deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WildNeutron_Sample_9
Repository: Neo23x0/signature-base
Detects: Wild Neutron APT Sample Rule
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s0 = "http://get.adobe.com/flashplayer/" wide  /* score: '30.00' */
      $s4 = " Player Installer/Uninstaller" fullword wide  /* score: '11.42' */
      $s5 = "Adobe Flash Plugin Updater" fullword wide  /* score: '11.00' */
      $s6 = "uSOFTWARE\\Adobe" fullword wide  /* score: '10.42' */
      $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
      $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
      $s13 = "%d -> %d" fullword wide /* score: '7.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1477KB and all of them

Full rule:
rule WildNeutron_Sample_9 {
   meta:
      description = "Wild Neutron APT Sample Rule"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
      date = "2015-07-10"
      modified = "2023-01-06"
      score = 60
      hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
      id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"
   strings:
      $s0 = "http://get.adobe.com/flashplayer/" wide  /* score: '30.00' */
      $s4 = " Player Installer/Uninstaller" fullword wide  /* score: '11.42' */
      $s5 = "Adobe Flash Plugin Updater" fullword wide  /* score: '11.00' */
      $s6 = "uSOFTWARE\\Adobe" fullword wide  /* score: '10.42' */
      $s11 = "2008R2" fullword wide /* PEStudio Blacklist: os */ /* score: '8.00' */
      $s12 = "%02d.%04d.%s" fullword wide /* score: '7.02' */
      $s13 = "%d -> %d" fullword wide /* score: '7.00' */
   condition:
      uint16(0) == 0x5a4d and filesize < 1477KB and all of them
}
YARA Detection Rule: APT_MAL_WildNeutron_javacpl
Repository: Neo23x0/signature-base
Detects: Wild Neutron APT Sample Rule
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/

Pattern signatures:
$s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
      $s2 = "cmdcmdline" wide fullword
      $s3 = "\"%s\" /K %s" wide fullword
      $s4 = "Process is not running any more" wide fullword
      $s5 = "dpnxfsatz" wide fullword

      $op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
      $op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
      $op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }

Detection condition:
uint16(0) == 0x5a4d and filesize < 5MB and (
         all of ($s*) or 
         all of ($op*)
      )

Full rule:
rule APT_MAL_WildNeutron_javacpl {
   meta:
      description = "Wild Neutron APT Sample Rule"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
      date = "2015-07-10"
      modified = "2023-01-06"
      old_rule_name = "WildNeutron_javacpl"
      score = 60
      hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
      hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
      hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
      id = "de82827e-61d4-559e-886a-78d5293ab141"
   strings:
      $s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
      $s2 = "cmdcmdline" wide fullword
      $s3 = "\"%s\" /K %s" wide fullword
      $s4 = "Process is not running any more" wide fullword
      $s5 = "dpnxfsatz" wide fullword

      $op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
      $op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
      $op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }
   condition:
      uint16(0) == 0x5a4d and filesize < 5MB and (
         all of ($s*) or 
         all of ($op*)
      )
}
YARA Detection Rule: SUSP_VCRuntime_Sideloading_Indicators_Aug23
Repository: Neo23x0/signature-base
Detects: Detects indicators of .NET based malware sideloading as VCRUNTIME140 with .NET DLL imports
Author: Jonathan Peters

Detection condition:
(filename == "VCRUNTIME140.dll" or filename == "vcruntime140.dll")
      and pe.imports("mscoree.dll", "_CorDllMain")

Full rule:
rule SUSP_VCRuntime_Sideloading_Indicators_Aug23 {
   meta:
      description = "Detects indicators of .NET based malware sideloading as VCRUNTIME140 with .NET DLL imports"
      author = "Jonathan Peters"
      date = "2023-08-30"
      hash = "b4bc73dfe9a781e2fee4978127cb9257bc2ffd67fc2df00375acf329d191ffd6"
      score = 75
      id = "[PII_REDACTED]-af31-880a3ef1745d"
   condition:
      (filename == "VCRUNTIME140.dll" or filename == "vcruntime140.dll")
      and pe.imports("mscoree.dll", "_CorDllMain")
}
YARA Detection Rule: SUSP_RDP_File_Indicators_Oct24_1
Repository: Neo23x0/signature-base
Detects: Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns
Author: Florian Roth
Reference: https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/

