deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXPL_Zoho_RCE_Fix_Lines_Dec21_1
Repository: Neo23x0/signature-base
Detects: Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]30385923

Pattern signatures:
// we look for the RCE Fixes
      $s1 = "RCEF="

      // we try to find a line which states that the attack is active (compromised host)
      $sa1 = "\"attackStatus\"\\:\"active\""
      $sa2 = "\"attackStatus\":\"active\""

      // we try to find a line in which the RCE fix deleted a file (compromised host)
      $sd1 = "deletedCount"
      $sd_fp1 = "\"deletedCount\"\\:0"
      $sd_fp2 = "\"deletedCount\":0"

Detection condition:
filesize < 6MB and $s1 and (
         1 of ($sa*) or 
         ( $sd1 and not 1 of ($sd_fp*) )
      )

Full rule:
rule EXPL_Zoho_RCE_Fix_Lines_Dec21_1 {
   meta:
      description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]30385923"
      date = "2021-12-06"
      score = 65
      id = "633287e3-a377-5b3c-8520-a7790168eff5"
   strings:
      // we look for the RCE Fixes
      $s1 = "RCEF="

      // we try to find a line which states that the attack is active (compromised host)
      $sa1 = "\"attackStatus\"\\:\"active\""
      $sa2 = "\"attackStatus\":\"active\""

      // we try to find a line in which the RCE fix deleted a file (compromised host)
      $sd1 = "deletedCount"
      $sd_fp1 = "\"deletedCount\"\\:0"
      $sd_fp2 = "\"deletedCount\":0"
   condition:
      filesize < 6MB and $s1 and (
         1 of ($sa*) or 
         ( $sd1 and not 1 of ($sd_fp*) )
      )
}
YARA Detection Rule: KINS_dropper
Repository: Neo23x0/signature-base
Detects: Match protocol, process injects and windows exploit present in KINS dropper
Author: AlienVault Labs aortega@alienvault.com
Reference: http://goo.gl/arPhm3

Pattern signatures:
// Network protocol
		$n1 = "tid=%d&ta=%s-%x" fullword
		$n2 = "fid=%d" fullword
		$n3 = "%[^.].%[^(](%[^)])" fullword
		// Injects
		$i0 = "%s [%s %d] 77 %s"
		$i01 = "Global\\%s%x"
		$i1 = "Inject::InjectProcessByName()"
		$i2 = "Inject::CopyImageToProcess()"
		$i3 = "Inject::InjectProcess()"
		$i4 = "Inject::InjectImageToProcess()"
		$i5 = "Drop::InjectStartThread()"
		// UAC bypass
		$uac1 = "ExploitMS10_092"
		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide

Detection condition:
2 of ($n*) and 2 of ($i*) and 2 of ($uac*)

Full rule:
rule KINS_dropper {
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match protocol, process injects and windows exploit present in KINS dropper"
		reference = "http://goo.gl/arPhm3"
		id = "17e12685-aaad-5d83-949c-43d5aef1ef0d"
	strings:
		// Network protocol
		$n1 = "tid=%d&ta=%s-%x" fullword
		$n2 = "fid=%d" fullword
		$n3 = "%[^.].%[^(](%[^)])" fullword
		// Injects
		$i0 = "%s [%s %d] 77 %s"
		$i01 = "Global\\%s%x"
		$i1 = "Inject::InjectProcessByName()"
		$i2 = "Inject::CopyImageToProcess()"
		$i3 = "Inject::InjectProcess()"
		$i4 = "Inject::InjectImageToProcess()"
		$i5 = "Drop::InjectStartThread()"
		// UAC bypass
		$uac1 = "ExploitMS10_092"
		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
	condition:
		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
}
YARA Detection Rule: KINS_DLL_zeus
Repository: Neo23x0/signature-base
Detects: Match default bot in KINS leaked dropper, Zeus
Author: AlienVault Labs aortega@alienvault.com
Reference: http://goo.gl/arPhm3

