deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Trj_Elex_Dll32
Repository: Yara-Rules/rules
Detects: Elex DLL 32 bits
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = {59 00 72 00 72 00 65 00 68 00 73 00}
        $str2 = "RookIE/1.0"

Detection condition:
(pe.machine == pe.MACHINE_I386) and (pe.characteristics & pe.DLL) and ($mz at 0) and ($str1) and ($str2)

Full rule:
rule Trj_Elex_Dll32 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex DLL 32 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = {59 00 72 00 72 00 65 00 68 00 73 00}
        $str2 = "RookIE/1.0"
        
    condition:
        (pe.machine == pe.MACHINE_I386) and (pe.characteristics & pe.DLL) and ($mz at 0) and ($str1) and ($str2)
}
YARA Detection Rule: Trj_Elex_Dll64
Repository: Yara-Rules/rules
Detects: Elex DLL 64 bits
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = {59 00 72 00 72 00 65 00 68 00 73 00}
        $str2 = "RookIE/1.0"

Detection condition:
(pe.machine == pe.MACHINE_AMD64) and (pe.characteristics & pe.DLL) and ($mz at 0) and ($str1) and ($str2)

Full rule:
rule Trj_Elex_Dll64 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex DLL 64 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = {59 00 72 00 72 00 65 00 68 00 73 00}
        $str2 = "RookIE/1.0"
        
    condition:
        (pe.machine == pe.MACHINE_AMD64) and (pe.characteristics & pe.DLL) and ($mz at 0) and ($str1) and ($str2)
}
YARA Detection Rule: KeyBoy_Dropper
Repository: Yara-Rules/rules
Detects: Strings inside
Author: Rapid7 Labs
Reference: https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india

Pattern signatures:
$1 = "I am Admin"
        $2 = "I am User"
        $3 = "Run install success!"
        $4 = "Service install success!"
        $5 = "Something Error!"
        $6 = "Not Configed, Exiting"

Detection condition:
all of them

Full rule:
rule KeyBoy_Dropper
{

    meta:
        Author      = "Rapid7 Labs"
        Date        = "2013/06/07"
        Description = "Strings inside"
        Reference   = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"

    strings:
        $1 = "I am Admin"
        $2 = "I am User"
        $3 = "Run install success!"
        $4 = "Service install success!"
        $5 = "Something Error!"
        $6 = "Not Configed, Exiting"

    condition:
        all of them
}
YARA Detection Rule: KeyBoy_Backdoor
Repository: Yara-Rules/rules
Detects: Strings inside
Author: Rapid7 Labs
Reference: https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india

Pattern signatures:
$1 = "$login$"
        $2 = "$sysinfo$"
        $3 = "$shell$"
        $4 = "$fileManager$"
        $5 = "$fileDownload$"
        $6 = "$fileUpload$"

Detection condition:
all of them

Full rule:
rule KeyBoy_Backdoor
{

    meta:
        Author      = "Rapid7 Labs"
        Date        = "2013/06/07"
        Description = "Strings inside"
        Reference   = "https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india"

    strings:
        $1 = "$login$"
        $2 = "$sysinfo$"
        $3 = "$shell$"
        $4 = "$fileManager$"
        $5 = "$fileDownload$"
        $6 = "$fileUpload$"

    condition:
        all of them
}
YARA Detection Rule: new_keyboy_export
Repository: Yara-Rules/rules
Detects: Matches the new 2016 sample's export
Author: Matt Brooks, @cmatthewbrooks

Detection condition:
//MZ header //PE signature //The malware family seems to share many exports //but this is the new kid on the block.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and pe.exports("cfsUpdate")

Full rule:
rule new_keyboy_export
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the new 2016 sample's export"
        date = "2016-08-28"
        md5 = "495adb1b9777002ecfe22aaf52fcee93"

    condition:
        //MZ header //PE signature //The malware family seems to share many exports //but this is the new kid on the block.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and pe.exports("cfsUpdate")
}
YARA Detection Rule: new_keyboy_header_codes
Repository: Yara-Rules/rules
Detects: Matches the 2016 sample's header codes
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$s1 = "*l*" wide fullword
        $s2 = "*a*" wide fullword
        $s3 = "*s*" wide fullword
        $s4 = "*d*" wide fullword
        $s5 = "*f*" wide fullword
        $s6 = "*g*" wide fullword
        $s7 = "*h*" wide fullword

Detection condition:
//MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and all of them

