deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_NK_MAL_DLL_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/

Pattern signatures:
$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword

      $s1 = "Windows %d(%d)-%s" ascii fullword
      $s2 = "auth_timestamp: " ascii fullword
      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword

      $op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
      $op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
      $op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 500KB and (
         1 of ($x*)
         or 2 of them
      )
      or (
         $x1 and 1 of ($s*)
         or 3 of them
      )

Full rule:
rule APT_NK_MAL_DLL_Apr23_1 {
   meta:
      description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
      date = "2023-04-03"
      score = 75
      hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
      hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
      hash4 = "dca33d6dacac0859ec2f[PII_REDACTED]fe2451e21eb06e676f4860ecc73a41e6f9"
      hash5 = "fe948451df90df80c8028b969bf89ecbf501401e[PII_REDACTED]c134080976ce2e"
      id = "c2abe266-0c21-51aa-9426-46a4f59df937"
   strings:
      $x1 = "vG2eZ1KOeGd2n5fr" ascii fullword

      $s1 = "Windows %d(%d)-%s" ascii fullword
      $s2 = "auth_timestamp: " ascii fullword
      $s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword

      $op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
      $op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
      $op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 500KB and (
         1 of ($x*)
         or 2 of them
      )
      or (
         $x1 and 1 of ($s*)
         or 3 of them
      )
}
YARA Detection Rule: APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1
Repository: Neo23x0/signature-base
Detects: Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736
Author: Mandiant
Reference: https://www.3cx.com/blog/news/mandiant-initial-results/

Pattern signatures:
$p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
      $p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}

Detection condition:
uint16(0) == 0x5A4D and any of them

Full rule:
rule APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 {
   meta:
      description = "Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736"
      author = "Mandiant"
      date = "2023-03-04"
      score = 80
      reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
      id = "25a80f98-03d6-59e6-84e6-6d847a6c591e"
   strings:
      $p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
      $p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}
   condition:
      uint16(0) == 0x5A4D and any of them
}
YARA Detection Rule: CorkowDLL
Repository: Neo23x0/signature-base
Detects: Rule to detect the Corkow DLL files
Author: Group IB

Pattern signatures:
$binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
        $binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }

Detection condition:
uint16(0) == 0x5a4d and (
            all of ($binary*) and (
               pe.exports("Control_RunDLL") or
               pe.exports("ServiceMain") or
               pe.exports("DllGetClassObject")
            ) or (
               pe.exports("ServiceMain") and  /* Service DLL */
               pe

Full rule:
rule CorkowDLL {
    meta:
        description = "Rule to detect the Corkow DLL files"
        author = "Group IB"
        date = "01.02.2016"
        referenced = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
        id = "cc9d2bb3-8db3-54a0-bd05-7f054ce84633"
    strings:
        $binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
        $binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }
    condition:
         uint16(0) == 0x5a4d and (
            all of ($binary*) and (
               pe.exports("Control_RunDLL") or
               pe.exports("ServiceMain") or
               pe.exports("DllGetClassObject")
            ) or (
               pe.exports("ServiceMain") and  /* Service DLL */
               pe.exports("Control_RunDLL")   /* Sufficiently specific in this combination */
            )
         )
}
YARA Detection Rule: SUSP_Solarwinds_SUNBURST_Revoked_Cert
Repository: Neo23x0/signature-base
Detects: Detects executables signed with a compromised certificate after 2019 (it doesn't mean that the 
Reference: https://github.com/fireeye/sunburst_countermeasures/pull/3#issuecomment-747156202

Detection condition:
uint16(0) == 0x5a4d and
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "Symantec Class 3 SHA256 Code Signing CA" and
         pe.signatures[i].serial == "0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed" and
         // valid after Tuesday, January 1, 

