deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Emotet_BKA_Cleanup_Apr21
Repository: Neo23x0/signature-base
Author: press inquiries <info@bka.de>, technical contact <info@mha.bka.de>
Reference: https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html

Pattern signatures:
$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }

Detection condition:
filesize > 300KB and
      filesize < 700KB and
      uint16(0) == 0x5A4D and
      $key

Full rule:
rule MAL_Emotet_BKA_Cleanup_Apr21 {
   meta:
      author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
      reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
      descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
      note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
      sharing = "TLP:WHITE"
      date = "2021-03-23"
      id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"
   strings:
      $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
   condition:
      filesize > 300KB and
      filesize < 700KB and
      uint16(0) == 0x5A4D and
      $key
}
YARA Detection Rule: EXT_MAL_SystemBC_Mar22_1
Repository: Neo23x0/signature-base
Detects: Detects unpacked SystemBC module as used by Emotet in March 2022
Author: Thomas Barabosch, Deutsche Telekom Security
Reference: https://twitter.com/Cryptolaemus1/status/[PII_REDACTED]46575105

Pattern signatures:
$sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
        $sx2 = "BEGINDATA" ascii
        $sx3 = "GET %s HTTP/1.0" ascii
        /*
        $s1 = "TOR:" ascii
        $s2 = "PORT1:" ascii
        $s3 = "HOST1:" ascii 
        */
        $s5 = "User-Agent:" ascii
        /* $s6 = "powershell" ascii */
        $s8 = "ALLUSERSPROFILE" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 30KB and 2 of ($sx*) ) or all of them

Full rule:
rule EXT_MAL_SystemBC_Mar22_1 {
    meta:
        author = "Thomas Barabosch, Deutsche Telekom Security"
        date = "2022-03-11"
        description = "Detects unpacked SystemBC module as used by Emotet in March 2022"
        score = 85
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
        reference = "https://twitter.com/Cryptolaemus1/status/[PII_REDACTED]46575105"
        reference2 = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
        hash1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
        id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
    strings:
        $sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
        $sx2 = "BEGINDATA" ascii
        $sx3 = "GET %s HTTP/1.0" ascii
        /*
        $s1 = "TOR:" ascii
        $s2 = "PORT1:" ascii
        $s3 = "HOST1:" ascii 
        */
        $s5 = "User-Agent:" ascii
        /* $s6 = "powershell" ascii */
        $s8 = "ALLUSERSPROFILE" ascii
    condition:
        ( uint16(0) == 0x5a4d and filesize < 30KB and 2 of ($sx*) ) or all of them
}
YARA Detection Rule: shimrat
Repository: Neo23x0/signature-base
Detects: Detects ShimRat and the ShimRat loader
Author: Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)

Pattern signatures:
$dll = ".dll"
      $dat = ".dat"
      $headersig = "QWERTYUIOPLKJHG"
      $datasig = "MNBVCXZLKJHGFDS"
      $datamarker1 = "Data$$00"
      $datamarker2 = "Data$$01%c%sData"
      $cmdlineformat = "ping localhost -n 9 /c %s > nul"
      $demoproject_keyword1 = "Demo"
      $demoproject_keyword2 = "Win32App"
      $comspec = "COMSPEC"
      $shim_func1 = "ShimMain"
      $shim_func2 = "NotifyShims"
      $shim_func3 = "GetHookAPIs"

Detection condition:
($dll and $dat and $headersig and $datasig) or
      ($datamarker1 and $datamarker2) or
      ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or
      ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)

Full rule:
rule shimrat {
   meta:
      description = "Detects ShimRat and the ShimRat loader"
      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
      date = "20/11/2015"
      id = "[PII_REDACTED]-8e82-1589992ffa1d"
   strings:
      $dll = ".dll"
      $dat = ".dat"
      $headersig = "QWERTYUIOPLKJHG"
      $datasig = "MNBVCXZLKJHGFDS"
      $datamarker1 = "Data$$00"
      $datamarker2 = "Data$$01%c%sData"
      $cmdlineformat = "ping localhost -n 9 /c %s > nul"
      $demoproject_keyword1 = "Demo"
      $demoproject_keyword2 = "Win32App"
      $comspec = "COMSPEC"
      $shim_func1 = "ShimMain"
      $shim_func2 = "NotifyShims"
      $shim_func3 = "GetHookAPIs"
   condition:
      ($dll and $dat and $headersig and $datasig) or
      ($datamarker1 and $datamarker2) or
      ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or
      ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
}
YARA Detection Rule: shimratreporter
Repository: Neo23x0/signature-base
Detects: Detects ShimRatReporter
Author: Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)

