deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Sniffer_analyzer_SSClone_1210_full_version
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
		$s1 = "GetConnectString" fullword ascii
		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3580KB and all of them

Full rule:
rule Sniffer_analyzer_SSClone_1210_full_version {
	meta:
		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
		id = "69dac4bf-483d-5888-a748-1a52cf372066"
	strings:
		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
		$s1 = "GetConnectString" fullword ascii
		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 3580KB and all of them
}
YARA Detection Rule: x64_klock
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file klock.dll
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "klock.dll" fullword ascii
		$s3 = "Erreur : le bureau courant (" wide
		$s4 = "klock de mimikatz pour Windows" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 907KB and all of them

Full rule:
rule x64_klock {
	meta:
		description = "Chinese Hacktool Set - file klock.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
		id = "7065a4fb-c867-5a94-b6bb-5b60085bea15"
	strings:
		$s1 = "Bienvenue dans un processus distant" fullword wide
		$s2 = "klock.dll" fullword ascii
		$s3 = "Erreur : le bureau courant (" wide
		$s4 = "klock de mimikatz pour Windows" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 907KB and all of them
}
YARA Detection Rule: Dos_Down32
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Down32.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s6 = "down.exe" fullword wide
		$s15 = "get_Form1" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 137KB and all of them

Full rule:
rule Dos_Down32 {
	meta:
		description = "Chinese Hacktool Set - file Down32.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
		id = "e56c254d-1238-5786-8e8a-f9122b0310a9"
	strings:
		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s6 = "down.exe" fullword wide
		$s15 = "get_Form1" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 137KB and all of them
}
YARA Detection Rule: MarathonTool_2
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file MarathonTool.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule MarathonTool_2 {
	meta:
		description = "Chinese Hacktool Set - file MarathonTool.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
		id = "20[PII_REDACTED]-58ce-872c-81e74a96597d"
	strings:
		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: scanms_scanms
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file scanms.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
		$s5 = "Internet Explorer 1.0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 3 of them

Full rule:
rule scanms_scanms {
	meta:
		description = "Chinese Hacktool Set - file scanms.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
		id = "50393220-35ae-5d3b-ae3f-5d5eb036c043"
	strings:
		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii /* PEStudio Blacklist: os */
		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
		$s5 = "Internet Explorer 1.0" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 300KB and 3 of them
}
YARA Detection Rule: CN_Tools_PcShare
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file PcShare.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
		$s16 = "%s\\ini\\*.dat" fullword wide
		$s17 = "pcinit.exe" fullword wide
		$s18 = "http://www.pcshare.cn" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them

Full rule:
rule CN_Tools_PcShare {
	meta:
		description = "Chinese Hacktool Set - file PcShare.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
		id = "0c4e9f9b-9839-56a0-be21-a4e9f19cdfdb"
	strings:
		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
		$s16 = "%s\\ini\\*.dat" fullword wide
		$s17 = "pcinit.exe" fullword wide
		$s18 = "http://www.pcshare.cn" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 6000KB and 3 of them
}
YARA Detection Rule: pw_inspector
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file pw-inspector.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
		$s2 = "http://www.thc.org" fullword ascii
		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 460KB and all of them

Full rule:
rule pw_inspector {
	meta:
		description = "Chinese Hacktool Set - file pw-inspector.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
		id = "888db647-c5d0-5b1b-bcd2-512c1ebeadea"
	strings:
		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
		$s2 = "http://www.thc.org" fullword ascii
		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 460KB and all of them
}
YARA Detection Rule: Dll_LoadEx
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file Dll_LoadEx.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "WiNrOOt@126.com" fullword wide
		$s1 = "Dll_LoadEx.EXE" fullword wide
		$s3 = "You Already Loaded This DLL ! :(" ascii
		$s10 = "Dll_LoadEx Microsoft " fullword wide
		$s17 = "Can't Load This Dll ! :(" ascii
		$s18 = "WiNrOOt" fullword wide
		$s20 = " Dll_LoadEx(&A)..." fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 120KB and 3 of them

Full rule:
rule Dll_LoadEx {
	meta:
		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
		id = "51235448-751e-51ce-93f8-da48eddb2b7f"
	strings:
		$s0 = "WiNrOOt@126.com" fullword wide
		$s1 = "Dll_LoadEx.EXE" fullword wide
		$s3 = "You Already Loaded This DLL ! :(" ascii
		$s10 = "Dll_LoadEx Microsoft " fullword wide
		$s17 = "Can't Load This Dll ! :(" ascii
		$s18 = "WiNrOOt" fullword wide
		$s20 = " Dll_LoadEx(&A)..." fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 120KB and 3 of them
}
YARA Detection Rule: dat_report
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file report.dll
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 480KB and all of them

Full rule:
rule dat_report {
	meta:
		description = "Chinese Hacktool Set - file report.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
		id = "c77633a7-0c2f-5efa-b58b-635546bfec95"
	strings:
		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 480KB and all of them
}
YARA Detection Rule: Dos_iis7
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file iis7.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "\\\\localhost" fullword ascii
		$s1 = "iis.run" fullword ascii
		$s3 = ">Could not connecto %s" fullword ascii
		$s5 = "WHOAMI" ascii
		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 140KB and all of them

