deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MAL_BACKORDER_LOADER_WIN_Go_Jan23
Repository: Neo23x0/signature-base
Detects: Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server.
Author: Arda Buyukkaya (modified by Florian Roth)
Reference: EclecticIQ

Pattern signatures:
$GoBuildId = "Go build" ascii
      // Debug symbols commonly seen in BACKORDER loader
      $x_DebugSymbol_1 = "C:/updatescheck/main.go"
      $x_DebugSymbol_2 = "C:/Users/IEUser/Desktop/Majestic/"
      // Function name patterns observed in BACKORDER loader
      $s_FunctionName_1 = "main.getUpdates.func"
      $s_FunctionName_2 = "main.obt_zip"
      $s_FunctionName_3 = "main.obtener_zip"
      $s_FunctionName_4 = "main.get_zip"
      $s_FunctionName_5 = "main.show_pr0gressbar"
      $s_FunctionName_6 = "main.pr0cess"

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 10MB
      and $GoBuildId
      and (
         1 of ($x*)
         or 3 of them
      )

Full rule:
rule MAL_BACKORDER_LOADER_WIN_Go_Jan23 {
   meta:
      description = "Detects the BACKORDER loader compiled in GO which download and executes a second stage payload from a remote server."
      author = "Arda Buyukkaya (modified by Florian Roth)"
      date = "2025-01-23"
      reference = "EclecticIQ"
      score = 80
      tags = "loader, golang, BACKORDER, malware, windows"
      hash = "70c91ffdc866920a634b31bf4a070fb3c3f947fc9de22b783d6f47a097fec2d8"
      id = "90a82f2c-be92-5d0b-b47e-f47db2b15867"
   strings:
      $GoBuildId = "Go build" ascii
      // Debug symbols commonly seen in BACKORDER loader
      $x_DebugSymbol_1 = "C:/updatescheck/main.go"
      $x_DebugSymbol_2 = "C:/Users/IEUser/Desktop/Majestic/"
      // Function name patterns observed in BACKORDER loader
      $s_FunctionName_1 = "main.getUpdates.func"
      $s_FunctionName_2 = "main.obt_zip"
      $s_FunctionName_3 = "main.obtener_zip"
      $s_FunctionName_4 = "main.get_zip"
      $s_FunctionName_5 = "main.show_pr0gressbar"
      $s_FunctionName_6 = "main.pr0cess"
   condition:
      uint16(0) == 0x5a4d
      and filesize < 10MB
      and $GoBuildId
      and (
         1 of ($x*)
         or 3 of them
      )
}
YARA Detection Rule: MAL_Sednit_DelphiDownloader_Apr18_3
Repository: Neo23x0/signature-base
Detects: Detects malware from Sednit Delphi Downloader report
Author: Florian Roth (Nextron Systems)
Reference: https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/

Pattern signatures:
$ = "Processor Level: " fullword ascii
      $ = "CONNECTION ERROR" fullword ascii
      $ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
      $ = "-KILL_PROCESS-" ascii
      $ = "-FILE_EXECUTE-" ascii
      $ = "-DOWNLOAD_ERROR-" ascii
      $ = "CMD_EXECUTE" fullword ascii
      $ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
      $ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them

Full rule:
rule MAL_Sednit_DelphiDownloader_Apr18_3 {
   meta:
      description = "Detects malware from Sednit Delphi Downloader report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
      date = "2018-04-24"
      modified = "2023-01-06"
      hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
      hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
      id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"
   strings:
      $ = "Processor Level: " fullword ascii
      $ = "CONNECTION ERROR" fullword ascii
      $ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
      $ = "-KILL_PROCESS-" ascii
      $ = "-FILE_EXECUTE-" ascii
      $ = "-DOWNLOAD_ERROR-" ascii
      $ = "CMD_EXECUTE" fullword ascii
      $ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
      $ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and 3 of them
}
YARA Detection Rule: MiniRAT_Gen_1
Repository: Neo23x0/signature-base
Detects: Detects Mini RAT malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news

Pattern signatures:
$x1 = "\\Mini rat\\" ascii
      $x2 = "\\Projects\\ali\\Clever Components v7\\" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them

