deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_ProjectSauron_encrypted_LSA
Repository: Yara-Rules/rules
Detects: Rule to detect ProjectSauron encrypted LSA samples
Reference: https://securelist.com/blog/

Pattern signatures:
$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
        $a2 = "\\Device\\NdisRaw_" fullword ascii
        $a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
        $a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
        $a5 = "Missing function %S::#%d" fullword wide
        $a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C[PII_REDACTED]975C48955DCFF55FC8BF88D8F0000003A83F[PII_REDACTED]3DB53FF15}
        $a7 = {488D4C[PII_REDACTED]2450488D[PII_REDACTED][PII_REDACTED]2460488D4520C[PII_REDACTED]000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}

Detection condition:
uint16(0) == 0x5A4D and (any of ($a*) or ( pe.exports("InitializeChangeNotify") and pe.exports("PasswordChangeNotify") and math.entropy(0x400, filesize) >= 7.5 )) and filesize < 1000000

Full rule:
rule apt_ProjectSauron_encrypted_LSA  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron encrypted LSA samples"
        version = "1.0"    
        reference = "https://securelist.com/blog/"

    strings:
        $a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
        $a2 = "\\Device\\NdisRaw_" fullword ascii
        $a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
        $a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
        $a5 = "Missing function %S::#%d" fullword wide
        $a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C[PII_REDACTED]975C48955DCFF55FC8BF88D8F0000003A83F[PII_REDACTED]3DB53FF15}
        $a7 = {488D4C[PII_REDACTED]2450488D[PII_REDACTED][PII_REDACTED]2460488D4520C[PII_REDACTED]000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}

    condition:
        uint16(0) == 0x5A4D and (any of ($a*) or ( pe.exports("InitializeChangeNotify") and pe.exports("PasswordChangeNotify") and math.entropy(0x400, filesize) >= 7.5 )) and filesize < 1000000
}
YARA Detection Rule: apt_ProjectSauron_encrypted_SSPI
Repository: Yara-Rules/rules
Detects: Rule to detect encrypted ProjectSauron SSPI samples
Reference: https://securelist.com/blog/

Pattern signatures:
$a1 = ":\\System Volume Information\\{" wide
        $a2 = "\\\\.\\PhysicalDrive%d" wide
        $a3 = "DMWndClassX%d"
        $b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
        $b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide

Detection condition:
uint16(0) == 0x5A4D and filesize < 1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics & pe.DLL and (pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and math.entropy(0x400, filesize) >= 7.5 }

rule apt_ProjectSauron_MyTrampoline  
{

    meta:
        copyright =

Full rule:
rule apt_ProjectSauron_encrypted_SSPI  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect encrypted ProjectSauron SSPI samples"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    condition:
        uint16(0) == 0x5A4D and filesize < 1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics & pe.DLL and (pe.machine == pe.MACHINE_AMD64 or pe.machine == pe.MACHINE_IA64) and math.entropy(0x400, filesize) >= 7.5 }

rule apt_ProjectSauron_MyTrampoline  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron MyTrampoline module"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a1 = ":\\System Volume Information\\{" wide
        $a2 = "\\\\.\\PhysicalDrive%d" wide
        $a3 = "DMWndClassX%d"
        $b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
        $b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide

    condition:
        uint16(0) == 0x5A4D and filesize < 5000000 and (all of ($a*) or any of ($b*)) }

rule apt_ProjectSauron_encrypted_container  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron samples encrypted container"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $vfs_header = {02 AA 02 C1 02 0?}
        $salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}

    condition:
        uint16(0) == 0x5A4D and ((@vfs_header < 0x4000) or $salt) and math.entropy(0x400, filesize) >= 6.5 and (filesize > 0x400) and filesize < 10000000 }

rule apt_ProjectSauron_encryption  
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron string encryption"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a1 = {81??02AA02C175??8B??0685}
        $a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BB
YARA Detection Rule: apt_ProjectSauron_generic_pipe_backdoor
Repository: Yara-Rules/rules
Detects: Rule to detect ProjectSauron generic pipe backdoors
Reference: https://securelist.com/blog/

Pattern signatures:
$a = { C7 [2-3] 32 32 32 32 E8 }
        $b = { 42 12 67 6B }
        $c = { 25 31 5F 73 }
        $d = "rand"
        $e = "WS2_32"

