deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: BlackEnergy_VBS_Agent
Repository: Yara-Rules/rules
Detects: Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
Author: Florian Roth
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
        $s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
        $s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule BlackEnergy_VBS_Agent 
{

    meta:
        description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
        author = "Florian Roth"
        reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
        date = "2016-01-03"
        hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
    
    strings:
        $s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
        $s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
        $s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
   
    condition:
        filesize < 1KB and 2 of them
}
YARA Detection Rule: DropBear_SSH_Server
Repository: Yara-Rules/rules
Detects: Detects DropBear SSH Server (not a threat but used to maintain access)
Author: Florian Roth
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
        $s2 = "Badly formatted command= authorized_keys option" fullword ascii
        $s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
        $s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
        $s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them

Full rule:
rule DropBear_SSH_Server
 {

    meta:
        description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
        author = "Florian Roth"
        reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
        date = "2016-01-03"
        score = 50
        hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
    
    strings:
        $s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
        $s2 = "Badly formatted command= authorized_keys option" fullword ascii
        $s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
        $s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
        $s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
}
YARA Detection Rule: BlackEnergy_BackdoorPass_DropBear_SSH
Repository: Yara-Rules/rules
Detects: Detects the password of the backdoored DropBear SSH Server - BlackEnergy
Author: Florian Roth
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s1 = "passDs5Bu9Te7" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and $s1

Full rule:
rule BlackEnergy_BackdoorPass_DropBear_SSH 
{
    
    meta:
        description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
        author = "Florian Roth"
        reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
        date = "2016-01-03"
        hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
    
    strings:
        $s1 = "passDs5Bu9Te7" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and $s1
}
YARA Detection Rule: BlackEnergy_KillDisk_1
Repository: Yara-Rules/rules
Detects: Detects KillDisk malware from BlackEnergy
Author: Florian Roth
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "system32\\cmd.exe" fullword ascii
        $s1 = "system32\\icacls.exe" fullword wide
        $s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
        $s3 = "shutdown /r /t %d" fullword ascii
        $s4 = "/C /Q /grant " fullword wide
        $s5 = "%08X.tmp" fullword ascii
        $s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
        $s7 = "/c format %c: /Y /Q" fullword ascii
        $s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
        $s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 8 of them

Full rule:
rule BlackEnergy_KillDisk_1 
{

    meta:
        description = "Detects KillDisk malware from BlackEnergy"
        author = "Florian Roth"
        reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
        date = "2016-01-03"
        score = 80
        super_rule = 1
        hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
        hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
        hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
        hash4 = "f[PII_REDACTED]4be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"

    strings:
        $s0 = "system32\\cmd.exe" fullword ascii
        $s1 = "system32\\icacls.exe" fullword wide
        $s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
        $s3 = "shutdown /r /t %d" fullword ascii
        $s4 = "/C /Q /grant " fullword wide
        $s5 = "%08X.tmp" fullword ascii
        $s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
        $s7 = "/c format %c: /Y /Q" fullword ascii
        $s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
        $s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
 
    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
}
YARA Detection Rule: BlackEnergy_KillDisk_2
Repository: Yara-Rules/rules
Detects: Detects KillDisk malware from BlackEnergy
Author: Florian Roth
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
        $s1 = "%s%08X.tmp" fullword ascii
        $s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide
        $s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 3 of them

Full rule:
rule BlackEnergy_KillDisk_2 
{

    meta:
        description = "Detects KillDisk malware from BlackEnergy"
        author = "Florian Roth"
        reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
        date = "2016-01-03"
        score = 80
        super_rule = 1
        hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
        hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
        hash3 = "f[PII_REDACTED]4be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"

    strings:
        $s0 = "%c:\\~tmp%08X.tmp" fullword ascii
        $s1 = "%s%08X.tmp" fullword ascii
        $s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" fullword wide
        $s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
}
YARA Detection Rule: BlackEnergy_Driver_USBMDM
Repository: Yara-Rules/rules
Detects: Auto-generated rule - from files 7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094, b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a, edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281
Author: Florian Roth
Reference: http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/

Pattern signatures:
$s1 = "USB MDM Driver" fullword wide
        $s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
        $s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 180KB and all of them