Pattern signatures:
// Network protocol
		$n1 = "%BOTID%" fullword
		$n2 = "%opensocks%" fullword
		$n3 = "%openvnc%" fullword
		$n4 = /Global\\(s|v)_ev/ fullword
		// Crypted strings
		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"

Detection condition:
all of ($n*) and 1 of ($s*)

Full rule:
rule KINS_DLL_zeus {
	meta:
		author = "AlienVault Labs aortega@alienvault.com"
		description = "Match default bot in KINS leaked dropper, Zeus"
		reference = "http://goo.gl/arPhm3"
		id = "968ada06-c8a1-5053-95de-10aa484231cb"
	strings:
		// Network protocol
		$n1 = "%BOTID%" fullword
		$n2 = "%opensocks%" fullword
		$n3 = "%openvnc%" fullword
		$n4 = /Global\\(s|v)_ev/ fullword
		// Crypted strings
		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
	condition:
		all of ($n*) and 1 of ($s*)
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
      $s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 10000KB and 3 of them ) or ( all of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_1 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
      id = "21e858b1-2cfa-5757-96f0-7c44a5da6898"
   strings:
      $s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
      $s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 10000KB and 3 of them ) or ( all of them )
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_2
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "winasys32.exe" fullword ascii
      $s2 = "alg32.exe" fullword ascii
      $s3 = "wmsrv32.exe" fullword ascii
      $s4 = "vmnat32.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_2 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "1aef507c385a234e8b10db12852ad1bd66a[PII_REDACTED]7b2dcb26f7fae16e01f"
      id = "5858541b-c394-5be8-9db3-fcff66f635de"
   strings:
      $s1 = "winasys32.exe" fullword ascii
      $s2 = "alg32.exe" fullword ascii
      $s3 = "wmsrv32.exe" fullword ascii
      $s4 = "vmnat32.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them ) or ( 3 of them )
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_3
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
      $s2 = "mvhost32.dll" fullword ascii
      $s3 = "sdwin32.dll" fullword ascii
      $s4 = "ofx64.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( all of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_3 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
      id = "bff79813-0d72-50d9-9676-794801edc34b"
   strings:
      $s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
      $s2 = "mvhost32.dll" fullword ascii
      $s3 = "sdwin32.dll" fullword ascii
      $s4 = "ofx64.dll" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_4
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
      $s2 = "info@aadobetech.com" fullword ascii
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide
      $s6 = "ADOBE Corp.1" fullword ascii
      $s7 = "Adobe Flash Player1\"0 " fullword ascii
      $s8 = "Windows Index Services" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and 4 of them ) or ( 6 of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_4 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
      id = "4e926b1c-bf10-5337-8c3a-964008a37d8b"
   strings:
      $s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
      $s2 = "info@aadobetech.com" fullword ascii
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide
      $s6 = "ADOBE Corp.1" fullword ascii
      $s7 = "Adobe Flash Player1\"0 " fullword ascii
      $s8 = "Windows Index Services" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 700KB and 4 of them ) or ( 6 of them )
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_5
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "Winxsys.exe" fullword wide
      $s2 = "%s\\ssleay32.dll" fullword wide
      $s3 = "%s\\libeay32.dll" fullword wide
      $s4 = "Windows Index Services" fullword wide
      $s5 = "<F RAT" fullword ascii
      $s6 = "WININDX-088FA840-B10D-11D3-BC36[PII_REDACTED]74" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and 3 of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_5 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
      id = "4bd60f61-a595-5289-9595-a7e33f265748"
   strings:
      $s1 = "Winxsys.exe" fullword wide
      $s2 = "%s\\ssleay32.dll" fullword wide
      $s3 = "%s\\libeay32.dll" fullword wide
      $s4 = "Windows Index Services" fullword wide
      $s5 = "<F RAT" fullword ascii
      $s6 = "WININDX-088FA840-B10D-11D3-BC36[PII_REDACTED]74" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and 3 of them )
}
YARA Detection Rule: PROMETHIUM_NEODYMIUM_Malware_6
Repository: Neo23x0/signature-base
Detects: Detects PROMETHIUM and NEODYMIUM malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/8abDE6

