deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: pvz_out
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "Network Connectivity Module" wide
    $s2 = "OSPPSVC" wide

Detection condition:
all of them

Full rule:
rule pvz_out
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "Network Connectivity Module" wide
    $s2 = "OSPPSVC" wide

  condition:
    all of them
}
YARA Detection Rule: wndTest
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "[Alt]" wide
    $s2 = "<< %s >>:" wide
    $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

Detection condition:
all of them

Full rule:
rule wndTest
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "[Alt]" wide
    $s2 = "<< %s >>:" wide
    $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

  condition:
    all of them
}
YARA Detection Rule: zhCat
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "zhCat -l -h -tp 1234"
    $s2 = "ABC ( A Big Company )" wide

Detection condition:
all of them

Full rule:
rule zhCat
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "zhCat -l -h -tp 1234"
    $s2 = "ABC ( A Big Company )" wide

  condition:
    all of them
}
YARA Detection Rule: zhLookUp
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "zhLookUp.Properties"

Detection condition:
all of them

Full rule:
rule zhLookUp
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "zhLookUp.Properties"

  condition:
    all of them
}
YARA Detection Rule: zhmimikatz
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "MimikatzRunner"
    $s2 = "zhmimikatz"

Detection condition:
all of them

Full rule:
rule zhmimikatz
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "MimikatzRunner"
    $s2 = "zhmimikatz"

  condition:
    all of them
}
YARA Detection Rule: Zh0uSh311
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "Zh0uSh311"

Detection condition:
all of them

Full rule:
rule Zh0uSh311
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "Zh0uSh311"

  condition:
    all of them
}
YARA Detection Rule: OPCLEAVER_BackDoorLogger
Repository: Yara-Rules/rules
Detects: Keylogger used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "BackDoorLogger"
        $s2 = "zhuAddress"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_BackDoorLogger
{

    meta:
        description = "Keylogger used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "BackDoorLogger"
        $s2 = "zhuAddress"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_Jasus
Repository: Yara-Rules/rules
Detects: ARP cache poisoner used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "pcap_dump_open"
        $s2 = "Resolving IPs to poison..."
        $s3 = "WARNNING: Gateway IP can not be found"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_Jasus
{

    meta:
        description = "ARP cache poisoner used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "pcap_dump_open"
        $s2 = "Resolving IPs to poison..."
        $s3 = "WARNNING: Gateway IP can not be found"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_LoggerModule
Repository: Yara-Rules/rules
Detects: Keylogger used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "%s-%02d%02d%02d%02d%02d.r"
        $s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_LoggerModule
{

    meta:
        description = "Keylogger used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "%s-%02d%02d%02d%02d%02d.r"
        $s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_NetC
Repository: Yara-Rules/rules
Detects: Net Crawler used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "NetC.exe" wide
        $s2 = "Net Service"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_NetC
{

    meta:
        description = "Net Crawler used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "NetC.exe" wide
        $s2 = "Net Service"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_ShellCreator2
Repository: Yara-Rules/rules
Detects: Shell Creator used by attackers in Operation Cleaver to create ASPX web shells
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "ShellCreator2.Properties"
        $s2 = "set_IV"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_ShellCreator2
{

    meta:
        description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "ShellCreator2.Properties"
        $s2 = "set_IV"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_SmartCopy2
Repository: Yara-Rules/rules
Detects: Malware or hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "SmartCopy2.Properties"
        $s2 = "ZhuFrameWork"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_SmartCopy2
{

    meta:
        description = "Malware or hack tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "SmartCopy2.Properties"
        $s2 = "ZhuFrameWork"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_SynFlooder
Repository: Yara-Rules/rules
Detects: Malware or hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
        $s2 = "your target’s IP is : %s"
        $s3 = "Raw TCP Socket Created successfully."

Detection condition:
all of them

Full rule:
rule OPCLEAVER_SynFlooder
{

    meta:
        description = "Malware or hack tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "Unable to resolve [ %s ]. ErrorCode %d"
        $s2 = "your target’s IP is : %s"
        $s3 = "Raw TCP Socket Created successfully."

