deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WiltedTulip_ReflectiveLoader
Repository: Neo23x0/signature-base
Detects: Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip
Author: Florian Roth (Nextron Systems)
Reference: http://www.clearskysec.com/tulip

Pattern signatures:
$x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
      $x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $x4 = "Failed to impersonate token from %d (%u)" fullword ascii
      $x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
      $x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or
      ( 2 of them ) or
      pe.exports("_ReflectiveLoader@4")

Full rule:
rule WiltedTulip_ReflectiveLoader {
   meta:
      description = "Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://www.clearskysec.com/tulip"
      date = "2017-07-23"
      hash1 = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
      hash2 = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
      hash3 = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e[PII_REDACTED]84b70804882b32f"
      hash4 = "cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0"
      hash5 = "eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89"
      id = "0c7dfb44-8acb-5f36-9683-745560f1f795"
   strings:
      $x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
      $x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
      $x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
      $x4 = "Failed to impersonate token from %d (%u)" fullword ascii
      $x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
      $x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 1 of them ) or
      ( 2 of them ) or
      pe.exports("_ReflectiveLoader@4")
}
YARA Detection Rule: WiltedTulip_Matryoshka_RAT
Repository: Neo23x0/signature-base
Detects: Detects Matryoshka RAT used in Operation Wilted Tulip
Author: Florian Roth (Nextron Systems)
Reference: http://www.clearskysec.com/tulip

Pattern signatures:
$s1 = "%S:\\Users\\public" fullword wide
      $s2 = "ntuser.dat.swp" fullword wide
      $s3 = "Job Save / Load Config" fullword wide
      $s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
      $s5 = "winupdate64.com" fullword ascii
      $s6 = "Job Save KeyLogger" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )

Full rule:
rule WiltedTulip_Matryoshka_RAT {
   meta:
      description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://www.clearskysec.com/tulip"
      date = "2017-07-23"
      hash1 = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
      hash2 = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
      id = "e851e212-bb71-55c9-9bc1-0041bb04bef5"
   strings:
      $s1 = "%S:\\Users\\public" fullword wide
      $s2 = "ntuser.dat.swp" fullword wide
      $s3 = "Job Save / Load Config" fullword wide
      $s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
      $s5 = "winupdate64.com" fullword ascii
      $s6 = "Job Save KeyLogger" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 3 of them )
}
YARA Detection Rule: redSails_EXE
Repository: Neo23x0/signature-base
Detects: Detects Red Sails Hacktool by WinDivert references
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/BeetleChunks/redsails

Pattern signatures:
$s1 = "bWinDivert64.dll" fullword ascii
      $s2 = "bWinDivert32.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 6000KB and all of them )

Full rule:
rule redSails_EXE {
   meta:
      description = "Detects Red Sails Hacktool by WinDivert references"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/BeetleChunks/redsails"
      date = "2017-10-02"
      hash1 = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
      id = "e7ebbebf-e2d6-5cd3-b859-b804d39d1641"
   strings:
      $s1 = "bWinDivert64.dll" fullword ascii
      $s2 = "bWinDivert32.dll" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 6000KB and all of them )
}
YARA Detection Rule: redSails_PY
Repository: Neo23x0/signature-base
Detects: Detects Red Sails Hacktool - Python
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/BeetleChunks/redsails

Pattern signatures:
$x1 = "Gained command shell on host" fullword ascii
      $x2 = "[!] Received an ERROR in shell()" fullword ascii
      $x3 = "Target IP address with backdoor installed" fullword ascii
      $x4 = "Open backdoor port on target machine" fullword ascii
      $x5 = "Backdoor port to open on victim machine" fullword ascii

Detection condition:
1 of them

Full rule:
rule redSails_PY {
   meta:
      description = "Detects Red Sails Hacktool - Python"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/BeetleChunks/redsails"
      date = "2017-10-02"
      hash1 = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
      hash2 = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
      id = "59d5e784-70ff-5061-9867-54c905ecfd8c"
   strings:
      $x1 = "Gained command shell on host" fullword ascii
      $x2 = "[!] Received an ERROR in shell()" fullword ascii
      $x3 = "Target IP address with backdoor installed" fullword ascii
      $x4 = "Open backdoor port on target machine" fullword ascii
      $x5 = "Backdoor port to open on victim machine" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: CVE_2015_1701_Taihou
Repository: Neo23x0/signature-base
Detects: CVE-2015-1701 compiled exploit code
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/W4nU0q

