deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Duqu2_Generic1
Repository: Yara-Rules/rules
Detects: Kaspersky APT Report - Duqu2 Sample - Generic Rule
Author: Florian Roth
Reference: https://goo.gl/7yKyOj

Pattern signatures:
$s0 = "Global\\{B54E3268-DE1E-4c1e-A[PII_REDACTED]403AD}" fullword wide
		$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
		$s2 = "msisvc_32@" fullword wide
		$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
		$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 150KB and all of them

Full rule:
rule Duqu2_Generic1 
{

    meta:
		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
		author = "Florian Roth"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		super_rule = 1
		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
		hash7 = "32f8689fd18c[PII_REDACTED]18817edec6239b18f3"
		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
		hash11 = "dfe1cb775719b529138e054e[PII_REDACTED]db00b1"
	
    strings:
		$s0 = "Global\\{B54E3268-DE1E-4c1e-A[PII_REDACTED]403AD}" fullword wide
		$s1 = "SetSecurityDescriptorSacl" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 189 times */
		$s2 = "msisvc_32@" fullword wide
		$s3 = "CompareStringA" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1392 times */
		$s4 = "GetCommandLineW" fullword ascii /* PEStudio Blacklist: strings */ /* Goodware String - occured 1680 times */
	
    condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}
YARA Detection Rule: APT_Kaspersky_Duqu2_procexp
Repository: Yara-Rules/rules
Detects: Kaspersky APT Report - Duqu2 Sample - Malicious MSI
Author: Florian Roth
Reference: https://goo.gl/7yKyOj

Pattern signatures:
$x1 = "svcmsi_32.dll" fullword wide
		$x2 = "msi3_32.dll" fullword wide
		$x3 = "msi4_32.dll" fullword wide
		$x4 = "MSI.dll" fullword ascii
		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )

Full rule:
rule APT_Kaspersky_Duqu2_procexp 
{

    meta:
		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
		author = "Florian Roth"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash1 = "[PII_REDACTED]066b6bcecb045ddd4f1fbc9486667a"
		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
	
    strings:
		$x1 = "svcmsi_32.dll" fullword wide
		$x2 = "msi3_32.dll" fullword wide
		$x3 = "msi4_32.dll" fullword wide
		$x4 = "MSI.dll" fullword ascii
		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "Sysinternals installer" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "Process Explorer" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 5 times */
	
    condition:
		uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of ($x*) ) and ( all of ($s*) )
}
YARA Detection Rule: APT_Kaspersky_Duqu2_SamsungPrint
Repository: Yara-Rules/rules
Detects: Kaspersky APT Report - Duqu2 Sample - file 2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69
Author: Florian Roth
Reference: https://goo.gl/7yKyOj

Pattern signatures:
$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "msi4_32.dll" fullword wide
		$s2 = "HASHVAL" fullword wide
		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
		$s4 = "ca.dll" fullword ascii
		$s5 = "Samsung Electronics Co., Ltd." fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 82KB and all of them

Full rule:
rule APT_Kaspersky_Duqu2_SamsungPrint 
{

    meta:
		description = "Kaspersky APT Report - Duqu2 Sample - file 2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
		author = "Florian Roth"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
	
    strings:
		$s0 = "Installer for printer drivers and applications" fullword wide /* PEStudio Blacklist: strings */
		$s1 = "msi4_32.dll" fullword wide
		$s2 = "HASHVAL" fullword wide
		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
		$s4 = "ca.dll" fullword ascii
		$s5 = "Samsung Electronics Co., Ltd." fullword wide
	
    condition:
		uint16(0) == 0x5a4d and filesize < 82KB and all of them
}
YARA Detection Rule: APT_Kaspersky_Duqu2_msi3_32
Repository: Yara-Rules/rules
Detects: Kaspersky APT Report - Duqu2 Sample - file d8a849654ab97debaf28ae5b749c3b1ff1812ea[PII_REDACTED]3333db48c3972c3
Author: Florian Roth
Reference: https://goo.gl/7yKyOj

Pattern signatures:
$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s4 = "msi3_32.dll" fullword wide
		$s5 = "RunDLL" fullword ascii
		$s6 = "MSI Custom Action v3" fullword wide
		$s7 = "msi3_32" fullword wide
		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 72KB and all of them