Full rule:
rule Dos_iis7 {
	meta:
		description = "Chinese Hacktool Set - file iis7.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
	strings:
		$s0 = "\\\\localhost" fullword ascii
		$s1 = "iis.run" fullword ascii
		$s3 = ">Could not connecto %s" fullword ascii
		$s5 = "WHOAMI" ascii
		$s13 = "WinSta0\\Default" fullword ascii  /* Goodware String - occured 22 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 140KB and all of them
}
YARA Detection Rule: SwitchSniffer
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file SwitchSniffer.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "NextSecurity.NET" fullword wide
		$s2 = "SwitchSniffer Setup" fullword wide

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule SwitchSniffer {
	meta:
		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1e[PII_REDACTED]f67dff4417f1f5d18b4ade5cf0cd"
		id = "6019f042-10ab-5899-8b1b-28b2609e9623"
	strings:
		$s0 = "NextSecurity.NET" fullword wide
		$s2 = "SwitchSniffer Setup" fullword wide
	condition:
		uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: dbexpora
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file dbexpora.dll
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
		$s13 = "ORACommand *" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 835KB and all of them

Full rule:
rule dbexpora {
	meta:
		description = "Chinese Hacktool Set - file dbexpora.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "b55b007ef091b2f33f[PII_REDACTED]564625a8c79f"
		id = "43297ce9-60f3-5b69-b7d8-904fffe622fe"
	strings:
		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
		$s13 = "ORACommand *" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 835KB and all of them
}
YARA Detection Rule: SQLCracker
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file SQLCracker.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "msvbvm60.dll" fullword ascii /* reversed goodware string 'lld.06mvbvsm' */
		$s1 = "_CIcos" fullword ascii
		$s2 = "kernel32.dll" fullword ascii
		$s3 = "cKmhV" fullword ascii
		$s4 = "080404B0" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 125KB and all of them

Full rule:
rule SQLCracker {
	meta:
		description = "Chinese Hacktool Set - file SQLCracker.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
		id = "7d7ff2cf-81fb-5a04-a97f-577c306137a9"
	strings:
		$s0 = "msvbvm60.dll" fullword ascii /* reversed goodware string 'lld.06mvbvsm' */
		$s1 = "_CIcos" fullword ascii
		$s2 = "kernel32.dll" fullword ascii
		$s3 = "cKmhV" fullword ascii
		$s4 = "080404B0" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 125KB and all of them
}
YARA Detection Rule: FreeVersion_debug
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file debug.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
		$s1 = "Got WMI process Pid: %d" ascii
		$s2 = "This exploit will execute" ascii
		$s6 = "Found token %s " ascii
		$s7 = "Running reverse shell" ascii
		$s10 = "wmiprvse.exe" fullword ascii
		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 820KB and 3 of them

Full rule:
rule FreeVersion_debug {
	meta:
		description = "Chinese Hacktool Set - file debug.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
		id = "2d69a39a-0da5-56ca-87a5-9116dea6c950"
	strings:
		$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
		$s1 = "Got WMI process Pid: %d" ascii
		$s2 = "This exploit will execute" ascii
		$s6 = "Found token %s " ascii
		$s7 = "Running reverse shell" ascii
		$s10 = "wmiprvse.exe" fullword ascii
		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 820KB and 3 of them
}
YARA Detection Rule: Dos_look
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file look.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
		$s2 = "version=\"9.9.9.9\"" fullword ascii
		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and all of them

Full rule:
rule Dos_look {
	meta:
		description = "Chinese Hacktool Set - file look.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
		id = "910d1469-9173-5a7d-91ea-a50ee921f662"
	strings:
		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
		$s2 = "version=\"9.9.9.9\"" fullword ascii
		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 40KB and all of them
}
YARA Detection Rule: NtGodMode
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file NtGodMode.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "to HOST!" fullword ascii
		$s1 = "SS.EXE" fullword ascii
		$s5 = "lstrlen0" fullword ascii
		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 45KB and all of them

Full rule:
rule NtGodMode {
	meta:
		description = "Chinese Hacktool Set - file NtGodMode.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
		id = "3de620bf-0405-536b-9f6d-3a7f02417b20"
	strings:
		$s0 = "to HOST!" fullword ascii
		$s1 = "SS.EXE" fullword ascii
		$s5 = "lstrlen0" fullword ascii
		$s6 = "Virtual" fullword ascii  /* Goodware String - occured 6 times */
		$s19 = "RtlUnw" fullword ascii /* Goodware String - occured 1 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 45KB and all of them
}
YARA Detection Rule: WebCrack4_RouterPasswordCracking
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them

Full rule:
rule WebCrack4_RouterPasswordCracking {
	meta:
		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
		id = "e3d50ff8-e58d-5c60-9acd-25ba95a21f68"
	strings:
		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
	condition:
		uint16(0) == 0x5a4d and filesize < 5000KB and 2 of them
}
YARA Detection Rule: hscan_gui
Repository: Neo23x0/signature-base
Detects: Chinese Hacktool Set - file hscan-gui.exe
Author: Florian Roth (Nextron Systems)
Reference: http://tools.zjqhr.com/

Pattern signatures:
$s0 = "Hscan.EXE" fullword wide
		$s1 = "RestTool.EXE" fullword ascii
		$s3 = "Hscan Application " fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 550KB and all of them

Full rule:
rule hscan_gui {
	meta:
		description = "Chinese Hacktool Set - file hscan-gui.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "1885f0b7be87f51c304b39bc04b[PII_REDACTED]c69"
		id = "27f9d2e9-0a62-57ca-9061-c32945c59c7e"
	strings:
		$s0 = "Hscan.EXE" fullword wide
		$s1 = "RestTool.EXE" fullword ascii
		$s3 = "Hscan Application " fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 550KB and all of them
}