deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_NGO_wuaclt
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
    $c = "/news/show.asp?id%d=%d"
    
    $d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
    $e = "0l23kj@nboxu"
    
    $f = "%%s.asp?id=%%d&Sid=%%d"
    $g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
    $h = "Cookies: UseID=KGIOODAOOK%%s"

Detection condition:
($a and $b and $c) or ($d and $e) or ($f and $g and $h)

Full rule:
rule APT_NGO_wuaclt
{
   
   meta:
    author = "AlienVault Labs"
  
  strings:
    $a = "%%APPDATA%%\\Microsoft\\wuauclt\\wuauclt.dat"
    $b = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
    $c = "/news/show.asp?id%d=%d"
    
    $d = "%%APPDATA%%\\Microsoft\\wuauclt\\"
    $e = "0l23kj@nboxu"
    
    $f = "%%s.asp?id=%%d&Sid=%%d"
    $g = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SP Q%%d)"
    $h = "Cookies: UseID=KGIOODAOOK%%s"

  condition:
    ($a and $b and $c) or ($d and $e) or ($f and $g and $h)
}
YARA Detection Rule: APT_NGO_wuaclt_PDF
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$pdf  = "%PDF" nocase
        $comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}

Detection condition:
$pdf at 0 and $comment in (0..200)

Full rule:
rule APT_NGO_wuaclt_PDF
{
        meta:
            author = "AlienVault Labs"

    strings:
        $pdf  = "%PDF" nocase
        $comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
    
    condition:
        $pdf at 0 and $comment in (0..200)
}
YARA Detection Rule: BlackRev
Repository: Yara-Rules/rules
Detects: Black Revolution DDoS Malware. http://www.arbornetworks.com/asert/2013/05/the-revolution-will-be-written-in-delphi/
Author: Dennis Schwarz

Pattern signatures:
$base1 = "http"
      $base2 = "simple"
      $base3 = "loginpost"
      $base4 = "datapost"

      $opt1 = "blackrev"
      $opt2 = "stop"
      $opt3 = "die"
      $opt4 = "sleep"
      $opt5 = "syn"
      $opt6 = "udp"
      $opt7 = "udpdata"
      $opt8 = "icmp"
      $opt9 = "antiddos"
      $opt10 = "range"
      $opt11 = "fastddos"
      $opt12 = "slowhttp"
      $opt13 = "allhttp"
      $opt14 = "tcpdata"
      $opt15 = "dataget"

Detection condition:
all of ($base*) and 5 of ($opt*)

Full rule:
rule BlackRev
{
   meta:
      author = "Dennis Schwarz"
      date = "2013-05-21"
      description = "Black Revolution DDoS Malware. http://www.arbornetworks.com/asert/2013/05/the-revolution-will-be-written-in-delphi/"
      origin = "https://github.com/arbor/yara/blob/master/blackrev.yara"

   strings: 
      $base1 = "http"
      $base2 = "simple"
      $base3 = "loginpost"
      $base4 = "datapost"

      $opt1 = "blackrev"
      $opt2 = "stop"
      $opt3 = "die"
      $opt4 = "sleep"
      $opt5 = "syn"
      $opt6 = "udp"
      $opt7 = "udpdata"
      $opt8 = "icmp"
      $opt9 = "antiddos"
      $opt10 = "range"
      $opt11 = "fastddos"
      $opt12 = "slowhttp"
      $opt13 = "allhttp"
      $opt14 = "tcpdata"
      $opt15 = "dataget"

   condition:
      all of ($base*) and 5 of ($opt*)
}
YARA Detection Rule: agenttesla_smtp_variant
Repository: Yara-Rules/rules
Author: J from THL <j@techhelplist.com> with thx to @Fumik0_ !!1!

Pattern signatures:
$a = "type={"
		$b = "hwid={"
		$c = "time={"
		$d = "pcname={"
		$e = "logdata={"
		$f = "screen={"
		$g = "ipadd={"
		$h = "webcam_link={"
		$i = "screen_link={"
		$j = "site_username={"
		$k = "[passwords]"

