deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Sofacy_Bundestag_Mal3
Repository: Yara-Rules/rules
Detects: Sofacy Group Malware Sample 3
Author: Florian Roth
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii 
        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii 
        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii 
        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii 
        $s5 = ".winnt.check-fix.com" fullword ascii 
        $s6 = ".update.adobeincorp.com" fullword ascii 
        $s7 = ".microsoft.checkwinframe.com" fullword ascii
        $s8 = "adobeincorp.com" fullword wide 
        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii 
        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide 
        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide 
        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and ( 2 of ($s*) or ( 1 of ($s*) and all of ($x*) ))

Full rule:
rule Sofacy_Bundestag_Mal3 
{

    meta:
        description = "Sofacy Group Malware Sample 3"
        author = "Florian Roth"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
        score = 70
   
    strings:
        $s1 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" fullword ascii 
        $s2 = ".?AVAgentModuleRemoteKeyLogger@@" fullword ascii 
        $s3 = "<font size=4 color=red>process isn't exist</font>" fullword ascii 
        $s4 = "<font size=4 color=red>process is exist</font>" fullword ascii 
        $s5 = ".winnt.check-fix.com" fullword ascii 
        $s6 = ".update.adobeincorp.com" fullword ascii 
        $s7 = ".microsoft.checkwinframe.com" fullword ascii
        $s8 = "adobeincorp.com" fullword wide 
        $s9 = "# EXC: HttpSender - Cannot create Get Channel!" fullword ascii 
        $x1 = "User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/" wide 
        $x2 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2" wide 
        $x3 = "C:\\Windows\\System32\\cmd.exe" fullword wide 
   
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and ( 2 of ($s*) or ( 1 of ($s*) and all of ($x*) )) 
}
YARA Detection Rule: Sofacy_Bundestag_Batch
Repository: Yara-Rules/rules
Detects: Sofacy Bundestags APT Batch Script
Author: Florian Roth
Reference: http://dokumente.linksfraktion.de/inhalt/report-orig.pdf

Pattern signatures:
$s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx) do (" ascii 
        $s2 = "cmd /c copy"
        $s3 = "forfiles"

Detection condition:
filesize < 10KB and all of them

Full rule:
rule Sofacy_Bundestag_Batch 
{

    meta:
        description = "Sofacy Bundestags APT Batch Script"
        author = "Florian Roth"
        reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
        date = "2015-06-19"
        score = 70
 
    strings:
        $s1 = "for %%G in (.pdf, .xls, .xlsx, .doc, .docx) do (" ascii 
        $s2 = "cmd /c copy"
        $s3 = "forfiles"
  
    condition:
        filesize < 10KB and all of them
}
YARA Detection Rule: fromCharCode_in_unicode
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\u0066\\u0072\\u006f\\u006d\\u0043\\u0068\\u0061\\u0072\\u0043\\u006f\\u0064\\u0065"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule fromCharCode_in_unicode {
    strings: 
        $ = "\\u0066\\u0072\\u006f\\u006d\\u0043\\u0068\\u0061\\u0072\\u0043\\u006f\\u0064\\u0065"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: function_through_object
Repository: Yara-Rules/rules

Pattern signatures:
$ = "['eval']"
        $ = "['unescape']"
        $ = "['charCodeAt']"
        $ = "['fromCharCode']"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule function_through_object {
    strings: 
        $ = "['eval']"
        $ = "['unescape']"
        $ = "['charCodeAt']"
        $ = "['fromCharCode']"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: hex_script
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x73\\x63\\x72\\x69\\x70\\x74\\x22"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule hex_script {
    strings:
        $ = "\\x73\\x63\\x72\\x69\\x70\\x74\\x22"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: php_malfunctions
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval("
        $ = "gzinflate("
        $ = "str_rot13("
        $ = "base64_decode("

Detection condition:
3 of them and filesize < 500KB

Full rule:
rule php_malfunctions {
    strings:
        $ = "eval("
        $ = "gzinflate("
        $ = "str_rot13("
        $ = "base64_decode("
    condition: 
        3 of them and filesize < 500KB
}
YARA Detection Rule: php_obf_malfunctions
Repository: Yara-Rules/rules