Pattern signatures:
$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
      $s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide
      $s6 = "Windows Index Services" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 7000KB and 4 of them )

Full rule:
rule PROMETHIUM_NEODYMIUM_Malware_6 {
   meta:
      description = "Detects PROMETHIUM and NEODYMIUM malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/8abDE6"
      date = "2016-12-14"
      hash1 = "dbd8cbbaf59d19cf[PII_REDACTED]e36409cd090bc711e339d3f2ec652bc26d6a03"
      id = "0f36eb56-39d8-536c-93ff-4a[PII_REDACTED]"
   strings:
      $s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
      $s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
      $s3 = "%s\\ssleay32.dll" fullword wide
      $s4 = "%s\\libeay32.dll" fullword wide
      $s5 = "%s\\fprot32.exe" fullword wide
      $s6 = "Windows Index Services" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 7000KB and 4 of them )
}
YARA Detection Rule: Unit78020_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe
Author: Florian Roth (Nextron Systems)
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
		$s2 = "msictl.exe" fullword ascii
		$s3 = "127.0.0.1:8080" fullword ascii
		$s4 = "mshtml.dat" fullword ascii
		$s5 = "msisvc" fullword ascii
		$s6 = "NOKIAN95/WEB" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 160KB and 4 of them

Full rule:
rule Unit78020_Malware_1 {
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
		id = "0374de68-98cb-5cb8-a936-fe7845de9330"
	strings:
		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
		$s2 = "msictl.exe" fullword ascii
		$s3 = "127.0.0.1:8080" fullword ascii
		$s4 = "mshtml.dat" fullword ascii
		$s5 = "msisvc" fullword ascii
		$s6 = "NOKIAN95/WEB" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 160KB and 4 of them
}
YARA Detection Rule: Unit78020_Malware_Gen2
Repository: Neo23x0/signature-base
Detects: Detects malware by Chinese APT PLA Unit 78020 - Generic Rule
Author: Florian Roth (Nextron Systems)
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$s0 = "-GetModuleFileNameExW" fullword ascii
		$s1 = "\\MSN Talk Start.lnk" wide
		$s2 = ":SeDebugPrivilege" fullword wide
		$s3 = "WinMM Version 1.0" fullword wide
		$s4 = "dwError1 = %d" fullword ascii
		$s5 = "*Can't Get" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule Unit78020_Malware_Gen2 {
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		super_rule = 1
		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
		hash2 = "7b73bf2d80a03eb[PII_REDACTED]28da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
		hash3 = "981e2fa1ae[PII_REDACTED]b46e8b53cc5da37dd[PII_REDACTED]761bd91572f025e8a"
		id = "9492b1f8-c2a9-5e3b-ad62-fbc3d99392b3"
	strings:
		$s0 = "-GetModuleFileNameExW" fullword ascii
		$s1 = "\\MSN Talk Start.lnk" wide
		$s2 = ":SeDebugPrivilege" fullword wide
		$s3 = "WinMM Version 1.0" fullword wide
		$s4 = "dwError1 = %d" fullword ascii
		$s5 = "*Can't Get" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: Unit78020_Malware_Gen3
Repository: Neo23x0/signature-base
Detects: Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong
Author: Florian Roth (Nextron Systems)
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x3 = "J:\\chong\\" ascii

		$s1 = "User-Agent: Netscape" fullword ascii
		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
		$s5 = "MM.exe" fullword ascii
		$s6 = "network.proxy.ssl" fullword wide
		$s7 = "PeekNamePipe" fullword ascii
		$s8 = "Host: %ws:%d" fullword ascii
		$s9 = "GET %dHTTP/1.1" fullword ascii
		$s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 
		4 of ($s*)