Full rule:
rule MiniRAT_Gen_1 {
   meta:
      description = "Detects Mini RAT malware"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
      date = "2018-01-22"
      hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
      hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
      hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
      hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e[PII_REDACTED]1d0790"
      hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
      id = "65d89762-2fd0-5c6a-b706-92d77a03089a"
   strings:
      $x1 = "\\Mini rat\\" ascii
      $x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 7000KB and 1 of them
}
YARA Detection Rule: Fareit_Trojan_Oct15
Repository: Neo23x0/signature-base
Detects: Detects Fareit Trojan from Sep/Oct 2015 Wave
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/5VYtlU

Pattern signatures:
$s1 = "ebai.exe" fullword wide
		$s2 = "Origina" fullword wide

Detection condition:
uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)

Full rule:
rule Fareit_Trojan_Oct15 {
	meta:
		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/5VYtlU"
		date = "2015-10-18"
		score = 80
		super_rule = 1
		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
		hash3 = "408fa0bd4d44de[PII_REDACTED]b554e8dab42f5d28a6a525b4bc41285e37ab488d"
		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
		id = "725abb2a-7675-51b5-aed8-594e4826a6b4"
	strings:
		$s1 = "ebai.exe" fullword wide
		$s2 = "Origina" fullword wide
	condition:
		uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
}
YARA Detection Rule: Upatre_Hazgurut
Repository: Neo23x0/signature-base
Detects: Detects Upatre malware - file hazgurut.exe
Author: Florian Roth (Nextron Systems)
Reference: https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3?environmentId=7

Pattern signatures:
$a1 = "barcod" fullword ascii

		$s0 = "msports.dll" fullword ascii
		$s1 = "nddeapi.dll" fullword ascii
		$s2 = "glmf32.dll" fullword ascii
		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
		$s4 = "cmutil.dll" fullword ascii
		$s5 = "mprapi.dll" fullword ascii
		$s6 = "glmf32.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1500KB
		and $a1 in (0..4000)
		and all of ($s*)

Full rule:
rule Upatre_Hazgurut {
	meta:
		description = "Detects Upatre malware - file hazgurut.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3?environmentId=7"
		date = "2015-10-13"
		score = 70
		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
		hash5 = "a35f9870f9d4b993eb094460b05ee1f[PII_REDACTED]07abe6264121dd7cc12aa70"
		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3"
		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
		id = "b0040452-ed63-5e90-9ed6-4f05e7b4eadc"
	strings:
		$a1 = "barcod" fullword ascii

		$s0 = "msports.dll" fullword ascii
		$s1 = "nddeapi.dll" fullword ascii
		$s2 = "glmf32.dll" fullword ascii
		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
		$s4 = "cmutil.dll" fullword ascii
		$s5 = "mprapi.dll" fullword ascii
		$s6 = "glmf32.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1500KB
		and $a1 in (0..4000)
		and all of ($s
YARA Detection Rule: APT_Thrip_Sample_Jun18_1
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "idocback.dll" fullword ascii
      $s2 = "constructor or from DllMain." fullword ascii
      $s3 = "appmgmt" fullword ascii
      $s4 = "chksrv" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule APT_Thrip_Sample_Jun18_1 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
      id = "5b[PII_REDACTED]-5dc0-bf64-90646f6bab6b"
   strings:
      $s1 = "idocback.dll" fullword ascii
      $s2 = "constructor or from DllMain." fullword ascii
      $s3 = "appmgmt" fullword ascii
      $s4 = "chksrv" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_2
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
      $s2 = "ProbeScriptFint" fullword wide
      $s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii /* Goodware String - occured 2 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule APT_Thrip_Sample_Jun18_2 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
      id = "bc1cfcc8-64a0-5da0-8ff7-147da8a3af0b"
   strings:
      $s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
      $s2 = "ProbeScriptFint" fullword wide
      $s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii /* Goodware String - occured 2 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_3
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
      $s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule APT_Thrip_Sample_Jun18_3 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
      id = "67ea7ed1-954f-5b3e-b058-452be3b6fdfa"
   strings:
      $s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
      $s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_4
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
      $s2 = "ProcessName No Access" fullword ascii
      $s3 = "Hwnd of Process NULL" fullword ascii
      $s4 = "*********The new session is be opening:(%d)**********" fullword ascii
      $s5 = "[EXECUTE]" fullword ascii
      $s6 = "/------------------------------------------------------------------------" fullword ascii
      $s7 = "constructor or from DllMain." fullword ascii
      $s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
      $s9 = "\\info.config" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 5 of them

