deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: IronTiger_Ring_Gh0stvariant
Repository: Yara-Rules/rules
Detects: Iron Tiger Malware - Ring Gh0stvariant
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "RING RAT Exception" nocase wide ascii
        $str2 = "(can not update server recently)!" nocase wide ascii
        $str4 = "CreaetProcess Error" nocase wide ascii
        $bla1 = "Sucess!" nocase wide ascii
        $bla2 = "user canceled!" nocase wide ascii

Detection condition:
uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))

Full rule:
rule IronTiger_Ring_Gh0stvariant
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Malware - Ring Gh0stvariant"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "RING RAT Exception" nocase wide ascii
        $str2 = "(can not update server recently)!" nocase wide ascii
        $str4 = "CreaetProcess Error" nocase wide ascii
        $bla1 = "Sucess!" nocase wide ascii
        $bla2 = "user canceled!" nocase wide ascii
  
    condition:
        uint16(0) == 0x5a4d and ((any of ($str*)) or (all of ($bla*)))
}
YARA Detection Rule: IronTiger_wmiexec
Repository: Yara-Rules/rules
Detects: Iron Tiger Tool - wmi.vbs detection
Author: Cyber Safety Solutions, Trend Micro
Reference: http://goo.gl/T5fSJC

Pattern signatures:
$str1 = "Temp Result File , Change it to where you like" nocase wide ascii
        $str2 = "wmiexec" nocase wide ascii
        $str3 = "By. Twi1ight" nocase wide ascii
        $str4 = "[both mode] ,delay TIME to read result" nocase wide ascii
        $str5 = "such as nc.exe or Trojan" nocase wide ascii
        $str6 = "+++shell mode+++" nocase wide ascii
        $str7 = "win2008 fso has no privilege to delete file" nocase wide ascii

Detection condition:
2 of ($str*)

Full rule:
rule IronTiger_wmiexec
{
  
    meta:
        author = "Cyber Safety Solutions, Trend Micro"
        description = "Iron Tiger Tool - wmi.vbs detection"
        reference = "http://goo.gl/T5fSJC"
  
    strings:
        $str1 = "Temp Result File , Change it to where you like" nocase wide ascii
        $str2 = "wmiexec" nocase wide ascii
        $str3 = "By. Twi1ight" nocase wide ascii
        $str4 = "[both mode] ,delay TIME to read result" nocase wide ascii
        $str5 = "such as nc.exe or Trojan" nocase wide ascii
        $str6 = "+++shell mode+++" nocase wide ascii
        $str7 = "win2008 fso has no privilege to delete file" nocase wide ascii
  
    condition:
        2 of ($str*)
}
YARA Detection Rule: IronPanda_DNSTunClient
Repository: Yara-Rules/rules
Detects: Iron Panda malware DnsTunClient - file named.exe
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
        $s2 = "dnstunclient -ip <server ip address>" fullword ascii
        $s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
        $s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
        $s5 = "taskkill /im conime.exe" fullword ascii
        $s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
        $s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
        $s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
        $s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
        $s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
        $s11 = "try to add many same pipe to select group(or mark is too easy)

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) or 5 of them

Full rule:
rule IronPanda_DNSTunClient 
{

    meta:
        description = "Iron Panda malware DnsTunClient - file named.exe"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        score = 80
        hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"

    strings:
        $s1 = "dnstunclient -d or -domain <domain>" fullword ascii
        $s2 = "dnstunclient -ip <server ip address>" fullword ascii
        $s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
        $s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
        $s5 = "taskkill /im conime.exe" fullword ascii
        $s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" fullword ascii
        $s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
        $s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
        $s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
        $s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
        $s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 400KB and 2 of them ) or 5 of them
}
YARA Detection Rule: IronPanda_Malware1
Repository: Yara-Rules/rules
Detects: Iron Panda Malware
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$x1 = "activedsimp.dll" fullword wide
        $s1 = "get_BadLoginAddress" fullword ascii
        $s2 = "get_LastFailedLogin" fullword ascii
        $s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
        $s4 = "get_PasswordExpirationDate" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule IronPanda_Malware1 
{

    meta:
        description = "Iron Panda Malware"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"

    strings:
        $x1 = "activedsimp.dll" fullword wide
        $s1 = "get_BadLoginAddress" fullword ascii
        $s2 = "get_LastFailedLogin" fullword ascii
        $s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
        $s4 = "get_PasswordExpirationDate" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: IronPanda_Webshell_JSP
Repository: Yara-Rules/rules
Detects: Iron Panda Malware JSP
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
        $s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
        $s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii

