deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_MAL_RU_WIN_Snake_Malware_May23_1
Repository: Neo23x0/signature-base
Detects: Hunting Russian Intelligence Snake Malware
Author: Matt Suiche (Magnet Forensics)
Reference: https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Pattern signatures:
$a = { 25 73 23 31 }
        $b = { 25 73 23 32 }
        $c = { 25 73 23 33 }
        $d = { 25 73 23 34 }
        $e = { 2e 74 6d 70 }
        /* $f = { 2e 74 6d 70 } */
        $g = { 2e 73 61 76 }
        $h = { 2e 75 70 64 }

Detection condition:
all of them

Full rule:
rule APT_MAL_RU_WIN_Snake_Malware_May23_1 {
    meta:
        author = "Matt Suiche (Magnet Forensics)"
        description = "Hunting Russian Intelligence Snake Malware"
        date = "2023-05-10"
        modified = "2025-03-21"
        threat_name = "Windows.Malware.Snake"
        reference = "https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
        score = 70
        scan_context = "memory"
        license = "MIT"

    /* The original search only query those bytes in PAGE_EXECUTE_WRITECOPY VADs */
        id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
    strings:
        $a = { 25 73 23 31 }
        $b = { 25 73 23 32 }
        $c = { 25 73 23 33 }
        $d = { 25 73 23 34 }
        $e = { 2e 74 6d 70 }
        /* $f = { 2e 74 6d 70 } */
        $g = { 2e 73 61 76 }
        $h = { 2e 75 70 64 }
    condition:
        all of them
}
YARA Detection Rule: APT_MAL_RU_Snake_Indicators_May23_1
Repository: Neo23x0/signature-base
Detects: Detects indicators found in Snake malware samples
Author: Florian Roth
Reference: https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Pattern signatures:
$s1 = "\\\\.\\%s\\\\" ascii fullword
      $s2 = "read_peer_nfo" ascii fullword
      $s3 = "rcv_buf=%d%c" ascii fullword
      $s4 = "%s: (0x%08x)" ascii fullword
      $s5 = "no_impersonate" ascii fullword

Detection condition:
all of them

Full rule:
rule APT_MAL_RU_Snake_Indicators_May23_1 {
   meta:
      description = "Detects indicators found in Snake malware samples"
      author = "Florian Roth"
      reference = "https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
      date = "2023-05-10"
      score = 85
      hash1 = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
      hash2 = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
      hash3 = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
      hash4 = "417eb4fb9ada270af35562ff317807ac5ca9ee26181fe89990858f0944d3a6a7"
      hash5 = "48112970de6ea0f925f0657b30adcd0723df94afc98cfafdc991d70ad3602119"
      hash6 = "55ea557bcf4c143f20c616abe9075f7faafbf825aeef9ddb4f2b201acc44414b"
      hash7 = "6568bbeeb417e1111bf284e73152d90fe17e5497da7630ccddcbc666730dccef"
      hash8 = "81d620cb645006ffc9ac1b9d98a53aa286ae92b025bda[PII_REDACTED]33f020482"
      hash9 = "888a3029b1b8b664eb1fc77dd511c4088a1e28ae5535a8683642bb3dca011d00"
      hash10 = "9027b4fef50b36289d630059425dc1137c88328329c3ea9dbc348dccd001adc0"
      hash11 = "9ac199572cab[PII_REDACTED]6a0e9ba39d6feed1d567d6d230ebe3133df8dcb7fa"
      hash12 = "a64e5d[PII_REDACTED]26ee040b4cd49a89ca681bdef4c10c4798b6c7b5c832c6df"
      hash13 = "b5d2da5eb57b5ab26edb[PII_REDACTED]29f3cf43bbce2b1a128f6daac7cf57f6f7"
      hash14 = "bc15de1d1c6c62c0bf856e0368adabc4941e7b687a969912494c173233e6d28d"
      hash15 = "bdf94311313c39a3413464f623bd75a3db2eb05cc01090acd6dcd462a605eb4a"
      hash16 = "e4311892ae00bf8148a94fa900fc8e2c279a2acd3b4b4b4c3d0c99dd1d32353c"
      hash17 = "ed74288b367a93c6b47343bc696e751b9c465761ce9c[PII_REDACTED]baa758b234"
      hash18 = "ef1f1c7692b92a730f76b6227643b2d02a6e353af6e930166e3b48e3903e4ffd"
      hash19 = "f5e982b76af7f447742753f0b57eec3d7dd2e3c8e5506c35d4cf6c860b829f45"
      id = "0d4fa8a7-447c-5905-bab9-b63de6209036"
   strings:
      $s1 = "\\\\.\\%s\\\\" ascii fullword
      $s2 = "read_
YARA Detection Rule: APT_WebShell_Tiny_1
Repository: Neo23x0/signature-base
Detects: Detetcs a tiny webshell involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "eval(" ascii wide

