deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Atmos_Builder
Repository: Yara-Rules/rules
Detects: Generic signature for Hacktool.Atmos.Builder cracked version
Author: xylitol@temari.fr
Reference: http://www.xylibox.com/2016/02/citadel-0011-atmos.html

Pattern signatures:
// Check for the presence of MZ, kutuzov license identifier, and good hardware ID
        $MZ = {4D 5A}
        $LKEY = "533D9226E4C1CE0A9815DBEB19235AE4" wide ascii
        $HWID = "D19FC0FB14BE23BCF35DA427951BB5AE" wide ascii

        // Builder strings identifiers
        $s1 = "url_loader=%S" wide ascii
        $s2 = "url_webinjects=%S" wide ascii
        $s3 = "url_tokenspy=%S" wide ascii
        $s4 = "file_webinjects=%S" wide ascii
        $s5 = "moneyparser.enabled=%u" wide ascii
        $s6 = "enable_luhn10_post=%u" wide ascii
        $s7 = "insidevm_enable=%u" wide ascii
        $s8 = "disable_antivirus=%u" wide ascii

Detection condition:
$MZ at 0 and $LKEY and $HWID and all of ($s*)

Full rule:
rule Atmos_Builder
{
    
    meta:
        description = "Generic signature for Hacktool.Atmos.Builder cracked version"
        author = "xylitol@temari.fr"
        reference = "http://www.xylibox.com/2016/02/citadel-0011-atmos.html"
        date = "20/08/2016"
        // May only the challenge guide you

    strings:
        // Check for the presence of MZ, kutuzov license identifier, and good hardware ID
        $MZ = {4D 5A}
        $LKEY = "533D9226E4C1CE0A9815DBEB19235AE4" wide ascii
        $HWID = "D19FC0FB14BE23BCF35DA427951BB5AE" wide ascii

        // Builder strings identifiers
        $s1 = "url_loader=%S" wide ascii
        $s2 = "url_webinjects=%S" wide ascii
        $s3 = "url_tokenspy=%S" wide ascii
        $s4 = "file_webinjects=%S" wide ascii
        $s5 = "moneyparser.enabled=%u" wide ascii
        $s6 = "enable_luhn10_post=%u" wide ascii
        $s7 = "insidevm_enable=%u" wide ascii
        $s8 = "disable_antivirus=%u" wide ascii
        
    condition:
        $MZ at 0 and $LKEY and $HWID and all of ($s*)
}
YARA Detection Rule: MirageStrings
Repository: Yara-Rules/rules
Detects: Mirage Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "Neo,welcome to the desert of real." wide ascii
        $ = "/result?hl=en&id=%s"

Detection condition:
any of them

Full rule:
rule MirageStrings
{
    meta:
        description = "Mirage Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "Neo,welcome to the desert of real." wide ascii
        $ = "/result?hl=en&id=%s"
        
    condition:
       any of them
}
YARA Detection Rule: Mirage
Repository: Yara-Rules/rules
Detects: Mirage
Author: Seth Hardy

Detection condition:
MirageStrings

Full rule:
rule Mirage
{
    meta:
        description = "Mirage"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    condition:
        MirageStrings
}
YARA Detection Rule: Mirage_APT
Repository: Yara-Rules/rules
Detects: Malware related to APT campaign
Author: Silas Cutler
Reference: Useful link

Pattern signatures:
$a1 = "welcome to the desert of the real"
        $a2 = "Mirage"
        $b = "Encoding: gzip"
        $c = /\/[A-Za-z]*\?hl=en/

Detection condition:
(($a1 or $a2) or $b) and $c

Full rule:
rule Mirage_APT
{
    meta:
        Author      = "Silas Cutler"
        Date        = "yyyy/mm/dd"
        Description = "Malware related to APT campaign"
        Reference   = "Useful link"
    
    strings:
        $a1 = "welcome to the desert of the real"
        $a2 = "Mirage"
        $b = "Encoding: gzip"
        $c = /\/[A-Za-z]*\?hl=en/

    condition: 
        (($a1 or $a2) or $b) and $c
}
YARA Detection Rule: RSharedStrings
Repository: Yara-Rules/rules
Detects: identifiers for remote and gmremote
Author: Katie Kleemola