Detection condition:
uint16(0) == 0x5A4D and (all of them) and filesize < 400000

Full rule:
rule apt_ProjectSauron_generic_pipe_backdoor 
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect ProjectSauron generic pipe backdoors"
        version = "1.0"
        reference = "https://securelist.com/blog/"

    strings:
        $a = { C7 [2-3] 32 32 32 32 E8 }
        $b = { 42 12 67 6B }
        $c = { 25 31 5F 73 }
        $d = "rand"
        $e = "WS2_32"

condition:
    uint16(0) == 0x5A4D and (all of them) and filesize < 400000

}
YARA Detection Rule: AAR
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide
		$g = "@@@@@"

Detection condition:
all of them

Full rule:
rule AAR : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/AAR"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide
		$g = "@@@@@"

	condition:
		all of them
}
YARA Detection Rule: Ap0calypse
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "Ap0calypse"
		$b = "Sifre"
		$c = "MsgGoster"
		$d = "Baslik"
		$e = "Dosyalars"
		$f = "Injecsiyon"

Detection condition:
all of them

Full rule:
rule Ap0calypse: RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Ap0calypse"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "Ap0calypse"
		$b = "Sifre"
		$c = "MsgGoster"
		$d = "Baslik"
		$e = "Dosyalars"
		$f = "Injecsiyon"

	condition:
		all of them
}
YARA Detection Rule: Arcom
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a1 = "CVu3388fnek3W(3ij3fkp0930di"
        $a2 = "ZINGAWI2"
        $a3 = "clWebLightGoldenrodYellow"
        $a4 = "Ancestor for '%s' not found" wide
        $a5 = "Control-C hit" wide
        $a6 = {A3 24 25 21}

Detection condition:
all of them

Full rule:
rule Arcom : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Arcom"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
        $a1 = "CVu3388fnek3W(3ij3fkp0930di"
        $a2 = "ZINGAWI2"
        $a3 = "clWebLightGoldenrodYellow"
        $a4 = "Ancestor for '%s' not found" wide
        $a5 = "Control-C hit" wide
        $a6 = {A3 24 25 21}
        
    condition:
        all of them
}
YARA Detection Rule: Bandook
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "aaaaaa1|"
            $b = "aaaaaa2|"
            $c = "aaaaaa3|"
            $d = "aaaaaa4|"
			$e = "aaaaaa5|"
			$f = "%s%d.exe"
			$g = "astalavista"
			$h = "givemecache"
			$i = "%s\\system32\\drivers\\blogs\\*"
			$j = "bndk13me"

Detection condition:
all of them

Full rule:
rule Bandook : RAT
{

	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/bandook"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
    		$a = "aaaaaa1|"
            $b = "aaaaaa2|"
            $c = "aaaaaa3|"
            $d = "aaaaaa4|"
			$e = "aaaaaa5|"
			$f = "%s%d.exe"
			$g = "astalavista"
			$h = "givemecache"
			$i = "%s\\system32\\drivers\\blogs\\*"
			$j = "bndk13me"
			

        
    condition:
    		all of them
}
YARA Detection Rule: BlackNix
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a1 = "SETTINGS" wide
		$a2 = "Mark Adler"
		$a3 = "Random-Number-Here"
		$a4 = "RemoteShell"
		$a5 = "SystemInfo"

Detection condition:
all of them

Full rule:
rule BlackNix : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/BlackNix"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
		$a1 = "SETTINGS" wide
		$a2 = "Mark Adler"
		$a3 = "Random-Number-Here"
		$a4 = "RemoteShell"
		$a5 = "SystemInfo"

	
	condition:
		all of them
}
YARA Detection Rule: BlueBanana
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$meta = "META-INF"
		$conf = "config.txt"
		$a = "a/a/a/a/f.class"
		$b = "a/a/a/a/l.class"
		$c = "a/a/a/b/q.class"
		$d = "a/a/a/b/v.class"

Detection condition:
all of them

Full rule:
rule BlueBanana : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/BlueBanana"
		maltype = "Remote Access Trojan"
		filetype = "Java"

	strings:
		$meta = "META-INF"
		$conf = "config.txt"
		$a = "a/a/a/a/f.class"
		$b = "a/a/a/a/l.class"
		$c = "a/a/a/b/q.class"
		$d = "a/a/a/b/v.class"

		
	condition:
		all of them
}
YARA Detection Rule: ClientMesh
Repository: Yara-Rules/rules
Malware family: torct
Author: Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$string1 = "machinedetails"
        $string2 = "MySettings"
        $string3 = "sendftppasswords"
        $string4 = "sendbrowserpasswords"
        $string5 = "arma2keyMass"
        $string6 = "keylogger"
        $conf = {00 00 00 00 00 00 00 00 00 7E}

