deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Hacktools_CN_Panda_tesksd
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file tesksd.jpg
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
      $s1 = "ExeMiniDownload.exe" fullword wide
      $s16 = "POST %Hs" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Panda_tesksd {
   meta:
      description = "Disclosed hacktool set - file tesksd.jpg"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
      id = "399ff307-c2e8-57bb-b792-a2c599e8686e"
   strings:
      $s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
      $s1 = "ExeMiniDownload.exe" fullword wide
      $s16 = "POST %Hs" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_Http
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Http.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "RPCRT4.DLL" fullword ascii
      $s1 = "WNetAddConnection2A" fullword ascii
      $s2 = "NdrPointerBufferSize" fullword ascii
      $s3 = "_controlfp" fullword ascii

Detection condition:
all of them and filesize < 10KB

Full rule:
rule Hacktools_CN_Http {
   meta:
      description = "Disclosed hacktool set - file Http.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
      id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"
   strings:
      $s0 = "RPCRT4.DLL" fullword ascii
      $s1 = "WNetAddConnection2A" fullword ascii
      $s2 = "NdrPointerBufferSize" fullword ascii
      $s3 = "_controlfp" fullword ascii
   condition:
      all of them and filesize < 10KB
}
YARA Detection Rule: Hacktools_CN_Burst_Start
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Start.bat - DoS tool
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
      $s1 = "Blast.bat /r 600" fullword ascii
      $s2 = "Blast.bat /l Blast.bat" fullword ascii
      $s3 = "Blast.bat /c 600" fullword ascii
      $s4 = "start Clear.bat" fullword ascii
      $s5 = "del Result.txt" fullword ascii
      $s6 = "s syn %%i %%j 3306 /save" fullword ascii
      $s7 = "start Thecard.bat" fullword ascii
      $s10 = "setlocal enabledelayedexpansion" fullword ascii

Detection condition:
5 of them

Full rule:
rule Hacktools_CN_Burst_Start {
   meta:
      description = "Disclosed hacktool set - file Start.bat - DoS tool"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "2014-11-17"
      modified = "2023-01-27"
      score = 60
      hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
      id = "1291fbc5-fbb3-5425-bb9a-e45f4d7cf562"
   strings:
      $s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
      $s1 = "Blast.bat /r 600" fullword ascii
      $s2 = "Blast.bat /l Blast.bat" fullword ascii
      $s3 = "Blast.bat /c 600" fullword ascii
      $s4 = "start Clear.bat" fullword ascii
      $s5 = "del Result.txt" fullword ascii
      $s6 = "s syn %%i %%j 3306 /save" fullword ascii
      $s7 = "start Thecard.bat" fullword ascii
      $s10 = "setlocal enabledelayedexpansion" fullword ascii
   condition:
      5 of them
}
YARA Detection Rule: Hacktools_CN_Panda_tasksvr
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file tasksvr.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s2 = "Consys21.dll" fullword ascii
      $s4 = "360EntCall.exe" fullword wide
      $s15 = "Beijing1" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Panda_tasksvr {
   meta:
      description = "Disclosed hacktool set - file tasksvr.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
      id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"
   strings:
      $s2 = "Consys21.dll" fullword ascii
      $s4 = "360EntCall.exe" fullword wide
      $s15 = "Beijing1" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_Burst_Clear
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Clear.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
      $s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
      $s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
      $s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
      $s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
      $s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
      $s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
      $s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
      $s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii

Detection condition:
5 of them

Full rule:
rule Hacktools_CN_Burst_Clear {
   meta:
      description = "Disclosed hacktool set - file Clear.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
      id = "21f33a36-779e-5eac-819c-ef79f291b43c"
   strings:
      $s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
      $s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
      $s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
      $s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
      $s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
      $s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
      $s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
      $s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
      $s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
   condition:
      5 of them
}
YARA Detection Rule: Hacktools_CN_Burst_Thecard
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Thecard.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
      $s1 = "Http://www.coffeewl.com" fullword ascii
      $s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
      $s3 = "for /L %%a in (" ascii
      $s4 = "MODE con: COLS=42 lines=5" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Burst_Thecard {
   meta:
      description = "Disclosed hacktool set - file Thecard.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
      id = "a9946aeb-2042-522f-8d91-f8b96341bb64"
   strings:
      $s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
      $s1 = "Http://www.coffeewl.com" fullword ascii
      $s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
      $s3 = "for /L %%a in (" ascii
      $s4 = "MODE con: COLS=42 lines=5" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: Hacktools_CN_Burst_Blast
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set - file Blast.bat
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
      $s1 = "@echo off" fullword ascii