Full rule:
rule APT_Kaspersky_Duqu2_msi3_32 
{

    meta:
		description = "Kaspersky APT Report - Duqu2 Sample - file d8a849654ab97debaf28ae5b749c3b1ff1812ea[PII_REDACTED]3333db48c3972c3"
		author = "Florian Roth"
		reference = "https://goo.gl/7yKyOj"
		date = "2015-06-10"
		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
	
    strings:
		$s0 = "ProcessUserAccounts" fullword ascii /* PEStudio Blacklist: strings */
		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide /* PEStudio Blacklist: strings */
		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
		$s4 = "msi3_32.dll" fullword wide
		$s5 = "RunDLL" fullword ascii
		$s6 = "MSI Custom Action v3" fullword wide
		$s7 = "msi3_32" fullword wide
		$s8 = "Operating System" fullword wide /* PEStudio Blacklist: strings */ /* Goodware String - occured 9203 times */
	
    condition:
		uint16(0) == 0x5a4d and filesize < 72KB and all of them
}
YARA Detection Rule: RAT_Orcus
Repository: Yara-Rules/rules
Author:  J from THL <j@techhelplist.com> with thx to MalwareHunterTeam
Reference: https://virustotal.com/en/file/0ef[PII_REDACTED]42c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/

Pattern signatures:
$text01 = "Orcus.CommandManagement"
        $text02 = "Orcus.Commands."
        $text03 = "Orcus.Config."
        $text04 = "Orcus.Connection."
        $text05 = "Orcus.Core."
        $text06 = "Orcus.exe"
        $text07 = "Orcus.Extensions."
        $text08 = "Orcus.InstallationPromptForm"
        $text09 = "Orcus.MainForm."
        $text10 = "Orcus.Native."
        $text11 = "Orcus.Plugins."
        $text12 = "orcus.plugins.dll"
        $text13 = "Orcus.Properties."
        $text14 = "Orcus.Protection."
        $text15 = "Orcus.Share."
        $text16 = "Orcus.Shared"
        $text17 = "Orcus.StaticCommands"
        $text18 = "Orcus.Utilities."
        $text19 = "\\Projects\\Orcus\\Source\\Orcus."
        $text20 = ".orcus.plugins.dll.zip"
        $text21 = ".orcus.shared.dll.zip"
        $text22 = ".orcus.shared.utilities.dll.zip"
        $text23 = ".orcus.staticcommands.dll.zip"
        $text24 = "HvncCommunication"
        $text25 = "HvncAction"
        $text26 = "hvncDesktop"
  

Detection condition:
13 of them

Full rule:
rule RAT_Orcus 
{

    meta:
        author = " J from THL <j@techhelplist.com> with thx to MalwareHunterTeam"
        date = "2017/01"
        reference = "https://virustotal.com/en/file/0ef[PII_REDACTED]42c184303f2d6fbead054200e9c223e5cfc4777cda03006e317/analysis/"
        version = 1
        maltype = "RAT"
        filetype = "memory"

    strings:
        $text01 = "Orcus.CommandManagement"
        $text02 = "Orcus.Commands."
        $text03 = "Orcus.Config."
        $text04 = "Orcus.Connection."
        $text05 = "Orcus.Core."
        $text06 = "Orcus.exe"
        $text07 = "Orcus.Extensions."
        $text08 = "Orcus.InstallationPromptForm"
        $text09 = "Orcus.MainForm."
        $text10 = "Orcus.Native."
        $text11 = "Orcus.Plugins."
        $text12 = "orcus.plugins.dll"
        $text13 = "Orcus.Properties."
        $text14 = "Orcus.Protection."
        $text15 = "Orcus.Share."
        $text16 = "Orcus.Shared"
        $text17 = "Orcus.StaticCommands"
        $text18 = "Orcus.Utilities."
        $text19 = "\\Projects\\Orcus\\Source\\Orcus."
        $text20 = ".orcus.plugins.dll.zip"
        $text21 = ".orcus.shared.dll.zip"
        $text22 = ".orcus.shared.utilities.dll.zip"
        $text23 = ".orcus.staticcommands.dll.zip"
        $text24 = "HvncCommunication"
        $text25 = "HvncAction"
        $text26 = "hvncDesktop"
        $text27 = ".InstallationPromptForm"
        $text28 = "RequestKeyLogCommand"
        $text29 = "get_KeyLogFile"
        $text30 = "LiveKeyloggerCommand"
        $text31 = "ORCUS.STATICCOMMANDS, VERSION="
        $text32 = "PrepareOrcusFileToRemove"
        $text33 = "ConvertFromOrcusValueKind"

    condition:
        13 of them
}
YARA Detection Rule: Unit78020_Malware_1
Repository: Yara-Rules/rules
Detects: Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe
Author: Florian Roth
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
        $s2 = "msictl.exe" fullword ascii
        $s3 = "127.0.0.1:8080" fullword ascii
        $s4 = "mshtml.dat" fullword ascii
        $s5 = "msisvc" fullword ascii
        $s6 = "NOKIAN95/WEB" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 160KB and 4 of them

