deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_BICECREAM
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BICECREAM-2140
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
		$s2 = "command data size is invalid for an exec cmd" fullword ascii
		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
		$s6 = "[%d] Execute code." fullword ascii
		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )

Full rule:
rule EQGRP_BICECREAM {
	meta:
		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
		id = "a10819ae-db48-5d30-8e2e-2e4fe33e005b"
	strings:
		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
		$s2 = "command data size is invalid for an exec cmd" fullword ascii
		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
		$s6 = "[%d] Execute code." fullword ascii
		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 5000KB and 2 of them ) or ( 5 of them )
}
YARA Detection Rule: EQGRP_create_http_injection
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file create_http_injection.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "required by SECONDDATE" fullword ascii

		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
		$s3 = "version='%prog 1.0'," fullword ascii
		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )

Full rule:
rule EQGRP_create_http_injection {
	meta:
		description = "EQGRP Toolset Firewall - file create_http_injection.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
		id = "92b6dad0-c7d8-5522-8fc1-fbd0aae00960"
	strings:
		$x1 = "required by SECONDDATE" fullword ascii

		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
		$s3 = "version='%prog 1.0'," fullword ascii
		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
	condition:
		( uint16(0) == 0x2123 and filesize < 3KB and ( $x1 or 2 of them ) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BFLEA_2201
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BFLEA-2201.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "readFlashHandler" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "flashRtnsPix6x.c" fullword ascii
		$s6 = "fix_ip_cksum_incr" fullword ascii
		$s7 = "writeFlashHandler" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )

Full rule:
rule EQGRP_BFLEA_2201 {
	meta:
		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
		id = "7dfdc2a2-73d1-5eba-8936-ed14b17495c5"
	strings:
		$s1 = ".got_loader" fullword ascii
		$s2 = "LOADED" fullword ascii
		$s3 = "readFlashHandler" fullword ascii
		$s4 = "KEEPGOING" fullword ascii
		$s5 = "flashRtnsPix6x.c" fullword ascii
		$s6 = "fix_ip_cksum_incr" fullword ascii
		$s7 = "writeFlashHandler" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 30KB and 5 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_BpfCreator_RHEL4
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BpfCreator-RHEL4
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
		$s2 = "error reading dump file: %s" fullword ascii
		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 2000KB and all of them )

Full rule:
rule EQGRP_BpfCreator_RHEL4 {
	meta:
		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "bd[PII_REDACTED]623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
		id = "476185f2-b093-5fb9-8604-891e96fe52a9"
	strings:
		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
		$s2 = "error reading dump file: %s" fullword ascii
		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 2000KB and all of them )
}
YARA Detection Rule: EQGRP_StoreFc
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file StoreFc.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_StoreFc {
	meta:
		description = "EQGRP Toolset Firewall - file StoreFc.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
		id = "48bbf5c9-e884-5126-93a2-d[PII_REDACTED]2"
	strings:
		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
	condition:
		1 of them
}
YARA Detection Rule: EQGRP_hexdump
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file hexdump.py
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )

Full rule:
rule EQGRP_hexdump {
	meta:
		description = "EQGRP Toolset Firewall - file hexdump.py"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
		id = "32a7d845-2fa3-5d8f-84e1-2c7f8d2ca8c8"
	strings:
		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
	condition:
		( uint16(0) == 0x2123 and filesize < 1KB and 2 of ($s*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BBALL
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "handler_readBIOS" fullword ascii
		$s4 = "cmosReadByte" fullword ascii
		$s5 = "KEEPGOING" fullword ascii
		$s6 = "checksumAreaConfirmed.0" fullword ascii
		$s7 = "writeSpeedPlow.c" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )

Full rule:
rule EQGRP_BBALL {
	meta:
		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
	strings:
		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
		$s2 = ".got_loader" fullword ascii
		$s3 = "handler_readBIOS" fullword ascii
		$s4 = "cmosReadByte" fullword ascii
		$s5 = "KEEPGOING" fullword ascii
		$s6 = "checksumAreaConfirmed.0" fullword ascii
		$s7 = "writeSpeedPlow.c" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 40KB and 4 of ($s*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_BARPUNCH_BPICKER
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )

Full rule:
rule EQGRP_BARPUNCH_BPICKER {
	meta:
		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		id = "7e88ba9d-1f15-533a-b388-a2a027ddb07c"
	strings:
		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 6000KB and 1 of them ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_Implants_Gen6
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
		$s3 = "getModInterface__preloadedModules" fullword ascii
		$s4 = "showCommands" fullword ascii
		$s5 = "readModuleInterface" fullword ascii
		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
		$s7 = "Get_CMD_List" fullword ascii
		$s8 = "LP_Listen2" fullword ascii
		$s9 = "killCmdList" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 6000KB and all of them )

Full rule:
rule EQGRP_Implants_Gen6 {
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "1b1c6426-7274-5fd4-9ea2-ef10bda769d4"
	strings:
		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
		$s3 = "getModInterface__preloadedModules" fullword ascii
		$s4 = "showCommands" fullword ascii
		$s5 = "readModuleInterface" fullword ascii
		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
		$s7 = "Get_CMD_List" fullword ascii
		$s8 = "LP_Listen2" fullword ascii
		$s9 = "killCmdList" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 6000KB and all of them )
}
YARA Detection Rule: EQGRP_Implants_Gen5
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii

		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii

Detection condition:
( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )

Full rule:
rule EQGRP_Implants_Gen5 {
	meta:
		description = "EQGRP Toolset Firewall"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "e35748ee-d530-5e73-a74d-5675d05725e9"
	strings:
		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii

		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
	condition:
		( uint16(0) == 0x457f and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_pandarock
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
		$x4 = "* Use arrow keys to scroll through command history" fullword ascii

		$s1 = "pitCmd_processCmdLine" fullword ascii
		$s2 = "execute all commands in <file>" fullword ascii
		$s3 = "__processShellCmd" ascii
		$s4 = "pitTarget_getDstPort" fullword ascii
		$s5 = "__processSetTargetIp" ascii

		$o1 = "Logging commands and output - ON" fullword ascii
		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)

Full rule:
rule EQGRP_pandarock {
	meta:
		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
		id = "aa0ee05b-b3e4-576a-8a32-bdc8d98fe636"
	strings:
		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
		$x4 = "* Use arrow keys to scroll through command history" fullword ascii

		$s1 = "pitCmd_processCmdLine" fullword ascii
		$s2 = "execute all commands in <file>" fullword ascii
		$s3 = "__processShellCmd" ascii
		$s4 = "pitTarget_getDstPort" fullword ascii
		$s5 = "__processSetTargetIp" ascii

		$o1 = "Logging commands and output - ON" fullword ascii
		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 3000KB and 1 of ($x*) ) or ( 4 of them ) or 1 of ($o*)
}
YARA Detection Rule: EQGRP_BananaUsurper_writeJetPlow
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "Implant Version-Specific Values:" fullword ascii
		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii

		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )

Full rule:
rule EQGRP_BananaUsurper_writeJetPlow {
	meta:
		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "3366b4bbf265716869a487203a8ac[PII_REDACTED]0990493dd4dd8385e42b0c119"
		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
		id = "901af182-cbfa-533a-a055-565d95005d62"
	strings:
		$x1 = "Implant Version-Specific Values:" fullword ascii
		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii

		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 2000KB and 1 of ($x*) ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_Implants_Gen4
Repository: Neo23x0/signature-base
Detects: EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$s1 = "Command has not yet been coded" fullword ascii
		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )

Full rule:
rule EQGRP_Implants_Gen4 {
	meta:
		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-16"
		super_rule = 1
		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f[PII_REDACTED]3c1a7939"
		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
		id = "8b2061f0-862d-51de-a7d0-7a36d3e71d61"
	strings:
		$s1 = "Command has not yet been coded" fullword ascii
		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 3000KB and 3 of them ) or ( all of them )
}