deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SUSP_AnyDesk_Compromised_Certificate_Jan24_2
Repository: Neo23x0/signature-base
Detects: Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)
Author: Florian Roth
Reference: https://anydesk.com/en/public-statement

Pattern signatures:
$sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
      $s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"

      $f1 = "AnyDesk Software GmbH" wide

Detection condition:
uint16(0) == 0x5a4d
      and filesize < 20000KB
      and all of ($s*)
      and not 1 of ($f*)

Full rule:
rule SUSP_AnyDesk_Compromised_Certificate_Jan24_2 {
   meta:
      description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
      date = "2024-02-02"
      author = "Florian Roth"
      reference = "https://anydesk.com/en/public-statement"
      score = 65
      id = "a41af8d8-ebdf-5a2f-8cf5-abd4587bdfc5"
   strings:
      $sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
      $s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"

      $f1 = "AnyDesk Software GmbH" wide
   condition:
      uint16(0) == 0x5a4d
      and filesize < 20000KB
      and all of ($s*)
      and not 1 of ($f*)
}
YARA Detection Rule: SUSP_AnyDesk_Compromised_Certificate_Jan24_3
Repository: Neo23x0/signature-base
Detects: Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)
Author: Florian Roth
Reference: https://anydesk.com/en/public-statement

Detection condition:
uint16(0) == 0x5a4d and
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and
         // valid after Mon

Full rule:
rule SUSP_AnyDesk_Compromised_Certificate_Jan24_3 {
   meta:
      description = "Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)"
      date = "2024-02-02"
      author = "Florian Roth"
      reference = "https://anydesk.com/en/public-statement"
      score = 75
      id = "9610e61c-25d7-53e8-ba3f-b78b3d108aa3"
   condition:
      uint16(0) == 0x5a4d and
      for any i in (0 .. pe.number_of_signatures) : (
         pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and
         pe.signatures[i].serial == "0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and
         // valid after Monday, January 29, 2024 0:00:00
         (
            pe.signatures[i].not_before >[PII_REDACTED] // certificate validity starts after it was revoked
            or pe.timestamp >[PII_REDACTED] // PE was created after it was revoked
         )
      )
}
YARA Detection Rule: SNOWGLOBE_Babar_Malware
Repository: Neo23x0/signature-base
Detects: Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe
Author: Florian Roth (Nextron Systems)
Reference: http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france

Pattern signatures:
$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
		$z2 = "ExecQueryFailled!" fullword ascii
		$z3 = "NBOT_COMMAND_LINE" fullword
		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword

		$s1 = "/s /n %s \"%s\"" fullword ascii
		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
		$s3 = "/c start /wait " fullword ascii
		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii

		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
		$x2 = "%COMMON_APPDATA%" fullword ascii
		$x4 = "CONOUT$" fullword ascii
		$x5 = "cmd.exe" fullword ascii
		$x6 = "DLLPATH" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1MB and
		(
			( 1 of ($z*) and 1 of ($x*) ) or
			( 3 of ($s*) and 4 of ($x*) )
		)

Full rule:
rule SNOWGLOBE_Babar_Malware {
	meta:
		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
		date = "2015/02/18"
		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
		score = 80
		id = "53a61065-a3b3-563e-8ecc-513d8da68085"
	strings:
		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
		$z2 = "ExecQueryFailled!" fullword ascii
		$z3 = "NBOT_COMMAND_LINE" fullword
		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword

		$s1 = "/s /n %s \"%s\"" fullword ascii
		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
		$s3 = "/c start /wait " fullword ascii
		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii

		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
		$x2 = "%COMMON_APPDATA%" fullword ascii
		$x4 = "CONOUT$" fullword ascii
		$x5 = "cmd.exe" fullword ascii
		$x6 = "DLLPATH" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1MB and
		(
			( 1 of ($z*) and 1 of ($x*) ) or
			( 3 of ($s*) and 4 of ($x*) )
		)
}
YARA Detection Rule: SUSP_Office_Dropper_Strings
Repository: Neo23x0/signature-base
Detects: Detects Office droppers that include a notice to enable active content
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$a1 = "_VBA_PROJECT" wide

      $s1 = "click enable editing" fullword ascii
      $s2 = "click enable content" fullword ascii
      $s3 = "\"Enable Editing\"" fullword ascii
      $s4 = "\"Enable Content\"" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 500KB and $a1 and 1 of ($s*)

