deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_BICECREAM
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BICECREAM-2140
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
        $s2 = "command data size is invalid for an exec cmd" fullword ascii
        $s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
        $s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
        $s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
        $s6 = "[%d] Execute code." fullword ascii
        $s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
        $s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
        $s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )

Full rule:
rule EQGRP_BICECREAM 
{

    meta:
        description = "EQGRP Toolset Firewall - file BICECREAM-2140"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"

    strings:
        $s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
        $s2 = "command data size is invalid for an exec cmd" fullword ascii
        $s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
        $s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
        $s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
        $s6 = "[%d] Execute code." fullword ascii
        $s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
        $s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
        $s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
    
    condition:
        ( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
}
YARA Detection Rule: EQGRP_create_http_injection
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file create_http_injection.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "required by SECONDDATE" fullword ascii
        $s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
        $s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
        $s3 = "version='%prog 1.0'," fullword ascii
        $s4 = "usage='%prog [ ... options ... ] url'," fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )

Full rule:
rule EQGRP_create_http_injection 
{

    meta:
        description = "EQGRP Toolset Firewall - file create_http_injection.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"

    strings:
        $x1 = "required by SECONDDATE" fullword ascii
        $s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
        $s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
        $s3 = "version='%prog 1.0'," fullword ascii
        $s4 = "usage='%prog [ ... options ... ] url'," fullword ascii

    condition:
        ( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BFLEA_2201
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BFLEA-2201.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
        $s2 = "LOADED" fullword ascii
        $s3 = "readFlashHandler" fullword ascii
        $s4 = "KEEPGOING" fullword ascii
        $s5 = "flashRtnsPix6x.c" fullword ascii
        $s6 = "fix_ip_cksum_incr" fullword ascii
        $s7 = "writeFlashHandler" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )

Full rule:
rule EQGRP_BFLEA_2201 
{

    meta:
        description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"

    strings:
        $s1 = ".got_loader" fullword ascii
        $s2 = "LOADED" fullword ascii
        $s3 = "readFlashHandler" fullword ascii
        $s4 = "KEEPGOING" fullword ascii
        $s5 = "flashRtnsPix6x.c" fullword ascii
        $s6 = "fix_ip_cksum_incr" fullword ascii
        $s7 = "writeFlashHandler" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_BpfCreator_RHEL4
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BpfCreator-RHEL4
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
        $s2 = "error reading dump file: %s" fullword ascii
        $s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
        $s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
        $s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 2000KB and all of them )

Full rule:
rule EQGRP_BpfCreator_RHEL4 
{

    meta:
        description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "bd[PII_REDACTED]623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"

    strings:
        $s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
        $s2 = "error reading dump file: %s" fullword ascii
        $s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
        $s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
        $s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 2000KB and all of them )
}
YARA Detection Rule: EQGRP_StoreFc
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file StoreFc.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
        $x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
        $x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_StoreFc 
{

    meta:
        description = "EQGRP Toolset Firewall - file StoreFc.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"

    strings:
        $x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
        $x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
        $x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_hexdump
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file hexdump.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
        $s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
        $s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
        $s4 = "print >>out, sane(x[i:i+16])" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )

Full rule:
rule EQGRP_hexdump 
{

    meta:
        description = "EQGRP Toolset Firewall - file hexdump.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"

    strings:
        $s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
        $s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
        $s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
        $s4 = "print >>out, sane(x[i:i+16])" fullword ascii

    condition:
        ( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BBALL
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
        $s2 = ".got_loader" fullword ascii
        $s3 = "handler_readBIOS" fullword ascii
        $s4 = "cmosReadByte" fullword ascii
        $s5 = "KEEPGOING" fullword ascii
        $s6 = "checksumAreaConfirmed.0" fullword ascii
        $s7 = "writeSpeedPlow.c" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )

Full rule:
rule EQGRP_BBALL 
{

    meta:
        description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"

    strings:
        $s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
        $s2 = ".got_loader" fullword ascii
        $s3 = "handler_readBIOS" fullword ascii
        $s4 = "cmosReadByte" fullword ascii
        $s5 = "KEEPGOING" fullword ascii
        $s6 = "checksumAreaConfirmed.0" fullword ascii
        $s7 = "writeSpeedPlow.c" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BARPUNCH_BPICKER
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
        $x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
        $x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
        $x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
        $x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )

Full rule:
rule EQGRP_BARPUNCH_BPICKER 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
        hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"

    strings:
        $x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
        $x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
        $x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
        $x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
        $x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
   
    condition:
        ( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_Implants_Gen6
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
        $s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
        $s3 = "getModInterface__preloadedModules" fullword ascii
        $s4 = "showCommands" fullword ascii
        $s5 = "readModuleInterface" fullword ascii
        $s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
        $s7 = "Get_CMD_List" fullword ascii
        $s8 = "LP_Listen2" fullword ascii
        $s9 = "killCmdList" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and all of them )

Full rule:
rule EQGRP_Implants_Gen6 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
        hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
        hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
        hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
        hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
        hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"

    strings:
        $s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
        $s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
        $s3 = "getModInterface__preloadedModules" fullword ascii
        $s4 = "showCommands" fullword ascii
        $s5 = "readModuleInterface" fullword ascii
        $s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
        $s7 = "Get_CMD_List" fullword ascii
        $s8 = "LP_Listen2" fullword ascii
        $s9 = "killCmdList" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 6000KB and all of them )
}
YARA Detection Rule: EQGRP_Implants_Gen5
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
        $s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
        $s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
        $s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii

Detection condition:
( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )

Full rule:
rule EQGRP_Implants_Gen5 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, BARPUNCH-3110, BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120, BPICKER-3100, writeJetPlow-2130"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
        hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
        hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
        hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
        hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
        hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
        hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
   
    strings:
        $x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
        $s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
        $s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
        $s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
    
    condition:
        ( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_pandarock
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
        $x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
        $x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
        $x4 = "* Use arrow keys to scroll through command history" fullword ascii
        $s1 = "pitCmd_processCmdLine" fullword ascii
        $s2 = "execute all commands in <file>" fullword ascii
        $s3 = "__processShellCmd" fullword ascii
        $s4 = "pitTarget_getDstPort" fullword ascii
        $s5 = "__processSetTargetIp" fullword ascii
        $o1 = "Logging commands and output - ON" fullword ascii
        $o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)

Full rule:
rule EQGRP_pandarock 
{

    meta:
        description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
        hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
  
    strings:
        $x1 = "* Not attempting to execute \"%s\" command" fullword ascii
        $x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
        $x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
        $x4 = "* Use arrow keys to scroll through command history" fullword ascii
        $s1 = "pitCmd_processCmdLine" fullword ascii
        $s2 = "execute all commands in <file>" fullword ascii
        $s3 = "__processShellCmd" fullword ascii
        $s4 = "pitTarget_getDstPort" fullword ascii
        $s5 = "__processSetTargetIp" fullword ascii
        $o1 = "Logging commands and output - ON" fullword ascii
        $o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)
}
YARA Detection Rule: EQGRP_BananaUsurper_writeJetPlow
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Implant Version-Specific Values:" fullword ascii
        $x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
        $s1 = "createSendRecv: recv'd an error from the target." fullword ascii
        $s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )

Full rule:
rule EQGRP_BananaUsurper_writeJetPlow
{

    meta:
        description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
        hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
    strings:
        $x1 = "Implant Version-Specific Values:" fullword ascii
        $x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
        $s1 = "createSendRecv: recv'd an error from the target." fullword ascii
        $s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_Implants_Gen4
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "Command has not yet been coded" fullword ascii
        $s2 = "Beacon Domain  : www.%s.com" fullword ascii
        $s3 = "This command can only be run on a PIX/ASA" fullword ascii
        $s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
        $s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )

Full rule:
rule EQGRP_Implants_Gen4 
{

    meta:
        description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        super_rule = 1
        hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
        hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
        hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
        hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"

    strings:
        $s1 = "Command has not yet been coded" fullword ascii
        $s2 = "Beacon Domain  : www.%s.com" fullword ascii
        $s3 = "This command can only be run on a PIX/ASA" fullword ascii
        $s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
        $s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
}