deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: OlyxCode
Repository: Yara-Rules/rules
Detects: Olyx code tricks
Author: Seth Hardy

Pattern signatures:
$six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }

Detection condition:
any of them

Full rule:
rule OlyxCode : Olyx Family 
{
    meta:
        description = "Olyx code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $six = { C7 40 04 36 36 36 36 C7 40 08 36 36 36 36 }
        $slash = { C7 40 04 5C 5C 5C 5C C7 40 08 5C 5C 5C 5C }
        
    condition:
        any of them
}
YARA Detection Rule: OlyxStrings
Repository: Yara-Rules/rules
Detects: Olyx Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "/Applications/Automator.app/Contents/MacOS/DockLight"

Detection condition:
any of them

Full rule:
rule OlyxStrings : Olyx Family
{
    meta:
        description = "Olyx Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $ = "/Applications/Automator.app/Contents/MacOS/DockLight"
       
    condition:
        any of them
}
YARA Detection Rule: Olyx
Repository: Yara-Rules/rules
Detects: Olyx
Author: Seth Hardy

Detection condition:
OlyxCode or OlyxStrings

Full rule:
rule Olyx : Family
{
    meta:
        description = "Olyx"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    condition:
        OlyxCode or OlyxStrings
}
YARA Detection Rule: WoolenGoldfish_Sample_1
Repository: Yara-Rules/rules
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$s1 = "Cannot execute (%d)" fullword ascii
        $s16 = "SvcName" fullword ascii

Detection condition:
all of them

Full rule:
rule WoolenGoldfish_Sample_1 
{

    meta:
        description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
        author = "Florian Roth"
        reference = "http://goo.gl/NpJpVZ"
        date = "2015/03/25"
        score = 60
        hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
    
    strings:
        $s1 = "Cannot execute (%d)" fullword ascii
        $s16 = "SvcName" fullword ascii
    
    condition:
        all of them
}
YARA Detection Rule: WoolenGoldfish_Generic_1
Repository: Yara-Rules/rules
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$x0 = "Users\\Wool3n.H4t\\"
        $x1 = "C-CPP\\CWoolger"
        $x2 = "NTSuser.exe" fullword wide
        $s1 = "107.6.181.116" fullword wide
        $s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
        $s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
        $s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
        $s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
        $s6 = "wlg.dat" fullword
        $s7 = "woolger" fullword wide
        $s8 = "[Enter]" fullword
        $s9 = "[Control]" fullword

Detection condition:
( 1 of ($x*) and 2 of ($s*) ) or ( 6 of ($s*) )

Full rule:
rule WoolenGoldfish_Generic_1 
{

    meta:
        description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
        author = "Florian Roth"
        reference = "http://goo.gl/NpJpVZ"
        date = "2015/03/25"
        score = 90
        super_rule = 1
        hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
        hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
        hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
    
    strings:
        $x0 = "Users\\Wool3n.H4t\\"
        $x1 = "C-CPP\\CWoolger"
        $x2 = "NTSuser.exe" fullword wide
        $s1 = "107.6.181.116" fullword wide
        $s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
        $s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
        $s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
        $s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
        $s6 = "wlg.dat" fullword
        $s7 = "woolger" fullword wide
        $s8 = "[Enter]" fullword
        $s9 = "[Control]" fullword
    condition:
        ( 1 of ($x*) and 2 of ($s*) ) or ( 6 of ($s*) )
}
YARA Detection Rule: WoolenGoldfish_Generic_2
Repository: Yara-Rules/rules
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii

Detection condition:
all of them

Full rule:
rule WoolenGoldfish_Generic_2 
{

    meta:
        description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
        author = "Florian Roth"
        reference = "http://goo.gl/NpJpVZ"
        date = "2015/03/25"
        score = 90
        hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
        hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
        hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
        hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
   
    strings:
        $s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
   
    condition:
        all of them
}
YARA Detection Rule: WoolenGoldfish_Generic_3
Repository: Yara-Rules/rules
Detects: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ
Author: Florian Roth
Reference: http://goo.gl/NpJpVZ

