deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_Honker_net_priv_esc2
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "Usage:%s username password" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<www.darkst.com>" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 17KB and all of them

Full rule:
rule CN_Honker_net_priv_esc2 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
		id = "b4fa3129-57a3-55ee-8ca6-ecbcc135184e"
	strings:
		$s1 = "Usage:%s username password" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "<www.darkst.com>" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 17KB and all of them
}
YARA Detection Rule: CN_Honker_Oracle_v1_0_Oracle
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Oracle.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 3455KB and all of them

Full rule:
rule CN_Honker_Oracle_v1_0_Oracle {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
		id = "0cebede9-f4ff-5efb-98bc-55df0ad656a3"
	strings:
		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "OnGetPassword" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 3455KB and all of them
}
YARA Detection Rule: CN_Honker_Interception
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Interception.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
		$s5 = "WinlogonHackEx " fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 160KB and all of them

Full rule:
rule CN_Honker_Interception {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
		id = "40d350e5-c6af-58e2-a1d8-f9516af5f869"
	strings:
		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii /* PEStudio Blacklist: strings */
		$s5 = "WinlogonHackEx " fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 160KB and all of them
}
YARA Detection Rule: CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file 3.0.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
		$s9 = "CryptGenRandom" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 581 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 395KB and all of them

Full rule:
rule CN_Honker_sig_3389_DUBrute_v3_0_RC3_3_0 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
		id = "994ad7e9-2019-54b3-84e6-2762a700c939"
	strings:
		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
		$s9 = "CryptGenRandom" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 581 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 395KB and all of them
}
YARA Detection Rule: CN_Honker_windows_exp
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file exp.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii /* PEStudio Blacklist: strings */
		$s8 = "OH,Sry.Too long command." fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 220KB and all of them

Full rule:
rule CN_Honker_windows_exp {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "04334c396b165db6e18e9b76094991d681e6c993"
		id = "148900d0-cf62-5cb0-adbc-52fa8ce8832e"
	strings:
		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii /* PEStudio Blacklist: strings */
		$s8 = "OH,Sry.Too long command." fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 220KB and all of them
}
YARA Detection Rule: CN_Honker_safe3wvs_cgiscan
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file cgiscan.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s2 = "httpclient.exe" fullword wide
		$s3 = "www.safe3.com.cn" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 357KB and all of them

Full rule:
rule CN_Honker_safe3wvs_cgiscan {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
		id = "a9f7a195-deb8-5887-bc55-d1b0cac43182"
	strings:
		$s2 = "httpclient.exe" fullword wide
		$s3 = "www.safe3.com.cn" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 357KB and all of them
}
YARA Detection Rule: CN_Honker_pr_debug
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file debug.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "-->Got WMI process Pid: %d " ascii /* PEStudio Blacklist: strings */
		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 820KB and all of them

Full rule:
rule CN_Honker_pr_debug {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
		id = "6d759818-b762-56f4-8475-82a7d18a659c"
	strings:
		$s1 = "-->Got WMI process Pid: %d " ascii /* PEStudio Blacklist: strings */
		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 820KB and all of them
}
YARA Detection Rule: CN_Honker_T00ls_Lpk_Sethc_v4_0
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
		$s15 = "2011-2012 T00LS&RICES" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2077KB and all of them

Full rule:
rule CN_Honker_T00ls_Lpk_Sethc_v4_0 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
		id = "d41cbed5-a6e3-5165-a8c3-e0375c1ed75d"
	strings:
		$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */
		$s15 = "2011-2012 T00LS&RICES" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 2077KB and all of them
}
YARA Detection Rule: CN_Honker_MatriXay1073
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file MatriXay1073.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii /* PEStudio Blacklist: strings */
		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii /* PEStudio Blacklist: strings */
		$s3 = "getalluserpasswordhash" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 9100KB and all of them

Full rule:
rule CN_Honker_MatriXay1073 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2023-01-27"
		score = 70
		hash = "fef951e47524f827c7698f4508ba[PII_REDACTED]a5"
		id = "23e73b89-f60e-5bc3-8974-15be16d7c408"
	strings:
		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii /* PEStudio Blacklist: strings */
		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii /* PEStudio Blacklist: strings */
		$s3 = "getalluserpasswordhash" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 9100KB and all of them
}
YARA Detection Rule: CN_Honker_Sword1_5
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Sword1.5.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "http://www.md5.com.cn" fullword wide
		$s2 = "ListBox_Command" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "\\Set.ini" wide
		$s4 = "OpenFileDialog1" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 740KB and all of them

Full rule:
rule CN_Honker_Sword1_5 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
		id = "832e4998-64fc-5f34-a46d-aeefde0ee763"
	strings:
		$s1 = "http://www.md5.com.cn" fullword wide
		$s2 = "ListBox_Command" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "\\Set.ini" wide
		$s4 = "OpenFileDialog1" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 740KB and all of them
}
YARA Detection Rule: CN_Honker_Havij_Havij
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Havij.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of them

