deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: is__str_Rebirth_gen3
Repository: Yara-Rules/rules
Detects: Generic detection for Vulcan branch Rebirth or Katrina from Torlus nextgen
Author: unixfreaxjp
Reference: https://www.reddit.com/r/LinuxMalware/comments/7rprnx/vulcan_aka_linuxrebirth_or_katrina_variant_of/

Pattern signatures:
$str01 = "/usr/bin/python" fullword nocase wide ascii
        	$str02 = "nameserver 8.8.8.8\nnameserver 8.8.4.4\n" fullword nocase wide ascii
        	$str03 = "Telnet Range %d->%d" fullword nocase wide ascii
        	$str04 = "Mirai Range %d->%d" fullword nocase wide ascii
        	$str05 = "[Updating] [%s:%s]" fullword nocase wide ascii
        	$str06 = "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*" fullword nocase wide ascii
		$str07 = "\x1B[96m[DEVICE] \x1B[97mConnected" fullword nocase wide ascii

Detection condition:
4 of them

Full rule:
private rule is__str_Rebirth_gen3 {
	meta:
		description = "Generic detection for Vulcan branch Rebirth or Katrina from Torlus nextgen"
		reference = "https://imgur.com/a/SSKmu"
		reference = "https://www.reddit.com/r/LinuxMalware/comments/7rprnx/vulcan_aka_linuxrebirth_or_katrina_variant_of/"
		author = "unixfreaxjp"
		org = "MalwareMustDie"
		date = "2018-01-21"
	strings:
        	$str01 = "/usr/bin/python" fullword nocase wide ascii
        	$str02 = "nameserver 8.8.8.8\nnameserver 8.8.4.4\n" fullword nocase wide ascii
        	$str03 = "Telnet Range %d->%d" fullword nocase wide ascii
        	$str04 = "Mirai Range %d->%d" fullword nocase wide ascii
        	$str05 = "[Updating] [%s:%s]" fullword nocase wide ascii
        	$str06 = "rm -rf /tmp/* /var/* /var/run/* /var/tmp/*" fullword nocase wide ascii
		$str07 = "\x1B[96m[DEVICE] \x1B[97mConnected" fullword nocase wide ascii
	condition:
        	4 of them
}
YARA Detection Rule: is__hex_Rebirth_gen3
Repository: Yara-Rules/rules
Author: unixfreaxjp

Pattern signatures:
$hex01 = { 0D C0 A0 E1 00 D8 2D E9 }
		$hex02 = { 3C 1C 00 06 27 9C 97 98 }
		$hex03 = { 94 21 EF 80 7C 08 02 A6 }
		$hex04 = { E6 2F 22 4F 76 91 18 3F }
		$hex05 = { 06 00 1C 3C 20 98 9C 27 }
		$hex06 = { 55 89 E5 81 EC ?? 10 00 }
		$hex07 = { 55 48 89 E5 48 81 EC 90 }
		$hex08 = { 6F 67 69 6E 00 }

Detection condition:
2 of them

Full rule:
private rule is__hex_Rebirth_gen3 {
	meta:
		author = "unixfreaxjp"
		date = "2018-01-21"
	strings:
		$hex01 = { 0D C0 A0 E1 00 D8 2D E9 }
		$hex02 = { 3C 1C 00 06 27 9C 97 98 }
		$hex03 = { 94 21 EF 80 7C 08 02 A6 }
		$hex04 = { E6 2F 22 4F 76 91 18 3F }
		$hex05 = { 06 00 1C 3C 20 98 9C 27 }
		$hex06 = { 55 89 E5 81 EC ?? 10 00 }
		$hex07 = { 55 48 89 E5 48 81 EC 90 }
		$hex08 = { 6F 67 69 6E 00 }
	condition:
        	2 of them 
}
YARA Detection Rule: is__bot_Rebirth_gen3
Repository: Yara-Rules/rules
Author: unixfreaxjp

Pattern signatures:
$bot01 = "MIRAITEST" fullword nocase wide ascii
        	$bot02 = "TELNETTEST" fullword nocase wide ascii
        	$bot03 = "UPDATE" fullword nocase wide ascii
        	$bot04 = "PHONE" fullword nocase wide ascii
        	$bot05 = "RANGE" fullword nocase wide ascii
		$bot06 = "KILLATTK" fullword nocase wide ascii
		$bot07 = "STD" fullword nocase wide ascii
        	$bot08 = "BCM" fullword nocase wide ascii
		$bot09 = "NETIS" fullword nocase wide ascii
		$bot10 = "FASTLOAD" fullword nocase wide ascii

