deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: IronGate_PyInstaller_update_EXE
Repository: Neo23x0/signature-base
Detects: Detects a PyInstaller file named update.exe as mentioned in the IronGate APT
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Mr6M2J

Pattern signatures:
$s1 = "bpython27.dll" fullword ascii
      $s5 = "%s%s.exe" fullword ascii
      $s6 = "bupdate.exe.manifest" fullword ascii
      $s9 = "bunicodedata.pyd" fullword ascii
      $s11 = "distutils.sysconfig(" ascii
      $s16 = "distutils.debug(" ascii
      $s18 = "supdate" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule IronGate_PyInstaller_update_EXE {
   meta:
      description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/Mr6M2J"
      date = "2016-06-04"
      modified = "2023-01-06"
      score = 60
      hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
      id = "f8d1b97e-86d9-547f-a212-a84fb068af3c"
   strings:
      $s1 = "bpython27.dll" fullword ascii
      $s5 = "%s%s.exe" fullword ascii
      $s6 = "bupdate.exe.manifest" fullword ascii
      $s9 = "bunicodedata.pyd" fullword ascii
      $s11 = "distutils.sysconfig(" ascii
      $s16 = "distutils.debug(" ascii
      $s18 = "supdate" fullword ascii
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: Nirsoft_NetResView
Repository: Neo23x0/signature-base
Detects: Detects NirSoft NetResView - utility that displays the list of all network resources
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/Mr6M2J

Pattern signatures:
$s1 = "NetResView.exe" fullword wide
		$s2 = "2005 - 2013 Nir Sofer" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule Nirsoft_NetResView {
	meta:
		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/Mr6M2J"
		date = "2016-06-04"
		score = 40
		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
		id = "bf786432-3ecf-510e-8d95-50aff09826ce"
	strings:
		$s1 = "NetResView.exe" fullword wide
		$s2 = "2005 - 2013 Nir Sofer" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: WoolenGoldfish_Sample_1
Repository: Neo23x0/signature-base
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$s1 = "Cannot execute (%d)" fullword ascii
		$s16 = "SvcName" fullword ascii

Detection condition:
all of them

Full rule:
rule WoolenGoldfish_Sample_1 {
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 60
		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
		id = "923de51a-8422-5318-95f5-79613d2d642e"
	strings:
		$s1 = "Cannot execute (%d)" fullword ascii
		$s16 = "SvcName" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: WoolenGoldfish_Generic_1
Repository: Neo23x0/signature-base
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$x0 = "Users\\Wool3n.H4t\\"
		$x1 = "C-CPP\\CWoolger"
		$x2 = "NTSuser.exe" fullword wide

		$s1 = "107.6.181.116" fullword wide
		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
		$s6 = "wlg.dat" fullword
		$s7 = "woolger" fullword wide
		$s8 = "[Enter]" fullword
		$s9 = "[Control]" fullword

Detection condition:
( 1 of ($x*) and 2 of ($s*) ) or
		( 6 of ($s*) )

Full rule:
rule WoolenGoldfish_Generic_1 {
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		super_rule = 1
		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
		id = "351f5ee5-c0ec-51b6-9953-2b64e3e74b09"
	strings:
		$x0 = "Users\\Wool3n.H4t\\"
		$x1 = "C-CPP\\CWoolger"
		$x2 = "NTSuser.exe" fullword wide

		$s1 = "107.6.181.116" fullword wide
		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
		$s6 = "wlg.dat" fullword
		$s7 = "woolger" fullword wide
		$s8 = "[Enter]" fullword
		$s9 = "[Control]" fullword
	condition:
		( 1 of ($x*) and 2 of ($s*) ) or
		( 6 of ($s*) )
}
YARA Detection Rule: WoolenGoldfish_Generic_2
Repository: Neo23x0/signature-base
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii

Detection condition:
all of them

Full rule:
rule WoolenGoldfish_Generic_2 {
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
		id = "930b928f-ff32-56b2-9e3c-dd80036ff7ef"
	strings:
		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
	condition:
		all of them
}
YARA Detection Rule: WoolenGoldfish_Generic_3
Repository: Neo23x0/signature-base
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii

		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
		$s4 = "unable to load kernel32.dll" fullword ascii
		$s5 = "index.php?c=%S&r=%x" fullword wide
		$s6 = "%s len:%d " fullword ascii
		$s7 = "Encountered error sending syscall response to client" fullword ascii
		$s9 = "/info.dat" fullword ascii
		$s10 = "Error entering thread lock" fullword ascii
		$s11 = "Error exiting thread lock" fullword ascii
		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii

