deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT1_dbg_mess
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$dbg1 = "Down file ok!" wide ascii
        $dbg2 = "Send file ok!" wide ascii
        $dbg3 = "Command Error!" wide ascii
        $dbg4 = "Pls choose target first!" wide ascii
        $dbg5 = "Alert!" wide ascii
        $dbg6 = "Pls press enter to make sure!" wide ascii
        $dbg7 = "Are you sure to " wide ascii
        $pay1 = "rusinfo.exe" wide ascii
        $pay2 = "cmd.exe" wide ascii
        $pay3 = "AdobeUpdater.exe" wide ascii
        $pay4 = "buildout.exe" wide ascii
        $pay5 = "DefWatch.exe" wide ascii
        $pay6 = "d.exe" wide ascii
        $pay7 = "em.exe" wide ascii
        $pay8 = "IMSCMig.exe" wide ascii
        $pay9 = "localfile.exe" wide ascii
        $pay10 = "md.exe" wide ascii
        $pay11 = "mdm.exe" wide ascii
        $pay12 = "mimikatz.exe" wide ascii
        $pay13 = "msdev.exe" wide ascii
        $pay14 = "ntoskrnl.exe" wide ascii
        $pay15 = "p.exe" wide ascii
        $pay16 = "otepad.exe" wide ascii
        $pay17 = "reg.exe" wide ascii
    

Detection condition:
4 of ($dbg*) and 1 of ($pay*)

Full rule:
rule APT1_dbg_mess
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $dbg1 = "Down file ok!" wide ascii
        $dbg2 = "Send file ok!" wide ascii
        $dbg3 = "Command Error!" wide ascii
        $dbg4 = "Pls choose target first!" wide ascii
        $dbg5 = "Alert!" wide ascii
        $dbg6 = "Pls press enter to make sure!" wide ascii
        $dbg7 = "Are you sure to " wide ascii
        $pay1 = "rusinfo.exe" wide ascii
        $pay2 = "cmd.exe" wide ascii
        $pay3 = "AdobeUpdater.exe" wide ascii
        $pay4 = "buildout.exe" wide ascii
        $pay5 = "DefWatch.exe" wide ascii
        $pay6 = "d.exe" wide ascii
        $pay7 = "em.exe" wide ascii
        $pay8 = "IMSCMig.exe" wide ascii
        $pay9 = "localfile.exe" wide ascii
        $pay10 = "md.exe" wide ascii
        $pay11 = "mdm.exe" wide ascii
        $pay12 = "mimikatz.exe" wide ascii
        $pay13 = "msdev.exe" wide ascii
        $pay14 = "ntoskrnl.exe" wide ascii
        $pay15 = "p.exe" wide ascii
        $pay16 = "otepad.exe" wide ascii
        $pay17 = "reg.exe" wide ascii
        $pay18 = "regsvr.exe" wide ascii
        $pay19 = "runinfo.exe" wide ascii
        $pay20 = "AdobeUpdate.exe" wide ascii
        $pay21 = "inetinfo.exe" wide ascii
        $pay22 = "svehost.exe" wide ascii
        $pay23 = "update.exe" wide ascii
        $pay24 = "NTLMHash.exe" wide ascii
        $pay25 = "wpnpinst.exe" wide ascii
        $pay26 = "WSDbg.exe" wide ascii
        $pay27 = "xcmd.exe" wide ascii
        $pay28 = "adobeup.exe" wide ascii
        $pay29 = "0830.bin" wide ascii
        $pay30 = "1001.bin" wide ascii
        $pay31 = "a.bin" wide ascii
        $pay32 = "ISUN32.EXE" wide ascii
        $pay33 = "AcroRD32.EXE" wide ascii
        $pay34 = "INETINFO.EXE" wide ascii

    condition:
        4 of ($dbg*) and 1 of ($pay*)
}
YARA Detection Rule: APT1_known_malicious_RARSilent
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$str1 = "Analysis And Outlook.doc" wide ascii
        $str2 = "North Korean launch.pdf" wide ascii
        $str3 = "Dollar General.doc" wide ascii
        $str4 = "Dow Corning Corp.pdf" wide ascii