Pattern signatures:
$ = "nView_DiskLoydb" wide
		$ = "nView_KeyLoydb" wide
		$ = "nView_skins" wide
		$ = "UsbLoydb" wide
		$ = "%sBurn%s" wide
		$ = "soul" wide

Detection condition:
any of them

Full rule:
private rule RSharedStrings : Surtr Family {
	meta:
		description = "identifiers for remote and gmremote"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = "nView_DiskLoydb" wide
		$ = "nView_KeyLoydb" wide
		$ = "nView_skins" wide
		$ = "UsbLoydb" wide
		$ = "%sBurn%s" wide
		$ = "soul" wide

	condition:
		any of them

}
YARA Detection Rule: RemoteStrings
Repository: Yara-Rules/rules
Detects: indicators for remote.dll - surtr stage 2
Author: Katie Kleemola

Pattern signatures:
$ = "\x00Remote.dll\x00"
		$ = "\x00CGm_PlugBase::"
		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
		$ = "\x00_Remote_\x00" wide

Detection condition:
any of them

Full rule:
private rule RemoteStrings : Remote Variant Surtr Family {
	meta:
		description = "indicators for remote.dll - surtr stage 2"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = "\x00Remote.dll\x00"
		$ = "\x00CGm_PlugBase::"
		$ = "\x00ServiceMain\x00_K_H_K_UH\x00"
		$ = "\x00_Remote_\x00" wide
	condition:
		any of them
}
YARA Detection Rule: GmRemoteStrings
Repository: Yara-Rules/rules
Detects: identifiers for gmremote: surtr stage 2
Author: Katie Kleemola

Pattern signatures:
$ = "\x00x86_GmRemote.dll\x00"
		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
		$ = "\x00GmShutPoint\x00"
		$ = "\x00GmRecvPoint\x00"
		$ = "\x00GmInitPoint\x00"
		$ = "\x00GmVerPoint\x00"
		$ = "\x00GmNumPoint\x00"
		$ = "_Gt_Remote_" wide
		$ = "%sBurn\\workdll.tmp" wide

Detection condition:
any of them

Full rule:
private rule GmRemoteStrings : GmRemote Variant Family Surtr {
	meta:
		description = "identifiers for gmremote: surtr stage 2"
		author = "Katie Kleemola"
		last_updated = "07-21-2014"
	
	strings:
		$ = "\x00x86_GmRemote.dll\x00"
		$ = "\x00D:\\Project\\GTProject\\Public\\List\\ListManager.cpp\x00"
		$ = "\x00GmShutPoint\x00"
		$ = "\x00GmRecvPoint\x00"
		$ = "\x00GmInitPoint\x00"
		$ = "\x00GmVerPoint\x00"
		$ = "\x00GmNumPoint\x00"
		$ = "_Gt_Remote_" wide
		$ = "%sBurn\\workdll.tmp" wide
	
	condition:
		any of them

}
YARA Detection Rule: GmRemote
Repository: Yara-Rules/rules
Detects: identifier for gmremote
Author: Katie Kleemola

Detection condition:
RSharedStrings and GmRemoteStrings

Full rule:
rule GmRemote : Family Surtr Variant GmRemote {
	meta:
		description = "identifier for gmremote"
		author = "Katie Kleemola"
		last_updated = "07-25-2014"
	
	condition:
		RSharedStrings and GmRemoteStrings
}
YARA Detection Rule: Remote
Repository: Yara-Rules/rules
Detects: identifier for remote
Author: Katie Kleemola

Detection condition:
RSharedStrings and RemoteStrings

Full rule:
rule Remote : Family Surtr Variant Remote {
	meta:
		description = "identifier for remote"
		author = "Katie Kleemola"
		last_updated = "07-25-2014"
	
	condition:
		RSharedStrings and RemoteStrings
}
YARA Detection Rule: SurtrStrings
Repository: Yara-Rules/rules
Detects: Strings for Surtr
Author: Katie Kleemola