Full rule:
rule Unit78020_Malware_Gen3 {
	meta:
		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
		date = "2015-09-24"
		super_rule = 1
		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
		id = "e26f386e-e98c-5005-9343-1873d2e35a1f"
	strings:
		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
		$x3 = "J:\\chong\\" ascii

		$s1 = "User-Agent: Netscape" fullword ascii
		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
		$s5 = "MM.exe" fullword ascii
		$s6 = "network.proxy.ssl" fullword wide
		$s7 = "PeekNamePipe" fullword ascii
		$s8 = "Host: %ws:%d" fullword ascii
		$s9 = "GET %dHTTP/1.1" fullword ascii
		$s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */
	condition:
		( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 
		4 of ($s*)
}
YARA Detection Rule: SUSP_VEST_Encryption_Core_Accumulator_Jan21
Repository: Neo23x0/signature-base
Detects: Detects VEST encryption core accumulator in PE file as used by Lazarus malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ochsenmeier/status/[PII_REDACTED]95649280

Pattern signatures:
$sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }

Detection condition:
uint16(0) == 0x5a4d and
      1 of them

Full rule:
rule SUSP_VEST_Encryption_Core_Accumulator_Jan21 {
   meta:
      description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ochsenmeier/status/[PII_REDACTED]95649280"
      date = "2021-01-28"
      score = 70
      hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
      id = "8343652b-8865-5213-b735-d6d4084e4a84"
   strings:
      $sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
   condition:
      uint16(0) == 0x5a4d and
      1 of them
}
YARA Detection Rule: APT_HiddenCobra_enc_PK_header
Repository: Neo23x0/signature-base
Detects: Hidden Cobra - Detects trojan with encrypted header
Malware family: TYPEFRAME
Author: NCCIC trusted 3rd party - Edit: Tobias Michalski
Reference: https://www.us-cert.gov/ncas/analysis-reports/AR18-165A

Pattern signatures:
$s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
      $s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
      $s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them

Full rule:
rule APT_HiddenCobra_enc_PK_header {
   meta:
      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
      incident = "10135536"
      date = "2018-04-12"
      category = "hidden_cobra"
      family = "TYPEFRAME"
      hash0 = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
      description = "Hidden Cobra - Detects trojan with encrypted header"
      id = "5d7001b3-162c-5a97-a740-1b8e33d4aa9e"
   strings:
      $s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
      $s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
      $s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }
   condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and any of them
}
YARA Detection Rule: APT_HiddenCobra_import_obfuscation_2
Repository: Neo23x0/signature-base
Detects: Hidden Cobra - Detects remote access trojan
Malware family: TYPEFRAME
Author: NCCIC trusted 3rd party - Edit: Tobias Michalski
Reference: https://www.us-cert.gov/ncas/analysis-reports/AR18-165A

Pattern signatures:
$s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
      $s1 = {B6 DF 01 FD 48 B5 }
      $s2 = {B6 D5 0E F3 4E B5 }
      $s3 = {B7 DF 0E EE }
      $s4 = {B6 DF 03 FC }
      $s5 = {A7 D3 03 FC }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them

Full rule:
rule APT_HiddenCobra_import_obfuscation_2 {
   meta:
      author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
      incident = "10135536"
      date = "2018-04-12"
      category = "hidden_cobra"
      family = "TYPEFRAME"
      hash0 = "bfb41bc0c3856aa0a81a5256b7b8da51"
      reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
      description = "Hidden Cobra - Detects remote access trojan"
      id = "bc139580-a55b-514f-8a4e-ca1402ce3ad9"
   strings:
      $s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
      $s1 = {B6 DF 01 FD 48 B5 }
      $s2 = {B6 D5 0E F3 4E B5 }
      $s3 = {B7 DF 0E EE }
      $s4 = {B6 DF 03 FC }
      $s5 = {A7 D3 03 FC }
  condition:
      (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them
}