Detection condition:
6 of them

Full rule:
private rule is__bot_Rebirth_gen3 {
	meta:
		author = "unixfreaxjp"
		date = "2018-01-21"
	strings:
        	$bot01 = "MIRAITEST" fullword nocase wide ascii
        	$bot02 = "TELNETTEST" fullword nocase wide ascii
        	$bot03 = "UPDATE" fullword nocase wide ascii
        	$bot04 = "PHONE" fullword nocase wide ascii
        	$bot05 = "RANGE" fullword nocase wide ascii
		$bot06 = "KILLATTK" fullword nocase wide ascii
		$bot07 = "STD" fullword nocase wide ascii
        	$bot08 = "BCM" fullword nocase wide ascii
		$bot09 = "NETIS" fullword nocase wide ascii
		$bot10 = "FASTLOAD" fullword nocase wide ascii
	condition:
        	6 of them
}
YARA Detection Rule: MALW_Rebirth_Vulcan_ELF
Repository: Yara-Rules/rules
Detects: Just adjust or omit below two strings for next version they code :) @unixfreaxjp

Pattern signatures:
$spec01 = "vulcan.sh" fullword nocase wide ascii
		$spec02 = "Vulcan" fullword nocase wide ascii

Detection condition:
all of them
		and is__elf
		and is__str_Rebirth_gen3
		and is__hex_Rebirth_gen3
		and is__bot_Rebirth_gen3
		and filesize < 300KB

Full rule:
rule MALW_Rebirth_Vulcan_ELF {
	meta:
		description = "Detects Rebirth Vulcan variant a torlus NextGen MALW"
		description = "Just adjust or omit below two strings for next version they code :) @unixfreaxjp"
		date = "2018-01-21"
	strings:
                $spec01 = "vulcan.sh" fullword nocase wide ascii
		$spec02 = "Vulcan" fullword nocase wide ascii
	condition:
                all of them
		and is__elf
		and is__str_Rebirth_gen3
		and is__hex_Rebirth_gen3
		and is__bot_Rebirth_gen3
		and filesize < 300KB 
}
YARA Detection Rule: APT_bestia
Repository: Yara-Rules/rules
Detects: Bestia.3.02.012.07 malware used in APT attacks on Polish government
Author: Adam Ziaja <adam@adamziaja.com> http://adamziaja.com

Pattern signatures:
/* generated with https://github.com/Xen0ph0n/YaraGenerator */
    $string0 = "u4(UeK"
    $string1 = "nMiq/'p"
    $string2 = "_9pJMf"
    $string3 = "ICMP.DLL"
    $string4 = "EG}QAp"
    $string5 = "tsjWj:U"
    $string6 = "FileVersion" wide
    $string7 = "O2nQpp"
    $string8 = "2}W8we"
    $string9 = "ILqkC:l"
    $string10 = "f1yzMk"
    $string11 = "AutoIt v3 Script: 3, 3, 8, 1" wide
    $string12 = "wj<1uH"
    $string13 = "6fL-uD"
    $string14 = "B9Iavo<"
    $string15 = "rUS)sO"
    $string16 = "FJH{_/f"
    $string17 = "3e 03V"