Detection condition:
filesize < 330KB and 1 of them

Full rule:
rule IronPanda_Webshell_JSP 
{

    meta:
        description = "Iron Panda Malware JSP"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
  
    strings:
        $s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
        $s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
        $s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
  
    condition:
        filesize < 330KB and 1 of them
}
YARA Detection Rule: IronPanda_Malware_Htran
Repository: Yara-Rules/rules
Detects: Iron Panda Malware Htran
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
        $s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
        $s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s4 = "[-] ERROR: Must supply logfile name." fullword ascii
        $s5 = "[SERVER]connection to %s:%d error" fullword ascii
        $s6 = "[+] Make a Connection to %s:%d...." fullword ascii
        $s7 = "[+] Waiting another Client on port:%d...." fullword ascii
        $s8 = "[+] Accept a Client on port %d from %s" fullword ascii
        $s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
        $s10 = "cmshared_get_ptr_from_atom" fullword ascii
        $s11 = "_cmshared_get_ptr_from_atom" fullword ascii
        $s12 = "[+] OK! I Closed The Two Socket." fullword ascii
        $s13 = "[-] TransmitPort invalid." fullword ascii
        $s14 = "[+] Waiting for Client on port:%d ......" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) or 5 of them

Full rule:
rule IronPanda_Malware_Htran 
{

    meta:
        description = "Iron Panda Malware Htran"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
   
    strings:
        $s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
        $s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
        $s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s4 = "[-] ERROR: Must supply logfile name." fullword ascii
        $s5 = "[SERVER]connection to %s:%d error" fullword ascii
        $s6 = "[+] Make a Connection to %s:%d...." fullword ascii
        $s7 = "[+] Waiting another Client on port:%d...." fullword ascii
        $s8 = "[+] Accept a Client on port %d from %s" fullword ascii
        $s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
        $s10 = "cmshared_get_ptr_from_atom" fullword ascii
        $s11 = "_cmshared_get_ptr_from_atom" fullword ascii
        $s12 = "[+] OK! I Closed The Two Socket." fullword ascii
        $s13 = "[-] TransmitPort invalid." fullword ascii
        $s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
   
    condition:
         ( uint16(0) == 0x5a4d and filesize < 125KB and 3 of them ) or 5 of them
}
YARA Detection Rule: IronPanda_Malware2
Repository: Yara-Rules/rules
Detects: Iron Panda Malware
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "\\setup.exe" fullword ascii
        $s1 = "msi.dll.urlUT" fullword ascii
        $s2 = "msi.dllUT" fullword ascii
        $s3 = "setup.exeUT" fullword ascii
        $s4 = "/c del /q %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 180KB and all of them

Full rule:
rule IronPanda_Malware2 
{

    meta:
        description = "Iron Panda Malware"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "a89c21dd608c51c4bf0323d640f816e[PII_REDACTED]89f9edcf04cd34090decc91"

    strings:
        $s0 = "\\setup.exe" fullword ascii
        $s1 = "msi.dll.urlUT" fullword ascii
        $s2 = "msi.dllUT" fullword ascii
        $s3 = "setup.exeUT" fullword ascii
        $s4 = "/c del /q %s" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 180KB and all of them
}
YARA Detection Rule: IronPanda_Malware3
Repository: Yara-Rules/rules
Detects: Iron Panda Malware
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "PluginDeflater.exe" fullword wide
        $s1 = ".Deflated" fullword wide
        $s2 = "PluginDeflater" fullword ascii
        $s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
        $s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
        $s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 10KB and all of them