Pattern signatures:
$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
        $x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
        $x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
        $s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
        $s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
        $s2 = "Attempting to unlock uninitialized lock!" fullword ascii
        $s4 = "unable to load kernel32.dll" fullword ascii
        $s5 = "index.php?c=%S&r=%x" fullword wide
        $s6 = "%s len:%d " fullword ascii
        $s7 = "Encountered error sending syscall response to client" fullword ascii
        $s9 = "/info.dat" fullword ascii
        $s10 = "Error entering thread lock" fullword ascii
        $s11 = "Error exiting thread lock" fullword ascii
        $s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii

Detection condition:
( 1 of ($x*) ) or ( 8 of ($s*) )

Full rule:
rule WoolenGoldfish_Generic_3 
{

    meta:
        description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
        author = "Florian Roth"
        reference = "http://goo.gl/NpJpVZ"
        date = "2015/03/25"
        score = 90
        hash1 = "86222ef166474e53f1eb6d7e[PII_REDACTED]e6fee7"
        hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
    
    strings:
        $x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
        $x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
        $x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
        $s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
        $s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
        $s2 = "Attempting to unlock uninitialized lock!" fullword ascii
        $s4 = "unable to load kernel32.dll" fullword ascii
        $s5 = "index.php?c=%S&r=%x" fullword wide
        $s6 = "%s len:%d " fullword ascii
        $s7 = "Encountered error sending syscall response to client" fullword ascii
        $s9 = "/info.dat" fullword ascii
        $s10 = "Error entering thread lock" fullword ascii
        $s11 = "Error exiting thread lock" fullword ascii
        $s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
   
    condition:
        ( 1 of ($x*) ) or ( 8 of ($s*) )
}
YARA Detection Rule: rtf_Kaba_jDoe
Repository: Yara-Rules/rules
Detects: fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620
Author: @patrickrolsen

Pattern signatures:
$magic1 = { 7b 5c 72 74 30 31 } // {\rt01
    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
    $author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
    $author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
    $string1 = { 44 30 [16] 43 46 [23] 31 31 45 }

Detection condition:
($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1

Full rule:
rule rtf_Kaba_jDoe
{

meta:
    author = "@patrickrolsen"
    maltype = "APT.Kaba"
    filetype = "RTF"
    version = "0.1"
    description = "fe439af268cd3de3a99c21ea40cf493f, d0e0e68a88dce443b24453cc951cf55f, b563af92f144dea7327c9597d9de574e, and def0c9a4c732c3a1e8910db3f9451620"
    date = "2013-12-10"

strings:
    $magic1 = { 7b 5c 72 74 30 31 } // {\rt01
    $magic2 = { 7b 5c 72 74 66 31 } // {\rtf1
    $magic3 = { 7b 5c 72 74 78 61 33 } // {\rtxa3
    $author1 = { 4A 6F 68 6E 20 44 6F 65 } // "John Doe"
    $author2 = { 61 75 74 68 6f 72 20 53 74 6f 6e 65 } // "author Stone"
    $string1 = { 44 30 [16] 43 46 [23] 31 31 45 }

condition:
    ($magic1 or $magic2 or $magic3 at 0) and all of ($author*) and $string1
}
YARA Detection Rule: Sphinx_Moth_cudacrt
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file cudacrt.dll
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "HPSSOEx.dll" fullword wide
        $s1 = "255.255.255.254" fullword wide
        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)

Full rule:
rule Sphinx_Moth_cudacrt 
{ 

    meta:
        description = "sphinx moth threat group file cudacrt.dll" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"

    strings:
        $s0 = "HPSSOEx.dll" fullword wide
        $s1 = "255.255.255.254" fullword wide
        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */

    condition:
        uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Sphinx_Moth_h2t
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file h2t.dat
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
        $s1 = "[-] Error in connection() %d - %s" fullword ascii
        $s2 = "[-] Child process exit." fullword ascii
        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
        $s4 = "pipe() to" fullword ascii
        $s5 = "pipe() from" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))