Full rule:
rule Unit78020_Malware_1  
{

    meta:
        description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
        author = "Florian Roth"
        reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
        date = "2015-09-24"
        hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
   
    strings:
        $s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
        $s2 = "msictl.exe" fullword ascii
        $s3 = "127.0.0.1:8080" fullword ascii
        $s4 = "mshtml.dat" fullword ascii
        $s5 = "msisvc" fullword ascii
        $s6 = "NOKIAN95/WEB" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 160KB and 4 of them
}
YARA Detection Rule: Unit78020_Malware_Gen2
Repository: Yara-Rules/rules
Detects: Detects malware by Chinese APT PLA Unit 78020 - Generic Rule
Author: Florian Roth
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$s0 = "-GetModuleFileNameExW" fullword ascii
        $s1 = "\\MSN Talk Start.lnk" fullword wide
        $s2 = ":SeDebugPrivilege" fullword wide
        $s3 = "WinMM Version 1.0" fullword wide
        $s4 = "dwError1 = %d" fullword ascii
        $s5 = "*Can't Get" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule Unit78020_Malware_Gen2 
{

    meta:
        description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
        author = "Florian Roth"
        reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
        date = "2015-09-24"
        super_rule = 1
        hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
        hash2 = "7b73bf2d80a03eb[PII_REDACTED]28da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
        hash3 = "981e2fa1ae[PII_REDACTED]b46e8b53cc5da37dd[PII_REDACTED]761bd91572f025e8a"
  
   strings:
        $s0 = "-GetModuleFileNameExW" fullword ascii
        $s1 = "\\MSN Talk Start.lnk" fullword wide
        $s2 = ":SeDebugPrivilege" fullword wide
        $s3 = "WinMM Version 1.0" fullword wide
        $s4 = "dwError1 = %d" fullword ascii
        $s5 = "*Can't Get" fullword wide
   
    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: Unit78020_Malware_Gen3
Repository: Yara-Rules/rules
Detects: Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong
Author: Florian Roth
Reference: http://threatconnect.com/camerashy/?utm_campaign=CameraShy

Pattern signatures:
$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
        $x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
        $x3 = "J:\\chong\\" ascii
        $s1 = "User-Agent: Netscape" fullword ascii
        $s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
        $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
        $s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
        $s5 = "MM.exe" fullword ascii
        $s6 = "network.proxy.ssl" fullword wide
        $s7 = "PeekNamePipe" fullword ascii
        $s8 = "Host: %ws:%d" fullword ascii
        $s9 = "GET %dHTTP/1.1" fullword ascii
        $s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 4 of ($s*)

Full rule:
rule Unit78020_Malware_Gen3 
{

    meta:
        description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
        author = "Florian Roth"
        reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
        date = "2015-09-24"
        super_rule = 1
        hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
        hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
   
    strings:
        $x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
        $x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
        $x3 = "J:\\chong\\" ascii
        $s1 = "User-Agent: Netscape" fullword ascii
        $s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
        $s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
        $s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
        $s5 = "MM.exe" fullword ascii
        $s6 = "network.proxy.ssl" fullword wide
        $s7 = "PeekNamePipe" fullword ascii
        $s8 = "Host: %ws:%d" fullword ascii
        $s9 = "GET %dHTTP/1.1" fullword ascii
        $s10 = "SCHANNEL.DLL" fullword ascii /* Goodware String - occured 6 times */
    
    condition:
        ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of ($x*) ) or 4 of ($s*)
}
YARA Detection Rule: malware_red_leaves_generic
Repository: Yara-Rules/rules
Detects: Red Leaves malware, related to APT10
Author: David Cannings

Pattern signatures:
// MiniLZO release date
    $ = "Feb 04 2015"
    $ = "I can not start %s"
    $ = "dwConnectPort" fullword
    $ = "dwRemoteLanPort" fullword
    $ = "strRemoteLanAddress" fullword
    $ = "strLocalConnectIp" fullword
    $ = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
    $ = "RedLeavesCMDSimulatorMutex" wide
    $ = "(NT %d.%d Build %d)" wide
    $ = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
    $ = "red_autumnal_leaves_dllmain.dll" wide ascii
    $ = "__data" wide
    $ = "__serial" wide
    $ = "__upt" wide
    $ = "__msgid" wide

