
$str_trick_02 = "Start"
$str_trick_03 = "Control"
$str_trick_04 = "FreeBuffer"
$str_trick_05 = "Release"
condition:
all of ($str_trick_*)
}
YARA Detection Rule: MALW_systeminfo_trickbot_module
Repository: Yara-Rules/rules
Detects: Detects systeminfo module from Trickbot Trojan
Author: Marc Salinas @Bondey_m

Pattern signatures:
$str_systeminf_01 = "<program>"
$str_systeminf_02 = "<service>"
$str_systeminf_03 = "</systeminfo>"
$str_systeminf_04 =
"GetSystemInfo.pdb"
$str_systeminf_05 = "</autostart>"
$str_systeminf_06 = "</moduleconfig>"

Detection condition:
all of ($str_systeminf_*)

Full rule:
rule MALW_systeminfo_trickbot_module :
Trojan
{
meta:
author = "Marc Salinas @Bondey_m"
description = "Detects systeminfo module from Trickbot Trojan"
strings:
$str_systeminf_01 = "<program>"
$str_systeminf_02 = "<service>"
$str_systeminf_03 = "</systeminfo>"
$str_systeminf_04 =
"GetSystemInfo.pdb"
$str_systeminf_05 = "</autostart>"
$str_systeminf_06 = "</moduleconfig>"
condition:
all of ($str_systeminf_*)
}
YARA Detection Rule: MALW_dllinject_trickbot_module
Repository: Yara-Rules/rules
Detects:  Detects dllinject module from Trickbot Trojan
Author: Marc Salinas @Bondey_m

Pattern signatures:
$str_dllinj_01 = "user_pref("
$str_dllinj_02 = "<ignore_mask>"
$str_dllinj_03 = "<require_header>"
$str_dllinj_04 = "</dinj>"

Detection condition:
all of ($str_dllinj_*)

Full rule:
rule MALW_dllinject_trickbot_module : Trojan
{
meta:
author = "Marc Salinas @Bondey_m"
description = " Detects dllinject module from Trickbot Trojan"
strings:
$str_dllinj_01 = "user_pref("
$str_dllinj_02 = "<ignore_mask>"
$str_dllinj_03 = "<require_header>"
$str_dllinj_04 = "</dinj>"
condition:
all of ($str_dllinj_*)
}
YARA Detection Rule: MALW_mailsercher_trickbot_module
Repository: Yara-Rules/rules
Detects:  Detects mailsearcher module from Trickbot Trojan
Author: Marc Salinas @Bondey_m

Pattern signatures:
$str_mails_01 = "mailsearcher"
$str_mails_02 = "handler"
$str_mails_03 = "conf"
$str_mails_04 = "ctl"
$str_mails_05 = "SetConf"
$str_mails_06 = "file"
$str_mails_07 = "needinfo"
$str_mails_08 = "mailconf"

Detection condition:
all of ($str_mails_*)

Full rule:
rule MALW_mailsercher_trickbot_module :
Trojan
{
meta:
author = "Marc Salinas @Bondey_m"
description = " Detects mailsearcher module from Trickbot Trojan"
strings:
$str_mails_01 = "mailsearcher"
$str_mails_02 = "handler"
$str_mails_03 = "conf"
$str_mails_04 = "ctl"
$str_mails_05 = "SetConf"
$str_mails_06 = "file"
$str_mails_07 = "needinfo"
$str_mails_08 = "mailconf"
condition:
all of ($str_mails_*)
}
YARA Detection Rule: Tinba2
Repository: Yara-Rules/rules
Detects: Tinba 2 (DGA) banking trojan
Author: n3sfox <n3sfox@gmail.com>
Reference: https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world

Pattern signatures:
$str1 = "MapViewOfFile"
                $str2 = "OpenFileMapping"
                $str3 = "NtCreateUserProcess"
                $str4 = "NtQueryDirectoryFile"
                $str5 = "RtlCreateUserThread"
                $str6 = "DeleteUrlCacheEntry"
                $str7 = "PR_Read"
                $str8 = "PR_Write"
                $pubkey = "BEGIN PUBLIC KEY"
                $code1 = {50 87 44 24 04 6A ?? E8}

