deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CN_APT_ZeroT_nflogger
Repository: Neo23x0/signature-base
Detects: Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$x1 = "\\LoaderDll.VS2010\\Release\\" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule CN_APT_ZeroT_nflogger {
   meta:
      description = "Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-04"
      hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
      id = "0d23f312-e3b6-5c23-855b-25ae54265512"
   strings:
      $x1 = "\\LoaderDll.VS2010\\Release\\" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: CN_APT_ZeroT_extracted_Go
Repository: Neo23x0/signature-base
Detects: Chinese APT by Proofpoint ZeroT RAT  - file Go.exe
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
      $x2 = "\\BypassUAC.VS2010\\Release\\" ascii

      $s1 = "Zjdsf.exe" fullword ascii
      $s2 = "SS32prep.exe" fullword ascii
      $s3 = "windowsgrep.exe" fullword ascii
      $s4 = "Sysdug.exe" fullword ascii
      $s5 = "Proessz.exe" fullword ascii
      $s6 = "%s\\Zlh.exe" fullword ascii
      $s7 = "/C %s\\%s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 7 of them )

Full rule:
rule CN_APT_ZeroT_extracted_Go {
   meta:
      description = "Chinese APT by Proofpoint ZeroT RAT  - file Go.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-04"
      modified = "2023-01-06"
      hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
      id = "ba929e6d-4162-58e7-b8a8-bcb066b64522"
   strings:
      $x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
      $x2 = "\\BypassUAC.VS2010\\Release\\" ascii

      $s1 = "Zjdsf.exe" fullword ascii
      $s2 = "SS32prep.exe" fullword ascii
      $s3 = "windowsgrep.exe" fullword ascii
      $s4 = "Sysdug.exe" fullword ascii
      $s5 = "Proessz.exe" fullword ascii
      $s6 = "%s\\Zlh.exe" fullword ascii
      $s7 = "/C %s\\%s" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 7 of them )
}
YARA Detection Rule: CN_APT_ZeroT_extracted_Mcutil
Repository: Neo23x0/signature-base
Detects: Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "LoaderDll.dll" fullword ascii
      $s2 = "QageBox1USER" fullword ascii
      $s3 = "xhmowl" fullword ascii
      $s4 = "?KEYKY" fullword ascii
      $s5 = "HH:mm:_s" fullword ascii
      $s6 = "=licni] has maX0t" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )

Full rule:
rule CN_APT_ZeroT_extracted_Mcutil {
   meta:
      description = "Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-04"
      hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
      id = "c887d36b-8aeb-54f1-a[PII_REDACTED]23238"
   strings:
      $s1 = "LoaderDll.dll" fullword ascii
      $s2 = "QageBox1USER" fullword ascii
      $s3 = "xhmowl" fullword ascii
      $s4 = "?KEYKY" fullword ascii
      $s5 = "HH:mm:_s" fullword ascii
      $s6 = "=licni] has maX0t" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 90KB and 3 of them ) or ( all of them )
}
YARA Detection Rule: CN_APT_ZeroT_extracted_Zlh
Repository: Neo23x0/signature-base
Detects: Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx

Pattern signatures:
$s1 = "nflogger.dll" fullword wide
      $s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
      $s3 = "_StartZlhh(): Executed \"%s\"" ascii
      $s4 = "Executable: '%s' (%s) %i" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )

Full rule:
rule CN_APT_ZeroT_extracted_Zlh {
   meta:
      description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
      date = "2017-02-04"
      hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db[PII_REDACTED]2fe6e1288f5705"
      id = "4c8b9a90-6cb3-5aba-a993-f73207341d0e"
   strings:
      $s1 = "nflogger.dll" fullword wide
      $s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
      $s3 = "_StartZlhh(): Executed \"%s\"" ascii
      $s4 = "Executable: '%s' (%s) %i" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 3 of them )
}
YARA Detection Rule: APT12_Malware_Aug17
Repository: Neo23x0/signature-base
Detects: Detects APT 12 Malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.macnica.net/blog/2017/08/post-fb81.html

