deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_Imphash_Mar23_2
Repository: Neo23x0/signature-base
Detects: Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Detection condition:
uint16(0) == 0x5A4D and (
            // no size limit as some samples are 20MB+ and the hash is calculated only on the header
            pe.imphash() == "e4290fa6afc89d56616f34ebbd0b1f2c" or
            pe.imphash() == "8abecba2211e61763c4c9ffcaa13369e" or
            pe.imphash() == "a64e048b98d0

Full rule:
rule SUSP_Imphash_Mar23_2 : HIGHVOL {
    meta:
        description = "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)"
        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
        author = "Arnim Rupp (https://github.com/ruppde)"
        reference = "Internal Research"
        date = "2023-03-23"
        modified = "2023-11-25"
        score = 65
        hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
        hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
        hash = "[PII_REDACTED]d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
        hash = "15e59cc5d7b83e63d40dbfd8406701cb4decd31353f68fda47238d073c87e4ea"
        hash = "13e5bb40be20b1a0bc28081ce7798f339c28c9652cb37b538c29872dfd0cd51d"
        hash = "16f963afdb30b38ba4b8b98ce56a37626e9fd87de9eba5f9903d2ba7f8a77788"
        hash = "168f22d02304ce66be88d2370c8fa7c7d9aa2ccf80f8e376edfeabfc9b96c73d"
        hash = "9e7701450dbcbd35083e34df935bd77a95735c4b441e0fc8eacd543a621f2fa5"
        hash = "51205c100702b21cce600692d69f3b108f49228e53f36678dd8b[PII_REDACTED]6b"
        hash = "c9b48e8b0e7c6fa[PII_REDACTED]9bc0529e454d84b29daa07bd4323aca9a33f607"
        hash = "ba5c06703bd3c093afa89e45d86aaf6c151fbaef44ebf3b65c97f3b376a88c72"
        hash = "7281afc138e8e898aee16d415cd02a29dc5dedda5b11c23934aac0ebd208373b"
        hash = "10a091b2468a8286f7b1a580d8923aef48856b43014e849035f05c4dbdc0a413"
        hash = "56c04e76427bd982be83799d0a435732193d7bf5a70cdeba5eb63eaf0d4ebb77"
        hash = "0aa8b7eddc4792a82f247702442c04e50173bd7712a4b[PII_REDACTED]80942853b"
        hash = "627f043ad875c[PII_REDACTED]3363b7f856dd618d169821b18df7bc9cdf6269d8"
        hash = "e1df460fd99c4f901859f3a8ec23b041ba9f4b79897dec349a96d6a27fb3e335"
        hash = "f10ecbd8031ce85b782c59682ff32301a65e[PII_REDACTED]688771f1057fb063d1"
        hash = "1bc7b8932b5b077b359c79e7ca664938b7a487a4e7e6b99d6647
YARA Detection Rule: SUSP_Imphash_Mar23_3
Repository: Neo23x0/signature-base
Detects: Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits
Author: Arnim Rupp (https://github.com/ruppde)
Reference: Internal Research

Detection condition:
uint16(0) == 0x5A4D and (
            // no size limit as some samples are 20MB+ and the hash is calculated only on the header
            //pe.imphash() == "87bed5a7cba00c7e1f4015f1bdae2183" or // UPX imphash
            //pe.imphash() == "09d0478591d4f788cb3e5ea416c25237" or // PECompact imphash
 

