deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: REDLEAVES_DroppedFile_ImplantLoader_Starburn
Repository: Yara-Rules/rules
Detects: Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop

Detection condition:
any of them

Full rule:
rule REDLEAVES_DroppedFile_ImplantLoader_Starburn {
meta:
        description = "Detect the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
        author = "USG"
        true_positive = "7f8a867a8302fe58039a6db254d335ae" // StarBurn.dll
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
strings:
        $XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10} // Deobfuscation loop
condition:
        any of them
}
YARA Detection Rule: REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief
Repository: Yara-Rules/rules
Detects: Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01

Detection condition:
any of them

Full rule:
rule REDLEAVES_DroppedFile_ObfuscatedShellcodeAndRAT_handkerchief {
meta:
        description = "Detect obfuscated .dat file containing shellcode and core REDLEAVES RAT"
        author = "USG"
        true_positive = "fb0c714cd2ebdcc6f33817abe7813c36" // handkerchief.dat
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"

strings:
        $RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d} // This is 'red_autumnal_leaves_dllmain.dll' XOR'd with 0x01
condition:
        any of them
}
YARA Detection Rule: REDLEAVES_CoreImplant_UniqueStrings
Repository: Yara-Rules/rules
Detects: Strings identifying the core REDLEAVES RAT in its deobfuscated state
Author: USG
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
        $unique7 = "\\NamePipe_MoreWindows" wide ascii

Detection condition:
any of them

Full rule:
rule REDLEAVES_CoreImplant_UniqueStrings {
meta:
        description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
        author = "USG"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"

strings:
        $unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
        $unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
        $unique7 = "\\NamePipe_MoreWindows" wide ascii
condition:
        any of them
}
YARA Detection Rule: PLUGX_RedLeaves
Repository: Yara-Rules/rules
Author: US-CERT Code Analysis Team
Reference: https://www.us-cert.gov/ncas/alerts/TA17-117A

Pattern signatures:
$s0 = {[PII_REDACTED]3D2FD0010072F433C08BFF[PII_REDACTED]3D2FD0010072F4 }
        $s1 = "C:/Users/user/Desktop/my_OK_2014/bit9/runsna/Release/runsna.pdb" fullword ascii
        $s2 = "d:/work/plug4.0(shellcode)" fullword ascii
        $s3 = "/shellcode/shellcode/XSetting.h" fullword ascii
        $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
        $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
        $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC[PII_REDACTED]657 }
        $s7 = { 8A043233C932043983C[PII_REDACTED]F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
        $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
        $s9 = "RedLeavesCMDSimulatorMutex"

Detection condition:
$s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9

Full rule:
rule PLUGX_RedLeaves
{
meta:
        author = "US-CERT Code Analysis Team"
        date = "03042017"
        incident = "10118538"
        date = "2017/04/03"
        MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
        MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
        MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
        MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
        MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
        info = "Detects specific RedLeaves and PlugX binaries"
        reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"

strings:
        $s0 = {[PII_REDACTED]3D2FD0010072F433C08BFF[PII_REDACTED]3D2FD0010072F4 }
        $s1 = "C:/Users/user/Desktop/my_OK_2014/bit9/runsna/Release/runsna.pdb" fullword ascii
        $s2 = "d:/work/plug4.0(shellcode)" fullword ascii
        $s3 = "/shellcode/shellcode/XSetting.h" fullword ascii
        $s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
        $s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
        $s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC[PII_REDACTED]657 }
        $s7 = { 8A043233C932043983C[PII_REDACTED]F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
        $s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
        $s9 = "RedLeavesCMDSimulatorMutex"
condition:
        $s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
}
YARA Detection Rule: Ham_backdoor
Repository: Yara-Rules/rules
Author: Cylance Spear Team
Reference: https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html

Pattern signatures:
$a = {8D 14 3E 8B 7D FC 8A 0C 11 32 0C 38 40 8B 7D 10 88 0A 8B 4D 08 3B C3}
        $b = {8D 0C 1F 8B 5D F8 8A 04 08 32 04 1E 46 8B 5D 10 88 01 8B 45 08 3B F2}

