deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Codoso_Gh0st_2
Repository: Yara-Rules/rules
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
        $s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
        $s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
        $s14 = "%s -r debug 1" fullword ascii
        $s15 = "\\\\.\\keymmdrv1" fullword ascii
        $s17 = "RunMeByDLL32" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 1 of them

Full rule:
rule Codoso_Gh0st_2
{

    meta:
        description = "Detects Codoso APT Gh0st Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "5402c785037614d09ad41e41e[PII_REDACTED]b53afd55aa054a09a[PII_REDACTED]1"

    strings:
        $s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
        $s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
        $s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
        $s14 = "%s -r debug 1" fullword ascii
        $s15 = "\\\\.\\keymmdrv1" fullword ascii
        $s17 = "RunMeByDLL32" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
}
YARA Detection Rule: Codoso_CustomTCP
Repository: Yara-Rules/rules
Detects: Codoso CustomTCP Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s4 = "wnyglw" fullword ascii
        $s5 = "WorkerRun" fullword ascii
        $s7 = "boazdcd" fullword ascii
        $s8 = "wayflw" fullword ascii
        $s9 = "CODETABL" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 405KB and all of them

Full rule:
rule Codoso_CustomTCP
{

    meta:
        description = "Codoso CustomTCP Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"

    strings:
        $s4 = "wnyglw" fullword ascii
        $s5 = "WorkerRun" fullword ascii
        $s7 = "boazdcd" fullword ascii
        $s8 = "wayflw" fullword ascii
        $s9 = "CODETABL" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 405KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_5
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "/c del %s >> NUL" fullword ascii
        $s2 = "%s%s.manifest" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of them

Full rule:
rule Codoso_PGV_PVID_5
{

    meta:
        description = "Detects Codoso APT PGV PVID Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
        hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"

    strings:
        $s1 = "/c del %s >> NUL" fullword ascii
        $s2 = "%s%s.manifest" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and all of them
}
YARA Detection Rule: Codoso_Gh0st_1
Repository: Yara-Rules/rules
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
        $x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
        $x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
        $x4 = "\\\\.\\keymmdrv1" fullword ascii
        $s1 = "spideragent.exe" fullword ascii
        $s2 = "AVGIDSAgent.exe" fullword ascii
        $s3 = "kavsvc.exe" fullword ascii
        $s4 = "mspaint.exe" fullword ascii
        $s5 = "kav.exe" fullword ascii
        $s6 = "avp.exe" fullword ascii
        $s7 = "NAV.exe" fullword ascii
        $c1 = "Elevation:Administrator!new:" wide
        $c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
        $c3 = "\\sysprep\\sysprep.exe" fullword wide
        $c4 = "\\sysprep\\CRYPTBASE.dll" fullword wide
        $c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
        $c6 = "ConsentPromptBehaviorAdmin" fullword ascii
        $c

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or 1 of ($x*) or 6 of ($c*)

Full rule:
rule Codoso_Gh0st_1
{

    meta:
        description = "Detects Codoso APT Gh0st Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "5402c785037614d09ad41e41e[PII_REDACTED]b53afd55aa054a09a[PII_REDACTED]1"
        hash2 = "7dc7cec2c3f7e[PII_REDACTED]1f64060ebd955813002d4db780e68a8f6e7d0a8f8"
        hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"

    strings:
        $x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
        $x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
        $x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
        $x4 = "\\\\.\\keymmdrv1" fullword ascii
        $s1 = "spideragent.exe" fullword ascii
        $s2 = "AVGIDSAgent.exe" fullword ascii
        $s3 = "kavsvc.exe" fullword ascii
        $s4 = "mspaint.exe" fullword ascii
        $s5 = "kav.exe" fullword ascii
        $s6 = "avp.exe" fullword ascii
        $s7 = "NAV.exe" fullword ascii
        $c1 = "Elevation:Administrator!new:" wide
        $c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
        $c3 = "\\sysprep\\sysprep.exe" fullword wide
        $c4 = "\\sysprep\\CRYPTBASE.dll" fullword wide
        $c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
        $c6 = "ConsentPromptBehaviorAdmin" fullword ascii
        $c7 = "\\sysprep" fullword wide
        $c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or 1 of ($x*) or 6 of ($c*)
}
YARA Detection Rule: Codoso_PGV_PVID_4
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "dropper, Version 1.0" fullword wide
        $x2 = "dropper" fullword wide
        $x3 = "DROPPER" fullword wide
        $x4 = "About dropper" fullword wide
        $s1 = "Microsoft Windows Manager Utility" fullword wide
        $s2 = "SYSTEM\\CurrentControlSet\\Services\\" fullword ascii /* Goodware String - occured 9 times */
        $s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
        $s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
        $s5 = "<supportedOS Id=\"{e2[PII_REDACTED]-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and 1 of ($x*) and 2 of ($s*)

