deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: _hscan_hscan_hscangui
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = ".\\log\\Hscan.log" fullword ascii
		$s2 = ".\\report\\%s-%s.html" fullword ascii
		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 240KB and all of them

Full rule:
rule _hscan_hscan_hscangui {
	meta:
		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
		id = "174b0ee4-23ce-59fd-a784-ab58fd13ce67"
	strings:
		$s1 = ".\\log\\Hscan.log" fullword ascii
		$s2 = ".\\report\\%s-%s.html" fullword ascii
		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 240KB and all of them
}
YARA Detection Rule: kiwi_tools
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
		$s2 = "Benjamin Delpy" fullword ascii
		$s3 = "GlobalSign" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule kiwi_tools {
	meta:
		description = "Chinese Hacktool Set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
		hash5 = "7addce[PII_REDACTED]c4efaa560524680ba2871d17"
		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
		hash10 = "febadc01a64a071816eac61a85418711debaf233"
		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
		id = "000f0081-b035-5c73-8da2-addde2b55303"
	strings:
		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
		$s2 = "Benjamin Delpy" fullword ascii
		$s3 = "GlobalSign" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: kiwi_tools_gentil_kiwi
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "mimikatz" fullword wide
		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
		$s3 = "Gentil Kiwi" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule kiwi_tools_gentil_kiwi {
	meta:
		description = "Chinese Hacktool Set"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		super_rule = 1
		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
		hash5 = "7addce[PII_REDACTED]c4efaa560524680ba2871d17"
		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
		hash9 = "febadc01a64a071816eac61a85418711debaf233"
		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
		id = "4ad54580-b10b-5b17-8d8a-510e210e04d1"
	strings:
		$s1 = "mimikatz" fullword wide
		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
		$s3 = "Gentil Kiwi" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: SUSP_Qakbot_Uninstaller_ShellCode_Aug23
Repository: Neo23x0/signature-base
Detects: Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023
Author: Florian Roth
Reference: https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources

Pattern signatures:
$xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }

Detection condition:
$xc1

Full rule:
rule SUSP_Qakbot_Uninstaller_ShellCode_Aug23 {
   meta:
      description = "Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023"
      author = "Florian Roth"
      reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
      date = "2023-08-30"
      score = 60
      id = "860796ab-689f-5c5f-bc40-3e2ef7fd1d5d"
   strings:
      $xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }
   condition:
      $xc1
}
YARA Detection Rule: SUSP_QakBot_Uninstaller_FBI_Aug23
Repository: Neo23x0/signature-base
Detects: Detects Qakbot uninstaller used by the FBI / Dutch Police
Author: Florian Roth
Reference: https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources

Pattern signatures:
$op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
      $op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
      $op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
      $op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }

Detection condition:
all of them

Full rule:
rule SUSP_QakBot_Uninstaller_FBI_Aug23 {
   meta:
      description = "Detects Qakbot uninstaller used by the FBI / Dutch Police"
      author = "Florian Roth"
      reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
      date = "2023-08-31"
      score = 60
      hash1 = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
      hash2 = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
      hash3 = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
      id = "499bff56-ff49-53df-9922-227b816c0a36"
   strings:
      $op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
      $op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
      $op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
      $op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }
   condition:
      all of them
}
YARA Detection Rule: crime_ole_loadswf_cve_2018_4878
Repository: Neo23x0/signature-base
Detects: Detects CVE-2018-4878
Threat actor: Purported North Korean actors
Author: Vitali Kremez, Flashpoint
Reference: hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998

Pattern signatures:
// EMBEDDED FLASH OBJECT BIN HEADER
      $header = "rdf:RDF" wide ascii
      // OBJECT APPLICATION TYPE TITLE
      $title = "Adobe Flex" wide ascii
      // PDB PATH
      $pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
      // LOADER STRINGS
      $s0 = "URLRequest" wide ascii
      $s1 = "URLLoader" wide ascii
      $s2 = "loadswf" wide ascii
      $s3 = "myUrlReqest" wide ascii

Detection condition:
filesize < 500KB and all of ($header*) and
      all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)

