deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: sig_5783b35b2eace55a5762df27fcb0b0fb28371b3e
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file 5783b35b2eace55a5762df27fcb0b0fb28371b3e.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = "B+P:\\6" fullword ascii
		$s2 = "6.666K6S6d6l6}6" fullword ascii
		$s3 = "0!0&0+0<0A0F0W0\\0a0n0z0" fullword ascii
		$s4 = ";#;);.;:;@;E;Q;W;\\;h;q;v;" fullword ascii
		$s5 = "2#2-222F2L2W2\\2b2g2x2~2" fullword ascii
		$s6 = "9\"9)90979>9E9L9S9Z9k9}9" fullword ascii
		$s7 = "6-747;7B7I7P7W7^7e7l7s7z7" fullword ascii
		$s8 = "4\"4'43494>4J4P4U4a4g4l4x4" fullword ascii
		$s9 = ":#:(:4:::?:K:T:Y:e:k:p:|:" fullword ascii
		$s10 = "WD.hyA" fullword ascii
		$s11 = "<\"<)<0<7<><E<L<S<Z<a<h<" fullword ascii
		$s12 = "=&=,=1=>=D=I=V=_=d=q=w=|=" fullword ascii
		$s13 = "; ;(;0;8;@;H;P;X;`;h;p;{;" fullword ascii
		$s14 = "<\"<)<0<7<><E<L<S<Z<a<h<o<v<" fullword ascii
		$s15 = "6#6(616;6@6I6S6X6d6n6s6|6" fullword ascii
		$s16 = "(%r-c;u" fullword ascii
		$s17 = "3%3G3N3U3\\3c3j3q3x3" fullword ascii
		$s18 = "7\"767T7[7b7i7p7w7~7" fullword ascii
		$s19 = "1 1-1>1C1P1a1f1s1" fullword ascii
		$s20 = "8 8&8,8A8M8^8d8i8" fullword ascii

		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
		$op1 = {

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule sig_5783b35b2eace55a5762df27fcb0b0fb28371b3e {
	meta:
		description = "Auto-generated rule - file 5783b35b2eace55a5762df27fcb0b0fb28371b3e.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		hash1 = "72513534f2e0f3e77a22023b887df3718c9df70686eb0ae58cbbde2f90f447e4"
	strings:
		$s1 = "B+P:\\6" fullword ascii
		$s2 = "6.666K6S6d6l6}6" fullword ascii
		$s3 = "0!0&0+0<0A0F0W0\\0a0n0z0" fullword ascii
		$s4 = ";#;);.;:;@;E;Q;W;\\;h;q;v;" fullword ascii
		$s5 = "2#2-222F2L2W2\\2b2g2x2~2" fullword ascii
		$s6 = "9\"9)90979>9E9L9S9Z9k9}9" fullword ascii
		$s7 = "6-747;7B7I7P7W7^7e7l7s7z7" fullword ascii
		$s8 = "4\"4'43494>4J4P4U4a4g4l4x4" fullword ascii
		$s9 = ":#:(:4:::?:K:T:Y:e:k:p:|:" fullword ascii
		$s10 = "WD.hyA" fullword ascii
		$s11 = "<\"<)<0<7<><E<L<S<Z<a<h<" fullword ascii
		$s12 = "=&=,=1=>=D=I=V=_=d=q=w=|=" fullword ascii
		$s13 = "; ;(;0;8;@;H;P;X;`;h;p;{;" fullword ascii
		$s14 = "<\"<)<0<7<><E<L<S<Z<a<h<o<v<" fullword ascii
		$s15 = "6#6(616;6@6I6S6X6d6n6s6|6" fullword ascii
		$s16 = "(%r-c;u" fullword ascii
		$s17 = "3%3G3N3U3\\3c3j3q3x3" fullword ascii
		$s18 = "7\"767T7[7b7i7p7w7~7" fullword ascii
		$s19 = "1 1-1>1C1P1a1f1s1" fullword ascii
		$s20 = "8 8&8,8A8M8^8d8i8" fullword ascii

