deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CrowdStrike_Shamoon_DroppedFile
Repository: Yara-Rules/rules
Detects: Rule to detect Shamoon malware http://goo.gl/QTxohN
Reference: http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf

Pattern signatures:
$testn123 = "test123" wide
		$testn456 = "test456" wide
		$testn789 = "test789" wide
		$testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide

Detection condition:
(any of ($testn*) or $pingcmd) and $testdomain

Full rule:
rule CrowdStrike_Shamoon_DroppedFile { 
	meta:
		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
	strings:
		$testn123 = "test123" wide
		$testn456 = "test456" wide
		$testn789 = "test789" wide
		$testdomain = "testdomain.com" wide $pingcmd = "ping -n 30 127.0.0.1 >nul" wide
	condition:
		(any of ($testn*) or $pingcmd) and $testdomain
}
YARA Detection Rule: Shamoon2_Wiper
Repository: Yara-Rules/rules
Detects: Detects Shamoon 2.0 Wiper Component
Author: Florian Roth
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
      $x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
      $s1 = "UFWYNYNTS" fullword wide
      $s2 = "\\\\?\\ElRawDisk" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )

Full rule:
rule Shamoon2_Wiper {
   meta:
      description = "Detects Shamoon 2.0 Wiper Component"
      author = "Florian Roth"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
      hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
   strings:
      $a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
      $x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
      $s1 = "UFWYNYNTS" fullword wide
      $s2 = "\\\\?\\ElRawDisk" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and 2 of them ) or ( 3 of them )
}
YARA Detection Rule: Shamoon2_ComComp
Repository: Yara-Rules/rules
Detects: Detects Shamoon 2.0 Communication Components
Author: Florian Roth (with Binar.ly)
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$s1 = "mkdir %s%s > nul 2>&1" fullword ascii
      $s2 = "p[%s%s%d.%s" fullword ascii

      $op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
      $op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
      $op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and ( all of ($s*) or all of ($op*) )

Full rule:
rule Shamoon2_ComComp {
   meta:
      description = "Detects Shamoon 2.0 Communication Components"
      author = "Florian Roth (with Binar.ly)"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
   strings:
      $s1 = "mkdir %s%s > nul 2>&1" fullword ascii
      $s2 = "p[%s%s%d.%s" fullword ascii

      $op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
      $op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
      $op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and ( all of ($s*) or all of ($op*) )
}
YARA Detection Rule: EldoS_RawDisk
Repository: Yara-Rules/rules
Detects: EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)
Author: Florian Roth (with Binar.ly)
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$s1 = "g\\system32\\" fullword wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii
      $s4 = "FEJIKC" fullword ascii
      $s5 = "INZQND" fullword ascii
      $s6 = "IUTLOM" fullword wide
      $s7 = "DKFKCK" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them )

Full rule:
rule EldoS_RawDisk {
   meta:
      description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
      author = "Florian Roth (with Binar.ly)"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 50
      hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
      hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
   strings:
      $s1 = "g\\system32\\" fullword wide
      $s2 = "ztvttw" fullword wide
      $s3 = "lwizvm" fullword ascii
      $s4 = "FEJIKC" fullword ascii
      $s5 = "INZQND" fullword ascii
      $s6 = "IUTLOM" fullword wide
      $s7 = "DKFKCK" fullword ascii

      $op1 = { 94 35 77 73 03 40 eb e9 }
      $op2 = { 80 7c 41 01 00 74 0a 3d }
      $op3 = { 74 0a 3d 00 94 35 77 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 4 of them )
}
YARA Detection Rule: Shamoon_Disttrack_Dropper
Repository: Yara-Rules/rules
Detects: Detects Shamoon 2.0 Disttrack Dropper
Author: Florian Roth
Reference: https://goo.gl/jKIfGB

Pattern signatures:
$a1 = "\\#{9A6DB7D2-FECF-41ff-9A92-6EDA696613DF}#" wide
      $a2 = "\\#{8A6DB7D2-FECF-41ff-9A92-6EDA696613DE}#" wide

