deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_RunAsChild_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file RunAsChild_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Privilege elevation failed" fullword wide
      $s2 = "Unable to open parent process" fullword wide
      $s4 = "Invalid input to lpRunAsChildPPC" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_RunAsChild_Lp {
   meta:
      description = "EquationGroup Malware - file RunAsChild_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
      id = "f0623c3f-3a49-5cdf-89ea-2b3273fd8324"
   strings:
      $s1 = "Privilege elevation failed" fullword wide
      $s2 = "Unable to open parent process" fullword wide
      $s4 = "Invalid input to lpRunAsChildPPC" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_6
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level3_dll_x64
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = "Copyright (C) Microsoft" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_6 {
   meta:
      description = "EquationGroup Malware - file PC_Level3_dll_x64"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
      id = "99b2fab0-1298-5d48-a78b-eb59942ecfca"
   strings:
      $s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = "Copyright (C) Microsoft" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_PC_Level3_http_flav_dll_x64
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level3_http_flav_dll_x64
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = ".?AVOpenSocket@@" fullword ascii
      $s4 = "RHTTP/1.0" fullword wide
      $s5 = "Copyright (C) Microsoft" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) ) or ( all of them )

Full rule:
rule EquationGroup_PC_Level3_http_flav_dll_x64 {
   meta:
      description = "EquationGroup Malware - file PC_Level3_http_flav_dll_x64"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
      id = "93a3d47d-1dac-5621-8e69-d6d23b7628db"
   strings:
      $s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = ".?AVOpenSocket@@" fullword ascii
      $s4 = "RHTTP/1.0" fullword wide
      $s5 = "Copyright (C) Microsoft" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( all of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_3
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file mssld.dll
Author: Auto Generated
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_3 {
   meta:
      description = "EquationGroup Malware - file mssld.dll"
      author = "Auto Generated"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
      id = "f664ad78-1820-5434-94cc-94f98b32e654"
   strings:
      $op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
      $op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
      $op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: EquationGroup_GetAdmin_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file GetAdmin_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "Current user is System -- unable to join administrators group" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_GetAdmin_Lp {
   meta:
      description = "EquationGroup Malware - file GetAdmin_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
      id = "3bbe0553-a5a3-5207-a94e-ad978606d9a4"
   strings:
      $x1 = "Current user is System -- unable to join administrators group" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_ModifyGroup_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file ModifyGroup_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Modify Privileges failed" fullword wide
      $s2 = "Given privilege name not found" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_ModifyGroup_Lp {
   meta:
      description = "EquationGroup Malware - file ModifyGroup_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
      id = "82c9617a-3d78-525f-a507-76c87aad7c59"
   strings:
      $s1 = "Modify Privileges failed" fullword wide
      $s2 = "Given privilege name not found" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_pwdump_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file pwdump_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "PWDUMP - - ERROR - -" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_pwdump_Lp {
   meta:
      description = "EquationGroup Malware - file pwdump_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
      id = "6f356f13-9ec1-5dd9-91b2-6a3071398e81"
   strings:
      $x1 = "PWDUMP - - ERROR - -" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_EventLogEdit_Implant
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file EventLogEdit_Implant.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
      $s2 = "Ntdll.dll" fullword ascii
      $s3 = "hZwOpenProcess" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_EventLogEdit_Implant {
   meta:
      description = "EquationGroup Malware - file EventLogEdit_Implant.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
      id = "40239dd0-4159-5c10-96b3-4f1e28c92d97"
   strings:
      $s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
      $s2 = "Ntdll.dll" fullword ascii
      $s3 = "hZwOpenProcess" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_PortMap_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PortMap_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Privilege elevation failed" fullword wide
      $s2 = "Portmap ended due to max number of ports" fullword wide
      $s3 = "Invalid parameters received for portmap" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 2 of them )

Full rule:
rule EquationGroup_PortMap_Lp {
   meta:
      description = "EquationGroup Malware - file PortMap_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b[PII_REDACTED]624a6"
      id = "e1851a17-9858-5c93-9993-2da0559e5d2e"
   strings:
      $s1 = "Privilege elevation failed" fullword wide
      $s2 = "Portmap ended due to max number of ports" fullword wide
      $s3 = "Invalid parameters received for portmap" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 2 of them )
}
YARA Detection Rule: EquationGroup_ProcessOptions_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file ProcessOptions_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Invalid parameter received by implant" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_ProcessOptions_Lp {
   meta:
      description = "EquationGroup Malware - file ProcessOptions_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "31d86f77137f0b3697af03dd28d[PII_REDACTED]cecd3c1d9dc18fcf609eb24229a"
      id = "5ccb9751-fbcc-538c-8d55-dfc495067ce5"
   strings:
      $s1 = "Invalid parameter received by implant" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_PassFreely_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PassFreely_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
      $s2 = "Oracle process memory successfully modified!" fullword wide
      $s3 = "Unable to reset the memory protection mask to the memory" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_PassFreely_Lp {
   meta:
      description = "EquationGroup Malware - file PassFreely_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
      id = "5fb99194-f0df-54aa-9f20-7f8458155e62"
   strings:
      $s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
      $s2 = "Oracle process memory successfully modified!" fullword wide
      $s3 = "Unable to reset the memory protection mask to the memory" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_1
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
      $x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or ( all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_1 {
   meta:
      description = "EquationGroup Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      super_rule = 1
      hash1 = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
      hash2 = "73d1d[PII_REDACTED]9c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
      hash3 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
      hash4 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
      hash5 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
      hash6 = "8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
      hash7 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
      hash8 = "d92928a867a685274b0a74ec55c0b83690fca[PII_REDACTED]79e184e2787d47f48"
      hash9 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
      hash10 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
      hash11 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b[PII_REDACTED]624a6"
      hash12 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
      hash13 = "31d86f77137f0b3697af03dd28d[PII_REDACTED]cecd3c1d9dc18fcf609eb24229a"
      hash14 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
      hash15 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
      id = "331d7ba5-e3fa-5ab7-b4de-c7af764be03d"
   strings:
      $x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
      $x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: EquationDrug_MS_Identifier
Repository: Neo23x0/signature-base
Detects: Microsoft Identifier used in EquationDrug Platform
Author: Florian Roth (Nextron Systems) @4nc4p