		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
		$op1 = { a1 e0 79 44 00 57 ff 75 1c ff 90 78 01 00 00 83 } /* Opcode */
		$op2 = { 3c ee 42 00 c7 84 24 8c } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )
}
YARA Detection Rule: sig_2fb404bdcebc7acbeb598f8a2ddbecf48c60b113
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file 2fb404bdcebc7acbeb598f8a2ddbecf48c60b113.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = ":%:0:;:F:Q:\\:p:|:" fullword ascii
		$s2 = "6.666>6F6N6V6^6f6n6v6~6" fullword ascii
		$s3 = "6!6(6/666=6D6K6R6Y6r6:7" fullword ascii
		$s4 = "1t83jL.bjG" fullword ascii
		$s5 = "6!61666V6]6p6" fullword ascii
		$s6 = "2%2D2P2`2p2|2" fullword ascii
		$s7 = "42494@4G4N4U4\\4c4j4q4x4" fullword ascii
		$s8 = "9+92999@9G9N9U9\\9c9j9q9x9" fullword ascii
		$s9 = "4!4&43484E4J4W4\\4i4n4s4" fullword ascii
		$s10 = "5$5+52595@5G5N5U5\\5c5j5q5" fullword ascii
		$s11 = "1.252<2C2J2Q2X2_2f2m2t2{2" fullword ascii
		$s12 = "8 8%818:8?8K8Q8V8b8h8m8y8" fullword ascii
		$s13 = "9'93989=9B9K9P9U9Z9c9n9s9" fullword ascii
		$s14 = ":\":':,:8:=:B:R:Z:`:e:v:}:" fullword ascii
		$s15 = "=#=(=4=:=?=K=Q=V=b=k=p=|=" fullword ascii
		$s16 = "= =*=1=8=?=F=M=T=[=b=i=p=w=~=" fullword ascii
		$s17 = "3&3-343;3B3I3P3W3^3e3l3s3z3" fullword ascii
		$s18 = ":!:(:/:6:=:I:N:S:`:f:k:x:~:" fullword ascii
		$s19 = "cMDkAjy=" fullword ascii
		$s20 = "=#=/=4=9=E=J=O=[=`=e=q=v={=" fullword ascii

		$op0 = { e0 b3 42 00 c7 

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule sig_2fb404bdcebc7acbeb598f8a2ddbecf48c60b113 {
	meta:
		description = "Auto-generated rule - file 2fb404bdcebc7acbeb598f8a2ddbecf48c60b113.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
	strings:
		$s1 = ":%:0:;:F:Q:\\:p:|:" fullword ascii
		$s2 = "6.666>6F6N6V6^6f6n6v6~6" fullword ascii
		$s3 = "6!6(6/666=6D6K6R6Y6r6:7" fullword ascii
		$s4 = "1t83jL.bjG" fullword ascii
		$s5 = "6!61666V6]6p6" fullword ascii
		$s6 = "2%2D2P2`2p2|2" fullword ascii
		$s7 = "42494@4G4N4U4\\4c4j4q4x4" fullword ascii
		$s8 = "9+92999@9G9N9U9\\9c9j9q9x9" fullword ascii
		$s9 = "4!4&43484E4J4W4\\4i4n4s4" fullword ascii
		$s10 = "5$5+52595@5G5N5U5\\5c5j5q5" fullword ascii
		$s11 = "1.252<2C2J2Q2X2_2f2m2t2{2" fullword ascii
		$s12 = "8 8%818:8?8K8Q8V8b8h8m8y8" fullword ascii
		$s13 = "9'93989=9B9K9P9U9Z9c9n9s9" fullword ascii
		$s14 = ":\":':,:8:=:B:R:Z:`:e:v:}:" fullword ascii
		$s15 = "=#=(=4=:=?=K=Q=V=b=k=p=|=" fullword ascii
		$s16 = "= =*=1=8=?=F=M=T=[=b=i=p=w=~=" fullword ascii
		$s17 = "3&3-343;3B3I3P3W3^3e3l3s3z3" fullword ascii
		$s18 = ":!:(:/:6:=:I:N:S:`:f:k:x:~:" fullword ascii
		$s19 = "cMDkAjy=" fullword ascii
		$s20 = "=#=/=4=9=E=J=O=[=`=e=q=v={=" fullword ascii

