deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_Toolset_Apr17_Dsz_Implant
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_Dsz_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
      hash2 = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
   strings:
      $s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_GenKey
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_GenKey {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
   strings:
      $x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_wmi_Implant
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 50KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_wmi_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
   strings:
      $x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 50KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_clocksvc
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "~debl00l.tmp" fullword ascii
      $x2 = "\\\\.\\mailslot\\c54321" fullword ascii
      $x3 = "\\\\.\\mailslot\\c12345" fullword ascii
      $x4 = "nowMutex" fullword ascii

      $s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
      $s2 = "[PII_REDACTED]17C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF[PII_REDACTED]4681FB94D17ED04217145B98" ascii
      $s3 = "00000000E2C9ADBD8F470C7320D[PII_REDACTED]3757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 2 of ($s*) ) )

Full rule:
rule EquationGroup_Toolset_Apr17_clocksvc {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
   strings:
      $x1 = "~debl00l.tmp" fullword ascii
      $x2 = "\\\\.\\mailslot\\c54321" fullword ascii
      $x3 = "\\\\.\\mailslot\\c12345" fullword ascii
      $x4 = "nowMutex" fullword ascii

      $s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
      $s2 = "[PII_REDACTED]17C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF[PII_REDACTED]4681FB94D17ED04217145B98" ascii
      $s3 = "00000000E2C9ADBD8F470C7320D[PII_REDACTED]3757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($x*) or 2 of ($s*) ) )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_xxxRIDEAREA
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
      $x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
      $x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
      $x4 = "Load and execute implant within the existing thread" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_xxxRIDEAREA {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
   strings:
      $x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
      $x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
      $x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
      $x4 = "Load and execute implant within the existing thread" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_yak_min_install
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "driver start" fullword ascii
      $s2 = "DeviceIoControl Error: %d" fullword ascii
      $s3 = "Phlook" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_yak_min_install {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "f67214083d60f90ffd16b89a0ce921c98185b[PII_REDACTED]691b720514b1fe99e"
   strings:
      $s1 = "driver start" fullword ascii
      $s2 = "DeviceIoControl Error: %d" fullword ascii
      $s3 = "Phlook" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SetOurAddr
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
      $s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SetOurAddr {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
   strings:
      $s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
      $s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\system32\\win32k.sys" fullword wide
      $s2 = "hKeAddSystemServiceTable" fullword ascii
      $s3 = "hPsDereferencePrimaryToken" fullword ascii
      $s4 = "CcnFormSyncExFBC" fullword wide
      $s5 = "hPsDereferencePrimaryToken" fullword ascii

      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and ( 4 of ($s*) or all of ($op*) ) )

Full rule:
rule EquationGroup_Toolset_Apr17_GetAdmin_LSADUMP_ModifyPrivilege_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
      hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
   strings:
      $s1 = "\\system32\\win32k.sys" fullword wide
      $s2 = "hKeAddSystemServiceTable" fullword ascii
      $s3 = "hPsDereferencePrimaryToken" fullword ascii
      $s4 = "CcnFormSyncExFBC" fullword wide
      $s5 = "hPsDereferencePrimaryToken" fullword ascii

      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and ( 4 of ($s*) or all of ($op*) ) )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SendPKTrigger
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SendPKTrigger {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "2f9c7a[PII_REDACTED]73a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
   strings:
      $x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DmGz_Target_2
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\\\.\\%ls" fullword ascii

      $op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
      $op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
      $op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DmGz_Target_2 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e[PII_REDACTED]95abe42aa904"
   strings:
      $s1 = "\\\\.\\%ls" fullword ascii