Detection condition:
( uint16(0) == 0x5a4d and pe.imphash() == "9ba915fd04f248ad62e856c7238c0264" )

Full rule:
rule APT12_Malware_Aug17 {
   meta:
      description = "Detects APT 12 Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
      date = "2017-08-30"
      hash1 = "dc7521c00ec2534cf494c0263ddf67ea4ba9915eb17bdc0b3ebe9e840ec63643"
      hash2 = "42da51b69bd[PII_REDACTED]a4eef9a2a10153e012a3213e8e9877cf831aea3eced"
      id = "6c9cd68f-b839-5c99-a9f5-14c2d8a28bec"
   condition:
      ( uint16(0) == 0x5a4d and pe.imphash() == "9ba915fd04f248ad62e856c7238c0264" )
}
YARA Detection Rule: VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21
Repository: Neo23x0/signature-base
Detects: Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE
Author: Christian Burkard
Reference: https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution

Pattern signatures:
$a1 = "/opt/omi/bin/omiagent" ascii fullword
      
      $s1 = "OMI-1.6.8-0 - " ascii
      $s2 = "OMI-1.6.6-0 - " ascii
      $s3 = "OMI-1.6.4-1 - " ascii
      $s4 = "OMI-1.6.4-0 - " ascii
      $s5 = "OMI-1.6.2-0 - " ascii
      $s6 = "OMI-1.6.1-0 - " ascii
      $s7 = "OMI-1.5.0-0 - " ascii
      $s8 = "OMI-1.4.4-0 - " ascii
      $s9 = "OMI-1.4.3-2 - " ascii
      $s10 = "OMI-1.4.3-1 - " ascii
      $s11 = "OMI-1.4.3-0 - " ascii
      $s12 = "OMI-1.4.2-5 - " ascii
      $s13 = "OMI-1.4.2-4 - " ascii
      $s14 = "OMI-1.4.2-3 - " ascii
      $s15 = "OMI-1.4.2-2 - " ascii
      $s16 = "OMI-1.4.2-1 - " ascii
      $s17 = "OMI-1.4.1-1 - " ascii
      $s18 = "OMI-1.4.1-0 - " ascii
      $s19 = "OMI-1.4.0-6 - " ascii
      // older versions are no longer supported by current openssl
      // and are from before 2018

Detection condition:
uint32be(0) == 0x7f454c46
      and $a1
      and 1 of ($s*)

Full rule:
rule VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 {
   meta:
      description = "Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE"
      author = "Christian Burkard"
      date = "2021-09-16"
      reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
      score = 50
      id = "ca49f0cc-ea33-559c-bd4f-306a01315fce"
   strings:
      $a1 = "/opt/omi/bin/omiagent" ascii fullword
      
      $s1 = "OMI-1.6.8-0 - " ascii
      $s2 = "OMI-1.6.6-0 - " ascii
      $s3 = "OMI-1.6.4-1 - " ascii
      $s4 = "OMI-1.6.4-0 - " ascii
      $s5 = "OMI-1.6.2-0 - " ascii
      $s6 = "OMI-1.6.1-0 - " ascii
      $s7 = "OMI-1.5.0-0 - " ascii
      $s8 = "OMI-1.4.4-0 - " ascii
      $s9 = "OMI-1.4.3-2 - " ascii
      $s10 = "OMI-1.4.3-1 - " ascii
      $s11 = "OMI-1.4.3-0 - " ascii
      $s12 = "OMI-1.4.2-5 - " ascii
      $s13 = "OMI-1.4.2-4 - " ascii
      $s14 = "OMI-1.4.2-3 - " ascii
      $s15 = "OMI-1.4.2-2 - " ascii
      $s16 = "OMI-1.4.2-1 - " ascii
      $s17 = "OMI-1.4.1-1 - " ascii
      $s18 = "OMI-1.4.1-0 - " ascii
      $s19 = "OMI-1.4.0-6 - " ascii
      // older versions are no longer supported by current openssl
      // and are from before 2018
   condition:
      uint32be(0) == 0x7f454c46
      and $a1
      and 1 of ($s*)
}
YARA Detection Rule: Recon_Commands_Windows_Gen1
Repository: Neo23x0/signature-base
Detects: Detects a set of reconnaissance commands on Windows systems
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/MSJCxP