Full rule:
rule new_keyboy_header_codes
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the 2016 sample's header codes"
        date = "2016-08-28"
        md5 = "495adb1b9777002ecfe22aaf52fcee93"

    strings:
        $s1 = "*l*" wide fullword
        $s2 = "*a*" wide fullword
        $s3 = "*s*" wide fullword
        $s4 = "*d*" wide fullword
        $s5 = "*f*" wide fullword
        $s6 = "*g*" wide fullword
        $s7 = "*h*" wide fullword

    condition:
        //MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and all of them
}
YARA Detection Rule: keyboy_commands
Repository: Yara-Rules/rules
Detects: Matches the 2016 sample's sent and received commands
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$s1 = "Update" wide fullword
        $s2 = "UpdateAndRun" wide fullword
        $s3 = "Refresh" wide fullword
        $s4 = "OnLine" wide fullword
        $s5 = "Disconnect" wide fullword
        $s6 = "Pw_Error" wide fullword
        $s7 = "Pw_OK" wide fullword
        $s8 = "Sysinfo" wide fullword
        $s9 = "Download" wide fullword
        $s10 = "UploadFileOk" wide fullword
        $s11 = "RemoteRun" wide fullword
        $s12 = "FileManager" wide fullword

Detection condition:
//MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 6 of them

Full rule:
rule keyboy_commands
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the 2016 sample's sent and received commands"
        date = "2016-08-28"
        md5 = "495adb1b9777002ecfe22aaf52fcee93"

    strings:
        $s1 = "Update" wide fullword
        $s2 = "UpdateAndRun" wide fullword
        $s3 = "Refresh" wide fullword
        $s4 = "OnLine" wide fullword
        $s5 = "Disconnect" wide fullword
        $s6 = "Pw_Error" wide fullword
        $s7 = "Pw_OK" wide fullword
        $s8 = "Sysinfo" wide fullword
        $s9 = "Download" wide fullword
        $s10 = "UploadFileOk" wide fullword
        $s11 = "RemoteRun" wide fullword
        $s12 = "FileManager" wide fullword

    condition:
        //MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 6 of them
}
YARA Detection Rule: keyboy_systeminfo
Repository: Yara-Rules/rules
Detects: Matches the system information format before sending to C2
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
//These strings are ASCII pre-2015 and UNICODE in 2016
        $s1 = "SystemVersion:    %s" ascii wide
        $s2 = "Product  ID:      %s" ascii wide
        $s3 = "InstallPath:      %s" ascii wide
        $s4 = "InstallTime:      %d-%d-%d, %02d:%02d:%02d" ascii wide
        $s5 = "ResgisterGroup:   %s" ascii wide
        $s6 = "RegisterUser:     %s" ascii wide
        $s7 = "ComputerName:     %s" ascii wide
        $s8 = "WindowsDirectory: %s" ascii wide
        $s9 = "System Directory: %s" ascii wide
        $s10 = "Number of Processors:       %d" ascii wide
        $s11 = "CPU[%d]:  %s: %sMHz" ascii wide
        $s12 = "RAM:         %dMB Total, %dMB Free." ascii wide
        $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
        $s14 = "Uptime:      %d Days %02u:%02u:%02u" ascii wide

Detection condition:
//MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 7 of them

Full rule:
rule keyboy_systeminfo
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the system information format before sending to C2"
        date = "2016-08-28"
        md5 = "495adb1b9777002ecfe22aaf52fcee93"

    strings:
        //These strings are ASCII pre-2015 and UNICODE in 2016
        $s1 = "SystemVersion:    %s" ascii wide
        $s2 = "Product  ID:      %s" ascii wide
        $s3 = "InstallPath:      %s" ascii wide
        $s4 = "InstallTime:      %d-%d-%d, %02d:%02d:%02d" ascii wide
        $s5 = "ResgisterGroup:   %s" ascii wide
        $s6 = "RegisterUser:     %s" ascii wide
        $s7 = "ComputerName:     %s" ascii wide
        $s8 = "WindowsDirectory: %s" ascii wide
        $s9 = "System Directory: %s" ascii wide
        $s10 = "Number of Processors:       %d" ascii wide
        $s11 = "CPU[%d]:  %s: %sMHz" ascii wide
        $s12 = "RAM:         %dMB Total, %dMB Free." ascii wide
        $s13 = "DisplayMode: %d x %d, %dHz, %dbit" ascii wide
        $s14 = "Uptime:      %d Days %02u:%02u:%02u" ascii wide

    condition:
        //MZ header //PE signature
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and 7 of them
}
YARA Detection Rule: keyboy_related_exports
Repository: Yara-Rules/rules
Detects: Matches the new 2016 sample's export
Author: Matt Brooks, @cmatthewbrooks