Full rule:
rule Codoso_PGV_PVID_4
{

    meta:
        description = "Detects Codoso APT PlugX Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
        hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
        hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
        hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
        hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"

    strings:
        $x1 = "dropper, Version 1.0" fullword wide
        $x2 = "dropper" fullword wide
        $x3 = "DROPPER" fullword wide
        $x4 = "About dropper" fullword wide
        $s1 = "Microsoft Windows Manager Utility" fullword wide
        $s2 = "SYSTEM\\CurrentControlSet\\Services\\" fullword ascii /* Goodware String - occured 9 times */
        $s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii /* Goodware String - occured 10 times */
        $s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii /* Goodware String - occured 46 times */
        $s5 = "<supportedOS Id=\"{e2[PII_REDACTED]-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii /* Goodware String - occured 65 times */
    condition:
        uint16(0) == 0x5a4d and filesize < 900KB and 1 of ($x*) and 2 of ($s*)
}
YARA Detection Rule: Codoso_PlugX_1
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "GETPASSWORD1" fullword ascii
        $s2 = "NvSmartMax.dll" fullword ascii
        $s3 = "LICENSEDLG" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of them

Full rule:
rule Codoso_PlugX_1
{

    meta:
        description = "Detects Codoso APT PlugX Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
        hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
        hash3 = "fd22547497ce[PII_REDACTED]2429eeff0599d0b11fe61186e91c91e1f76b518fe2"

    strings:
        $s1 = "GETPASSWORD1" fullword ascii
        $s2 = "NvSmartMax.dll" fullword ascii
        $s3 = "LICENSEDLG" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 800KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_3
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide

Detection condition:
$x1

Full rule:
rule Codoso_PGV_PVID_3
{

    meta:
        description = "Detects Codoso APT PGV PVID Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
        hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
        hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
        hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
        hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
        hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"

    strings:
        $x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide

    condition:
        $x1
}
YARA Detection Rule: Codoso_PGV_PVID_2
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
        $s1 = "regsvr32.exe /s \"%s\"" fullword ascii
        $s2 = "Help and Support" fullword ascii
        $s3 = "netsvcs" fullword ascii
        $s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
        $s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
        $s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 907KB and all of them

Full rule:
rule Codoso_PGV_PVID_2
{

    meta:
        description = "Detects Codoso APT PGV PVID Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
        hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
        hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"

    strings:
        $s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
        $s1 = "regsvr32.exe /s \"%s\"" fullword ascii
        $s2 = "Help and Support" fullword ascii
        $s3 = "netsvcs" fullword ascii
        $s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii /* Goodware String - occured 4 times */
        $s10 = "winlogon" fullword ascii /* Goodware String - occured 4 times */
        $s11 = "System\\CurrentControlSet\\Services" fullword ascii /* Goodware String - occured 11 times */

    condition:
        uint16(0) == 0x5a4d and filesize < 907KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_1
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "Cookie: pgv_pvid=" ascii
        $x2 = "DRIVERS\\ipinip.sys" fullword wide
        $s1 = "TsWorkSpaces.dll" fullword ascii
        $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
        $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
        $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
        $s5 = "Microsoft Chart ActiveX Control" fullword wide
        $s6 = "MSChartCtrl.ocx" fullword wide
        $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
        $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */

Detection condition:
( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or 5 of them

Full rule:
rule Codoso_PGV_PVID_1
{

    meta:
        description = "Detects Codoso APT PGV PVID Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        super_rule = 1
        hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
        hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
        hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
        hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
        hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"

    strings:
        $x1 = "Cookie: pgv_pvid=" ascii
        $x2 = "DRIVERS\\ipinip.sys" fullword wide
        $s1 = "TsWorkSpaces.dll" fullword ascii
        $s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
        $s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
        $s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
        $s5 = "Microsoft Chart ActiveX Control" fullword wide
        $s6 = "MSChartCtrl.ocx" fullword wide
        $s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
        $s8 = "WUServiceMain" fullword ascii /* Goodware String - occured 2 times */
    condition:
        ( uint16(0) == 0x5a4d and ( 1 of ($x*) or 3 of them ) ) or 5 of them
}
YARA Detection Rule: Control32
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "b3dc808fc7cb4492669ec019911ef22a"

