deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WindowsShell_s4
Repository: Neo23x0/signature-base
Detects: Detects simple Windows shell - file s4.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/odzhan/shells/

Pattern signatures:
$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v4" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s8 = "-l           Listen for incoming connections" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )

Full rule:
rule WindowsShell_s4 {
	meta:
		description = "Detects simple Windows shell - file s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "838771dc-f885-5332-9813-2bc01af8e5fe"
	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
		$s3 = "get <remote> <local> - download file" fullword ascii
		$s4 = "[ simple remote shell for windows v4" fullword ascii
		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s8 = "-l           Listen for incoming connections" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
}
YARA Detection Rule: WindowsShell_Gen
Repository: Neo23x0/signature-base
Detects: Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/odzhan/shells/

Pattern signatures:
$s0 = "[ %c%c requires parameter" fullword ascii
		$s1 = "[ %s : %i" fullword ascii
		$s2 = "[ %s : %s" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )

Full rule:
rule WindowsShell_Gen {
	meta:
		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		super_rule = 1
		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "6b871e8a-8fe3-5cc6-9f2c-ba2359861ea1"
	strings:
		$s0 = "[ %c%c requires parameter" fullword ascii
		$s1 = "[ %s : %i" fullword ascii
		$s2 = "[ %s : %s" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: WindowsShell_Gen2
Repository: Neo23x0/signature-base
Detects: Detects simple Windows shell - from files s3.exe, s4.exe
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/odzhan/shells/

Pattern signatures:
$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "get <remote> <local> - download file" fullword ascii
		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s4 = "put <local> <remote> - upload file" fullword ascii
		$s5 = "term                 - terminate remote client" fullword ascii
		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ error : received %i bytes" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )

Full rule:
rule WindowsShell_Gen2 {
	meta:
		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://github.com/odzhan/shells/"
		date = "2016-03-26"
		super_rule = 1
		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
		id = "8ed8443d-491b-5cb0-b12b-0d25267ba462"
	strings:
		$s1 = "cmd                  - execute cmd.exe" fullword ascii
		$s2 = "get <remote> <local> - download file" fullword ascii
		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
		$s4 = "put <local> <remote> - upload file" fullword ascii
		$s5 = "term                 - terminate remote client" fullword ascii
		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
		$s7 = "[ error : received %i bytes" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 175KB and 2 of them ) or ( 5 of them )
}
YARA Detection Rule: APT_DonotTeam_YTYframework
Repository: Neo23x0/signature-base
Detects: Modular malware framework with similarities to EHDevel
Author: James E.C, ProofPoint
Reference: https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/

Pattern signatures:
$x1 = "/football/download2/" ascii wide
      $x2 = "/football/download/" ascii wide
      $x3 = "Caption: Xp>" wide

      $x_c2 = "5.135.199.0" ascii fullword

      $a1 = "getGoogle" ascii fullword
      $a2 = "/q /noretstart" wide
      $a3 = "IsInSandbox" ascii fullword
      $a4 = "syssystemnew" ascii fullword
      $a5 = "ytyinfo" ascii fullword
      $a6 = "\\ytyboth\\yty " ascii

      $s1 = "SELECT Name FROM Win32_Processor" wide
      $s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
      $s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
      $s4 = "VM: Yes" wide fullword
      $s5 = "VM: No" wide fullword
      $s6 = "helpdll.dll" ascii fullword
      $s7 = "boothelp.exe" ascii fullword
      $s8 = "SbieDll.dll" wide fullword
      $s9 = "dbghelp.dll" wide fullword
      $s10 = "YesNoMaybe" ascii fullword
      $s11 = "saveData" ascii fullword
      $s12 = "saveLogs" ascii fullword

Detection condition:
uint16be(0) == 0x4d5a and filesize < 500KB and (
         pe.imphash() == "[PII_REDACTED]9fa860b9963b11596a2ded" or
         1 of ($x*) or 3 of ($a*) or 6 of ($s*)
      )

Full rule:
rule APT_DonotTeam_YTYframework : APT DonotTeam Windows {
   meta:
      author = "James E.C, ProofPoint"
      description = "Modular malware framework with similarities to EHDevel"
      hashes = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
      reference = "https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"
      reference2 = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
      date = "08-03-2018"
      id = "6dd07019-aa5a-5966-8331-b6f6758b0652"
   strings:
      $x1 = "/football/download2/" ascii wide
      $x2 = "/football/download/" ascii wide
      $x3 = "Caption: Xp>" wide

      $x_c2 = "5.135.199.0" ascii fullword

      $a1 = "getGoogle" ascii fullword
      $a2 = "/q /noretstart" wide
      $a3 = "IsInSandbox" ascii fullword
      $a4 = "syssystemnew" ascii fullword
      $a5 = "ytyinfo" ascii fullword
      $a6 = "\\ytyboth\\yty " ascii