Full rule:
rule APT_Thrip_Sample_Jun18_4 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
      id = "9dcfcdbd-d18f-5eba-a10c-95686f010f23"
   strings:
      $s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
      $s2 = "ProcessName No Access" fullword ascii
      $s3 = "Hwnd of Process NULL" fullword ascii
      $s4 = "*********The new session is be opening:(%d)**********" fullword ascii
      $s5 = "[EXECUTE]" fullword ascii
      $s6 = "/------------------------------------------------------------------------" fullword ascii
      $s7 = "constructor or from DllMain." fullword ascii
      $s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
      $s9 = "\\info.config" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and 5 of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_5
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s2 = "c:\\windows\\USBEvent.exe" fullword ascii
      $s5 = "c:\\windows\\spdir.dat" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and all of them

Full rule:
rule APT_Thrip_Sample_Jun18_5 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
      id = "42c56ed6-a509-568f-a611-ce7e5c5d9d8e"
   strings:
      $s2 = "c:\\windows\\USBEvent.exe" fullword ascii
      $s5 = "c:\\windows\\spdir.dat" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and all of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_6
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them

Full rule:
rule APT_Thrip_Sample_Jun18_6 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
      id = "a1c65bc1-371e-509f-a01c-2d58c1773f95"
   strings:
      $s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_7
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$s1 = "C:\\runme.exe" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and 1 of them

Full rule:
rule APT_Thrip_Sample_Jun18_7 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "6b714dc1c7e[PII_REDACTED]0d2c7f3d820798473faeb26855e53101b8f3c701e3f"
      id = "16739590-eb88-5de2-bd76-974b3343ec19"
   strings:
      $s1 = "C:\\runme.exe" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 60KB and 1 of them
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_8
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
      $x2 = "new $._x('WScript.Shell');" ascii
      $x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii

Detection condition:
filesize < 10KB and 1 of ($x*)

Full rule:
rule APT_Thrip_Sample_Jun18_8 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
      id = "5eb98c9e-5103-5146-9364-d5f24416406f"
   strings:
      $x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
      $x2 = "new $._x('WScript.Shell');" ascii
      $x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii
   condition:
      filesize < 10KB and 1 of ($x*)
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_9
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "a7f0714e82b3105031fa7bc89dfe7664" or
         pe.imphash() == "8812ff21aeb160e[PII_REDACTED]acae54b" or
         pe.imphash() == "44a1e904763fe2d0837c747c7061b010" or
         pe.imphash() == "51a854d285aa12eb82e76e6e1be01573" or
 

Full rule:
rule APT_Thrip_Sample_Jun18_9 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
      hash2 = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
      hash3 = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
      hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
      id = "7fcd8d7f-ed60-5155-a0dd-f3a36f3f2981"
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "a7f0714e82b3105031fa7bc89dfe7664" or
         pe.imphash() == "8812ff21aeb160e[PII_REDACTED]acae54b" or
         pe.imphash() == "44a1e904763fe2d0837c747c7061b010" or
         pe.imphash() == "51a854d285aa12eb82e76e6e1be01573" or
         pe.imphash() == "a1f457c8c549c5c430556bfe5887a4e6"
      )
}
YARA Detection Rule: APT_Thrip_Sample_Jun18_10
Repository: Neo23x0/signature-base
Detects: Detects sample found in Thrip report by Symantec 
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets 

Pattern signatures:
$x1 = "!This Program cannot be run in DOS mode." fullword ascii
      $x2 = "!this program cannot be run in dos mode." fullword ascii

      $s1 = "svchost.dll" fullword ascii
      $s2 = "constructor or from DllMain." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or 2 of them )

Full rule:
rule APT_Thrip_Sample_Jun18_10 {
   meta:
      description = "Detects sample found in Thrip report by Symantec "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
      date = "2018-06-21"
      hash1 = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
      id = "3307ca18-59fb-5400-b51e-c4f4aa99e592"
   strings:
      $x1 = "!This Program cannot be run in DOS mode." fullword ascii
      $x2 = "!this program cannot be run in dos mode." fullword ascii

      $s1 = "svchost.dll" fullword ascii
      $s2 = "constructor or from DllMain." fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and ( $x1 or 2 of them )
}