Pattern signatures:
$s1 = "redirectclipboard:i:1" wide fullword
      $s2 = "redirectprinters:i:1" wide fullword
      $s3 = "remoteapplicationmode:i:1" wide fullword
      $s4 = "username:s:" wide
      $s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide

Detection condition:
filesize < 50KB
      and all of them

Full rule:
rule SUSP_RDP_File_Indicators_Oct24_1 {
   meta:
      description = "Detects characteristics found in malicious RDP files used as email attachments in spear phishing campaigns"
      author = "Florian Roth"
      reference = "https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/"
      date = "2024-10-25"
      score = 75
      hash1 = "280fbf353fdffefc5a0af40c706377142fff718c7b87bc8b0daab10849f388d0"
      hash2 = "8b45f5a173e8e18b0d5c544f9221d7a1759847c28e62a25210ad8265f07e96d5"
      hash3 = "9b8cb8b01ce4eafb9204250a3c28bfaf70cc76a99ce411ad52bbf1aa2b6cce34"
      hash4 = "ba4d58f2c5903776fe47c92a0ec3297cc7b9c8fa16b3bf5f40b46242e7092b46"
      hash5 = "f357d26265a59e9c356be5a8ddb8d6533d1de222aae969c2ad4dc9c40863bfe8"
      id = "16128c1e-64ed-5a3e-ad1e-e0330d91f5a9"
   strings:
      $s1 = "redirectclipboard:i:1" wide fullword
      $s2 = "redirectprinters:i:1" wide fullword
      $s3 = "remoteapplicationmode:i:1" wide fullword
      $s4 = "username:s:" wide
      $s5 = "emoteapplicationicon:s:C:\\Windows\\SystemApps" wide
   condition:
      filesize < 50KB
      and all of them
}
YARA Detection Rule: Casper_Backdoor_x86
Repository: Neo23x0/signature-base
Detects: Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/VRJNLo

Pattern signatures:
$s1 = "\"svchost.exe\"" fullword wide
      $s2 = "firefox.exe" fullword ascii
      $s3 = "\"Host Process for Windows Services\"" fullword wide

      $x1 = "\\Users\\*" ascii
      $x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
      $x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
      $x4 = "\\Documents and Settings\\*" ascii

      $y1 = "%s; %S=%S" fullword wide
      $y2 = "%s; %s=%s" fullword ascii
      $y3 = "Cookie: %s=%s" fullword ascii
      $y4 = "http://%S:%d" fullword wide

      $z1 = "http://google.com/" ascii
      $z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
      $z3 = "Operating System\"" fullword wide

Detection condition:
( filesize < 250KB and all of ($s*) ) or
      ( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )

Full rule:
rule Casper_Backdoor_x86 {
   meta:
      description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/VRJNLo"
      date = "2015-03-05"
      modified = "2023-01-27"
      hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
      score = 80
      id = "9e54f00c-74a7-56cc-87e5-8dec1233cbb5"
   strings:
      $s1 = "\"svchost.exe\"" fullword wide
      $s2 = "firefox.exe" fullword ascii
      $s3 = "\"Host Process for Windows Services\"" fullword wide

      $x1 = "\\Users\\*" ascii
      $x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
      $x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
      $x4 = "\\Documents and Settings\\*" ascii

      $y1 = "%s; %S=%S" fullword wide
      $y2 = "%s; %s=%s" fullword ascii
      $y3 = "Cookie: %s=%s" fullword ascii
      $y4 = "http://%S:%d" fullword wide