Detection condition:
all of them

Full rule:
rule ClientMesh : RAT
{
    meta:
        author = "Kevin Breen <kevin@techanarchy.net>"
        date = "2014/06"
        ref = "http://malwareconfig.com/stats/ClientMesh"
        family = "torct"

    strings:
        $string1 = "machinedetails"
        $string2 = "MySettings"
        $string3 = "sendftppasswords"
        $string4 = "sendbrowserpasswords"
        $string5 = "arma2keyMass"
        $string6 = "keylogger"
        $conf = {00 00 00 00 00 00 00 00 00 7E}

    condition:
        all of them
}
YARA Detection Rule: DarkRAT
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "@1906dark1996coder@"
		$b = "SHEmptyRecycleBinA"
		$c = "mciSendStringA"
		$d = "add_Shutdown"
		$e = "get_SaveMySettingsOnExit"
		$f = "get_SpecialDirectories"
		$g = "Client.My"

Detection condition:
all of them

Full rule:
rule DarkRAT : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/DarkRAT"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "@1906dark1996coder@"
		$b = "SHEmptyRecycleBinA"
		$c = "mciSendStringA"
		$d = "add_Shutdown"
		$e = "get_SaveMySettingsOnExit"
		$f = "get_SpecialDirectories"
		$g = "Client.My"

	condition:
		all of them
}
YARA Detection Rule: Greame
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
            $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
            $c = "EditSvr"
            $d = "TLoader"
			$e = "Stroks"
            $f = "Avenger by NhT"
			$g = "####@####"
			$h = "GREAME"

Detection condition:
all of them

Full rule:
rule Greame : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Greame"
		maltype = "Remote Access Trojan"
		filetype = "exe"
		
	strings:
    		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
            $b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
            $c = "EditSvr"
            $d = "TLoader"
			$e = "Stroks"
            $f = "Avenger by NhT"
			$g = "####@####"
			$h = "GREAME"
			
    condition:
    		all of them
}
YARA Detection Rule: HawkEye
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
        $string5 = "<!-- do not script -->" wide
        $string6 = "\\pidloc.txt" wide
        $string7 = "BSPLIT" wide

Detection condition:
$key and $salt and all of ($string*)

Full rule:
rule HawkEye : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2015/06"
		ref = "http://malwareconfig.com/stats/HawkEye"
		maltype = "KeyLogger"
		filetype = "exe"

	strings:
		$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
        $string5 = "<!-- do not script -->" wide
        $string6 = "\\pidloc.txt" wide
        $string7 = "BSPLIT" wide
        

	condition:
		$key and $salt and all of ($string*)
}
YARA Detection Rule: Imminent
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$v1a = "DecodeProductKey"
        $v1b = "StartHTTPFlood"
        $v1c = "CodeKey"
        $v1d = "MESSAGEBOX"
        $v1e = "GetFilezillaPasswords"
        $v1f = "DataIn"
        $v1g = "UDPzSockets"
        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

        $v2a = "<URL>k__BackingField"
        $v2b = "<RunHidden>k__BackingField"
        $v2c = "DownloadAndExecute"
        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
        $v2e = "england.png" wide
        $v2f = "Showed Messagebox" wide

Detection condition:
all of ($v1*) or all of ($v2*)

Full rule:
rule Imminent : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/Imminent"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $v1a = "DecodeProductKey"
        $v1b = "StartHTTPFlood"
        $v1c = "CodeKey"
        $v1d = "MESSAGEBOX"
        $v1e = "GetFilezillaPasswords"
        $v1f = "DataIn"
        $v1g = "UDPzSockets"
        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

        $v2a = "<URL>k__BackingField"
        $v2b = "<RunHidden>k__BackingField"
        $v2c = "DownloadAndExecute"
        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
        $v2e = "england.png" wide
        $v2f = "Showed Messagebox" wide
    condition:
        all of ($v1*) or all of ($v2*)
}
YARA Detection Rule: Infinity
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

Detection condition:
all of them

Full rule:
rule Infinity : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Infinity"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

	condition:
		all of them
}
YARA Detection Rule: JavaDropper
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$jar = "META-INF/MANIFEST.MF"

	    $a1 = "ePK"
	    $a2 = "kPK"

        $b1 = "config.ini"
        $b2 = "password.ini"

        $c1 = "stub/stub.dll"

        $d1 = "c.dat"

Detection condition:
$jar and (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*))

Full rule:
rule JavaDropper : RAT
{
    meta:
	    author = " Kevin Breen <kevin@techanarchy.net>"
	    date = "2015/10"
	    ref = "http://malwareconfig.com/stats/AlienSpy"
	    maltype = "Remote Access Trojan"
	    filetype = "jar"

    strings:
	    $jar = "META-INF/MANIFEST.MF"