Detection condition:
//MZ header //PE signature //The malware family seems to share many exports //but this is the new kid on the block.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and pe.exports("Embedding") or pe.exports("SSSS") or pe.exports("GetUP")

Full rule:
rule keyboy_related_exports
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the new 2016 sample's export"
        date = "2016-08-28"
        md5 = "495adb1b9777002ecfe22aaf52fcee93"

    condition:
        //MZ header //PE signature //The malware family seems to share many exports //but this is the new kid on the block.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 200KB and pe.exports("Embedding") or pe.exports("SSSS") or pe.exports("GetUP")
}
YARA Detection Rule: keyboy_init_config_section
Repository: Yara-Rules/rules
Detects: Matches the Init section where the config is stored
Author: Matt Brooks, @cmatthewbrooks

Detection condition:
//MZ header //PE signature //Payloads are normally smaller but the new dropper we spotted //is a bit larger. //Observed virtual sizes of the .Init section vary but they've //always been 1024, 2048, or 4096 bytes.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 300KB

Full rule:
rule keyboy_init_config_section
{

    meta:
        author = "Matt Brooks, @cmatthewbrooks"
        desc = "Matches the Init section where the config is stored"
        date = "2016-08-28"

    condition:
        //MZ header //PE signature //Payloads are normally smaller but the new dropper we spotted //is a bit larger. //Observed virtual sizes of the .Init section vary but they've //always been 1024, 2048, or 4096 bytes.
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and filesize < 300KB and for any i in (0..pe.number_of_sections - 1): (pe.sections[i].name == ".Init" and pe.sections[i].virtual_size % 1024 == 0)
}
YARA Detection Rule: Ransom_Satana
Repository: Yara-Rules/rules
Detects: Regla para detectar Ransom.Satana
Author: CCN-CERT

Pattern signatures:
$a = { 21 00 73 00 61 00 74 00 61 00 6E 00 61 00 21 00 2E 00 74 00 78 00 74 00 00 }
        $b = { 74 67 77 79 75 67 77 71 }
        $c = { 53 77 76 77 6E 67 75 }
        $d = { 45 6E 75 6D 4C 6F 63 61 6C 52 65 73 }
        $e = { 57 4E 65 74 4F 70 65 6E 45 6E 75 6D 57 00 }
        $f = { 21 53 41 54 41 4E 41 21 }

Detection condition:
$b or $c and $d and $a and $e and $f

Full rule:
rule Ransom_Satana
{
    meta:
        description = "Regla para detectar Ransom.Satana"
        author = "CCN-CERT"
        version = "1.0"
    strings:
        $a = { 21 00 73 00 61 00 74 00 61 00 6E 00 61 00 21 00 2E 00 74 00 78 00 74 00 00 }
        $b = { 74 67 77 79 75 67 77 71 }
        $c = { 53 77 76 77 6E 67 75 }
        $d = { 45 6E 75 6D 4C 6F 63 61 6C 52 65 73 }
        $e = { 57 4E 65 74 4F 70 65 6E 45 6E 75 6D 57 00 }
        $f = { 21 53 41 54 41 4E 41 21 }
    condition:
        $b or $c and $d and $a and $e and $f
}
YARA Detection Rule: Ransom_Satana_Dropper
Repository: Yara-Rules/rules
Detects: Regla para detectar el dropper de Ransom.Satana
Author: CCN-CERT

Pattern signatures:
$a = { 25 73 2D 54 72 79 45 78 63 65 70 74 }
        $b = { 64 3A 5C 6C 62 65 74 77 6D 77 79 5C 75 69 6A 65 75 71 70 6C 66 77 75 62 2E 70 64 62 }
        $c = { 71 66 6E 74 76 74 68 62 }

Detection condition:
all of them

Full rule:
rule Ransom_Satana_Dropper
{
    meta:
        description = "Regla para detectar el dropper de Ransom.Satana"
        author = "CCN-CERT"
        version = "1.0"
    strings:
        $a = { 25 73 2D 54 72 79 45 78 63 65 70 74 }
        $b = { 64 3A 5C 6C 62 65 74 77 6D 77 79 5C 75 69 6A 65 75 71 70 6C 66 77 75 62 2E 70 64 62 }
        $c = { 71 66 6E 74 76 74 68 62 }
    condition:
        all of them
}
YARA Detection Rule: SeaDuke_Sample
Repository: Yara-Rules/rules
Detects: SeaDuke Malware - file 3eb86b7b067c296ef53e4857a74e09f12c2b84b666fc130d1f58aec18bc74b0d
Author: Florian Roth
Reference: http://goo.gl/MJ0c2M