      $s1 = "SELECT Name FROM Win32_Processor" wide
      $s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
      $s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
      $s4 = "VM: Yes" wide fullword
      $s5 = "VM: No" wide fullword
      $s6 = "helpdll.dll" ascii fullword
      $s7 = "boothelp.exe" ascii fullword
      $s8 = "SbieDll.dll" wide fullword
      $s9 = "dbghelp.dll" wide fullword
      $s10 = "YesNoMaybe" ascii fullword
      $s11 = "saveData" ascii fullword
      $s12 = "saveLogs" ascii fullword
   condition:
      uint16be(0) == 0x4d5a and filesize < 500KB and (
         pe.imphash() == "[PII_REDACTED]9fa860b9963b11596a2ded" or
         1 of ($x*) or 3 of ($a*) or 6 of ($s*)
      )
}
YARA Detection Rule: APT_HKTL_Wiper_WhisperGate_Jan22_1
Repository: Neo23x0/signature-base
Detects: Detects unknown wiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

Pattern signatures:
/* AAAAA\x00Your hard drive has been corrupted. */
      $xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
               6F 72 72 75 70 74 65 64 }
      
      $op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
      $op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
      $op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 100KB and ( 1 of ($x*) or 2 of them ) or all of them

Full rule:
rule APT_HKTL_Wiper_WhisperGate_Jan22_1 {
   meta:
      description = "Detects unknown wiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
      date = "2022-01-16"
      score = 85
      hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
      id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"
   strings:
      /* AAAAA\x00Your hard drive has been corrupted. */
      $xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
               6F 72 72 75 70 74 65 64 }
      
      $op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
      $op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
      $op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 100KB and ( 1 of ($x*) or 2 of them ) or all of them
}
YARA Detection Rule: APT_HKTL_Wiper_WhisperGate_Jan22_2
Repository: Neo23x0/signature-base
Detects: Detects unknown wiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

Pattern signatures:
/* powershell  -enc UwB0AGEAcgB0AC */
      $sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
               63 00 67 00 42 00 30 00 41 00 43 }
      /* Ylfwdwgmpilzyaph */
      $sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }

      $s1 = "xownxloxadDxatxxax" wide
      $s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide /* Decoded with base64, UTF-16-LE: Sleep -s 10 */
      $s3 = "https://cdn.discordapp.com/attachments/" wide
      $s4 = "fffxfff.fff" ascii fullword

      $op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
      $op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
      $op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
      $op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 1000KB and 5 of them
      or 7 of them

Full rule:
rule APT_HKTL_Wiper_WhisperGate_Jan22_2 {
   meta:
      description = "Detects unknown wiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
      date = "2022-01-16"
      score = 90
      hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
      id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"
   strings:
      /* powershell  -enc UwB0AGEAcgB0AC */
      $sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
               63 00 67 00 42 00 30 00 41 00 43 }
      /* Ylfwdwgmpilzyaph */
      $sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }

      $s1 = "xownxloxadDxatxxax" wide
      $s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide /* Decoded with base64, UTF-16-LE: Sleep -s 10 */
      $s3 = "https://cdn.discordapp.com/attachments/" wide
      $s4 = "fffxfff.fff" ascii fullword

      $op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
      $op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
      $op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
      $op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 1000KB and 5 of them
      or 7 of them
}
YARA Detection Rule: APT_HKTL_Wiper_WhisperGate_Stage3_Jan22
Repository: Neo23x0/signature-base
Detects: Detects reversed stage3 related to Ukrainian wiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/juanandres_gs/status/[PII_REDACTED]04257792

Pattern signatures:
$xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }

      $s1 = "lld." wide

Detection condition:
uint16(filesize-2) == 0x4d5a and
      filesize < 5000KB and all of them

Full rule:
rule APT_HKTL_Wiper_WhisperGate_Stage3_Jan22 {
   meta:
      description = "Detects reversed stage3 related to Ukrainian wiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/juanandres_gs/status/[PII_REDACTED]04257792"
      date = "2022-01-16"
      hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
      id = "d5d562cd-03ef-5450-8044-3f538cea32d0"
   strings:
      $xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }

      $s1 = "lld." wide
   condition:
      uint16(filesize-2) == 0x4d5a and
      filesize < 5000KB and all of them
}
YARA Detection Rule: MAL_OBFUSC_Unknown_Jan22_1
Repository: Neo23x0/signature-base
Detects: Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/juanandres_gs/status/[PII_REDACTED]04257792

Pattern signatures:
$xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
      $xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
               79 31 00 70 63 31 65 }