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_TinyZBot
Repository: Yara-Rules/rules
Detects: Tiny Bot used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "NetScp" wide
        $s2 = "TinyZBot.Properties.Resources.resources"
        $s3 = "Aoao WaterMark"
        $s4 = "Run_a_exe"
        $s5 = "netscp.exe"
        $s6 = "get_MainModule_WebReference_DefaultWS"
        $s7 = "remove_CheckFileMD5Completed"
        $s8 = "http://tempuri.org/"
        $s9 = "Zhoupin_Cleaver"

Detection condition:
(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)

Full rule:
rule OPCLEAVER_TinyZBot
{

    meta:
        description = "Tiny Bot used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "NetScp" wide
        $s2 = "TinyZBot.Properties.Resources.resources"
        $s3 = "Aoao WaterMark"
        $s4 = "Run_a_exe"
        $s5 = "netscp.exe"
        $s6 = "get_MainModule_WebReference_DefaultWS"
        $s7 = "remove_CheckFileMD5Completed"
        $s8 = "http://tempuri.org/"
        $s9 = "Zhoupin_Cleaver"

    condition:
        (($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
}
YARA Detection Rule: OPCLEAVER_ZhoupinExploitCrew
Repository: Yara-Rules/rules
Detects: Keywords used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "zhoupin exploit crew" nocase
        $s2 = "zhopin exploit crew" nocase

Detection condition:
1 of them

Full rule:
rule OPCLEAVER_ZhoupinExploitCrew
{

    meta:
        description = "Keywords used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "zhoupin exploit crew" nocase
        $s2 = "zhopin exploit crew" nocase

    condition:
        1 of them
}
YARA Detection Rule: OPCLEAVER_antivirusdetector
Repository: Yara-Rules/rules
Detects: Hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "getShadyProcess"
        $s2 = "getSystemAntiviruses"
        $s3 = "AntiVirusDetector"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_antivirusdetector
{

    meta:
        description = "Hack tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "getShadyProcess"
        $s2 = "getSystemAntiviruses"
        $s3 = "AntiVirusDetector"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_csext
Repository: Yara-Rules/rules
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "COM+ System Extentions"
        $s2 = "csext.exe"
        $s3 = "COM_Extentions_bin"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_csext
{

    meta:
        description = "Backdoor used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "COM+ System Extentions"
        $s2 = "csext.exe"
        $s3 = "COM_Extentions_bin"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_kagent
Repository: Yara-Rules/rules
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "kill command is in last machine, going back"
        $s2 = "message data length in B64: %d Bytes"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_kagent
{

    meta:
        description = "Backdoor used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "kill command is in last machine, going back"
        $s2 = "message data length in B64: %d Bytes"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_mimikatzWrapper
Repository: Yara-Rules/rules
Detects: Mimikatz Wrapper used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "mimikatzWrapper"
        $s2 = "get_mimikatz"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_mimikatzWrapper
{

    meta:
        description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "mimikatzWrapper"
        $s2 = "get_mimikatz"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_pvz_in
Repository: Yara-Rules/rules
Detects: Parviz tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "LAST_TIME=00/00/0000:00:00PM$"
        $s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_pvz_in
{

    meta:
        description = "Parviz tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "LAST_TIME=00/00/0000:00:00PM$"
        $s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_pvz_out
Repository: Yara-Rules/rules
Detects: Parviz tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Network Connectivity Module" wide
        $s2 = "OSPPSVC" wide

Detection condition:
all of them

Full rule:
rule OPCLEAVER_pvz_out
{

    meta:
        description = "Parviz tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "Network Connectivity Module" wide
        $s2 = "OSPPSVC" wide

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_wndTest
Repository: Yara-Rules/rules
Detects: Backdoor used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "[Alt]" wide
        $s2 = "<< %s >>:" wide
        $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_wndTest
{

    meta:
        description = "Backdoor used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "[Alt]" wide
        $s2 = "<< %s >>:" wide
        $s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_zhCat
Repository: Yara-Rules/rules
Detects: Network tool used by Iranian hackers and used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
        $s2 = "ABC ( A Big Company )" wide fullword

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhCat
{

    meta:
        description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
        $s2 = "ABC ( A Big Company )" wide fullword

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_zhLookUp
Repository: Yara-Rules/rules
Detects: Hack tool used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "zhLookUp.Properties"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhLookUp
{

    meta:
        description = "Hack tool used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "zhLookUp.Properties"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_zhmimikatz
Repository: Yara-Rules/rules
Detects: Mimikatz wrapper used by attackers in Operation Cleaver
Author: Cylance Inc.
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "MimikatzRunner"
        $s2 = "zhmimikatz"

Detection condition:
all of them

Full rule:
rule OPCLEAVER_zhmimikatz
{

    meta:
        description = "Mimikatz wrapper used by attackers in Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Cylance Inc."
        score = "70"

    strings:
        $s1 = "MimikatzRunner"
        $s2 = "zhmimikatz"

    condition:
        all of them
}
YARA Detection Rule: OPCLEAVER_Parviz_Developer
Repository: Yara-Rules/rules
Detects: Parviz developer known from Operation Cleaver
Author: Florian Roth
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "Users\\parviz\\documents\\" nocase