Full rule:
rule IronPanda_Malware3 
{

    meta:
        description = "Iron Panda Malware"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"

    strings:
        $s0 = "PluginDeflater.exe" fullword wide
        $s1 = ".Deflated" fullword wide
        $s2 = "PluginDeflater" fullword ascii
        $s3 = "DeflateStream" fullword ascii /* Goodware String - occured 1 times */
        $s4 = "CompressionMode" fullword ascii /* Goodware String - occured 4 times */
        $s5 = "System.IO.Compression" fullword ascii /* Goodware String - occured 6 times */

    condition:
        uint16(0) == 0x5a4d and filesize < 10KB and all of them
}
YARA Detection Rule: IronPanda_Malware4
Repository: Yara-Rules/rules
Detects: Iron Panda Malware
Author: Florian Roth
Reference: https://goo.gl/E4qia9

Pattern signatures:
$s0 = "TestPlugin.dll" fullword wide
        $s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
        $s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
        $s6 = "TestPlugin" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 10KB and all of them

Full rule:
rule IronPanda_Malware4 
{

    meta:
        description = "Iron Panda Malware"
        author = "Florian Roth"
        reference = "https://goo.gl/E4qia9"
        date = "2015-09-16"
        hash = "0d6da[PII_REDACTED]16f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"

    strings:
        $s0 = "TestPlugin.dll" fullword wide
        $s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
        $s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
        $s6 = "TestPlugin" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 10KB and all of them
}
YARA Detection Rule: Shifu_Banking_Trojan_0
Repository: Yara-Rules/rules
Detects: Detects Shifu Banking Trojan
Author: Florian Roth
Reference: https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/

Pattern signatures:
$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii

		$s1 = "listen above" fullword wide
		$s2 = "familycould cost" fullword wide
		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))

Full rule:
rule Shifu_Banking_Trojan_0 : banking {
	meta:
		description = "Detects Shifu Banking Trojan"
		author = "Florian Roth"
		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
		date = "2015-09-01"
		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
	strings:
		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii

		$s1 = "listen above" fullword wide
		$s2 = "familycould cost" fullword wide
		$s3 = "SetSystemTimeAdjustment" fullword ascii /* Goodware String - occured 33 times */
		$s4 = "PeekNamedPipe" fullword ascii /* Goodware String - occured 347 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and ($x1 or all of ($s*))
}
YARA Detection Rule: SHIFU_Banking_Trojan_1
Repository: Yara-Rules/rules
Detects: Detects SHIFU Banking Trojan
Author: Florian Roth
Reference: http://goo.gl/52n8WE

Pattern signatures:
$x1 = "\\Gather\\Dividerail.pdb" ascii

		$s0 = "\\payload\\payload.x86.pdb" ascii
		$s1 = "USER_PRIV_GUEST" fullword wide
		$s2 = "USER_PRIV_ADMIN" fullword wide
		$s3 = "USER_PRIV_USER" fullword wide
		$s4 = "PPSWVPP" fullword ascii
		$s5 = "WinSCard.dll" fullword ascii /* Goodware String - occured 83 times */

Detection condition:
uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))

Full rule:
rule SHIFU_Banking_Trojan_1 : banking {
	meta:
		description = "Detects SHIFU Banking Trojan"
		author = "Florian Roth"
		reference = "http://goo.gl/52n8WE"
		date = "2015-10-31"
		score = 70
		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a[PII_REDACTED]7f710a47ce06afb36d"
	strings:
		$x1 = "\\Gather\\Dividerail.pdb" ascii

		$s0 = "\\payload\\payload.x86.pdb" ascii
		$s1 = "USER_PRIV_GUEST" fullword wide
		$s2 = "USER_PRIV_ADMIN" fullword wide
		$s3 = "USER_PRIV_USER" fullword wide
		$s4 = "PPSWVPP" fullword ascii
		$s5 = "WinSCard.dll" fullword ascii /* Goodware String - occured 83 times */
	condition:
		uint16(0) == 0x5a4d and ($x1 or 5 of ($s*))
}
YARA Detection Rule: Shifu
Repository: Yara-Rules/rules
Author: McAfee Labs
Reference: https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/

Pattern signatures:
$b = "RegCreateKeyA"
		$a = "CryptCreateHash"
		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}

Detection condition:
all of them

Full rule:
rule Shifu : banking {
	meta:
		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
		author = "McAfee Labs"
	strings:
		$b = "RegCreateKeyA"
		$a = "CryptCreateHash"
		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
	condition:
		all of them
}
YARA Detection Rule: jeff_dev_ransomware
Repository: Yara-Rules/rules
Detects: Rule to detect Jeff DEV Ransomware
Author: Marc Rivero | @seifreed
Reference: https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/