Pattern signatures:
$s1 = "netstat -an" ascii
      $s2 = "net view" ascii fullword
      $s3 = "net user" ascii fullword
      $s4 = "whoami" ascii
      $s5 = "tasklist /v" ascii
      $s6 = "systeminfo" ascii
      $s7 = "net localgroup administrators" ascii
      $s8 = "net user administrator" ascii
      $s9 = "regedit -e " ascii
      $s10 = "tasklist /svc" ascii
      $s11 = "regsvr32 /s /u " ascii
      $s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
      $s13 = "bitsadmin /rawreturn /transfer getfile" ascii
      $s14 = "wmic qfe list full" ascii
      $s15 = "schtasks.exe /create " ascii nocase
      $s16 = "wmic share get" ascii
      $s17 = "wmic nteventlog get" ascii
      $s18 = "wevtutil cl " ascii
      $s19 = "sc query type= service" ascii
      $s20 = "arp -a " ascii

      $fp1 = "avdapp.dll" fullword wide
      $fp2 = "keyword.command.batchfile" ascii
      $fp3 = ".sublime-settings" ascii

Detection condition:
filesize < 1000KB and 4 of them
      and not 1 of ($fp*)

Full rule:
rule Recon_Commands_Windows_Gen1 {
   meta:
      description = "Detects a set of reconnaissance commands on Windows systems"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-07-10"
      score = 60
      reference = "https://goo.gl/MSJCxP"
      id = "bc95265c-780d-5451-bd12-d14495877e46"
   strings:
      $s1 = "netstat -an" ascii
      $s2 = "net view" ascii fullword
      $s3 = "net user" ascii fullword
      $s4 = "whoami" ascii
      $s5 = "tasklist /v" ascii
      $s6 = "systeminfo" ascii
      $s7 = "net localgroup administrators" ascii
      $s8 = "net user administrator" ascii
      $s9 = "regedit -e " ascii
      $s10 = "tasklist /svc" ascii
      $s11 = "regsvr32 /s /u " ascii
      $s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
      $s13 = "bitsadmin /rawreturn /transfer getfile" ascii
      $s14 = "wmic qfe list full" ascii
      $s15 = "schtasks.exe /create " ascii nocase
      $s16 = "wmic share get" ascii
      $s17 = "wmic nteventlog get" ascii
      $s18 = "wevtutil cl " ascii
      $s19 = "sc query type= service" ascii
      $s20 = "arp -a " ascii

      $fp1 = "avdapp.dll" fullword wide
      $fp2 = "keyword.command.batchfile" ascii
      $fp3 = ".sublime-settings" ascii
   condition:
      filesize < 1000KB and 4 of them
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_Recon_Outputs_Jun20_1
Repository: Neo23x0/signature-base
Detects: Detects outputs of many different commands often used for reconnaissance purposes
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/cycldek-bridging-the-air-gap/97157/

Pattern signatures:
/* ipconfig /all */
      $s1 = ". . . . : Yes" ascii 
      /* ping */
      $s2 = "with 32 bytes of data:" ascii
      /* arp -a */
      $s3 = "ff-ff-ff-ff-ff-ff     static" ascii
      /* netstat */ 
      $s4 = "  TCP    0.0.0.0:445" ascii 
      /* tasklist */ 
      $s5 = "System Idle Process" ascii