Pattern signatures:
$ = "eval(base64_decode"
        $ = "eval(gzinflate"
        $ = "str_rot13(base64_decode"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule php_obf_malfunctions {
    strings:
        $ = "eval(base64_decode"
        $ = "eval(gzinflate"
        $ = "str_rot13(base64_decode"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: fopo_obfuscator
Repository: Yara-Rules/rules

Pattern signatures:
$ = "www.fopo.com.ar"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule fopo_obfuscator {
    strings:
        $ = "www.fopo.com.ar"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: obf_base64_decode
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x62\\x61\\x73\\145\\x36\\x34\\x5f\\x64\\x65\\143\\x6f\\144\\145"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule obf_base64_decode {
    strings: 
        $ = "\\x62\\x61\\x73\\145\\x36\\x34\\x5f\\x64\\x65\\143\\x6f\\144\\145"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: html_upload
Repository: Yara-Rules/rules

Pattern signatures:
$ = "<input type='submit' name='upload' value='upload'>"
        $ = "if($_POST['upload'])"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule html_upload {
    strings: 
        $ = "<input type='submit' name='upload' value='upload'>"
        $ = "if($_POST['upload'])"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: php_uname
Repository: Yara-Rules/rules

Pattern signatures:
$ = "php_uname()"

Detection condition:
any of them and filesize < 500KB

Full rule:
rule php_uname {
    strings: 
        $ = "php_uname()"
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: scriptkiddies
Repository: Yara-Rules/rules

Pattern signatures:
$ = "lastc0de@Outlook.com" nocase
        $ = "CodersLeet" nocase
        $ = "AgencyCaFc" nocase
        $ = "IndoXploit" nocase
        $ = "Kapaljetz666" nocase

Detection condition:
any of them and filesize < 500KB

Full rule:
rule scriptkiddies {
    strings:
        $ = "lastc0de@Outlook.com" nocase
        $ = "CodersLeet" nocase
        $ = "AgencyCaFc" nocase
        $ = "IndoXploit" nocase
        $ = "Kapaljetz666" nocase
    condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: eval_with_comments
Repository: Yara-Rules/rules

Pattern signatures:
$ = /(^|\s)eval\s*\/\*.{,128}\*\/\s*\(/

Detection condition:
any of them and filesize < 500KB

Full rule:
rule eval_with_comments {
	strings:
		$ = /(^|\s)eval\s*\/\*.{,128}\*\/\s*\(/
	condition: 
        any of them and filesize < 500KB
}
YARA Detection Rule: MacControlCode
Repository: Yara-Rules/rules
Detects: MacControl code tricks
Author: Seth Hardy

Pattern signatures:
// Load these function strings 4 characters at a time. These check the first two blocks:
        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }

Detection condition:
all of ($L4*) or $GEThgif

Full rule:
rule MacControlCode : MacControl Family 
{
    meta:
        description = "MacControl code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-17"
        
    strings:
        // Load these function strings 4 characters at a time. These check the first two blocks:
        $L4_Accept = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 3A 20 }
        $L4_AcceptLang = { C7 ?? 41 63 63 65 C7 ?? 04 70 74 2D 4C }
        $L4_Pragma = { C7 ?? 50 72 61 67 C7 ?? 04 6D 61 3A 20 }
        $L4_Connection = { C7 ?? 43 6F 6E 6E C7 ?? 04 65 63 74 69 }
        $GEThgif = { C7 ?? 47 45 54 20 C7 ?? 04 2F 68 2E 67 }
        
    condition:
        all of ($L4*) or $GEThgif
}
YARA Detection Rule: MacControlStrings
Repository: Yara-Rules/rules
Detects: MacControl Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "HTTPHeadGet"
        $ = "/Library/launched"
        $ = "My connect error with no ip!"
        $ = "Send File is Failed"
        $ = "****************************You Have got it!****************************"

Detection condition:
any of them

Full rule:
rule MacControlStrings : MacControl Family
{
    meta:
        description = "MacControl Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-17"
        
    strings:
        $ = "HTTPHeadGet"
        $ = "/Library/launched"
        $ = "My connect error with no ip!"
        $ = "Send File is Failed"
        $ = "****************************You Have got it!****************************"
        
    condition:
        any of them
}
YARA Detection Rule: MacControl
Repository: Yara-Rules/rules
Detects: MacControl
Author: Seth Hardy