Detection condition:
17 of them

Full rule:
rule APT_bestia
{
meta:
    author = "Adam Ziaja <adam@adamziaja.com> http://adamziaja.com"
    date = "2014-03-19"
    description = "Bestia.3.02.012.07 malware used in APT attacks on Polish government"
    references = "http://zaufanatrzeciastrona.pl/post/ukierunkowany-atak-na-pracownikow-polskich-samorzadow/" /* PL */
    hash0 = "9bb03bb5af40d1202378f95a6485fba8"
    hash1 = "7d9a806e0da0b869b10870dd6c7692c5"
    maltype = "apt"
    filetype = "exe"
strings:
    /* generated with https://github.com/Xen0ph0n/YaraGenerator */
    $string0 = "u4(UeK"
    $string1 = "nMiq/'p"
    $string2 = "_9pJMf"
    $string3 = "ICMP.DLL"
    $string4 = "EG}QAp"
    $string5 = "tsjWj:U"
    $string6 = "FileVersion" wide
    $string7 = "O2nQpp"
    $string8 = "2}W8we"
    $string9 = "ILqkC:l"
    $string10 = "f1yzMk"
    $string11 = "AutoIt v3 Script: 3, 3, 8, 1" wide
    $string12 = "wj<1uH"
    $string13 = "6fL-uD"
    $string14 = "B9Iavo<"
    $string15 = "rUS)sO"
    $string16 = "FJH{_/f"
    $string17 = "3e 03V"
condition:
    17 of them
}
YARA Detection Rule: ScarhiknStrings
Repository: Yara-Rules/rules
Detects: Scarhikn Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "9887___skej3sd"
        $ = "haha123"

Detection condition:
any of them

Full rule:
rule ScarhiknStrings : Scarhikn Family
{
    meta:
        description = "Scarhikn Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "9887___skej3sd"
        $ = "haha123"
        
    condition:
       any of them
}
YARA Detection Rule: ScarhiknCode
Repository: Yara-Rules/rules
Detects: Scarhikn code features
Author: Seth Hardy

Pattern signatures:
// decryption
        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }

Detection condition:
any of them

Full rule:
rule ScarhiknCode : Scarhikn Family 
{
    meta:
        description = "Scarhikn code features"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
    
    strings:
        // decryption
        $ = { 8B 06 8A 8B ?? ?? ?? ?? 30 0C 38 03 C7 55 43 E8 ?? ?? ?? ?? 3B D8 59 72 E7 }
        $ = { 8B 02 8A 8D ?? ?? ?? ?? 30 0C 30 03 C6 8B FB 83 C9 FF 33 C0 45 F2 AE F7 D1 49 3B E9 72 E2 }
    
    condition:
        any of them
}
YARA Detection Rule: Scarhikn
Repository: Yara-Rules/rules
Detects: Scarhikn
Author: Seth Hardy

Detection condition:
ScarhiknCode or ScarhiknStrings

Full rule:
rule Scarhikn : Family
{
    meta:
        description = "Scarhikn"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    condition:
        ScarhiknCode or ScarhiknStrings
}
YARA Detection Rule: citadel13xy
Repository: Yara-Rules/rules
Detects: Citadel 1.5.x.y trojan banker
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = "Coded by BRIAN KREBS for personnal use only. I love my job & wife."
        $b = "http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x%02x.php"
        $c = "%BOTID%"
        $d = "%BOTNET%"
        $e = "cit_video.module"
        $f = "bc_remove"
        $g = "bc_add"
        $ggurl = "http://www.google.com/webhp"

Detection condition:
3 of them

Full rule:
rule citadel13xy
{
    
    meta:
        author = "Jean-Philippe Teissier / @Jipe_"
        description = "Citadel 1.5.x.y trojan banker"
        date = "2013-01-12" 
        version = "1.0" 
        filetype = "memory"
   
    strings:
        $a = "Coded by BRIAN KREBS for personnal use only. I love my job & wife."
        $b = "http://%02x%02x%02x%02x%02x%02x%02x%02x.com/%02x%02x%02x%02x/%02x%02x%02x%02x%02x.php"
        $c = "%BOTID%"
        $d = "%BOTNET%"
        $e = "cit_video.module"
        $f = "bc_remove"
        $g = "bc_add"
        $ggurl = "http://www.google.com/webhp"

    condition:
        3 of them
}
YARA Detection Rule: Citadel_Malware
Repository: Yara-Rules/rules
Detects: Search for nss3.dll pattern indicating an hexed copy of Citadel malware to work on firefox > v23.0
Author: xylitol@temari.fr

Pattern signatures:
$s1 = "Coded by BRIAN KREBS for personal use only. I love my job & wife" wide ascii
        $s2 = "nss3.dll" wide ascii

        $h1 = {8B C7 EB F5 55 8B EC}
        $h2 = {55 8B EC 83 EC 0C 8A 82 00 01 00 00}
        $h3 = {3D D0 FF 1F 03 77 ?? 83 7D}
        $h4 = {83 F9 66 74 ?? 83 F9 6E 74 ?? 83 F9 76 74 ?? 83 F9 7A}