Pattern signatures:
$s0 = "bpython27.dll" fullword ascii
        $s1 = "email.header(" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "LogonUI.exe" fullword wide /* PEStudio Blacklist: strings */
        $s3 = "Crypto.Cipher.AES(" fullword ascii /* PEStudio Blacklist: strings */
        $s4 = "mod is NULL - %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 4000KB and all of them

Full rule:
rule SeaDuke_Sample 
{

    meta:
        description = "SeaDuke Malware - file 3eb86b7b067c296ef53e4857a74e09f12c2b84b666fc130d1f58aec18bc74b0d"
        author = "Florian Roth"
        reference = "http://goo.gl/MJ0c2M"
        date = "2015-07-14"
        score = 70
        hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"

    strings:
        $s0 = "bpython27.dll" fullword ascii
        $s1 = "email.header(" fullword ascii /* PEStudio Blacklist: strings */
        $s2 = "LogonUI.exe" fullword wide /* PEStudio Blacklist: strings */
        $s3 = "Crypto.Cipher.AES(" fullword ascii /* PEStudio Blacklist: strings */
        $s4 = "mod is NULL - %s" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 4000KB and all of them
}
YARA Detection Rule: rc4_stack_key_fallchill
Repository: Yara-Rules/rules
Detects: rc4_stack_key

Pattern signatures:
$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key

Full rule:
rule rc4_stack_key_fallchill
{
meta:
    description = "rc4_stack_key"
	ref = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
strings:
    $stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $stack_key
}
YARA Detection Rule: success_fail_codes_fallchill
Repository: Yara-Rules/rules
Detects: success_fail_codes

Pattern signatures:
$s0 = { 68 7a 34 12 00 }  
    $s1 = { ba 7a 34 12 00 }  
    $f0 = { 68 5c 34 12 00 }  
    $f1 = { ba 5c 34 12 00 }

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))

Full rule:
rule success_fail_codes_fallchill
{
meta:
    description = "success_fail_codes"
	ref = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
strings:
    $s0 = { 68 7a 34 12 00 }  
    $s1 = { ba 7a 34 12 00 }  
    $f0 = { 68 5c 34 12 00 }  
    $f1 = { ba 5c 34 12 00 }
condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and (($s0 and $f0) or ($s1 and $f1))
}
YARA Detection Rule: zoxPNG_RAT
Repository: Yara-Rules/rules
Detects: ZoxPNG RAT, url inside
Author: Novetta Advanced Research Group
Reference: http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf

Pattern signatures:
$url = "png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"

Detection condition:
$url

Full rule:
rule zoxPNG_RAT
{
    meta:
        Author      = "Novetta Advanced Research Group"
        Date        = "2014/11/14"
        Description = "ZoxPNG RAT, url inside"
        Reference   = "http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf"

    strings: 
        $url = "png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"

    condition: 
        $url
}
YARA Detection Rule: Bozok
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

Detection condition:
all of them

Full rule:
rule Bozok : RAT
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Bozok"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

	condition:
		all of them
}
YARA Detection Rule: kpot
Repository: Yara-Rules/rules
Author:  J from THL <j@techhelplist.com>

Pattern signatures:
$text01 = "bot_id=%s"
        $text02 = "x64=%d"
        $text03 = "is_admin=%d"
        $text04 = "IL=%d"
        $text05 = "os_version=%d"
        $text06 = "IP: %S"
        $text07 = "MachineGuid: %s"
        $text08 = "CPU: %S (%d cores)"
        $text09 = "RAM: %S MB"
        $text10 = "Screen: %dx%d"
        $text11 = "PC: %s"
        $text12 = "User: %s"
        $text13 = "LT: %S (UTC+%d:%d)"
        $text14 = "%s/%s.php"
        $text15 = "Host: %s"
        $text16 = "username_value"
        $text17 = "password_value"
        $text18 = "name_on_card"
        $text19 = "last_four"
        $text20 = "exp_month"
        $text21 = "exp_year"
        $text22 = "bank_name"