Full rule:
rule Sphinx_Moth_h2t 
{ 

    meta:
        description = "sphinx moth threat group file h2t.dat" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)" 
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"

    strings:
        $x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
        $s1 = "[-] Error in connection() %d - %s" fullword ascii
        $s2 = "[-] Child process exit." fullword ascii
        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
        $s4 = "pipe() to" fullword ascii
        $s5 = "pipe() from" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))
}
YARA Detection Rule: Sphinx_Moth_iastor32
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file iastor32.exe
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule Sphinx_Moth_iastor32 
{ 

    meta:
        description = "sphinx moth threat group file iastor32.exe" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
   
    strings:
        $s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */
   
    condition:
        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: Sphinx_Moth_kerberos32
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file kerberos32.dll
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
        $x3 = "kerberos32.dll" fullword wide
        $x4 = "KERBEROS64.dll" fullword ascii
        $x5 = "kerberos%d.dll" fullword ascii
        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
        $s4 = "getlog" fullword ascii
        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))

Full rule:
rule Sphinx_Moth_kerberos32 
{

    meta:
        description = "sphinx moth threat group file kerberos32.dll" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"

    strings:
        $x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
        $x3 = "kerberos32.dll" fullword wide
        $x4 = "KERBEROS64.dll" fullword ascii
        $x5 = "kerberos%d.dll" fullword ascii
        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
        $s4 = "getlog" fullword ascii
        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */
    
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))
}
YARA Detection Rule: Sphinx_Moth_kerberos64
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file kerberos64.dll
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "KERBEROS64.dll" fullword ascii
        $s1 = "zeSecurityDescriptor" fullword ascii
        $s2 = "SpGetInfo" fullword ascii
        $s3 = "SpShutdown" fullword ascii
        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)

Full rule:
rule Sphinx_Moth_kerberos64 
{ 

    meta:
        description = "sphinx moth threat group file kerberos64.dll" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"

    strings:
        $s0 = "KERBEROS64.dll" fullword ascii
        $s1 = "zeSecurityDescriptor" fullword ascii
        $s2 = "SpGetInfo" fullword ascii
        $s3 = "SpShutdown" fullword ascii
        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */

    condition:
        uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Sphinx_Moth_nvcplex
Repository: Yara-Rules/rules
Detects: sphinx moth threat group file nvcplex.dat
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "mshtaex.exe" fullword wide
        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 214KB and all of them

Full rule:
rule Sphinx_Moth_nvcplex 
{ 

    meta:
        description = "sphinx moth threat group file nvcplex.dat" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"

    strings:
        $s0 = "mshtaex.exe" fullword wide
        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */

    condition:
        uint16(0) == 0x5a4d and filesize < 214KB and all of them
}
YARA Detection Rule: gholeeV1
Repository: Yara-Rules/rules
Detects: Gholee first discovered variant 
Author: @GelosSnake
Reference: http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html

Pattern signatures:
$a = "sandbox_avg10_vc9_SP1_2011"
    	 $b = "gholee"

Detection condition:
all of them

Full rule:
rule gholeeV1
{
    meta:
	 Author = "@GelosSnake"
    	 Date = "2014/08"
    	 Description = "Gholee first discovered variant "
	 Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html" 

    strings:
    	 $a = "sandbox_avg10_vc9_SP1_2011"
    	 $b = "gholee"

    condition:
    	 all of them
}
YARA Detection Rule: gholeeV2
Repository: Yara-Rules/rules
Detects: Gholee first discovered variant 
Author: @GelosSnake
Reference: http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html

Pattern signatures:
$string0 = "RichHa"
	$string1 = "         (((((                  H" wide
	$string2 = "1$1,141<1D1L1T1\\1d1l1t1"
	$string3 = "<8;$O' "
	$string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
	$string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
	$string6 = "urn:schemas-microsoft-com:asm.v1"
	$string7 = "8.848H8O8i8s8y8"
	$string8 = "wrapper3" wide
	$string9 = "pwwwwwwww"
	$string10 = "Sunday"
	$string11 = "YYuTVWh"
	$string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
	$string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
	$string15 = "wrapper3 Version 1.0" wide
	$string16 = "77A779"
	$string17 = "<C<G<M<R<X<"
	$string18 = "9 9-9N9X9s9"