Detection condition:
all of them

Full rule:
rule Hacktools_CN_Burst_Blast {
   meta:
      description = "Disclosed hacktool set - file Blast.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "17.11.14"
      score = 60
      hash = "b07702a381fa2eaee40b96ae[PII_REDACTED]674051"
      id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"
   strings:
      $s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
      $s1 = "@echo off" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: VUBrute_VUBrute
Repository: Neo23x0/signature-base
Detects: PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
      $s1 = "http://ubrute.com" fullword ascii
      $s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
      $s14 = "error.txt" fullword ascii

Detection condition:
all of them

Full rule:
rule VUBrute_VUBrute {
   meta:
      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "22.11.14"
      score = 70
      hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
      id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"
   strings:
      $s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
      $s1 = "http://ubrute.com" fullword ascii
      $s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
      $s14 = "error.txt" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: DK_Brute
Repository: Neo23x0/signature-base
Detects: PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/xiIphp

Pattern signatures:
$s6 = "get_CrackedCredentials" fullword ascii
      $s13 = "Same port used for two different protocols:" fullword wide
      $s18 = "coded by fLaSh" fullword ascii
      $s19 = "get_grbToolsScaningCracking" fullword ascii

Detection condition:
all of them

Full rule:
rule DK_Brute {
   meta:
      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "22.11.14"
      score = 70
      reference = "http://goo.gl/xiIphp"
      hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
      id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"
   strings:
      $s6 = "get_CrackedCredentials" fullword ascii
      $s13 = "Same port used for two different protocols:" fullword wide
      $s18 = "coded by fLaSh" fullword ascii
      $s19 = "get_grbToolsScaningCracking" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: VUBrute_config
Repository: Neo23x0/signature-base
Detects: PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/xiIphp

Pattern signatures:
$s2 = "Restore=1" fullword ascii
      $s6 = "Thread=" ascii
      $s7 = "Running=1" fullword ascii
      $s8 = "CheckCombination=" fullword ascii
      $s10 = "AutoSave=1.000000" fullword ascii
      $s12 = "TryConnect=" ascii
      $s13 = "Tray=" ascii

Detection condition:
all of them

Full rule:
rule VUBrute_config {
   meta:
      description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "22.11.14"
      score = 70
      reference = "http://goo.gl/xiIphp"
      hash = "b9f66b9265d2370dab[PII_REDACTED]67c11f7d93e9"
      id = "25cad108-b2d6-5886-bb2f-e614e05649fa"
   strings:
      $s2 = "Restore=1" fullword ascii
      $s6 = "Thread=" ascii
      $s7 = "Running=1" fullword ascii
      $s8 = "CheckCombination=" fullword ascii
      $s10 = "AutoSave=1.000000" fullword ascii
      $s12 = "TryConnect=" ascii
      $s13 = "Tray=" ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_hunt
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file hunt.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
      $s3 = "Usage - hunt \\\\servername" fullword ascii
      $s4 = ".share = %S - %S" fullword wide
      $s5 = "SMB share enumerator and admin finder " fullword ascii
      $s7 = "Hunt only runs on Windows NT..." fullword ascii
      $s8 = "User = %S" fullword ascii
      $s9 = "Admin is %s\\%s" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_hunt {
   meta:
      description = "Disclosed hacktool set (old stuff) - file hunt.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
      id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"
   strings:
      $s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
      $s3 = "Usage - hunt \\\\servername" fullword ascii
      $s4 = ".share = %S - %S" fullword wide
      $s5 = "SMB share enumerator and admin finder " fullword ascii
      $s7 = "Hunt only runs on Windows NT..." fullword ascii
      $s8 = "User = %S" fullword ascii
      $s9 = "Admin is %s\\%s" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_listip
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file listip.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
      $s2 = "ERROR No.2!!! Program Terminate." fullword ascii
      $s4 = "Local Host Name: %s" fullword ascii
      $s5 = "Packed by exe32pack 1.38" fullword ascii
      $s7 = "Local Computer Name: %s" fullword ascii
      $s8 = "Local IP Adress: %s" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_listip {
   meta:
      description = "Disclosed hacktool set (old stuff) - file listip.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
      id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"
   strings:
      $s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
      $s2 = "ERROR No.2!!! Program Terminate." fullword ascii
      $s4 = "Local Host Name: %s" fullword ascii
      $s5 = "Packed by exe32pack 1.38" fullword ascii
      $s7 = "Local Computer Name: %s" fullword ascii
      $s8 = "Local IP Adress: %s" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: ArtTrayHookDll
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "ArtTrayHookDll.dll" fullword ascii
      $s7 = "?TerminateHook@@YAXXZ" fullword ascii