Full rule:
rule SUSP_Solarwinds_SUNBURST_Revoked_Cert {
   meta:
      description = "Detects executables signed with a compromised certificate after 2019 (it doesn't mean that the "
      date = "2020-12-14"
      reference = "https://github.com/fireeye/sunburst_countermeasures/pull/3#issuecomment-747156202"
      score = 50
   condition:
      uint16(0) == 0x5a4d and
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "Symantec Class 3 SHA256 Code Signing CA" and
         pe.signatures[i].serial == "0f:e9:73:75:20:22:a6:06:ad:f2:a3:6e:34:5d:c0:ed" and
         // valid after Tuesday, January 1, 2019 0:00:00
         pe.signatures[i].not_before >[PII_REDACTED]
      )
}
YARA Detection Rule: LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
Repository: Neo23x0/signature-base
Detects: Detects webshell access mentioned in FireEye's SUNBURST report
Author: Florian Roth (Nextron Systems)
Reference: https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/

Pattern signatures:
$xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide

Detection condition:
$xr1

Full rule:
rule LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2 {
   meta:
      description = "Detects webshell access mentioned in FireEye's SUNBURST report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
      date = "2020-12-21"
      id = "fb86164d-13de-5357-8f52-c597b51127ff"
   strings:
      $xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide
   condition:
      $xr1
}
YARA Detection Rule: MAL_OSX_FancyBear_Agent_Jul18_1
Repository: Neo23x0/signature-base
Detects: Detects FancyBear Agent for OSX
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/DrunkBinary/status/[PII_REDACTED]54098432

Pattern signatures:
$x1 = "/Users/kazak/Desktop/" ascii

      $s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
      $s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
      $s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
      $s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
      $s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii

Detection condition:
uint16(0) == 0xfacf and filesize < 3000KB and ( 1 of ($x*) and 4 of them )

Full rule:
rule MAL_OSX_FancyBear_Agent_Jul18_1 {
   meta:
      description = "Detects FancyBear Agent for OSX"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/DrunkBinary/status/[PII_REDACTED]54098432"
      date = "2018-07-15"
      hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
      id = "ae717f70-7196-561a-916f-1598ab38c77a"
   strings:
      $x1 = "/Users/kazak/Desktop/" ascii

      $s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
      $s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
      $s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
      $s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
      $s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
   condition:
      uint16(0) == 0xfacf and filesize < 3000KB and ( 1 of ($x*) and 4 of them )
}
YARA Detection Rule: Unspecified_Malware_Jul17_2C
Repository: Neo23x0/signature-base
Detects: Unspecified Malware - CN relation
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/CX3KaY

Pattern signatures:
$x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
      $x2 = "freenow.chickenkiller.com" fullword ascii
      $x3 = "\\Release\\PhantomNet-SSL.pdb" ascii

      $s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
      $s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
      $s3 = "Proxy-Authenticate: Basic" fullword ascii
      $s4 = "Proxy-Authenticate: NTLM" fullword ascii
      $s5 = "Root\\SecurityCenter2" fullword wide
      $s6 = "aaabbbcccddd" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of ($s*) ) ) or
      ( all of them )

Full rule:
rule Unspecified_Malware_Jul17_2C {
   meta:
      description = "Unspecified Malware - CN relation"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/CX3KaY"
      date = "2017-07-18"
      hash1 = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
      id = "91e760e8-7460-54af-a794-0b41a4b19760"
   strings:
      $x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
      $x2 = "freenow.chickenkiller.com" fullword ascii
      $x3 = "\\Release\\PhantomNet-SSL.pdb" ascii

      $s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
      $s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
      $s3 = "Proxy-Authenticate: Basic" fullword ascii
      $s4 = "Proxy-Authenticate: NTLM" fullword ascii
      $s5 = "Root\\SecurityCenter2" fullword wide
      $s6 = "aaabbbcccddd" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 4 of ($s*) ) ) or
      ( all of them )
}
YARA Detection Rule: RAT_AAR
Repository: Neo23x0/signature-base
Detects: Detects AAR RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/AAR

Pattern signatures:
$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide

Detection condition:
all of them

Full rule:
rule RAT_AAR
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects AAR RAT"
		reference = "http://malwareconfig.com/stats/AAR"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "42c1af80-cff3-505f-a3cb-35b7e34575e1"
	strings:
		$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_Adzok
Repository: Neo23x0/signature-base
Detects: Detects Adzok RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Adzok

