deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXPL_Exploit_TLB_Scripts
Repository: Neo23x0/signature-base
Detects: Detects malicious TLB files which may be delivered via Visual Studio projects
Author: Rich Warren (slightly modified by Florian Roth)
Reference: https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf

Pattern signatures:
$a = ".sct" ascii nocase
      $b = "script:" ascii nocase
      $c = "scriptlet:" ascii nocase
      $d = "soap:" ascii nocase
      $e = "winmgmts:" ascii nocase

Detection condition:
uint32be(0) == 0x4D534654 and 
      filesize < 100KB and 
      any of them

Full rule:
rule EXPL_Exploit_TLB_Scripts {
   meta:
      description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
      author = "Rich Warren (slightly modified by Florian Roth)"
      reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
      date = "2021-01-26"
      id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"
   strings:
      $a = ".sct" ascii nocase
      $b = "script:" ascii nocase
      $c = "scriptlet:" ascii nocase
      $d = "soap:" ascii nocase
      $e = "winmgmts:" ascii nocase
   condition:
      uint32be(0) == 0x4D534654 and 
      filesize < 100KB and 
      any of them
}
YARA Detection Rule: MAL_Win_Amadey_Jun25
Repository: Neo23x0/signature-base
Detects: This rule detects intrinsic patterns of Amadey version 5.34
Author: 0x0d4y
Reference: https://0x0d4y.blog/amadey-targeted-analysis/

Pattern signatures:
$rc4_algorithm = { 8a 96 ?? ?? ?? ?? 0f b6 86 ?? ?? ?? ?? 03 f8 0f b6 ca 03 f9 81 e7 ff 00 00 80 79 ?? 4f 81 cf 00 ff ff ff 47 8a 87 ?? ?? ?? ?? 88 86 ?? ?? ?? ?? 46 88 97 ?? ?? ?? ?? 81 fe 00 01 00 00 7c }
      $s_MZ_PE_validation = { b8 4d 5a ?? ?? 66 39 06 0f 85 a8 01 ?? ?? 8b 7e 3c 03 fe 81 3f 50 45 00 00  }
      $s_loop_through_pe_section = { 8b 4c 24 0c 03 ce 03 4e 3c 6a ?? ff b1 08 01 ?? ?? 8b 81 0c 01 00 00 03 c6 50 8b 81 04 01 ?? ?? 03 44 24 20 50 ff 74 24 30 ff 15 f4 f0 44 00 8b 4c 24 10 0f b7 47 06 41 83 44 24 0c 28 89 4c 24 10 3b c8 }
      $s_str_decryption_algorithm = { 8b cb 0f 43 35 ?? ?? ?? ?? 2b c8 8d 04 0a 33 d2 f7 f3 }

Detection condition:
uint16(0) == 0x5a4d 
      and $rc4_algorithm 
      and 2 of ($s*)

Full rule:
rule MAL_Win_Amadey_Jun25 {
   meta:
      author = "0x0d4y"
      description = "This rule detects intrinsic patterns of Amadey version 5.34"
      date = "2025-06-18"
      score = 80
      reference = "https://0x0d4y.blog/amadey-targeted-analysis/"
      yarahub_reference_md5 = "1db72c5832fb71b29863ccc3125137a0"
      yarahub_uuid = "853111b8-e548-46a9-8f5a-ec8621343e0d"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      malpedia_family = "win.amadey"

   strings:
      $rc4_algorithm = { 8a 96 ?? ?? ?? ?? 0f b6 86 ?? ?? ?? ?? 03 f8 0f b6 ca 03 f9 81 e7 ff 00 00 80 79 ?? 4f 81 cf 00 ff ff ff 47 8a 87 ?? ?? ?? ?? 88 86 ?? ?? ?? ?? 46 88 97 ?? ?? ?? ?? 81 fe 00 01 00 00 7c }
      $s_MZ_PE_validation = { b8 4d 5a ?? ?? 66 39 06 0f 85 a8 01 ?? ?? 8b 7e 3c 03 fe 81 3f 50 45 00 00  }
      $s_loop_through_pe_section = { 8b 4c 24 0c 03 ce 03 4e 3c 6a ?? ff b1 08 01 ?? ?? 8b 81 0c 01 00 00 03 c6 50 8b 81 04 01 ?? ?? 03 44 24 20 50 ff 74 24 30 ff 15 f4 f0 44 00 8b 4c 24 10 0f b7 47 06 41 83 44 24 0c 28 89 4c 24 10 3b c8 }
      $s_str_decryption_algorithm = { 8b cb 0f 43 35 ?? ?? ?? ?? 2b c8 8d 04 0a 33 d2 f7 f3 }

    condition:
      uint16(0) == 0x5a4d 
      and $rc4_algorithm 
      and 2 of ($s*)
}
YARA Detection Rule: APT28_HospitalityMalware_document
Repository: Neo23x0/signature-base
Detects: Yara Rule for APT28_Hospitality_Malware document identification
Author: CSE CybSec Enterprise - Z-Lab
Reference: http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf

Pattern signatures:
/* this string identifies the malicious payload */
      $a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
      /* this string identifies the document */
      $b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}

Detection condition:
all of them and filesize > 75KB and filesize < 82KB

Full rule:
rule APT28_HospitalityMalware_document {
   meta:
      description = "Yara Rule for APT28_Hospitality_Malware document identification"
      author = "CSE CybSec Enterprise - Z-Lab"
      reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
      last_updated = "2017-10-02"
      tlp = "white"
      id = "722e80ef-d729-5887-9853-cd06128f506d"
   strings:
      /* this string identifies the malicious payload */
      $a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
      /* this string identifies the document */
      $b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
   condition:
      all of them and filesize > 75KB and filesize < 82KB
}
YARA Detection Rule: APT28_HospitalityMalware_mvtband_file
Repository: Neo23x0/signature-base
Detects: Yara Rule for mvtband.dll malware
Author: CSE CybSec Enterprise - Z-Lab
Reference: http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf

Pattern signatures:
$a = "DGMNOEP"
      $b = {C7 45 94 0A 25 73 30 8D 45 94}  // two significant instructions

Detection condition:
all of them and pe.sections[2].raw_data_size == 0

Full rule:
rule APT28_HospitalityMalware_mvtband_file {
   meta:
      description = "Yara Rule for mvtband.dll malware"
      author = "CSE CybSec Enterprise - Z-Lab"
      reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
      last_updated = "2017-10-02"
      tlp = "white"
      id = "f9e34c77-38b3-513e-bb29-148ac7058596"
   strings:
      $a = "DGMNOEP"
      $b = {C7 45 94 0A 25 73 30 8D 45 94}  // two significant instructions
   condition:
      all of them and pe.sections[2].raw_data_size == 0
}
YARA Detection Rule: PowerShell_Emp_Eval_Jul17_A1
Repository: Neo23x0/signature-base
Detects: Detects suspicious sample with PowerShell content 
Author: Florian Roth (Nextron Systems)
Reference: PowerShell Empire Eval

Pattern signatures:
$s1 = "powershell" wide
      $s2 = "pshcmd" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 30KB and all of them )

Full rule:
rule PowerShell_Emp_Eval_Jul17_A1 {
   meta:
      description = "Detects suspicious sample with PowerShell content "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "PowerShell Empire Eval"
      date = "2017-07-27"
      hash1 = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
      id = "1699f153-f972-5e06-a94b-eb95af637e6b"
   strings:
      $s1 = "powershell" wide
      $s2 = "pshcmd" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
}
YARA Detection Rule: PowerShell_Emp_Eval_Jul17_A2
Repository: Neo23x0/signature-base
Detects: Detects suspicious sample with PowerShell content 
Author: Florian Roth (Nextron Systems)
Reference: PowerShell Empire Eval

Pattern signatures:
$x1 = "\\support\\Release\\ab.pdb" ascii
      $s2 = "powershell.exe" ascii fullword

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule PowerShell_Emp_Eval_Jul17_A2 {
   meta:
      description = "Detects suspicious sample with PowerShell content "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "PowerShell Empire Eval"
      date = "2017-07-27"
      hash1 = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
      id = "8f299fcd-156c-5ce1-8582-c2a4ff2c0cfc"
   strings:
      $x1 = "\\support\\Release\\ab.pdb" ascii
      $s2 = "powershell.exe" ascii fullword
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: CrowdStrike_SUNSPOT_01
Repository: Neo23x0/signature-base
Detects: Detects RC4 and AES key encryption material in SUNSPOT
Threat actor: StellarParticle
Author: (c) 2021 CrowdStrike Inc.
Reference: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

Pattern signatures:
$key = {fc f3 2a 83 e5 f6 d0 24 a6 bf ce 88 30 c2 48 e7}
        $iv  = {81 8c 85 49 b9 00 06 78 0b e9 63 60 26 64 b2 da}

