deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PlugX_NvSmartMax_Gen
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT Sample - PlugX NvSmartMax Generic
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s0 = "NvSmartMax.dll" fullword ascii
        $s1 = "NvSmartMax.dll.url" fullword ascii
        $s2 = "Nv.exe" fullword ascii
        $s4 = "CryptProtectMemory failed" fullword ascii 
        $s5 = "CryptUnprotectMemory failed" fullword ascii 
        $s7 = "r%.*s(%d)%s" fullword wide
        $s8 = " %s CRC " fullword wide
        $op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
        $op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
        $op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)

Full rule:
rule PlugX_NvSmartMax_Gen 
{

    meta:
        description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 70
        hash1 = "718fc72942b9b706488575c[PII_REDACTED]170463f6f40fa19b08fc84b79bf0cef"
        hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
        hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
        hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
        hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
    
    strings:
        $s0 = "NvSmartMax.dll" fullword ascii
        $s1 = "NvSmartMax.dll.url" fullword ascii
        $s2 = "Nv.exe" fullword ascii
        $s4 = "CryptProtectMemory failed" fullword ascii 
        $s5 = "CryptUnprotectMemory failed" fullword ascii 
        $s7 = "r%.*s(%d)%s" fullword wide
        $s8 = " %s CRC " fullword wide
        $op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 } /* Opcode */
        $op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 } /* Opcode */
        $op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 } /* Opcode */
 
    condition:
        uint16(0) == 0x5a4d and filesize < 800KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: HttpBrowser_RAT_dropper_Gen2
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT Sample - HttpBrowser RAT Dropper
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s1 = "navlu.dll.urlUT" fullword ascii
        $s2 = "VPDN_LU.exeUT" fullword ascii
        $s3 = "pnipcn.dllUT" fullword ascii
        $s4 = "\\ssonsvr.exe" fullword ascii
        $s5 = "/c del /q %s" fullword ascii
        $s6 = "\\setup.exe" fullword ascii 
        $s7 = "msi.dllUT" fullword ascii
        $op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
        $op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
        $op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
        $op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
        $op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)

Full rule:
rule HttpBrowser_RAT_dropper_Gen2 
{

    meta:
        description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 70
        hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa[PII_REDACTED]82a9983ae47b8992"
        hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
   
    strings:
        $s1 = "navlu.dll.urlUT" fullword ascii
        $s2 = "VPDN_LU.exeUT" fullword ascii
        $s3 = "pnipcn.dllUT" fullword ascii
        $s4 = "\\ssonsvr.exe" fullword ascii
        $s5 = "/c del /q %s" fullword ascii
        $s6 = "\\setup.exe" fullword ascii 
        $s7 = "msi.dllUT" fullword ascii
        $op0 = { 8b 45 0c 83 38 00 0f 84 98 } /* Opcode */
        $op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 } /* Opcode */
        $op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d } /* Opcode */
        $op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 } /* Opcode */
        $op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 } /* Opcode */

    condition:
        uint16(0) == 0x5a4d and filesize < 400KB and 3 of ($s*) and 1 of ($op*)
}
YARA Detection Rule: ThreatGroup3390_Strings
Repository: Yara-Rules/rules
Detects: Threat Group 3390 APT - Strings
Author: Florian Roth
Reference: http://snip.ly/giNB

Pattern signatures:
$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
        $s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
        $s3 = "ren *.rar *.zip" fullword ascii
        $s4 = "c:\\temp\\ipcan.exe" fullword ascii
        $s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii

Detection condition:
1 of them and filesize < 30KB

Full rule:
rule ThreatGroup3390_Strings 
{

    meta:
        description = "Threat Group 3390 APT - Strings"
        author = "Florian Roth"
        reference = "http://snip.ly/giNB"
        date = "2015-08-06"
        score = 60
 
    strings:
        $s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
        $s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
        $s3 = "ren *.rar *.zip" fullword ascii
        $s4 = "c:\\temp\\ipcan.exe" fullword ascii
        $s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
 