Detection condition:
6 of them

Full rule:
rule agenttesla_smtp_variant {

    meta:
        author = "J from THL <j@techhelplist.com> with thx to @Fumik0_ !!1!"
        date = "2018/2"
	reference1 = "https://www.virustotal.com/#/file/1198865bc928a7a4f7977aaa36af5a2b9d5a949328b89dd87c541758516ad417/detection"
	reference2 = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_negasteal.a"
	reference3 = "Agent Tesla == negasteal -- @coldshell"
	version = 1
        maltype = "Stealer"
        filetype = "memory"

    strings:
		$a = "type={"
		$b = "hwid={"
		$c = "time={"
		$d = "pcname={"
		$e = "logdata={"
		$f = "screen={"
		$g = "ipadd={"
		$h = "webcam_link={"
		$i = "screen_link={"
		$j = "site_username={"
		$k = "[passwords]"

    condition:
        6 of them
}
YARA Detection Rule: Sakurel_backdoor
Repository: Yara-Rules/rules
Detects: malware creates a process in the temp directory and performs the sysprep UAC bypass method.
Reference: http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan:Win32/Sakurel.A#tab=2

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="Windows\\System32\\sysprep\\sysprep.exe" nocase

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" nocase

Detection condition:
all of them

Full rule:
rule Sakurel_backdoor
{
	meta:
		maltype = "Sakurel backdoor"
    ref = "https://github.com/reed1713"
		reference = "http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Trojan:Win32/Sakurel.A#tab=2"
		description = "malware creates a process in the temp directory and performs the sysprep UAC bypass method."
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="Windows\\System32\\sysprep\\sysprep.exe" nocase

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" nocase
	condition:
		all of them
}
YARA Detection Rule: shrug2_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect Shrug2 ransomware
Author: Marc Rivero | @seifreed
Reference: https://blogs.quickheal.com/new-net-ransomware-shrug2/

Pattern signatures:
$s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
      $s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
      $s4 = "Shortcut for @ShrugDecryptor@.exe" fullword wide
      $s5 = "C:\\Users\\" fullword wide
      $s6 = "http://clients3.google.com/generate_204" fullword wide
      $s7 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB ) and all of them

Full rule:
rule shrug2_ransomware {

   meta:

      description = "Rule to detect Shrug2 ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
       
   strings:

      $s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
      $s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
      $s4 = "Shortcut for @ShrugDecryptor@.exe" fullword wide
      $s5 = "C:\\Users\\" fullword wide
      $s6 = "http://clients3.google.com/generate_204" fullword wide
      $s7 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide
   
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB ) and all of them 
}
YARA Detection Rule: BlackWorm
Repository: Yara-Rules/rules
Detects: Identify BlackWorm
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$str1 = "m_ComputerObjectProvider"
        $str2 = "MyWebServices"
        $str3 = "get_ExecutablePath"
        $str4 = "get_WebServices"
        $str5 = "My.WebServices"
        $str6 = "My.User"
        $str7 = "m_UserObjectProvider"
        $str8 = "DelegateCallback"
        $str9 = "TargetMethod"
        $str10 = "000004b0" wide
        $str11 = "Microsoft Corporation" wide

Detection condition:
all of them

Full rule:
rule BlackWorm
{

    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2015-05-20"
        description = "Identify BlackWorm"

    strings:
        $str1 = "m_ComputerObjectProvider"
        $str2 = "MyWebServices"
        $str3 = "get_ExecutablePath"
        $str4 = "get_WebServices"
        $str5 = "My.WebServices"
        $str6 = "My.User"
        $str7 = "m_UserObjectProvider"
        $str8 = "DelegateCallback"
        $str9 = "TargetMethod"
        $str10 = "000004b0" wide
        $str11 = "Microsoft Corporation" wide

    condition:
        all of them
}
YARA Detection Rule: APT_Uppercut
Repository: Yara-Rules/rules
Detects: Detects APT10 MenuPass Uppercut
Author: Colin Cowie
Reference: https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html

Pattern signatures:
$ip1 = "51.106.53.147"
     $ip2 = "153.92.210.208"
     $ip3 = "eservake.jetos.com"
     $c1 = "0x97A168D9697D40DD" wide
     $c2 = "0x7CF812296CCC68D5" wide
     $c3 = "0x652CB1CEFF1C0A00" wide
     $c4 = "0x27595F1F74B55278" wide
     $c5 = "0xD290626C85FB1CE3" wide
     $c6 = "0x409C7A89CFF0A727" wide

Detection condition:
any of them or
     hash.md5(0, filesize) == "aa3f303c3319b14b4829fe2faa5999c1" or
     hash.md5(0, filesize) == "126067d634d94c45084cbe1d9873d895" or
     hash.md5(0, filesize) == "fce54b4886cac5c61eda1e7605483ca3"