Pattern signatures:
$ = "\x00soul\x00"
		$ = "\x00InstallDll.dll\x00"
		$ = "\x00_One.dll\x00"
		$ = "_Fra.dll"
		$ = "CrtRunTime.log"
		$ = "Prod.t"
		$ = "Proe.t"
		$ = "Burn\\"
		$ = "LiveUpdata_Mem\\"

Detection condition:
any of them

Full rule:
rule SurtrStrings : Surtr Family {	
	meta: 
		author = "Katie Kleemola"
		description = "Strings for Surtr"
		last_updated = "2014-07-16"

	strings:
		$ = "\x00soul\x00"
		$ = "\x00InstallDll.dll\x00"
		$ = "\x00_One.dll\x00"
		$ = "_Fra.dll"
		$ = "CrtRunTime.log"
		$ = "Prod.t"
		$ = "Proe.t"
		$ = "Burn\\"
		$ = "LiveUpdata_Mem\\"

	condition:
		any of them

}
YARA Detection Rule: SurtrCode
Repository: Yara-Rules/rules
Detects: Code features for Surtr Stage1
Author: Katie Kleemola

Pattern signatures:
//decrypt config
		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
		//if Burn folder name is not in strings
		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
		//mov char in _Fire
		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }

Detection condition:
any of them

Full rule:
rule SurtrCode : Surtr Family {
	meta: 
		author = "Katie Kleemola"
		description = "Code features for Surtr Stage1"
		last_updated = "2014-07-16"
	
	strings:
		//decrypt config
		$ = { 8A ?? ?? 84 ?? ?? 74 ?? 3C 01 74 ?? 34 01 88 41 3B ?? 72 ?? }
		//if Burn folder name is not in strings
		$ = { C6 [3] 42 C6 [3] 75 C6 [3] 72 C6 [3] 6E C6 [3] 5C }
		//mov char in _Fire
		$ = { C6 [3] 5F C6 [3] 46 C6 [3] 69 C6 [3] 72 C6 [3] 65 C6 [3] 2E C6 [3] 64 }

	condition:
		any of them

}
YARA Detection Rule: Surtr
Repository: Yara-Rules/rules
Detects: Rule for Surtr Stage One
Author: Katie Kleemola

Detection condition:
SurtrStrings or SurtrCode

Full rule:
rule Surtr : Family {
	meta:
		author = "Katie Kleemola"
		description = "Rule for Surtr Stage One"
		last_updated = "2014-07-16"

	condition:
		SurtrStrings or SurtrCode

}
YARA Detection Rule: GEN_PowerShell
Repository: Yara-Rules/rules
Detects: Generic PowerShell Malware Rule
Author: https://github.com/interleaved

Pattern signatures:
$s1 = "powershell"
        $s2 = "-ep bypass" nocase
        $s3 = "-nop" nocase
        $s10 = "-executionpolicy bypass" nocase
        $s4 = "-win hidden" nocase
        $s5 = "-windowstyle hidden" nocase
        $s11 = "-w hidden" nocase
        /*$s6 = "-noni" fullword ascii*/
        /*$s7 = "-noninteractive" fullword ascii*/
        $s8 = "-enc" nocase
        $s9 = "-encodedcommand" nocase

Detection condition:
$s1 and (($s2 or $s3 or $s10) and ($s4 or $s5 or $s11) and ($s8 or $s9))

Full rule:
rule GEN_PowerShell 
{

    meta:
        description = "Generic PowerShell Malware Rule"
        author = "https://github.com/interleaved"
    
    strings:
        $s1 = "powershell"
        $s2 = "-ep bypass" nocase
        $s3 = "-nop" nocase
        $s10 = "-executionpolicy bypass" nocase
        $s4 = "-win hidden" nocase
        $s5 = "-windowstyle hidden" nocase
        $s11 = "-w hidden" nocase
        /*$s6 = "-noni" fullword ascii*/
        /*$s7 = "-noninteractive" fullword ascii*/
        $s8 = "-enc" nocase
        $s9 = "-encodedcommand" nocase
    
    condition:
        $s1 and (($s2 or $s3 or $s10) and ($s4 or $s5 or $s11) and ($s8 or $s9))
}
YARA Detection Rule: universal_1337_stealer_serveur
Repository: Yara-Rules/rules
Detects: Universal 1337 Stealer Serveur
Author: Kevin Falcoz