Pattern signatures:
$s3 = "VirtualProtect" fullword
		$s4 = "RegisterClass"
		$s5 = "LoadIcon"
		$s6 = "PsLookupProcessByProcessId" fullword ascii 
		$s7 = "LoadLibraryExA" fullword ascii
		$s8 = "gSharedInfo" fullword

		$w1 = "user32.dll" wide
		$w2 = "ntdll" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 160KB and all of ($s*) and 1 of ($w*)

Full rule:
rule CVE_2015_1701_Taihou {
	meta:
		description = "CVE-2015-1701 compiled exploit code"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/W4nU0q"
		date = "2015-05-13"
		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
		score = 70
		id = "58250e17-aa46-5451-ae6d-18fb4030f8df"
	strings:	
		$s3 = "VirtualProtect" fullword
		$s4 = "RegisterClass"
		$s5 = "LoadIcon"
		$s6 = "PsLookupProcessByProcessId" fullword ascii 
		$s7 = "LoadLibraryExA" fullword ascii
		$s8 = "gSharedInfo" fullword

		$w1 = "user32.dll" wide
		$w2 = "ntdll" wide	
	condition:
		uint16(0) == 0x5a4d and filesize < 160KB and all of ($s*) and 1 of ($w*)
}
YARA Detection Rule: APT_MAL_FalseFont_Backdoor_Jan24
Repository: Neo23x0/signature-base
Detects: Detects FalseFont backdoor, related to Peach Sandstorm APT
Author: X__Junior, Jonathan Peters
Reference: https://twitter.com/MsftSecIntel/status/[PII_REDACTED]69628824

Pattern signatures:
$x1 = "Agent.Core.WPF.App" ascii
      $x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide //AesIV
      $x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide // AesKey

      $sa1 = "StopSendScreen" wide
      $sa2 = "Decryption failed :(" wide

      $sb1 = "{0}     {1}     {2}     {3}" wide
      $sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
      $sb3 = "select * from logins" wide
      $sb4 = "Loginvault.db" wide
      $sb5 = "password_value" wide

Detection condition:
uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
         or ( 1 of ($sa*) and 4 of ($sb*) )
      )

Full rule:
rule APT_MAL_FalseFont_Backdoor_Jan24 {
   meta:
      description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
      author = "X__Junior, Jonathan Peters"
      date = "2024-01-11"
      reference = "https://twitter.com/MsftSecIntel/status/[PII_REDACTED]69628824"
      hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
      score = 80
      id = "b6a3efff-2abf-5ac1-9a2b-c7b30b51f92c"
   strings:
      $x1 = "Agent.Core.WPF.App" ascii
      $x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide //AesIV
      $x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide // AesKey

      $sa1 = "StopSendScreen" wide
      $sa2 = "Decryption failed :(" wide

      $sb1 = "{0}     {1}     {2}     {3}" wide
      $sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
      $sb3 = "select * from logins" wide
      $sb4 = "Loginvault.db" wide
      $sb5 = "password_value" wide
   condition:
      uint16(0) == 0x5a4d
      and (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
         or ( 1 of ($sa*) and 4 of ($sb*) )
      )
}
YARA Detection Rule: gen_python_encoded_adware
Repository: Neo23x0/signature-base
Detects: Encoded Python payload for adware
Author: John Lambert @JohnLaTwC
Reference: https://twitter.com/JohnLaTwC/status/[PII_REDACTED]66914304

Pattern signatures:
$r1 = "=__import__(\"base64\").b64decode"
        /* $r2 = ")))))" */
        $s1 = "bytes(map(lambda"
        $s2 = "[1]^"

Detection condition:
filesize < 100KB
        and @r1 < 100
        // and @r2 > (filesize - 30)
        and all of them