Detection condition:
all of ($str*) and $pubkey and $code1

Full rule:
rule Tinba2 : banking {
        meta:
                author = "n3sfox <n3sfox@gmail.com>"
                date = "2015/11/07"
                description = "Tinba 2 (DGA) banking trojan"
                reference = "https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world"
                filetype = "memory"
                hash1 = "c7f662594f07776ab047b322150f6ed0"
                hash2 = "dc71ef1e55f1ddb36b3c41b1b95ae586"
                hash3 = "b788155cb82a7600f2ed1965cffc1e88"

        strings:
                $str1 = "MapViewOfFile"
                $str2 = "OpenFileMapping"
                $str3 = "NtCreateUserProcess"
                $str4 = "NtQueryDirectoryFile"
                $str5 = "RtlCreateUserThread"
                $str6 = "DeleteUrlCacheEntry"
                $str7 = "PR_Read"
                $str8 = "PR_Write"
                $pubkey = "BEGIN PUBLIC KEY"
                $code1 = {50 87 44 24 04 6A ?? E8}

        condition:
                all of ($str*) and $pubkey and $code1
}
YARA Detection Rule: shimrat
Repository: Yara-Rules/rules
Detects: Detects ShimRat and the ShimRat loader
Author: Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)

Pattern signatures:
$dll = ".dll"
  $dat = ".dat"
  $headersig = "QWERTYUIOPLKJHG"
  $datasig = "MNBVCXZLKJHGFDS"
  $datamarker1 = "Data$$00"
  $datamarker2 = "Data$$01%c%sData"
  $cmdlineformat = "ping localhost -n 9 /c %s > nul"
  $demoproject_keyword1 = "Demo"
  $demoproject_keyword2 = "Win32App"
  $comspec = "COMSPEC"
  $shim_func1 = "ShimMain"
  $shim_func2 = "NotifyShims"
  $shim_func3 = "GetHookAPIs"

Detection condition:
($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)

Full rule:
rule shimrat: RAT
{
 meta:
  description = "Detects ShimRat and the ShimRat loader"
  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
  date = "20/11/2015"
  ref = "https://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/"
  
 strings:
  $dll = ".dll"
  $dat = ".dat"
  $headersig = "QWERTYUIOPLKJHG"
  $datasig = "MNBVCXZLKJHGFDS"
  $datamarker1 = "Data$$00"
  $datamarker2 = "Data$$01%c%sData"
  $cmdlineformat = "ping localhost -n 9 /c %s > nul"
  $demoproject_keyword1 = "Demo"
  $demoproject_keyword2 = "Win32App"
  $comspec = "COMSPEC"
  $shim_func1 = "ShimMain"
  $shim_func2 = "NotifyShims"
  $shim_func3 = "GetHookAPIs"


 condition:
  ($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
}
YARA Detection Rule: shimratreporter
Repository: Yara-Rules/rules
Detects: Detects ShimRatReporter
Author: Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)

Pattern signatures:
$IpInfo = "IP-INFO"
  $NetworkInfo = "Network-INFO"
  $OsInfo = "OS-INFO"
  $ProcessInfo = "Process-INFO"
  $BrowserInfo = "Browser-INFO"
  $QueryUserInfo = "QueryUser-INFO"
  $UsersInfo = "Users-INFO"
  $SoftwareInfo = "Software-INFO"
  $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
  $proxy_str = "(from environment) = %s"

  $netuserfun = "NetUserEnum"
  $networkparams = "GetNetworkParams"

Detection condition:
all of them

Full rule:
rule shimratreporter: RAT
{
 meta:
  description = "Detects ShimRatReporter"
  author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
  date = "20/11/2015"
  ref = "https://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/"


 strings:
  $IpInfo = "IP-INFO"
  $NetworkInfo = "Network-INFO"
  $OsInfo = "OS-INFO"
  $ProcessInfo = "Process-INFO"
  $BrowserInfo = "Browser-INFO"
  $QueryUserInfo = "QueryUser-INFO"
  $UsersInfo = "Users-INFO"
  $SoftwareInfo = "Software-INFO"
  $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
  $proxy_str = "(from environment) = %s"

  $netuserfun = "NetUserEnum"
  $networkparams = "GetNetworkParams"

 condition:
  all of them
}
YARA Detection Rule: KINS_dropper
Repository: Yara-Rules/rules
Detects: Match protocol, process injects and windows exploit present in KINS dropper
Author: AlienVault Labs aortega@alienvault.com
Reference: http://goo.gl/arPhm3

Pattern signatures:
// Network protocol
		$n1 = "tid=%d&ta=%s-%x" fullword
		$n2 = "fid=%d" fullword
		$n3 = "%[^.].%[^(](%[^)])" fullword
		// Injects
		$i0 = "%s [%s %d] 77 %s"
		$i01 = "Global\\%s%x"
		$i1 = "Inject::InjectProcessByName()"
		$i2 = "Inject::CopyImageToProcess()"
		$i3 = "Inject::InjectProcess()"
		$i4 = "Inject::InjectImageToProcess()"
		$i5 = "Drop::InjectStartThread()"
		// UAC bypass
		$uac1 = "ExploitMS10_092"
		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide

Detection condition:
2 of ($n*) and 2 of ($i*) and 2 of ($uac*)

Full rule:
rule KINS_dropper : dropper {
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match protocol, process injects and windows exploit present in KINS dropper"
		reference = "http://goo.gl/arPhm3"
	strings:
		// Network protocol
		$n1 = "tid=%d&ta=%s-%x" fullword
		$n2 = "fid=%d" fullword
		$n3 = "%[^.].%[^(](%[^)])" fullword
		// Injects
		$i0 = "%s [%s %d] 77 %s"
		$i01 = "Global\\%s%x"
		$i1 = "Inject::InjectProcessByName()"
		$i2 = "Inject::CopyImageToProcess()"
		$i3 = "Inject::InjectProcess()"
		$i4 = "Inject::InjectImageToProcess()"
		$i5 = "Drop::InjectStartThread()"
		// UAC bypass
		$uac1 = "ExploitMS10_092"
		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
	condition:
		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
}
YARA Detection Rule: KINS_DLL_zeus
Repository: Yara-Rules/rules
Detects: Match default bot in KINS leaked dropper, Zeus
Author: AlienVault Labs aortega@alienvault.com
Reference: http://goo.gl/arPhm3

Pattern signatures:
// Network protocol
		$n1 = "%BOTID%" fullword
		$n2 = "%opensocks%" fullword
		$n3 = "%openvnc%" fullword
		$n4 = /Global\\(s|v)_ev/ fullword
		// Crypted strings
		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"

Detection condition:
all of ($n*) and 1 of ($s*)

Full rule:
rule KINS_DLL_zeus {
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match default bot in KINS leaked dropper, Zeus"
		reference = "http://goo.gl/arPhm3"
	strings:
		// Network protocol
		$n1 = "%BOTID%" fullword
		$n2 = "%opensocks%" fullword
		$n3 = "%openvnc%" fullword
		$n4 = /Global\\(s|v)_ev/ fullword
		// Crypted strings
		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
	condition:
		all of ($n*) and 1 of ($s*)
}
YARA Detection Rule: Furtim_nativeDLL
Repository: Yara-Rules/rules
Detects: Detects Furtim malware - file native.dll
Author: Florian Roth
Reference: MISP 3971

Pattern signatures:
$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
        $op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
        $op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
        $op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)

Full rule:
rule Furtim_nativeDLL 
{

    meta:
        description = "Detects Furtim malware - file native.dll"
        author = "Florian Roth"
        reference = "MISP 3971"
        date = "2016-06-13"
        hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"

    strings:
        $s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
        $op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
        $op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
        $op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
    condition:
        uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
}
YARA Detection Rule: Furtim_Parent_1
Repository: Yara-Rules/rules
Detects: Detects Furtim Parent Malware
Author: Florian Roth
Reference: https://sentinelone.com/blogs/sfg-furtims-parent/

Pattern signatures:
/* RC4 encryption password */
        $x1 = "dqrChZonUF" fullword ascii
        /* Other strings */
        $s1 = "Egistec" fullword wide
        $s2 = "Copyright (C) 2016" fullword wide
        /* Op Code */
        $op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
        $op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
        $op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or all of them

Full rule:
rule Furtim_Parent_1 
{

    meta:
        description = "Detects Furtim Parent Malware"
        author = "Florian Roth"
        reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
        date = "2016-07-16"
        hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"

    strings:
        /* RC4 encryption password */
        $x1 = "dqrChZonUF" fullword ascii
        /* Other strings */
        $s1 = "Egistec" fullword wide
        $s2 = "Copyright (C) 2016" fullword wide
        /* Op Code */
        $op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
        $op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
        $op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
  
    condition:
        ( uint16(0) == 0x5a4d and filesize < 900KB and ( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or all of them
}
YARA Detection Rule: APT_DeputyDog_Fexel
Repository: Yara-Rules/rules
Author: ThreatConnect Intelligence Research Team

Pattern signatures:
$180 = "180.150.228.102" wide ascii
    $0808cmd = {25 30 38 78 30 38 78 00 5C 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 [2-6] 43 00 61 00 6E 00 27 00 74 00 20 00 6F 00 70 00 65 00 6E 00 20 00 73 00 68 00 65 00 6C 00 6C 00 21}
    $cUp = "Upload failed! [Remote error code:" nocase wide ascii
    $DGGYDSYRL = {00 44 47 47 59 44 53 59 52 4C 00}
    $GDGSYDLYR = "GDGSYDLYR_%" wide ascii