Pattern signatures:
$IpInfo = "IP-INFO"
      $NetworkInfo = "Network-INFO"
      $OsInfo = "OS-INFO"
      $ProcessInfo = "Process-INFO"
      $BrowserInfo = "Browser-INFO"
      $QueryUserInfo = "QueryUser-INFO"
      $UsersInfo = "Users-INFO"
      $SoftwareInfo = "Software-INFO"
      $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
      $proxy_str = "(from environment) = %s"
      $netuserfun = "NetUserEnum"
      $networkparams = "GetNetworkParams"

Detection condition:
all of them

Full rule:
rule shimratreporter {
   meta:
      description = "Detects ShimRatReporter"
      author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
      date = "20/11/2015"
      id = "01688b3c-2f06-518f-939d-4d65529be5ae"
   strings:
      $IpInfo = "IP-INFO"
      $NetworkInfo = "Network-INFO"
      $OsInfo = "OS-INFO"
      $ProcessInfo = "Process-INFO"
      $BrowserInfo = "Browser-INFO"
      $QueryUserInfo = "QueryUser-INFO"
      $UsersInfo = "Users-INFO"
      $SoftwareInfo = "Software-INFO"
      $AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
      $proxy_str = "(from environment) = %s"
      $netuserfun = "NetUserEnum"
      $networkparams = "GetNetworkParams"
   condition:
      all of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_1
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
      $s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 4000KB and (
         pe.imphash() == "baa93d47220682c04d92f7797d9224ce" and
         $s1 in (0..1024) and
         $s2 in (0..1024)
      )

Full rule:
rule MAL_BurningUmbrella_Sample_1 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
      id = "9f8a6831-172b-5310-9763-43657b79b91d"
   strings:
      $s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
      $s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }
   condition:
      uint16(0) == 0x5a4d and filesize < 4000KB and (
         pe.imphash() == "baa93d47220682c04d92f7797d9224ce" and
         $s1 in (0..1024) and
         $s2 in (0..1024)
      )
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_2
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
      $s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
      $s3 = "ActiveX Manager" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and
      $s1 in (0..1024) and
      $s2 in (0..1024) and
      $s3

Full rule:
rule MAL_BurningUmbrella_Sample_2 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
      id = "926b4a29-ce47-559b-94e3-1fabd90f3fbe"
   strings:
      $s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
      $s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
      $s3 = "ActiveX Manager" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and
      $s1 in (0..1024) and
      $s2 in (0..1024) and
      $s3
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_3
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 1 of them

Full rule:
rule MAL_BurningUmbrella_Sample_3 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "92efbecc24fbb[PII_REDACTED]b6221b241b10bdfe3dd0375d663b051283d0de30f"
      id = "b997822a-3f62-51b4-bd96-e780ffe60812"
   strings:
      $s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_4
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$x1 = "dumpodbc.exe" fullword ascii
      $x2 = "photo_Bundle.exe" fullword ascii
      $x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
      $x4 = "Connect fails 1 : %d %s:%d" fullword ascii
      $x5 = "New IP : %s,New Port: %d" fullword ascii
      $x6 = "Micrsoft Corporation. All rights reserved." fullword wide
      $x7 = "New ConFails : %d" fullword ascii

      $s1 = "cmd /c net stop stisvc" fullword ascii
      $s2 = "cmd /c net stop spooler" fullword ascii
      $s3 = "\\temp\\s%d.dat" ascii
      $s4 = "cmd /c net stop wuauserv" fullword ascii
      $s5 = "User-Agent: MyApp/0.1" fullword ascii
      $s6 = "%s->%s Fails : %d" fullword ascii
      $s7 = "Enter WorkThread,Current sock:%d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and (
         ( pe.exports("Print32") and 2 of them ) or
         1 of ($x*) or
         4 of them
      )

Full rule:
rule MAL_BurningUmbrella_Sample_4 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
      id = "3489f64b-7ebc-55b8-bd11-afaa719e572b"
   strings:
      $x1 = "dumpodbc.exe" fullword ascii
      $x2 = "photo_Bundle.exe" fullword ascii
      $x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
      $x4 = "Connect fails 1 : %d %s:%d" fullword ascii
      $x5 = "New IP : %s,New Port: %d" fullword ascii
      $x6 = "Micrsoft Corporation. All rights reserved." fullword wide
      $x7 = "New ConFails : %d" fullword ascii