      $z1 = "http://google.com/" ascii
      $z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
      $z3 = "Operating System\"" fullword wide
   condition:
      ( filesize < 250KB and all of ($s*) ) or
      ( 3 of ($x*) and 2 of ($y*) and 2 of ($z*) )
}
YARA Detection Rule: Casper_EXE_Dropper
Repository: Neo23x0/signature-base
Detects: Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/VRJNLo

Pattern signatures:
$s0 = "<Command>" fullword ascii
		$s1 = "</Command>" fullword ascii
		$s2 = "\" /d \"" fullword ascii
		$s4 = "'%s' %s" fullword ascii
		$s5 = "nKERNEL32.DLL" fullword wide
		$s6 = "@ReturnValue" fullword wide
		$s7 = "ID: 0x%x" fullword ascii
		$s8 = "Name: %S" fullword ascii

Detection condition:
7 of them

Full rule:
rule Casper_EXE_Dropper {
	meta:
		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/05"
		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
		score = 80
		id = "a901d045-6f9b-57e8-8347-6f78178b7231"
	strings:
		$s0 = "<Command>" fullword ascii
		$s1 = "</Command>" fullword ascii
		$s2 = "\" /d \"" fullword ascii
		$s4 = "'%s' %s" fullword ascii
		$s5 = "nKERNEL32.DLL" fullword wide
		$s6 = "@ReturnValue" fullword wide
		$s7 = "ID: 0x%x" fullword ascii
		$s8 = "Name: %S" fullword ascii
	condition:
		7 of them
}
YARA Detection Rule: Casper_Included_Strings
Repository: Neo23x0/signature-base
Detects: Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/VRJNLo

Pattern signatures:
$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
		$a1 = "& SYSTEMINFO) ELSE EXIT"

		$c1 = "domcommon.exe" wide fullword							// File Name
		$c2 = "jpic.gov.sy" fullword 								// C2 Server
		$c3 = "aiomgr.exe" wide fullword							// File Name
		$c4 = "perfaudio.dat" fullword								// Temp File Name
		$c5 = "Casper_DLL.dll" fullword								// Name
		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } 	// Decryption Key
		$c7 = "{4216567A-4512-9825-7745F856}" fullword 				// Mutex

Detection condition:
all of ($a*) or
		uint16(0) == 0x5a4d and ( 1 of ($c*) )

Full rule:
rule Casper_Included_Strings {
	meta:
		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/06"
		score = 50
		id = "34ba474d-0858-534a-8f32-db5a709e8814"
	strings:
		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
		$a1 = "& SYSTEMINFO) ELSE EXIT"

		$c1 = "domcommon.exe" wide fullword							// File Name
		$c2 = "jpic.gov.sy" fullword 								// C2 Server
		$c3 = "aiomgr.exe" wide fullword							// File Name
		$c4 = "perfaudio.dat" fullword								// Temp File Name
		$c5 = "Casper_DLL.dll" fullword								// Name
		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 } 	// Decryption Key
		$c7 = "{4216567A-4512-9825-7745F856}" fullword 				// Mutex
	condition:
		all of ($a*) or
		uint16(0) == 0x5a4d and ( 1 of ($c*) )
}
YARA Detection Rule: Casper_SystemInformation_Output
Repository: Neo23x0/signature-base
Detects: Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/VRJNLo

Pattern signatures:
$a0 = "***** SYSTEM INFORMATION ******"
		$a1 = "***** SECURITY INFORMATION ******"
		$a2 = "Antivirus: "
		$a3 = "Firewall: "
		$a4 = "***** EXECUTION CONTEXT ******"
		$a5 = "Identity: "
		$a6 = "<CONFIG TIMESTAMP="

Detection condition:
all of them

Full rule:
rule Casper_SystemInformation_Output {
	meta:
		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/VRJNLo"
		date = "2015/03/06"
		score = 70
		id = "aaae200c-7ef1-52eb-be5b-36e0ad29ecef"
	strings:
		$a0 = "***** SYSTEM INFORMATION ******"
		$a1 = "***** SECURITY INFORMATION ******"
		$a2 = "Antivirus: "
		$a3 = "Firewall: "
		$a4 = "***** EXECUTION CONTEXT ******"
		$a5 = "Identity: "
		$a6 = "<CONFIG TIMESTAMP="
	condition:
		all of them
}
YARA Detection Rule: Unauthorized_Proxy_Server_RAT
Repository: Neo23x0/signature-base
Author: US-CERT Code Analysis Team
Reference: https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity

Pattern signatures:
$s0 = {8A043132C288043125FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72DE5E5FC3}
      $s1 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s2 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s3 = {8A043132C288043125FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72DE5E5FC3}
      $s4 = {B91A7900008A140780F29A[PII_REDACTED]F4}
      $s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
      $s6 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40600910A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
      $s8 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F24}
      $s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F[PII_REDACTED]C7523}
      $s10 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F246685C0}
      $s11 = {30110FB60148FFC102C20FBEC09941F7

Detection condition:
any of them

Full rule:
rule Unauthorized_Proxy_Server_RAT {
   meta:
      author = "US-CERT Code Analysis Team"
      reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
      hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
      hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
      desscription = "Detects Proxy Server RAT"
      id = "378573e3-17a7-5862-aae5-a8e84102e237"
   strings:
      $s0 = {8A043132C288043125FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72DE5E5FC3}
      $s1 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s2 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s3 = {8A043132C288043125FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72DE5E5FC3}
      $s4 = {B91A7900008A140780F29A[PII_REDACTED]F4}
      $s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
      $s6 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40600910A[PII_REDACTED]D0413BCF72D65E5FC3}
      $s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
      $s8 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F24}
      $s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F[PII_REDACTED]C7523}
      $s10 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F246685C0}
      $s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
      $s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
      $s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
   condition:
      any of them
}
YARA Detection Rule: hkdoor_backdoor_dll
Repository: Neo23x0/signature-base
Detects: Hacker's Door Backdoor DLL
Author: Cylance Inc.
Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html

Pattern signatures:
$s1 = "The version of personal hacker's door server is" fullword ascii
      $s2 = "The connect back interval is %d (minutes)" fullword ascii
      $s3 = "I'mhackeryythac1977" fullword ascii
      $s4 = "Welcome to http://www.yythac.com" fullword ascii
      $s5 = "SeLoadDriverPrivilege" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 400KB and
      ( 3 of ($s*) ) and
      pe.characteristics & pe.DLL and
      pe.imports("ws2_32.dll", "WSAStartup") and
      pe.imports("ws2_32.dll", "sendto")

Full rule:
rule hkdoor_backdoor_dll {
   meta:
      description = "Hacker's Door Backdoor DLL"
      author = "Cylance Inc."
      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
      id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
   strings:
      $s1 = "The version of personal hacker's door server is" fullword ascii
      $s2 = "The connect back interval is %d (minutes)" fullword ascii
      $s3 = "I'mhackeryythac1977" fullword ascii
      $s4 = "Welcome to http://www.yythac.com" fullword ascii
      $s5 = "SeLoadDriverPrivilege" fullword ascii
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and
      ( 3 of ($s*) ) and
      pe.characteristics & pe.DLL and
      pe.imports("ws2_32.dll", "WSAStartup") and
      pe.imports("ws2_32.dll", "sendto")
}
YARA Detection Rule: hkdoor_backdoor
Repository: Neo23x0/signature-base
Detects: Hacker's Door Backdoor
Author: Cylance Inc.
Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html

Pattern signatures:
$s1 = "http://www.yythac.com" fullword ascii
      $s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
      $s3 = "password-----------The hacker's door's password" fullword ascii
      $s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
      $s5 = "hkdoordll.dll" fullword ascii
      $s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
      $s7 = "I'mhackeryythac1977" fullword ascii
      $s8 = "yythac.yeah.net" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 400KB and
      ( 4 of ($s*) )