Pattern signatures:
$signature1={2A 5B 53 2D 50 2D 4C 2D 49 2D 54 5D 2A} /*[S-P-L-I-T]*/
		$signature2={2A 5B 48 2D 45 2D 52 2D 45 5D 2A} /*[H-E-R-E]*/
		$signature3={46 54 50 7E} /*FTP~*/
		$signature4={7E 31 7E 31 7E 30 7E 30} /*~1~1~0~0*/

Detection condition:
$signature1 and $signature2 or $signature3 and $signature4

Full rule:
rule universal_1337_stealer_serveur : Stealer
{
	meta:
		author="Kevin Falcoz"
		date="24/02/2013"
		description="Universal 1337 Stealer Serveur"
		
	strings:
		$signature1={2A 5B 53 2D 50 2D 4C 2D 49 2D 54 5D 2A} /*[S-P-L-I-T]*/
		$signature2={2A 5B 48 2D 45 2D 52 2D 45 5D 2A} /*[H-E-R-E]*/
		$signature3={46 54 50 7E} /*FTP~*/
		$signature4={7E 31 7E 31 7E 30 7E 30} /*~1~1~0~0*/
		
	condition:
		$signature1 and $signature2 or $signature3 and $signature4
}
YARA Detection Rule: MALW_FakePyPI
Repository: Yara-Rules/rules
Detects: Identifies fake PyPI Packages.
Author: @bartblaze
Reference: http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/

Pattern signatures:
$ = "# Welcome Here! :)"
	$ = "# just toy, no harm :)"
	$ = "[0x76,0x21,0xfe,0xcc,0xee]"

Detection condition:
all of them

Full rule:
rule MALW_FakePyPI
{
meta:
	description = "Identifies fake PyPI Packages."
	author = "@bartblaze"
	reference = "http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/"
	date = "2017-09"
	tlp = "white"

strings:	
	$ = "# Welcome Here! :)"
	$ = "# just toy, no harm :)"
	$ = "[0x76,0x21,0xfe,0xcc,0xee]"

condition:
	all of them
}
YARA Detection Rule: COZY_FANCY_BEAR_Hunt
Repository: Yara-Rules/rules
Detects: Detects Cozy Bear / Fancy Bear C2 Server IPs
Author: Florian Roth
Reference: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

Pattern signatures:
$s1 = "185.100.84.134" ascii wide fullword
        $s2 = "58.49.58.58" ascii wide fullword
        $s3 = "218.1.98.203" ascii wide fullword
        $s4 = "187.33.33.8" ascii wide fullword
        $s5 = "185.86.148.227" ascii wide fullword
        $s6 = "45.32.129.185" ascii wide fullword
        $s7 = "23.227.196.217" ascii wide fullword

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule COZY_FANCY_BEAR_Hunt 
{

    meta:
        description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
        author = "Florian Roth"
        reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
        date = "2016-06-14"

    strings:
        $s1 = "185.100.84.134" ascii wide fullword
        $s2 = "58.49.58.58" ascii wide fullword
        $s3 = "218.1.98.203" ascii wide fullword
        $s4 = "187.33.33.8" ascii wide fullword
        $s5 = "185.86.148.227" ascii wide fullword
        $s6 = "45.32.129.185" ascii wide fullword
        $s7 = "23.227.196.217" ascii wide fullword

    condition:
        uint16(0) == 0x5a4d and 1 of them
}
YARA Detection Rule: COZY_FANCY_BEAR_pagemgr_Hunt
Repository: Yara-Rules/rules
Detects: Detects a pagemgr.exe as mentioned in the CrowdStrike report
Author: Florian Roth
Reference: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/