Pattern signatures:
$s1 = "C:\\Users\\Umut\\Desktop\\takemeon" fullword wide
      $s2 = "C:\\Users\\Umut\\Desktop\\" fullword ascii
      $s3 = "PRESS HERE TO STOP THIS CREEPY SOUND AND VIEW WHAT HAPPENED TO YOUR COMPUTER" fullword wide
      $s4 = "WHAT YOU DO TO MY COMPUTER??!??!!!" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 5000KB ) and all of them

Full rule:
rule jeff_dev_ransomware {

   meta:
   
      description = "Rule to detect Jeff DEV Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
      
   strings:

      $s1 = "C:\\Users\\Umut\\Desktop\\takemeon" fullword wide
      $s2 = "C:\\Users\\Umut\\Desktop\\" fullword ascii
      $s3 = "PRESS HERE TO STOP THIS CREEPY SOUND AND VIEW WHAT HAPPENED TO YOUR COMPUTER" fullword wide
      $s4 = "WHAT YOU DO TO MY COMPUTER??!??!!!" fullword wide

   condition:

      ( uint16(0) == 0x5a4d and filesize < 5000KB ) and all of them
}
YARA Detection Rule: Trj_Elex_Installer_NSIS
Repository: Yara-Rules/rules
Detects: Elex Installer NSIS
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = {4e 75 6c 6c 73 6f 66 74 }
        $str2 = {b7 a2 d5 dc 0c d6 a6 3a}

Detection condition:
($mz at 0) and ($str1 at 0xA008) and ($str2 at 0x1c8700)

Full rule:
rule Trj_Elex_Installer_NSIS 
{
   
    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Installer NSIS"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = {4e 75 6c 6c 73 6f 66 74 }
        $str2 = {b7 a2 d5 dc 0c d6 a6 3a}
        
    condition:
        ($mz at 0) and ($str1 at 0xA008) and ($str2 at 0x1c8700)
}
YARA Detection Rule: Trj_Elex_Installer
Repository: Yara-Rules/rules
Detects: Elex Installer
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = {65 00 76 00 65 00 72 00 79 00 74 00 68 00 69 00 6e 00 67 00}
        $str2 = "IsWow64Process"
        $str3 = "SSFK"

Detection condition:
($mz at 0) and ($str1) and ($str2) and ($str3)

Full rule:
rule Trj_Elex_Installer 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Installer"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = {65 00 76 00 65 00 72 00 79 00 74 00 68 00 69 00 6e 00 67 00}
        $str2 = "IsWow64Process"
        $str3 = "SSFK"
        
    condition:
        ($mz at 0) and ($str1) and ($str2) and ($str3)
}
YARA Detection Rule: Trj_Elex_Service32
Repository: Yara-Rules/rules
Detects: Elex Service 32 bits
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"

Detection condition:
(pe.machine == pe.MACHINE_I386) and ($mz at 0) and ($str1) and ($str2) and ($str3)

Full rule:
rule Trj_Elex_Service32 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Service 32 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"
        
    condition:
        (pe.machine == pe.MACHINE_I386) and ($mz at 0) and ($str1) and ($str2) and ($str3)
}
YARA Detection Rule: Trj_Elex_Service64
Repository: Yara-Rules/rules
Detects: Elex Service 64 bits
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"

Detection condition:
(pe.machine == pe.MACHINE_AMD64) and ($mz at 0) and ($str1) and ($str2) and ($str3)

Full rule:
rule Trj_Elex_Service64 
{
    
    meta:
        author = "Centro Criptológico Nacional (CCN)"
        description = "Elex Service 64 bits"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        
    strings:
        $mz = { 4d 5a }
        $str1 = "http://xa.xingcloud.com/v4/sof-everything/"
        $str2 = "http://www.mysearch123.com"
        $str3 = "21e223b3f0c97db3c281da1g7zccaefozzjcktmlma"
        
    condition:
        (pe.machine == pe.MACHINE_AMD64) and ($mz at 0) and ($str1) and ($str2) and ($str3)
}