Full rule:
rule APT_Uppercut {
  meta:
     description = "Detects APT10 MenuPass Uppercut"
     author = "Colin Cowie"
     reference = "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
     date = "2018-09-13"
  strings:
     $ip1 = "51.106.53.147"
     $ip2 = "153.92.210.208"
     $ip3 = "eservake.jetos.com"
     $c1 = "0x97A168D9697D40DD" wide
     $c2 = "0x7CF812296CCC68D5" wide
     $c3 = "0x652CB1CEFF1C0A00" wide
     $c4 = "0x27595F1F74B55278" wide
     $c5 = "0xD290626C85FB1CE3" wide
     $c6 = "0x409C7A89CFF0A727" wide
  condition:
     any of them or
     hash.md5(0, filesize) == "aa3f303c3319b14b4829fe2faa5999c1" or
     hash.md5(0, filesize) == "126067d634d94c45084cbe1d9873d895" or
     hash.md5(0, filesize) == "fce54b4886cac5c61eda1e7605483ca3"
}
YARA Detection Rule: CloudDuke_Malware
Repository: Yara-Rules/rules
Detects: Detects CloudDuke Malware
Author: Florian Roth
Reference: https://www.f-secure.com/weblog/archives/00002822.html

Pattern signatures:
$s1 = "ProcDataWrap" fullword ascii
        $s2 = "imagehlp.dll" fullword ascii
        $s3 = "dnlibsh" fullword ascii
        $s4 = "%ws_out%ws" fullword wide
        $s5 = "Akernel32.dll" fullword wide
        $op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
        $op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
        $op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 720KB and 4 of ($s*) and 1 of ($op*)

Full rule:
rule CloudDuke_Malware
{

    meta:
        description = "Detects CloudDuke Malware"
        author = "Florian Roth"
        reference = "https://www.f-secure.com/weblog/archives/00002822.html"
        date = "2015-07-22"
        score = 60
        hash1 = "97d8725e39d263ed21856477ed[PII_REDACTED]4b5c0d0b9ae86ebb1cdd4cdc18b7"
        hash2 = "88a40d5b679bccf[PII_REDACTED]b3d18b09e68b609ffaf414574a6eca6536e8b8f"
        hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
        hash4 = "97d8725e39d263ed21856477ed[PII_REDACTED]4b5c0d0b9ae86ebb1cdd4cdc18b7"
        hash5 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
        hash6 = "88a40d5b679bccf[PII_REDACTED]b3d18b09e68b609ffaf414574a6eca6536e8b8f"
        hash7 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
        hash8 = "97d8725e39d263ed21856477ed[PII_REDACTED]4b5c0d0b9ae86ebb1cdd4cdc18b7"
        hash9 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
        hash10 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
        hash11 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f[PII_REDACTED]40004"
        hash12 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
        hash13 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
        hash14 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f[PII_REDACTED]40004"
        hash15 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"

    strings:
        $s1 = "ProcDataWrap" fullword ascii
        $s2 = "imagehlp.dll" fullword ascii
        $s3 = "dnlibsh" fullword ascii
        $s4 = "%ws_out%ws" fullword wide
        $s5 = "Akernel32.dll" fullword wide
        $op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
        $op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
        $op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */

    condition:
        uint16(0) == 0x5a
YARA Detection Rule: SFXRAR_Acrotray
Repository: Yara-Rules/rules
Detects: Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe
Author: Florian Roth
Reference: https://www.f-secure.com/weblog/archives/00002822.html

Pattern signatures:
$s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
        $s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
        $s3 = "acrotray.exe" fullword ascii
        $s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2449KB and all of them

Full rule:
rule SFXRAR_Acrotray
{

    meta:
        description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
        author = "Florian Roth"
        reference = "https://www.f-secure.com/weblog/archives/00002822.html"
        date = "2015-07-22"
        super_rule = 1
        score = 70
        hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
        hash2 = "5d695ff[PII_REDACTED]5da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
        hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"

    strings:
        $s1 = "winrarsfxmappingfile.tmp" fullword wide /* PEStudio Blacklist: strings */
        $s2 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */
        $s3 = "acrotray.exe" fullword ascii
        $s4 = "CryptUnprotectMemory failed" fullword wide /* PEStudio Blacklist: strings */

    condition:
        uint16(0) == 0x5a4d and filesize < 2449KB and all of them
}
YARA Detection Rule: legion_777
Repository: Yara-Rules/rules
Detects: Detects an UPX-unpacked .777 ransomware binary.
Author: Daxda (https://github.com/Daxda)

Pattern signatures:
$s1 = "http://tuginsaat.com/wp-content/themes/twentythirteen/stats.php"
        $s2 = "read_this_file.txt" wide // Ransom note filename.
        $s3 = "seven_legion@india.com" // Part of the format string used to rename files.
        $s4 = {46 4f 52 20 44 45 43 52 59 50 54 20 46 49 4c 45 53 0d 0a 53 45 4e 44 20 4f
               4e 45 20 46 49 4c 45 20 49 4e 20 45 2d 4d 41 49 4c 0d 0a 73 65 76 65 6e 5f
               6c 65 67 69 6f 6e 40 69 6e 64 69 61 2e 63 6f 6d } // Ransom note content.
        $s5 = "%s._%02i-%02i-%02i-%02i-%02i-%02i_$%s$.777" // Renaming format string.