Full rule:
rule SUSP_Office_Dropper_Strings {
   meta:
      description = "Detects Office droppers that include a notice to enable active content"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-09-13"
      id = "6560fdf7-46e8-5c16-8263-a36f1dec7868"
   strings:
      $a1 = "_VBA_PROJECT" wide

      $s1 = "click enable editing" fullword ascii
      $s2 = "click enable content" fullword ascii
      $s3 = "\"Enable Editing\"" fullword ascii
      $s4 = "\"Enable Content\"" fullword ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 500KB and $a1 and 1 of ($s*)
}
YARA Detection Rule: SUSP_EnableContent_String_Gen
Repository: Neo23x0/signature-base
Detects: Detects suspicious string that asks to enable active content in Office Doc
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$e1 = "Enable Editing" fullword ascii
      $e2 = "Enable Content" fullword ascii
      $e3 = "Enable editing" fullword ascii
      $e4 = "Enable content" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and (
            $e1 in (0..3000) or
            $e2 in (0..3000) or
            $e3 in (0..3000) or
            $e4 in (0..3000) or
            2 of them
      )

Full rule:
rule SUSP_EnableContent_String_Gen {
   meta:
      description = "Detects suspicious string that asks to enable active content in Office Doc"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-02-12"
      hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
      id = "d763bc21-2925-55df-85e0-1ee857e921ca"
   strings:
      $e1 = "Enable Editing" fullword ascii
      $e2 = "Enable Content" fullword ascii
      $e3 = "Enable editing" fullword ascii
      $e4 = "Enable content" fullword ascii
   condition:
      uint16(0) == 0xcfd0 and (
            $e1 in (0..3000) or
            $e2 in (0..3000) or
            $e3 in (0..3000) or
            $e4 in (0..3000) or
            2 of them
      )
}
YARA Detection Rule: SUSP_WordDoc_VBA_Macro_Strings
Repository: Neo23x0/signature-base
Detects: Detects suspicious strings in Word Doc that indcate malicious use of VBA macros
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$a1 = "\\Microsoft Shared\\" ascii
      $a2 = "\\VBA\\" ascii
      $a3 = "Microsoft Office Word" fullword ascii
      $a4 = "PROJECTwm" fullword wide

      $s1 = "AppData" fullword ascii
      $s2 = "Document_Open" fullword ascii
      $s3 = "Project1" fullword ascii
      $s4 = "CreateObject" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 800KB and all of them

Full rule:
rule SUSP_WordDoc_VBA_Macro_Strings {
   meta:
      description = "Detects suspicious strings in Word Doc that indcate malicious use of VBA macros"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-02-12"
      score = 60
      hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
      id = "210baf6e-ec67-5bc4-ba27-6a6de0c11a73"
   strings:
      $a1 = "\\Microsoft Shared\\" ascii
      $a2 = "\\VBA\\" ascii
      $a3 = "Microsoft Office Word" fullword ascii
      $a4 = "PROJECTwm" fullword wide

      $s1 = "AppData" fullword ascii
      $s2 = "Document_Open" fullword ascii
      $s3 = "Project1" fullword ascii
      $s4 = "CreateObject" fullword ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 800KB and all of them
}
YARA Detection Rule: SUSP_OfficeDoc_VBA_Base64Decode
Repository: Neo23x0/signature-base
Detects: Detects suspicious VBA code with Base64 decode functions
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas

Pattern signatures:
$s1 = "B64_CHAR_DICT" ascii
      $s2 = "Base64Decode" ascii
      $s3 = "Base64Encode" ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 60KB and 2 of them

Full rule:
rule SUSP_OfficeDoc_VBA_Base64Decode {
   meta:
      description = "Detects suspicious VBA code with Base64 decode functions"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
      date = "2019-06-21"
      score = 70
      hash1 = "52262bb315fa55b7441a04966e176b0e26b[PII_REDACTED]e35c80aa60696b6d6fc"
      id = "99690116-fc89-53d7-8f29-575d75d53fc9"
   strings:
      $s1 = "B64_CHAR_DICT" ascii
      $s2 = "Base64Decode" ascii
      $s3 = "Base64Encode" ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 60KB and 2 of them
}
YARA Detection Rule: SUSP_VBA_FileSystem_Access
Repository: Neo23x0/signature-base
Detects: Detects suspicious VBA that writes to disk and is activated on document open
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "\\Common Files\\Microsoft Shared\\" wide
      $s2 = "Scripting.FileSystemObject" ascii

      $a1 = "Document_Open" ascii
      $a2 = "WScript.Shell" ascii
      $a3 = "AutoOpen" fullword ascii