Full rule:
rule BlackEnergy_Driver_USBMDM 
{

    meta:
        description = "Auto-generated rule - from files 7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094, b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a, edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
        author = "Florian Roth"
        reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
        date = "2016-01-04"
        super_rule = 1
        hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
        hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
        hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
        hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a[PII_REDACTED]917df4276c583fc"
        hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
        hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
        hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
        hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
    
    strings:
        $s1 = "USB MDM Driver" fullword wide
        $s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
        $s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
    condition:
        uint16(0) == 0x5a4d and filesize < 180KB and all of them
}
YARA Detection Rule: BlackEnergy_Driver_AMDIDE
Repository: Yara-Rules/rules
Detects: Auto-generated rule - from files 32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614, 3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2, 90ba78b6710462c2d97815e[PII_REDACTED]b3b296135490f0095bdc0cd97a34d9c, 97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1
Author: Florian Roth
Reference: http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/

Pattern signatures:
$s1 = " AMD IDE driver" fullword wide
        $s2 = "SessionEnv" fullword wide
        $s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
        $s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 150KB and all of them

Full rule:
rule BlackEnergy_Driver_AMDIDE 
{

    meta:
        description = "Auto-generated rule - from files 32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614, 3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2, 90ba78b6710462c2d97815e[PII_REDACTED]b3b296135490f0095bdc0cd97a34d9c, 97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
        author = "Florian Roth"
        reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
        date = "2016-01-04"
        super_rule = 1
        hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
        hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
        hash3 = "90ba78b6710462c2d97815e[PII_REDACTED]b3b296135490f0095bdc0cd97a34d9c"
        hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
        hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
        hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
        hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
   
    strings:
        $s1 = " AMD IDE driver" fullword wide
        $s2 = "SessionEnv" fullword wide
        $s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
        $s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
    
    condition:
        uint16(0) == 0x5a4d and filesize < 150KB and all of them
}
YARA Detection Rule: TreasureHunt
Repository: Yara-Rules/rules
Author: Minerva Labs

Pattern signatures:
$a = "treasureHunter.pdb"
      $b = "jucheck"
      $c = "cmdLineDecrypted"

Detection condition:
all of them

Full rule:
rule TreasureHunt
  {
    meta:
      author = "Minerva Labs"
      ref ="http://www.minerva-labs.com/#!Cybercriminals-Adopt-the-Mossad-Emblem/c7a5/573da2d60cf2f90ca6f6e3ed"
      date = "2016/06"
      maltype = "Point of Sale (POS) Malware"
      filetype = "exe"

    strings:
      $a = "treasureHunter.pdb"
      $b = "jucheck"
      $c = "cmdLineDecrypted"

    condition:
      all of them
}
YARA Detection Rule: apt_hellsing_implantstrings
Repository: Yara-Rules/rules
Detects: detection for Hellsing implants
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $a1="the file uploaded failed !" 
        $a2="ping 127.0.0.1"      
        $b1="the file downloaded failed !" 
        $b2="common.asp"
        $c="xweber_server.exe" 
        $d="action="
        $debugpath1="d:\\Hellsing\\release\\msger\\" nocase 
        $debugpath2="d:\\hellsing\\sys\\xrat\\" nocase 
        $debugpath3="D:\\Hellsing\\release\\exe\\" nocase 
        $debugpath4="d:\\hellsing\\sys\\xkat\\" nocase 
        $debugpath5="e:\\Hellsing\\release\\clare" nocase 
        $debugpath6="e:\\Hellsing\\release\\irene\\" nocase 
        $debugpath7="d:\\hellsing\\sys\\irene\\" nocase
        $e="msger_server.dll"
        $f="ServiceMain"