Detection condition:
1 of them and APT1_RARSilent_EXE_PDF

Full rule:
rule APT1_known_malicious_RARSilent
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"

    strings:
        $str1 = "Analysis And Outlook.doc" wide ascii
        $str2 = "North Korean launch.pdf" wide ascii
        $str3 = "Dollar General.doc" wide ascii
        $str4 = "Dow Corning Corp.pdf" wide ascii

    condition:
        1 of them and APT1_RARSilent_EXE_PDF
}
YARA Detection Rule: win_asyncrat_j1
Repository: Yara-Rules/rules
Detects: detects AsyncRAT
Author: Johannes Bader @viql

Pattern signatures:
$str_anti_1 = "VIRTUAL" wide
        $str_anti_2 = "vmware" wide
        $str_anti_3 = "VirtualBox" wide
        $str_anti_4 = "SbieDll.dll" wide

        $str_miner_1 = "--donate-level=" wide

        $str_b_rev_run    = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
        $str_b_msg_pack_1 = "(ext8,ext16,ex32) type $c7,$c8,$c9" wide
        $str_b_msg_pack_2 = "(never used) type $c1" wide
        $str_b_schtask_1  = "/create /f /sc ONLOGON /RL HIGHEST /tn \"'" wide
        $str_b_schtask_2  = "\"' /tr \"'" wide

        $str_config_1 = "Antivirus" wide
        $str_config_2 = "Pastebin" wide
        $str_config_3 = "HWID" wide
        $str_config_4 = "Installed" wide
        $str_config_5 = "Pong" wide
        $str_config_6 = "Performance" wide

Detection condition:
all of ($str_anti_*)  and 
        4 of ($str_config_*) and ( 
            all of ($str_miner_*) or 
            3 of ($str_b_*)
        )

Full rule:
rule win_asyncrat_j1 {

    meta:
        author      = "Johannes Bader @viql"
        date        = "2020-04-26"
        description = "detects AsyncRAT"
        references  = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
        tlp         = "white"

    strings:
        $str_anti_1 = "VIRTUAL" wide
        $str_anti_2 = "vmware" wide
        $str_anti_3 = "VirtualBox" wide
        $str_anti_4 = "SbieDll.dll" wide

        $str_miner_1 = "--donate-level=" wide

        $str_b_rev_run    = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
        $str_b_msg_pack_1 = "(ext8,ext16,ex32) type $c7,$c8,$c9" wide
        $str_b_msg_pack_2 = "(never used) type $c1" wide
        $str_b_schtask_1  = "/create /f /sc ONLOGON /RL HIGHEST /tn \"'" wide
        $str_b_schtask_2  = "\"' /tr \"'" wide

        $str_config_1 = "Antivirus" wide
        $str_config_2 = "Pastebin" wide
        $str_config_3 = "HWID" wide
        $str_config_4 = "Installed" wide
        $str_config_5 = "Pong" wide
        $str_config_6 = "Performance" wide

    condition:
        all of ($str_anti_*)  and 
        4 of ($str_config_*) and ( 
            all of ($str_miner_*) or 
            3 of ($str_b_*)
        )
        
}
YARA Detection Rule: HKTL_Solarwinds_credential_stealer
Repository: Yara-Rules/rules
Detects: Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns
Author: Arnim Rupp
Reference: https://github.com/mubix/solarflare

Pattern signatures:
$certificate = "CN=SolarWinds-Orion" ascii nocase wide
        $credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
        $credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
        $credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
        $credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
        $sql1 = "encryptedkey" ascii nocase wide fullword
        $sql2 = "protectiontype" ascii nocase wide fullword
        $sql3 = "CredentialProperty" ascii nocase wide fullword
        $sql4 = "passwordhash" ascii nocase wide fullword
        $sql5 = "credentialtype" ascii nocase wide fullword
        $sql6 = "passwordsalt" ascii nocase wide fullword

Detection condition:
uint16(0) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )

Full rule:
rule HKTL_Solarwinds_credential_stealer {
    meta:
        description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
        reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        reference = "https://github.com/mubix/solarflare"
        author = "Arnim Rupp"
        date = "2021-01-20"
		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
    strings:
        $certificate = "CN=SolarWinds-Orion" ascii nocase wide
        $credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
        $credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
        $credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
        $credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
        $sql1 = "encryptedkey" ascii nocase wide fullword
        $sql2 = "protectiontype" ascii nocase wide fullword
        $sql3 = "CredentialProperty" ascii nocase wide fullword
        $sql4 = "passwordhash" ascii nocase wide fullword
        $sql5 = "credentialtype" ascii nocase wide fullword
        $sql6 = "passwordsalt" ascii nocase wide fullword
    condition:
        uint16(0) == 0x5A4D and $certificate and ( 2 of ( $credfile* ) or 5 of ( $sql* ) )
}
YARA Detection Rule: WaterBug_wipbot_2013_core_PDF
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$PDF = "%PDF-"
        $a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/ 
        $b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/