Detection condition:
filesize < 150KB and
      4 of them

Full rule:
rule SUSP_Recon_Outputs_Jun20_1 {
   meta:
      description = "Detects outputs of many different commands often used for reconnaissance purposes"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
      date = "2020-06-04"
      score = 60
      id = "ec3759aa-212f-52ce-9f38-636accd35749"
   strings:
      /* ipconfig /all */
      $s1 = ". . . . : Yes" ascii 
      /* ping */
      $s2 = "with 32 bytes of data:" ascii
      /* arp -a */
      $s3 = "ff-ff-ff-ff-ff-ff     static" ascii
      /* netstat */ 
      $s4 = "  TCP    0.0.0.0:445" ascii 
      /* tasklist */ 
      $s5 = "System Idle Process" ascii
   condition:
      filesize < 150KB and
      4 of them
}
YARA Detection Rule: Pupy_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects Pupy backdoor
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/n1nj4sec/pupy-binaries

Pattern signatures:
$x1 = "reflectively inject a dll into a process." fullword ascii
      $x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
      $x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
      $x4 = "reflective_inject_dll" fullword ascii
      $x5 = "ld_preload_inject_dll" fullword ascii
      $x6 = "get_pupy_config() -> string" fullword ascii
      $x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
      $x8 = "reflective_inject_dll" fullword ascii
      $x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
      $x10 = "linux_inject_main" fullword ascii

Detection condition:
( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 7000KB and 1 of them )
      or 3 of them
      or ( uint16(0) == 0x5a4d and pe.imphash() == "84a69bce2ff6d9f866b7ae63bd70b163" )

Full rule:
rule Pupy_Backdoor {
   meta:
      description = "Detects Pupy backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/n1nj4sec/pupy-binaries"
      date = "2017-08-11"
      hash1 = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
      hash2 = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
      hash3 = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
      hash4 = "20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8"
      hash5 = "06bb41c12644ca1761bcb3c14767180b673cb9d9116b[PII_REDACTED]09e7063c3e"
      hash6 = "be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2"
      hash7 = "8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01"

      id = "[PII_REDACTED]-b3e1-02ad9cccc6ae"
   strings:
      $x1 = "reflectively inject a dll into a process." fullword ascii
      $x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
      $x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
      $x4 = "reflective_inject_dll" fullword ascii
      $x5 = "ld_preload_inject_dll" fullword ascii
      $x6 = "get_pupy_config() -> string" fullword ascii
      $x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
      $x8 = "reflective_inject_dll" fullword ascii
      $x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
      $x10 = "linux_inject_main" fullword ascii
   condition:
      ( ( uint16(0) == 0x457f or uint16(0) == 0x5a4d ) and filesize < 7000KB and 1 of them )
      or 3 of them
      or ( uint16(0) == 0x5a4d and pe.imphash() == "84a69bce2ff6d9f866b7ae63bd70b163" )
}
YARA Detection Rule: SUSP_Macro_StarOffice
Repository: Neo23x0/signature-base
Detects: Suspicious macro in StarOffice
Author: John Lambert @JohnLaTwC
Reference: https://twitter.com/JohnLaTwC/status/[PII_REDACTED]93732096

Pattern signatures:
$r1 = "StarBasic"
        $r2 = "</script:module>"
        $s1 = "Shell" nocase
        $s2 = ".Run" nocase
        $s3 = ".PutInClipboard" nocase
        $s4 = "powershell" nocase

        $fp1 = "LibreOffice project" ascii

Detection condition:
filesize < 1MB
        and uint32be(0) == 0x3c3f786d // <?xm
        and all of ($r*)
        and 1 of ($s*)
        and not 1 of ($fp*)

