deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Indetectables_RAT
Repository: Yara-Rules/rules
Detects: Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux
Author: Florian Roth
Reference: http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/

Pattern signatures:
$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s9a = "M3n3gatt1hack3r" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them

Full rule:
rule Indetectables_RAT: RAT {
	meta:
		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
		author = "Florian Roth"
		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf[PII_REDACTED]5f6801"
	strings:
		$s1 = "Coded By M3" fullword wide
		$s2 = "Stub Undetector M3" fullword wide
		$s3 = "www.webmenegatti.com.br" wide
		$s4 = "M3n3gatt1" fullword wide
		$s5 = "TheMisterFUD" fullword wide
		$s6 = "KillZoneKillZoneKill" fullword ascii
		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
		$s8 = "M3_F_U_D_M3" ascii
		$s9 = "M3n3gatt1hack3r" fullword wide
		$s9a = "M3n3gatt1hack3r" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and 1 of them
}
YARA Detection Rule: BergSilva_Malware
Repository: Yara-Rules/rules
Detects: Detects a malware from the same author as the Indetectables RAT
Author: Florian Roth

Pattern signatures:
$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide

		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )

Full rule:
rule BergSilva_Malware : RAT {
	meta:
		description = "Detects a malware from the same author as the Indetectables RAT"
		author = "Florian Roth"
		date = "2015-10-01"
		super_rule = 1
		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
	strings:
		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide

		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
		$s5 = "https://dl.dropbox.com/u/105015858" wide
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or 2 of ($s*) )
}
YARA Detection Rule: sakula_v1_0
Repository: Yara-Rules/rules
Detects: Sakula v1.0
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou

Pattern signatures:
$m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"

Detection condition:
$MZ at 0 and all of ($m*) and not $v1_1

Full rule:
rule sakula_v1_0: RAT
{
    meta:
        description = "Sakula v1.0"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"
    condition:
        $MZ at 0 and all of ($m*) and not $v1_1
}
YARA Detection Rule: sakula_v1_1
Repository: Yara-Rules/rules
Detects: Sakula v1.1
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou

Pattern signatures:
$m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"

Detection condition:
$MZ at 0 and all of them

Full rule:
rule sakula_v1_1: RAT
{
    meta:
        description = "Sakula v1.1"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "=%s&type=%d"
        $m4 = "?photoid="
        $m5 = "iexplorer"
                $m6 = "net start \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}
YARA Detection Rule: sakula_v1_2
Repository: Yara-Rules/rules
Detects: Sakula v1.2
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou

Pattern signatures:
$m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $v1_2 = "CCPUpdate"

        $MZ = "MZ"

Detection condition:
$MZ at 0 and $m1 and $m2 and $m3 and $v1_2 and not $v1_1

Full rule:
rule sakula_v1_2: RAT
{
    meta:
        description = "Sakula v1.2"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""
        $v1_1 = "MicroPlayerUpdate.exe"
        $v1_2 = "CCPUpdate"

        $MZ = "MZ"
    condition:
        $MZ at 0 and $m1 and $m2 and $m3 and $v1_2 and not $v1_1
}
YARA Detection Rule: sakula_v1_3
Repository: Yara-Rules/rules
Detects: Sakula v1.3
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou

Pattern signatures:
$m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }

        $MZ = "MZ"

Detection condition:
$MZ at 0 and all of them

Full rule:
rule sakula_v1_3: RAT
{
    meta:
        description = "Sakula v1.3"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }

        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}
YARA Detection Rule: sakula_v1_4
Repository: Yara-Rules/rules
Detects: Sakula v1.4
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou

Pattern signatures:
$m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }

        $MZ = "MZ"

Detection condition:
$MZ at 0 and all of them

Full rule:
rule sakula_v1_4: RAT
{
    meta:
        description = "Sakula v1.4"
        date = "2015-10-13"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou"
    strings:
        $m1 = "%d_of_%d_for_%s_on_%s"
        $m2 = "/c ping 127.0.0.1 & del /q \"%s\""
        $m3 = "cmd.exe /c rundll32 \"%s\""

        $v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }

        $MZ = "MZ"
    condition:
        $MZ at 0 and all of them
}
YARA Detection Rule: Apolmy_Privesc_Trojan
Repository: Yara-Rules/rules
Detects: Apolmy Privilege Escalation Trojan used in APT Terracotta
Author: Florian Roth
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "[%d] Failed, %08X" fullword ascii
        $s2 = "[%d] Offset can not fetched." fullword ascii
        $s3 = "PowerShadow2011" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule Apolmy_Privesc_Trojan 
{

    meta:
        description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
        date = "2015-08-04"
        score = 80
        hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f[PII_REDACTED]d8f373d"

    strings:
        $s1 = "[%d] Failed, %08X" fullword ascii
        $s2 = "[%d] Offset can not fetched." fullword ascii
        $s3 = "PowerShadow2011" fullword wide

