deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SnakeTurla_Malware_May17_4
Repository: Neo23x0/signature-base
Detects: Detects Snake / Turla Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QaOh4V

Pattern signatures:
$s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii

Detection condition:
( uint16(0) == 0x4b50 and filesize < 5000KB and all of them )

Full rule:
rule SnakeTurla_Malware_May17_4 {
   meta:
      description = "Detects Snake / Turla Sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QaOh4V"
      date = "2017-05-04"
      hash1 = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
      id = "797dedd6-a13e-529f-bae4[PII_REDACTED]c4"
   strings:
      $s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii
   condition:
      ( uint16(0) == 0x4b50 and filesize < 5000KB and all of them )
}
YARA Detection Rule: SnakeTurla_Installd_SH
Repository: Neo23x0/signature-base
Detects: Detects Snake / Turla Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QaOh4V

Pattern signatures:
$s1 = "PIDS=`ps cax | grep installdp" ascii
      $s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 20KB and all of them )

Full rule:
rule SnakeTurla_Installd_SH {
   meta:
      description = "Detects Snake / Turla Sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QaOh4V"
      date = "2017-05-04"
      id = "65a97c0d-5c69-5e58-9a18-10e5684bc218"
   strings:
      $s1 = "PIDS=`ps cax | grep installdp" ascii
      $s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii
   condition:
      ( uint16(0) == 0x2123 and filesize < 20KB and all of them )
}
YARA Detection Rule: SnakeTurla_Install_SH
Repository: Neo23x0/signature-base
Detects: Detects Snake / Turla Sample
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QaOh4V

Pattern signatures:
$s1 = "${TARGET_PATH}/installd.sh" ascii
      $s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 20KB and all of them )

Full rule:
rule SnakeTurla_Install_SH {
   meta:
      description = "Detects Snake / Turla Sample"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QaOh4V"
      date = "2017-05-04"
      id = "68775c54-46f8-5d44-ba63-6726d2bb8016"
   strings:
      $s1 = "${TARGET_PATH}/installd.sh" ascii
      $s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii
   condition:
   ( uint16(0) == 0x2123 and filesize < 20KB and all of them )
}
YARA Detection Rule: BlackEnergy_BE_2
Repository: Neo23x0/signature-base
Detects: Detects BlackEnergy 2 Malware
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/DThzLz

Pattern signatures:
$s0 = "<description> Windows system utility service  </description>" fullword ascii
      $s1 = "WindowsSysUtility - Unicode" fullword wide
      $s2 = "msiexec.exe" fullword wide
      $s3 = "WinHelpW" fullword ascii
      $s4 = "ReadProcessMemory" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)

Full rule:
rule BlackEnergy_BE_2 {
   meta:
      description = "Detects BlackEnergy 2 Malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://goo.gl/DThzLz"
      date = "2015/02/19"
      hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
      id = "c93991b9-77e8-5a73-80ef-e21df770c3a5"
   strings:
      $s0 = "<description> Windows system utility service  </description>" fullword ascii
      $s1 = "WindowsSysUtility - Unicode" fullword wide
      $s2 = "msiexec.exe" fullword wide
      $s3 = "WinHelpW" fullword ascii
      $s4 = "ReadProcessMemory" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
}
YARA Detection Rule: BlackEnergy_VBS_Agent
Repository: Neo23x0/signature-base
Detects: Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs
Author: Florian Roth (Nextron Systems)
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */

Detection condition:
filesize < 1KB and 2 of them

Full rule:
rule BlackEnergy_VBS_Agent {
	meta:
		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
		id = "0876f752-d476-5706-918e-edfda9bd7928"
	strings:
		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii /* Goodware String - occured 1 times */
	condition:
		filesize < 1KB and 2 of them
}
YARA Detection Rule: DropBear_SSH_Server
Repository: Neo23x0/signature-base
Detects: Detects DropBear SSH Server (not a threat but used to maintain access)
Author: Florian Roth (Nextron Systems)
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them

Full rule:
rule DropBear_SSH_Server {
	meta:
		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		score = 50
		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
		id = "22595d8b-b7ea-570e-ad17-d5bcec613abf"
	strings:
		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them
}
YARA Detection Rule: BlackEnergy_BackdoorPass_DropBear_SSH
Repository: Neo23x0/signature-base
Detects: Detects the password of the backdoored DropBear SSH Server - BlackEnergy
Author: Florian Roth (Nextron Systems)
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s1 = "passDs5Bu9Te7" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and $s1

