deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_Fake_Document_Software_Indicators_Nov23
Repository: Neo23x0/signature-base
Detects: Detects indicators of fake document/image utility software that acts as a downloader for additional malware
Author: Jonathan Peters
Reference: https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html

Pattern signatures:
$ = "tweakscode.com" wide
      $ = "www.createmygif.com" wide
      $ = "www.videownload.com" wide
      $ = "www.pdfconverterz.com" wide
      $ = "www.pdfconvertercompare.com" wide

Detection condition:
uint16(0) == 0x5a4d
      and 1 of them

Full rule:
rule MAL_Fake_Document_Software_Indicators_Nov23 {
   meta:
      description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
      author = "Jonathan Peters"
      date = "2023-11-13"
      reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
      hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
      hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
      score = 80
      id = "231474cd-1ec9-5738-bf48-ef707689056d"
   strings:
      $ = "tweakscode.com" wide
      $ = "www.createmygif.com" wide
      $ = "www.videownload.com" wide
      $ = "www.pdfconverterz.com" wide
      $ = "www.pdfconvertercompare.com" wide
   condition:
      uint16(0) == 0x5a4d
      and 1 of them
}
YARA Detection Rule: SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious tiny ZIP files with phishing attachment characteristics
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$sl1 = ".lnk"

Detection condition:
uint16(0) == 0x4b50 and 
      filesize < 2KB and 
      $sl1 in (filesize-256..filesize)

Full rule:
rule SUSP_ZIP_LNK_PhishAttachment_Pattern_Jun22_1 {
   meta:
      description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2022-06-23"
      score = 65
      hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
      hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
      hash3 = "9c70eeac[PII_REDACTED]5ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
      hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
      hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
      id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"
   strings:
      $sl1 = ".lnk" 
   condition:
      uint16(0) == 0x4b50 and 
      filesize < 2KB and 
      $sl1 in (filesize-256..filesize)
}
YARA Detection Rule: SUSP_ZIP_ISO_PhishAttachment_Pattern_Jun22_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$pkzip_base64_1 = { 0A 55 45 73 44 42 }
      $pkzip_base64_2 = { 0A 55 45 73 44 42 }
      $pkzip_base64_3 = { 0A 55 45 73 48 43 }

      $iso_1 = "Lmlzb1BL"
      $iso_2 = "5pc29QS"
      $iso_3 = "uaXNvUE"

Detection condition:
filesize < 2000KB and 1 of ($pk*) and 1 of ($iso*)

Full rule:
rule SUSP_ZIP_ISO_PhishAttachment_Pattern_Jun22_1 {
   meta:
      description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2022-06-23"
      score = 65
      id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
   strings:
      $pkzip_base64_1 = { 0A 55 45 73 44 42 }
      $pkzip_base64_2 = { 0A 55 45 73 44 42 }
      $pkzip_base64_3 = { 0A 55 45 73 48 43 }

      $iso_1 = "Lmlzb1BL"
      $iso_2 = "5pc29QS"
      $iso_3 = "uaXNvUE"
   condition:
      filesize < 2000KB and 1 of ($pk*) and 1 of ($iso*)
}
YARA Detection Rule: BTC_Miner_lsass1_chrome_2
Repository: Neo23x0/signature-base
Detects: Detects a Bitcoin Miner
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - CN Actor

Pattern signatures:
$x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
      $x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 6000KB and 1 of them )

Full rule:
rule BTC_Miner_lsass1_chrome_2 {
   meta:
      description = "Detects a Bitcoin Miner"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - CN Actor"
      date = "2017-06-22"
      super_rule = 1
      score = 60
      hash1 = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
      hash2 = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c[PII_REDACTED]a6e8"
      id = "7960d96a-7bd3-5135-867d-e39a02274c45"
   strings:
      $x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
      $x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 6000KB and 1 of them )
}
YARA Detection Rule: CN_Actor_RA_Tool_Ammyy_mscorsvw
Repository: Neo23x0/signature-base
Detects: Detects Ammyy remote access tool
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - CN Actor

Pattern signatures:
$s1 = "Please enter password for accessing remote computer" fullword ascii
      $s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
      $s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )

Full rule:
rule CN_Actor_RA_Tool_Ammyy_mscorsvw {
   meta:
      description = "Detects Ammyy remote access tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - CN Actor"
      date = "2017-06-22"
      hash1 = "1831806fc27d496f0f9dcfd[PII_REDACTED]deaeb5f8bcf0118f3d6484d0bdee9ed"
      hash2 = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
      id = "71a0c5a9-b4dc-508d-a6b7-4b85b75bc34b"
   strings:
      $s1 = "Please enter password for accessing remote computer" fullword ascii
      $s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
      $s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and 3 of them )
}
YARA Detection Rule: CN_Actor_AmmyyAdmin
Repository: Neo23x0/signature-base
Detects: Detects Ammyy Admin Downloader
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - CN Actor

Pattern signatures:
$x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule CN_Actor_AmmyyAdmin {
   meta:
      description = "Detects Ammyy Admin Downloader"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - CN Actor"
      date = "2017-06-22"
      score = 60
      hash1 = "1831806fc27d496f0f9dcfd[PII_REDACTED]deaeb5f8bcf0118f3d6484d0bdee9ed"
      id = "08ffb61a-e2de-538e-9d9f-040276324af9"
   strings:
      $x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: WinDivert_Driver
Repository: Neo23x0/signature-base
Detects: Detects WinDivert User-Mode packet capturing driver
Author: Florian Roth (Nextron Systems)
Reference: https://www.reqrypt.org/windivert.html

Pattern signatures:
$s1 = "WinDivertDllEntry" fullword ascii
      $s2 = "WinDivertHelperParseIPv4Address" fullword ascii
      $s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )

Full rule:
rule WinDivert_Driver {
   meta:
      description = "Detects WinDivert User-Mode packet capturing driver"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.reqrypt.org/windivert.html"
      date = "2017-10-02"
      score = 40
      hash1 = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
      hash2 = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d[PII_REDACTED]d18da3858"
      hash3 = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
      hash4 = "df12afa691e529f01c75b3dd734f6b45bf1488dbf90ced218657f0d205bff319"
      id = "95e89577-bb5a-5391-9130-155746d4783f"
   strings:
      $s1 = "WinDivertDllEntry" fullword ascii
      $s2 = "WinDivertHelperParseIPv4Address" fullword ascii
      $s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and 1 of them )
}
YARA Detection Rule: APT_SideWinder_NET_Loader_Aug_2020_1
Repository: Neo23x0/signature-base
Detects: Detected the NET loader used by SideWinder group (August 2020)
Author: Arkbird_SOLG
Reference: https://twitter.com/ShadowChasing1/status/[PII_REDACTED]47598852

Pattern signatures:
$a1 = "DUSER.dll" fullword wide
      
      $s1 = "UHJvZ3JhbQ==" fullword wide // base64 encoded string -> 'Program' -> Invoke call decoded PE
      $s2 = "U3RhcnQ=" fullword wide 
      $s3 = ".tmp           " fullword wide
      $s4 = "FileRipper" fullword ascii
      $s5 = "copytight @" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 4KB and $a1 and 3 of ($s*)

Full rule:
rule APT_SideWinder_NET_Loader_Aug_2020_1 {
   meta:
      description = "Detected the NET loader used by SideWinder group (August 2020)"
      author = "Arkbird_SOLG"
      reference = "https://twitter.com/ShadowChasing1/status/[PII_REDACTED]47598852"
      date = "2020-08-24"
      hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
      id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
   strings:
      $a1 = "DUSER.dll" fullword wide
      
      $s1 = "UHJvZ3JhbQ==" fullword wide // base64 encoded string -> 'Program' -> Invoke call decoded PE
      $s2 = "U3RhcnQ=" fullword wide 
      $s3 = ".tmp           " fullword wide
      $s4 = "FileRipper" fullword ascii
      $s5 = "copytight @" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 4KB and $a1 and 3 of ($s*)
}
YARA Detection Rule: APT_MAL_SideWinder_implant
Repository: Neo23x0/signature-base
Detects: Detects SideWinder final payload
Author: AT&T Alien Labs
Reference: https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt

Pattern signatures:
$code= { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
               02 28 21 00 00 06 02 7B 12 00 00 04 16 }

      $strings = { 
         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
         65 00 64 00 46 00 69 00 6C 00 65 00 73
      }

Detection condition:
uint16(0) == 0x5A4D and all of them

Full rule:
rule APT_MAL_SideWinder_implant {
   meta:
      author = "AT&T Alien Labs"
      description = "Detects SideWinder final payload"
      hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
      reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
      id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
   strings:
      $code= { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
               02 28 21 00 00 06 02 7B 12 00 00 04 16 }