		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
		$op1 = { 3c ee 42 00 c7 84 24 8c } /* Opcode */
		$op2 = { a1 e0 79 44 00 83 c4 0c ff 74 24 1c ff 90 3c 01 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )
}
YARA Detection Rule: GlassesCode
Repository: Yara-Rules/rules
Detects: Glasses code features
Author: Seth Hardy

Pattern signatures:
$ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }

Detection condition:
any of them

Full rule:
private rule GlassesCode : Glasses Family 
{
    meta:
        description = "Glasses code features"
        author = "Seth Hardy"
        last_modified = "2021-11-18"
        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"

        
    strings:
        $ = { B8 AB AA AA AA F7 E1 D1 EA 8D 04 52 2B C8 }
        $ = { B8 56 55 55 55 F7 E9 8B 4C 24 1C 8B C2 C1 E8 1F 03 D0 49 3B CA }
        
    condition:
        any of them
}
YARA Detection Rule: GlassesStrings
Repository: Yara-Rules/rules
Detects: Strings used by Glasses
Author: Seth Hardy

Pattern signatures:
$ = "thequickbrownfxjmpsvalzydg"
        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
        $ = "\" target=\"NewRef\"></a>"

Detection condition:
all of them

Full rule:
rule GlassesStrings : Glasses Family
{
    meta:
        description = "Strings used by Glasses"
        author = "Seth Hardy"
        last_modified = "2021-11-18"
        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"
        
    strings:
        $ = "thequickbrownfxjmpsvalzydg"
        $ = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0; %s.%s)"
        $ = "\" target=\"NewRef\"></a>"
 
    condition:
        all of them

}
YARA Detection Rule: Glasses
Repository: Yara-Rules/rules
Detects: Glasses family
Author: Seth Hardy

Detection condition:
GlassesCode and GlassesStrings

Full rule:
rule Glasses : Family
{
    meta:
        description = "Glasses family"
        author = "Seth Hardy"
        last_modified = "2021-11-18"
        reference_file = "aaf262fde1738dbf0bb50213a9624cd6705ebcaeb06c5fcaf7e9f33695d3fc33"
        reference_url = "https://citizenlab.ca/2013/02/apt1s-glasses-watching-a-human-rights-organization/"
   
    condition:
        GlassesCode and GlassesStrings
        
}
YARA Detection Rule: AthenaHTTP
Repository: Yara-Rules/rules
Detects: Identify Athena HTTP
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "%s(%s)"
        $s2 = "type:on_exec"
        $s3 = "uid:%s"
        $s4 = "priv:%s"
        $s5 = "arch:x%s"
        $s6 = "gend:%s"
        $s7 = "cores:%i"
        $s8 = "ver:%s"
        $s9 = "net:%s"

Detection condition:
all of them

Full rule:
rule AthenaHTTP
{
    
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-08-09"
        description = "Identify Athena HTTP"
    
    strings:
        $s1 = "%s(%s)"
        $s2 = "type:on_exec"
        $s3 = "uid:%s"
        $s4 = "priv:%s"
        $s5 = "arch:x%s"
        $s6 = "gend:%s"
        $s7 = "cores:%i"
        $s8 = "ver:%s"
        $s9 = "net:%s"
    
    condition:
        all of them
}
YARA Detection Rule: AthenaHTTP_v2
Repository: Yara-Rules/rules
Detects: Athena HTTP identification
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$fmt_str1="|type:on_exec|uid:%s|priv:%s|arch:x%s|gend:%s|cores:%i|os:%s|ver:%s|net:%s|"
        $fmt_str2="|type:repeat|uid:%s|ram:%ld|bk_killed:%i|bk_files:%i|bk_keys:%i|busy:%s|"
        $cmd1 = "filesearch.stop"
        $cmd2 = "rapidget"
        $cmd3 = "layer4."
        $cmd4 = "slowloris"
        $cmd5 = "rudy"

Detection condition:
all of ($fmt_str*) and 3 of ($cmd*)