Detection condition:
16 of them

Full rule:
rule kpot
{

    meta:
        author = " J from THL <j@techhelplist.com>"
        date = "2018-08-29"
        reference1 = "https://www.virustotal.com/#/file/4e87a0794bf73d06ac1ce4a37e33eb832ff4c89fb9e4266490c7cef9229d27a7/detection"
        reference2 = "ETPRO TROJAN KPOT Stealer Check-In [2832358]"
        reference3 = "ETPRO TROJAN KPOT Stealer Exfiltration [2832359]"
        version = 1
        maltype = "Stealer"
        filetype = "memory"

    strings:
        $text01 = "bot_id=%s"
        $text02 = "x64=%d"
        $text03 = "is_admin=%d"
        $text04 = "IL=%d"
        $text05 = "os_version=%d"
        $text06 = "IP: %S"
        $text07 = "MachineGuid: %s"
        $text08 = "CPU: %S (%d cores)"
        $text09 = "RAM: %S MB"
        $text10 = "Screen: %dx%d"
        $text11 = "PC: %s"
        $text12 = "User: %s"
        $text13 = "LT: %S (UTC+%d:%d)"
        $text14 = "%s/%s.php"
        $text15 = "Host: %s"
        $text16 = "username_value"
        $text17 = "password_value"
        $text18 = "name_on_card"
        $text19 = "last_four"
        $text20 = "exp_month"
        $text21 = "exp_year"
        $text22 = "bank_name"


    condition:
        16 of them
}
YARA Detection Rule: apt_duqu2_loaders
Repository: Yara-Rules/rules
Detects: Rule to detect Duqu 2.0 samples

Pattern signatures:
$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide 
		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
		$a5 = "Global\\{B54E3268-DE1E-4c1e-A[PII_REDACTED]403AD}" wide
		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
		$b1 = "MSI.dll"
		$b2 = "msi.dll"
		$b3 = "StartAction"
		$c1 = "msisvc_32@" wide
		$c2 = "PROP=" wide
		$c3 = "-Embedding" wide
		$c4 = "S:(ML;;NW;;;LW)" wide
		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}

Detection condition:
( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 ) or ( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )

Full rule:
rule apt_duqu2_loaders 
{ 

    meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Duqu 2.0 samples"
		last_modified = "2015-06-09"
		version = "1.0"

    strings:
		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide 
		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
		$a5 = "Global\\{B54E3268-DE1E-4c1e-A[PII_REDACTED]403AD}" wide
		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
		$b1 = "MSI.dll"
		$b2 = "msi.dll"
		$b3 = "StartAction"
		$c1 = "msisvc_32@" wide
		$c2 = "PROP=" wide
		$c3 = "-Embedding" wide
		$c4 = "S:(ML;;NW;;;LW)" wide
		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
	
    condition:
		( (uint16(0) == 0x5a4d) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) ) and filesize < 100000 ) or ( (uint32(0) == 0xe011cfd0) and ( (any of ($a*)) or (all of ($b*)) or (all of ($c*)) or (any of ($d*)) ) and filesize < 20000000 )
}
YARA Detection Rule: apt_duqu2_drivers
Repository: Yara-Rules/rules
Detects: Rule to detect Duqu 2.0 drivers

Pattern signatures:
$a1 = "\\DosDevices\\port_optimizer" wide nocase 
		$a2 = "romanian.antihacker" 
		$a3 = "PortOptimizerTermSrv" wide 
		$a4 = "ugly.gorilla1"
		$b1 = "NdisIMCopySendCompletePerPacketInfo" 
		$b2 = "NdisReEnumerateProtocolBindings"
		$b3 = "NdisOpenProtocolConfiguration"

Detection condition:
uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000

Full rule:
rule apt_duqu2_drivers 
{ 

    meta:
		copyright = "Kaspersky Lab"
		description = "Rule to detect Duqu 2.0 drivers"
		last_modified = "2015-06-09"
		version = "1.0"
	
    strings:
		$a1 = "\\DosDevices\\port_optimizer" wide nocase 
		$a2 = "romanian.antihacker" 
		$a3 = "PortOptimizerTermSrv" wide 
		$a4 = "ugly.gorilla1"
		$b1 = "NdisIMCopySendCompletePerPacketInfo" 
		$b2 = "NdisReEnumerateProtocolBindings"
		$b3 = "NdisOpenProtocolConfiguration"
	condition:
		uint16(0) == 0x5A4D and (any of ($a*) ) and (2 of ($b*)) and filesize < 100000
}