Detection condition:
($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000

Full rule:
rule apt_hellsing_implantstrings
{ 
  
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing implants"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back"

    strings: 
        $mz="MZ"
        $a1="the file uploaded failed !" 
        $a2="ping 127.0.0.1"      
        $b1="the file downloaded failed !" 
        $b2="common.asp"
        $c="xweber_server.exe" 
        $d="action="
        $debugpath1="d:\\Hellsing\\release\\msger\\" nocase 
        $debugpath2="d:\\hellsing\\sys\\xrat\\" nocase 
        $debugpath3="D:\\Hellsing\\release\\exe\\" nocase 
        $debugpath4="d:\\hellsing\\sys\\xkat\\" nocase 
        $debugpath5="e:\\Hellsing\\release\\clare" nocase 
        $debugpath6="e:\\Hellsing\\release\\irene\\" nocase 
        $debugpath7="d:\\hellsing\\sys\\irene\\" nocase
        $e="msger_server.dll"
        $f="ServiceMain"

    condition:
        ($mz at 0) and (all of ($a*)) or (all of ($b*)) or ($c and $d) or (any of ($debugpath*)) or ($e and $f) and filesize < 500000
}
YARA Detection Rule: apt_hellsing_installer
Repository: Yara-Rules/rules
Detects: detection for Hellsing xweber/msger installers
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $cmd="cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
        $a1="xweber_install_uac.exe"
        $a2="system32\\cmd.exe" wide
        $a4="S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y=" 
        $a5="S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg=" $a6="7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
        $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw==" 
        $a8="vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSI Njl2tyI" $a9="C:\\Windows\\System32\\sysprep\\sysprep.exe" wide 
        $a10="%SystemRoot%\\system32\\cmd.exe" wide 
        $a11="msger_install.dll"
        $a12={00 65 78 2E 64 6C 6C 00}

Detection condition:
($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000

Full rule:
rule apt_hellsing_installer
{
    
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing xweber/msger installers"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back" 

    strings: 
        $mz="MZ"
        $cmd="cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
        $a1="xweber_install_uac.exe"
        $a2="system32\\cmd.exe" wide
        $a4="S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y=" 
        $a5="S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg=" $a6="7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
        $a7="vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw==" 
        $a8="vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSI Njl2tyI" $a9="C:\\Windows\\System32\\sysprep\\sysprep.exe" wide 
        $a10="%SystemRoot%\\system32\\cmd.exe" wide 
        $a11="msger_install.dll"
        $a12={00 65 78 2E 64 6C 6C 00}

    condition:
        ($mz at 0) and ($cmd and (2 of ($a*))) and filesize < 500000
}
YARA Detection Rule: apt_hellsing_proxytool
Repository: Yara-Rules/rules
Detects: detection for Hellsing proxy testing tool
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $a1="PROXY_INFO: automatic proxy url => %s " 
        $a2="PROXY_INFO: connection type => %d " 
        $a3="PROXY_INFO: proxy server => %s " 
        $a4="PROXY_INFO: bypass list => %s " 
        $a5="InternetQueryOption failed with GetLastError() %d" 
        $a6="D:\\Hellsing\\release\\exe\\exe\\" nocase

Detection condition:
($mz at 0) and (2 of ($a*)) and filesize < 300000

Full rule:
rule apt_hellsing_proxytool
{
    
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing proxy testing tool"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back" 

    strings: 
        $mz="MZ"
        $a1="PROXY_INFO: automatic proxy url => %s " 
        $a2="PROXY_INFO: connection type => %d " 
        $a3="PROXY_INFO: proxy server => %s " 
        $a4="PROXY_INFO: bypass list => %s " 
        $a5="InternetQueryOption failed with GetLastError() %d" 
        $a6="D:\\Hellsing\\release\\exe\\exe\\" nocase

    condition:
        ($mz at 0) and (2 of ($a*)) and filesize < 300000
}
YARA Detection Rule: apt_hellsing_xkat
Repository: Yara-Rules/rules
Detects: detection for Hellsing xKat tool
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $a1="\\Dbgv.sys"
        $a2="XKAT_BIN"
        $a3="release sys file error."
        $a4="driver_load error. "
        $a5="driver_create error."
        $a6="delete file:%s error."
        $a7="delete file:%s ok."
        $a8="kill pid:%d error."
        $a9="kill pid:%d ok."
        $a10="-pid-delete"
        $a11="kill and delete pid:%d error."
        $a12="kill and delete pid:%d ok."