Full rule:
rule Control32 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "b3dc808fc7cb4492669ec019911ef22a"
}
YARA Detection Rule: Control64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "bec30379078d5c5c7845d3be33707b89"

Full rule:
rule Control64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "bec30379078d5c5c7845d3be33707b89"
}
YARA Detection Rule: GH_PM32
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "2f2c5b3f3b1f97908074f526ac90a28d"

Full rule:
rule GH_PM32 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "2f2c5b3f3b1f97908074f526ac90a28d"
}
YARA Detection Rule: GH_PM64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "fe6c0097412b2c7b7f4b8a489004dd14"

Full rule:
rule GH_PM64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "fe6c0097412b2c7b7f4b8a489004dd14"
}
YARA Detection Rule: MemStub32_GH1
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "0a579ad25fdd4db8110aac4dbb7d2da3"

Full rule:
rule MemStub32_GH1 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "0a579ad25fdd4db8110aac4dbb7d2da3"
}
YARA Detection Rule: MemStub32
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "8987652f26732607b769247adb4e9cce"

Full rule:
rule MemStub32 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "8987652f26732607b769247adb4e9cce"
}
YARA Detection Rule: MemStub64_GH1
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "2350403a09e6928f0a7ba5d74da58cb9"

Full rule:
rule MemStub64_GH1 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "2350403a09e6928f0a7ba5d74da58cb9"
}
YARA Detection Rule: MemStub64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "6b5b46d3212fc3fc5b455d9efd8d3ffa"

Full rule:
rule MemStub64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "6b5b46d3212fc3fc5b455d9efd8d3ffa"
}
YARA Detection Rule: msvcrt_Win7AMD64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "c8fc794cc5a22b5a1e0803b0b8acce77"

Full rule:
rule msvcrt_Win7AMD64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "c8fc794cc5a22b5a1e0803b0b8acce77"
}
YARA Detection Rule: msvcrt_Win7x86
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "7713e5c5a48b020c9575b1b50f2e5e9e"

Full rule:
rule msvcrt_Win7x86 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "7713e5c5a48b020c9575b1b50f2e5e9e"
}
YARA Detection Rule: msvcrt_WIN8AMD64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "33c59fcdf027470e0ab1d366f54a6ebf"

Full rule:
rule msvcrt_WIN8AMD64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "33c59fcdf027470e0ab1d366f54a6ebf"
}
YARA Detection Rule: msvcrt_WIN8x86
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "95490c2b284a9bb63f0ee49254ab727e"

Full rule:
rule msvcrt_WIN8x86 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "95490c2b284a9bb63f0ee49254ab727e"
}
YARA Detection Rule: msvcrt_WinXPx86
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "b68f72d77754f8b76168ced0924a4174"

Full rule:
rule msvcrt_WinXPx86 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "b68f72d77754f8b76168ced0924a4174"
}
YARA Detection Rule: Network_Win7AMD64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "eb92031a38f17d0e63285b5142b31966"

Full rule:
rule Network_Win7AMD64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "eb92031a38f17d0e63285b5142b31966"
}
YARA Detection Rule: Network_Win7x86
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "548889baed7768b828d9c2f373abd225"

Full rule:
rule Network_Win7x86 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "548889baed7768b828d9c2f373abd225"
}
YARA Detection Rule: Network_WinXPx86
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "877341a16d5d223435c43a9db7f721bc"

Full rule:
rule Network_WinXPx86 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "877341a16d5d223435c43a9db7f721bc"
}
YARA Detection Rule: RabbitStew32
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "a9d2e8ae5ddbf8f2842d96f7de2faef8"

Full rule:
rule RabbitStew32 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "a9d2e8ae5ddbf8f2842d96f7de2faef8"
}
YARA Detection Rule: RabbitStew64
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "fa415b6280104e813770df520b303897"

Full rule:
rule RabbitStew64 {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "fa415b6280104e813770df520b303897"
}
YARA Detection Rule: Vbr
Repository: Yara-Rules/rules
Author: Jaume Martin

Detection condition:
hash.md5(0, filesize) == "961d2fd68fde2ae0b7c52e0c90767d0d"

Full rule:
rule Vbr {
    meta:
        author = "Jaume Martin"
    condition:
        hash.md5(0, filesize) == "961d2fd68fde2ae0b7c52e0c90767d0d"
}