Detection condition:
($PDF at 0) and #a > 150 and #b > 200

Full rule:
rule WaterBug_wipbot_2013_core_PDF 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"
 
    strings:
        $PDF = "%PDF-"
        $a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/ 
        $b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
 
    condition:
        ($PDF at 0) and #a > 150 and #b > 200
}
YARA Detection Rule: WaterBug_wipbot_2013_dll
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$string1 = "/%s?rank=%s"
        $string2 = "ModuleStart\x00ModuleStop\x00start"
        $string3 = "1156fd22-3443-4344-c4ffff"
        //read file... error..
        $string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"

Detection condition:
2 of them

Full rule:
rule WaterBug_wipbot_2013_dll 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"        
  
    strings:
        $string1 = "/%s?rank=%s"
        $string2 = "ModuleStart\x00ModuleStop\x00start"
        $string3 = "1156fd22-3443-4344-c4ffff"
        //read file... error..
        $string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
  
    condition:
        2 of them
}
YARA Detection Rule: WaterBug_wipbot_2013_core
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$mz = "MZ"
        $code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
        $code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
        $code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}

Detection condition:
$mz at 0 and (($code1 or $code2) or ($code3 and $code4))

Full rule:
rule WaterBug_wipbot_2013_core 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"            

    strings:
        $mz = "MZ"
        $code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
        $code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
        $code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04} $code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}

    condition:
        $mz at 0 and (($code1 or $code2) or ($code3 and $code4))
}
YARA Detection Rule: WaterBug_turla_dropper
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - Trojan Turla Dropper
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
        $b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}

Detection condition:
all of them

Full rule:
rule WaterBug_turla_dropper 
{

    meta:
        description = "Symantec Waterbug Attack - Trojan Turla Dropper"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"

    strings: 
        $a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
        $b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}

    condition: 
        all of them
}
YARA Detection Rule: WaterBug_fa_malware
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - FA malware variant
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$mz = "MZ"
        $string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
        $string2 = "d:\\proj\\cn\\fa64\\"
        $string3 = "sengoku_Win32.sys\x00"
        $string4 = "rk_ntsystem.c"
        $string5 = "\\uroboros\\"
        $string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"

Detection condition:
($mz at 0) and (any of ($string*))

Full rule:
rule WaterBug_fa_malware 
{ 

    meta: 
        description = "Symantec Waterbug Attack - FA malware variant"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"

    strings:
        $mz = "MZ"
        $string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
        $string2 = "d:\\proj\\cn\\fa64\\"
        $string3 = "sengoku_Win32.sys\x00"
        $string4 = "rk_ntsystem.c"
        $string5 = "\\uroboros\\"
        $string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"

    condition:
        ($mz at 0) and (any of ($string*))
}
YARA Detection Rule: WaterBug_sav
Repository: Yara-Rules/rules
Detects: Symantec Waterbug Attack - SAV Malware
Author: Symantec Security Response
Reference: http://t.co/rF35OaAXrl

Pattern signatures:
$mz = "MZ"
        $code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
        $code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
        $code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
        $code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}

Detection condition:
($mz at 0) and (($code1a or $code1b or $code1c) and $code2)

Full rule:
rule WaterBug_sav 
{

    meta: 
        description = "Symantec Waterbug Attack - SAV Malware"
        author = "Symantec Security Response"
        date = "22.01.2015"
        reference = "http://t.co/rF35OaAXrl"    

    strings:
        $mz = "MZ"
        $code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
        $code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC 3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
        $code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
        $code2 =  { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
   