Detection condition:
7 of them

Full rule:
rule malware_red_leaves_generic {
  meta:
    author = "David Cannings"
    description = "Red Leaves malware, related to APT10"
    
    // This hash from VT retrohunt, original sample was a memory dump
    sha256 = "2e1f902de32b999642bb09e995082c37a024f320c683848edadaf2db8e322c3c"
    
  strings:
    // MiniLZO release date
    $ = "Feb 04 2015"
    $ = "I can not start %s"
    $ = "dwConnectPort" fullword
    $ = "dwRemoteLanPort" fullword
    $ = "strRemoteLanAddress" fullword
    $ = "strLocalConnectIp" fullword
    $ = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
    $ = "RedLeavesCMDSimulatorMutex" wide
    $ = "(NT %d.%d Build %d)" wide
    $ = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
    $ = "red_autumnal_leaves_dllmain.dll" wide ascii
    $ = "__data" wide
    $ = "__serial" wide
    $ = "__upt" wide
    $ = "__msgid" wide
    
  condition:
    7 of them
}
YARA Detection Rule: malware_red_leaves_memory
Repository: Yara-Rules/rules
Detects: Red Leaves C&C left in memory, use with Volatility / Rekall
Author: David Cannings

Pattern signatures:
$ = "__msgid=" wide ascii
    $ = "__serial=" wide ascii
    $ = "OnlineTime=" wide

    // Indicates a file transfer
    $ = "clientpath=" wide ascii 
    $ = "serverpath=" wide ascii

Detection condition:
3 of them

Full rule:
rule malware_red_leaves_memory {
  meta:
    author = "David Cannings"
    description = "Red Leaves C&C left in memory, use with Volatility / Rekall"
    
  strings:
    $ = "__msgid=" wide ascii
    $ = "__serial=" wide ascii
    $ = "OnlineTime=" wide

    // Indicates a file transfer
    $ = "clientpath=" wide ascii 
    $ = "serverpath=" wide ascii

  condition:
    3 of them
}
YARA Detection Rule: APT_Hikit_msrv
Repository: Yara-Rules/rules
Author: ThreatConnect Intelligence Research Team

Pattern signatures:
$m = {6D 73 72 76 2E 64 6C 6C 00 44 6C 6C}

Detection condition:
any of them

Full rule:
rule APT_Hikit_msrv
{

meta:
    author = "ThreatConnect Intelligence Research Team"

strings:
    $m = {6D 73 72 76 2E 64 6C 6C 00 44 6C 6C}

condition:
    any of them
}
YARA Detection Rule: apt_win32_dll_rat_hiZor_RAT
Repository: Yara-Rules/rules
Detects: Detects hiZor RAT
Reference: https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf

Pattern signatures:
// Part of the encoded User-Agent = Mozilla
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }

		// XOR to decode User-Agent after string stacking 0x10001630
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }

		// XOR with 0x2E - 0x10002EF6
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }

		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii

Detection condition:
(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)

Full rule:
rule apt_win32_dll_rat_hiZor_RAT: RAT
{
	meta:
    description = "Detects hiZor RAT"
		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
		hash2 = "d[PII_REDACTED]ccd3b9ea03161566ef18e"
		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
    ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
    ref2 = "https://github.com/Neo23x0/Loki/blob/b187ed063d73d0defc6958100ca7ad04aa77fc12/signatures/apt_hizor_rat.yar"
    reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
	strings:
		// Part of the encoded User-Agent = Mozilla
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }

		// XOR to decode User-Agent after string stacking 0x10001630
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }

		// XOR with 0x2E - 0x10002EF6
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }

		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii
	condition:
		(uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f) and (all of them)
}
YARA Detection Rule: is__LinuxHttpsdStrings
Repository: Yara-Rules/rules
Detects: Strings of ELF Linux/Httpsd (backdoor, downloader, remote command execution)
Author: unixfreaxjp