Full rule:
rule SUSP_Imphash_Mar23_3 {
    meta:
        description = "Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits"
        license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
        author = "Arnim Rupp (https://github.com/ruppde)"
        date = "2023-03-23"
        modified = "2026-03-09"
        reference = "Internal Research"
        score = 45
        hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
        hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
        hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
        hash = "716ba6ea691d6a391daedf09ae1262f1dc1591df85292bff52ad[PII_REDACTED]2d"
        hash = "800d160736335aafab10503f7263f9af37a15db3e88e41082d50f68d0ad2dabd"
        hash = "[PII_REDACTED]84b3c374137befec9330cd56908e0e32c70312afa16f8220627a52"
        hash = "21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070"
        hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
        hash = "773edc71d[PII_REDACTED]6dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
        hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
        id = "eb91e700-6478-5085-a393-a7b342c0eb4f"
    condition:
        uint16(0) == 0x5A4D and (
            // no size limit as some samples are 20MB+ and the hash is calculated only on the header
            //pe.imphash() == "87bed5a7cba00c7e1f4015f1bdae2183" or // UPX imphash
            //pe.imphash() == "09d0478591d4f788cb3e5ea416c25237" or // PECompact imphash
            // pe.imphash() == "6ed4f5f04d62b18d96b26d6db7c18840" or // too many fp by now
            // pe.imphash() == "0b5552dccd9d0a834cea55c0c8fc05be"
            // pe.imphash() == "fc6683d30d9f25244a50fd5357825e79" or
            pe.imphash() == "afcdf79be1557326c854b6e20cb900a7" or
            pe.imphash() == "2c5f2513605e48f2d8ea5
YARA Detection Rule: HKTL_RedMimicry_Agent
Repository: Neo23x0/signature-base
Detects: matches the RedMimicry agent executable and payload
Author: mirar@chaosmail.org
Reference: https://redmimicry.com

Pattern signatures:
$reg0 = "HKEY_CURRENT_USER\\" ascii
        $reg1 = "HKEY_LOCAL_MACHINE\\" ascii
        $reg2 = "HKEY_CURRENT_CONFIG\\" ascii
        $reg3 = "HKEY_CLASSES_ROOT\\" ascii
        $cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
        $lua0 = "client_recv" ascii fullword
        $lua1 = "client_send" ascii fullword
        $lua2 = "$LuaVersion: " ascii
        $sym0 = "VirtualAllocEx" wide fullword
        $sym1 = "kernel32.dll" wide fullword

Detection condition:
all of them

Full rule:
rule HKTL_RedMimicry_Agent {
    meta:
        date        = "2020-06-22"
        modified = "2023-01-06"
        author      = "mirar@chaosmail.org"
        sharing     = "tlp:white"
        description = "matches the RedMimicry agent executable and payload"
        reference   = "https://redmimicry.com"

        id = "a4d4ec77-4a0d-5afd-9181-85433e8b5fda"
    strings:
        $reg0 = "HKEY_CURRENT_USER\\" ascii
        $reg1 = "HKEY_LOCAL_MACHINE\\" ascii
        $reg2 = "HKEY_CURRENT_CONFIG\\" ascii
        $reg3 = "HKEY_CLASSES_ROOT\\" ascii
        $cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
        $lua0 = "client_recv" ascii fullword
        $lua1 = "client_send" ascii fullword
        $lua2 = "$LuaVersion: " ascii
        $sym0 = "VirtualAllocEx" wide fullword
        $sym1 = "kernel32.dll" wide fullword

    condition:
        all of them
}
YARA Detection Rule: APT_FIN7_Strings_Aug18_1
Repository: Neo23x0/signature-base
Detects: Detects strings from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "&&call %a01%%a02% /e:jscript" ascii
      $s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
      $s3 = " w=wsc@ript /b " ascii
      $s4 = "@echo %w:@=%|cmd" ascii
      $s5 = " & wscript //b /e:jscript"

Detection condition:
1 of them

Full rule:
rule APT_FIN7_Strings_Aug18_1 {
   meta:
      description = "Detects strings from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
      id = "9b940986-e41b-5fbf-9e42-cb0fd550e541"
   strings:
      $s1 = "&&call %a01%%a02% /e:jscript" ascii
      $s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
      $s3 = " w=wsc@ript /b " ascii
      $s4 = "@echo %w:@=%|cmd" ascii
      $s5 = " & wscript //b /e:jscript"
   condition:
      1 of them
}
YARA Detection Rule: APT_FIN7_Sample_Aug18_2
Repository: Neo23x0/signature-base
Detects: Detects FIN7 malware sample
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
      $x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
      $x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
      $x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
      $x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 2000KB and 1 of them

Full rule:
rule APT_FIN7_Sample_Aug18_2 {
   meta:
      description = "Detects FIN7 malware sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "1513c7630c981e4b1d0d5a[PII_REDACTED]1df4f87bb0fac2d2b8ff6afae187f01d"
      id = "885eebfe-2587-5744-ba0c-c74ced946050"
   strings:
      $x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
      $x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
      $x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
      $x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
      $x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 2000KB and 1 of them
}
YARA Detection Rule: APT_FIN7_MalDoc_Aug18_1
Repository: Neo23x0/signature-base
Detects: Detects malicious Doc from FIN7 campaign
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii

Detection condition:
filesize < 800KB and 1 of them

Full rule:
rule APT_FIN7_MalDoc_Aug18_1 {
   meta:
      description = "Detects malicious Doc from FIN7 campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
      id = "f3c430e0-be9a-5c3f-9378-a20ef0492afb"
   strings:
      $s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii
   condition:
      filesize < 800KB and 1 of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_1
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "Manche Enterprises Limited0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and 1 of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_1 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
      id = "46c82d27-5683-5acd-9a3c-d69613091ecc"
   strings:
      $s1 = "Manche Enterprises Limited0" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_2
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "constructor or from DllMain." fullword ascii
      $s2 = "Network Software Ltd0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and all of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_2 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
      id = "4522cd85-ba85-5afd-8600-1ebabfaf6d02"
   strings:
      $s1 = "constructor or from DllMain." fullword ascii
      $s2 = "Network Software Ltd0" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and all of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_3
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and 1 of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_3 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "995b[PII_REDACTED]8a376db67f906a126257d314efc21b03768941f2f819cf61a6"
      id = "0b0ce882-1c18-5741-bb71-0cef010dc778"
   strings:
      $s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 50KB and 1 of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_4
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "c:\\file.dat" fullword wide
      $s2 = "constructor or from DllMain." fullword ascii
      $s3 = "lineGetCallIDs" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and all of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_4 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
      id = "bead79bb-28c2-59ed-985b-e44b41e7f66a"
   strings:
      $s1 = "c:\\file.dat" fullword wide
      $s2 = "constructor or from DllMain." fullword ascii
      $s3 = "lineGetCallIDs" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and all of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_5
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
      $s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and all of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_5 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
      id = "6c810662-9ceb-5c3b-8f83-5a4aa2a5d461"
   strings:
      $s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
      $s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and all of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_6
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "coreServiceShell.exe" fullword ascii
      $s2 = "PtSessionAgent.exe" fullword ascii
      $s3 = "TiniMetI.exe" fullword ascii
      $s4 = "PwmSvc.exe" fullword ascii
      $s5 = "uiSeAgnt.exe" fullword ascii
      $s7 = "LHOST:" fullword ascii
      $s8 = "TRANSPORT:" fullword ascii
      $s9 = "LPORT:" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 20KB and (
         pe.exports("TiniStart") or
         4 of them
      )

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_6 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b[PII_REDACTED]424a"
      id = "2b2e6b74-5d71-5656-8faf-37c94607d93e"
   strings:
      $s1 = "coreServiceShell.exe" fullword ascii
      $s2 = "PtSessionAgent.exe" fullword ascii
      $s3 = "TiniMetI.exe" fullword ascii
      $s4 = "PwmSvc.exe" fullword ascii
      $s5 = "uiSeAgnt.exe" fullword ascii
      $s7 = "LHOST:" fullword ascii
      $s8 = "TRANSPORT:" fullword ascii
      $s9 = "LPORT:" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 20KB and (
         pe.exports("TiniStart") or
         4 of them
      )
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_7
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "libpng version" fullword ascii
      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_7 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
      id = "96943654-a6e8-59c0-ab6c-1ab3906a5d05"
   strings:
      $s1 = "libpng version" fullword ascii
      $s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and all of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_8
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
$s1 = "GetL3st3rr" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and all of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_8 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
      id = "1eb9810e-2b50-5a93-925e-073bb17e1e6c"
   strings:
      $s1 = "GetL3st3rr" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and all of them
}
YARA Detection Rule: APT_FIN7_EXE_Sample_Aug18_10
Repository: Neo23x0/signature-base
Detects: Detects sample from FIN7 report in August 2018
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html

Pattern signatures:
/* "Copyright 1 - 19" */
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them

Full rule:
rule APT_FIN7_EXE_Sample_Aug18_10 {
   meta:
      description = "Detects sample from FIN7 report in August 2018"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
      date = "2018-08-01"
      hash1 = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
      id = "2c6f557e-31d3-5377-a3fa-4f1507f28386"
   strings:
      /* "Copyright 1 - 19" */
      $c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them
}