Full rule:
rule AthenaHTTP_v2 
{
    
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        description = "Athena HTTP identification"
        source = "https://github.com/arbor/yara/blob/master/athena.yara"

    strings:
        $fmt_str1="|type:on_exec|uid:%s|priv:%s|arch:x%s|gend:%s|cores:%i|os:%s|ver:%s|net:%s|"
        $fmt_str2="|type:repeat|uid:%s|ram:%ld|bk_killed:%i|bk_files:%i|bk_keys:%i|busy:%s|"
        $cmd1 = "filesearch.stop"
        $cmd2 = "rapidget"
        $cmd3 = "layer4."
        $cmd4 = "slowloris"
        $cmd5 = "rudy"
   
    condition:
        all of ($fmt_str*) and 3 of ($cmd*)
}
YARA Detection Rule: AthenaIRC
Repository: Yara-Rules/rules
Detects: Athena IRC v1.8.x, 2.x identification
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$cmd1 = "ddos." fullword
        $cmd2 = "layer4." fullword
        $cmd3 = "war." fullword
        $cmd4 = "smartview" fullword
        $cmd5 = "ftp.upload" fullword
        $msg1 = "%s %s :%s LAYER4 Combo Flood: Stopped"
        $msg2 = "%s %s :%s IRC War: Flood started [Type: %s | Target: %s]"
        $msg3 = "%s %s :%s FTP Upload: Failed"
        $msg4 = "Athena v2"
        $msg5 = "%s %s :%s ECF Flood: Stopped [Total Connections: %ld | Rate: %ld Connections/Second]"
        // v1 strs
        $amsg1 = "ARME flood on %s/%s:%i for %i seconds [Host confirmed vulnerable"
        $amsg2 = " Rapid HTTP Combo flood on %s:%i for %i seconds"
        $amsg3 = "Began flood: %i connections every %i ms to %s:%i"
        $amsg4 = "IPKiller>Athena"
        $amsg5 = "Athena=Shit!"
        $amsg6 = "Athena-v1"
        $amsg7 = "BTC wallet.dat file found"
        $amsg8 = "MineCraft lastlogin file found"
        $amsg9 = "Process '%s' was found and scheduled for deletion upon next reboot"
        $

Detection condition:
(all of ($cmd*) and 3 of ($msg*)) or (5 of ($amsg*) and 5 of ($acmd*))

Full rule:
rule AthenaIRC 
{

    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        description = "Athena IRC v1.8.x, 2.x identification"
        source = "https://github.com/arbor/yara/blob/master/athena.yara"

    strings:
        $cmd1 = "ddos." fullword
        $cmd2 = "layer4." fullword
        $cmd3 = "war." fullword
        $cmd4 = "smartview" fullword
        $cmd5 = "ftp.upload" fullword
        $msg1 = "%s %s :%s LAYER4 Combo Flood: Stopped"
        $msg2 = "%s %s :%s IRC War: Flood started [Type: %s | Target: %s]"
        $msg3 = "%s %s :%s FTP Upload: Failed"
        $msg4 = "Athena v2"
        $msg5 = "%s %s :%s ECF Flood: Stopped [Total Connections: %ld | Rate: %ld Connections/Second]"
        // v1 strs
        $amsg1 = "ARME flood on %s/%s:%i for %i seconds [Host confirmed vulnerable"
        $amsg2 = " Rapid HTTP Combo flood on %s:%i for %i seconds"
        $amsg3 = "Began flood: %i connections every %i ms to %s:%i"
        $amsg4 = "IPKiller>Athena"
        $amsg5 = "Athena=Shit!"
        $amsg6 = "Athena-v1"
        $amsg7 = "BTC wallet.dat file found"
        $amsg8 = "MineCraft lastlogin file found"
        $amsg9 = "Process '%s' was found and scheduled for deletion upon next reboot"
        $amsg10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12)"
        // Athena-v1.8.3
        $amsg11 = "Rapid Connect/Disconnect"
        $amsg12 = "BTC wallet.dat found,"
        // v1 cmds
        $acmd1 = ":!arme"
        $acmd2 = ":!openurl"
        $acmd3 = ":!condis"
        $acmd4 = ":!httpcombo"
        $acmd5 = ":!urlblock"
        $acmd6 = ":!udp"
        $acmd7 = ":!btcwallet"
   
    condition:
        (all of ($cmd*) and 3 of ($msg*)) or (5 of ($amsg*) and 5 of ($acmd*))
}
YARA Detection Rule: StringDotSimplified
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		F3 AB     rep stosd
		80 3A 00  cmp     byte ptr [edx], 0
		74 15     jz      short loc_404170
		8A 02     mov     al, [edx]
		3C 2E     cmp     al, 2Eh
		74 07     jz      short loc_404168
		3C 20     cmp     al, 20h
		74 03     jz      short loc_404168
		88 06     mov     [esi], al
		46        inc     esi
	*/