Full rule:
rule hkdoor_backdoor {
   meta:
      description = "Hacker's Door Backdoor"
      author = "Cylance Inc."
      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
      id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
   strings:
      $s1 = "http://www.yythac.com" fullword ascii
      $s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
      $s3 = "password-----------The hacker's door's password" fullword ascii
      $s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
      $s5 = "hkdoordll.dll" fullword ascii
      $s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
      $s7 = "I'mhackeryythac1977" fullword ascii
      $s8 = "yythac.yeah.net" fullword ascii
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and
      ( 4 of ($s*) )
}
YARA Detection Rule: hkdoor_dropper
Repository: Neo23x0/signature-base
Detects: Hacker's Door Dropper
Author: Cylance Inc.
Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html

Pattern signatures:
$s1 = "The version of personal hacker's door server is" fullword ascii
      $s2 = "The connect back interval is %d (minutes)" fullword ascii
      $s3 = "I'mhackeryythac1977" fullword ascii
      $s4 = "Welcome to http://www.yythac.com" fullword ascii
      $s5 = "SeLoadDriverPrivilege" fullword ascii
      $s6 = "\\drivers\\ntfs.sys" ascii
      $s7 = "kifes" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 1000KB and
      ( 4 of ($s*) ) and
      pe.number_of_resources > 0 and
      for any i in (0..pe.number_of_resources - 1):
         (pe.resources[i].type_string == "B\x00I\x00N\x00" and
         uint16(pe.resources[i].offset) == 0x5A4D) and
      pe.imports

Full rule:
rule hkdoor_dropper {
   meta:
      description = "Hacker's Door Dropper"
      author = "Cylance Inc."
      date = "2018-01-01"
      modified = "2023-01-07"
      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
      id = "8c8171b9-6256-591a-8f74-abac1cb9a50b"
   strings:
      $s1 = "The version of personal hacker's door server is" fullword ascii
      $s2 = "The connect back interval is %d (minutes)" fullword ascii
      $s3 = "I'mhackeryythac1977" fullword ascii
      $s4 = "Welcome to http://www.yythac.com" fullword ascii
      $s5 = "SeLoadDriverPrivilege" fullword ascii
      $s6 = "\\drivers\\ntfs.sys" ascii
      $s7 = "kifes" fullword ascii
   condition:
      uint16(0) == 0x5a4d and
      filesize < 1000KB and
      ( 4 of ($s*) ) and
      pe.number_of_resources > 0 and
      for any i in (0..pe.number_of_resources - 1):
         (pe.resources[i].type_string == "B\x00I\x00N\x00" and
         uint16(pe.resources[i].offset) == 0x5A4D) and
      pe.imports("KERNEL32.dll", "FindResourceW") and
      pe.imports("KERNEL32.dll", "LoadResource")
}
YARA Detection Rule: hkdoor_driver
Repository: Neo23x0/signature-base
Detects: Hacker's Door Driver
Author: Cylance Inc.
Reference: https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html

Pattern signatures:
$s1 = "ipfltdrv.sys" fullword ascii
      $s2 = "Patch Success." fullword ascii
      $s3 = "\\DosDevices\\kifes" ascii
      $s4 = "\\Device\\kifes" ascii
      $s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}

Detection condition:
uint16(0) == 0x5a4d and
      pe.subsystem == pe.SUBSYSTEM_NATIVE and
      ( 4 of ($s*) )

Full rule:
rule hkdoor_driver {
   meta:
      description = "Hacker's Door Driver"
      author = "Cylance Inc."
      date = "2018-01-01"
      modified = "2023-01-07"
      reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
      id = "50b763a9-6d4f-59dd-ba6c-27e2ae117523"
   strings:
      $s1 = "ipfltdrv.sys" fullword ascii
      $s2 = "Patch Success." fullword ascii
      $s3 = "\\DosDevices\\kifes" ascii
      $s4 = "\\Device\\kifes" ascii
      $s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
   condition:
      uint16(0) == 0x5a4d and
      pe.subsystem == pe.SUBSYSTEM_NATIVE and
      ( 4 of ($s*) )
}