deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: IronPanda_Malware_Htran
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware Htran
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
		$s11 = "_cmshared_get_ptr_from_atom" ascii
		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s13 = "[-] TransmitPort invalid." fullword ascii
		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) 
		 or 
		 5 of them

Full rule:
rule IronPanda_Malware_Htran {
	meta:
		description = "Iron Panda Malware Htran"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
		id = "7215f0da-9367-59b4-a78b-aeeebc4f2b69"
	strings:
		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
		$s11 = "_cmshared_get_ptr_from_atom" ascii
		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
		$s13 = "[-] TransmitPort invalid." fullword ascii
		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
	condition:
		 ( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) 
		 or 
		 5 of them
}
YARA Detection Rule: IronPanda_Malware2
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "\\setup.exe" ascii
		$s1 = "msi.dll.urlUT" fullword ascii
		$s2 = "msi.dllUT" fullword ascii
		$s3 = "setup.exeUT" fullword ascii
		$s4 = "/c del /q %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 180KB and all of them

Full rule:
rule IronPanda_Malware2 {
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "a89c21dd608c51c4bf0323d640f816e[PII_REDACTED]89f9edcf04cd34090decc91"
		id = "63916f73-808d-5dc7-86f3-05c8b9c5650d"
	strings:
		$s0 = "\\setup.exe" ascii
		$s1 = "msi.dll.urlUT" fullword ascii
		$s2 = "msi.dllUT" fullword ascii
		$s3 = "setup.exeUT" fullword ascii
		$s4 = "/c del /q %s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 180KB and all of them
}
YARA Detection Rule: IronPanda_Malware3
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "PluginDeflater.exe" fullword wide
		$s1 = ".Deflated" fullword wide
		$s2 = "PluginDeflater" fullword ascii
		$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
		$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
		$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 10KB and all of them

Full rule:
rule IronPanda_Malware3 {
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
		id = "bc3094ab-9dc8-5b9d-aa13-28daa7d5c13f"
	strings:
		$s0 = "PluginDeflater.exe" fullword wide
		$s1 = ".Deflated" fullword wide
		$s2 = "PluginDeflater" fullword ascii
		$s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
		$s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
		$s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 10KB and all of them
}
YARA Detection Rule: IronPanda_Malware4
Repository: Neo23x0/signature-base
Detects: Iron Panda Malware
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "TestPlugin.dll" fullword wide
		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
		$s6 = "TestPlugin" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 10KB and all of them

Full rule:
rule IronPanda_Malware4 {
	meta:
		description = "Iron Panda Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/E4qia9"
		date = "2015-09-16"
		hash = "0d6da[PII_REDACTED]16f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
		id = "0a72c1e1-b442-52d4-af52-b863abe5ba3c"
	strings:
		$s0 = "TestPlugin.dll" fullword wide
		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
		$s6 = "TestPlugin" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 10KB and all of them
}
YARA Detection Rule: Microcin_Sample_1
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$s1 = "e Class Descriptor at (" ascii
      $s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
      $s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
      $s4 = ".?AVCAppleBinRealClass@@" fullword ascii
      $s5 = ".?AVCAppleBinBaseClass@@" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and (
            4 of them or
            pe.imphash() == "897077ca318eaf629cfe74569f10e023"
         )
      )

Full rule:
rule Microcin_Sample_1 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
      hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
      hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
      id = "96e9ac3b-a837-5909-b17b-259d54e0e7fd"
   strings:
      $s1 = "e Class Descriptor at (" ascii
      $s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
      $s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
      $s4 = ".?AVCAppleBinRealClass@@" fullword ascii
      $s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and (
            4 of them or
            pe.imphash() == "897077ca318eaf629cfe74569f10e023"
         )
      )
}
YARA Detection Rule: Microcin_Sample_2
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$s2 = "[Pause]" fullword ascii
      $s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule Microcin_Sample_2 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "8a7d[PII_REDACTED]9f[PII_REDACTED]184d75b26c375a77b468d8cbad6dbdb0c99271"
      id = "8718ef84-be2b-55a6-a4bb-41161548a2b4"
   strings:
      $s2 = "[Pause]" fullword ascii
      $s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: Microcin_Sample_3
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
      $s2 = "test, Version 1.0" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule Microcin_Sample_3 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "4f74a3b67c5ed6f38f08786f[PII_REDACTED]49fe128f12c[PII_REDACTED]0d681e1d"
      id = "daecdfe3-e78c-55ee-83a3-3cee8cb9bb5f"
   strings:
      $x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
      $s2 = "test, Version 1.0" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: Microcin_Sample_4
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
      $s2 = "ini.dat" fullword wide
      $s3 = "winupdata" fullword wide