	$a = {	F3 AB 	80 ?? 00 	74 ?? 	8A 02 	3C 2E 	74 ?? 	3C 20 	74 ?? 	88 06 	46 }

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule StringDotSimplified: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		F3 AB     rep stosd
		80 3A 00  cmp     byte ptr [edx], 0
		74 15     jz      short loc_404170
		8A 02     mov     al, [edx]
		3C 2E     cmp     al, 2Eh
		74 07     jz      short loc_404168
		3C 20     cmp     al, 20h
		74 03     jz      short loc_404168
		88 06     mov     [esi], al
		46        inc     esi
	*/

	$a = {	F3 AB 	80 ?? 00 	74 ?? 	8A 02 	3C 2E 	74 ?? 	3C 20 	74 ?? 	88 06 	46 }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: FakeTLS_ServerHelloGetSelectedCipher
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		24 10           and     al, 10h
		0C 10           or      al, 10h
		89 07           mov     [edi], eax
		66 8B 44 24 14  mov     ax, [esp+0Ch+wCipherSuiteID]
		66 3D 00 C0     cmp     ax, 0C000h
		73 34           jnb     short loc_4067C1
		66 2D 35 00     sub     ax, 35h
		66 F7 D8        neg     ax
		1B C0           sbb     eax, eax
		24 80           and     al, 80h
		05 00 01 00 00  add     eax, 100h
		8B D8           mov     ebx, eax
		53              push    ebx             ; hostshort
	*/

	$a = {	24 10 	0C 10 	89 ?? 	66 8? [3] 66 3? 00 C0 73 ?? 66 2? 35 00 66 F7 ?? 1B ?? 	2? 80 0? 00 01 00 00 8B ?? 5? }

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule FakeTLS_ServerHelloGetSelectedCipher: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		24 10           and     al, 10h
		0C 10           or      al, 10h
		89 07           mov     [edi], eax
		66 8B 44 24 14  mov     ax, [esp+0Ch+wCipherSuiteID]
		66 3D 00 C0     cmp     ax, 0C000h
		73 34           jnb     short loc_4067C1
		66 2D 35 00     sub     ax, 35h
		66 F7 D8        neg     ax
		1B C0           sbb     eax, eax
		24 80           and     al, 80h
		05 00 01 00 00  add     eax, 100h
		8B D8           mov     ebx, eax
		53              push    ebx             ; hostshort
	*/

	$a = {	24 10 	0C 10 	89 ?? 	66 8? [3] 66 3? 00 C0 73 ?? 66 2? 35 00 66 F7 ?? 1B ?? 	2? 80 0? 00 01 00 00 8B ?? 5? }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: XORDecodeA7
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		8A 04 17  mov     al, [edi+edx]
		8B FB     mov     edi, ebx
		34 A7     xor     al, 0A7h
		46        inc     esi
		88 02     mov     [edx], al
		83 C9 FF  or      ecx, 0FFFFFFFFh
		33 C0     xor     eax, eax
		42        inc     edx
		F2 AE     repne scasb
		F7 D1     not     ecx
		49        dec     ecx
		3B F1     cmp     esi, ecx
	*/

	$a = {	8A [2] 	8B ??	34 A7 	46 88 ?? 83 ?? FF 33 ?? 4? F2 AE F7 ?? 	4? 3B ?? }

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule XORDecodeA7: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		8A 04 17  mov     al, [edi+edx]
		8B FB     mov     edi, ebx
		34 A7     xor     al, 0A7h
		46        inc     esi
		88 02     mov     [edx], al
		83 C9 FF  or      ecx, 0FFFFFFFFh
		33 C0     xor     eax, eax
		42        inc     edx
		F2 AE     repne scasb
		F7 D1     not     ecx
		49        dec     ecx
		3B F1     cmp     esi, ecx
	*/