Pattern signatures:
$s1 = "pagemgr.exe" wide fullword

Detection condition:
uint16(0) == 0x5a4d and 1 of them

Full rule:
rule COZY_FANCY_BEAR_pagemgr_Hunt 
{

    meta:
        description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
        author = "Florian Roth"
        reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
        date = "2016-06-14"

    strings:
        $s1 = "pagemgr.exe" wide fullword

    condition:
        uint16(0) == 0x5a4d and 1 of them
}
YARA Detection Rule: BeEF_browser_hooked
Repository: Yara-Rules/rules
Detects: Yara rule related to hook.js, BeEF Browser hooking capability
Author: Pasquale Stirparo

Pattern signatures:
$s0 = "mitb.poisonAnchor" wide ascii
		$s1 = "this.request(this.httpproto" wide ascii
		$s2 = "beef.logger.get_dom_identifier" wide ascii
		$s3 = "return (!!window.opera" wide ascii 
		$s4 = "history.pushState({ Be:\"EF\" }" wide ascii 
		$s5 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/10\\./)" wide ascii 
		$s6 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/11\\./)" wide ascii 
		$s7 = "window.navigator.userAgent.match(/Avant TriCore/)" wide ascii 
		$s8 = "window.navigator.userAgent.match(/Iceweasel" wide ascii 
		$s9 = "mitb.sniff(" wide ascii 
		$s10 = "Method XMLHttpRequest.open override" wide ascii 
		$s11 = ".browser.hasWebSocket" wide ascii 
		$s12 = ".mitb.poisonForm" wide ascii 
		$s13 = "resolved=require.resolve(file,cwd||" wide ascii 
		$s14 = "if (document.domain == domain.replace(/(\\r\\n|\\n|\\r)/gm" wide ascii 
		$s15 = "beef.net.request" wide ascii 
		$s16 = "uagent.search(engineOpera)" wide ascii 
		$s17 = "mitb.sniff" wide ascii
		$

Detection condition:
all of them

Full rule:
rule BeEF_browser_hooked 
{
	meta:
		description = "Yara rule related to hook.js, BeEF Browser hooking capability"
		author = "Pasquale Stirparo"
		date = "2015-10-07"
		hash1 = "587e611f49baf63097ad2421ad0299b7b8403169ec22456fb6286abf051228db"
	
	strings:
		$s0 = "mitb.poisonAnchor" wide ascii
		$s1 = "this.request(this.httpproto" wide ascii
		$s2 = "beef.logger.get_dom_identifier" wide ascii
		$s3 = "return (!!window.opera" wide ascii 
		$s4 = "history.pushState({ Be:\"EF\" }" wide ascii 
		$s5 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/10\\./)" wide ascii 
		$s6 = "window.navigator.userAgent.match(/Opera\\/9\\.80.*Version\\/11\\./)" wide ascii 
		$s7 = "window.navigator.userAgent.match(/Avant TriCore/)" wide ascii 
		$s8 = "window.navigator.userAgent.match(/Iceweasel" wide ascii 
		$s9 = "mitb.sniff(" wide ascii 
		$s10 = "Method XMLHttpRequest.open override" wide ascii 
		$s11 = ".browser.hasWebSocket" wide ascii 
		$s12 = ".mitb.poisonForm" wide ascii 
		$s13 = "resolved=require.resolve(file,cwd||" wide ascii 
		$s14 = "if (document.domain == domain.replace(/(\\r\\n|\\n|\\r)/gm" wide ascii 
		$s15 = "beef.net.request" wide ascii 
		$s16 = "uagent.search(engineOpera)" wide ascii 
		$s17 = "mitb.sniff" wide ascii
		$s18 = "beef.logger.start" wide ascii
	
	condition:
		all of them
}
YARA Detection Rule: backdoor_apt_pcclient
Repository: Yara-Rules/rules
Detects: Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)
Author: @patrickrolsen

Pattern signatures:
$magic = { 4d 5a } // MZ
        $string1 = "www.micro1.zyns.com"
        $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
        $string3 = "msacm32.drv" wide
        $string4 = "C:\\Windows\\Explorer.exe" wide
        $string5 = "Elevation:Administrator!" wide
        $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"