      $strings = { 
         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
         65 00 64 00 46 00 69 00 6C 00 65 00 73
      }
   condition:
      uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20121
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20121.xml
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20121.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii

Detection condition:
9 of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20121 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20121.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"
	strings:
		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
		$s1 = "<name>20121.dll</name>" fullword ascii
		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<platform type=\"1\">" fullword ascii
		$s5 = "</plugin>" fullword ascii
		$s6 = "</pluginConfig>" fullword ascii
		$s7 = "<pluginConfig>" fullword ascii
		$s8 = "</platform>" fullword ascii
		$s9 = "</lpConfig>" fullword ascii
		$s10 = "<lpConfig>" fullword ascii
	condition:
		9 of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20123_sys
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20123.sys.bin
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "20123.dll" fullword ascii
		$s1 = "kbdclass.sys" fullword wide
		$s2 = "IoFreeMdl" fullword ascii
		$s3 = "ntoskrnl.exe" fullword ascii
		$s4 = "KfReleaseSpinLock" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20123_sys {
	meta:
		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
		id = "0d0e3642-f5d4-59b2-8e56-a7c999e34775"
	strings:
		$s0 = "20123.dll" fullword ascii
		$s1 = "kbdclass.sys" fullword wide
		$s2 = "IoFreeMdl" fullword ascii
		$s3 = "ntoskrnl.exe" fullword ascii
		$s4 = "KfReleaseSpinLock" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20123_cmdDef
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20123_cmdDef.xml
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
		$s2 = "<commands/>" fullword ascii
		$s3 = "</version>" fullword ascii
		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
		$s9 = "<minorType>0</minorType>" fullword ascii
		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
		$s11 = "</comments>" fullword ascii
		$s12 = "<comments>" fullword ascii
		$s13 = "<majorType>1</majorType>" fullword ascii
		$s14 = "<files>None</files>" fullword ascii
		$s15 = "<poc>Erebus</poc>" fullword ascii
		$s16 = "</plugin>" ful

Detection condition:
14 of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef {
	meta:
		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
		id = "88a29288-9db5-5437-9efe-cdb823a2b928"
	strings:
		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
		$s2 = "<commands/>" fullword ascii
		$s3 = "</version>" fullword ascii
		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
		$s9 = "<minorType>0</minorType>" fullword ascii
		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
		$s11 = "</comments>" fullword ascii
		$s12 = "<comments>" fullword ascii
		$s13 = "<majorType>1</majorType>" fullword ascii
		$s14 = "<files>None</files>" fullword ascii
		$s15 = "<poc>Erebus</poc>" fullword ascii
		$s16 = "</plugin>" fullword ascii
		$s17 = "<team>None</team>" fullword ascii
		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
	condition:
		14 of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20121_dll
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20121.dll.bin
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
		$s1 = "20121.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20121_dll {
	meta:
		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "89504d91c5539a366e153894c1bc[PII_REDACTED]b"
		id = "a0dc146c-85fd-55b8-a5e0-bfc1f406507e"
	strings:
		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
		$s1 = "20121.dll" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20123
Repository: Neo23x0/signature-base
Detects: FiveEyes QUERTY Malware - file 20123.xml
Author: Florian Roth (Nextron Systems)
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
		$s2 = "<name>20123.sys</name>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
		$s5 = "<platform type=\"1\">" fullword ascii
		$s6 = "</plugin>" fullword ascii
		$s7 = "</pluginConfig>" fullword ascii
		$s8 = "<pluginConfig>" fullword ascii
		$s9 = "</platform>" fullword ascii
		$s10 = "</lpConfig>" fullword ascii
		$s11 = "<lpConfig>" fullword ascii

Detection condition:
9 of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20123 {
	meta:
		description = "FiveEyes QUERTY Malware - file 20123.xml"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.spiegel.de/media/media-35668.pdf"
		date = "2015/01/18"
		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"
	strings:
		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
		$s2 = "<name>20123.sys</name>" fullword ascii
		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
		$s5 = "<platform type=\"1\">" fullword ascii
		$s6 = "</plugin>" fullword ascii
		$s7 = "</pluginConfig>" fullword ascii
		$s8 = "<pluginConfig>" fullword ascii
		$s9 = "</platform>" fullword ascii
		$s10 = "</lpConfig>" fullword ascii
		$s11 = "<lpConfig>" fullword ascii
	condition:
		9 of them
}