Full rule:
rule gen_python_encoded_adware
{
    meta: 
        description = "Encoded Python payload for adware"
        author = "John Lambert @JohnLaTwC"
        date = "2018-03-07"
        modified = "2023-01-06"
        hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
        reference = "https://twitter.com/JohnLaTwC/status/[PII_REDACTED]66914304"
        
        id = "7b4b422b-c960-5ab3-a6a7-a30e416efdec"
    strings:
        $r1 = "=__import__(\"base64\").b64decode"
        /* $r2 = ")))))" */
        $s1 = "bytes(map(lambda"
        $s2 = "[1]^"
    condition:
        filesize < 100KB
        and @r1 < 100
        // and @r2 > (filesize - 30)
        and all of them
}
YARA Detection Rule: Nanocore_RAT_Gen_1
Repository: Neo23x0/signature-base
Detects: Detetcs the Nanocore RAT and similar malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
      $x2 = "RunPE1" fullword ascii
      $x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
      $x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
      $x5 = "Monitorinjection" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )

Full rule:
rule Nanocore_RAT_Gen_1 {
   meta:
      description = "Detetcs the Nanocore RAT and similar malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
      date = "2016-04-22"
      score = 70
      hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
      id = "b007e0ce-e64f-5027-95ff-d178383e3b59"
   strings:
      $x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
      $x2 = "RunPE1" fullword ascii
      $x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
      $x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
      $x5 = "Monitorinjection" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
}
YARA Detection Rule: Nanocore_RAT_Gen_2
Repository: Neo23x0/signature-base
Detects: Detetcs the Nanocore RAT
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "NanoCore.ClientPluginHost" fullword ascii
      $x2 = "IClientNetworkHost" fullword ascii
      $x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )

Full rule:
rule Nanocore_RAT_Gen_2 {
   meta:
      description = "Detetcs the Nanocore RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 100
      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
      date = "2016-04-22"
      hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
      id = "74124961-3b0e-5808-b495-90437d3a5999"
   strings:
      $x1 = "NanoCore.ClientPluginHost" fullword ascii
      $x2 = "IClientNetworkHost" fullword ascii
      $x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: Nanocore_RAT_Sample_1
Repository: Neo23x0/signature-base
Detects: Detetcs a certain Nanocore RAT sample
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
      $x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
      $x3 = "popthatkitty.Resources.resources" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )

Full rule:
rule Nanocore_RAT_Sample_1 {
   meta:
      description = "Detetcs a certain Nanocore RAT sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 75
      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
      date = "2016-04-22"
      hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
      id = "381d3caf-77de-544c-869c-4d9f0cae148f"
   strings:
      $x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
      $x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
      $x3 = "popthatkitty.Resources.resources" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
}
YARA Detection Rule: Nanocore_RAT_Sample_2
Repository: Neo23x0/signature-base
Detects: Detetcs a certain Nanocore RAT sample
Author: Florian Roth (Nextron Systems)
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$s1 = "U4tSOtmpM" fullword ascii
      $s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
      $s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)

Full rule:
rule Nanocore_RAT_Sample_2 {
   meta:
      description = "Detetcs a certain Nanocore RAT sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 75
      reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
      date = "2016-04-22"
      hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
      id = "81f6771a-29a3-5fa0-8d24-ea717d3c5251"
   strings:
      $s1 = "U4tSOtmpM" fullword ascii
      $s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
      $s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)
}
YARA Detection Rule: Nanocore_RAT_Feb18_1
Repository: Neo23x0/signature-base
Detects: Detects Nanocore RAT
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - T2T

Pattern signatures:
$x1 = "NanoCore Client.exe" fullword ascii
      $x2 = "NanoCore.ClientPluginHost" fullword ascii

      $s1 = "PluginCommand" fullword ascii
      $s2 = "FileCommand" fullword ascii
      $s3 = "PipeExists" fullword ascii
      $s4 = "PipeCreated" fullword ascii
      $s5 = "IClientLoggingHost" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
        1 of ($x*) or
        5 of them
      )

Full rule:
rule Nanocore_RAT_Feb18_1 {
   meta:
      description = "Detects Nanocore RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - T2T"
      date = "2018-02-19"
      hash1 = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
      id = "6db0c8a7-8c31-58a6-8732-de6663fec16b"
   strings:
      $x1 = "NanoCore Client.exe" fullword ascii
      $x2 = "NanoCore.ClientPluginHost" fullword ascii