Detection condition:
MacControlCode or MacControlStrings

Full rule:
rule MacControl : Family
{
    meta:
        description = "MacControl"
        author = "Seth Hardy"
        last_modified = "2014-06-16"
        
    condition:
        MacControlCode or MacControlStrings
}
YARA Detection Rule: onepage_or_checkout
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x6F\\x6E\\x65\\x70\\x61\\x67\\x65\\x7C\\x63\\x68\\x65\\x63\\x6B\\x6F\\x75\\x74"

Detection condition:
any of them

Full rule:
rule onepage_or_checkout {
    strings: $ = "\\x6F\\x6E\\x65\\x70\\x61\\x67\\x65\\x7C\\x63\\x68\\x65\\x63\\x6B\\x6F\\x75\\x74"
    condition: any of them
}
YARA Detection Rule: sinlesspleasure_com
Repository: Yara-Rules/rules

Pattern signatures:
$ = "5e908r948q9e605j8t9b915n5o9f8r5e5d969g9d795b4s6p8t9h9f978o8p8s9590936l6k8j9670524p7490915l5f8r90878t917f7g8p8o8p8k9c605i8d937t7m8i8q8o8q959h7p828e7r8e7q7e8m8o5g5e9199918o9g7q7c8c8t99905a5i8l94989h7r7g8i8t8m5f5o92917q7k9i9e948c919h925a5d8j915h608t8p8t9f937b7k9i9e948c919h92"

Detection condition:
any of them

Full rule:
rule sinlesspleasure_com {
    strings: $ = "5e908r948q9e605j8t9b915n5o9f8r5e5d969g9d795b4s6p8t9h9f978o8p8s9590936l6k8j9670524p7490915l5f8r90878t917f7g8p8o8p8k9c605i8d937t7m8i8q8o8q959h7p828e7r8e7q7e8m8o5g5e9199918o9g7q7c8c8t99905a5i8l94989h7r7g8i8t8m5f5o92917q7k9i9e948c919h925a5d8j915h608t8p8t9f937b7k9i9e948c919h92"
    condition: any of them
}
YARA Detection Rule: amasty_biz
Repository: Yara-Rules/rules

Pattern signatures:
$ = "118,97,114,32,115,110,100,32,61,110,117,108,108,59,10,10,102,117"

Detection condition:
any of them

Full rule:
rule amasty_biz {
    strings: $ = "118,97,114,32,115,110,100,32,61,110,117,108,108,59,10,10,102,117"
    condition: any of them
}
YARA Detection Rule: amasty_biz_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "t_p#0.qlb#0.#1Blsjj#1@#.?#.?dslargml#0.qr_pr#06#07#5@#.?#0"

Detection condition:
any of them

Full rule:
rule amasty_biz_js {
    strings: $ = "t_p#0.qlb#0.#1Blsjj#1@#.?#.?dslargml#0.qr_pr#06#07#5@#.?#0"
    condition: any of them
}
YARA Detection Rule: returntosender
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x2F\\x6D\\x65\\x64\\x69\\x61\\x2F\\x63\\x61\\x74\\x61\\x6C\\x6F\\x67\\x2F\\x70\\x72\\x6F\\x64\\x75\\x63\\x74\\x2F\\x63\\x61\\x63\\x68\\x65\\x2F\\x31\\x2F\\x74\\x68\\x75\\x6D\\x62\\x6E\\x61\\x69\\x6C\\x2F\\x37\\x30\\x30\\x78\\x2F\\x32\\x62\\x66\\x38\\x66\\x32\\x62\\x38\\x64\\x30\\x32\\x38\\x63\\x63\\x65\\x39\\x36\\x2F\\x42\\x2F\\x57\\x2F\\x64\\x61\\x34\\x31\\x38\\x30\\x33\\x63\\x63\\x39\\x38\\x34\\x62\\x38\\x63\\x2E\\x70\\x68\\x70"