Detection condition:
$s1

Full rule:
rule OPCLEAVER_Parviz_Developer
{

    meta:
        description = "Parviz developer known from Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Florian Roth"
        score = "70"

    strings:
        $s1 = "Users\\parviz\\documents\\" nocase

    condition:
        $s1
}
YARA Detection Rule: OPCLEAVER_CCProxy_Config
Repository: Yara-Rules/rules
Detects: CCProxy config known from Operation Cleaver
Author: Florian Roth
Reference: http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf

Pattern signatures:
$s1 = "UserName=User-001" fullword ascii
        $s2 = "Web=1" fullword ascii
        $s3 = "Mail=1" fullword ascii
        $s4 = "FTP=0" fullword ascii
        $x1 = "IPAddressLow=78.109.194.114" fullword ascii

Detection condition:
all of ($s*) or $x1

Full rule:
rule OPCLEAVER_CCProxy_Config
{

    meta:
        description = "CCProxy config known from Operation Cleaver"
        reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
        date = "2014/12/02"
        author = "Florian Roth"
        score = "70"

    strings:
        $s1 = "UserName=User-001" fullword ascii
        $s2 = "Web=1" fullword ascii
        $s3 = "Mail=1" fullword ascii
        $s4 = "FTP=0" fullword ascii
        $x1 = "IPAddressLow=78.109.194.114" fullword ascii

    condition:
        all of ($s*) or $x1
}
YARA Detection Rule: Atmos_Packed_Malware
Repository: Yara-Rules/rules
Detects: Second Generic Spyware.Citadel.Atmos signture when builder add a packed layer
Author: xylitol@temari.fr
Reference: http://www.xylibox.com/2016/02/citadel-0011-atmos.html

Pattern signatures:
$MZ = {4D 5A}
        // Entry point identifier with CreateThread pointer in '??' 
        $a = {55 8B EC 83 EC 0C 53 56 8B 35 ?? ?? ?? 00 57 33 DB BF 00 28 00 00}
        // End of main proc with sleep value in '??' and api call to sleep in '??'
        $b = {68 ?? ?? ?? ?? FF 15 ?? ?? ?? 00 E9 62 FF FF FF E8 69 10 FE FF 5F 5E 5B C9 C3}
        // API String identifier (ShellExecuteExW, SHELL32.dll, GetUserNameExW, Secur32.dll)
        $c = {53 68 65 6C 6C 45 78 65 63 75 74 65 45 78 57 00 53 48 45 4C 4C 33 32 2E 64 6C 6C 00 1E 00 47 65}
        $d = {74 55 73 65 72 4E 61 6D 65 45 78 57 00 00 53 65 63 75 72 33 32 2E 64 6C 6C 00 10 00}
        // New Thread identifier
        $e = {55 8B EC 83 E4 F8 83 EC 1C 83 7D 08 00 57 74 ?? 6A FF FF 75 08 FF 15 ?? ?? ?? 00}

Detection condition:
all of them and filesize < 300KB // Standard size (raw from builder) should be arround ~264kb
        // Remove the above line if you want to trig also on memory dumps, etc...

Full rule:
rule Atmos_Packed_Malware 
{
   
    meta:
    description = "Second Generic Spyware.Citadel.Atmos signture when builder add a packed layer"
    author = "xylitol@temari.fr"
    reference = "http://www.xylibox.com/2016/02/citadel-0011-atmos.html"
    date = "20/08/2016"
    // May only the challenge guide you

    strings:
        $MZ = {4D 5A}
        // Entry point identifier with CreateThread pointer in '??' 
        $a = {55 8B EC 83 EC 0C 53 56 8B 35 ?? ?? ?? 00 57 33 DB BF 00 28 00 00}
        // End of main proc with sleep value in '??' and api call to sleep in '??'
        $b = {68 ?? ?? ?? ?? FF 15 ?? ?? ?? 00 E9 62 FF FF FF E8 69 10 FE FF 5F 5E 5B C9 C3}
        // API String identifier (ShellExecuteExW, SHELL32.dll, GetUserNameExW, Secur32.dll)
        $c = {53 68 65 6C 6C 45 78 65 63 75 74 65 45 78 57 00 53 48 45 4C 4C 33 32 2E 64 6C 6C 00 1E 00 47 65}
        $d = {74 55 73 65 72 4E 61 6D 65 45 78 57 00 00 53 65 63 75 72 33 32 2E 64 6C 6C 00 10 00}
        // New Thread identifier
        $e = {55 8B EC 83 E4 F8 83 EC 1C 83 7D 08 00 57 74 ?? 6A FF FF 75 08 FF 15 ?? ?? ?? 00}

    condition:
    all of them and filesize < 300KB // Standard size (raw from builder) should be arround ~264kb
        // Remove the above line if you want to trig also on memory dumps, etc...
}