Detection condition:
any of them

Full rule:
rule APT_DeputyDog_Fexel
{

meta:
    author = "ThreatConnect Intelligence Research Team"

strings:
    $180 = "180.150.228.102" wide ascii
    $0808cmd = {25 30 38 78 30 38 78 00 5C 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 [2-6] 43 00 61 00 6E 00 27 00 74 00 20 00 6F 00 70 00 65 00 6E 00 20 00 73 00 68 00 65 00 6C 00 6C 00 21}
    $cUp = "Upload failed! [Remote error code:" nocase wide ascii
    $DGGYDSYRL = {00 44 47 47 59 44 53 59 52 4C 00}
    $GDGSYDLYR = "GDGSYDLYR_%" wide ascii

condition:
    any of them
}
YARA Detection Rule: APT_DeputyDog
Repository: Yara-Rules/rules
Detects: detects string seen in samples used in 2013-3893 0day attacks
Author: FireEye Labs
Reference: https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html

Pattern signatures:
$mz = {4d 5a}
        $a = "DGGYDSYRL"

Detection condition:
($mz at 0) and $a

Full rule:
rule APT_DeputyDog
{

    meta:
        Author      = "FireEye Labs"
        Date        = "2013/09/21"
        Description = "detects string seen in samples used in 2013-3893 0day attacks"
        Reference   = "https://www.fireeye.com/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html"

    strings:
        $mz = {4d 5a}
        $a = "DGGYDSYRL"

    condition:
        ($mz at 0) and $a
}
YARA Detection Rule: ROKRAT_payload
Repository: Yara-Rules/rules
Detects: Designed to catch loader observed used with ROKRAT malware
Author: CarbonBlack Threat Research
Reference: https://www.carbonblack.com/2018/02/27/threat-analysis-rokrat-malware/

Pattern signatures:
$s1 = "api.box.com/oauth2/token" wide

	$s2 = "upload.box.com/api/2.0/files/content" wide

	$s3 = "api.pcloud.com/uploadfile?path=%s&filename=%s&nopartial=1" wide

	$s4 = "cloud-api.yandex.net/v1/disk/resources/download?path=%s" wide

	$s5 = "SbieDll.dll"

	$s6 = "dbghelp.dll"

	$s7 = "api_log.dll"

	$s8 = "dir_watch.dll"

	$s9 = "def_%s.jpg" wide

	$s10 = "pho_%s_%d.jpg" wide

	$s11 = "login=%s&[CREDENTIAL_REDACTED]_submit=Authorizing" wide

	$s12 = "gdiplus.dll"

	$s13 = "Set-Cookie:\\b*{.+?}\\n" wide

	$s14 = "charset={[A-Za-z0-9\\-_]+}" wide

Detection condition:
12 of ($s*)

Full rule:
rule ROKRAT_payload : TAU DPRK APT

{

meta:

    author = "CarbonBlack Threat Research" //JMyers

    date = "2018-Jan-11"

    description = "Designed to catch loader observed used with ROKRAT malware"
    
    reference = "https://www.carbonblack.com/2018/02/27/threat-analysis-rokrat-malware/"

    rule_version = 1

  	yara_version = "3.7.0"

    TLP = "White"

  	exemplar_hashes = "e200517ab9482e787a59e60accc8552bd0c844687cd0cf8ec4238ed2fc2fa573"

strings:

	$s1 = "api.box.com/oauth2/token" wide

	$s2 = "upload.box.com/api/2.0/files/content" wide

	$s3 = "api.pcloud.com/uploadfile?path=%s&filename=%s&nopartial=1" wide

	$s4 = "cloud-api.yandex.net/v1/disk/resources/download?path=%s" wide

	$s5 = "SbieDll.dll"

	$s6 = "dbghelp.dll"

	$s7 = "api_log.dll"

	$s8 = "dir_watch.dll"

	$s9 = "def_%s.jpg" wide

	$s10 = "pho_%s_%d.jpg" wide

	$s11 = "login=%s&[CREDENTIAL_REDACTED]_submit=Authorizing" wide

	$s12 = "gdiplus.dll"

	$s13 = "Set-Cookie:\\b*{.+?}\\n" wide

	$s14 = "charset={[A-Za-z0-9\\-_]+}" wide

condition:

	12 of ($s*)

}