deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_BananaAid
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BananaAid
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
		$x2 = "scp BGLEE-" ascii
		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_BananaAid {
	meta:
		description = "EQGRP Toolset Firewall - file BananaAid"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
		id = "bdd3ce51-1809-5b2f-9c7e-6c0b056d022b"
	strings:
		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
		$x2 = "scp BGLEE-" ascii
		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_bo
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file bo
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "ERROR: failed to open %s: %d" fullword ascii
		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
		$s3 = "serial number: %s" fullword ascii
		$s4 = "strerror@@GLIBC_2.0" fullword ascii
		$s5 = "ERROR: mmap failed: %d" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 20KB and all of them )

Full rule:
rule EQGRP_bo {
	meta:
		description = "EQGRP Toolset Firewall - file bo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
		id = "6aa71528-3ce6-5597-bb1a-e44cff3856d6"
	strings:
		$s1 = "ERROR: failed to open %s: %d" fullword ascii
		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
		$s3 = "serial number: %s" fullword ascii
		$s4 = "strerror@@GLIBC_2.0" fullword ascii
		$s5 = "ERROR: mmap failed: %d" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 20KB and all of them )
}
YARA Detection Rule: EQGRP_SecondDate_2211
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file SecondDate-2211.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "SD_processControlPacket" fullword ascii
		$s2 = "Encryption_rc4SetKey" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 200KB and all of them )

Full rule:
rule EQGRP_SecondDate_2211 {
	meta:
		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
		id = "00[PII_REDACTED]-58b6-8b64-422c4ab15ebe"
	strings:
		$s1 = "SD_processControlPacket" fullword ascii
		$s2 = "Encryption_rc4SetKey" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 200KB and all of them )
}
YARA Detection Rule: EQGRP_config_jp1_UA
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file config_jp1_UA.pl
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
		$x2 = "Error running config_implant." fullword ascii
		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_config_jp1_UA {
	meta:
		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
		id = "947e6f90-4eb4-5241-9819-677cee0c15d8"
	strings:
		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
		$x2 = "Error running config_implant." fullword ascii
		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_userscript
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file userscript.FW
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_userscript {
	meta:
		description = "EQGRP Toolset Firewall - file userscript.FW"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
		id = "c6c1b70e-437f-50e7-9055-b943a1a62e6c"
	strings:
		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_BBALL_M50FW08_2201
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "pageTable.c" fullword ascii
		$s4 = "_start_text" ascii
		$s5 = "handler_readBIOS" fullword ascii
		$s6 = "KEEPGOING" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )

Full rule:
rule EQGRP_BBALL_M50FW08_2201 {
	meta:
		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "pageTable.c" fullword ascii
		$s4 = "_start_text" ascii
		$s5 = "handler_readBIOS" fullword ascii
		$s6 = "KEEPGOING" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )
}
YARA Detection Rule: EQGRP_BUSURPER_3001_724
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BUSURPER-3001-724.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "IMPLANT" fullword ascii
		$s2 = "KEEPGOING" fullword ascii
		$s3 = "upgrade_implant" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )

Full rule:
rule EQGRP_BUSURPER_3001_724 {
	meta:
		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
		id = "006877e9-1e73-5a27-8b3a-bca3513a2035"
	strings:
		$s1 = "IMPLANT" fullword ascii
		$s2 = "KEEPGOING" fullword ascii
		$s3 = "upgrade_implant" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_workit
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file workit.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "macdef init > /tmp/.netrc;" fullword ascii
		$s2 = "/usr/bin/wget http://" ascii
		$s3 = "HOME=/tmp ftp" fullword ascii
		$s4 = " >> /tmp/.netrc;" fullword ascii
		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
		$s6 = "created shell_command:" fullword ascii
		$s7 = "rm -f /tmp/.netrc;" fullword ascii
		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
		$s11 = "created cli_command:" fullword ascii

Detection condition:
6 of them

Full rule:
rule EQGRP_workit {
	meta:
		description = "EQGRP Toolset Firewall - file workit.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		modified = "2023-01-27"
		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
		id = "b582f990-5bd5-592d-a7c0-475fdfffc38c"
	strings:
		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
		$s2 = "/usr/bin/wget http://" ascii
		$s3 = "HOME=/tmp ftp" fullword ascii
		$s4 = " >> /tmp/.netrc;" fullword ascii
		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
		$s6 = "created shell_command:" fullword ascii
		$s7 = "rm -f /tmp/.netrc;" fullword ascii
		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
		$s11 = "created cli_command:" fullword ascii
	condition:
		6 of them
}
YARA Detection Rule: EQGRP_tinyhttp_setup
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file tinyhttp_setup.sh
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
		$x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
		$x3 = "killall thttpd" fullword ascii
		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )

Full rule:
rule EQGRP_tinyhttp_setup {
	meta:
		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
		id = "71dcc48f-f551-5596-9f03-dbbae470a62b"
	strings:
		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
		$x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
		$x3 = "killall thttpd" fullword ascii
		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
	condition:
		( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_shellcode
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file shellcode.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii

		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
		/* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }

Detection condition:
1 of them

Full rule:
rule EQGRP_shellcode {
	meta:
		description = "EQGRP Toolset Firewall - file shellcode.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df[PII_REDACTED]98eca8f8b7f"
		id = "d923c1de-c6eb-511f-ae1f-bf3ac6e0eae8"
	strings:
		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii

		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
		/* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_EPBA
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file EPBA.script
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
		$x6 = "this operation is complete, BananaGlee will" fullword ascii
		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii

Detection condition:
( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )

Full rule:
rule EQGRP_EPBA {
	meta:
		description = "EQGRP Toolset Firewall - file EPBA.script"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
		id = "5159c2f4-20b7-590d-b216-b3468c26e459"
	strings:
		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
		$x6 = "this operation is complete, BananaGlee will" fullword ascii
		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
	condition:
		( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_BPIE
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BPIE-2201.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "profProcessPacket" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "getTimeSlotCmdHandler" fullword ascii
		$s4 = "getIpIpCmdHandler" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "profStartScan" fullword ascii
		$s7 = "tmpData.1" fullword ascii
		$s8 = "resetCmdHandler" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )

Full rule:
rule EQGRP_BPIE {
	meta:
		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
		id = "a73f0216-3994-5ee6-8a8c-cbcc1279898e"
	strings:
		$s1 = "profProcessPacket" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "getTimeSlotCmdHandler" fullword ascii
		$s4 = "getIpIpCmdHandler" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "profStartScan" fullword ascii
		$s7 = "tmpData.1" fullword ascii
		$s8 = "resetCmdHandler" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )
}
YARA Detection Rule: EQGRP_jetplow_SH
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file jetplow.sh
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_jetplow_SH {
	meta:
		description = "EQGRP Toolset Firewall - file jetplow.sh"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
		id = "e7780540-29c9-5827-8ac0-a685d9ba8a5f"
	strings:
		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_BBANJO
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BBANJO-3011.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "get_lsl_interfaces" fullword ascii
		$s2 = "encryptFC4Payload" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "beacon_getconfig" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "FormBeaconPacket" fullword ascii
		$s7 = "beacon_reconfigure" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 50KB and all of them )

Full rule:
rule EQGRP_BBANJO {
	meta:
		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
		id = "81af4769-7007-51f1-9569-bc370618b4ff"
	strings:
		$s1 = "get_lsl_interfaces" fullword ascii
		$s2 = "encryptFC4Payload" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "beacon_getconfig" fullword ascii
		$s5 = "LOADED" fullword ascii
		$s6 = "FormBeaconPacket" fullword ascii
		$s7 = "beacon_reconfigure" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 50KB and all of them )
}
YARA Detection Rule: EQGRP_BPATROL_2201
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BPATROL-2201.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "dumpConfig" fullword ascii
		$s2 = "getstatusHandler" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "xtractdata" fullword ascii
		$s5 = "KEEPGOING" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and all of them )

Full rule:
rule EQGRP_BPATROL_2201 {
	meta:
		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
		id = "864a346c-e8aa-5c66-9867-faccb14b8bee"
	strings:
		$s1 = "dumpConfig" fullword ascii
		$s2 = "getstatusHandler" fullword ascii
		$s3 = ".got_loader" fullword ascii
		$s4 = "xtractdata" fullword ascii
		$s5 = "KEEPGOING" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 40KB and all of them )
}
YARA Detection Rule: EQGRP_extrabacon
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "To disable password checking on target:" fullword ascii
		$x2 = "[-] target is running" fullword ascii
		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
		$x4 = "[+] importing version-specific shellcode" fullword ascii
		$s5 = "[-] unsupported target version, abort" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_extrabacon {
	meta:
		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
		id = "79b998ef-e548-5038-b8ad-da1abf362e7f"
	strings:
		$x1 = "To disable password checking on target:" fullword ascii
		$x2 = "[-] target is running" fullword ascii
		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
		$x4 = "[+] importing version-specific shellcode" fullword ascii
		$s5 = "[-] unsupported target version, abort" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_sploit_py
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file sploit.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
		$x3 = "[-] no response from health check - target may have crashed" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_sploit_py {
	meta:
		description = "EQGRP Toolset Firewall - file sploit.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
	strings:
		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_uninstallPBD
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file uninstallPBD.bat
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
		$s2 = "_hidecmd" ascii
		$s3 = "memset 013abd04 1 0d" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_uninstallPBD {
	meta:
		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a[PII_REDACTED]8006c66af159bd0"
		id = "0153cb2a-a0de-51f9-80c2-22136d56f16d"
	strings:
		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
		$s2 = "_hidecmd" ascii
		$s3 = "memset 013abd04 1 0d" fullword ascii
	condition:
		all of them
}