      $s1 = "cmd /c net stop stisvc" fullword ascii
      $s2 = "cmd /c net stop spooler" fullword ascii
      $s3 = "\\temp\\s%d.dat" ascii
      $s4 = "cmd /c net stop wuauserv" fullword ascii
      $s5 = "User-Agent: MyApp/0.1" fullword ascii
      $s6 = "%s->%s Fails : %d" fullword ascii
      $s7 = "Enter WorkThread,Current sock:%d" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 50KB and (
         ( pe.exports("Print32") and 2 of them ) or
         1 of ($x*) or
         4 of them
      )
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_6
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
      $s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them

Full rule:
rule MAL_BurningUmbrella_Sample_6 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
      id = "7198a734-fd54-5cb5-9966-b91796a415c7"
   strings:
      $s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
      $s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 1 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_7
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and pe.imphash() == "f5b113d6708a3927b5cc48f2215fcaff"

Full rule:
rule MAL_BurningUmbrella_Sample_7 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
      hash2 = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
      hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
      id = "7e427512-a8ee-53ae-a141-e995e74ca845"
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and pe.imphash() == "f5b113d6708a3927b5cc48f2215fcaff"
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_8
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "cmd /c open %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 1 of them

Full rule:
rule MAL_BurningUmbrella_Sample_8 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
      id = "1b89d5a1-1425-5cb7-b429-563769bc0943"
   strings:
      $s1 = "cmd /c open %s" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and 1 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_10
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "revjj.syshell.org" fullword ascii
      /* $s2 = "Kernel.dll" fullword ascii */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule MAL_BurningUmbrella_Sample_10 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
      hash2 = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
      hash3 = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
      id = "e4cb2211-efbe-55f9-99e3-c[PII_REDACTED]9"
   strings:
      $s1 = "revjj.syshell.org" fullword ascii
      /* $s2 = "Kernel.dll" fullword ascii */
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_11
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 700KB and 1 of them

Full rule:
rule MAL_BurningUmbrella_Sample_11 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
      id = "9762c68c-4d69-5d38-aaf4-0048e7404147"
   strings:
      $s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii
   condition:
      uint16(0) == 0x4b50 and filesize < 700KB and 1 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_12
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
      $s2 = "rundll32.exe %s,Startup" fullword ascii
      $s3 = "nvsvcs.dll" fullword wide
      $s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
      $s5 = "http://www.sginternet.net 0" fullword ascii
      $s6 = "Microsoft Corporation. All rights reserved." fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 80KB and (
         pe.exports("SvcServiceMain") and
         5 of them
      )

Full rule:
rule MAL_BurningUmbrella_Sample_12 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
      id = "805a00e7-2959-53d8-b769-0f8e54e1bbd5"
   strings:
      $s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
      $s2 = "rundll32.exe %s,Startup" fullword ascii
      $s3 = "nvsvcs.dll" fullword wide
      $s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
      $s5 = "http://www.sginternet.net 0" fullword ascii
      $s6 = "Microsoft Corporation. All rights reserved." fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 80KB and (
         pe.exports("SvcServiceMain") and
         5 of them
      )
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_13
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "75f201aa8b18e1c4f826b2fe0963b84f"

Full rule:
rule MAL_BurningUmbrella_Sample_13 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
      hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
      id = "38c73425-bbdd-5b74-8ad4-5e0052039dd8"
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "75f201aa8b18e1c4f826b2fe0963b84f"
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_14
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Pattern signatures:
$s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
      /* $s2 = "Kernel.dll" fullword ascii */

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and 1 of them

Full rule:
rule MAL_BurningUmbrella_Sample_14 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
      id = "a2b3a4bb-ca60-5dc2-8124-17e654e326b8"
   strings:
      $s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
      /* $s2 = "Kernel.dll" fullword ascii */
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and 1 of them
}
YARA Detection Rule: MAL_BurningUmbrella_Sample_15
Repository: Neo23x0/signature-base
Detects: Detects malware sample from Burning Umbrella report
Author: Florian Roth (Nextron Systems)
Reference: https://401trg.pw/burning-umbrella/

Detection condition:
uint16(0) == 0x5a4d and filesize < 50KB and pe.imphash() == "cc33b1500354cf785409a3b428f7cd2a"

Full rule:
rule MAL_BurningUmbrella_Sample_15 {
   meta:
      description = "Detects malware sample from Burning Umbrella report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://401trg.pw/burning-umbrella/"
      date = "2018-05-04"
      hash1 = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
      hash2 = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
      hash3 = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
      hash4 = "1a4a64f01b101c16e8b5928b52231211e744e695f125e056ef7a9412da04bb91"
      hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
      id = "4dc840c1-e6fa-5b21-bfcd-ef07cd85272a"
   condition:
      uint16(0) == 0x5a4d and filesize < 50KB and pe.imphash() == "cc33b1500354cf785409a3b428f7cd2a"
}