Detection condition:
( 1 of ($x*) ) or
		( 8 of ($s*) )

Full rule:
rule WoolenGoldfish_Generic_3 {
	meta:
		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/NpJpVZ"
		date = "2015/03/25"
		score = 90
		hash1 = "86222ef166474e53f1eb6d7e[PII_REDACTED]e6fee7"
		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
		id = "5c227d24-624c-5fb5-a2ea-a971fda8bfba"
	strings:
		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii

		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
		$s4 = "unable to load kernel32.dll" fullword ascii
		$s5 = "index.php?c=%S&r=%x" fullword wide
		$s6 = "%s len:%d " fullword ascii
		$s7 = "Encountered error sending syscall response to client" fullword ascii
		$s9 = "/info.dat" fullword ascii
		$s10 = "Error entering thread lock" fullword ascii
		$s11 = "Error exiting thread lock" fullword ascii
		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
	condition:
		( 1 of ($x*) ) or
		( 8 of ($s*) )
}
YARA Detection Rule: WaterBug_wipbot_2013_core_PDF
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/

Detection condition:
uint32(0) == 0x46445025 and #a > 150 and #b > 200

Full rule:
rule WaterBug_wipbot_2013_core_PDF {
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
	strings:
		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
	condition:
		uint32(0) == 0x46445025 and #a > 150 and #b > 200
}
YARA Detection Rule: WaterBug_wipbot_2013_dll
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$string1 = "/%s?rank=%s"
		$string2 = "ModuleStart\x00ModuleStop\x00start"
		$string3 = "1156fd22-3443-4344-c4ffff"
		//read file... error..
		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"

Detection condition:
2 of them

Full rule:
rule WaterBug_wipbot_2013_dll {
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "2aae09a3-6e59-5951-941e-c1f82aada979"
	strings:
		$string1 = "/%s?rank=%s"
		$string2 = "ModuleStart\x00ModuleStop\x00start"
		$string3 = "1156fd22-3443-4344-c4ffff"
		//read file... error..
		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
	condition:
		2 of them
}
YARA Detection Rule: WaterBug_wipbot_2013_core
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}

Detection condition:
uint16(0) == 0x5A4D  and (($code1 or $code2) or ($code3 and $code4))

Full rule:
rule WaterBug_wipbot_2013_core {
	meta:
		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
	strings:
		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
	condition:
		uint16(0) == 0x5A4D  and (($code1 or $code2) or ($code3 and $code4))
}
YARA Detection Rule: WaterBug_turla_dropper
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - Trojan Turla Dropper
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}

Detection condition:
all of them

Full rule:
rule WaterBug_turla_dropper {
	meta:
		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "f9683ac7-36f3-5a2a-8b76-e8e2527f4e0d"
	strings:
		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
	condition:
		all of them
}
YARA Detection Rule: WaterBug_fa_malware
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - FA malware variant
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
		$string2 = "d:\\proj\\cn\\fa64\\"
		$string3 = "sengoku_Win32.sys\x00"
		$string4 = "rk_ntsystem.c"
		$string5 = "\\uroboros\\"
		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"

Detection condition:
uint16(0) == 0x5A4D  and (any of ($string*))

Full rule:
rule WaterBug_fa_malware {
	meta:
		description = "Symantec Waterbug Attack - FA malware variant"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "b09f798a-2875-59ca-b880-971d8f973c76"
	strings:
		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
		$string2 = "d:\\proj\\cn\\fa64\\"
		$string3 = "sengoku_Win32.sys\x00"
		$string4 = "rk_ntsystem.c"
		$string5 = "\\uroboros\\"
		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
	condition:
		uint16(0) == 0x5A4D  and (any of ($string*))
}
YARA Detection Rule: WaterBug_turla_dll
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - Trojan Turla DLL
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/

Detection condition:
pe.exports("ee") and $a

Full rule:
rule WaterBug_turla_dll {
	meta:
		description = "Symantec Waterbug Attack - Trojan Turla DLL"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
	strings:
		$a = /([A-Za-z0-9]{2,10}_){,2}Win32\.dll\x00/
	condition:
		pe.exports("ee") and $a
}
YARA Detection Rule: WaterBug_sav_dropper
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - SAV Dropper
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$mz = "MZ"
		$a = /[a-z]{,10}_x64.sys\x00hMZ\x00/