	$a = {	8A [2] 	8B ??	34 A7 	46 88 ?? 83 ?? FF 33 ?? 4? F2 AE F7 ?? 	4? 3B ?? }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: DynamicAPILoading
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		83 C4 04           add     esp, 4
		50                 push    eax             ; lpProcName
		56                 push    esi             ; hModule
		FF 15 20 F0 40 00  call    ds:GetProcAddress
		68 A8 0C 41 00     push    offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
		A3 DC 3E 41 00     mov     GetProcAddress_0, eax
		E8 7D FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 94 0C 41 00     push    offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
		A3 D4 3E 41 00     mov     LoadLibraryW, eax
		E8 63 FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 80 0C 41 00     push    offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
		A3 D8 3E 41 00   

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule DynamicAPILoading: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55.ex_"

	strings:
	/*
		83 C4 04           add     esp, 4
		50                 push    eax             ; lpProcName
		56                 push    esi             ; hModule
		FF 15 20 F0 40 00  call    ds:GetProcAddress
		68 A8 0C 41 00     push    offset aLo_adlIbr_arYw; "Lo.adL ibr.ar yW"
		A3 DC 3E 41 00     mov     GetProcAddress_0, eax
		E8 7D FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 94 0C 41 00     push    offset aLoad_LibR_arYa; "Load. Lib r.ar yA"
		A3 D4 3E 41 00     mov     LoadLibraryW, eax
		E8 63 FF FF FF     call    CleanupString
		83 C4 04           add     esp, 4
		50                 push    eax             ; _DWORD
		56                 push    esi             ; _DWORD
		FF 15 DC 3E 41 00  call    GetProcAddress_0
		68 80 0C 41 00     push    offset a_frE_eliBr_arY; ".Fr e.eLi br.ar y"
		A3 D8 3E 41 00     mov     LoadLibraryA_0, eax
		E8 49 FF FF FF     call    CleanupString
	*/

	$a = {	83 C4 ?? 5? 5? 	FF 15 [4] 68 [4] A3 [4]	E8 [4]	83 C4 ?? 5? 5? 	FF 15 [4] 68 [4] A3 [4]	E8 [4] 83 C4 ?? 5?  5? 	FF 15 [4] 68 [4] A3 [4]	E8}


	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
YARA Detection Rule: DNSCalcStyleEncodeAndDecode
Repository: Yara-Rules/rules
Author: Novetta Threat Research & Interdiction Group - trig@novetta.com

Pattern signatures:
/*
		8A 10     mov     dl, [eax]
		80 F2 73  xor     dl, 73h					<--- for decoding and encoding, this and
		80 EA 3A  sub     dl, 3Ah					<--- this could be reversed, but the sig holds since both are 0x80
		88 10     mov     [eax], dl
		40        inc     eax
		49        dec     ecx
		75 F2     jnz     short loc_1000403C
	*/

	$a = {8A ?? 80 ?? ?? 80 ?? ?? 88 ?? 4? 4? 75 ?? }

Detection condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))

Full rule:
rule DNSCalcStyleEncodeAndDecode: sharedcode
{
	meta:
		copyright = "2015 Novetta Solutions"
		author = "Novetta Threat Research & Interdiction Group - trig@novetta.com"
		Source = "975522bc3e07f7aa2c4a5457e6cc16c49a148b9f731134b[PII_REDACTED]835577e"

	strings:
	/*
		8A 10     mov     dl, [eax]
		80 F2 73  xor     dl, 73h					<--- for decoding and encoding, this and
		80 EA 3A  sub     dl, 3Ah					<--- this could be reversed, but the sig holds since both are 0x80
		88 10     mov     [eax], dl
		40        inc     eax
		49        dec     ecx
		75 F2     jnz     short loc_1000403C
	*/

	$a = {8A ?? 80 ?? ?? 80 ?? ?? 88 ?? 4? 4? 75 ?? }

	condition:
		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}