Detection condition:
all of them

Full rule:
rule ArtTrayHookDll {
   meta:
      description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
      id = "324561fc-024c-5583-aa25-6b13e9616898"
   strings:
      $s0 = "ArtTrayHookDll.dll" fullword ascii
      $s7 = "?TerminateHook@@YAXXZ" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: sig_238_eee
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file eee.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "szj1230@yesky.com" fullword wide
      $s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
      $s4 = "MailTo:szj1230@yesky.com" fullword wide
      $s5 = "Command1_Click" fullword ascii
      $s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
      $s11 = "vb5chs.dll" fullword ascii
      $s12 = "MSVBVM50.DLL" fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_eee {
   meta:
      description = "Disclosed hacktool set (old stuff) - file eee.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
      id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"
   strings:
      $s0 = "szj1230@yesky.com" fullword wide
      $s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
      $s4 = "MailTo:szj1230@yesky.com" fullword wide
      $s5 = "Command1_Click" fullword ascii
      $s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
      $s11 = "vb5chs.dll" fullword ascii
      $s12 = "MSVBVM50.DLL" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspbackdoor_asp4
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file asp4.txt
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "system.dll" fullword ascii
      $s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
      $s3 = "Public Function reboot(atype As Variant)" fullword ascii
      $s4 = "t& = ExitWindowsEx(1, atype)" ascii
      $s5 = "atype=request(\"atype\") " fullword ascii
      $s7 = "AceiveX dll" fullword ascii
      $s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
      $s10 = "sys.reboot(atype)" fullword ascii

Detection condition:
all of them

Full rule:
rule aspbackdoor_asp4 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file asp4.txt"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "faf991664fd82a8755feb65334e5130f791baa8c"
      id = "7718aa71-fc0f-505c-a035-b78ae0438653"
   strings:
      $s0 = "system.dll" fullword ascii
      $s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
      $s3 = "Public Function reboot(atype As Variant)" fullword ascii
      $s4 = "t& = ExitWindowsEx(1, atype)" ascii
      $s5 = "atype=request(\"atype\") " fullword ascii
      $s7 = "AceiveX dll" fullword ascii
      $s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
      $s10 = "sys.reboot(atype)" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: aspfile1
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file aspfile1.asp
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "' -- check for a command that we have posted -- '" fullword ascii
      $s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
      $s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
      $s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
      $s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
      $s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii

Detection condition:
3 of them

Full rule:
rule aspfile1 {
   meta:
      description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
      id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"
   strings:
      $s0 = "' -- check for a command that we have posted -- '" fullword ascii
      $s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
      $s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
      $s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
      $s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
      $s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
   condition:
      3 of them
}
YARA Detection Rule: EditServer
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file EditServer.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s0 = "%s Server.exe" fullword ascii
      $s1 = "Service Port: %s" fullword ascii
      $s2 = "The Port Must Been >0 & <65535" fullword ascii
      $s8 = "3--Set Server Port" fullword ascii
      $s9 = "The Server Password Exceeds 32 Characters" fullword ascii
      $s13 = "Service Name: %s" fullword ascii
      $s14 = "Server Password: %s" fullword ascii
      $s17 = "Inject Process Name: %s" fullword ascii

      $x1 = "WinEggDrop Shell Congirator" fullword ascii

Detection condition:
5 of ($s*) or $x1

Full rule:
rule EditServer {
   meta:
      description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
      id = "de6bf995-1c7c-561f-98df-e8748d5fb157"
   strings:
      $s0 = "%s Server.exe" fullword ascii
      $s1 = "Service Port: %s" fullword ascii
      $s2 = "The Port Must Been >0 & <65535" fullword ascii
      $s8 = "3--Set Server Port" fullword ascii
      $s9 = "The Server Password Exceeds 32 Characters" fullword ascii
      $s13 = "Service Name: %s" fullword ascii
      $s14 = "Server Password: %s" fullword ascii
      $s17 = "Inject Process Name: %s" fullword ascii

      $x1 = "WinEggDrop Shell Congirator" fullword ascii
   condition:
      5 of ($s*) or $x1
}
YARA Detection Rule: sig_238_letmein
Repository: Neo23x0/signature-base
Detects: Disclosed hacktool set (old stuff) - file letmein.exe
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
      $s6 = "Error get users from server!" fullword ascii
      $s7 = "get in nt by name and null" fullword ascii
      $s16 = "get something from nt, hold by killusa." fullword ascii

Detection condition:
all of them

Full rule:
rule sig_238_letmein {
   meta:
      description = "Disclosed hacktool set (old stuff) - file letmein.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      date = "23.11.14"
      score = 60
      hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
      id = "5dba055f-1928-534a-8d0e-11dda56d93b7"
   strings:
      $s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
      $s6 = "Error get users from server!" fullword ascii
      $s7 = "get in nt by name and null" fullword ascii
      $s16 = "get something from nt, hold by killusa." fullword ascii
   condition:
      all of them
}