Pattern signatures:
$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide

Detection condition:
// Epoch for 01.01.2000
		$s1 and pe.timestamp > 946684800

Full rule:
rule EquationDrug_MS_Identifier {
	meta:
		description = "Microsoft Identifier used in EquationDrug Platform"
		author = "Florian Roth (Nextron Systems) @4nc4p"
		date = "2015/03/11"
		id = "c934c117-bf5a-5688-acd9-5d6c6aacd6bc"
	strings:
		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
	condition:
		// Epoch for 01.01.2000
		$s1 and pe.timestamp > 946684800
}
YARA Detection Rule: KeyBoy_InstallClient
Repository: Neo23x0/signature-base
Detects: Detects KeyBoy InstallClient
Author: Markus Neis, Florian Roth
Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/

Pattern signatures:
$x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
      $x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
      $x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
      $x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
      $x5 = "szCmd1:%s" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s4 = "rundll32.exe %s Main" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule KeyBoy_InstallClient {
   meta:
      description = "Detects KeyBoy InstallClient"
      author = "Markus Neis, Florian Roth"
      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
      date = "2018-03-26"
      hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
      hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
      hash1 = "d65f809f7684b28a6fa2d9397582f[PII_REDACTED]99be3acf1241ff44d4df36a3a"
      id = "d1359f35-d6cd-502b-8cf7-6215bf5e62ba"
   strings:
      $x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
      $x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
      $x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
      $x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
      $x5 = "szCmd1:%s" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s4 = "rundll32.exe %s Main" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: KeyBoy_wab32res
Repository: Neo23x0/signature-base
Detects: Detects KeyBoy Loader wab32res.dll
Author: Markus Neis, Florian Roth
Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/

Pattern signatures:
$x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
      $x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
      $x3 = "\\Release\\FakeRun.pdb" ascii
      $x4 = "FakeRun.dll" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s2 = "CreateProcess failed (%d)" fullword ascii
      $s3 = "CreateProcess %s " fullword ascii
      $s4 = "FindResource %s error " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule KeyBoy_wab32res {
   meta:
      description = "Detects KeyBoy Loader wab32res.dll"
      author = "Markus Neis, Florian Roth"
      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
      date = "2018-03-26"
      hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
      hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
      id = "0e4045a7-1c45-5043-9e10-e969219b67f8"
   strings:
      $x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
      $x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
      $x3 = "\\Release\\FakeRun.pdb" ascii
      $x4 = "FakeRun.dll" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s2 = "CreateProcess failed (%d)" fullword ascii
      $s3 = "CreateProcess %s " fullword ascii
      $s4 = "FindResource %s error " fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: KeyBoy_rasauto
Repository: Neo23x0/signature-base
Detects: Detects KeyBoy ServiceClient
Author: Markus Neis, Florian Roth
Reference: https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/

Pattern signatures:
$x1 = "rundll32.exe %s SSSS & exit" fullword ascii
      $x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s2 = "CreateProcess failed (%d)" fullword ascii
      $s3 = "ServiceClient.dll" fullword ascii
      $s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
      $s5 = "pid:%d CmdLine:%S" fullword ascii
      $s6 = "rasauto32.ServiceMain" fullword ascii
      $s7 = "del /q/f %s\\%s*" fullword ascii
      $s8 = "szTmpDll:%s" fullword ascii
      $s9 = "lpCmdLine:%s" fullword ascii
      $s0 = "ReleaseFileFromRes:%s ok!" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.exports("SSSS") or
         1 of ($x*) or
         4 of them
      )

Full rule:
rule KeyBoy_rasauto {
   meta:
      description = "Detects KeyBoy ServiceClient"
      author = "Markus Neis, Florian Roth"
      reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
      date = "2018-03-26"
      hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
      id = "b6c72a91-fda1-5f40-804f-896b25a8813f"
   strings:
      $x1 = "rundll32.exe %s SSSS & exit" fullword ascii
      $x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii

      $s1 = "cmd.exe /c \"%s\"" fullword ascii
      $s2 = "CreateProcess failed (%d)" fullword ascii
      $s3 = "ServiceClient.dll" fullword ascii
      $s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
      $s5 = "pid:%d CmdLine:%S" fullword ascii
      $s6 = "rasauto32.ServiceMain" fullword ascii
      $s7 = "del /q/f %s\\%s*" fullword ascii
      $s8 = "szTmpDll:%s" fullword ascii
      $s9 = "lpCmdLine:%s" fullword ascii
      $s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         pe.exports("SSSS") or
         1 of ($x*) or
         4 of them
      )
}