Detection condition:
all of ($s*) and 2 of ($h*)

Full rule:
rule Citadel_Malware
{
    
    meta:
        author = "xylitol@temari.fr"
        date = "2015-10-08" 
        description = "Search for nss3.dll pattern indicating an hexed copy of Citadel malware to work on firefox > v23.0"
        // May only the challenge guide you
        
    strings:
        $s1 = "Coded by BRIAN KREBS for personal use only. I love my job & wife" wide ascii
        $s2 = "nss3.dll" wide ascii

        $h1 = {8B C7 EB F5 55 8B EC}
        $h2 = {55 8B EC 83 EC 0C 8A 82 00 01 00 00}
        $h3 = {3D D0 FF 1F 03 77 ?? 83 7D}
        $h4 = {83 F9 66 74 ?? 83 F9 6E 74 ?? 83 F9 76 74 ?? 83 F9 7A}

    condition:
        all of ($s*) and 2 of ($h*)
}
YARA Detection Rule: EzcobStrings
Repository: Yara-Rules/rules
Detects: Ezcob Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
        $ = "Ezcob" wide ascii
        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
        $ = "[PII_REDACTED]4935"

Detection condition:
any of them

Full rule:
rule EzcobStrings : Ezcob Family
{
    meta:
        description = "Ezcob Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
        
    strings:
        $ = "\x12F\x12F\x129\x12E\x12A\x12E\x12B\x12A\x12-\x127\x127\x128\x123\x12"
        $ = "\x121\x12D\x128\x123\x12B\x122\x12E\x128\x12-\x12B\x122\x123\x12D\x12"
        $ = "Ezcob" wide ascii
        $ = "l\x12i\x12u\x122\x120\x121\x123\x120\x124\x121\x126"
        $ = "[PII_REDACTED]4935"
        
    condition:
       any of them
}
YARA Detection Rule: Ezcob
Repository: Yara-Rules/rules
Detects: Ezcob
Author: Seth Hardy

Detection condition:
EzcobStrings

Full rule:
rule Ezcob : Family
{
    meta:
        description = "Ezcob"
        author = "Seth Hardy"
        last_modified = "2014-06-23"
        
    condition:
        EzcobStrings
}
YARA Detection Rule: Xtreme
Repository: Yara-Rules/rules
Detects: Xtreme RAT
Author: botherder https://github.com/botherder

Pattern signatures:
$string1 = /(X)tremeKeylogger/ wide ascii
        $string2 = /(X)tremeRAT/ wide ascii
        $string3 = /(X)TREMEUPDATE/ wide ascii
        $string4 = /(S)TUBXTREMEINJECTED/ wide ascii

        $unit1 = /(U)nitConfigs/ wide ascii
        $unit2 = /(U)nitGetServer/ wide ascii
        $unit3 = /(U)nitKeylogger/ wide ascii
        $unit4 = /(U)nitCryptString/ wide ascii
        $unit5 = /(U)nitInstallServer/ wide ascii
        $unit6 = /(U)nitInjectServer/ wide ascii
        $unit7 = /(U)nitBinder/ wide ascii
        $unit8 = /(U)nitInjectProcess/ wide ascii

Detection condition:
5 of them

Full rule:
rule Xtreme
{
    meta:
        description = "Xtreme RAT"
	author = "botherder https://github.com/botherder"

    strings:
        $string1 = /(X)tremeKeylogger/ wide ascii
        $string2 = /(X)tremeRAT/ wide ascii
        $string3 = /(X)TREMEUPDATE/ wide ascii
        $string4 = /(S)TUBXTREMEINJECTED/ wide ascii

        $unit1 = /(U)nitConfigs/ wide ascii
        $unit2 = /(U)nitGetServer/ wide ascii
        $unit3 = /(U)nitKeylogger/ wide ascii
        $unit4 = /(U)nitCryptString/ wide ascii
        $unit5 = /(U)nitInstallServer/ wide ascii
        $unit6 = /(U)nitInjectServer/ wide ascii
        $unit7 = /(U)nitBinder/ wide ascii
        $unit8 = /(U)nitInjectProcess/ wide ascii

    condition:
        5 of them
}
YARA Detection Rule: xtreme_rat
Repository: Yara-Rules/rules
Detects: Xtreme RAT
Author: Kevin Falcoz

