deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: malware_apt15_bs2005
Repository: Neo23x0/signature-base
Detects: APT15 bs2005
Author: Ahmed Zaki

Pattern signatures:
$ = "%s&%s&%s&%s" wide ascii
      $ = "%s\\%s" wide ascii fullword
      $ = "WarOnPostRedirect"  wide ascii fullword
      $ = "WarnonZoneCrossing"  wide ascii fullword
      $ = "^^^^^" wide ascii fullword
      $ =  /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/
      $ ="IEharden" wide ascii fullword
      $ ="DEPOff" wide ascii fullword
      $ ="ShownVerifyBalloon" wide ascii fullword
      $ ="IEHardenIENoWarn" wide ascii fullword

Detection condition:
( uint16(0) == 0x5A4D and 5 of them ) or
      ( uint16(0) == 0x5A4D and 3 of them and
            ( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and
              pe.imports("ole32.dll", "CoCreateInstance")
            )
      )

Full rule:
rule malware_apt15_bs2005{
   meta:
      author = "Ahmed Zaki"
      md5 = "ed21ce2beee56f0a0b1c5a62a80c128b"
      description = "APT15 bs2005"
   strings:
      $ = "%s&%s&%s&%s" wide ascii
      $ = "%s\\%s" wide ascii fullword
      $ = "WarOnPostRedirect"  wide ascii fullword
      $ = "WarnonZoneCrossing"  wide ascii fullword
      $ = "^^^^^" wide ascii fullword
      $ =  /"?%s\s*"?\s*\/C\s*"?%s\s*>\s*\\?"?%s\\(\w+\.\w+)?"\s*2>&1\s*"?/
      $ ="IEharden" wide ascii fullword
      $ ="DEPOff" wide ascii fullword
      $ ="ShownVerifyBalloon" wide ascii fullword
      $ ="IEHardenIENoWarn" wide ascii fullword
   condition:
      ( uint16(0) == 0x5A4D and 5 of them ) or
      ( uint16(0) == 0x5A4D and 3 of them and
            ( pe.imports("advapi32.dll", "CryptDecrypt") and pe.imports("advapi32.dll", "CryptEncrypt") and
              pe.imports("ole32.dll", "CoCreateInstance")
            )
      )
}
YARA Detection Rule: malware_apt15_royaldll
Repository: Neo23x0/signature-base
Detects: DLL implant, originally rights.dll and runs as a service
Author: David Cannings

Pattern signatures:
/*
      56                push    esi
      B8 A7 C6 67 4E    mov     eax, 4E67C6A7h
      83 C1 02          add     ecx, 2
      BA 04 00 00 00    mov     edx, 4
      57                push    edi
      90                nop
      */
      // JSHash implementation (Justin Sobel's hash algorithm)
      $opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }

      /*
      0F B6 1C 03       movzx   ebx, byte ptr [ebx+eax]
      8B 55 08          mov     edx, [ebp+arg_0]
      30 1C 17          xor     [edi+edx], bl
      47                inc     edi
      3B 7D 0C          cmp     edi, [ebp+arg_4]
      72 A4             jb      short loc_10003F31
      */
      // Encode loop, used to "encrypt" data before DNS request
      $opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }

      /*
      68 88 13 00 00    push    5000 # Also seen 3000, included below
      FF D6             call    esi ; Sleep
      4F                dec     edi
      75 F6             jnz

Detection condition:
3 of them

Full rule:
rule malware_apt15_royaldll {
   meta:
      author = "David Cannings"
      description = "DLL implant, originally rights.dll and runs as a service"
      sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
      id = "26baef92-1055-56dc-b274-e2a6bc05d85b"
   strings:
      /*
      56                push    esi
      B8 A7 C6 67 4E    mov     eax, 4E67C6A7h
      83 C1 02          add     ecx, 2
      BA 04 00 00 00    mov     edx, 4
      57                push    edi
      90                nop
      */
      // JSHash implementation (Justin Sobel's hash algorithm)
      $opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }

      /*
      0F B6 1C 03       movzx   ebx, byte ptr [ebx+eax]
      8B 55 08          mov     edx, [ebp+arg_0]
      30 1C 17          xor     [edi+edx], bl
      47                inc     edi
      3B 7D 0C          cmp     edi, [ebp+arg_4]
      72 A4             jb      short loc_10003F31
      */
      // Encode loop, used to "encrypt" data before DNS request
      $opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }

      /*
      68 88 13 00 00    push    5000 # Also seen 3000, included below
      FF D6             call    esi ; Sleep
      4F                dec     edi
      75 F6             jnz     short loc_10001554
      */
      // Sleep loop
      $opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }

      // Generic strings
      $ = "Nwsapagent" fullword
      $ = "\"%s\">>\"%s\"\\s.txt"
      $ = "myWObject" fullword
      $ = "del c:\\windows\\temp\\r.exe /f /q"
      $ = "del c:\\windows\\temp\\r.ini /f /q"

   condition:
      3 of them
}
YARA Detection Rule: malware_apt15_royaldll_2
Repository: Neo23x0/signature-base
Detects: DNS backdoor used by APT15
Author: Ahmed Zaki

Pattern signatures:
$= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
      $= "netsvcs" wide ascii fullword
      $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
      $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
      $= "myWObject" wide ascii

Detection condition:
uint16(0) == 0x5A4D and all of them
      and pe.exports("ServiceMain")
      and filesize > 50KB and filesize < 600KB

Full rule:
rule malware_apt15_royaldll_2 {
   meta:
      author = "Ahmed Zaki"
      sha256 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
      description = "DNS backdoor used by APT15"
      id = "3bc546a5-38b9-5504-b09e-305ba7bbd6bc"
   strings:
      $= "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
      $= "netsvcs" wide ascii fullword
      $= "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
      $= "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
      $= "myWObject" wide ascii
   condition:
      uint16(0) == 0x5A4D and all of them
      and pe.exports("ServiceMain")
      and filesize > 50KB and filesize < 600KB
}
YARA Detection Rule: malware_apt15_exchange_tool
Repository: Neo23x0/signature-base
Detects: This is a an exchange enumeration/hijacking tool used by an APT 15
Author: Ahmed Zaki

Pattern signatures:
$s1= "subjectname" fullword
      $s2= "sendername" fullword
      $s3= "WebCredentials" fullword
      $s4= "ExchangeVersion" fullword
      $s5= "ExchangeCredentials" fullword
      $s6= "slfilename" fullword
      $s7= "EnumMail" fullword
      $s8= "EnumFolder" fullword
      $s9= "set_Credentials" fullword
      $s18 = "/v or /t is null" wide
      $s24 = "2013sp1" wide

Detection condition:
uint16(0) == 0x5A4D and all of them

Full rule:
rule malware_apt15_exchange_tool {
   meta:
      author = "Ahmed Zaki"
      md5 = "d21a7e349e796064ce10f2f6ede31c71"
      description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
      id = "f07b9537-0741-51c8-a9fa-836430fe4855"
   strings:
      $s1= "subjectname" fullword
      $s2= "sendername" fullword
      $s3= "WebCredentials" fullword
      $s4= "ExchangeVersion" fullword
      $s5= "ExchangeCredentials" fullword
      $s6= "slfilename" fullword
      $s7= "EnumMail" fullword
      $s8= "EnumFolder" fullword
      $s9= "set_Credentials" fullword
      $s18 = "/v or /t is null" wide
      $s24 = "2013sp1" wide
   condition:
      uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: malware_apt15_generic
Repository: Neo23x0/signature-base
Detects: Find generic data potentially relating to AP15 tools
Author: David Cannings

Pattern signatures:
// Appears to be from copy/paste code
       $str01 = "myWObject" fullword
       $str02 = "myRObject" fullword

       /*
         6A 02             push    2               ; dwCreationDisposition
         6A 00             push    0               ; lpSecurityAttributes
         6A 00             push    0               ; dwShareMode
         68 00 00 00 C0    push    0C0000000h      ; dwDesiredAccess
         50                push    eax             ; lpFileName
         FF 15 44 F0 00 10 call    ds:CreateFileA
       */
       // Arguments for CreateFileA
       $opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }

Detection condition:
2 of them

Full rule:
rule malware_apt15_generic {
   meta:
      author = "David Cannings"
      description = "Find generic data potentially relating to AP15 tools"
      id = "4eb50731-22df-5f7a-bf5f-166ef84cf8b5"
   strings:
       // Appears to be from copy/paste code
       $str01 = "myWObject" fullword
       $str02 = "myRObject" fullword

       /*
         6A 02             push    2               ; dwCreationDisposition
         6A 00             push    0               ; lpSecurityAttributes
         6A 00             push    0               ; dwShareMode
         68 00 00 00 C0    push    0C0000000h      ; dwDesiredAccess
         50                push    eax             ; lpFileName
         FF 15 44 F0 00 10 call    ds:CreateFileA
       */
       // Arguments for CreateFileA
       $opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
   condition:
      2 of them
}
YARA Detection Rule: Trojan_Win32_PlaSrv
Repository: Neo23x0/signature-base
Detects: Hotpatching Injector
Author: Microsoft

Pattern signatures:
$Section_name = ".hotp1"
		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }

Detection condition:
$Section_name and $offset_x59

Full rule:
rule Trojan_Win32_PlaSrv : Platinum
{
	meta:
		author = "Microsoft"
		description = "Hotpatching Injector"
		original_sample_sha1 = "ff7f949da665ba8ce9fb01da357b51415634eaad"
		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "2a099b68-fb13-5926-8a86-4d788326609c"
	strings:
		$Section_name = ".hotp1"
		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
	
	condition:
		$Section_name and $offset_x59
}
YARA Detection Rule: Trojan_Win32_Platual
Repository: Neo23x0/signature-base
Detects: Installer component
Author: Microsoft

Pattern signatures:
$class_name = "AVCObfuscation"
		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }

Detection condition:
$class_name and $scrambled_dir

Full rule:
rule Trojan_Win32_Platual : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "ac963388-cc73-5842-96be-77349398efcc"
	strings:
		$class_name = "AVCObfuscation"
		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }

	condition:
		$class_name and $scrambled_dir
}
YARA Detection Rule: Trojan_Win32_Plaplex
Repository: Neo23x0/signature-base
Detects: Variant of the JPin backdoor
Author: Microsoft

Pattern signatures:
$class_name1 = "AVCObfuscation"
		$class_name2 = "AVCSetiriControl"

Detection condition:
$class_name1 and $class_name2

Full rule:
rule Trojan_Win32_Plaplex : Platinum
{
	meta:
		author = "Microsoft"
		description = "Variant of the JPin backdoor"
		original_sample_sha1 = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"
	strings:
		$class_name1 = "AVCObfuscation"
		$class_name2 = "AVCSetiriControl"

	condition:
		$class_name1 and $class_name2
}
YARA Detection Rule: Trojan_Win32_Dipsind_B
Repository: Neo23x0/signature-base
Detects: Dipsind Family
Author: Microsoft

Pattern signatures:
$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}

Detection condition:
$frg1 and $frg2 and $frg3

Full rule:
rule Trojan_Win32_Dipsind_B : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind Family"
		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"
	strings:
		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}

	condition:
		$frg1 and $frg2 and $frg3
}
YARA Detection Rule: Trojan_Win32_PlaKeylog_B
Repository: Neo23x0/signature-base
Detects: Keylogger component
Author: Microsoft

Pattern signatures:
$hook = {C6 06 FF 46 C6 06 25}
		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

Detection condition:
$hook and $dasm_engine

Full rule:
rule Trojan_Win32_PlaKeylog_B : Platinum
{
	meta:
		author = "Microsoft"
		description = "Keylogger component"
		original_sample_sha1 = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
	strings:
		$hook = {C6 06 FF 46 C6 06 25}
		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}

	condition:
		$hook and $dasm_engine
}
YARA Detection Rule: Trojan_Win32_Adupib
Repository: Neo23x0/signature-base
Detects: Adupib SSL Backdoor
Author: Microsoft

Pattern signatures:
$str1 = "POLL_RATE"
		$str2 = "OP_TIME(end hour)"
		$str3 = "%d:TCP:*:Enabled"
		$str4 = "%s[PwFF_cfg%d]"
		$str5 = "Fake_GetDlgItemTextW: ***value***="

Detection condition:
$str1 and $str2 and $str3 and $str4 and $str5

Full rule:
rule Trojan_Win32_Adupib : Platinum
{
	meta:
		author = "Microsoft"
		description = "Adupib SSL Backdoor"
		original_sample_sha1 = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "fb3b10a4-66d7-50ec-b6a5-b3c5c382ef01"
	strings:
		$str1 = "POLL_RATE"
		$str2 = "OP_TIME(end hour)"
		$str3 = "%d:TCP:*:Enabled"
		$str4 = "%s[PwFF_cfg%d]"
		$str5 = "Fake_GetDlgItemTextW: ***value***="

	condition:
		$str1 and $str2 and $str3 and $str4 and $str5
}
YARA Detection Rule: Trojan_Win32_PlaLsaLog
Repository: Neo23x0/signature-base
Detects: Loader / possible incomplete LSA Password Filter
Author: Microsoft

Pattern signatures:
$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
		$str2 = "PasswordChangeNotify"

Detection condition:
$str1 and $str2

Full rule:
rule Trojan_Win32_PlaLsaLog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Loader / possible incomplete LSA Password Filter"
		original_sample_sha1 = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"
	strings:
		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
		$str2 = "PasswordChangeNotify"

	condition:
		$str1 and $str2
}
YARA Detection Rule: Trojan_Win32_Plagon
Repository: Neo23x0/signature-base
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = "VPLRXZHTU"
		$str2 = {64 6F 67 32 6A 7E 6C}
		$str3 = "Dqpqftk(Wou\"Isztk)"
		$str4 = "StartThreadAtWinLogon"