Pattern signatures:
$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
		$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"

Detection condition:
7 of ($a*)

Full rule:
rule RAT_Adzok
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		description = "Detects Adzok RAT"
		Versions = "Free 1.0.0.3,"
		date = "01.05.2015"
		reference = "http://malwareconfig.com/stats/Adzok"
		maltype = "Remote Access Trojan"
		filetype = "jar"

		id = "93807f85-ae4e-5fd2-9010-ed2cf6f57f38"
	strings:
		$a1 = "config.xmlPK"
		$a2 = "key.classPK"
		$a3 = "svd$1.classPK"
		$a4 = "svd$2.classPK"
		$a5 = "Mensaje.classPK"
		$a6 = "inic$ShutdownHook.class"
		$a7 = "Uninstall.jarPK"
		$a8 = "resources/icono.pngPK"

	condition:
		7 of ($a*)
}
YARA Detection Rule: RAT_Ap0calypse
Repository: Neo23x0/signature-base
Detects: Detects Ap0calypse RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Ap0calypse

Pattern signatures:
$a = "Ap0calypse"
		$b = "Sifre"
		$c = "MsgGoster"
		$d = "Baslik"
		$e = "Dosyalars"
		$f = "Injecsiyon"

Detection condition:
all of them

Full rule:
rule RAT_Ap0calypse
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		description = "Detects Ap0calypse RAT"
		date = "01.04.2014"
		reference = "http://malwareconfig.com/stats/Ap0calypse"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "a2993654-efa0-519b-b6f6-4d722d93adde"
	strings:
		$a = "Ap0calypse"
		$b = "Sifre"
		$c = "MsgGoster"
		$d = "Baslik"
		$e = "Dosyalars"
		$f = "Injecsiyon"

	condition:
		all of them
}
YARA Detection Rule: RAT_Arcom
Repository: Neo23x0/signature-base
Detects: Detects Arcom RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Arcom

Pattern signatures:
$a1 = "CVu3388fnek3W(3ij3fkp0930di"
		$a2 = "ZINGAWI2"
		$a3 = "clWebLightGoldenrodYellow"
		$a4 = "Ancestor for '%s' not found" wide
		$a5 = "Control-C hit" wide
		$a6 = {A3 24 25 21}

Detection condition:
all of them

Full rule:
rule RAT_Arcom
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Arcom RAT"
		reference = "http://malwareconfig.com/stats/Arcom"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "a0598340-c4a5-53f0-a810-63e37ec669a5"
	strings:
		$a1 = "CVu3388fnek3W(3ij3fkp0930di"
		$a2 = "ZINGAWI2"
		$a3 = "clWebLightGoldenrodYellow"
		$a4 = "Ancestor for '%s' not found" wide
		$a5 = "Control-C hit" wide
		$a6 = {A3 24 25 21}

	condition:
		all of them
}
YARA Detection Rule: RAT_Bandook
Repository: Neo23x0/signature-base
Detects: Detects Bandook RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/bandook

Pattern signatures:
$a = "aaaaaa1|"
		$b = "aaaaaa2|"
		$c = "aaaaaa3|"
		$d = "aaaaaa4|"
		$e = "aaaaaa5|"
		$f = "%s%d.exe"
		$g = "astalavista"
		$h = "givemecache"
		$i = "%s\\system32\\drivers\\blogs\\*"
		$j = "bndk13me"

Detection condition:
all of them

Full rule:
rule RAT_Bandook
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Bandook RAT"
		reference = "http://malwareconfig.com/stats/bandook"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "79fb99d8-bd56-5986-9917-e119b51b8303"
	strings:
		$a = "aaaaaa1|"
		$b = "aaaaaa2|"
		$c = "aaaaaa3|"
		$d = "aaaaaa4|"
		$e = "aaaaaa5|"
		$f = "%s%d.exe"
		$g = "astalavista"
		$h = "givemecache"
		$i = "%s\\system32\\drivers\\blogs\\*"
		$j = "bndk13me"

	condition:
		all of them
}
YARA Detection Rule: RAT_BlackNix
Repository: Neo23x0/signature-base
Detects: Detects BlackNix RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/BlackNix