Full rule:
rule CN_Honker_Havij_Havij {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
		id = "b3640a32-b546-58c9-abb1-3da60dc6633c"
	strings:
		$s1 = "User-Agent: %Inject_Here%" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}
YARA Detection Rule: CN_Honker_exp_ms11011
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ms11011.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "\\i386\\Hello.pdb" ascii /* PEStudio Blacklist: strings */
		$s1 = "OS not supported." fullword ascii /* PEStudio Blacklist: strings */
		$s2 = ".Rich5" fullword ascii
		$s3 = "Not supported." fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
		$s5 = "cmd.exe" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 120 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule CN_Honker_exp_ms11011 {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
		id = "fc092166-73cd-58f6-b034-a2fe2c5fb859"
	strings:
		$s0 = "\\i386\\Hello.pdb" ascii /* PEStudio Blacklist: strings */
		$s1 = "OS not supported." fullword ascii /* PEStudio Blacklist: strings */
		$s2 = ".Rich5" fullword ascii
		$s3 = "Not supported." fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 3 times */
		$s5 = "cmd.exe" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 120 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: CN_Honker_DLL_passive_privilege_escalation_ws2help
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file ws2help.dll
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "PassMinDll.dll" fullword ascii
		$s1 = "\\ws2help.dll" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and all of them

Full rule:
rule CN_Honker_DLL_passive_privilege_escalation_ws2help {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
		id = "85a07bb7-2856-56f0-bd15-e020bb2a7692"
	strings:
		$s0 = "PassMinDll.dll" fullword ascii
		$s1 = "\\ws2help.dll" ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 30KB and all of them
}
YARA Detection Rule: CN_Honker_Webshell
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Webshell.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "Do you want to cancel the file download?" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Downloading: %s" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 381KB and all of them

Full rule:
rule CN_Honker_Webshell {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
		id = "12870766-2b85-522d-9ad8-abba2786caaf"
	strings:
		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii /* PEStudio Blacklist: strings */
		$s2 = "Do you want to cancel the file download?" fullword ascii /* PEStudio Blacklist: strings */
		$s3 = "Downloading: %s" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 381KB and all of them
}
YARA Detection Rule: CN_Honker_AspxClient
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file AspxClient.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s1 = "\\tools\\hashq\\hashq.exe" wide
		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
		$s3 = "\\myshell.mdb" wide /* PEStudio Blacklist: strings */
		$s4 = "injectfile" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them

Full rule:
rule CN_Honker_AspxClient {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		modified = "2022-12-21"
		score = 70
		hash = "67569a89128f503a459eab3daa[PII_REDACTED]f2d2"
		id = "7e38365c-ffe5-5fcd-8bd6-948d255d6e10"
	strings:
		$s1 = "\\tools\\hashq\\hashq.exe" wide
		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
		$s3 = "\\myshell.mdb" wide /* PEStudio Blacklist: strings */
		$s4 = "injectfile" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them
}
YARA Detection Rule: CN_Honker_Fckeditor
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Fckeditor.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide /* PEStudio Blacklist: strings */
		$s7 = "Fckeditor.exe" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1340KB and all of them

Full rule:
rule CN_Honker_Fckeditor {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "4b16ae12c204f64265acef872526b27111b68820"
		id = "eb8767cb-b081-5c37-b7ad-57a0de047462"
	strings:
		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide /* PEStudio Blacklist: strings */
		$s7 = "Fckeditor.exe" fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 1340KB and all of them
}
YARA Detection Rule: CN_Honker_Codeeer_Explorer
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s2 = "Codeeer Explorer.exe" fullword wide /* PEStudio Blacklist: strings */
		$s12 = "webBrowser1_ProgressChanged" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 470KB and all of them

Full rule:
rule CN_Honker_Codeeer_Explorer {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
		id = "d4a88ae7-c0b2-57d2-a070-3dd748a30a3a"
	strings:
		$s2 = "Codeeer Explorer.exe" fullword wide /* PEStudio Blacklist: strings */
		$s12 = "webBrowser1_ProgressChanged" fullword ascii /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 470KB and all of them
}
YARA Detection Rule: CN_Honker_SwordHonkerEdition
Repository: Neo23x0/signature-base
Detects: Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe
Author: Florian Roth (Nextron Systems)
Reference: Disclosed CN Honker Pentest Toolset

Pattern signatures:
$s0 = "\\bin\\systemini\\MyPort.ini" wide /* PEStudio Blacklist: strings */
		$s1 = "PortThread=200 //" fullword wide /* PEStudio Blacklist: strings */
		$s2 = " Port Open -> " fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 375KB and all of them

Full rule:
rule CN_Honker_SwordHonkerEdition {
	meta:
		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Disclosed CN Honker Pentest Toolset"
		date = "2015-06-23"
		score = 70
		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
		id = "5688fa03-bcb0-545d-9fdf-7ab48a389424"
	strings:
		$s0 = "\\bin\\systemini\\MyPort.ini" wide /* PEStudio Blacklist: strings */
		$s1 = "PortThread=200 //" fullword wide /* PEStudio Blacklist: strings */
		$s2 = " Port Open -> " fullword wide /* PEStudio Blacklist: strings */
	condition:
		uint16(0) == 0x5a4d and filesize < 375KB and all of them
}