Full rule:
rule crime_ole_loadswf_cve_2018_4878 {
   meta:
      description = "Detects CVE-2018-4878"
      vuln_type = "Remote Code Execution"
      vuln_impact = "Use-after-free"
      affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
      mitigation0 = "Implement Protected View for Office documents"
      mitigation1 = "Disable Adobe Flash"
      weaponization = "Embedded in Microsoft Office first payloads"
      actor = "Purported North Korean actors"
      reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
      author = "Vitali Kremez, Flashpoint"
      version = "1.1"
      id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"
   strings:
      // EMBEDDED FLASH OBJECT BIN HEADER
      $header = "rdf:RDF" wide ascii
      // OBJECT APPLICATION TYPE TITLE
      $title = "Adobe Flex" wide ascii
      // PDB PATH
      $pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
      // LOADER STRINGS
      $s0 = "URLRequest" wide ascii
      $s1 = "URLLoader" wide ascii
      $s2 = "loadswf" wide ascii
      $s3 = "myUrlReqest" wide ascii
   condition:
      filesize < 500KB and all of ($header*) and
      all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
}
YARA Detection Rule: EXPL_macOS_Switcharoo_Indicator_Dec22
Repository: Neo23x0/signature-base
Detects: Detects indicators found after exploitations of CVE-2022-46689
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/zhuowei/MacDirtyCowDemo

Pattern signatures:
$x1 = "auth       sufficient     pam_permit.so" ascii

Detection condition:
filesize < 1KB and $x1

Full rule:
rule EXPL_macOS_Switcharoo_Indicator_Dec22 {
   meta:
      description = "Detects indicators found after exploitations of CVE-2022-46689"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/zhuowei/MacDirtyCowDemo"
      date = "2022-12-19"
      score = 65
      id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"
   strings:
      $x1 = "auth       sufficient     pam_permit.so" ascii
   condition:
      filesize < 1KB and $x1
}
YARA Detection Rule: IronTiger_ASPXSpy
Repository: Neo23x0/signature-base
Detects: ASPXSpy detection. It might be used by other fraudsters
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str2 = "IIS Spy" wide ascii
		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii

Detection condition:
any of ($str*)

Full rule:
rule IronTiger_ASPXSpy : HIGHVOL
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "ASPXSpy detection. It might be used by other fraudsters"
		reference = "http://goo.gl/T5fSJC"
		id = "3010fcb9-0dbf-59ef-90ce-01d922a95f2d"
	strings:
		$str2 = "IIS Spy" wide ascii
		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii
	condition:
		any of ($str*)
}
YARA Detection Rule: IronTiger_ChangePort_Toolkit_driversinstall
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - Changeport Toolkit driverinstall
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "openmydoor" wide ascii
		$str2 = "Install service error" wide ascii
		$str3 = "start remove service" wide ascii
		$str4 = "NdisVersion" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_ChangePort_Toolkit_driversinstall
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
		reference = "http://goo.gl/T5fSJC"
		id = "fde2728b-9a23-5f35-9727-0834a7b403da"
	strings:
		$str1 = "openmydoor" wide ascii
		$str2 = "Install service error" wide ascii
		$str3 = "start remove service" wide ascii
		$str4 = "NdisVersion" wide ascii
	condition:
		uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_ChangePort_Toolkit_ChangePortExe
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - Toolkit ChangePort
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Unable to alloc the adapter!" wide ascii
		$str2 = "Wait for master fuck" wide ascii
		$str3 = "xx.exe <HOST> <PORT>" wide ascii
		$str4 = "chkroot2007" wide ascii
		$str5 = "Door is bind on %s" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_ChangePort_Toolkit_ChangePortExe
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - Toolkit ChangePort"
		reference = "http://goo.gl/T5fSJC"
		id = "2ba74413-5f72-560a-8567-1c4bf3357097"
	strings:
		$str1 = "Unable to alloc the adapter!" wide ascii
		$str2 = "Wait for master fuck" wide ascii
		$str3 = "xx.exe <HOST> <PORT>" wide ascii
		$str4 = "chkroot2007" wide ascii
		$str5 = "Door is bind on %s" wide ascii
	condition:
		uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_dllshellexc2010
Repository: Neo23x0/signature-base
Detects: dllshellexc2010 Exchange backdoor + remote shell
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
		$str2 = "Dllshellexc2010" wide ascii
		$str3 = "Users\\ljw\\Documents" wide ascii
		$bla1 = "please input path" wide ascii
		$bla2 = "auth.owa" wide ascii