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plagon : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "48b89f61d58b57dba6a0ca857bce97bab636af65"
		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"
	strings:
		$str1 = "VPLRXZHTU"
		$str2 = {64 6F 67 32 6A 7E 6C}
		$str3 = "Dqpqftk(Wou\"Isztk)"
		$str4 = "StartThreadAtWinLogon"

	condition:
		$str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Plakelog
Repository: Neo23x0/signature-base
Detects: Raw-input based keylogger
Author: Microsoft

Pattern signatures:
$str1 = "<0x02>" wide
		$str2 = "[CTR-BRK]" wide
		$str3 = "[/WIN]" wide
		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Plakelog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Raw-input based keylogger"
		original_sample_sha1 = "3907a9e41df805f912f821a47031164b6636bd04"
		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"
	strings:
		$str1 = "<0x02>" wide
		$str2 = "[CTR-BRK]" wide
		$str3 = "[/WIN]" wide
		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}

	condition:
		$str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Plainst
Repository: Neo23x0/signature-base
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}

Detection condition:
$str1 and $str2

Full rule:
rule Trojan_Win32_Plainst : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"
	strings:
		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
		$str2 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}

	condition:
		$str1 and $str2
}
YARA Detection Rule: Trojan_Win32_Plagicom
Repository: Neo23x0/signature-base
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
00}
		$str2 = "OUEMM/EMM"
		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plagicom : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		original_sample_sha1 = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc[PII_REDACTED]a7"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"
	strings:
		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ??
00}
		$str2 = "OUEMM/EMM"
		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plaklog
Repository: Neo23x0/signature-base
Detects: Hook-based keylogger
Author: Microsoft

Pattern signatures:
$str1 = "++[%s^^unknown^^%s]++"
		$str2 = "vtfs43/emm"
		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plaklog : Platinum
{
	meta:
		author = "Microsoft"
		description = "Hook-based keylogger"
		original_sample_sha1 = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"
	strings:
		$str1 = "++[%s^^unknown^^%s]++"
		$str2 = "vtfs43/emm"
		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plapiio
Repository: Neo23x0/signature-base
Detects: JPin backdoor
Author: Microsoft

Pattern signatures:
$str1 = "ServiceMain"
		$str2 = "Startup"
		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plapiio : Platinum
{
	meta:
		author = "Microsoft"
		description = "JPin backdoor"
		original_sample_sha1 = "3119de80088c52bd[PII_REDACTED]847cd984606c88"
		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"
	strings:
		$str1 = "ServiceMain"
		$str2 = "Startup"
		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Plabit
Repository: Neo23x0/signature-base
Detects: Installer component
Author: Microsoft

Pattern signatures:
$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
		$str2 = "GetInstanceW"
		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Plabit : Platinum
{
	meta:
		author = "Microsoft"
		description = "Installer component"
		sample_sha1 = "6d1169775a[PII_REDACTED]31f9385135d385efd166"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"
	strings:
		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
		$str2 = "GetInstanceW"
		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}

	condition:
		$str1 and $str2 and $str3
}
YARA Detection Rule: Trojan_Win32_Placisc2
Repository: Neo23x0/signature-base
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
		$str2 = "VPLRXZHTU"
		$str3 = "%d) Command:%s"
		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}

Detection condition:
$str1 and $str2 and $str3 and $str4

Full rule:
rule Trojan_Win32_Placisc2 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "a5557cfa-354c-5913-9b63-f53ffb294796"
	strings:
		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA}
		$str2 = "VPLRXZHTU"
		$str3 = "%d) Command:%s"
		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}

	condition:
		$str1 and $str2 and $str3 and $str4
}
YARA Detection Rule: Trojan_Win32_Placisc3
Repository: Neo23x0/signature-base
Detects: Dipsind variant
Author: Microsoft

Pattern signatures:
$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
		$str2 = "VPLRXZHTU"
		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}

Detection condition:
$str1 and $str2 and $str3

Full rule:
rule Trojan_Win32_Placisc3 : Platinum
{
	meta:
		author = "Microsoft"
		description = "Dipsind variant"
		original_sample_sha1 = "1b542dd0dacfcd[PII_REDACTED]709f5fa9683cdcda"
		unpacked_sample_sha1 = "bbd4992ee3f3a[PII_REDACTED]636359cf94fb4575d"
		activity_group = "Platinum"
		version = "1.0"
		last_modified = "2016-04-12"

		id = "f2[PII_REDACTED]-5042-9086-fb77aebd147f"
	strings:
		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
		$str2 = "VPLRXZHTU"
		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}

	condition:
		$str1 and $str2 and $str3
}