Full rule:
rule BlackEnergy_BackdoorPass_DropBear_SSH {
	meta:
		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
		id = "60db00dd-72b3-5a28-90de-2a397b1e007b"
	strings:
		$s1 = "passDs5Bu9Te7" fullword ascii
	condition:
		uint16(0) == 0x5a4d and $s1
}
YARA Detection Rule: BlackEnergy_KillDisk_1
Repository: Neo23x0/signature-base
Detects: Detects KillDisk malware from BlackEnergy
Author: Florian Roth (Nextron Systems)
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "system32\\cmd.exe" fullword ascii
		$s1 = "system32\\icacls.exe" fullword wide
		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
		$s3 = "shutdown /r /t %d" fullword ascii
		$s4 = "/C /Q /grant " fullword wide
		$s5 = "%08X.tmp" fullword ascii
		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
		$s7 = "/c format %c: /Y /Q" fullword ascii
		$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
		$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 8 of them

Full rule:
rule BlackEnergy_KillDisk_1 {
	meta:
		description = "Detects KillDisk malware from BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		score = 80
		super_rule = 1
		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
		hash4 = "f[PII_REDACTED]4be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
		id = "304e7aa3-48d3-5015-aaf1-6b1df2441b75"
	strings:
		$s0 = "system32\\cmd.exe" fullword ascii
		$s1 = "system32\\icacls.exe" fullword wide
		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
		$s3 = "shutdown /r /t %d" fullword ascii
		$s4 = "/C /Q /grant " fullword wide
		$s5 = "%08X.tmp" fullword ascii
		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
		$s7 = "/c format %c: /Y /Q" fullword ascii
		$s8 = "taskhost.exe" fullword wide /* Goodware String - occured 1 times */
		$s9 = "shutdown.exe" fullword wide /* Goodware String - occured 1 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 8 of them
}
YARA Detection Rule: BlackEnergy_KillDisk_2
Repository: Neo23x0/signature-base
Detects: Detects KillDisk malware from BlackEnergy
Author: Florian Roth (Nextron Systems)
Reference: http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/

Pattern signatures:
$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
		$s1 = "%s%08X.tmp" fullword ascii
		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 3 of them

Full rule:
rule BlackEnergy_KillDisk_2 {
	meta:
		description = "Detects KillDisk malware from BlackEnergy"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
		date = "2016-01-03"
		modified = "2023-01-06"
		score = 80
		super_rule = 1
		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
		hash3 = "f[PII_REDACTED]4be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
		id = "f0304e87-a278-5963-9af0-935c088c00ec"
	strings:
		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
		$s1 = "%s%08X.tmp" fullword ascii
		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 3 of them
}
YARA Detection Rule: BlackEnergy_Driver_USBMDM
Repository: Neo23x0/signature-base
Detects: Black Energy Driver
Author: Florian Roth (Nextron Systems)
Reference: http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/

Pattern signatures:
$s1 = "USB MDM Driver" fullword wide
		$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
		$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 180KB and all of them

Full rule:
rule BlackEnergy_Driver_USBMDM {
	meta:
		description = "Black Energy Driver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
		date = "2016-01-04"
		super_rule = 1
		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a[PII_REDACTED]917df4276c583fc"
		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
		id = "d5e8faf0-38cb-5193-b859-83ea09278011"
	strings:
		$s1 = "USB MDM Driver" fullword wide
		$s2 = "KdDebuggerNotPresent" fullword ascii /* Goodware String - occured 50 times */
		$s3 = "KdDebuggerEnabled" fullword ascii /* Goodware String - occured 69 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 180KB and all of them
}
YARA Detection Rule: BlackEnergy_Driver_AMDIDE
Repository: Neo23x0/signature-base
Detects: Black Energy Malware
Author: Florian Roth (Nextron Systems)
Reference: http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/

Pattern signatures:
$s1 = " AMD IDE driver" fullword wide
		$s2 = "SessionEnv" fullword wide
		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 150KB and all of them

Full rule:
rule BlackEnergy_Driver_AMDIDE {
	meta:
		description = "Black Energy Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
		date = "2016-01-04"
		super_rule = 1
		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
		hash3 = "90ba78b6710462c2d97815e[PII_REDACTED]b3b296135490f0095bdc0cd97a34d9c"
		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
		id = "e5b57c33-87f7-5411-995c-384e0afa0348"
	strings:
		$s1 = " AMD IDE driver" fullword wide
		$s2 = "SessionEnv" fullword wide
		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}
YARA Detection Rule: Unspecified_Malware_Oct16_A
Repository: Neo23x0/signature-base
Detects: Detects an unspecififed malware - October 2016
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "%s\\system32\\%s.dll" fullword ascii
      $x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
      $x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii

      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
      $s2 = "boottemp.exe" fullword ascii
      $s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
      $s4 = "cryptcom.dll" fullword ascii
      $s5 = "Wininet.dll" fullword ascii
      $s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
      $s7 = "%s%d.exe" fullword ascii
      $s8 = "booter.exe" fullword ascii
      $s9 = "\\\\%s\\pipe%s" fullword ascii
      $s10 = "C:\\DelInfo.bin" fullword ascii

      $op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
      $op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
      $op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 } /* Opcode */