Full rule:
rule SUSP_Macro_StarOffice {
   meta:
        description = "Suspicious macro in StarOffice"
        author = "John Lambert @JohnLaTwC"
        date = "2019-02-06"
        modified = "2021-05-27"
        score = 60
        reference = "https://twitter.com/JohnLaTwC/status/[PII_REDACTED]93732096"
        hash1 = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
        hash2 = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
        hash3 = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
        hash4 = "[PII_REDACTED]37f7e0087a6159708df97992abaadff0fa48fdf25111d34a3e2f20"
        hash5 = "7141d94e827d3b24810813d6b2e3fb851da0ee2958ef347154bc28153b23874a"
        hash6 = "7c0e85c0a4d96080ca341d3496743f0f113b[PII_REDACTED]d40413be6d453eab4"
        hash7 = "8d59f1e2abcab9efb7f833d478d1d1390e7456092f858b656ee0024daf3d1aa3"
        hash8 = "9846b942d9d1e276c95361180e9326593ea46d3abcce9c116c204954bbfe3fdc"
        hash9 = "aa0c83f339c8c16ad21dec41e4605d4e327adbbb78827dcad250ed64d2ceef1c"
        hash10 = "b0be54c7210b06e60112a119c235e23c9edbe40b1c1ce[PII_REDACTED]f82b6b302"
        hash11 = "bf581ebb96b8ca4f254ab4d200f9a053aff[PII_REDACTED]d9a1cbd443df0f554e3"
        hash12 = "de45634064af31cb6768e4912cac284a76a6e66d398993df1aeee8ce26e0733b"

        id = "92110a87-66b4-5fc5-b3f5-3e59ec2671b2"
    strings:
        $r1 = "StarBasic"
        $r2 = "</script:module>"
        $s1 = "Shell" nocase
        $s2 = ".Run" nocase
        $s3 = ".PutInClipboard" nocase
        $s4 = "powershell" nocase

        $fp1 = "LibreOffice project" ascii
    condition:
        filesize < 1MB
        and uint32be(0) == 0x3c3f786d // <?xm
        and all of ($r*)
        and 1 of ($s*)
        and not 1 of ($fp*)
}
YARA Detection Rule: APT_APT41_POISONPLUG_3
Repository: Neo23x0/signature-base
Detects: Detects APT41 malware POISONPLUG
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html

Pattern signatures:
$s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
      $s2 = "tcpview.exe" fullword ascii
      $s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii /* reversed goodware string 'Software\\Microsoft\\Windows\\CurrentVersion\\Run' */
      $s4 = "AxEeulaVteSgeR" fullword ascii /* reversed goodware string 'RegSetValueExA' */
      $s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and 3 of them

Full rule:
rule APT_APT41_POISONPLUG_3 {
   meta:
      description = "Detects APT41 malware POISONPLUG"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
      date = "2019-08-07"
      score = 80
      hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
   strings:
      $s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
      $s2 = "tcpview.exe" fullword ascii
      $s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii /* reversed goodware string 'Software\\Microsoft\\Windows\\CurrentVersion\\Run' */
      $s4 = "AxEeulaVteSgeR" fullword ascii /* reversed goodware string 'RegSetValueExA' */
      $s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and 3 of them
}
YARA Detection Rule: APT_APT41_POISONPLUG_SHADOW
Repository: Neo23x0/signature-base
Detects: Detects APT41 malware POISONPLUG SHADOW
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and pe.imphash() == "c67de089f2009b[PII_REDACTED]2fc484e8"

Full rule:
rule APT_APT41_POISONPLUG_SHADOW {
   meta:
      description = "Detects APT41 malware POISONPLUG SHADOW"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
      date = "2019-08-07"
      score = 85
      hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
      id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and pe.imphash() == "c67de089f2009b[PII_REDACTED]2fc484e8"
}
YARA Detection Rule: APT_APT41_CRACKSHOT
Repository: Neo23x0/signature-base
Detects: Detects APT41 malware CRACKSHOT
Author: Florian Roth (Nextron Systems)
Reference: https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html

Pattern signatures:
$x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii

      $s1 = "RunUrlBinInMem" fullword ascii
      $s2 = "DownRunUrlFile" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
      $s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule APT_APT41_CRACKSHOT {
   meta:
      description = "Detects APT41 malware CRACKSHOT"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
      date = "2019-08-07"
      score = 85
      hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
      id = "4ec34a77-dc7f-5f27-9f0a-c[PII_REDACTED]8"
   strings:
      $x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii

      $s1 = "RunUrlBinInMem" fullword ascii
      $s2 = "DownRunUrlFile" fullword ascii
      $s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
      $s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 250KB and ( 1 of ($x*) or 2 of them )
}