Detection condition:
($mz at 0) and (6 of ($a*)) and filesize < 300000

Full rule:
rule apt_hellsing_xkat 
{
    
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing xKat tool"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back"

    strings:
        $mz="MZ"
        $a1="\\Dbgv.sys"
        $a2="XKAT_BIN"
        $a3="release sys file error."
        $a4="driver_load error. "
        $a5="driver_create error."
        $a6="delete file:%s error."
        $a7="delete file:%s ok."
        $a8="kill pid:%d error."
        $a9="kill pid:%d ok."
        $a10="-pid-delete"
        $a11="kill and delete pid:%d error."
        $a12="kill and delete pid:%d ok."

    condition:
        ($mz at 0) and (6 of ($a*)) and filesize < 300000
}
YARA Detection Rule: apt_hellsing_msgertype2
Repository: Yara-Rules/rules
Detects: detection for Hellsing msger type 2 implants
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $a1="%s\\system\\%d.txt"
        $a2="_msger"
        $a3="http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
        $a4="http://%s/data/%s[PII_REDACTED]"
        $a5="/lib/common.asp?action=user_upload&file="
        $a6="%02X-%02X-%02X-%02X-%02X-%02X"

Detection condition:
($mz at 0) and (4 of ($a*)) and filesize < 500000

Full rule:
rule apt_hellsing_msgertype2
{
    
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing msger type 2 implants"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back"

    strings:
        $mz="MZ"
        $a1="%s\\system\\%d.txt"
        $a2="_msger"
        $a3="http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
        $a4="http://%s/data/%s[PII_REDACTED]"
        $a5="/lib/common.asp?action=user_upload&file="
        $a6="%02X-%02X-%02X-%02X-%02X-%02X"
    
    condition:
        ($mz at 0) and (4 of ($a*)) and filesize < 500000
}
YARA Detection Rule: apt_hellsing_irene
Repository: Yara-Rules/rules
Detects: detection for Hellsing msger irene installer
Author: Costin Raiu, Kaspersky Lab
Reference: http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back

Pattern signatures:
$mz="MZ"
        $a1="\\Drivers\\usbmgr.tmp" wide
        $a2="\\Drivers\\usbmgr.sys" wide
        $a3="common_loadDriver CreateFile error! " 
        $a4="common_loadDriver StartService error && GetLastError():%d! " 
        $a5="irene" wide
        $a6="aPLib v0.43 - the smaller the better"

Detection condition:
($mz at 0) and (4 of ($a*)) and filesize < 500000

Full rule:
rule apt_hellsing_irene
{
    
    meta:
        Author = "Costin Raiu, Kaspersky Lab"
        Date = "2015-04-07"
        Description = "detection for Hellsing msger irene installer"
        Reference = "http://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back"

    strings: 
        $mz="MZ"
        $a1="\\Drivers\\usbmgr.tmp" wide
        $a2="\\Drivers\\usbmgr.sys" wide
        $a3="common_loadDriver CreateFile error! " 
        $a4="common_loadDriver StartService error && GetLastError():%d! " 
        $a5="irene" wide
        $a6="aPLib v0.43 - the smaller the better" 

    condition:
        ($mz at 0) and (4 of ($a*)) and filesize < 500000
}
YARA Detection Rule: Ransom_CryptXXX_Dropper
Repository: Yara-Rules/rules
Detects: Regla para detectar RANSOM.CRYPTXXX
Author: CCN-CERT

Pattern signatures:
$a = { 50 65 31 57 58 43 46 76 59 62 48 6F 35 }
        $b = { 43 00 3A 00 5C 00 42 00 49 00 45 00 52 00 5C 00 51 00 6D 00 6B 00 4E 00 52 00 4C 00 46 00 00 }

Detection condition:
all of them

Full rule:
rule Ransom_CryptXXX_Dropper
{
    /*
      Regla para detectar el dropper de Ransom.CryptXXX con MD5 d01fd2bb8c6296d51be297978af8b3a1
    */
    meta:
        description = "Regla para detectar RANSOM.CRYPTXXX"
        author      = "CCN-CERT"
        version     = "1.0"
        ref = "https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/4002-publicado-el-informe-del-codigo-danino-ransom-cryptxxx.html"
    strings:
        $a = { 50 65 31 57 58 43 46 76 59 62 48 6F 35 }
        $b = { 43 00 3A 00 5C 00 42 00 49 00 45 00 52 00 5C 00 51 00 6D 00 6B 00 4E 00 52 00 4C 00 46 00 00 }
    condition:
        all of them
}