Detection condition:
( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 40 and $x1

Full rule:
rule APT_WebShell_Tiny_1 {
   meta:
      description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      id = "e65a8920-0684-5aae-a2b8-079c2beae08a"
   strings:
      $x1 = "eval(" ascii wide
   condition:
      ( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 40 and $x1
}
YARA Detection Rule: APT_WebShell_AUS_Tiny_2
Repository: Neo23x0/signature-base
Detects: Detetcs a tiny webshell involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
      $x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii

Detection condition:
( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 1KB and 1 of them

Full rule:
rule APT_WebShell_AUS_Tiny_2 {
   meta:
      description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
      id = "4746d4ce-628a-59b0-9032-7e0759d96ad3"
   strings:
      $x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
      $x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
   condition:
      ( uint16(0) == 0x3f3c or uint16(0) == 0x253c ) and filesize < 1KB and 1 of them
}
YARA Detection Rule: APT_WebShell_AUS_JScript_3
Repository: Neo23x0/signature-base
Detects: Detetcs a webshell involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
      $s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii

Detection condition:
uint16(0) == 0x6568 and filesize < 1KB and all of them

Full rule:
rule APT_WebShell_AUS_JScript_3 {
   meta:
      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
      id = "ff7e780b-ccf9-53b6-b741-f04a8cbaf580"
   strings:
      $s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
      $s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
   condition:
      uint16(0) == 0x6568 and filesize < 1KB and all of them
}
YARA Detection Rule: APT_WebShell_AUS_4
Repository: Neo23x0/signature-base
Detects: Detetcs a webshell involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
      $s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
      $s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
      $s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii

Detection condition:
uint16(0) == 0x7566 and filesize < 10KB and 3 of them

Full rule:
rule APT_WebShell_AUS_4 {
   meta:
      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
      id = "bb5b10d1-3528-5361-92fc-8440c65dcda4"
   strings:
      $s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
      $s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
      $s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
      $s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
   condition:
      uint16(0) == 0x7566 and filesize < 10KB and 3 of them
}
YARA Detection Rule: APT_Script_AUS_4
Repository: Neo23x0/signature-base
Detects: Detetcs a script involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
      $x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
      $x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
      $x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
      $x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
      $x6 = ".DoCmd.Close , , acSaveYes" fullword ascii

Detection condition:
filesize < 7KB and 1 of them

Full rule:
rule APT_Script_AUS_4 {
   meta:
      description = "Detetcs a script involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
      id = "5cbf2476-5ce8-540d-b87b-e400daf49b43"
   strings:
      $x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
      $x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
      $x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
      $x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
      $x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
      $x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
   condition:
      filesize < 7KB and 1 of them
}
YARA Detection Rule: APT_WebShell_AUS_5
Repository: Neo23x0/signature-base
Detects: Detetcs a webshell involved in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
      $a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii

      $s1 = "var hash=DEC(Request.Item['" ascii
      $s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
      $s3 = "hashtable[hash] = assCode;" fullword ascii
      $s4 = "Response.Write(ss);" fullword ascii
      $s5 = "var hashtable = Application[CachePtr];" fullword ascii

Detection condition:
uint16(0) == 0x7566 and filesize < 2KB and 4 of them

Full rule:
rule APT_WebShell_AUS_5 {
   meta:
      description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
      id = "59b3f6aa-2d3b-54b4-b543-57bd9d981e87"
   strings:
      $a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
      $a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii

      $s1 = "var hash=DEC(Request.Item['" ascii
      $s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
      $s3 = "hashtable[hash] = assCode;" fullword ascii
      $s4 = "Response.Write(ss);" fullword ascii
      $s5 = "var hashtable = Application[CachePtr];" fullword ascii
   condition:
      uint16(0) == 0x7566 and filesize < 2KB and 4 of them
}
YARA Detection Rule: HKTL_LazyCat_LogEraser
Repository: Neo23x0/signature-base
Detects: Detetcs a tool used in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "LazyCat.dll" ascii wide fullword
      $x2 = ".local_privilege_escalation.rotten_potato" ascii wide
      $x3 = "LazyCat.Extension" ascii wide
      $x4 = " MEOWof" ascii wide
      $x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide

      $s1 = "LazyCat" fullword ascii wide
      $s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
      $s3 = "local -> remote {0} bytes"
      $s4 = "remote -> local {0} bytes"

Detection condition:
3 of them

Full rule:
rule HKTL_LazyCat_LogEraser {
   meta:
      description = "Detetcs a tool used in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
      hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
      id = "a3d74657-a389-5482-ab26-966e790afd50"
   strings:
      $x1 = "LazyCat.dll" ascii wide fullword
      $x2 = ".local_privilege_escalation.rotten_potato" ascii wide
      $x3 = "LazyCat.Extension" ascii wide
      $x4 = " MEOWof" ascii wide
      $x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide

      $s1 = "LazyCat" fullword ascii wide
      $s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
      $s3 = "local -> remote {0} bytes"
      $s4 = "remote -> local {0} bytes"
   condition:
      3 of them
}
YARA Detection Rule: HKTL_PowerKatz_Feb19_1
Repository: Neo23x0/signature-base
Detects: Detetcs a tool used in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "Powerkatz32" ascii wide fullword
      $x2 = "Powerkatz64" ascii wide

      $s1 = "GetData: not found taskName" fullword ascii wide
      $s2 = "GetRes Ex:" fullword ascii wide

Detection condition:
1 of ($x*) and 1 of ($s*)

Full rule:
rule HKTL_PowerKatz_Feb19_1 {
   meta:
      description = "Detetcs a tool used in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      id = "294d6f6c-dbc8-5431-87a0-64abe582c4ea"
   strings:
      $x1 = "Powerkatz32" ascii wide fullword
      $x2 = "Powerkatz64" ascii wide

      $s1 = "GetData: not found taskName" fullword ascii wide
      $s2 = "GetRes Ex:" fullword ascii wide
   condition:
      1 of ($x*) and 1 of ($s*)
}
YARA Detection Rule: HKTL_Unknown_Feb19_1
Repository: Neo23x0/signature-base
Detects: Detetcs a tool used in the Australian Parliament House network compromise
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832

Pattern signatures:
$x1 = "not a valid timeout format!" ascii wide fullword
      $x2 = "host can not be empty!" ascii wide fullword
      $x3 = "not a valid port format!" ascii wide fullword
      $x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
      $x5 = "ping count is not a correct format!" ascii wide fullword

      $s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
      $s2 = "C:\\Windows\\temp\\" ascii wide

Detection condition:
1 of ($x*) or 2 of them

Full rule:
rule HKTL_Unknown_Feb19_1 {
   meta:
      description = "Detetcs a tool used in the Australian Parliament House network compromise"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/cyb3rops/status/[PII_REDACTED]72376832"
      date = "2019-02-18"
      id = "bdcadc4b-8881-5dc7-b203-4e79cbc850ed"
   strings:
      $x1 = "not a valid timeout format!" ascii wide fullword
      $x2 = "host can not be empty!" ascii wide fullword
      $x3 = "not a valid port format!" ascii wide fullword
      $x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
      $x5 = "ping count is not a correct format!" ascii wide fullword

      $s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
      $s2 = "C:\\Windows\\temp\\" ascii wide
   condition:
      1 of ($x*) or 2 of them
}
YARA Detection Rule: b374k_back_connect
Repository: Neo23x0/signature-base
Detects: Detects privilege escalation tool
Author: Florian Roth (Nextron Systems)
Reference: Internal Analysis

Pattern signatures:
$s1 = "AddAtomACreatePro" fullword ascii
		$s2 = "shutdow" fullword ascii
		$s3 = "/config/i386" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 10KB and all of them )

Full rule:
rule b374k_back_connect {
	meta:
		description = "Detects privilege escalation tool"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "Internal Analysis"
		date = "2016-08-18"
		score = 80
		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
		id = "8612bda2-2576-56c0-a4ba-afbef419ab05"
	strings:
		$s1 = "AddAtomACreatePro" fullword ascii
		$s2 = "shutdow" fullword ascii
		$s3 = "/config/i386" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 10KB and all of them )
}
YARA Detection Rule: Korplug_FAST
Repository: Neo23x0/signature-base
Detects: Rule to detect Korplug/PlugX FAST variant
Author: Florian Roth (Nextron Systems)