Detection condition:
uint16(0) == 0xcfd0 and filesize < 100KB and all of ($s*) and 1 of ($a*)

Full rule:
rule SUSP_VBA_FileSystem_Access {
   meta:
      description = "Detects suspicious VBA that writes to disk and is activated on document open"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-06-21"
      score = 60
      hash1 = "52262bb315fa55b7441a04966e176b0e26b[PII_REDACTED]e35c80aa60696b6d6fc"
      id = "91241b91-ca3f-5817-bf78-550fe015b467"
   strings:
      $s1 = "\\Common Files\\Microsoft Shared\\" wide
      $s2 = "Scripting.FileSystemObject" ascii

      $a1 = "Document_Open" ascii
      $a2 = "WScript.Shell" ascii
      $a3 = "AutoOpen" fullword ascii
   condition:
      uint16(0) == 0xcfd0 and filesize < 100KB and all of ($s*) and 1 of ($a*)
}
YARA Detection Rule: SUSP_Excel_IQY_RemoteURI_Syntax
Repository: Neo23x0/signature-base
Detects: Detects files with Excel IQY RemoteURI syntax
Author: Nick Carr
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]54897920

Pattern signatures:
$URL = "http"

      $fp1 = "https://go.microsoft.com"

Detection condition:
uint32(0) == 0x0d424557 and uint32(4) == 0x0a0d310a
      and filesize < 1MB
      and $URL
      and not 1 of ($fp*)

Full rule:
rule SUSP_Excel_IQY_RemoteURI_Syntax {
   meta:
      description = "Detects files with Excel IQY RemoteURI syntax"
      author = "Nick Carr"
      reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]54897920"
      date = "2018-08-17"
      modified = "2023-11-25"
      score = 55
      id = "ea3427da-9cce-5ad9-9c78-e3cee802ba80"
   strings:
      $URL = "http"

      $fp1 = "https://go.microsoft.com"
   condition:
      uint32(0) == 0x0d424557 and uint32(4) == 0x0a0d310a
      and filesize < 1MB
      and $URL
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_Macro_Sheet_Obfuscated_Char
Repository: Neo23x0/signature-base
Detects: Finding hidden/very-hidden macros with many CHAR functions
Author: DissectMalware
Reference: https://twitter.com/DissectMalware/status/[PII_REDACTED]05800706

Pattern signatures:
$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}  
      $s1 = "Excel" fullword ascii
      $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
      $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}    
      $char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}

Detection condition:
$ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func > 10 and $s1

Full rule:
rule SUSP_Macro_Sheet_Obfuscated_Char {
   meta:
      description = "Finding hidden/very-hidden macros with many CHAR functions"
      author = "DissectMalware"
      date = "2020-04-07"
      score = 65
      hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
      reference = "https://twitter.com/DissectMalware/status/[PII_REDACTED]05800706"
      id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
   strings:
      $ole_marker = {D0 CF 11 E0 A1 B1 1A E1}  
      $s1 = "Excel" fullword ascii
      $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
      $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}    
      $char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
   condition:
      $ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func > 10 and $s1
}
YARA Detection Rule: MAL_AveMaria_RAT_Jul19
Repository: Neo23x0/signature-base
Detects: Detects AveMaria RAT
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/abuse_ch/status/[PII_REDACTED]61934856

Pattern signatures:
$a1 = "operator co_await" fullword ascii
      $s1 = "uohlyatqn" fullword ascii
      $s2 = "index = [%d][%d][%d][%d]" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and all of them

Full rule:
rule MAL_AveMaria_RAT_Jul19 {
   meta:
      description = "Detects AveMaria RAT"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/abuse_ch/status/[PII_REDACTED]61934856"
      date = "2019-07-01"
      hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b[PII_REDACTED]ddbf2651a59"
      id = "960048cf-7a56-50cf-8498-549f900770d8"
   strings:
      $a1 = "operator co_await" fullword ascii
      $s1 = "uohlyatqn" fullword ascii
      $s2 = "index = [%d][%d][%d][%d]" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and all of them
}
YARA Detection Rule: Ransom_LockerGoga_Mar19_1
Repository: Neo23x0/signature-base
Detects: Detects LockerGoga ransomware binaries
Author: Florian Roth (Nextron Systems)
Reference: https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202