      $s1 = "\\amd64\\elrawdsk.pdb" fullword ascii
      $s2 = "RawDiskSample.exe" fullword wide
      $s3 = "RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later." fullword wide
      $s4 = "elrawdsk.sys" fullword wide
      $s5 = "\\DosDevices\\ElRawDisk" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 90KB and 1 of ($a*) and 1 of ($s*) )

Full rule:
rule Shamoon_Disttrack_Dropper {
   meta:
      description = "Detects Shamoon 2.0 Disttrack Dropper"
      author = "Florian Roth"
      reference = "https://goo.gl/jKIfGB"
      date = "2016-12-01"
      score = 70
      hash1 = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
      hash2 = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
   strings:
      $a1 = "\\#{9A6DB7D2-FECF-41ff-9A92-6EDA696613DF}#" wide
      $a2 = "\\#{8A6DB7D2-FECF-41ff-9A92-6EDA696613DE}#" wide

      $s1 = "\\amd64\\elrawdsk.pdb" fullword ascii
      $s2 = "RawDiskSample.exe" fullword wide
      $s3 = "RawDisk Driver. Allows write access to files and raw disk sectors for user mode applications in Windows 2000 and later." fullword wide
      $s4 = "elrawdsk.sys" fullword wide
      $s5 = "\\DosDevices\\ElRawDisk" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 90KB and 1 of ($a*) and 1 of ($s*) )
}
YARA Detection Rule: almashreq_agent_dotnet
Repository: Yara-Rules/rules
Detects: Memory rule for a .net RAT/Agent first found with .pdb referencing almashreq
Author: J from THL <j@techhelplist.com> with thx to @malwrhunterteam !!1!

Pattern signatures:
$s01 = "WriteElementString(@\"PCName\"," wide
        $s02 = "WriteElementString(@\"Command\"," wide
        $s03 = "WriteElementStringRaw(@\"commandID\"," wide
	$s04 = /^Try Run$/ wide
        $s05 = " is running in PC :" wide
        $s06 = "SOAPAction: \"http://tempuri.org/Set\"" wide
        $s07 = "Try Run</obj><name>" wide
        $s08 = "Disable</obj><name>" wide
        $s09 = "http://tempuri.org/" wide

Detection condition:
7 of them

Full rule:
rule almashreq_agent_dotnet : almashreq_agent_dotnet
{
    meta:
        description = "Memory rule for a .net RAT/Agent first found with .pdb referencing almashreq"
	author = "J from THL <j@techhelplist.com> with thx to @malwrhunterteam !!1!"
        date = "2019-05-12"
        reference1 = "https://twitter.com/JayTHL/status/[PII_REDACTED]42503936"
        reference2 = "https://www.virustotal.com/#/file/f6e1e425650abc6c0465758edf3c089a1dde5b9f58d26a50d3b8682cc38f12c8/details"
        reference3 = "https://www.virustotal.com/#/file/7e4231dc2bdab53f494b84bc13c6cb99478a[PII_REDACTED]c649478323ed5a9071/detection"
        reference4 = "https://www.virustotal.com/#/file/3cbaf6ddba3869ab68baf458afb25d2c8ba623153c43708bad2f312c4663161b/detection"
        reference5 = "https://www.virustotal.com/#/file/0f5424614b3519a340198dd82ad0abc9711a23c3283dc25b519affe5d2959a92/detection" 
        maltype = "agent"
	filetype = "memory"

    strings:
        $s01 = "WriteElementString(@\"PCName\"," wide
        $s02 = "WriteElementString(@\"Command\"," wide
        $s03 = "WriteElementStringRaw(@\"commandID\"," wide
	$s04 = /^Try Run$/ wide
        $s05 = " is running in PC :" wide
        $s06 = "SOAPAction: \"http://tempuri.org/Set\"" wide
        $s07 = "Try Run</obj><name>" wide
        $s08 = "Disable</obj><name>" wide
        $s09 = "http://tempuri.org/" wide

 	condition: 
 		7 of them
}
YARA Detection Rule: MedussaHTTP_2019
Repository: Yara-Rules/rules
Detects: MedussaHTTP v20190812
Author: J from THL <j@techhelplist.com>

