deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Trojan_Win32_Dipsind_B
Repository: Yara-Rules/rules
Detects: Dipsind Family
Author: Microsoft

Pattern signatures:
$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
        $frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
        $frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}

Detection condition:
$frg1 and $frg2 and $frg3

Full rule:
rule Trojan_Win32_Dipsind_B
{

    meta:
        author = "Microsoft"
        description = "Dipsind Family"
        sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
        $frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
        $frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
    
    condition:
        $frg1 and $frg2 and $frg3
}
YARA Detection Rule: Trojan_Win32_PlaKeylog_B
Repository: Yara-Rules/rules
Detects: Keylogger component
Author: Microsoft

Pattern signatures:
$hook = {C6 06 FF 46 C6 06 25}
        $dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

Detection condition:
$hook and $dasm_engine

Full rule:
rule Trojan_Win32_PlaKeylog_B
{

    meta:
        author = "Microsoft"
        description = "Keylogger component"
        original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
        unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $hook = {C6 06 FF 46 C6 06 25}
        $dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
    
    condition:
        $hook and $dasm_engine
}
YARA Detection Rule: Trojan_Win32_Adupib
Repository: Yara-Rules/rules
Detects: Adupib SSL Backdoor
Author: Microsoft

Pattern signatures:
$str1 = "POLL_RATE"
        $str2 = "OP_TIME(end hour)"
        $str3 = "%d:TCP:*:Enabled"
        $str4 = "%s[PwFF_cfg%d]"
        $str5 = "Fake_GetDlgItemTextW: ***value***="

Detection condition:
$str1 and $str2 and $str3 and $str4 and $str5

Full rule:
rule Trojan_Win32_Adupib 
{
    
    meta:
        author = "Microsoft"
        description = "Adupib SSL Backdoor"
        original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
        unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "POLL_RATE"
        $str2 = "OP_TIME(end hour)"
        $str3 = "%d:TCP:*:Enabled"
        $str4 = "%s[PwFF_cfg%d]"
        $str5 = "Fake_GetDlgItemTextW: ***value***="

    condition:
        $str1 and $str2 and $str3 and $str4 and $str5
}
YARA Detection Rule: Trojan_Win32_PlaLsaLog
Repository: Yara-Rules/rules
Detects: Loader / possible incomplete LSA Password Filter
Author: Microsoft

Pattern signatures:
$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
        $str2 = "PasswordChangeNotify"

Detection condition:
$str1 and $str2

Full rule:
rule Trojan_Win32_PlaLsaLog 
{

    meta:
        author = "Microsoft"
        description = "Loader / possible incomplete LSA Password Filter"
        original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
        unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
        $str2 = "PasswordChangeNotify"

    condition:
        $str1 and $str2
}
YARA Detection Rule: Trojan_Win32_Plagon
Repository: Yara-Rules/rules
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = "VPLRXZHTU"
        $str2 = {64 6F 67 32 6A 7E 6C}
        $str3 = "Dqpqftk(Wou\"Isztk)"
        $str4 = "StartThreadAtWinLogon"

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plagon
{
   
    meta:
        author = "Microsoft"
        description = "Dipsind variant"
        original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
        unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "VPLRXZHTU"
        $str2 = {64 6F 67 32 6A 7E 6C}
        $str3 = "Dqpqftk(Wou\"Isztk)"
        $str4 = "StartThreadAtWinLogon"
        condition:
        $str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Plakelog
Repository: Yara-Rules/rules
Detects: Raw-input based keylogger
Author: Microsoft

Pattern signatures:
$str1 = "<0x02>" wide
        $str2 = "[CTR-BRK]" wide
        $str3 = "[/WIN]" wide
        $str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plakelog 
{

    meta:
        author = "Microsoft"
        description = "Raw-input based keylogger"
        original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
        unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "<0x02>" wide
        $str2 = "[CTR-BRK]" wide
        $str3 = "[/WIN]" wide
        $str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}

    condition:
        $str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Plainst
Repository: Yara-Rules/rules
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
        $str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}

Detection condition:
$str1 and $str2

Full rule:
rule Trojan_Win32_Plainst
{

    meta:
        author = "Microsoft"
        description = "Installer component"
        original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
        unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
        $str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}

    condition:
        $str1 and $str2
}
YARA Detection Rule: Trojan_Win32_Plagicom
Repository: Yara-Rules/rules
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ?? 00}
        $str2 = "OUEMM/EMM"
        $str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plagicom
{

    meta:
        author = "Microsoft"
        description = "Installer component"
        original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
        unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc[PII_REDACTED]a7"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ?? 00}
        $str2 = "OUEMM/EMM"
        $str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plaklog
Repository: Yara-Rules/rules
Detects: Hook-based keylogger
Author: Microsoft