Detection condition:
/* File Detection */
      ( uint16(0) == 0x5a4d and filesize < 1000KB and (
         2 of ($x*) or 3 of ($s*) or all of ($op*)
      ) )
      /* In Memory */
      or ( 6 of them )

Full rule:
rule Unspecified_Malware_Oct16_A {
   meta:
      description = "Detects an unspecififed malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      score = 80
      hash1 = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
      id = "f62ecf7e-2b66-5567-9bf3-3d3797bc582d"
   strings:
      $x1 = "%s\\system32\\%s.dll" fullword ascii
      $x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
      $x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii

      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
      $s2 = "boottemp.exe" fullword ascii
      $s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
      $s4 = "cryptcom.dll" fullword ascii
      $s5 = "Wininet.dll" fullword ascii
      $s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
      $s7 = "%s%d.exe" fullword ascii
      $s8 = "booter.exe" fullword ascii
      $s9 = "\\\\%s\\pipe%s" fullword ascii
      $s10 = "C:\\DelInfo.bin" fullword ascii

      $op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
      $op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 } /* Opcode */
      $op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 } /* Opcode */
   condition:
      /* File Detection */
      ( uint16(0) == 0x5a4d and filesize < 1000KB and (
         2 of ($x*) or 3 of ($s*) or all of ($op*)
      ) )
      /* In Memory */
      or ( 6 of them )
}
YARA Detection Rule: Sality_Malware_Oct16
Repository: Neo23x0/signature-base
Detects: Detects an unspecififed malware - October 2016
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Hello world!" fullword wide
      $s2 = "[LordPE]" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule Sality_Malware_Oct16 {
   meta:
      description = "Detects an unspecififed malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      score = 80
      hash1 = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
      id = "7bf2a818-f7ee-587e-b22e-b557251d89e1"
   strings:
      $s1 = "Hello world!" fullword wide
      $s2 = "[LordPE]" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: Unspecified_Malware_Oct16_C
Repository: Neo23x0/signature-base
Detects: Detects an unspecififed malware - October 2016
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "dUSER32.DLL" fullword wide
      $s2 = "output.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB and all of them )

Full rule:
rule Unspecified_Malware_Oct16_C {
   meta:
      description = "Detects an unspecififed malware - October 2016"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      score = 80
      hash1 = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
      id = "fff98097-a19a-59aa-bece-837c75b0995c"
   strings:
      $s1 = "dUSER32.DLL" fullword wide
      $s2 = "output.dll" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 5000KB and all of them )
}
YARA Detection Rule: Bladabindi_Malware_B64
Repository: Neo23x0/signature-base
Detects: Detects Bladabindi Malware using Base64 encoded strings
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "XHN5c3RlbTMyXA==" fullword ascii /* base64 encoded string '\system32\' */
      $s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii /* base64 encoded string 'Execute ERROR' */
      $s3 = "dHJvamFuLmV4ZQ==" fullword ascii /* base64 encoded string 'trojan.exe' */
      $s4 = "VXBkYXRlIEVSUk9S" fullword ascii /* base64 encoded string 'Update ERROR' */
      $s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii /* base64 encoded string 'Download ERROR' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 700KB and 1 of them

Full rule:
rule Bladabindi_Malware_B64 {
   meta:
      description = "Detects Bladabindi Malware using Base64 encoded strings"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
      id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"
   strings:
      $s1 = "XHN5c3RlbTMyXA==" fullword ascii /* base64 encoded string '\system32\' */
      $s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii /* base64 encoded string 'Execute ERROR' */
      $s3 = "dHJvamFuLmV4ZQ==" fullword ascii /* base64 encoded string 'trojan.exe' */
      $s4 = "VXBkYXRlIEVSUk9S" fullword ascii /* base64 encoded string 'Update ERROR' */
      $s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii /* base64 encoded string 'Download ERROR' */
   condition:
      uint16(0) == 0x5a4d and filesize < 700KB and 1 of them
}
YARA Detection Rule: Dorkbot_Injector_Malware
Repository: Neo23x0/signature-base
Detects: Detects Darkbot Injector
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
      $s2 = "ready to finish" fullword ascii
      $s3 = "EYEnpw" fullword ascii
      $s4 = "somewhere i belong" fullword ascii
      $s5 = "Not all fields were assigned" fullword ascii
      $s6 = "take down" fullword ascii
      $s7 = "real number = %f" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 6 of them )

Full rule:
rule Dorkbot_Injector_Malware {
   meta:
      description = "Detects Darkbot Injector"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2016-10-08"
      hash1 = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
      id = "b32986fe-d6f1-55f2-8d50-bc348b52fb49"
   strings:
      $s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
      $s2 = "ready to finish" fullword ascii
      $s3 = "EYEnpw" fullword ascii
      $s4 = "somewhere i belong" fullword ascii
      $s5 = "Not all fields were assigned" fullword ascii
      $s6 = "take down" fullword ascii
      $s7 = "real number = %f" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and 6 of them )
}