Detection condition:
$a or $b

Full rule:
rule Ham_backdoor
{
meta:
        author = "Cylance Spear Team"
        reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
strings:
        $a = {8D 14 3E 8B 7D FC 8A 0C 11 32 0C 38 40 8B 7D 10 88 0A 8B 4D 08 3B C3}
        $b = {8D 0C 1F 8B 5D F8 8A 04 08 32 04 1E 46 8B 5D 10 88 01 8B 45 08 3B F2}
condition:
        $a or $b
}
YARA Detection Rule: Tofu_Backdoor
Repository: Yara-Rules/rules
Author: Cylance Spear Team
Reference: https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html

Pattern signatures:
$a = "Cookies: Sym1.0"
	$b = "\\\\.\\pipe\\1[12345678]"
	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}

Detection condition:
$a or $b or $c

Full rule:
rule Tofu_Backdoor
{
meta:
        author = "Cylance Spear Team"
        reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
strings:
	$a = "Cookies: Sym1.0"
	$b = "\\\\.\\pipe\\1[12345678]"
	$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
condition:
	$a or $b or $c
}
YARA Detection Rule: Industroyer_Malware_1
Repository: Yara-Rules/rules
Detects: Detects Industroyer related malware
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "haslo.exe" fullword ascii
      $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
      $s3 = "SYS_BASCON.COM" fullword wide
      $s4 = "*.pcmt" fullword wide
      $s5 = "*.pcmi" fullword wide

      $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
         00 3A 00 5C 00 00 00 }
      $x2 = "haslo.dat\x00Crash"

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )

Full rule:
rule Industroyer_Malware_1 {
   meta:
      description = "Detects Industroyer related malware"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
      hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
   strings:
      $s1 = "haslo.exe" fullword ascii
      $s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
      $s3 = "SYS_BASCON.COM" fullword wide
      $s4 = "*.pcmt" fullword wide
      $s5 = "*.pcmi" fullword wide

      $x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
         00 3A 00 5C 00 00 00 }
      $x2 = "haslo.dat\x00Crash"
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 1 of ($x*) or 2 of them )
}
YARA Detection Rule: Industroyer_Malware_2
Repository: Yara-Rules/rules
Detects: Detects Industroyer related malware
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
      $x2 = "10.15.1.69:3128" fullword wide

      $s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
      $s2 = "/c sc stop %s" fullword wide
      $s3 = "sc start %ls" fullword wide
      $s4 = "93.115.27.57" fullword wide
      $s5 = "5.39.218.152" fullword wide
      $s6 = "tierexe" fullword wide
      $s7 = "comsys" fullword wide
      $s8 = "195.16.88.6" fullword wide
      $s9 = "TieringService" fullword wide

      $a1 = "TEMP\x00\x00DEF" fullword wide
      $a2 = "TEMP\x00\x00DEF-C" fullword wide
      $a3 = "TEMP\x00\x00DEF-WS" fullword wide
      $a4 = "TEMP\x00\x00DEF-EP" fullword wide
      $a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
      $a6 = "TEMP\x00\x00DC-2" fullword wide
      $a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
      $a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
      $a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
    

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them )

Full rule:
rule Industroyer_Malware_2 {
   meta:
      description = "Detects Industroyer related malware"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
      hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
      hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
      hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
   strings:
      $x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
      $x2 = "10.15.1.69:3128" fullword wide

      $s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
      $s2 = "/c sc stop %s" fullword wide
      $s3 = "sc start %ls" fullword wide
      $s4 = "93.115.27.57" fullword wide
      $s5 = "5.39.218.152" fullword wide
      $s6 = "tierexe" fullword wide
      $s7 = "comsys" fullword wide
      $s8 = "195.16.88.6" fullword wide
      $s9 = "TieringService" fullword wide