Pattern signatures:
$str1 = "++[%s^^unknown^^%s]++"
        $str2 = "vtfs43/emm"
        $str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plaklog
{

    meta:
        author = "Microsoft"
        description = "Hook-based keylogger"
        original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
        unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "++[%s^^unknown^^%s]++"
        $str2 = "vtfs43/emm"
        $str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plapiio
Repository: Yara-Rules/rules
Detects: JPin backdoor
Author: Microsoft

Pattern signatures:
$str1 = "ServiceMain"
        $str2 = "Startup"
        $str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plapiio
{

    meta:
        author = "Microsoft"
        description = "JPin backdoor"
        original_sample_sha1 = "3119de80088c52bd[PII_REDACTED]847cd984606c88"
        unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "ServiceMain"
        $str2 = "Startup"
        $str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plabit
Repository: Yara-Rules/rules
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
        $str2 = "GetInstanceW"
        $str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plabit
{

    meta:
        author = "Microsoft" description = "Installer component" sample_sha1 = "6d1169775a[PII_REDACTED]31f9385135d385efd166" activity_group = "Platinum" version = "1.0"
        last_modified = "2016-04-12"
    
    strings:
        $str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
        $str2 = "GetInstanceW"
        $str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
    
    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Placisc2
Repository: Yara-Rules/rules
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA }
        $str2 = "VPLRXZHTU"
        $str3 = "%d) Command:%s"
        $str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Placisc2
{

    meta:
        author = "Microsoft"
        description = "Dipsind variant"
        original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
        unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA }
        $str2 = "VPLRXZHTU"
        $str3 = "%d) Command:%s"
        $str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}

    condition:
        $str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Placisc3
Repository: Yara-Rules/rules
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
        $str2 = "VPLRXZHTU"
        $str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Placisc3 
{

    meta:
        author = "Microsoft"
        description = "Dipsind variant"
        original_sample_sha1 = "1b542dd0dacfcd[PII_REDACTED]709f5fa9683cdcda"
        unpacked_sample_sha1 = "bbd4992ee3f3a[PII_REDACTED]636359cf94fb4575d"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
        $str2 = "VPLRXZHTU"
        $str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Placisc4
Repository: Yara-Rules/rules
Detects: Installer for Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
        $str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
        $str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Placisc4 
{

    meta:
        author = "Microsoft"
        description = "Installer for Dipsind variant"
        original_sample_sha1 = "3d17828632e8ff1560f6094703ece5433bc69586"
        unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"
    
    strings:
        $str1 = {8D 71 01 8B C6 99 BB 0A 00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
        $str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
        $str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
    
    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plakpers
Repository: Yara-Rules/rules
Detects: Injector / loader component
Author: Microsoft

Pattern signatures:
$str1 = "MyFileMappingObject"
        $str2 = "[%.3u] %s %s %s [%s:" wide
        $str3 = "%s\\{%s}\\%s" wide

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plakpers
{

    meta:
        author = "Microsoft"
        description = "Injector / loader component"
        original_sample_sha1 = "fa083d744d278c6f4865f095cfd2feabee558056"
        unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "MyFileMappingObject"
        $str2 = "[%.3u] %s %s %s [%s:" wide
        $str3 = "%s\\{%s}\\%s" wide

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plainst2
Repository: Yara-Rules/rules
Detects: Zc tool
Author: Microsoft

Pattern signatures:
$str1 = "Connected [%s:%d]..."
        $str2 = "reuse possible: %c"
        $str3 = "] => %d%%\x0a"

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plainst2 
{

    meta:
        author = "Microsoft"
        description = "Zc tool"
        original_sample_sha1 = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
        unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "Connected [%s:%d]..."
        $str2 = "reuse possible: %c"
        $str3 = "] => %d%%\x0a"

    condition:
        $str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plakpeer
Repository: Yara-Rules/rules
Detects: Zc tool v2
Author: Microsoft

Pattern signatures:
$str1 = "@@E0020(%d)" wide
        $str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
        $str3 = "---###---" wide
        $str4 = "---@@@---" wide

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plakpeer
{

    meta:
        author = "Microsoft"
        description = "Zc tool v2"
        original_sample_sha1 = "2155c[PII_REDACTED]7b5e3fde004bb604198463d29"
        unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
        activity_group = "Platinum"
        version = "1.0"
        last_modified = "2016-04-12"

    strings:
        $str1 = "@@E0020(%d)" wide
        $str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
        $str3 = "---###---" wide
        $str4 = "---@@@---" wide

    condition:
        $str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: VidgrabCode
Repository: Yara-Rules/rules
Detects: Vidgrab code tricks
Author: Seth Hardy