Detection condition:
18 of them

Full rule:
rule gholeeV2
{
   meta:
	Author = "@GelosSnake"
	Date = "2015-02-12"
    	Description = "Gholee first discovered variant "
	Reference = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html" 

   strings:
	$string0 = "RichHa"
	$string1 = "         (((((                  H" wide
	$string2 = "1$1,141<1D1L1T1\\1d1l1t1"
	$string3 = "<8;$O' "
	$string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
	$string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
	$string6 = "urn:schemas-microsoft-com:asm.v1"
	$string7 = "8.848H8O8i8s8y8"
	$string8 = "wrapper3" wide
	$string9 = "pwwwwwwww"
	$string10 = "Sunday"
	$string11 = "YYuTVWh"
	$string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
	$string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
	$string15 = "wrapper3 Version 1.0" wide
	$string16 = "77A779"
	$string17 = "<C<G<M<R<X<"
	$string18 = "9 9-9N9X9s9"

    condition:
	18 of them
}
YARA Detection Rule: MW_gholee_v1
Repository: Yara-Rules/rules
Detects: http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html
Author: @GelosSnake

Pattern signatures:
$a = "sandbox_avg10_vc9_SP1_2011"
    $b = "gholee"

Detection condition:
all of them

Full rule:
rule MW_gholee_v1 : v1
{
meta:
    Author = "@GelosSnake"
    description = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
    date = "2014-08"
    maltype = "Remote Access Trojan"
    sample_filetype = "dll"
    hash0 = "48573a150562c[PII_REDACTED]3456b4c02"
   
strings:
    $a = "sandbox_avg10_vc9_SP1_2011"
    $b = "gholee"
   
condition:
    all of them
}
YARA Detection Rule: MW_gholee_v2
Repository: Yara-Rules/rules
Detects: http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html
Author: @GelosSnake

Pattern signatures:
$string0 = "RichHa"
        $string1 = "         (((((                  H" wide
        $string2 = "1$1,141<1D1L1T1\\1d1l1t1"
        $string3 = "<8;$O' "
        $string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
        $string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
        $string6 = "urn:schemas-microsoft-com:asm.v1"
        $string7 = "8.848H8O8i8s8y8"
        $string8 = "wrapper3" wide
        $string9 = "pwwwwwwww"
        $string10 = "Sunday"
        $string11 = "YYuTVWh"
        $string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
        $string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
        $string15 = "wrapper3 Version 1.0" wide
        $string16 = "77A779"
        $string17 = "<C<G<M<R<X<"
        $string18 = "9 9-9N9X9s9"

Detection condition:
18 of them

Full rule:
rule MW_gholee_v2 : v2
{
meta:
        author = "@GelosSnake"
        date = "2015-02-12"
        description = "http://securityaffairs.co/wordpress/28170/cyber-crime/gholee-malware.html"
        hash0 = "05523761ca296ec09afdf79477e5f18d"
        hash1 = "08e424ac42e6efa361eccefdf3c13b21"
        hash2 = "5730f925145f1a1cd8380197e01d9e06"
        hash3 = "73461c8578dd9ab86d42984f30c04610"
        sample_filetype = "dll"
strings:
        $string0 = "RichHa"
        $string1 = "         (((((                  H" wide
        $string2 = "1$1,141<1D1L1T1\\1d1l1t1"
        $string3 = "<8;$O' "
        $string4 = "@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]"
        $string5 = "jYPQTVTSkllZTTXRTUiHceWda/"
        $string6 = "urn:schemas-microsoft-com:asm.v1"
        $string7 = "8.848H8O8i8s8y8"
        $string8 = "wrapper3" wide
        $string9 = "pwwwwwwww"
        $string10 = "Sunday"
        $string11 = "YYuTVWh"
        $string12 = "DDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDIN"
        $string13 = "ytMMMMMMUbbrrrrrxxxxxxxxrriUMMMMMMMMMUuzt"
        $string15 = "wrapper3 Version 1.0" wide
        $string16 = "77A779"
        $string17 = "<C<G<M<R<X<"
        $string18 = "9 9-9N9X9s9"
condition:
        18 of them
}