Pattern signatures:
$text01 = "|check|" ascii
        $text02 = "POST!" ascii
        $text03 = "httpactive" ascii
        $text04 = "httpstrong" ascii
        $text05 = "httppost" ascii
        $text06 = "slavicdragon" ascii
        $text07 = "slavicnodragon" ascii
        $text08 = "smartflood" ascii
        $text09 = "stop-all" ascii
        $text10 = "botkill" ascii
        $text11 = "updatehash" ascii
        $text12 = "xyz=" ascii
        $text13 = "abc=" ascii

Detection condition:
9 of them

Full rule:
rule MedussaHTTP_2019
{

    meta:
        author = "J from THL <j@techhelplist.com>"
        date = "2019-08-12"
        reference1 = "https://app.any.run/tasks/68c8f400-eba5-4d6c-b1f1-8b07d4c014a4/"
        reference2 = "https://www.netscout.com/blog/asert/medusahttp-ddos-slithers-back-spotlight"
        reference3 = "https://twitter.com/malware_traffic/status/[PII_REDACTED]83008261"
        version = 1
        maltype = "Bot"
        filetype = "memory"
        description = "MedussaHTTP v20190812"

    strings:
        $text01 = "|check|" ascii
        $text02 = "POST!" ascii
        $text03 = "httpactive" ascii
        $text04 = "httpstrong" ascii
        $text05 = "httppost" ascii
        $text06 = "slavicdragon" ascii
        $text07 = "slavicnodragon" ascii
        $text08 = "smartflood" ascii
        $text09 = "stop-all" ascii
        $text10 = "botkill" ascii
        $text11 = "updatehash" ascii
        $text12 = "xyz=" ascii
        $text13 = "abc=" ascii



    condition:
        9 of them
}
YARA Detection Rule: Anthem_DeepPanda_sl_txt_packed
Repository: Yara-Rules/rules
Detects: Anthem Hack Deep Panda - ScanLine sl-txt-packed
Author: Florian Roth

Pattern signatures:
$s0 = "Command line port scanner" fullword wide
        $s1 = "sl.exe" fullword wide
        $s2 = "CPports.txt" fullword ascii
        $s3 = ",GET / HTTP/.}" fullword ascii
        $s4 = "Foundstone Inc." fullword wide
        $s9 = " 2002 Foundstone Inc." fullword wide
        $s15 = ", Inc. 2002" fullword ascii
        $s20 = "ICMP Time" fullword ascii

Detection condition:
all of them

Full rule:
rule Anthem_DeepPanda_sl_txt_packed
{

    meta:
        description = "Anthem Hack Deep Panda - ScanLine sl-txt-packed"
        author = "Florian Roth"
        date = "2015/02/08"
        hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"

    strings:
        $s0 = "Command line port scanner" fullword wide
        $s1 = "sl.exe" fullword wide
        $s2 = "CPports.txt" fullword ascii
        $s3 = ",GET / HTTP/.}" fullword ascii
        $s4 = "Foundstone Inc." fullword wide
        $s9 = " 2002 Foundstone Inc." fullword wide
        $s15 = ", Inc. 2002" fullword ascii
        $s20 = "ICMP Time" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: Anthem_DeepPanda_lot1
Repository: Yara-Rules/rules
Detects: Anthem Hack Deep Panda - lot1.tmp-pwdump
Author: Florian Roth

Pattern signatures:
$s0 = "Unable to open target process: %d, pid %d" fullword ascii
        $s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
        $s2 = "Target: Failed to load SAM functions." fullword ascii
        $s5 = "Error writing the test file %s, skipping this share" fullword ascii
        $s6 = "Failed to create service (%s/%s), error %d" fullword ascii
        $s8 = "Service start failed: %d (%s/%s)" fullword ascii
        $s12 = "PwDump.exe" fullword ascii
        $s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
        $s14 = ":\\\\.\\pipe\\%s" fullword ascii
        $s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
        $s16 = "dump logon session" fullword ascii
        $s17 = "Timed out waiting to get our pipe back" fullword ascii
        $s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
        $s20 = "%s\\%s.exe" fullword ascii