Detection condition:
($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a

Full rule:
rule WaterBug_sav_dropper {
	meta:
		description = "Symantec Waterbug Attack - SAV Dropper"
		author = "Symantec Security Response"
		date = "22.01.2015"
		reference = "http://t.co/rF35OaAXrl"
		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
	strings:
		$mz = "MZ"
		$a = /[a-z]{,10}_x64.sys\x00hMZ\x00/
	condition:
		($mz at 0) and uint32(0x400) == 0x000000c3 and pe.number_of_sections == 6 and $a
}
YARA Detection Rule: WaterBug_sav
Repository: Neo23x0/signature-base
Detects: Symantec Waterbug Attack - SAV Malware
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
		$code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}

Detection condition:
uint16(0) == 0x5A4D and (($code1a or $code1b or $code1c) and $code2)

Full rule:
rule WaterBug_sav {
	meta:
		description = "Symantec Waterbug Attack - SAV Malware"
		author = "Symantec Security Response"
		date = "2015-01-22"
		modified = "2023-01-27"
		reference = "http://t.co/rF35OaAXrl"
		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
	strings:
		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
		$code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
	condition:
		uint16(0) == 0x5A4D and (($code1a or $code1b or $code1c) and $code2)
}
YARA Detection Rule: ATM_Malware_JavaDispCash
Repository: Neo23x0/signature-base
Detects: Detects ATM Malware JavaDispCash
Author: Frank Boldewin (@r3c0nst)
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]23674882

Pattern signatures:
$CashInfo = "getNumberOfCashUnits" ascii wide
		$Dispense = "waitforbillstaken" ascii wide
		$Inject = "No code to inject!" ascii wide
		$config = ".Agentcli" ascii wide
		$log1 = "logft.log" ascii wide
		$log2 = ".loginside" ascii wide

Detection condition:
uint16(0) == 0x4B50 and filesize < 500KB and all of them

Full rule:
rule ATM_Malware_JavaDispCash {
	meta:
		description = "Detects ATM Malware JavaDispCash"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/[PII_REDACTED]23674882"
		date = "2019-03-28"
		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
		hash2 = "ef407db8c[PII_REDACTED]8364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"

		id = "7aa91719-6539-572a-8618-bfb5290a5b59"
	strings:
		$CashInfo = "getNumberOfCashUnits" ascii wide
		$Dispense = "waitforbillstaken" ascii wide
		$Inject = "No code to inject!" ascii wide
		$config = ".Agentcli" ascii wide
		$log1 = "logft.log" ascii wide
		$log2 = ".loginside" ascii wide

	condition:
		uint16(0) == 0x4B50 and filesize < 500KB and all of them
}
YARA Detection Rule: SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]08437762

Detection condition:
uint16(0) == 0x5a4d and filesize < 100MB and
      pe.timestamp >[PII_REDACTED] and  // comment out to find all files signed with that certificate
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (
            pe

Full rule:
rule SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 {
   meta:
      description = "Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022"
      author = "Florian Roth (Nextron Systems)"
      date = "2022-03-03"
      modified = "2022-03-04"
      score = 70
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]08437762"
      id = "8bc7460f-a1c4-5157-8c2d-34d3a6c9c7e9"
   condition:
      uint16(0) == 0x5a4d and filesize < 100MB and
      pe.timestamp >[PII_REDACTED] and  // comment out to find all files signed with that certificate
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (
            pe.signatures[i].serial == "43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or
            pe.signatures[i].serial == "14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18"
         )
   )
}
YARA Detection Rule: M_APT_VIRTUALPITA_1
Repository: Neo23x0/signature-base
Detects: Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)
Author: Mandiant

Pattern signatures:
$x = { 8b ?? ?? 4? b8 04 00 00 00 [0-4] ba 02 00 00 00 be 01 00 00 00 [0-2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0-50] ba 10 00 00 00 [0-10] e8 }

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule M_APT_VIRTUALPITA_1 {
   meta:
      author = "Mandiant"
      md5 = "fe34b7c071d96dac498b72a4a07cb246"
      description = "Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)"
      modified = "2023-11-25"
      score = 60  // reduced score by Florian Roth due to FPs
      id = "bdfbe29a-f7db-50d9-a909-d4ca96cc0731"
   strings:
      $x = { 8b ?? ?? 4? b8 04 00 00 00 [0-4] ba 02 00 00 00 be 01 00 00 00 [0-2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0-50] ba 10 00 00 00 [0-10] e8 }
   condition:
      uint32(0) == 0x464c457f and all of them
}