Pattern signatures:
$signature1={58 00 54 00 52 00 45 00 4D 00 45} /*X.T.R.E.M.E*/

Detection condition:
$signature1

Full rule:
rule xtreme_rat : Trojan
{
	meta:
		author="Kevin Falcoz"
		date="23/02/2013"
		description="Xtreme RAT"
	
	strings:
		$signature1={58 00 54 00 52 00 45 00 4D 00 45} /*X.T.R.E.M.E*/
		
	condition:
		$signature1
}
YARA Detection Rule: XtremeRATCode
Repository: Yara-Rules/rules
Detects: XtremeRAT code features
Author: Seth Hardy

Pattern signatures:
// call; fstp st
        $ = { E8 ?? ?? ?? ?? DD D8 }
        // hiding string
        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }

Detection condition:
all of them

Full rule:
rule XtremeRATCode : XtremeRAT Family 
{
    meta:
        description = "XtremeRAT code features"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
    
    strings:
        // call; fstp st
        $ = { E8 ?? ?? ?? ?? DD D8 }
        // hiding string
        $ = { C6 85 ?? ?? ?? ?? 4D C6 85 ?? ?? ?? ?? 70 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 62 C6 85 ?? ?? ?? ?? 6D }
    
    condition:
        all of them
}
YARA Detection Rule: XtremeRATStrings
Repository: Yara-Rules/rules
Detects: XtremeRAT Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "dqsaazere"
        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"

Detection condition:
all of them

Full rule:
rule XtremeRATStrings : XtremeRAT Family
{
    meta:
        description = "XtremeRAT Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
        
    strings:
        $ = "dqsaazere"
        $ = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32"
        
    condition:
        all of them
}
YARA Detection Rule: XtremeRAT
Repository: Yara-Rules/rules
Detects: XtremeRAT
Author: Seth Hardy

Detection condition:
XtremeRATCode or XtremeRATStrings

Full rule:
rule XtremeRAT : Family
{
    meta:
        description = "XtremeRAT"
        author = "Seth Hardy"
        last_modified = "2014-07-09"
        
    condition:
        XtremeRATCode or XtremeRATStrings
}
YARA Detection Rule: xtremrat
Repository: Yara-Rules/rules
Detects: Xtrem RAT v3.5
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = "XTREME" wide
		$b = "XTREMEBINDER" wide
		$c = "STARTSERVERBUFFER" wide
		$d = "SOFTWARE\\XtremeRAT" wide
		$e = "XTREMEUPDATE" wide
		$f = "XtremeKeylogger" wide
		$g = "myversion|3.5" wide
		$h = "xtreme rat" wide nocase

Detection condition:
2 of them

Full rule:
rule xtremrat : rat
{
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "Xtrem RAT v3.5"
		date = "2012-07-12" 
		version = "1.0" 
		filetype = "memory"

	strings:
		$a = "XTREME" wide
		$b = "XTREMEBINDER" wide
		$c = "STARTSERVERBUFFER" wide
		$d = "SOFTWARE\\XtremeRAT" wide
		$e = "XTREMEUPDATE" wide
		$f = "XtremeKeylogger" wide
		$g = "myversion|3.5" wide
		$h = "xtreme rat" wide nocase
	condition:
		2 of them
}
YARA Detection Rule: xtreme_rat_0
Repository: Yara-Rules/rules
Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"

Detection condition:
all of them

Full rule:
rule xtreme_rat_0
{ 
	meta:
		maltype = "Xtreme RAT"
		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"
	condition:
		all of them
}
YARA Detection Rule: xtreme_rat_1
Repository: Yara-Rules/rules
Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"

Detection condition:
all of them

Full rule:
rule xtreme_rat_1
{ 
	meta:
		maltype = "Xtreme RAT"
		ref = "https://github.com/reed1713"
		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="5156"
		$data="windows\\system32\\sethc.exe"

		$type1="Microsoft-Windows-Security-Auditing"
		$eventid1="4688"
		$data1="AppData\\Local\\Temp\\Microsoft Word.exe"
	condition:
		all of them
}
YARA Detection Rule: Erebus
Repository: Yara-Rules/rules
Detects: Erebus Ransomware
Author: Joan Soriano / @joanbtl

Pattern signatures:
$a = "/{5f58d6f0-bb9c-46e2-a4da-8ebc746f24a5}//log.log"
		$b = "EREBUS IS BEST."