Pattern signatures:
$a1 = "SETTINGS" wide
		$a2 = "Mark Adler"
		$a3 = "Random-Number-Here"
		$a4 = "RemoteShell"
		$a5 = "SystemInfo"

Detection condition:
all of them

Full rule:
rule RAT_BlackNix
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects BlackNix RAT"
		reference = "http://malwareconfig.com/stats/BlackNix"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "d7814184-3ae4-53f1-a602-c3fbc02573c3"
	strings:
		$a1 = "SETTINGS" wide
		$a2 = "Mark Adler"
		$a3 = "Random-Number-Here"
		$a4 = "RemoteShell"
		$a5 = "SystemInfo"

	condition:
		all of them
}
YARA Detection Rule: RAT_BlackShades
Repository: Neo23x0/signature-base
Detects: Detects BlackShades RAT
Malware family: blackshades
Author: Brian Wallace (@botnet_hunter)
Reference: http://blog.cylance.com/a-study-in-bots-blackshades-net

Pattern signatures:
$string1 = "bss_server"
		$string2 = "txtChat"
		$string3 = "UDPFlood"

Detection condition:
all of them

Full rule:
rule RAT_BlackShades
{
	meta:
		author = "Brian Wallace (@botnet_hunter)"
		date = "01.04.2014"
		description = "Detects BlackShades RAT"
		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
		family = "blackshades"

		id = "039f9efd-034d-5088-9a2f-7a63ad170d3d"
	strings:
		$string1 = "bss_server"
		$string2 = "txtChat"
		$string3 = "UDPFlood"

	condition:
		all of them
}
YARA Detection Rule: RAT_BlueBanana
Repository: Neo23x0/signature-base
Detects: Detects BlueBanana RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/BlueBanana

Pattern signatures:
$meta = "META-INF"
		$conf = "config.txt"
		$a = "a/a/a/a/f.class"
		$b = "a/a/a/a/l.class"
		$c = "a/a/a/b/q.class"
		$d = "a/a/a/b/v.class"

Detection condition:
all of them

Full rule:
rule RAT_BlueBanana
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects BlueBanana RAT"
		reference = "http://malwareconfig.com/stats/BlueBanana"
		maltype = "Remote Access Trojan"
		filetype = "Java"

		id = "f00c7e92-f34c-5666-a1d9-02ac2cf7608c"
	strings:
		$meta = "META-INF"
		$conf = "config.txt"
		$a = "a/a/a/a/f.class"
		$b = "a/a/a/a/l.class"
		$c = "a/a/a/b/q.class"
		$d = "a/a/a/b/v.class"

	condition:
		all of them
}
YARA Detection Rule: RAT_Bozok
Repository: Neo23x0/signature-base
Detects: Detects Bozok RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Bozok

Pattern signatures:
$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

Detection condition:
all of them

Full rule:
rule RAT_Bozok
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Bozok RAT"
		reference = "http://malwareconfig.com/stats/Bozok"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "b1d22e8c-39aa-52e7-9ca8-2b35bb82f7de"
	strings:
		$a = "getVer" nocase
		$b = "StartVNC" nocase
		$c = "SendCamList" nocase
		$d = "untPlugin" nocase
		$e = "gethostbyname" nocase

	condition:
		all of them
}
YARA Detection Rule: RAT_ClientMesh
Repository: Neo23x0/signature-base
Detects: Detects ClientMesh RAT
Malware family: torct
Author: Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)
Reference: http://malwareconfig.com/stats/ClientMesh

Pattern signatures:
$string1 = "machinedetails"
		$string2 = "MySettings"
		$string3 = "sendftppasswords"
		$string4 = "sendbrowserpasswords"
		$string5 = "arma2keyMass"
		$string6 = "keylogger"