    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: Mithozhan_Trojan
Repository: Yara-Rules/rules
Detects: Mitozhan Trojan used in APT Terracotta
Author: Florian Roth
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "adbrowser" fullword wide 
        $s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
        $s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule Mithozhan_Trojan 
{

    meta:
        description = "Mitozhan Trojan used in APT Terracotta"
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
        date = "2015-08-04"
        score = 70
        hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
    
    strings:
        $s1 = "adbrowser" fullword wide 
        $s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
        $s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
    
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: RemoteExec_Tool
Repository: Yara-Rules/rules
Detects: Remote Access Tool used in APT Terracotta
Author: Florian Roth
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
        $s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
        $s2 = "This is a service executable! Couldn't start directly." fullword ascii 
        $s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
        $s4 = "TermHlp_stdout" fullword ascii 
        $s5 = "TermHlp_stdin" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)

Full rule:
rule RemoteExec_Tool 
{

    meta:
        description = "Remote Access Tool used in APT Terracotta"
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
        date = "2015-08-04"
        hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"

    strings:
        $s0 = "cmd.exe /q /c \"%s\"" fullword ascii 
        $s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii 
        $s2 = "This is a service executable! Couldn't start directly." fullword ascii 
        $s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii 
        $s4 = "TermHlp_stdout" fullword ascii 
        $s5 = "TermHlp_stdin" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 75KB and 4 of ($s*)
}
YARA Detection Rule: LiuDoor_Malware_1
Repository: Yara-Rules/rules
Detects: Liudoor Trojan used in Terracotta APT
Author: Florian Roth
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s1 = "svchostdllserver.dll" fullword ascii 
        $s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
        $s3 = "\\nbtstat.exe" fullword ascii
        $s4 = "DataVersionEx" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 150KB and all of them

Full rule:
rule LiuDoor_Malware_1 
{

    meta:
        description = "Liudoor Trojan used in Terracotta APT"
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
        date = "2015-08-04"
        score = 70
        super_rule = 1
        hash1 = "deed6e2a[PII_REDACTED]3d[PII_REDACTED]e1dfc3ad4589f6987388de13e33ac187fc"
        hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
        hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"

    strings:
        $s1 = "svchostdllserver.dll" fullword ascii 
        $s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii 
        $s3 = "\\nbtstat.exe" fullword ascii
        $s4 = "DataVersionEx" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 150KB and all of them
}
YARA Detection Rule: LiuDoor_Malware_2
Repository: Yara-Rules/rules
Detects: Liudoor Trojan used in Terracotta APT
Author: Florian Roth
Reference: https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/

Pattern signatures:
$s0 = "svchostdllserver.dll" fullword ascii 
        $s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and all of them

Full rule:
rule LiuDoor_Malware_2 
{

    meta:
        description = "Liudoor Trojan used in Terracotta APT"
        author = "Florian Roth"
        reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
        date = "2015-08-04"
        score = 70
        super_rule = 1
        hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
        hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"

    strings:
        $s0 = "svchostdllserver.dll" fullword ascii 
        $s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and all of them
}
YARA Detection Rule: liudoor
Repository: Yara-Rules/rules
Detects: Detects Liudoor daemon backdoor
Author: RSA FirstWatch

Pattern signatures:
$string0 = "Succ"
        $string1 = "Fail"
        $string2 = "pass"
        $string3 = "exit"
        $string4 = "svchostdllserver.dll"
        $string5 = "L$,PQR"
        $string6 = "0/0B0H0Q0W0k0"
        $string7 = "QSUVWh"
        $string8 = "Ht Hu["

Detection condition:
all of them

Full rule:
rule liudoor
{

    meta:
        author = "RSA FirstWatch"
        date = "2015-07-23"
        description = "Detects Liudoor daemon backdoor"
        hash0 = "78b56bc3edbee3a425c96738760ee406"
        hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
        hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
        hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
        hash4 = "6093505c7f7ec25b1934d3657649ef07"
        type = "Win32 DLL"

    strings:
        $string0 = "Succ"
        $string1 = "Fail"
        $string2 = "pass"
        $string3 = "exit"
        $string4 = "svchostdllserver.dll"
        $string5 = "L$,PQR"
        $string6 = "0/0B0H0Q0W0k0"
        $string7 = "QSUVWh"
        $string8 = "Ht Hu["
    condition:
        all of them
}
YARA Detection Rule: ZhoupinExploitCrew
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "zhoupin exploit crew" nocase
    $s2 = "zhopin exploit crew" nocase

Detection condition:
1 of them

Full rule:
rule ZhoupinExploitCrew
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "zhoupin exploit crew" nocase
    $s2 = "zhopin exploit crew" nocase

  condition:
    1 of them
}
YARA Detection Rule: BackDoorLogger
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "BackDoorLogger"
    $s2 = "zhuAddress"

Detection condition:
all of them

Full rule:
rule BackDoorLogger
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "BackDoorLogger"
    $s2 = "zhuAddress"

  condition:
    all of them
}
YARA Detection Rule: Jasus
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "pcap_dump_open"
    $s2 = "Resolving IPs to poison..."
    $s3 = "WARNNING: Gateway IP can not be found"