Detection condition:
$magic at 0 and 4 of ($string*)

Full rule:
rule backdoor_apt_pcclient
{

    meta:
        author = "@patrickrolsen"
        maltype = "APT.PCCLient"
        filetype = "DLL"
        version = "0.1"
        description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
        date = "2012-10"

    strings:
        $magic = { 4d 5a } // MZ
        $string1 = "www.micro1.zyns.com"
        $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
        $string3 = "msacm32.drv" wide
        $string4 = "C:\\Windows\\Explorer.exe" wide
        $string5 = "Elevation:Administrator!" wide
        $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"

    condition:
        $magic at 0 and 4 of ($string*)
}
YARA Detection Rule: korlia
Repository: Yara-Rules/rules
Author: Nick Hoffman
Reference: http://www.morphick.com/resources/lab-blog/curious-korlia

Pattern signatures:
$a = {b2 ?? 8A 86 98 40 00 71 BF 98 40 00 71 32 c2 83 C9 FF 88 86 98 40 00 71 33 C0 46 F2 AE F7 D1 49 3B F1} 
$b = {B3 ?? ?? ?? 8A 8A 28 50 40 00 BF 28 50 40 00 32 CB 33 C0 88 8A 28 50 40 00 83 C9 FF 42 F2 AE F7 D1 49 3B D1} 
$c = {8A 0C 28 80 F1 ?? 88 0C 28 8B 4C 24 14 40 3B C1} 
$d = {00 62 69 73 6F 6E 61 6C 00} //config marker "\x00bisonal\x00"

Detection condition:
any of them

Full rule:
rule korlia
{ 
meta:
author = "Nick Hoffman" 
company = "Morphick"
reference = "http://www.morphick.com/resources/lab-blog/curious-korlia"
information = "korlia malware found in apt dump" 

//case a
//b2 1f mov dl, 0x1f ; mov key (wildcard) 
// ----------------- 
//8A 86 98 40 00 71 mov al, byte ptr url[esi]
//BF 98 40 00 71 mov edi, offset url 
//32 C2 xor al, dl 
//83 C9 FF or ecx, 0FFFFFFFFh 
//88 86 98 40 00 71 mov byte ptr url[esi], al 
//33 C0 xor eax, eax 
//46 inc esi 
//F2 AE repne scasb 
//F7 D1 not ecx 
//49 dec ecx 
//3B F1 cmp esi, ecx 
//72 DE jb short loc_71001DE0

//case b (variant of loop a) 
//8A 8A 28 50 40 00 mov cl, byte_405028[edx] 
//BF 28 50 40 00 mov edi, offset byte_405028 
//32 CB xor cl, bl 
//33 C0 xor eax, eax 
//88 8A 28 50 40 00 mov byte_405028[edx], cl
//83 C9 FF or ecx, 0FFFFFFFFh 
//42 inc edx 
//F2 AE repne scasb 
//F7 D1 not ecx 
//49 dec ecx 
//3B D1 cmp edx, ecx 
//72 DE jb short loc_4047F2 

//case c (not a variant of the above loop) 
//8A 0C 28 mov cl, [eax+ebp] 
//80 F1 28 xor cl, 28h 
//88 0C 28 mov [eax+ebp], cl 
//8B 4C 24 14 mov ecx, [esp+0D78h+var_D64]
//40 inc eax 
//3B C1 cmp eax, ecx 
//7C EE jl short loc_404F1C 

strings:
$a = {b2 ?? 8A 86 98 40 00 71 BF 98 40 00 71 32 c2 83 C9 FF 88 86 98 40 00 71 33 C0 46 F2 AE F7 D1 49 3B F1} 
$b = {B3 ?? ?? ?? 8A 8A 28 50 40 00 BF 28 50 40 00 32 CB 33 C0 88 8A 28 50 40 00 83 C9 FF 42 F2 AE F7 D1 49 3B D1} 
$c = {8A 0C 28 80 F1 ?? 88 0C 28 8B 4C 24 14 40 3B C1} 
$d = {00 62 69 73 6F 6E 61 6C 00} //config marker "\x00bisonal\x00"
condition:
any of them 
}
YARA Detection Rule: LuaBot
Repository: Yara-Rules/rules
Detects: LuaBot
Author: Joan Soriano / @joanbtl