Detection condition:
all of them

Full rule:
rule RAT_ClientMesh
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
		date = "01.06.2014"
		description = "Detects ClientMesh RAT"
		reference = "http://malwareconfig.com/stats/ClientMesh"
		family = "torct"

		id = "351df33e-d3a1-5fe8-be38-edb43bc5d38f"
	strings:
		$string1 = "machinedetails"
		$string2 = "MySettings"
		$string3 = "sendftppasswords"
		$string4 = "sendbrowserpasswords"
		$string5 = "arma2keyMass"
		$string6 = "keylogger"

	condition:
		all of them
}
YARA Detection Rule: RAT_CyberGate
Repository: Neo23x0/signature-base
Detects: Detects CyberGate RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/CyberGate

Pattern signatures:
$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$string3 = "EditSvr"
		$string4 = "TLoader"
		$string5 = "Stroks"
		$string6 = "####@####"
		$res1 = "XX-XX-XX-XX"
		$res2 = "CG-CG-CG-CG"

Detection condition:
all of ($string*) and any of ($res*)

Full rule:
rule RAT_CyberGate
{

	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects CyberGate RAT"
		reference = "http://malwareconfig.com/stats/CyberGate"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "387e7c89-c766-54cf-aac0-3ba03092bc25"
	strings:
		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$string3 = "EditSvr"
		$string4 = "TLoader"
		$string5 = "Stroks"
		$string6 = "####@####"
		$res1 = "XX-XX-XX-XX"
		$res2 = "CG-CG-CG-CG"

	condition:
		all of ($string*) and any of ($res*)
}
YARA Detection Rule: RAT_DarkComet
Repository: Neo23x0/signature-base
Detects: Detects DarkComet RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/DarkComet

Pattern signatures:
// Versions 2x
		$a1 = "#BOT#URLUpdate"
		$a2 = "Command successfully executed!"
		$a3 = "MUTEXNAME" wide
		$a4 = "NETDATA" wide
		// Versions 3x & 4x & 5x
		$b1 = "FastMM Borland Edition"
		$b2 = "%s, ClassID: %s"
		$b3 = "I wasn't able to open the hosts file"
		$b4 = "#BOT#VisitUrl"
		$b5 = "#KCMDDC"

Detection condition:
all of ($a*) or all of ($b*)

Full rule:
rule RAT_DarkComet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects DarkComet RAT"
		reference = "http://malwareconfig.com/stats/DarkComet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "e6fd0269-dd0c-58c0-a1a3-24c2aed916ee"
	strings:
		// Versions 2x
		$a1 = "#BOT#URLUpdate"
		$a2 = "Command successfully executed!"
		$a3 = "MUTEXNAME" wide
		$a4 = "NETDATA" wide
		// Versions 3x & 4x & 5x
		$b1 = "FastMM Borland Edition"
		$b2 = "%s, ClassID: %s"
		$b3 = "I wasn't able to open the hosts file"
		$b4 = "#BOT#VisitUrl"
		$b5 = "#KCMDDC"

	condition:
		all of ($a*) or all of ($b*)
}
YARA Detection Rule: RAT_DarkRAT
Repository: Neo23x0/signature-base
Detects: Detects DarkRAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/DarkRAT

Pattern signatures:
$a = "@1906dark1996coder@"
		$b = "SHEmptyRecycleBinA"
		$c = "mciSendStringA"
		$d = "add_Shutdown"
		$e = "get_SaveMySettingsOnExit"
		$f = "get_SpecialDirectories"
		$g = "Client.My"

Detection condition:
all of them

Full rule:
rule RAT_DarkRAT
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects DarkRAT"
		reference = "http://malwareconfig.com/stats/DarkRAT"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "8283236a-6ed1-5213-8386-a029867b9677"
	strings:
		$a = "@1906dark1996coder@"
		$b = "SHEmptyRecycleBinA"
		$c = "mciSendStringA"
		$d = "add_Shutdown"
		$e = "get_SaveMySettingsOnExit"
		$f = "get_SpecialDirectories"
		$g = "Client.My"

	condition:
		all of them
}