Detection condition:
all of them and filesize < 32MB

Full rule:
rule CrowdStrike_SUNSPOT_01 : artifact stellarparticle sunspot {

    meta:
        author = "(c) 2021 CrowdStrike Inc."
        description = "Detects RC4 and AES key encryption material in SUNSPOT"
        reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
        version = "[PII_REDACTED]48"
        date = "2021-01-08"
        actor = "StellarParticle"
        malware_family = "SUNSPOT"

        id = "2a2a5cfc-d059-5942-bd70-c3169e9ceb45"
    strings:

        $key = {fc f3 2a 83 e5 f6 d0 24 a6 bf ce 88 30 c2 48 e7}
        $iv  = {81 8c 85 49 b9 00 06 78 0b e9 63 60 26 64 b2 da}

    condition:
        all of them and filesize < 32MB

}
YARA Detection Rule: CrowdStrike_SUNSPOT_02
Repository: Neo23x0/signature-base
Detects: Detects mutex names in SUNSPOT
Threat actor: StellarParticle
Reference: https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

Pattern signatures:
$mutex_01 = "{12d61a41-4b74-7610-a4d8-3028d2f56395}" wide ascii
        $mutex_02 = "{56331e4d-76a3-0390-a7ee-567adf5836b7}" wide ascii

Detection condition:
any of them and filesize < 10MB

Full rule:
rule CrowdStrike_SUNSPOT_02 : artifact stellarparticle sunspot
{

    meta:
        copyright = "(c) 2021 CrowdStrike Inc."
        description = "Detects mutex names in SUNSPOT"
        version = "[PII_REDACTED]48"
        date = "2021-01-08"
        actor = "StellarParticle"
        malware_family = "SUNSPOT"
        reference = "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"

        id = "9ecb89e6-475b-5961-8a67-136a0274e1c7"
    strings:
        $mutex_01 = "{12d61a41-4b74-7610-a4d8-3028d2f56395}" wide ascii
        $mutex_02 = "{56331e4d-76a3-0390-a7ee-567adf5836b7}" wide ascii

    condition:
        any of them and filesize < 10MB

}
YARA Detection Rule: CrowdStrike_SUNSPOT_03
Repository: Neo23x0/signature-base
Detects: Detects log format lines in SUNSPOT
Threat actor: StellarParticle

Pattern signatures:
$s01 = "[ERROR] ***Step1('%ls','%ls') fails with error %#x***\x0A" ascii
        $s02 = "[ERROR] Step2 fails\x0A" ascii
        $s03 = "[ERROR] Step3 fails\x0A" ascii
        $s04 = "[ERROR] Step4('%ls') fails\x0A" ascii
        $s05 = "[ERROR] Step5('%ls') fails\x0A" ascii
        $s06 = "[ERROR] Step6('%ls') fails\x0A" ascii
        $s07 = "[ERROR] Step7 fails\x0A" ascii
        $s08 = "[ERROR] Step8 fails\x0A" ascii
        $s09 = "[ERROR] Step9('%ls') fails\x0A" ascii
        $s10 = "[ERROR] Step10('%ls','%ls') fails with error %#x\x0A" ascii
        $s11 = "[ERROR] Step11('%ls') fails\x0A" ascii
        $s12 = "[ERROR] Step12('%ls','%ls') fails with error %#x\x0A" ascii
        $s13 = "[ERROR] Step30 fails\x0A" ascii
        $s14 = "[ERROR] Step14 fails with error %#x\x0A" ascii
        $s15 = "[ERROR] Step15 fails\x0A" ascii
        $s16 = "[ERROR] Step16 fails\x0A" ascii
        $s17 = "[%d] Step17 fails with error %#x\x0A" ascii
        $s18 = "[%d] Step18 fails with error %#x\

Detection condition:
2 of them and filesize < 10MB

Full rule:
rule CrowdStrike_SUNSPOT_03 : artifact logging stellarparticle sunspot 