Pattern signatures:
$divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }

Detection condition:
all of them

Full rule:
rule VidgrabCode : Vidgrab Family 
{
    meta:
        description = "Vidgrab code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    strings:
        $divbyzero = { B8 02 00 00 00 48 48 BA 02 00 00 00 83 F2 02 F7 F0 }
        // add eax, ecx; xor byte ptr [eax], ??h; inc ecx
        $xorloop = { 03 C1 80 30 (66 | 58) 41 }
        $junk = { 8B 4? ?? 8B 4? ?? 03 45 08 52 5A }
        
    condition:
        all of them
}
YARA Detection Rule: VidgrabStrings
Repository: Yara-Rules/rules
Detects: Vidgrab Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "IDI_ICON5" wide ascii
        $ = "starter.exe"
        $ = "wmifw.exe"
        $ = "Software\\rar"
        $ = "tmp092.tmp"
        $ = "temp1.exe"

Detection condition:
3 of them

Full rule:
rule VidgrabStrings : Vidgrab Family
{
    meta:
        description = "Vidgrab Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    strings:
        $ = "IDI_ICON5" wide ascii
        $ = "starter.exe"
        $ = "wmifw.exe"
        $ = "Software\\rar"
        $ = "tmp092.tmp"
        $ = "temp1.exe"
        
    condition:
       3 of them
}
YARA Detection Rule: Vidgrab
Repository: Yara-Rules/rules
Detects: Vidgrab
Author: Seth Hardy

Detection condition:
VidgrabCode or VidgrabStrings

Full rule:
rule Vidgrab : Family
{
    meta:
        description = "Vidgrab"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    condition:
        VidgrabCode or VidgrabStrings
}
YARA Detection Rule: Adwind
Repository: Yara-Rules/rules
Detects: Adwind RAT
Author: Asaf Aprozper, asafa AT minerva-labs.com
Reference: https://minerva-labs.com/post/adwind-and-other-evasive-java-rats

Pattern signatures:
$a0 = "META-INF/MANIFEST.MF"
        $a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
        $PK = "PK"

Detection condition:
$PK at 0 and $a0 and $a1

Full rule:
rule Adwind
{
meta:
        author="Asaf Aprozper, asafa AT minerva-labs.com"
        description = "Adwind RAT"
        reference = "https://minerva-labs.com/post/adwind-and-other-evasive-java-rats"
        last_modified = "2017-06-25"
strings:
        $a0 = "META-INF/MANIFEST.MF"
        $a1 = /Main(\$)Q[0-9][0-9][0-9][0-9]/
        $PK = "PK"
condition:
        $PK at 0 and $a0 and $a1
}
YARA Detection Rule: TeslaCrypt
Repository: Yara-Rules/rules
Detects: Regla para detectar Tesla con md5
Author: CCN-CERT

Pattern signatures:
$ = { 4E 6F 77 20 69 74 27 73 20 25 49 3A 25 4D 25 70 2E 00 00 00 76 61 6C 20 69 73 20 25 64 0A 00 00 }

Detection condition:
all of them

Full rule:
rule TeslaCrypt {
meta:
    description = "Regla para detectar Tesla con md5"
    author = "CCN-CERT"
    version = "1.0"
strings:
    $ = { 4E 6F 77 20 69 74 27 73 20 25 49 3A 25 4D 25 70 2E 00 00 00 76 61 6C 20 69 73 20 25 64 0A 00 00 }
condition:
    all of them
}
YARA Detection Rule: Hsdfihdf
Repository: Yara-Rules/rules
Detects: Polish banking malware
Author: Adam Ziaja <adam@adamziaja.com> http://adamziaja.com

Pattern signatures:
$s0 = "ANSI_CHARSET"
	$s1 = "][Vee_d_["
	$s2 = "qfcD:6<"
	$s3 = "%-%/%1%3%5%7%9%;%"
	$s4 = "imhzxsc\\WWKD<.)w"
	$s5 = "Vzlarf\\]VOZVMskf"
	$s6 = "JKWFAp\\Z"
	$s7 = "<aLLwhg"
	$s8 = "bdLeftToRight"
	$s9 = "F/.pTC7"
	$s10 = "O><8,)-$ "
	$s11 = "mjeUB>D.'8)5\\\\vhe["
	$s12 = "JGiVRk[W]PL("
	$s13 = "zwWNNG:8"
	$s14 = "zv7,'$"
	$a0 = "#hsdfihdf"
	$a1 = "polska.irc.pl"
	$b0 = "firehim@o2.pl"
	$b1 = "firehim@go2.pl"
	$b2 = "firehim@tlen.pl"
	$c0 = "cyberpunks.pl"
	$c1 = "kaper.phrack.pl"
	$c2 = "serwer.uk.to"
	$c3 = "ns1.ipv4.hu"
	$c4 = "scorebot.koth.hu"
	$c5 = "esopoland.pl"