    condition:
        ($mz at 0) and (($code1a or $code1b or $code1c) and $code2) 
}
YARA Detection Rule: d4fe01ea13cf9926c2cf51d0ffbd78f9a110f4b9
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file d4fe01ea13cf9926c2cf51d0ffbd78f9a110f4b9.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = ":&:-:=:J:O:\\:m:r:" fullword ascii
		$s2 = "6)6/666;6N6W6^6c6t6y6" fullword ascii
		$s3 = "666Q6V6b6g6~6" fullword ascii
		$s4 = "0%0,010A0F0K0\\0a0f0w0|0" fullword ascii
		$s5 = "6!6(63686E6J6W6\\6i6n6{6" fullword ascii
		$s6 = "3 3%33383=3J3R3`3e3o3t3~3" fullword ascii
		$s7 = "4 4'40454:4G4M4R4_4e4j4w4" fullword ascii
		$s8 = "1#1(141=1B1N1T1Y1e1k1p1|1" fullword ascii
		$s9 = "?(?2?<?C?J?Q?X?_?f?m?t?{?" fullword ascii
		$s10 = "?#?*?1?8???F?M?T?[?b?i?p?w?" fullword ascii
		$s11 = "6)6/646@6F6K6W6]6b6n6w6|6" fullword ascii
		$s12 = "4#40454:4G4L4Q4^4c4h4u4z4" fullword ascii
		$s13 = "<\"<'<3<8<=<I<N<S<_<d<i<u<z<" fullword ascii
		$s14 = ">%>/>9>@>G>N>U>\\>c>j>q>" fullword ascii
		$s15 = "WTZDAE" fullword ascii
		$s16 = "060>0E0K0P0\\0b0g0v0|0" fullword ascii
		$s17 = "4#4-474A4K4U4\\4f4p4z4" fullword ascii
		$s18 = "7\"7,767@7J7T7^7h7q7{7" fullword ascii
		$s19 = ";\";';4;E;J;W;k;p;};" fullword ascii
		$s20 = ";0;;;F;Q;\\;g;r;};" fullword ascii

		$op0 = { a1 b8 63 44 00 83 c4

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule d4fe01ea13cf9926c2cf51d0ffbd78f9a110f4b9 {
	meta:
		description = "Auto-generated rule - file d4fe01ea13cf9926c2cf51d0ffbd78f9a110f4b9.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		hash1 = "d1dc9b2905264da34dc97d6c005810fbcc99be1a6b4b41f883bb179dbcacba6e"
	strings:
		$s1 = ":&:-:=:J:O:\\:m:r:" fullword ascii
		$s2 = "6)6/666;6N6W6^6c6t6y6" fullword ascii
		$s3 = "666Q6V6b6g6~6" fullword ascii
		$s4 = "0%0,010A0F0K0\\0a0f0w0|0" fullword ascii
		$s5 = "6!6(63686E6J6W6\\6i6n6{6" fullword ascii
		$s6 = "3 3%33383=3J3R3`3e3o3t3~3" fullword ascii
		$s7 = "4 4'40454:4G4M4R4_4e4j4w4" fullword ascii
		$s8 = "1#1(141=1B1N1T1Y1e1k1p1|1" fullword ascii
		$s9 = "?(?2?<?C?J?Q?X?_?f?m?t?{?" fullword ascii
		$s10 = "?#?*?1?8???F?M?T?[?b?i?p?w?" fullword ascii
		$s11 = "6)6/646@6F6K6W6]6b6n6w6|6" fullword ascii
		$s12 = "4#40454:4G4L4Q4^4c4h4u4z4" fullword ascii
		$s13 = "<\"<'<3<8<=<I<N<S<_<d<i<u<z<" fullword ascii
		$s14 = ">%>/>9>@>G>N>U>\\>c>j>q>" fullword ascii
		$s15 = "WTZDAE" fullword ascii
		$s16 = "060>0E0K0P0\\0b0g0v0|0" fullword ascii
		$s17 = "4#4-474A4K4U4\\4f4p4z4" fullword ascii
		$s18 = "7\"7,767@7J7T7^7h7q7{7" fullword ascii
		$s19 = ";\";';4;E;J;W;k;p;};" fullword ascii
		$s20 = ";0;;;F;Q;\\;g;r;};" fullword ascii