{

    meta:
        copyright = "(c) 2021 CrowdStrike Inc."
        description = "Detects log format lines in SUNSPOT"
        version = "[PII_REDACTED]43"
        last_modified = "2021-01-08"
        actor = "StellarParticle"
        malware_family = "SUNSPOT"

        id = "5535163e-a85a-587d-bb6e-083783f915c9"
    strings:
        $s01 = "[ERROR] ***Step1('%ls','%ls') fails with error %#x***\x0A" ascii
        $s02 = "[ERROR] Step2 fails\x0A" ascii
        $s03 = "[ERROR] Step3 fails\x0A" ascii
        $s04 = "[ERROR] Step4('%ls') fails\x0A" ascii
        $s05 = "[ERROR] Step5('%ls') fails\x0A" ascii
        $s06 = "[ERROR] Step6('%ls') fails\x0A" ascii
        $s07 = "[ERROR] Step7 fails\x0A" ascii
        $s08 = "[ERROR] Step8 fails\x0A" ascii
        $s09 = "[ERROR] Step9('%ls') fails\x0A" ascii
        $s10 = "[ERROR] Step10('%ls','%ls') fails with error %#x\x0A" ascii
        $s11 = "[ERROR] Step11('%ls') fails\x0A" ascii
        $s12 = "[ERROR] Step12('%ls','%ls') fails with error %#x\x0A" ascii
        $s13 = "[ERROR] Step30 fails\x0A" ascii
        $s14 = "[ERROR] Step14 fails with error %#x\x0A" ascii
        $s15 = "[ERROR] Step15 fails\x0A" ascii
        $s16 = "[ERROR] Step16 fails\x0A" ascii
        $s17 = "[%d] Step17 fails with error %#x\x0A" ascii
        $s18 = "[%d] Step18 fails with error %#x\x0A" ascii
        $s19 = "[ERROR] Step19 fails with error %#x\x0A" ascii
        $s20 = "[ERROR] Step20 fails\x0A" ascii
        $s21 = "[ERROR] Step21(%d,%s,%d) fails\x0A" ascii
        $s22 = "[ERROR] Step22 fails with error %#x\x0A" ascii
        $s23 = "[ERROR] Step23 fails with error %#x\x0A" ascii
        $s24 = "[%d] Solution directory: %ls\x0A" ascii
        $s25 = "[%d] %04d-%02d-%02d %02d:%02d:%02d:%03d %ls\x0A" ascii
        $s26 = "[%d] + '%s' " ascii

    condition:
        2 of them and filesize < 10MB
}
YARA Detection Rule: Reaver3_Malware_Nov17_1
Repository: Neo23x0/signature-base
Detects: Detects Reaver malware mentioned in PaloAltoNetworks report
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/

Pattern signatures:
$s1 = "CPL.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )

Full rule:
rule Reaver3_Malware_Nov17_1 {
   meta:
      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
      date = "2017-11-11"
      hash1 = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
      id = "95419d6f-b657-53c4-840d-9a9e9b00787e"
   strings:
      $s1 = "CPL.dll" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and pe.imphash() == "e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
}
YARA Detection Rule: Reaver3_Malware_Nov17_2
Repository: Neo23x0/signature-base
Detects: Detects Reaver malware mentioned in PaloAltoNetworks report
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/

Pattern signatures:
$x1 = "WindowsUpdateReaver" fullword wide

      $s1 = "\\WUpdate.~tmp" ascii
      $s2 = "\\~WUpdate.lnk" ascii
      $s3 = "\\services\\" ascii
      $s4 = "moomjufps" fullword ascii
      $s5 = "gekmomkege" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "837cc5062a0758335b257ea3b27972b2" or
         1 of ($x*) or
         3 of them
      )

Full rule:
rule Reaver3_Malware_Nov17_2 {
   meta:
      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
      date = "2017-11-11"
      modified = "2023-01-06"
      hash1 = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
      hash2 = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
      id = "423ae050-5087-528e-be0a-c612024dc70a"
   strings:
      $x1 = "WindowsUpdateReaver" fullword wide

      $s1 = "\\WUpdate.~tmp" ascii
      $s2 = "\\~WUpdate.lnk" ascii
      $s3 = "\\services\\" ascii
      $s4 = "moomjufps" fullword ascii
      $s5 = "gekmomkege" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
         pe.imphash() == "837cc5062a0758335b257ea3b27972b2" or
         1 of ($x*) or
         3 of them
      )
}
YARA Detection Rule: Reaver3_Malware_Nov17_3
Repository: Neo23x0/signature-base
Detects: Detects Reaver malware mentioned in PaloAltoNetworks report
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/