Detection condition:
any of them

Full rule:
rule returntosender {
    strings: $ = "\\x2F\\x6D\\x65\\x64\\x69\\x61\\x2F\\x63\\x61\\x74\\x61\\x6C\\x6F\\x67\\x2F\\x70\\x72\\x6F\\x64\\x75\\x63\\x74\\x2F\\x63\\x61\\x63\\x68\\x65\\x2F\\x31\\x2F\\x74\\x68\\x75\\x6D\\x62\\x6E\\x61\\x69\\x6C\\x2F\\x37\\x30\\x30\\x78\\x2F\\x32\\x62\\x66\\x38\\x66\\x32\\x62\\x38\\x64\\x30\\x32\\x38\\x63\\x63\\x65\\x39\\x36\\x2F\\x42\\x2F\\x57\\x2F\\x64\\x61\\x34\\x31\\x38\\x30\\x33\\x63\\x63\\x39\\x38\\x34\\x62\\x38\\x63\\x2E\\x70\\x68\\x70"
    condition: any of them
}
YARA Detection Rule: ip_5uu8_com
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x69\\x70\\x2e\\x35\\x75\\x75\\x38\\x2e\\x63\\x6f\\x6d"

Detection condition:
any of them

Full rule:
rule ip_5uu8_com {
    strings: $ = "\\x69\\x70\\x2e\\x35\\x75\\x75\\x38\\x2e\\x63\\x6f\\x6d"
    condition: any of them
}
YARA Detection Rule: cloudfusion_me
Repository: Yara-Rules/rules

Pattern signatures:
$ = "&#99;&#108;&#111;&#117;&#100;&#102;&#117;&#115;&#105;&#111;&#110;&#46;&#109;&#101;"

Detection condition:
any of them

Full rule:
rule cloudfusion_me {
    strings: $ = "&#99;&#108;&#111;&#117;&#100;&#102;&#117;&#115;&#105;&#111;&#110;&#46;&#109;&#101;"
    condition: any of them
}
YARA Detection Rule: grelos_v
Repository: Yara-Rules/rules

Pattern signatures:
$ = "var grelos_v"

Detection condition:
any of them

Full rule:
rule grelos_v {
    strings: $ = "var grelos_v"
    condition: any of them
}
YARA Detection Rule: hacked_domains
Repository: Yara-Rules/rules

Pattern signatures:
$ = "infopromo.biz"
        $ = "jquery-code.su"
        $ = "jquery-css.su"
        $ = "megalith-games.com"
        $ = "cdn-cloud.pw"
        $ = "animalzz921.pw"
        $ = "statsdot.eu"

Detection condition:
any of them

Full rule:
rule hacked_domains {
    strings: 
        $ = "infopromo.biz"
        $ = "jquery-code.su"
        $ = "jquery-css.su"
        $ = "megalith-games.com"
        $ = "cdn-cloud.pw"
        $ = "animalzz921.pw"
        $ = "statsdot.eu"
    condition: any of them
}
YARA Detection Rule: mage_cdn_link
Repository: Yara-Rules/rules

Pattern signatures:
$ = "\\x6D\\x61\\x67\\x65\\x2D\\x63\\x64\\x6E\\x2E\\x6C\\x69\\x6E\\x6B"

Detection condition:
any of them

Full rule:
rule mage_cdn_link {
    strings: $ = "\\x6D\\x61\\x67\\x65\\x2D\\x63\\x64\\x6E\\x2E\\x6C\\x69\\x6E\\x6B"
    condition: any of them
}
YARA Detection Rule: credit_card_regex
Repository: Yara-Rules/rules

Pattern signatures:
$ = "RegExp(\"[0-9]{13,16}\")"

Detection condition:
any of them

Full rule:
rule credit_card_regex {
    strings: $ = "RegExp(\"[0-9]{13,16}\")"
    condition: any of them
}
YARA Detection Rule: jquery_code_su
Repository: Yara-Rules/rules

Pattern signatures:
$ = "105,102,40,40,110,101,119,32,82,101,103,69,120,112,40,39,111,110,101,112,97,103,101"

Detection condition:
any of them

Full rule:
rule jquery_code_su {
    strings: $ = "105,102,40,40,110,101,119,32,82,101,103,69,120,112,40,39,111,110,101,112,97,103,101"
    condition: any of them
}
YARA Detection Rule: jquery_code_su_multi
Repository: Yara-Rules/rules

Pattern signatures:
$ = "=oQKpkyJ8dCK0lGbwNnLn42bpRXYj9GbENDft12bkBjM8V2Ypx2c8Rnbl52bw12bDlkUVVGZvNWZkZ0M85WavpGfsJXd8R1UPB1NywXZtFmb0N3box"