Pattern signatures:
$st01 = "k.conectionapis.com" fullword nocase wide ascii
		$st02 = "key=%s&host_name=%s&cpu_count=%d&os_type=%s&core_count=%s" fullword nocase wide ascii
		$st03 = "id=%d&result=%s" fullword nocase wide ascii
		$st04 = "rtime" fullword nocase wide ascii
		$st05 = "down" fullword nocase wide ascii
		$st06 = "cmd" fullword nocase wide ascii
		$st07 = "0 */6 * * * root" fullword nocase wide ascii
		$st08 = "/etc/cron.d/httpsd" fullword nocase wide ascii
		$st09 = "cat /proc/cpuinfo |grep processor|wc -l" fullword nocase wide ascii
		$st10 = "k.conectionapis.com" fullword nocase wide ascii
		$st11 = "/api" fullword nocase wide ascii
		$st12 = "/tmp/.httpslog" fullword nocase wide ascii
		$st13 = "/bin/.httpsd" fullword nocase wide ascii
		$st14 = "/tmp/.httpsd" fullword nocase wide ascii
		$st15 = "/tmp/.httpspid" fullword nocase wide ascii
		$st16 = "/tmp/.httpskey" fullword nocase wide ascii

Detection condition:
all of them

Full rule:
private rule is__LinuxHttpsdStrings {

    meta:
	description = "Strings of ELF Linux/Httpsd (backdoor, downloader, remote command execution)"
	ref1 = "https://imgur.com/a/8mFGk"
	ref2 = "https://otx.alienvault.com/pulse/5a49115f93199b171b90a212"
	ref3 = "https://misppriv.circl.lu/events/view/9952"
	author = "unixfreaxjp"
	org = "MalwareMustDie"
	date = "2018-01-02"
	sha256 = "dd1266561fe7fcd54d1eb17efbbb6babaa9c1f44b36cef6e06052e22ce275ccd"
	sha256 = "1b3718698fae20b63fbe6ab32411a02b0b08625f95014e03301b49afaee9d559"
		
	strings:
		$st01 = "k.conectionapis.com" fullword nocase wide ascii
		$st02 = "key=%s&host_name=%s&cpu_count=%d&os_type=%s&core_count=%s" fullword nocase wide ascii
		$st03 = "id=%d&result=%s" fullword nocase wide ascii
		$st04 = "rtime" fullword nocase wide ascii
		$st05 = "down" fullword nocase wide ascii
		$st06 = "cmd" fullword nocase wide ascii
		$st07 = "0 */6 * * * root" fullword nocase wide ascii
		$st08 = "/etc/cron.d/httpsd" fullword nocase wide ascii
		$st09 = "cat /proc/cpuinfo |grep processor|wc -l" fullword nocase wide ascii
		$st10 = "k.conectionapis.com" fullword nocase wide ascii
		$st11 = "/api" fullword nocase wide ascii
		$st12 = "/tmp/.httpslog" fullword nocase wide ascii
		$st13 = "/bin/.httpsd" fullword nocase wide ascii
		$st14 = "/tmp/.httpsd" fullword nocase wide ascii
		$st15 = "/tmp/.httpspid" fullword nocase wide ascii
		$st16 = "/tmp/.httpskey" fullword nocase wide ascii

	condition:
		all of them
}
YARA Detection Rule: Linux_Httpsd_malware_ARM
Repository: Yara-Rules/rules
Detects: Detects Linux/Httpsd ARMv5

Pattern signatures:
$hexsts01 = { f0 4f 2d e9 1e db 4d e2 ec d0 4d e2 01 40 a0 e1 } // main
		$hexsts02 = { f0 45 2d e9 0b db 4d e2 04 d0 4d e2 3c 01 9f e5 } // self-rclocal
		$hexsts03 = { f0 45 2d e9 01 db 4d e2 04 d0 4d e2 bc 01 9f e5 } // copy-self

Detection condition:
all of them
        	and is__elf
		and is__LinuxHttpsdStrings
		and filesize < 200KB

Full rule:
rule Linux_Httpsd_malware_ARM {
  
	meta:
		description = "Detects Linux/Httpsd ARMv5"
		date = "2017-12-31"

	strings:
		$hexsts01 = { f0 4f 2d e9 1e db 4d e2 ec d0 4d e2 01 40 a0 e1 } // main
		$hexsts02 = { f0 45 2d e9 0b db 4d e2 04 d0 4d e2 3c 01 9f e5 } // self-rclocal
		$hexsts03 = { f0 45 2d e9 01 db 4d e2 04 d0 4d e2 bc 01 9f e5 } // copy-self

	condition:
		all of them
        	and is__elf
		and is__LinuxHttpsdStrings
		and filesize < 200KB 
}