Detection condition:
all of them

Full rule:
rule Jasus
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "pcap_dump_open"
    $s2 = "Resolving IPs to poison..."
    $s3 = "WARNNING: Gateway IP can not be found"

  condition:
    all of them
}
YARA Detection Rule: LoggerModule
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "%s-%02d%02d%02d%02d%02d.r"
    $s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

Detection condition:
all of them

Full rule:
rule LoggerModule
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "%s-%02d%02d%02d%02d%02d.r"
    $s2 = "C:\\Users\\%s\\AppData\\Cookies\\"

  condition:
    all of them
}
YARA Detection Rule: NetC
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "NetC.exe" wide
    $s2 = "Net Service"

Detection condition:
all of them

Full rule:
rule NetC
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "NetC.exe" wide
    $s2 = "Net Service"

  condition:
    all of them
}
YARA Detection Rule: ShellCreator2
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "ShellCreator2.Properties"
    $s2 = "set_IV"

Detection condition:
all of them

Full rule:
rule ShellCreator2
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "ShellCreator2.Properties"
    $s2 = "set_IV"

  condition:
    all of them
}
YARA Detection Rule: SmartCopy2
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "SmartCopy2.Properties"
    $s2 = "ZhuFrameWork"

Detection condition:
all of them

Full rule:
rule SmartCopy2
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "SmartCopy2.Properties"
    $s2 = "ZhuFrameWork"

  condition:
    all of them
}
YARA Detection Rule: SynFlooder
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
    $s2 = "your target's IP is : %s"
    $s3 = "Raw TCP Socket Created successfully."

Detection condition:
all of them

Full rule:
rule SynFlooder
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "Unable to resolve [ %s ]. ErrorCode %d"
    $s2 = "your target's IP is : %s"
    $s3 = "Raw TCP Socket Created successfully."

  condition:
    all of them
}
YARA Detection Rule: TinyZBot
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "NetScp" wide
    $s2 = "TinyZBot.Properties.Resources.resources"
    $s3 = "Aoao WaterMark"
    $s4 = "Run_a_exe"
    $s5 = "netscp.exe"
    $s6 = "get_MainModule_WebReference_DefaultWS"
    $s7 = "remove_CheckFileMD5Completed"
    $s8 = "http://tempuri.org/"
    $s9 = "Zhoupin_Cleaver"

Detection condition:
($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or ($s9)

Full rule:
rule TinyZBot
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "NetScp" wide
    $s2 = "TinyZBot.Properties.Resources.resources"
    $s3 = "Aoao WaterMark"
    $s4 = "Run_a_exe"
    $s5 = "netscp.exe"
    $s6 = "get_MainModule_WebReference_DefaultWS"
    $s7 = "remove_CheckFileMD5Completed"
    $s8 = "http://tempuri.org/"
    $s9 = "Zhoupin_Cleaver"

  condition:
    ($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or ($s9)
}
YARA Detection Rule: antivirusdetector
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "getShadyProcess"
        $s2 = "getSystemAntiviruses"
        $s3 = "AntiVirusDetector"

Detection condition:
all of them

Full rule:
rule antivirusdetector
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

    strings:
        $s1 = "getShadyProcess"
        $s2 = "getSystemAntiviruses"
        $s3 = "AntiVirusDetector"

    condition:
        all of them
}
YARA Detection Rule: csext
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "COM+ System Extentions"
    $s2 = "csext.exe"
    $s3 = "COM_Extentions_bin"

Detection condition:
all of them

Full rule:
rule csext
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "COM+ System Extentions"
    $s2 = "csext.exe"
    $s3 = "COM_Extentions_bin"

  condition:
    all of them
}
YARA Detection Rule: kagent
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "kill command is in last machine, going back"
    $s2 = "message data length in B64: %d Bytes"

Detection condition:
all of them

Full rule:
rule kagent
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "kill command is in last machine, going back"
    $s2 = "message data length in B64: %d Bytes"

  condition:
    all of them
}
YARA Detection Rule: mimikatzWrapper
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "mimikatzWrapper"
    $s2 = "get_mimikatz"

Detection condition:
all of them

Full rule:
rule mimikatzWrapper : Toolkit
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "mimikatzWrapper"
    $s2 = "get_mimikatz"

  condition:
    all of them
}
YARA Detection Rule: pvz_in
Repository: Yara-Rules/rules
Detects: http://cylance.com/opcleaver
Author: Cylance

Pattern signatures:
$s1 = "LAST_TIME=00/00/0000:00:00PM$"
    $s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

Detection condition:
all of them

Full rule:
rule pvz_in
{

  meta:
    author = "Cylance"
    date = "2014-12-02"
    description = "http://cylance.com/opcleaver"

  strings:
    $s1 = "LAST_TIME=00/00/0000:00:00PM$"
    $s2 = "if %%ERRORLEVEL%% == 1 GOTO line"

  condition:
    all of them
}