      $s1 = "PluginCommand" fullword ascii
      $s2 = "FileCommand" fullword ascii
      $s3 = "PipeExists" fullword ascii
      $s4 = "PipeCreated" fullword ascii
      $s5 = "IClientLoggingHost" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
        1 of ($x*) or
        5 of them
      )
}
YARA Detection Rule: Nanocore_RAT_Feb18_2
Repository: Neo23x0/signature-base
Detects: Detects Nanocore RAT
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - T2T

Pattern signatures:
$s1 = "ResManagerRunnable" fullword ascii
      $s2 = "TransformRunnable" fullword ascii
      $s3 = "MethodInfoRunnable" fullword ascii
      $s4 = "ResRunnable" fullword ascii
      $s5 = "RunRunnable" fullword ascii
      $s6 = "AsmRunnable" fullword ascii
      $s7 = "ReadRunnable" fullword ascii
      $s8 = "ExitRunnable" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule Nanocore_RAT_Feb18_2 {
   meta:
      description = "Detects Nanocore RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - T2T"
      date = "2018-02-19"
      hash1 = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
      id = "83a8ad4d-0bef-5ba2-aa10-eac5601f2c7b"
   strings:
      $s1 = "ResManagerRunnable" fullword ascii
      $s2 = "TransformRunnable" fullword ascii
      $s3 = "MethodInfoRunnable" fullword ascii
      $s4 = "ResRunnable" fullword ascii
      $s5 = "RunRunnable" fullword ascii
      $s6 = "AsmRunnable" fullword ascii
      $s7 = "ReadRunnable" fullword ascii
      $s8 = "ExitRunnable" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: MAL_Emotet_JS_Dropper_Oct19_1
Repository: Neo23x0/signature-base
Detects: Detects Emotet JS dropper
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/

Pattern signatures:
$xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
               27 00 }

Detection condition:
uint32(0) == 0x0076feff and filesize <= 700KB and $xc1 at 0

Full rule:
rule MAL_Emotet_JS_Dropper_Oct19_1 {
   meta:
      description = "Detects Emotet JS dropper"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
      date = "2019-10-03"
      hash1 = "38295d[PII_REDACTED]72b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
      hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
      id = "34605452-8f3d-540a-b66f-4f68d9187003"
   strings:
      $xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
               27 00 }
   condition:
      uint32(0) == 0x0076feff and filesize <= 700KB and $xc1 at 0
}
YARA Detection Rule: MAL_Emotet_Jan20_1
Repository: Neo23x0/signature-base
Detects: Detects Emotet malware
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/

Pattern signatures:
$op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
      $op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
      $op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }

Detection condition:
uint16(0) == 0x5a4d and filesize <= 200KB and (
         pe.imphash() == "009889c73bd2e55113bf6dfa5f395e0d" or
         1 of them
      )

Full rule:
rule MAL_Emotet_Jan20_1 {
   meta:
      description = "Detects Emotet malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
      date = "2020-01-29"
      hash1 = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
      id = "334ae7e5-0a46-5e95-bf53-0f343db4e4de"
   strings:
      $op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
      $op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
      $op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }
   condition:
      uint16(0) == 0x5a4d and filesize <= 200KB and (
         pe.imphash() == "009889c73bd2e55113bf6dfa5f395e0d" or
         1 of them
      )
}
YARA Detection Rule: MAL_Emotet_BKA_Quarantine_Apr21
Repository: Neo23x0/signature-base
Author: press inquiries <info@bka.de>, technical contact <info@mha.bka.de>
Reference: https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html

Pattern signatures:
$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }

Detection condition:
$key at 0

Full rule:
rule MAL_Emotet_BKA_Quarantine_Apr21 {
   meta:
      author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
      reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
      descripton = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
      note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
      sharing = "TLP:WHITE"
      date = "2021-03-23"
      id = "22c27d82-00cb-5d2f-a1cc-9f8b4c60aecd"
   strings:
      $key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
   condition:
      $key at 0
}