Detection condition:
10 of them

Full rule:
rule Anthem_DeepPanda_lot1
{

    meta:
        description = "Anthem Hack Deep Panda - lot1.tmp-pwdump"
        author = "Florian Roth"
        date = "2015/02/08"
        hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"

    strings:
        $s0 = "Unable to open target process: %d, pid %d" fullword ascii
        $s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
        $s2 = "Target: Failed to load SAM functions." fullword ascii
        $s5 = "Error writing the test file %s, skipping this share" fullword ascii
        $s6 = "Failed to create service (%s/%s), error %d" fullword ascii
        $s8 = "Service start failed: %d (%s/%s)" fullword ascii
        $s12 = "PwDump.exe" fullword ascii
        $s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
        $s14 = ":\\\\.\\pipe\\%s" fullword ascii
        $s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
        $s16 = "dump logon session" fullword ascii
        $s17 = "Timed out waiting to get our pipe back" fullword ascii
        $s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
        $s20 = "%s\\%s.exe" fullword ascii

    condition:
        10 of them
}
YARA Detection Rule: Anthem_DeepPanda_htran_exe
Repository: Yara-Rules/rules
Detects: Anthem Hack Deep Panda - htran-exe
Author: Florian Roth

Pattern signatures:
$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
        $s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
        $s2 = "e:\\VS 2008 Project\\htran\\Release\\htran.pdb" fullword ascii
        $s3 = "[SERVER]connection to %s:%d error" fullword ascii
        $s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s5 = "[-] ERROR: Must supply logfile name." fullword ascii
        $s6 = "[-] There is a error...Create a new connection." fullword ascii
        $s7 = "[+] Accept a Client on port %d from %s" fullword ascii
        $s8 = "======================== htran V%s =======================" fullword ascii
        $s9 = "[-] Socket Listen error." fullword ascii
        $s10 = "[-] ERROR: open logfile" fullword ascii
        $s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s12 = "[+] Make a Connection to %s:%d ......" fullword ascii
        $s14 = "Recv %5d bytes from %s:%d" fullword asc

Detection condition:
10 of them

Full rule:
rule Anthem_DeepPanda_htran_exe
{

    meta:
        description = "Anthem Hack Deep Panda - htran-exe"
        author = "Florian Roth"
        date = "2015/02/08"
        hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"

    strings:
        $s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
        $s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
        $s2 = "e:\\VS 2008 Project\\htran\\Release\\htran.pdb" fullword ascii
        $s3 = "[SERVER]connection to %s:%d error" fullword ascii
        $s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s5 = "[-] ERROR: Must supply logfile name." fullword ascii
        $s6 = "[-] There is a error...Create a new connection." fullword ascii
        $s7 = "[+] Accept a Client on port %d from %s" fullword ascii
        $s8 = "======================== htran V%s =======================" fullword ascii
        $s9 = "[-] Socket Listen error." fullword ascii
        $s10 = "[-] ERROR: open logfile" fullword ascii
        $s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
        $s12 = "[+] Make a Connection to %s:%d ......" fullword ascii
        $s14 = "Recv %5d bytes from %s:%d" fullword ascii
        $s15 = "[+] OK! I Closed The Two Socket." fullword ascii
        $s16 = "[+] Waiting another Client on port:%d...." fullword ascii
        $s17 = "[+] Accept a Client on port %d from %s ......" fullword ascii
        $s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii

    condition:
        10 of them
}
YARA Detection Rule: Anthem_DeepPanda_Trojan_Kakfum
Repository: Yara-Rules/rules
Detects: Anthem Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll
Author: Florian Roth

Pattern signatures:
$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
        $s1 = "%s\\sqlsrv32.dll" fullword ascii
        $s2 = "%s\\sqlsrv64.dll" fullword ascii
        $s3 = "%s\\%d.tmp" fullword ascii
        $s4 = "ServiceMaix" fullword ascii
        $s15 = "sqlserver" fullword ascii