      $s1 = ".dll" wide
      $s2 = "%&%,%s%" ascii fullword

      $op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
      $op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
      $op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 1000KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_OBFUSC_Unknown_Jan22_1 {
   meta:
      description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/juanandres_gs/status/[PII_REDACTED]04257792"
      date = "2022-01-16"
      hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
      id = "647c0092-b03d-5627-8568-ddaa982c73a1"
   strings:
      $xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
      $xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
               79 31 00 70 63 31 65 }

      $s1 = ".dll" wide
      $s2 = "%&%,%s%" ascii fullword

      $op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
      $op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
      $op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 1000KB and ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: MAL_Unknown_Discord_Characteristics_Jan22_1
Repository: Neo23x0/signature-base
Detects: Detects unknown malware with a few indicators also found in Wiper malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

Pattern signatures:
$x1 = "xownxloxadDxatxxax" wide
      
      $s2 = "https://cdn.discordapp.com/attachments/" wide

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 1000KB and all of them

Full rule:
rule MAL_Unknown_Discord_Characteristics_Jan22_1 {
   meta:
      description = "Detects unknown malware with a few indicators also found in Wiper malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
      date = "2022-01-16"
      score = 75
      hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
      id = "23ee5319-6a72-517b-8ea0-55063b6b862c"
   strings:
      $x1 = "xownxloxadDxatxxax" wide
      
      $s2 = "https://cdn.discordapp.com/attachments/" wide
   condition:
      uint16(0) == 0x5a4d and
      filesize < 1000KB and all of them
}
YARA Detection Rule: MAL_Ransomware_GermanWiper
Repository: Neo23x0/signature-base
Detects: Detects RansomWare GermanWiper in Memory or in unpacked state
Author: Frank Boldewin (@r3c0nst), modified by Florian Roth
Reference: https://twitter.com/r3c0nst/status/[PII_REDACTED]66657538

Pattern signatures:
$x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
      $x_Mutex2 = "cFgxTERNWEVhM2V" ascii

      // code patterns for process kills
      $PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
      $ProcessKill1 = "sqbcoreservice.exe" ascii
      $ProcessKill2 = "isqlplussvc.exe"  ascii
      $KillShadowCopies = "vssadmin.exe delete shadows" ascii
      $Domain1 = "cdnjs.cloudflare.com" ascii
      $Domain2 = "expandingdelegation.top" ascii
      $RansomNote = "Entschluesselungs_Anleitung.html" ascii

Detection condition:
uint16(0) == 0x5A4D and filesize < 1000KB and
      ( 1 of ($x*) or 3 of them )

Full rule:
rule MAL_Ransomware_GermanWiper {
   meta:
      description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
      author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
      reference = "https://twitter.com/r3c0nst/status/[PII_REDACTED]66657538"
      date = "2019-08-05"
      hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
      hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"

      id = "e7587691-f69a-53e7-bab2-875179fbfa19"
   strings:
      $x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
      $x_Mutex2 = "cFgxTERNWEVhM2V" ascii

      // code patterns for process kills
      $PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
      $ProcessKill1 = "sqbcoreservice.exe" ascii
      $ProcessKill2 = "isqlplussvc.exe"  ascii
      $KillShadowCopies = "vssadmin.exe delete shadows" ascii
      $Domain1 = "cdnjs.cloudflare.com" ascii
      $Domain2 = "expandingdelegation.top" ascii
      $RansomNote = "Entschluesselungs_Anleitung.html" ascii
   condition:
      uint16(0) == 0x5A4D and filesize < 1000KB and
      ( 1 of ($x*) or 3 of them )
}
YARA Detection Rule: EQGRP_noclient_3_0_5
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file noclient-3.0.5.3
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )

Full rule:
rule EQGRP_noclient_3_0_5 {
	meta:
		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "af7472ce-0605-5f50-8180-23438d2196b8"
	strings:
		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
	condition:
		( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_installdate
Repository: Neo23x0/signature-base
Detects: Detects tool from EQGRP toolset - file installdate.pl
Author: Florian Roth (Nextron Systems)
Reference: Research

Pattern signatures:
$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
		$x2 = "print \"Gimme hex: \";" fullword ascii
		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii

		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
		$s2 = "if (not($cmdInput)) {" fullword ascii
		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii

Detection condition:
filesize < 2KB and ( 1 of ($x*) or 3 of them )

Full rule:
rule EQGRP_installdate {
	meta:
		description = "Detects tool from EQGRP toolset - file installdate.pl"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Research"
		date = "2016-08-15"
		score = 75
		id = "029b1213-1206-5b7c-bd72-93239a23fe8a"
	strings:
		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
		$x2 = "print \"Gimme hex: \";" fullword ascii
		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii

		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
		$s2 = "if (not($cmdInput)) {" fullword ascii
		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
	condition:
		filesize < 2KB and ( 1 of ($x*) or 3 of them )
}