Pattern signatures:
$x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
      $x2 = "|[A-Za-z]:\\cl.log" wide
      $x4 = "\\crypto-locker\\" ascii
      $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
               00 72 00 6F 00 73 00 6F 00 66 00 74 }
      $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
               69 6F 6E }
      $rn1 = "This may lead to the impossibility of recovery of the certain files." wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and 1 of ($x*) ) or $rn1

Full rule:
rule Ransom_LockerGoga_Mar19_1 {
   meta:
      description = "Detects LockerGoga ransomware binaries"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
      date = "2019-03-19"
      hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
      hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
      hash3 = "bdf[PII_REDACTED]3f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
      id = "ba5836b9-bc47-54d4-8f7a-475ba0feaac6"
   strings:
      $x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
      $x2 = "|[A-Za-z]:\\cl.log" wide
      $x4 = "\\crypto-locker\\" ascii
      $xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
               00 72 00 6F 00 73 00 6F 00 66 00 74 }
      $xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
               69 6F 6E }
      $rn1 = "This may lead to the impossibility of recovery of the certain files." wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and 1 of ($x*) ) or $rn1
}
YARA Detection Rule: HKTL_Nim_NimPackt
Repository: Neo23x0/signature-base
Detects: Detects binaries generated with NimPackt v1
Author: Cas van Cooten
Reference: https://github.com/chvancooten/NimPackt-v1

Pattern signatures:
$nim1 = "fatal.nim" ascii fullword
        $nim2 = "winim" ascii
        $np1 = { 4E 69 6D 50 61 63 6B 74 }
        $sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
        $sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
        $sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }

Detection condition:
uint16(0) == 0x5A4D and
        filesize < 750KB and
        1 of ($nim*) and (
            $np1 or 2 of ($sus*)
        )

Full rule:
rule HKTL_Nim_NimPackt : EXE FILE HKTL {
    meta:
        description = "Detects binaries generated with NimPackt v1"
        author = "Cas van Cooten"
        reference = "https://github.com/chvancooten/NimPackt-v1"
        date = "2022-01-26"
        score = 80
        id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
    strings:
        $nim1 = "fatal.nim" ascii fullword
        $nim2 = "winim" ascii
        $np1 = { 4E 69 6D 50 61 63 6B 74 }
        $sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
        $sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
        $sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
    condition:
        uint16(0) == 0x5A4D and
        filesize < 750KB and
        1 of ($nim*) and (
            $np1 or 2 of ($sus*)
        )
}
YARA Detection Rule: APT_MAL_Win_BlueLight
Repository: Neo23x0/signature-base
Detects: The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications.
Author: threatintel@volexity.com
Reference: https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/

Pattern signatures:
$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
        $pdb2 = "Release\\bluelight.pdb"

        $msg0 = "https://ipinfo.io" fullword
        $msg1 = "country" fullword
        $msg5 = "\"UserName\":\"" fullword
        $msg7 = "\"ComName\":\"" fullword
        $msg8 = "\"OS\":\"" fullword
        $msg9 = "\"OnlineIP\":\"" fullword
        $msg10 = "\"LocalIP\":\"" fullword
        $msg11 = "\"Time\":\"" fullword
        $msg12 = "\"Compiled\":\"" fullword
        $msg13 = "\"Process Level\":\"" fullword
        $msg14 = "\"AntiVirus\":\"" fullword
        $msg15 = "\"VM\":\"" fullword

Detection condition:
any of ($pdb*) or 
        all of ($msg*)

Full rule:
rule APT_MAL_Win_BlueLight : InkySquid {
    meta:
        author = "threatintel@volexity.com"
        date = "2021-04-23"
        description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
        hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
        hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
        license = "See license at https://github.com/volexity/threat-intel/LICENSE.txt"
        reference = "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
        id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
    strings:
        $pdb1 = "\\Development\\BACKDOOR\\ncov\\"
        $pdb2 = "Release\\bluelight.pdb"

        $msg0 = "https://ipinfo.io" fullword
        $msg1 = "country" fullword
        $msg5 = "\"UserName\":\"" fullword
        $msg7 = "\"ComName\":\"" fullword
        $msg8 = "\"OS\":\"" fullword
        $msg9 = "\"OnlineIP\":\"" fullword
        $msg10 = "\"LocalIP\":\"" fullword
        $msg11 = "\"Time\":\"" fullword
        $msg12 = "\"Compiled\":\"" fullword
        $msg13 = "\"Process Level\":\"" fullword
        $msg14 = "\"AntiVirus\":\"" fullword
        $msg15 = "\"VM\":\"" fullword

    condition:
        any of ($pdb*) or 
        all of ($msg*) 
}