Detection condition:
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_dllshellexc2010
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "dllshellexc2010 Exchange backdoor + remote shell"
		reference = "http://goo.gl/T5fSJC"
		id = "960e8e5c-65a5-5dd2-90fa-1f7d31ee8cb5"
	strings:
		$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
		$str2 = "Dllshellexc2010" wide ascii
		$str3 = "Users\\ljw\\Documents" wide ascii
		$bla1 = "please input path" wide ascii
		$bla2 = "auth.owa" wide ascii
	condition:
		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_dnstunnel
Repository: Neo23x0/signature-base
Detects: This rule detects a dns tunnel tool used in Operation Iron Tiger
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "\\DnsTunClient\\" wide ascii
		$str2 = "\\t-DNSTunnel\\" wide ascii
		$str3 = "xssok.blogspot" wide ascii
		$str4 = "dnstunclient" wide ascii
		$mistake1 = "because of error, can not analysis" wide ascii
		$mistake2 = "can not deal witn the error" wide ascii
		$mistake3 = "the other retun one RST" wide ascii
		$mistake4 = "Coversation produce one error" wide ascii
		$mistake5 = "Program try to use the have deleted the buffer" wide ascii

Detection condition:
(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))

Full rule:
rule IronTiger_dnstunnel
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
		reference = "http://goo.gl/T5fSJC"
		id = "7f24d3dd-4301-5b12-8262-4cc5f6578a4b"
	strings:
		$str1 = "\\DnsTunClient\\" wide ascii
		$str2 = "\\t-DNSTunnel\\" wide ascii
		$str3 = "xssok.blogspot" wide ascii
		$str4 = "dnstunclient" wide ascii
		$mistake1 = "because of error, can not analysis" wide ascii
		$mistake2 = "can not deal witn the error" wide ascii
		$mistake3 = "the other retun one RST" wide ascii
		$mistake4 = "Coversation produce one error" wide ascii
		$mistake5 = "Program try to use the have deleted the buffer" wide ascii
	condition:
		(uint16(0) == 0x5a4d) and ((any of ($str*)) or (any of ($mistake*)))
}
YARA Detection Rule: IronTiger_EFH3_encoder
Repository: Neo23x0/signature-base
Detects: Iron Tiger EFH3 Encoder
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
		$str2 = "123.EXE 123.EFH" wide ascii
		$str3 = "ENCODER: b[i]: = " wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_EFH3_encoder
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger EFH3 Encoder"
		reference = "http://goo.gl/T5fSJC"
		id = "ec30782e-8fe9-5843-9db4-5a3c477b7f25"
	strings:
		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
		$str2 = "123.EXE 123.EFH" wide ascii
		$str3 = "ENCODER: b[i]: = " wide ascii
	condition:
		uint16(0) == 0x5a4d and (any of ($str*))
}
YARA Detection Rule: IronTiger_GetPassword_x64
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - GetPassword x64
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "(LUID ERROR)" wide ascii
		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
		$str3 = "Debug x64\\GetPassword.pdb" ascii
		$bla1 = "Authentication Package:" wide ascii
		$bla2 = "Authentication Domain:" wide ascii
		$bla3 = "* Password:" wide ascii
		$bla4 = "Primary User:" wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_GetPassword_x64
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - GetPassword x64"
		reference = "http://goo.gl/T5fSJC"
		modified = "2023-01-06"
		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"
	strings:
		$str1 = "(LUID ERROR)" wide ascii
		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
		$str3 = "Debug x64\\GetPassword.pdb" ascii
		$bla1 = "Authentication Package:" wide ascii
		$bla2 = "Authentication Domain:" wide ascii
		$bla3 = "* Password:" wide ascii
		$bla4 = "Primary User:" wide ascii
	condition:
		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_GTalk_Trojan
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - GTalk Trojan
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "gtalklite.com" wide ascii
		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
		$str3 = "D13idmAdm" wide ascii
		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (2 of ($str*))