Detection condition:
4 of ($s*)

Full rule:
rule legion_777
{
    meta:
        author = "Daxda (https://github.com/Daxda)"
        date = "2016/6/6"
        description = "Detects an UPX-unpacked .777 ransomware binary."
        ref = "https://github.com/Daxda/malware-analysis/tree/master/malware_samples/legion"
        category = "Ransomware"
        sample = "SHA256: 14d22359e76cf63bf17268cad24bac03663c8b2b8028b869f5cec10fe3f75548"

    strings:
        $s1 = "http://tuginsaat.com/wp-content/themes/twentythirteen/stats.php"
        $s2 = "read_this_file.txt" wide // Ransom note filename.
        $s3 = "seven_legion@india.com" // Part of the format string used to rename files.
        $s4 = {46 4f 52 20 44 45 43 52 59 50 54 20 46 49 4c 45 53 0d 0a 53 45 4e 44 20 4f
               4e 45 20 46 49 4c 45 20 49 4e 20 45 2d 4d 41 49 4c 0d 0a 73 65 76 65 6e 5f
               6c 65 67 69 6f 6e 40 69 6e 64 69 61 2e 63 6f 6d } // Ransom note content.
        $s5 = "%s._%02i-%02i-%02i-%02i-%02i-%02i_$%s$.777" // Renaming format string.

    condition:
        4 of ($s*)
}
YARA Detection Rule: ShadowTech_2
Repository: Yara-Rules/rules
Detects: ShadowTech RAT
Author: botherder https://github.com/botherder

Pattern signatures:
$string1 = /\#(S)trings/
        $string2 = /\#(G)UID/
        $string3 = /\#(B)lob/
        $string4 = /(S)hadowTech Rat\.exe/
        $string5 = /(S)hadowTech_Rat/

Detection condition:
all of them

Full rule:
rule ShadowTech_2
{
    meta:
        description = "ShadowTech RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /\#(S)trings/
        $string2 = /\#(G)UID/
        $string3 = /\#(B)lob/
        $string4 = /(S)hadowTech Rat\.exe/
        $string5 = /(S)hadowTech_Rat/

    condition:
        all of them
}
YARA Detection Rule: ShadowTech
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "ShadowTech" nocase
		$b = "DownloadContainer"
		$c = "MySettings"
		$d = "System.Configuration"
		$newline = "#-@NewLine@-#" wide
		$split = "pSIL" wide
		$key = "ESIL" wide

Detection condition:
4 of them

Full rule:
rule ShadowTech
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/ShadowTech"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "ShadowTech" nocase
		$b = "DownloadContainer"
		$c = "MySettings"
		$d = "System.Configuration"
		$newline = "#-@NewLine@-#" wide
		$split = "pSIL" wide
		$key = "ESIL" wide

	condition:
		4 of them
}
YARA Detection Rule: Sofacy_Jun16_Sample1
Repository: Yara-Rules/rules
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth
Reference: http://goo.gl/mzAa97

Pattern signatures:
$s1 = "clconfg.dll" fullword ascii
        $s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )

Full rule:
rule Sofacy_Jun16_Sample1  
{

    meta:
        description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
        author = "Florian Roth"
        reference = "http://goo.gl/mzAa97"
        date = "2016-06-14"
        score = 85
        hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"

    strings:
        $s1 = "clconfg.dll" fullword ascii
        $s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide

    condition:
        ( uint16(0) == 0x5a4d and filesize < 200KB and ( 1 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: Sofacy_Jun16_Sample2
Repository: Yara-Rules/rules
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth
Reference: http://goo.gl/mzAa97

Pattern signatures:
$x1 = "DGMNOEP" fullword ascii
        $x2 = "/%s%s%s/?%s=" fullword ascii
        $s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
        $s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
        $s3 = "svchost.dll" fullword wide
        $s4 = "clconfig.dll" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )

Full rule:
rule Sofacy_Jun16_Sample2  
{

    meta:
        description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
        author = "Florian Roth"
        reference = "http://goo.gl/mzAa97"
        date = "2016-06-14"
        score = 85
        hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
        hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff[PII_REDACTED]afc12a834261"
        hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
 
    strings:
        $x1 = "DGMNOEP" fullword ascii
        $x2 = "/%s%s%s/?%s=" fullword ascii
        $s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
        $s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
        $s3 = "svchost.dll" fullword wide
        $s4 = "clconfig.dll" fullword wide
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 100KB and ( all of ($x*) ) ) or ( 3 of them )
}
YARA Detection Rule: Sofacy_Jun16_Sample3
Repository: Yara-Rules/rules
Detects: Detects Sofacy Malware mentioned in PaloAltoNetworks APT report
Author: Florian Roth
Reference: http://goo.gl/mzAa97

Pattern signatures:
$s1 = "ASLIiasiuqpssuqkl713h" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and $s1

Full rule:
rule Sofacy_Jun16_Sample3 
{

    meta:
        description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
        author = "Florian Roth"
        reference = "http://goo.gl/mzAa97"
        date = "2016-06-14"
        score = 85
        hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
   
    strings:
        $s1 = "ASLIiasiuqpssuqkl713h" fullword wide
   
    condition:
        uint16(0) == 0x5a4d and filesize < 200KB and $s1
}
YARA Detection Rule: Intel_Virtualization_Wizard_exe
Repository: Yara-Rules/rules
Detects: Dynamic DLL abuse executable
Author: cabrel@zerklabs.com

Pattern signatures:
$a = {4C 6F 61 64 53 54 52 49 4E 47}
    $b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B}
    $c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73}
    $d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55}
    $e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C}

Detection condition:
all of them

Full rule:
rule Intel_Virtualization_Wizard_exe {
  meta:
    author = "cabrel@zerklabs.com"
    description = "Dynamic DLL abuse executable"

    file_1_seen = "2013-05-21"
    file_1_sha256 = "7787757ae851f4a162f46f794be1532ab78e[PII_REDACTED]bdab83b3106f28c708"

  strings:
    $a = {4C 6F 61 64 53 54 52 49 4E 47}
    $b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B}
    $c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73}
    $d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55}
    $e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C}
  condition:
    all of them
}
YARA Detection Rule: Intel_Virtualization_Wizard_dll
Repository: Yara-Rules/rules
Detects: Dynamic DLL (Malicious)
Author: cabrel@zerklabs.com

Pattern signatures:
$a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C}
    $b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62}

Detection condition:
($a and $b) and Intel_Virtualization_Wizard_exe

Full rule:
rule Intel_Virtualization_Wizard_dll {
  meta:
    author = "cabrel@zerklabs.com"
    description = "Dynamic DLL (Malicious)"

    file_1_seen = "2013-05-21"
    file_1_sha256 = "485ae043b6a5758789f1d33766a26d8b45b9fde09cde0512aa32d4bd1ee04f28"

  strings:
    $a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C}
    $b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62}

  condition:
    ($a and $b) and Intel_Virtualization_Wizard_exe
}
YARA Detection Rule: cerber3
Repository: Yara-Rules/rules
Detects: Cerber3 
Author: pekeinfo

Pattern signatures:
$a = {00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 03 6A  01 8B 85}
  $b = {68 3B DB 00 00 ?? ?? ?? ?? 00 ?? FF 15}

Detection condition:
1 of them

Full rule:
rule cerber3{
meta:
  author = "pekeinfo"
  date = "2016-09-09"
  description = "Cerber3 "
strings:
  $a = {00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 03 6A  01 8B 85}
  $b = {68 3B DB 00 00 ?? ?? ?? ?? 00 ?? FF 15}
  
condition:
  1 of them 
}
YARA Detection Rule: cerber4
Repository: Yara-Rules/rules
Detects: Cerber4
Author: pekeinfo

Pattern signatures:
$a = {8B 0D ?? ?? 43 00 51 8B 15 ?? ?? 43 00 52 E8 C9 04 00 00 83 C4 08 89 45 FC A1 ?? ?? 43 00 3B 05 ?? ?? 43 00 72 02}

Detection condition:
1 of them

Full rule:
rule cerber4{
meta:
        author = "pekeinfo"
        date = "2016-09-09"
        description = "Cerber4"
strings:
        $a = {8B 0D ?? ?? 43 00 51 8B 15 ?? ?? 43 00 52 E8 C9 04 00 00 83 C4 08 89 45 FC A1 ?? ?? 43 00 3B 05 ?? ?? 43 00 72 02}

condition:
        1 of them 
}