	    $a1 = "ePK"
	    $a2 = "kPK"

        $b1 = "config.ini"
        $b2 = "password.ini"

        $c1 = "stub/stub.dll"

        $d1 = "c.dat"

    condition:
        $jar and (all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*))
}
YARA Detection Rule: LostDoor
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
        $a1 = "*mlt* = %"
        $a2 = "*ip* = %"
        $a3 = "*victimo* = %"
        $a4 = "*name* = %"
        $b5 = "[START]"
        $b6 = "[DATA]"
        $b7 = "We Control Your Digital World" wide ascii
        $b8 = "RC4Initialize" wide ascii
        $b9 = "RC4Decrypt" wide ascii

Detection condition:
all of ($a*) or all of ($b*)

Full rule:
rule LostDoor : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/LostDoor"
		maltype = "Remote Access Trojan"
		filetype = "exe"
        
    strings:
    	$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
        $a1 = "*mlt* = %"
        $a2 = "*ip* = %"
        $a3 = "*victimo* = %"
        $a4 = "*name* = %"
        $b5 = "[START]"
        $b6 = "[DATA]"
        $b7 = "We Control Your Digital World" wide ascii
        $b8 = "RC4Initialize" wide ascii
        $b9 = "RC4Decrypt" wide ascii
        
    condition:
    	all of ($a*) or all of ($b*)
}
YARA Detection Rule: LuminosityLink
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "SMARTLOGS" wide
        $b = "RUNPE" wide
        $c = "b.Resources" wide
        $d = "CLIENTINFO*" wide
        $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
        $f = "Proactive Anti-Malware has been manually activated!" wide
        $g = "REMOVEGUARD" wide
        $h = "C0n1f8" wide
        $i = "Luminosity" wide
        $j = "LuminosityCryptoMiner" wide
        $k = "MANAGER*CLIENTDETAILS*" wide

Detection condition:
all of them

Full rule:
rule LuminosityLink : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/LuminosityLink"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "SMARTLOGS" wide
        $b = "RUNPE" wide
        $c = "b.Resources" wide
        $d = "CLIENTINFO*" wide
        $e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
        $f = "Proactive Anti-Malware has been manually activated!" wide
        $g = "REMOVEGUARD" wide
        $h = "C0n1f8" wide
        $i = "Luminosity" wide
        $j = "LuminosityCryptoMiner" wide
        $k = "MANAGER*CLIENTDETAILS*" wide

    condition:
        all of them
}
YARA Detection Rule: LuxNet
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

Detection condition:
all of them

Full rule:
rule LuxNet : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/LuxNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

	condition:
		all of them
}
YARA Detection Rule: NanoCore
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "NanoCore"
        $b = "ClientPlugin"
        $c = "ProjectData"
        $d = "DESCrypto"
        $e = "KeepAlive"
        $f = "IPNETROW"
        $g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
        $key = {43 6f 24 cb 95 30 38 39}

Detection condition:
6 of them

Full rule:
rule NanoCore : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/NanoCore"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "NanoCore"
        $b = "ClientPlugin"
        $c = "ProjectData"
        $d = "DESCrypto"
        $e = "KeepAlive"
        $f = "IPNETROW"
        $g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
        $key = {43 6f 24 cb 95 30 38 39}


    condition:
        6 of them
}
YARA Detection Rule: Paradox
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

Detection condition:
all of them

Full rule:
rule Paradox : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Paradox"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

	condition:
		all of them
}
YARA Detection Rule: Plasma
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "Miner: Failed to Inject." wide
        $b = "Started GPU Mining on:" wide
        $c = "BK: Hard Bot Killer Ran Successfully!" wide
        $d = "Uploaded Keylogs Successfully!" wide
        $e = "No Slowloris Attack is Running!" wide
        $f = "An ARME Attack is Already Running on" wide
        $g = "Proactive Bot Killer Enabled!" wide
        $h = "PlasmaRAT" wide ascii
        $i = "AntiEverything" wide ascii

Detection condition:
all of them

Full rule:
rule Plasma : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/Plasma"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $a = "Miner: Failed to Inject." wide
        $b = "Started GPU Mining on:" wide
        $c = "BK: Hard Bot Killer Ran Successfully!" wide
        $d = "Uploaded Keylogs Successfully!" wide
        $e = "No Slowloris Attack is Running!" wide
        $f = "An ARME Attack is Already Running on" wide
        $g = "Proactive Bot Killer Enabled!" wide
        $h = "PlasmaRAT" wide ascii
        $i = "AntiEverything" wide ascii

    condition:
        all of them
}