    condition:
        1 of them and filesize < 30KB
}
YARA Detection Rule: APT_Malware_PutterPanda_Rel
Repository: Yara-Rules/rules
Detects: Detects an APT malware related to PutterPanda
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$x0 = "app.stream-media.net" fullword ascii /* score: '12.03' */
        $x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.035' */
        $s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '32.02' */
        $s7 = "Connect %s error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.04' */
        $s9 = "Download file %s successfully!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.03' */
        $s10 = "index.tmp" fullword ascii /* score: '14.03' */
        $s11 = "Execute PE Successfully" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.03' */
        $s13 = "aa/22/success.xml" fullword ascii /* score: '12.005' */
        $s16 = "aa/22/index.asp" fullword ascii /* score: '11.02' */
        $s18 = "File %s a Non-Pe File" fullword ascii /* score: '8.04' */
        $s19 = "SendRequset error!" fullword ascii /* scor

Detection condition:
( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( 4 of ($s*) )

Full rule:
rule APT_Malware_PutterPanda_Rel 
{

    meta:
        description = "Detects an APT malware related to PutterPanda"
        author = "Florian Roth"
        score = 70
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "5367e183df155e3133d916f7080ef973f7741d34"

    strings:
        $x0 = "app.stream-media.net" fullword ascii /* score: '12.03' */
        $x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.035' */
        $s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '32.02' */
        $s7 = "Connect %s error!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.04' */
        $s9 = "Download file %s successfully!" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.03' */
        $s10 = "index.tmp" fullword ascii /* score: '14.03' */
        $s11 = "Execute PE Successfully" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.03' */
        $s13 = "aa/22/success.xml" fullword ascii /* score: '12.005' */
        $s16 = "aa/22/index.asp" fullword ascii /* score: '11.02' */
        $s18 = "File %s a Non-Pe File" fullword ascii /* score: '8.04' */
        $s19 = "SendRequset error!" fullword ascii /* score: '8.04' */
        $s20 = "filelist[%d]=%s" fullword ascii /* score: '7.015' */

    condition:
        ( uint16(0) == 0x5a4d and 1 of ($x*) ) or ( 4 of ($s*) )
}
YARA Detection Rule: APT_Malware_PutterPanda_Rel_2
Repository: Yara-Rules/rules
Detects: APT Malware related to PutterPanda Group
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
        $s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
        $s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
        $s3 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.035' */
        $s4 = "Proxy-Authorization:Basic" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
        $s5 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.015' */
        $s6 = "read file error:%d" fullword ascii /* score: '11.04' */
        $s7 = "downdll.dll" fullword ascii /* score: '11.025' */
        $s8 = "rz.dat" fullword ascii /* score: '10.005' */
        $s9 = "Invalid url" fullword ascii /* PEStudio Blacklist

Detection condition:
uint16(0) == 0x5a4d and 6 of them

Full rule:
rule APT_Malware_PutterPanda_Rel_2 
{

    meta:
        description = "APT Malware related to PutterPanda Group"
        author = "Florian Roth"
        score = 70
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"

    strings:
        $s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
        $s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii /* PEStudio Blacklist: strings */ /* score: '28.01' */
        $s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii /* PEStudio Blacklist: agent */ /* score: '20.03' */
        $s3 = "Internet connect error:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.035' */
        $s4 = "Proxy-Authorization:Basic" fullword ascii /* PEStudio Blacklist: strings */ /* score: '14.02' */
        $s5 = "HttpQueryInfo failed:%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '13.015' */
        $s6 = "read file error:%d" fullword ascii /* score: '11.04' */
        $s7 = "downdll.dll" fullword ascii /* score: '11.025' */
        $s8 = "rz.dat" fullword ascii /* score: '10.005' */
        $s9 = "Invalid url" fullword ascii /* PEStudio Blacklist: strings */ /* score: '9.03' */
        $s10 = "Create file failed" fullword ascii /* score: '8.045' */
        $s11 = "myAgent" fullword ascii /* score: '8.025' */
        $s12 = "%s%s%d%d" fullword ascii /* score: '8.005' */
        $s13 = "down file success" fullword ascii /* score: '7.035' */
        $s15 = "error!" fullword ascii /* score: '6.04' */
        $s18 = "Avaliable data:%u bytes" fullword ascii /* score: '5.025' */
    
    condition:
        uint16(0) == 0x5a4d and 6 of them
}
YARA Detection Rule: APT_Malware_PutterPanda_PSAPI
Repository: Yara-Rules/rules
Detects: Detects a malware related to Putter Panda
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.03' */
        $s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.045' */
        $s2 = "psapi.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 54 times */
        $s3 = "urlmon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 471 times */
        $s4 = "WinHttpGetProxyForUrl" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 179 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and all of them