Detection condition:
all of them

Full rule:
rule Erebus: ransom
{
	meta:
		description = "Erebus Ransomware"
		author = "Joan Soriano / @joanbtl"
		date = "2017-06-23"
		version = "1.0"
		MD5 = "27d857e12b9be5d43f935b8cc86eaabf"
		SHA256 = "0b7996bca486575be15e68dba7cbd802b1e5f90436ba23f802da66292c8a055f"
		ref1 = "http://blog.trendmicro.com/trendlabs-security-intelligence/erebus-resurfaces-as-linux-ransomware/"
	strings:
		$a = "/{5f58d6f0-bb9c-46e2-a4da-8ebc746f24a5}//log.log"
		$b = "EREBUS IS BEST."
	condition:
		all of them
}
YARA Detection Rule: apt_sofacy_xtunnel
Repository: Yara-Rules/rules
Detects: Sofacy Malware - German Bundestag
Author: Claudio Guarnieri

Pattern signatures:
$xaps = ":\\PROJECT\\XAPS_"
        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
        $variant22 = "is you live?"
        $mix1 = "176.31.112.10"
        $mix2 = "error in select, errno %d" $mix3 = "no msg"
        $mix4 = "is you live?"
        $mix5 = "127.0.0.1"
        $mix6 = "err %d"
        $mix7 = "i`m wait"
        $mix8 = "hello"
        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"

Detection condition:
((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*)))

Full rule:
rule apt_sofacy_xtunnel
{

    meta:
        author = "Claudio Guarnieri"
        description = "Sofacy Malware - German Bundestag"
        score = 75

    strings:
        $xaps = ":\\PROJECT\\XAPS_"
        $variant11 = "XAPS_OBJECTIVE.dll" $variant12 = "start"
        $variant21 = "User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0"
        $variant22 = "is you live?"
        $mix1 = "176.31.112.10"
        $mix2 = "error in select, errno %d" $mix3 = "no msg"
        $mix4 = "is you live?"
        $mix5 = "127.0.0.1"
        $mix6 = "err %d"
        $mix7 = "i`m wait"
        $mix8 = "hello"
        $mix9 = "OpenSSL 1.0.1e 11 Feb 2013" $mix10 = "Xtunnel.exe"

    condition:
        ((uint16(0) == 0x5A4D) or (uint16(0) == 0xCFD0)) and (($xaps) or (all of ($variant1*)) or (all of ($variant2*)) or (6 of ($mix*))) 
}
YARA Detection Rule: Sofacy_Bundestag_Winexe
Repository: Yara-Rules/rules
Detects: Winexe tool used by Sofacy group in Bundestag APT
Author: Florian Roth
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "\\\\.\\pipe\\ahexec" fullword ascii 
        $s2 = "implevel" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 115KB and all of them

Full rule:
rule Sofacy_Bundestag_Winexe
{

    meta:
        description = "Winexe tool used by Sofacy group in Bundestag APT"
        author = "Florian Roth"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        hash = "5130f600cd9a9cdc82d4bad938b20cbd2f699aadb76e7f3f1a93602330d9997d"
        score = 70
  
    strings:
        $s1 = "\\\\.\\pipe\\ahexec" fullword ascii 
        $s2 = "implevel" fullword ascii
  
    condition:
        uint16(0) == 0x5a4d and filesize < 115KB and all of them
}
YARA Detection Rule: Sofacy_Bundestag_Mal2
Repository: Yara-Rules/rules
Detects: Sofacy Group Malware Sample 2
Author: Florian Roth
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii
        $s1 = "i`m wait" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1

Full rule:
rule Sofacy_Bundestag_Mal2 
{

    meta:
        description = "Sofacy Group Malware Sample 2"
        author = "Florian Roth"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
        score = 70
   
    strings:
        $x1 = "PROJECT\\XAPS_OBJECTIVE_DLL\\" ascii
        $x2 = "XAPS_OBJECTIVE.dll" fullword ascii
        $s1 = "i`m wait" fullword ascii 
   
    condition:
        uint16(0) == 0x5a4d and ( 1 of ($x*) ) and $s1
}