      $a1 = "TEMP\x00\x00DEF" fullword wide
      $a2 = "TEMP\x00\x00DEF-C" fullword wide
      $a3 = "TEMP\x00\x00DEF-WS" fullword wide
      $a4 = "TEMP\x00\x00DEF-EP" fullword wide
      $a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
      $a6 = "TEMP\x00\x00DC-2" fullword wide
      $a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
      $a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
      $a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
      $a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) or 3 of them or 1 of ($a*) ) or ( 5 of them )
}
YARA Detection Rule: Industroyer_Portscan_3
Repository: Yara-Rules/rules
Detects: Detects Industroyer related custom port scaner
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "!ZBfamily" fullword ascii
      $s2 = ":g/outddomo;" fullword ascii
      $s3 = "GHIJKLMNOTST" fullword ascii
      /* Decompressed File */
      $d1 = "Error params Arguments!!!" fullword wide
      $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
      $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
      $d4 = "Error IP Range %ls - %ls" fullword wide
      $d5 = "Can't closesocket." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )

Full rule:
rule Industroyer_Portscan_3 {
   meta:
      description = "Detects Industroyer related custom port scaner"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
   strings:
      $s1 = "!ZBfamily" fullword ascii
      $s2 = ":g/outddomo;" fullword ascii
      $s3 = "GHIJKLMNOTST" fullword ascii
      /* Decompressed File */
      $d1 = "Error params Arguments!!!" fullword wide
      $d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
      $d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
      $d4 = "Error IP Range %ls - %ls" fullword wide
      $d5 = "Can't closesocket." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) or 2 of ($d*) )
}
YARA Detection Rule: Industroyer_Portscan_3_Output
Repository: Yara-Rules/rules
Detects: Detects Industroyer related custom port scaner output file
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "WSA library load complite." fullword ascii
      $s2 = "Connection refused" fullword ascii

Detection condition:
all of them

Full rule:
rule Industroyer_Portscan_3_Output {
   meta:
      description = "Detects Industroyer related custom port scaner output file"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
   strings:
      $s1 = "WSA library load complite." fullword ascii
      $s2 = "Connection refused" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Industroyer_Malware_4
Repository: Yara-Rules/rules
Detects: Detects Industroyer related malware
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$s1 = "haslo.dat" fullword wide
      $s2 = "defragsvc" fullword ascii

      /* .dat\x00\x00Crash */
      $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )

Full rule:
rule Industroyer_Malware_4 {
   meta:
      description = "Detects Industroyer related malware"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
   strings:
      $s1 = "haslo.dat" fullword wide
      $s2 = "defragsvc" fullword ascii

      /* .dat\x00\x00Crash */
      $a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or $a1 )
}
YARA Detection Rule: Industroyer_Malware_5
Repository: Yara-Rules/rules
Detects: Detects Industroyer related malware
Author: Florian Roth
Reference: https://goo.gl/x81cSy

Pattern signatures:
$x1 = "D2MultiCommService.exe" fullword ascii
      $x2 = "Crash104.dll" fullword ascii
      $x3 = "iec104.log" fullword ascii
      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii

      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
      $s2 = "return info-Remote command" fullword ascii
      $s3 = "Error killing process ..." fullword ascii
      $s4 = "stop_comm_service_name" fullword ascii
      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )

Full rule:
rule Industroyer_Malware_5 {
   meta:
      description = "Detects Industroyer related malware"
      author = "Florian Roth"
      reference = "https://goo.gl/x81cSy"
      date = "2017-06-13"
      hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
   strings:
      $x1 = "D2MultiCommService.exe" fullword ascii
      $x2 = "Crash104.dll" fullword ascii
      $x3 = "iec104.log" fullword ascii
      $x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii

      $s1 = "Error while getaddrinfo executing: %d" fullword ascii
      $s2 = "return info-Remote command" fullword ascii
      $s3 = "Error killing process ..." fullword ascii
      $s4 = "stop_comm_service_name" fullword ascii
      $s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of them ) ) or ( all of them )
}
YARA Detection Rule: CookiesStrings
Repository: Yara-Rules/rules
Detects: Cookies Identifying Strings
Author: Seth Hardy

Pattern signatures:
$zip1 = "ntdll.exePK"
        $zip2 = "AcroRd32.exePK"
        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
        $exe1 = "Leave GetCommand!"
        $exe2 = "perform exe success!"
        $exe3 = "perform exe failure!"
        $exe4 = "Entry SendCommandReq!"
        $exe5 = "Reqfile not exist!"
        $exe6 = "LeaveDealUpfile!"
        $exe7 = "Entry PostData!"
        $exe8 = "Leave PostFile!"
        $exe9 = "Entry PostFile!"
        $exe10 = "\\unknow.zip" wide ascii
        $exe11 = "the url no respon!"