Full rule:
rule IronTiger_GTalk_Trojan
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - GTalk Trojan"
		reference = "http://goo.gl/T5fSJC"
		id = "3d72660b-c470-5e63-a83d-990d3c5a696c"
	strings:
		$str1 = "gtalklite.com" wide ascii
		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
		$str3 = "D13idmAdm" wide ascii
		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii
	condition:
		uint16(0) == 0x5a4d and (2 of ($str*))
}
YARA Detection Rule: IronTiger_HTTP_SOCKS_Proxy_soexe
Repository: Neo23x0/signature-base
Detects: Iron Tiger Toolset - HTTP SOCKS Proxy soexe
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "listen SOCKET error." wide ascii
		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
		$str3 = "new SOCKETINFO error!" wide ascii
		$str4 = "Http/1.1 403 Forbidden" wide ascii
		$str5 = "Create SOCKET error." wide ascii

Detection condition:
uint16(0) == 0x5a4d and (3 of ($str*))

Full rule:
rule IronTiger_HTTP_SOCKS_Proxy_soexe
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
		reference = "http://goo.gl/T5fSJC"
		id = "6ead3d61-c1e3-55d1-894e-ab57bcd09cde"
	strings:
		$str1 = "listen SOCKET error." wide ascii
		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
		$str3 = "new SOCKETINFO error!" wide ascii
		$str4 = "Http/1.1 403 Forbidden" wide ascii
		$str5 = "Create SOCKET error." wide ascii
	condition:
		uint16(0) == 0x5a4d and (3 of ($str*))
}
YARA Detection Rule: IronTiger_NBDDos_Gh0stvariant_dropper
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - NBDDos Gh0stvariant Dropper
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "This service can't be stoped." wide ascii
		$str2 = "Provides support for media palyer" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Kill You" wide ascii
		$bla2 = "%4.2f GB" wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_NBDDos_Gh0stvariant_dropper
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
		reference = "http://goo.gl/T5fSJC"
		id = "3610b9e3-45f8-5a8d-[PII_REDACTED]"
	strings:
		$str1 = "This service can't be stoped." wide ascii
		$str2 = "Provides support for media palyer" wide ascii
		$str4 = "CreaetProcess Error" wide ascii
		$bla1 = "Kill You" wide ascii
		$bla2 = "%4.2f GB" wide ascii
	condition:
		uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_PlugX_DosEmulator
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - PlugX DosEmulator
Author: Cyber Safety Solutions, Trend Micro - modified by Florian Roth
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Dos Emluator Ver" wide ascii
		$str2 = "\\PIPE\\FASTDOS" wide ascii
		$str3 = "FastDos.cpp" wide ascii
		$str4 = "fail,error code = %d." wide ascii

Detection condition:
uint16(0) == 0x5a4d and 2 of ($str*)

Full rule:
rule IronTiger_PlugX_DosEmulator
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro - modified by Florian Roth"
		description = "Iron Tiger Malware - PlugX DosEmulator"
		reference = "http://goo.gl/T5fSJC"
		id = "e601d91d-49e6-5fe9-b70b-fb1fb6c4f059"
	strings:
		$str1 = "Dos Emluator Ver" wide ascii
		$str2 = "\\PIPE\\FASTDOS" wide ascii
		$str3 = "FastDos.cpp" wide ascii
		$str4 = "fail,error code = %d." wide ascii
	condition:
		uint16(0) == 0x5a4d and 2 of ($str*)
}
YARA Detection Rule: IronTiger_PlugX_FastProxy
Repository: Neo23x0/signature-base
Detects: Iron Tiger Malware - PlugX FastProxy
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
		$str2 = "Useage: %s pid" wide ascii
		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
		$str4 = "p0: port for listener" wide ascii
		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii

Detection condition:
uint16(0) == 0x5a4d and (any of ($str*))

Full rule:
rule IronTiger_PlugX_FastProxy
{
	meta:
		author = "Cyber Safety Solutions, Trend Micro"
		description = "Iron Tiger Malware - PlugX FastProxy"
		reference = "http://goo.gl/T5fSJC"
		id = "14e05823-6288-5f02-8060-add51084c446"
	strings:
		$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
		$str2 = "Useage: %s pid" wide ascii
		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
		$str4 = "p0: port for listener" wide ascii
		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii
	condition:
		uint16(0) == 0x5a4d and (any of ($str*))
}