Detection condition:
all of them

Full rule:
rule Anthem_DeepPanda_Trojan_Kakfum
{

    meta:
        description = "Anthem Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
        author = "Florian Roth"
        date = "2015/02/08"
        hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
        hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"

    strings:
        $s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
        $s1 = "%s\\sqlsrv32.dll" fullword ascii
        $s2 = "%s\\sqlsrv64.dll" fullword ascii
        $s3 = "%s\\%d.tmp" fullword ascii
        $s4 = "ServiceMaix" fullword ascii
        $s15 = "sqlserver" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: SnakeRansomware
Repository: Yara-Rules/rules
Detects: A yara rule to catch snake ransomware
Author: Nishan Maharjan
Reference: https://medium.com/@nishanmaharjan17/malware-analysis-snake-ransomware-a0e66f487017

Pattern signatures:
$go_build_id = "Go build ID: \"X6lNEpDhc_qgQl56x4du/fgVJOqLlPCCIekQhFnHL/rkxe6tXCg56Ez88otHrz/Y-lXW-OhiIbzg3-ioGRz\""
        $math_rand_seed_calling = { 89 C8 BB 00 CA 9A 3B 89 D1 F7 E3 81 E1 FF FF FF 3F 89 C3 01 C8 89 C6 05 00 00 1A 3D 89 04 24 69 ED 00 CA 9A 3B 01 EA 89 CD C1 F9 1F 01 EB 11 CA 81 C6 00 00 1A 3D 81 D2 EB 03 B2 A1 89 54 24 04 E8 10 62 F6 FF }
        $encryption_function = {64 8B 0D 14 00 00 00 8B 89 00 00 00 00 3B 61 08 0F 86 38 01 00 00 83 EC 3C E8 32 1A F3 FF 8D 7C 24 28 89 E6 E8 25 EA F0 FF 8B 44 24 2C 8B 4C 24 28 89 C2 C1 E8 1F C1 E0 1F 85 C0 0F 84 FC 00 00 00 D1 E2 89 CB C1 E9 1F 09 D1 89 DA D1 E3 C1 EB 1F 89 CD D1 E1 09 D9 89 CB 81 C1 80 7F B1 D7 C1 ED 1F 81 C3 80 7F B1 D7 83 D5 0D 89 C8 BB 00 CA 9A 3B 89 D1 F7 E3 81 E1 FF FF FF 3F 89 C3 01 C8 89 C6 05 00 00 1A 3D 89 04 24 69 ED 00 CA 9A 3B 01 EA 89 CD C1 F9 1F 01 EB 11 CA 81 C6 00 00 1A 3D 81 D2 EB 03 B2 A1 89 54 24 04 E8 10 62 F6 FF 31 C0 EB 79 89 44 24 20 8B 4C 24 40 8D 14 C1 8B 1A 89 5C 24 24 8B 52 04 89 54