Detection condition:
(2 of ($zip*)) or (2 of ($exe*))

Full rule:
rule CookiesStrings
{
    meta:
        description = "Cookies Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    strings:
        $zip1 = "ntdll.exePK"
        $zip2 = "AcroRd32.exePK"
        $zip3 = "Setup=ntdll.exe\x0d\x0aSilent=1\x0d\x0a"
        $zip4 = "Setup=%temp%\\AcroRd32.exe\x0d\x0a"
        $exe1 = "Leave GetCommand!"
        $exe2 = "perform exe success!"
        $exe3 = "perform exe failure!"
        $exe4 = "Entry SendCommandReq!"
        $exe5 = "Reqfile not exist!"
        $exe6 = "LeaveDealUpfile!"
        $exe7 = "Entry PostData!"
        $exe8 = "Leave PostFile!"
        $exe9 = "Entry PostFile!"
        $exe10 = "\\unknow.zip" wide ascii
        $exe11 = "the url no respon!"
        
    condition:
      (2 of ($zip*)) or (2 of ($exe*))
}
YARA Detection Rule: Cookies
Repository: Yara-Rules/rules
Detects: Cookies
Author: Seth Hardy

Detection condition:
CookiesStrings

Full rule:
rule Cookies
{
    meta:
        description = "Cookies"
        author = "Seth Hardy"
        last_modified = "2014-06-20"
        
    condition:
        CookiesStrings
}
YARA Detection Rule: cxpidStrings
Repository: Yara-Rules/rules
Detects: cxpid Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "/cxpid/submit.php?SessionID="
        $ = "/cxgid/"
        $ = "E21BC52BEA2FEF26D005CF"
        $ = "E21BC52BEA39E435C40CD8"
        $ = "                   -,L-,O+,Q-,R-,Y-,S-"

Detection condition:
any of them

Full rule:
rule cxpidStrings
{
    meta:
        description = "cxpid Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
        
    strings:
        $ = "/cxpid/submit.php?SessionID="
        $ = "/cxgid/"
        $ = "E21BC52BEA2FEF26D005CF"
        $ = "E21BC52BEA39E435C40CD8"
        $ = "                   -,L-,O+,Q-,R-,Y-,S-"
        
    condition:
       any of them
}
YARA Detection Rule: cxpidCode
Repository: Yara-Rules/rules
Detects: cxpid code features
Author: Seth Hardy

Pattern signatures:
$entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }

Detection condition:
any of them

Full rule:
rule cxpidCode
{
    meta:
        description = "cxpid code features"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
    
    strings:
        $entryjunk = { 55 8B EC B9 38 04 00 00 6A 00 6A 00 49 75 F9 }
    
    condition:
        any of them
}
YARA Detection Rule: Derkziel
Repository: Yara-Rules/rules
Detects: Derkziel info stealer (Steam, Opera, Yandex, ...)
Author: The Malware Hunter
Reference: https://bhf.su/threads/137898/

Pattern signatures:
$drz = "{!}DRZ{!}"
        $ua = "User-Agent: Uploador"
        $steam = "SteamAppData.vdf"
        $login = "loginusers.vdf"
        $config = "config.vdf"