      $f1 = "%s\\(%08x%08x)%s" fullword wide
      $f2 = "%s\\d%08x\\d%08x.db" fullword wide
      $f3 = "%s\\u%08x\\u%08x.db" fullword wide
      $f4 = "%s\\h%08x\\h%08x.db" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or 5 of them )

Full rule:
rule Microcin_Sample_4 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
      id = "8a6a0735-422a-5e91-9274-ce55f7bee5d3"
   strings:
      $s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
      $s2 = "ini.dat" fullword wide
      $s3 = "winupdata" fullword wide

      $f1 = "%s\\(%08x%08x)%s" fullword wide
      $f2 = "%s\\d%08x\\d%08x.db" fullword wide
      $f3 = "%s\\u%08x\\u%08x.db" fullword wide
      $f4 = "%s\\h%08x\\h%08x.db" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of ($s*) or 5 of them )
}
YARA Detection Rule: Microcin_Sample_5
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
      $x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
      $x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
      $x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
      $x5 = "No password found!" fullword ascii
      $x7 = "Can not found the Password Dictoonary file! " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them

Full rule:
rule Microcin_Sample_5 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
      id = "cd06f9f7-0ba3-52c9-a814-be1cd53e2e42"
   strings:
      $x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
      $x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
      $x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
      $x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
      $x5 = "No password found!" fullword ascii
      $x7 = "Can not found the Password Dictoonary file! " fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and 1 of them ) or 2 of them
}
YARA Detection Rule: Microcin_Sample_6
Repository: Neo23x0/signature-base
Detects: Malware sample mentioned in Microcin technical report by Kaspersky
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf

Pattern signatures:
$s1 = "** ERROR ** %s: %s" fullword ascii
      $s2 = "TEMPDATA" fullword wide
      $s3 = "Bruntime error " fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and all of them )

Full rule:
rule Microcin_Sample_6 {
   meta:
      description = "Malware sample mentioned in Microcin technical report by Kaspersky"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
      date = "2017-09-26"
      hash1 = "cbd43e70dc55e[PII_REDACTED]2d7b91b07a3997722d4a539ecc4015f37ea14a26e"
      hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
      id = "9988723f-a7ca-598f-9a6c-9f[PII_REDACTED]"
   strings:
      $s1 = "** ERROR ** %s: %s" fullword ascii
      $s2 = "TEMPDATA" fullword wide
      $s3 = "Bruntime error " fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and all of them )
}
YARA Detection Rule: Andromeda_MalBot_Jun_1A
Repository: Neo23x0/signature-base
Detects: Detects a malicious Worm Andromeda / RETADUP
Author: Florian Roth (Nextron Systems)
Reference: http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/

Pattern signatures:
$x1 = "%temp%\\FolderN\\name.exe" fullword wide
      $x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
      $x3 = "\\Startup\\name.exe" wide
      $x4 = "firefox.exe.exe" fullword wide
      $x5 = "\\Desktop\\New folder\\dark.exe" wide
      $x6 = "\\x86\\Release\\word.pdb" ascii
      $x7 = "\\obj\\Release\\botkill.pdb" ascii

      $s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
      $s2 = "svhost.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 2 of them )

Full rule:
rule Andromeda_MalBot_Jun_1A {
   meta:
      description = "Detects a malicious Worm Andromeda / RETADUP"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
      date = "2017-06-30"
      modified = "2022-12-21"
      hash1 = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
      hash2 = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
      hash3 = "66035cc81e811735beab[PII_REDACTED]53749b02703eae58b90430646f6e3e3eb4"
      hash4 = "42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed"
      id = "42ee6ba3-85ea-5369-bd9b-8ffdec6e17bc"
   strings:
      $x1 = "%temp%\\FolderN\\name.exe" fullword wide
      $x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
      $x3 = "\\Startup\\name.exe" wide
      $x4 = "firefox.exe.exe" fullword wide
      $x5 = "\\Desktop\\New folder\\dark.exe" wide
      $x6 = "\\x86\\Release\\word.pdb" ascii
      $x7 = "\\obj\\Release\\botkill.pdb" ascii

      $s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
      $s2 = "svhost.exe" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and ( 1 of ($x*) or 2 of them )
}
YARA Detection Rule: Monsoon_APT_Malware_1
Repository: Neo23x0/signature-base
Detects: Detects malware from Monsoon APT
Author: Florian Roth (Nextron Systems)
Reference: http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2