Detection condition:
14 of ($s*) or all of ($a*) or 1 of ($b*) or 2 of ($c*)

Full rule:
rule Hsdfihdf: banking malware 
{
meta:
	author = "Adam Ziaja <adam@adamziaja.com> http://adamziaja.com"
	date = "2014-04-06"
	description = "Polish banking malware"
	hash0 = "db1675c74a444fd35383d9a45631cada"
	hash1 = "f48ba39df38056449a3e9a1a7289f657"
	filetype = "exe"
strings:
	$s0 = "ANSI_CHARSET"
	$s1 = "][Vee_d_["
	$s2 = "qfcD:6<"
	$s3 = "%-%/%1%3%5%7%9%;%"
	$s4 = "imhzxsc\\WWKD<.)w"
	$s5 = "Vzlarf\\]VOZVMskf"
	$s6 = "JKWFAp\\Z"
	$s7 = "<aLLwhg"
	$s8 = "bdLeftToRight"
	$s9 = "F/.pTC7"
	$s10 = "O><8,)-$ "
	$s11 = "mjeUB>D.'8)5\\\\vhe["
	$s12 = "JGiVRk[W]PL("
	$s13 = "zwWNNG:8"
	$s14 = "zv7,'$"
	$a0 = "#hsdfihdf"
	$a1 = "polska.irc.pl"
	$b0 = "firehim@o2.pl"
	$b1 = "firehim@go2.pl"
	$b2 = "firehim@tlen.pl"
	$c0 = "cyberpunks.pl"
	$c1 = "kaper.phrack.pl"
	$c2 = "serwer.uk.to"
	$c3 = "ns1.ipv4.hu"
	$c4 = "scorebot.koth.hu"
	$c5 = "esopoland.pl"
condition:
	14 of ($s*) or all of ($a*) or 1 of ($b*) or 2 of ($c*)
}
YARA Detection Rule: Insta11Code
Repository: Yara-Rules/rules
Detects: Insta11 code features
Author: Seth Hardy

Pattern signatures:
// jmp $+5; push 423h
        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }

Detection condition:
any of them

Full rule:
rule Insta11Code : Insta11 Family 
{
    meta:
        description = "Insta11 code features"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
    
    strings:
        // jmp $+5; push 423h
        $jumpandpush = { E9 00 00 00 00 68 23 04 00 00 }
    
    condition:
        any of them
}
YARA Detection Rule: Insta11Strings
Repository: Yara-Rules/rules
Detects: Insta11 Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "XTALKER7"
        $ = "Insta11 Microsoft" wide ascii
        $ = "wudMessage"
        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
        $ = "B12AE898-D056-4378-A844-6D393FE37956"

Detection condition:
any of them

Full rule:
rule Insta11Strings : Insta11 Family
{
    meta:
        description = "Insta11 Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
        
    strings:
        $ = "XTALKER7"
        $ = "Insta11 Microsoft" wide ascii
        $ = "wudMessage"
        $ = "ECD4FC4D-521C-11D0-B792-00A0C90312E1"
        $ = "B12AE898-D056-4378-A844-6D393FE37956"
        
    condition:
       any of them
}
YARA Detection Rule: Insta11
Repository: Yara-Rules/rules
Detects: Insta11
Author: Seth Hardy

Detection condition:
Insta11Code or Insta11Strings

Full rule:
rule Insta11 : Family
{
    meta:
        description = "Insta11"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
        
    condition:
        Insta11Code or Insta11Strings
}
YARA Detection Rule: XOR_DDosv1
Repository: Yara-Rules/rules
Detects: Rule to detect XOR DDos infection
Author: Akamai CSIRT

Pattern signatures:
$st0 = "BB2FA36AAA9541F0"
    $st1 = "md5="
    $st2 = "denyip="
    $st3 = "filename="
    $st4 = "rmfile="
    $st5 = "exec_packet"
    $st6 = "build_iphdr"

Detection condition:
all of them

Full rule:
rule XOR_DDosv1 : DDoS
{
  meta:
    author = "Akamai CSIRT"
    description = "Rule to detect XOR DDos infection"
  strings:
    $st0 = "BB2FA36AAA9541F0"
    $st1 = "md5="
    $st2 = "denyip="
    $st3 = "filename="
    $st4 = "rmfile="
    $st5 = "exec_packet"
    $st6 = "build_iphdr"
  condition:
    all of them
}