Full rule:
rule APT_Malware_PutterPanda_PSAPI 
{

    meta:
        description = "Detects a malware related to Putter Panda"
        author = "Florian Roth"
        score = 70
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"

    strings:
        $s0 = "LOADER ERROR" fullword ascii /* PEStudio Blacklist: strings */ /* score: '12.03' */
        $s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii /* PEStudio Blacklist: strings */ /* score: '8.045' */
        $s2 = "psapi.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 54 times */
        $s3 = "urlmon.dll" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 471 times */
        $s4 = "WinHttpGetProxyForUrl" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5' */ /* Goodware String - occured 179 times */

    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
YARA Detection Rule: APT_Malware_PutterPanda_Gen1
Repository: Yara-Rules/rules
Detects: Detects a malware 
Author: YarGen Rule Generator
Reference: not set

Pattern signatures:
$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
        $s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
        $s3 = "Fail %s " fullword ascii /* score: '10.04' */
        $s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
        $s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
        $s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
        $s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them

Full rule:
rule APT_Malware_PutterPanda_Gen1 
{

    meta:
        description = "Detects a malware "
        author = "YarGen Rule Generator"
        reference = "not set"
        date = "2015-06-03"
        super_rule = 1
        hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
        hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
        hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"

    strings:
        $s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii /* PEStudio Blacklist: strings */ /* score: '22.02' */
        $s2 = "ssdpsvc.dll" fullword ascii /* score: '11.00' */
        $s3 = "Fail %s " fullword ascii /* score: '10.04' */
        $s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii /* score: '10.01' */
        $s5 = "LsaServiceInit" fullword ascii /* score: '7.03' */
        $s6 = "%-8d Fs %-12s Bs " fullword ascii /* score: '5.04' */
        $s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii /* PEStudio Blacklist: strings */ /* score: '5.00' */ /* Goodware String - occured 5 times */

    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and 5 of them
}
YARA Detection Rule: Malware_MsUpdater_String_in_EXE
Repository: Yara-Rules/rules
Detects: MSUpdater String in Executable
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$x1 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
        // $x2 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
        $x3 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
        $x4 = "msupdater32.exe" fullword ascii
        $x5 = "msupdater32.exe" fullword wide
        $x6 = "msupdate.pif" fullword ascii
        $fp1 = "_msupdate_" wide /* False Positive */
        $fp2 = "_msupdate_" ascii /* False Positive */
        $fp3 = "/kies" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and ( 1 of ($x*) ) and not ( 1 of ($fp*) )

Full rule:
rule Malware_MsUpdater_String_in_EXE  
{

    meta:
        description = "MSUpdater String in Executable"
        author = "Florian Roth"
        score = 50
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"

    strings:
        $x1 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
        // $x2 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
        $x3 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
        $x4 = "msupdater32.exe" fullword ascii
        $x5 = "msupdater32.exe" fullword wide
        $x6 = "msupdate.pif" fullword ascii
        $fp1 = "_msupdate_" wide /* False Positive */
        $fp2 = "_msupdate_" ascii /* False Positive */
        $fp3 = "/kies" wide

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and ( 1 of ($x*) ) and not ( 1 of ($fp*) ) 
}
YARA Detection Rule: APT_Malware_PutterPanda_MsUpdater_3
Repository: Yara-Rules/rules
Detects: Detects Malware related to PutterPanda - MSUpdater
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$s0 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
        $s1 = "Explorer.exe \"" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.05' */
        $s2 = "FAVORITES.DAT" fullword ascii /* score: '11.02' */
        $s4 = "COMSPEC" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 178 times */