      $op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
      $op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
      $op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
      $s2 = "\\DosDevices\\%ws" fullword wide
      $s3 = "\\Device\\%ws_%ws" fullword wide
      $s4 = "sys\\mstcp32.dbg" fullword ascii
      $s5 = "%ws%03d%ws%wZ" fullword wide
      $s6 = "TCP/IP driver" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 4 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_mstcp32_DXGHLP16_tdip {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
      hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
      hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
   strings:
      $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
      $s2 = "\\DosDevices\\%ws" fullword wide
      $s3 = "\\Device\\%ws_%ws" fullword wide
      $s4 = "sys\\mstcp32.dbg" fullword ascii
      $s5 = "%ws%03d%ws%wZ" fullword wide
      $s6 = "TCP/IP driver" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 4 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_regprobe
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
      $x2 = "key does not exist or pinging w2k system" fullword ascii
      $x3 = "RpcProxy=255.255.255.255:65536" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_regprobe {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
   strings:
      $x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
      $x2 = "key does not exist or pinging w2k system" fullword ascii
      $x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = ".dllfD" fullword ascii
      $s2 = "Khsppxu" fullword ascii
      $s3 = "D$8.exe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DoubleFeatureDll_dll_2 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
      hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
      hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
   strings:
      $s1 = ".dllfD" fullword ascii
      $s2 = "Khsppxu" fullword ascii
      $s3 = "D$8.exe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_GangsterThief_Implant
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "\\\\.\\%s:" fullword wide
      $s4 = "raw_open CreateFile error" fullword ascii
      $s5 = "-PATHDELETED-" fullword ascii
      $s6 = "(deleted)" fullword wide
      $s8 = "NULLFILENAME" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_GangsterThief_Implant {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
   strings:
      $s1 = "\\\\.\\%s:" fullword wide
      $s4 = "raw_open CreateFile error" fullword ascii
      $s5 = "-PATHDELETED-" fullword ascii
      $s6 = "(deleted)" fullword wide
      $s8 = "NULLFILENAME" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_SetCallbackPorts
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
      $s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_SetCallbackPorts {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
   strings:
      $s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
      $s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s2 = "0M1U1Z1p1" fullword ascii /* base64 encoded string '3U5gZu' */
      $s14 = "SPRQWV" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule EquationGroup_Toolset_Apr17_DiBa_Target_BH_2000 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "0654b4b[PII_REDACTED]390cd091029f08245d690dd90d1120e8feec336d1f9e788"
   strings:
      $s2 = "0M1U1Z1p1" fullword ascii /* base64 encoded string '3U5gZu' */
      $s14 = "SPRQWV" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_rc5
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
      $s2 = "where session_key and ciphertext are strings of hex" fullword ascii
      $s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
      $s4 = "Bad mode, should be 'd' or 'e'" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )

Full rule:
rule EquationGroup_Toolset_Apr17_rc5 {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
   strings:
      $s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
      $s2 = "where session_key and ciphertext are strings of hex" fullword ascii
      $s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
      $s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
}
YARA Detection Rule: EquationGroup_Toolset_Apr17_PC_Level_Generic
Repository: Yara-Rules/rules
Detects: Detects EquationGroup Tool - April Leak
Author: Florian Roth
Reference: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

Pattern signatures:
$s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
      $s2 = "\\\\.\\%hs" fullword ascii
      $s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
      $s4 = "Corporation. All rights reserved." fullword wide
      $s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }

      $op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
      $op2 = { c6 44 24 56 64 88 5c 24 57 }
      $op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($s*) or all of ($op*) )

Full rule:
rule EquationGroup_Toolset_Apr17_PC_Level_Generic {
   meta:
      description = "Detects EquationGroup Tool - April Leak"
      author = "Florian Roth"
      reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
      date = "2017-04-15"
      hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
      hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
      hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
      hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
      hash5 = "591abd3d7ee214df25ac25682b673f02219da108d[PII_REDACTED]b5167a36a7645"
      hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
      hash7 = "7be4c05cecb920f1010fc[PII_REDACTED]ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
      hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
      hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
      hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
   strings:
      $s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
      $s2 = "\\\\.\\%hs" fullword ascii
      $s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
      $s4 = "Corporation. All rights reserved." fullword wide
      $s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }

      $op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
      $op2 = { c6 44 24 56 64 88 5c 24 57 }
      $op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and ( 2 of ($s*) or all of ($op*) )
}