Pattern signatures:
$a = "LUA_PATH"
                $b = "Hi. Happy reversing, you can mail me: luabot@yandex.ru"
                $c = "/tmp/lua_XXXXXX"
                $d = "NOTIFY"
                $e = "UPDATE"

Detection condition:
all of them

Full rule:
rule LuaBot : MALW
{
        meta:
                description = "LuaBot"
                author = "Joan Soriano / @joanbtl"
                date = "2017-06-07"
                version = "1.0"
                MD5 = "9df3372f058874fa964548cbb74c74bf"
                SHA1 = "[PII_REDACTED]1ee7d399354656d870b4a9c02db1d3"
                ref1 = "http://blog.malwaremustdie.org/2016/09/mmd-0057-2016-new-elf-botnet-linuxluabot.html"

        strings:
                $a = "LUA_PATH"
                $b = "Hi. Happy reversing, you can mail me: luabot@yandex.ru"
                $c = "/tmp/lua_XXXXXX"
                $d = "NOTIFY"
                $e = "UPDATE"

        condition:
                all of them
}
YARA Detection Rule: backoff
Repository: Yara-Rules/rules
Detects: Identify Backoff
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "&op=%d&id=%s&ui=%s&wv=%d&gr=%s&bv=%s"
        $s2 = "%s @ %s"
        $s3 = "Upload KeyLogs"

Detection condition:
all of them

Full rule:
rule backoff 
{

    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-08-21"
        description = "Identify Backoff"

    strings:
        $s1 = "&op=%d&id=%s&ui=%s&wv=%d&gr=%s&bv=%s"
        $s2 = "%s @ %s"
        $s3 = "Upload KeyLogs"

    condition:
        all of them
}
YARA Detection Rule: Misdat_Backdoor_Packed
Repository: Yara-Rules/rules
Author: Cylance SPEAR Team

Pattern signatures:
$upx = {33 2E 30 33 00 55 50 58 21}
        $send = {00 00 00 73 65 6E 64 00 00 00}
        $delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
        $shellexec = {00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 57 00 00 00}

Detection condition:
filesize < 100KB and $upx and $send and $delphi_sec_pe and $shellexec

Full rule:
rule Misdat_Backdoor_Packed
{
    
    meta:
        author = "Cylance SPEAR Team"
        note = "Probably Prone to False Positive"

    strings:
        $upx = {33 2E 30 33 00 55 50 58 21}
        $send = {00 00 00 73 65 6E 64 00 00 00}
        $delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
        $shellexec = {00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 57 00 00 00}
        
    condition:
        filesize < 100KB and $upx and $send and $delphi_sec_pe and $shellexec
}
YARA Detection Rule: MiSType_Backdoor_Packed
Repository: Yara-Rules/rules
Author: Cylance SPEAR Team

Pattern signatures:
$upx = {33 2E 30 33 00 55 50 58 21}
        $send_httpquery = {00 00 00 48 74 74 70 51 75 65 72 79 49 6E 66 6F 41 00 00 73 65 6E 64 00 00}
        $delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}

Detection condition:
filesize < 100KB and $upx and $send_httpquery and $delphi_sec_pe

Full rule:
rule MiSType_Backdoor_Packed
{
    
    meta:
        author = "Cylance SPEAR Team"
        note = "Probably Prone to False Positive"

    strings:
        $upx = {33 2E 30 33 00 55 50 58 21}
        $send_httpquery = {00 00 00 48 74 74 70 51 75 65 72 79 49 6E 66 6F 41 00 00 73 65 6E 64 00 00}
        $delphi_sec_pe = {50 45 00 00 4C 01 03 00 19 5E 42 2A}
    
    condition:
        filesize < 100KB and $upx and $send_httpquery and $delphi_sec_pe
}