Pattern signatures:
$s1 = "cmd.exe /c start " fullword ascii
      $s2 = "\\Microsoft\\Templates\\" ascii
      $s3 = "\\Microsoft\\Windows\\" ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "a0c824244f1d36ea1dd2759cf7599cd1" or
           all of them
        )
      )

Full rule:
rule Monsoon_APT_Malware_1 {
   meta:
      description = "Detects malware from Monsoon APT"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
      date = "2017-09-08"
      modified = "2023-01-06"
      hash1 = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
      id = "a543c46d-01fc-5276-a[PII_REDACTED]56455"
   strings:
      $s1 = "cmd.exe /c start " fullword ascii
      $s2 = "\\Microsoft\\Templates\\" ascii
      $s3 = "\\Microsoft\\Windows\\" ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "a0c824244f1d36ea1dd2759cf7599cd1" or
           all of them
        )
      )
}
YARA Detection Rule: Monsoon_APT_Malware_2
Repository: Neo23x0/signature-base
Detects: Detects malware from Monsoon APT
Author: Florian Roth (Nextron Systems)
Reference: http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2

Pattern signatures:
$x1 = "\\Microsoft\\Windows\\coco.exe" ascii
      $x2 = ":\\System Volume Information\\config" fullword ascii
      $x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide

      $s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
      $s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
      $s3 = "wininet.dll    " fullword ascii
      $s4 = "DMCZ0001.dat" fullword ascii
      $s5 = "TZ0000001.dat" fullword ascii
      $s6 = "\\MUT.dat" ascii
      $s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 400KB and ( 1 of ($x*) or 3 of them )
      )

Full rule:
rule Monsoon_APT_Malware_2 {
   meta:
      description = "Detects malware from Monsoon APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
      date = "2017-09-08"
      hash1 = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
      hash2 = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
      hash3 = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
      id = "dbbccf56-7e36-5c3a-b8d9-ee08d077f29f"
   strings:
      $x1 = "\\Microsoft\\Windows\\coco.exe" ascii
      $x2 = ":\\System Volume Information\\config" fullword ascii
      $x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide

      $s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
      $s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
      $s3 = "wininet.dll    " fullword ascii
      $s4 = "DMCZ0001.dat" fullword ascii
      $s5 = "TZ0000001.dat" fullword ascii
      $s6 = "\\MUT.dat" ascii
      $s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 400KB and ( 1 of ($x*) or 3 of them )
      )
}
YARA Detection Rule: MAL_Etoroloro_Malicious_NodePackage_Dec25
Repository: Neo23x0/signature-base
Detects: Detects malicious component of node package named Etoroloro
Author: Pezier Pierre-Henri
Reference: Internal Research

Pattern signatures:
$s1 = "DLLSideload."
      $s2 = "Failed to expand path:" wide
      $op1 = {
         41 0f af c0           // imul    eax, r8d
         48 8d 52 01           // lea     rdx, [rdx+1]
         0f b6 c9              // movzx   ecx, cl
         45 69 c0 35 d4 04 00  // imul    r8d, 4D435h
         03 c1                 // add     eax, ecx
         0f b6 0a              // movzx   ecx, byte ptr [rdx]
         84 c9                 // test    cl, cl
         75 e5                 // jnz     short loc_1800022C0
      }

Detection condition:
uint16(0) == 0x5a4d
      and (all of ($s*) or $op1)

Full rule:
rule MAL_Etoroloro_Malicious_NodePackage_Dec25 {
   meta:
      description = "Detects malicious component of node package named Etoroloro"
      reference = "Internal Research"
      author = "Pezier Pierre-Henri"
      date = "2025-12-12"
      score = 80
      hash = "f08c5b748c91dd45fd73c5e85920f656e361d94b869e2147410b2b528c6ae78f"
   strings:
      $s1 = "DLLSideload."
      $s2 = "Failed to expand path:" wide
      $op1 = {
         41 0f af c0           // imul    eax, r8d
         48 8d 52 01           // lea     rdx, [rdx+1]
         0f b6 c9              // movzx   ecx, cl
         45 69 c0 35 d4 04 00  // imul    r8d, 4D435h
         03 c1                 // add     eax, ecx
         0f b6 0a              // movzx   ecx, byte ptr [rdx]
         84 c9                 // test    cl, cl
         75 e5                 // jnz     short loc_1800022C0
      }
   condition:
      uint16(0) == 0x5a4d
      and (all of ($s*) or $op1)
}