Detection condition:
uint16(0) == 0x5a4d and 3 of them

Full rule:
rule APT_Malware_PutterPanda_MsUpdater_3 
{

    meta:
        description = "Detects Malware related to PutterPanda - MSUpdater"
        author = "Florian Roth"
        score = 70
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"

    strings:
        $s0 = "msupdater.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '20.02' */
        $s1 = "Explorer.exe \"" fullword ascii /* PEStudio Blacklist: strings */ /* score: '16.05' */
        $s2 = "FAVORITES.DAT" fullword ascii /* score: '11.02' */
        $s4 = "COMSPEC" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.82' */ /* Goodware String - occured 178 times */
   
    condition:
        uint16(0) == 0x5a4d and 3 of them
}
YARA Detection Rule: APT_Malware_PutterPanda_MsUpdater_1
Repository: Yara-Rules/rules
Detects: Detects Malware related to PutterPanda - MSUpdater
Author: Florian Roth
Reference: VT Analysis

Pattern signatures:
$x0 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
        $x1 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
        $s1 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
        $s2 = "Automatic Updates" fullword wide /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
        $s3 = "VirtualProtectEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 68 times */
        $s4 = "Invalid parameter" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 69 times */
        $s5 = "VirtualAllocEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 95 times */
        $s6 = "WriteProcessMemory" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.87' */ /* Goodware String - occured 131 times */

Detection condition:
( uint16(0) == 0x5a4d and 1 of ($x*) and 4 of ($s*) ) or ( 1 of ($x*) and all of ($s*) )

Full rule:
rule APT_Malware_PutterPanda_MsUpdater_1 
{

    meta:
        description = "Detects Malware related to PutterPanda - MSUpdater"
        author = "Florian Roth"
        score = 70
        reference = "VT Analysis"
        date = "2015-06-03"
        hash = "b55072b67543f58c096571c841a560c53d72f01a"

    strings:
        $x0 = "msupdate.exe" fullword wide /* PEStudio Blacklist: strings */ /* score: '20.01' */
        $x1 = "msupdate" fullword wide /* PEStudio Blacklist: strings */ /* score: '13.01' */
        $s1 = "Microsoft Corporation. All rights reserved." fullword wide /* score: '8.04' */
        $s2 = "Automatic Updates" fullword wide /* PEStudio Blacklist: strings */ /* score: '4.98' */ /* Goodware String - occured 22 times */
        $s3 = "VirtualProtectEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 68 times */
        $s4 = "Invalid parameter" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.93' */ /* Goodware String - occured 69 times */
        $s5 = "VirtualAllocEx" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.91' */ /* Goodware String - occured 95 times */
        $s6 = "WriteProcessMemory" fullword ascii /* PEStudio Blacklist: strings */ /* score: '4.87' */ /* Goodware String - occured 131 times */
    condition:
        ( uint16(0) == 0x5a4d and 1 of ($x*) and 4 of ($s*) ) or ( 1 of ($x*) and all of ($s*) ) 
}
YARA Detection Rule: whosthere_alt
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file whosthere-alt.exe
Author: Florian Roth
Reference: http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit

Pattern signatures:
$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
		$s7 = "Cannot get LSASS.EXE PID!" fullword 

Detection condition:
uint16(0) == 0x5a4d and filesize < 280KB and 2 of them

Full rule:
rule whosthere_alt : Toolkit {
	meta:
		description = "Auto-generated rule - file whosthere-alt.exe"
		author = "Florian Roth"
		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
		date = "2015-07-10"
		score = 80
		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
	strings:
		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii /* PEStudio Blacklist: strings */ /* score: '49.00' */
		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii /* PEStudio Blacklist: strings */ /* score: '36.00' */
		$s2 = "dump output to a file, -o filename" fullword ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii /* PEStudio Blacklist: strings */ /* score: '29.00' */
		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii /* score: '24.00' */
		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii /* PEStudio Blacklist: strings */ /* score: '17.00' */
		$s6 = ".\\pth.dll" fullword ascii /* score: '16.00' */
		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii /* score: '14.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 280KB and 2 of them
}