Detection condition:
all of them

Full rule:
rule Derkziel
{
    
    meta:
        description = "Derkziel info stealer (Steam, Opera, Yandex, ...)"
        author = "The Malware Hunter"
        filetype = "pe"
        date = "2015-11"
        md5 = "f5956953b7a4acab2e6fa478c0015972"
        site = "https://zoo.mlw.re/samples/f5956953b7a4acab2e6fa478c0015972"
        reference = "https://bhf.su/threads/137898/"
    
    strings:
        $drz = "{!}DRZ{!}"
        $ua = "User-Agent: Uploador"
        $steam = "SteamAppData.vdf"
        $login = "loginusers.vdf"
        $config = "config.vdf"
    
    condition:
        all of them
}
YARA Detection Rule: ChickenDOS
Repository: Yara-Rules/rules
Detects: Win32-variant of Chicken ident for both dropper and dropped file
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$pdb1 = "\\Chicken\\Release\\svchost.pdb"
        $pdb2 = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
        $str2 = "fake.cf"
        $str3 = "8.8.8.8"
        $str4 = "Processor(%d)\\"
        $str5 = "DbProtectSupport"
        $str1 = "dm1712/`jvpnpkte/bpl"
        $str6 = "InstallService NPF %d"
        $str7 = "68961"
        $str8 = "InstallService DbProtectSupport %d"
        $str9 = "C:\\Program Files\\DbProtectSupport\\npf.sys"

Detection condition:
($pdb1 or $pdb2) and 5 of ($str*)

Full rule:
rule ChickenDOS
{

    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        description = "Win32-variant of Chicken ident for both dropper and dropped file"
        source = "https://github.com/arbor/yara/blob/master/chicken.yara"

    strings:
        $pdb1 = "\\Chicken\\Release\\svchost.pdb"
        $pdb2 = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
        $str2 = "fake.cf"
        $str3 = "8.8.8.8"
        $str4 = "Processor(%d)\\"
        $str5 = "DbProtectSupport"
        $str1 = "dm1712/`jvpnpkte/bpl"
        $str6 = "InstallService NPF %d"
        $str7 = "68961"
        $str8 = "InstallService DbProtectSupport %d"
        $str9 = "C:\\Program Files\\DbProtectSupport\\npf.sys"
   
    condition:
        ($pdb1 or $pdb2) and 5 of ($str*)
}
YARA Detection Rule: ChickenDOS_Linux
Repository: Yara-Rules/rules
Detects: Linux-variant of Chicken ident for both dropper and dropped file
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$cfg = "fake.cfg"
        $file1 = "ThreadAttack.cpp"
        $file2 = "Fake.cpp"
        $str1 = "dns_array"
        $str2 = "DomainRandEx"
        $str3 = "cpu %llu %llu %llu %llu"
        $str4 = "[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s" ascii

Detection condition:
$cfg and all of ($file*) and 3 of ($str*)

Full rule:
rule ChickenDOS_Linux 
{
 
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        description = "Linux-variant of Chicken ident for both dropper and dropped file"
        source = "https://github.com/arbor/yara/blob/master/chicken.yara"
    
    strings:
        $cfg = "fake.cfg"
        $file1 = "ThreadAttack.cpp"
        $file2 = "Fake.cpp"
        $str1 = "dns_array"
        $str2 = "DomainRandEx"
        $str3 = "cpu %llu %llu %llu %llu"
        $str4 = "[ %02d.%02d %02d:%02d:%02d.%03ld ] [%lu] [%s] %s" ascii
    
    condition:
        $cfg and all of ($file*) and 3 of ($str*)
}
YARA Detection Rule: XHide
Repository: Yara-Rules/rules
Detects: XHide - Process Faker
Author: Joan Soriano / @w0lfvan

Pattern signatures:
$a = "XHide - Process Faker"
		$b = "Fakename: %s PidNum: %d"

Detection condition:
all of them

Full rule:
rule XHide: MALW
{
	meta:
		description = "XHide - Process Faker"
		author = "Joan Soriano / @w0lfvan"
		date = "2017-12-01"
		version = "1.0"
		MD5 = "c644c04bce21dacdeb1e6c14c081e359"
		SHA256 = "59f5b21ef8a570c02453b5edb0e750a42a1382f6"
	strings:
		$a = "XHide - Process Faker"
		$b = "Fakename: %s PidNum: %d"
	condition:
		all of them
}