Pattern signatures:
$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii

        $a1 = "ShadowPlay" fullword ascii

        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
        $s2 = "nvdisps.dll" fullword ascii
        $s3 = "%snvdisps.dll" fullword ascii
        $s4 = "\\winhlp32.exe" ascii
        $s5 = "nvdisps_user.dat" fullword ascii
        $s6 = "%snvdisps_user.dat" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 
        (
            $x1 or
            ($a1 and 1 of ($s*)) or 
            4 of ($s*)
        )

Full rule:
rule Korplug_FAST {
    meta:
        description = "Rule to detect Korplug/PlugX FAST variant"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
        date = "2015-08-20"
        hash = "c437465db[PII_REDACTED]3fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
        id = "85c6c460-2902-5bfa-be58-a2b62e3b882e"
    strings:
        $x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii

        $a1 = "ShadowPlay" fullword ascii

        $s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
        $s2 = "nvdisps.dll" fullword ascii
        $s3 = "%snvdisps.dll" fullword ascii
        $s4 = "\\winhlp32.exe" ascii
        $s5 = "nvdisps_user.dat" fullword ascii
        $s6 = "%snvdisps_user.dat" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and 
        (
            $x1 or
            ($a1 and 1 of ($s*)) or 
            4 of ($s*)
        )
}
YARA Detection Rule: Datper_Backdoor
Repository: Neo23x0/signature-base
Detects: Detects Datper Malware
Author: Florian Roth (Nextron Systems)
Reference: http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html

Pattern signatures:
$s1 = "RtlGetCo" fullword ascii
      $s2 = "hutils" fullword ascii
      $s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii

      $c1 = "dkkwldngn" fullword ascii
      $c2 = "ndkkwqgcm" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "58db98e2334746d349d607e4d73bc5ea" or
           pe.imphash() == "8fbed921458af485ce84fb7d9b13899e" or
           ( 2 of ($s*) and 1 of ($c*) ) or
           ( $s3 and $c1 )
         )
      )

Full rule:
rule Datper_Backdoor {
   meta:
      description = "Detects Datper Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
      date = "2017-08-21"
      hash1 = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
      hash2 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
      hash3 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
      hash4 = "12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f"
      hash5 = "2384e8ad8eee6db1e69b3ee7b6b3d01ae09f99a86901a0a87fb2788c1115090c"
      hash6 = "1e511c32cdf8abe23d8ba7c39da5ce7fc6c87fdb551c9fc3265ee22ac4076e27"
      hash7 = "7bc042b9a599e1024a668b9921e2a42a02545429cf446d5b3d21f20185afa6ce"
      id = "547db8bb-cc02-5521-8b85-845b1652fee9"
   strings:
      $s1 = "RtlGetCo" fullword ascii
      $s2 = "hutils" fullword ascii
      $s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii

      $c1 = "dkkwldngn" fullword ascii
      $c2 = "ndkkwqgcm" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and
        filesize < 300KB and
        (
           pe.imphash() == "58db98e2334746d349d607e4d73bc5ea" or
           pe.imphash() == "8fbed921458af485ce84fb7d9b13899e" or
           ( 2 of ($s*) and 1 of ($c*) ) or
           ( $s3 and $c1 )
         )
      )
}
YARA Detection Rule: SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation
Repository: Neo23x0/signature-base
Detects: This rule is UNTESTED against a large dataset and is for hunting purposes only.
Author: netadr, modified by Florian Roth to avoid elf module import
Reference: https://netadr.github.io/blog/a-quick-glimpse-sbz/

Pattern signatures:
// xor g3, 0x47, o5
      // xor o5, g1, o5
      // xor g2, o5, o5
      $xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }

      $a1 = "SUNW_"

Detection condition:
uint32be(0) == 0x7f454c46
      and $a1
      and $xor_block

Full rule:
rule SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation {
   meta:
   description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
   author = "netadr, modified by Florian Roth to avoid elf module import"
   reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
   date = "2023-04-02"
   modified = "2023-05-08"
   score = 60

   id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"
   strings:
      // xor g3, 0x47, o5
      // xor o5, g1, o5
      // xor g2, o5, o5
      $xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }

      $a1 = "SUNW_"

   condition:
      uint32be(0) == 0x7f454c46
      and $a1
      and $xor_block
}