Pattern signatures:
$s1 = "winhelp.dat" fullword ascii
      $s2 = "\\microsoft\\Credentials\\" ascii
      $s3 = "~Update.lnk" fullword ascii
      $s4 = "winhelp.cpl" fullword ascii
      $s5 = "\\services\\" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "8ee521b2316ddd6af1679eac9f5ed77b" or
         4 of them
      )

Full rule:
rule Reaver3_Malware_Nov17_3 {
   meta:
      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
      date = "2017-11-11"
      modified = "2023-01-06"
      hash1 = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
      hash2 = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
      hash3 = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
      hash4 = "1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1"
      hash5 = "d560f44188fb56d3abb11d9508e[PII_REDACTED]de19b811163eb[PII_REDACTED]e666"
      id = "cc2511a9-8938-5f4d-9802-f73e44609bf9"
   strings:
      $s1 = "winhelp.dat" fullword ascii
      $s2 = "\\microsoft\\Credentials\\" ascii
      $s3 = "~Update.lnk" fullword ascii
      $s4 = "winhelp.cpl" fullword ascii
      $s5 = "\\services\\" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
         pe.imphash() == "8ee521b2316ddd6af1679eac9f5ed77b" or
         4 of them
      )
}
YARA Detection Rule: SunOrcal_Malware_Nov17_1
Repository: Neo23x0/signature-base
Detects: Detects Reaver malware mentioned in PaloAltoNetworks report
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/

Pattern signatures:
$x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
      /* $x2 = "!!!system" fullword ascii - more specific: */
      $x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
      $x3 = "!!!url!!!" fullword ascii
      $x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
      $x5 = "GloablCryptNv1" fullword ascii
      $x6 = "Gloabl\\CryptNv1" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 1 of them

Full rule:
rule SunOrcal_Malware_Nov17_1 {
   meta:
      description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
      date = "2017-11-11"
      hash1 = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
      hash2 = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
      hash3 = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
      id = "d8a21570-d1d6-52c3-abb2-ecaa86eb7ff0"
   strings:
      $x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
      /* $x2 = "!!!system" fullword ascii - more specific: */
      $x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
      $x3 = "!!!url!!!" fullword ascii
      $x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
      $x5 = "GloablCryptNv1" fullword ascii
      $x6 = "Gloabl\\CryptNv1" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 1 of them
}
YARA Detection Rule: APT_DarkHydrus_Jul18_1
Repository: Neo23x0/signature-base
Detects: Detects strings found in malware samples in APT report in DarkHydrus
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

Pattern signatures:
$x1 = "Z:\\devcenter\\aggressor\\" ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "d3666d1cde4790b22b44ec35976687fb" or
         1 of them
      )

Full rule:
rule APT_DarkHydrus_Jul18_1 {
   meta:
      description = "Detects strings found in malware samples in APT report in DarkHydrus"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      date = "2018-07-28"
      hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
      id = "fbd001c0-43c9-5429-84d6-7f62eadd8ff3"
   strings:
      $x1 = "Z:\\devcenter\\aggressor\\" ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 600KB and (
         pe.imphash() == "d3666d1cde4790b22b44ec35976687fb" or
         1 of them
      )
}
YARA Detection Rule: APT_DarkHydrus_Jul18_2
Repository: Neo23x0/signature-base
Detects: Detects strings found in malware samples in APT report in DarkHydrus
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/

Pattern signatures:
$s4 = "windir" fullword ascii /* Goodware String - occured 47 times */
      $s6 = "temp.dll" fullword ascii /* Goodware String - occured 3 times */
      $s7 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */
      $s8 = "%s\\System32\\%s" fullword ascii /* Goodware String - occured 4 times */
      $s9 = "StartW" fullword ascii /* Goodware String - occured 5 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and all of them

Full rule:
rule APT_DarkHydrus_Jul18_2 {
   meta:
      description = "Detects strings found in malware samples in APT report in DarkHydrus"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      date = "2018-07-28"
      hash1 = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
      id = "1a21cbbf-f7e1-56eb-973b-35c1a811e210"
   strings:
      $s4 = "windir" fullword ascii /* Goodware String - occured 47 times */
      $s6 = "temp.dll" fullword ascii /* Goodware String - occured 3 times */
      $s7 = "libgcj-12.dll" fullword ascii /* Goodware String - occured 3 times */
      $s8 = "%s\\System32\\%s" fullword ascii /* Goodware String - occured 4 times */
      $s9 = "StartW" fullword ascii /* Goodware String - occured 5 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 40KB and all of them
}