Detection condition:
all of them

Full rule:
rule SnakeRansomware
{
    meta:
        Author = "Nishan Maharjan"
        Description = "A yara rule to catch snake ransomware"
        Reference = "https://medium.com/@nishanmaharjan17/malware-analysis-snake-ransomware-a0e66f487017"
        Data = "15th May 2020"
    strings:
        $go_build_id = "Go build ID: \"X6lNEpDhc_qgQl56x4du/fgVJOqLlPCCIekQhFnHL/rkxe6tXCg56Ez88otHrz/Y-lXW-OhiIbzg3-ioGRz\""
        $math_rand_seed_calling = { 89 C8 BB 00 CA 9A 3B 89 D1 F7 E3 81 E1 FF FF FF 3F 89 C3 01 C8 89 C6 05 00 00 1A 3D 89 04 24 69 ED 00 CA 9A 3B 01 EA 89 CD C1 F9 1F 01 EB 11 CA 81 C6 00 00 1A 3D 81 D2 EB 03 B2 A1 89 54 24 04 E8 10 62 F6 FF }
        $encryption_function = {64 8B 0D 14 00 00 00 8B 89 00 00 00 00 3B 61 08 0F 86 38 01 00 00 83 EC 3C E8 32 1A F3 FF 8D 7C 24 28 89 E6 E8 25 EA F0 FF 8B 44 24 2C 8B 4C 24 28 89 C2 C1 E8 1F C1 E0 1F 85 C0 0F 84 FC 00 00 00 D1 E2 89 CB C1 E9 1F 09 D1 89 DA D1 E3 C1 EB 1F 89 CD D1 E1 09 D9 89 CB 81 C1 80 7F B1 D7 C1 ED 1F 81 C3 80 7F B1 D7 83 D5 0D 89 C8 BB 00 CA 9A 3B 89 D1 F7 E3 81 E1 FF FF FF 3F 89 C3 01 C8 89 C6 05 00 00 1A 3D 89 04 24 69 ED 00 CA 9A 3B 01 EA 89 CD C1 F9 1F 01 EB 11 CA 81 C6 00 00 1A 3D 81 D2 EB 03 B2 A1 89 54 24 04 E8 10 62 F6 FF 31 C0 EB 79 89 44 24 20 8B 4C 24 40 8D 14 C1 8B 1A 89 5C 24 24 8B 52 04 89 54 24 1C C7 04 24 05 00 00 00 E8 48 FE FF FF 8B 44 24 08 8B 4C 24 04 C7 04 24 00 00 00 00 8B 54 24 24 89 54 24 04 8B 5C 24 1C 89 5C 24 08 89 4C 24 0C 89 44 24 10 E8 EC DD EF FF 8B 44 24 18 8B 4C 24 14 89 4C 24 08 89 44 24 0C 8B 44 24 24 89 04 24 8B 44 24 1C 89 44 24 04 E8 68 BB F3 FF 8B 44 24 20 40}
    condition:
        all of them     
}
YARA Detection Rule: Carbanak_0915_1
Repository: Yara-Rules/rules
Detects: Carbanak Malware
Author: Florian Roth
Reference: https://www.csis.dk/en/csis/blog/4710/

Pattern signatures:
$s1 = "evict1.pdb" fullword ascii
        $s2 = "http://testing.corp 0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 1 of them

Full rule:
rule Carbanak_0915_1
{

    meta:
        description = "Carbanak Malware"
        author = "Florian Roth"
        reference = "https://www.csis.dk/en/csis/blog/4710/"
        date = "2015-09-03"
        score = 70

    strings:
        $s1 = "evict1.pdb" fullword ascii
        $s2 = "http://testing.corp 0" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and 1 of them
}
YARA Detection Rule: Carbanak_0915_2
Repository: Yara-Rules/rules
Detects: Carbanak Malware
Author: Florian Roth
Reference: https://www.csis.dk/en/csis/blog/4710/

Pattern signatures:
$x1 = "8Rkzy.exe" fullword wide
        $s1 = "Export Template" fullword wide
        $s2 = "Session folder with name '%s' already exists." fullword ascii
        $s3 = "Show Unconnected Endpoints (Ctrl+U)" fullword ascii
        $s4 = "Close All Documents" fullword wide
        $s5 = "Add &Resource" fullword ascii
        $s6 = "PROCEXPLORER" fullword wide /* Goodware String - occured 1 times */
        $s7 = "AssocQueryKeyA" fullword ascii /* Goodware String - occured 4 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and ( $x1 or all of ($s*) )

Full rule:
rule Carbanak_0915_2
{

    meta:
        description = "Carbanak Malware"
        author = "Florian Roth"
        reference = "https://www.csis.dk/en/csis/blog/4710/"
        date = "2015-09-03"
        score = 70

    strings:
        $x1 = "8Rkzy.exe" fullword wide
        $s1 = "Export Template" fullword wide
        $s2 = "Session folder with name '%s' already exists." fullword ascii
        $s3 = "Show Unconnected Endpoints (Ctrl+U)" fullword ascii
        $s4 = "Close All Documents" fullword wide
        $s5 = "Add &Resource" fullword ascii
        $s6 = "PROCEXPLORER" fullword wide /* Goodware String - occured 1 times */
        $s7 = "AssocQueryKeyA" fullword ascii /* Goodware String - occured 4 times */
    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and ( $x1 or all of ($s*) )
}