		$op0 = { a1 b8 63 44 00 83 c4 14 53 ff 75 14 56 57 ff 90 } /* Opcode */
		$op1 = { 8b d8 8b 45 08 8b 40 3a 81 c3 00 10 00 00 03 c3 } /* Opcode */
		$op2 = { 5c 2d 44 00 c7 84 24 c0 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )
}
YARA Detection Rule: sig_7acb8d6d4c062c3097a7d31df103bc4d018519f9
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file 7acb8d6d4c062c3097a7d31df103bc4d018519f9.codex
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = "5(666Z6c6" fullword ascii
		$s2 = "Wlm;y%UD%d" fullword ascii
		$s3 = ";1;9;@;G;N;U;\\;c;j;q;x;" fullword ascii
		$s4 = "8 8'8.858<8C8J8Q8X8_8f8m8t8" fullword ascii
		$s5 = "2 2,282=2B2G2P2U2Z2_2h2s2x2" fullword ascii
		$s6 = "4'5.555<5C5J5Q5X5_5f5m5t5{5" fullword ascii
		$s7 = "0#0*01080?0F0M0T0[0b0i0p0w0" fullword ascii
		$s8 = "6$6,616=6B6G6S6X6]6i6n6s6" fullword ascii
		$s9 = "=\"=)=0=7=>=E=L=S=Z=a=h=" fullword ascii
		$s10 = "6&6-646;6B6I6P6W6^6e6l6s6z6" fullword ascii
		$s11 = "O.QrH@" fullword ascii
		$s12 = ">\">/>4>A>F>S>X>e>j>w>|>" fullword ascii
		$s13 = "0#0(040=0B0N0T0Y0e0k0p0|0" fullword ascii
		$s14 = "5)5/545@5F5K5W5`5e5q5w5|5" fullword ascii
		$s15 = "=!=&=3=8=E=N=S=`=e=s=x=}=" fullword ascii
		$s16 = ":(:/:6:=:D:K:R:Y:`:g:n:u:|:" fullword ascii
		$s17 = "7\"727<7F7M7W7a7k7u7" fullword ascii
		$s18 = "2+21262E2K2P2\\2h2m2|2" fullword ascii
		$s19 = ";/;5;:;G;V;\\;a;n;};" fullword ascii
		$s20 = ";\";-;8;C;N;^;i;t;" fullword ascii

		$op0 = { ff 44 24 14 8d 47 44

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )

Full rule:
rule sig_7acb8d6d4c062c3097a7d31df103bc4d018519f9 {
	meta:
		description = "Auto-generated rule - file 7acb8d6d4c062c3097a7d31df103bc4d018519f9.codex"
		author = "YarGen Rule Generator"
		reference = "not set"
		date = "2016-07-21"
		hash1 = "e1607486cbb2d111d5df314fe58948aa0dc5897f56f7fd763c62bb30651380e3"
	strings:
		$s1 = "5(666Z6c6" fullword ascii
		$s2 = "Wlm;y%UD%d" fullword ascii
		$s3 = ";1;9;@;G;N;U;\\;c;j;q;x;" fullword ascii
		$s4 = "8 8'8.858<8C8J8Q8X8_8f8m8t8" fullword ascii
		$s5 = "2 2,282=2B2G2P2U2Z2_2h2s2x2" fullword ascii
		$s6 = "4'5.555<5C5J5Q5X5_5f5m5t5{5" fullword ascii
		$s7 = "0#0*01080?0F0M0T0[0b0i0p0w0" fullword ascii
		$s8 = "6$6,616=6B6G6S6X6]6i6n6s6" fullword ascii
		$s9 = "=\"=)=0=7=>=E=L=S=Z=a=h=" fullword ascii
		$s10 = "6&6-646;6B6I6P6W6^6e6l6s6z6" fullword ascii
		$s11 = "O.QrH@" fullword ascii
		$s12 = ">\">/>4>A>F>S>X>e>j>w>|>" fullword ascii
		$s13 = "0#0(040=0B0N0T0Y0e0k0p0|0" fullword ascii
		$s14 = "5)5/545@5F5K5W5`5e5q5w5|5" fullword ascii
		$s15 = "=!=&=3=8=E=N=S=`=e=s=x=}=" fullword ascii
		$s16 = ":(:/:6:=:D:K:R:Y:`:g:n:u:|:" fullword ascii
		$s17 = "7\"727<7F7M7W7a7k7u7" fullword ascii
		$s18 = "2+21262E2K2P2\\2h2m2|2" fullword ascii
		$s19 = ";/;5;:;G;V;\\;a;n;};" fullword ascii
		$s20 = ";\";-;8;C;N;^;i;t;" fullword ascii

		$op0 = { ff 44 24 14 8d 47 44 50 a1 08 63 44 00 ff 90 84 } /* Opcode */
		$op1 = { 6d 43 00 c7 84 24 10 03 00 00 0c 6d 43 00 c7 84 } /* Opcode */
		$op2 = { c7 43 0c 20 02 00 00 89 5d f0 ff 90 f8 } /* Opcode */
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 10 of ($s*) )and 1 of ($op*) ) or ( all of them )
}