Detection condition:
any of them

Full rule:
rule jquery_code_su_multi {
    strings: $ = "=oQKpkyJ8dCK0lGbwNnLn42bpRXYj9GbENDft12bkBjM8V2Ypx2c8Rnbl52bw12bDlkUVVGZvNWZkZ0M85WavpGfsJXd8R1UPB1NywXZtFmb0N3box"
    condition: any of them
}
YARA Detection Rule: Trafficanalyzer_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "z=x['length'];for(i=0;i<z;i++){y+=String['fromCharCode'](x['charCodeAt'](i)-10) }w=this['unescape'](y);this['eval'](w);"

Detection condition:
any of them

Full rule:
rule Trafficanalyzer_js {
    strings: $ = "z=x['length'];for(i=0;i<z;i++){y+=String['fromCharCode'](x['charCodeAt'](i)-10) }w=this['unescape'](y);this['eval'](w);"
    condition: any of them
}
YARA Detection Rule: atob_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "this['eval'](this['atob']('"

Detection condition:
any of them

Full rule:
rule atob_js {
    strings: $ = "this['eval'](this['atob']('"
    condition: any of them
}
YARA Detection Rule: gate_php_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = /\/gate.php\?token=.{,10}&host=/

Detection condition:
any of them

Full rule:
rule gate_php_js {
    /* token=KjsS29Msl&host= */
    strings: 
		$ = /\/gate.php\?token=.{,10}&host=/
    condition: any of them
}
YARA Detection Rule: googieplay_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "tdsjqu!tsd>#iuuq;00hpphjfqmbz/jogp0nbhfoup`hpphjfqmbz/kt#?=0tdsjqu?"

Detection condition:
any of them

Full rule:
rule googieplay_js {
    strings: $ = "tdsjqu!tsd>#iuuq;00hpphjfqmbz/jogp0nbhfoup`hpphjfqmbz/kt#?=0tdsjqu?"
    condition: any of them
}
YARA Detection Rule: mag_php_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "onepage|checkout|onestep|firecheckout|onestepcheckout"
        $ = "'one|check'"

Detection condition:
any of them

Full rule:
rule mag_php_js {
    strings: 
        $ = "onepage|checkout|onestep|firecheckout|onestepcheckout"
        $ = "'one|check'"
    condition: any of them
}
YARA Detection Rule: thetech_org_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "|RegExp|onepage|checkout|"

Detection condition:
any of them

Full rule:
rule thetech_org_js {
    strings: $ = "|RegExp|onepage|checkout|"
    condition: any of them
}
YARA Detection Rule: md5_cdn_js_link_js
Repository: Yara-Rules/rules

Pattern signatures:
$ = "grelos_v= null"

Detection condition:
any of them

Full rule:
rule md5_cdn_js_link_js {
    strings: $ = "grelos_v= null"
    condition: any of them
}
YARA Detection Rule: Wabot
Repository: Yara-Rules/rules
Detects: Wabot Trojan Worm
Author: Kevin Falcoz

Pattern signatures:
$signature1={43 3A 5C 6D 61 72 69 6A 75 61 6E 61 2E 74 78 74}
		$signature2={73 49 52 43 34}

Detection condition:
$signature1 and $signature2

Full rule:
rule Wabot : Worm
{
	meta:
		author="Kevin Falcoz"
		date="14/08/2015"
		description="Wabot Trojan Worm"

	strings:
		$signature1={43 3A 5C 6D 61 72 69 6A 75 61 6E 61 2E 74 78 74}
		$signature2={73 49 52 43 34}

	condition:
		$signature1 and $signature2
}
YARA Detection Rule: Petya_Ransomware
Repository: Yara-Rules/rules
Detects: Detects Petya Ransomware
Author: Florian Roth
Reference: http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html

Pattern signatures:
$a1 = "<description>WinRAR SFX module</description>" fullword ascii

		$s1 = "BX-Proxy-Manual-Auth" fullword wide
		$s2 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
		$s3 = "X-HTTP-Attempts" fullword wide
		$s4 = "@CommandLineMode" fullword wide
		$s5 = "X-Retry-After" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and $a1 and 3 of ($s*)

Full rule:
rule Petya_Ransomware {
	meta:
		description = "Detects Petya Ransomware"
		author = "Florian Roth"
		reference = "http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html"
		date = "2016-03-24"
		hash = "26b4699a7b9eeb16e76305d843d4ab05e94d43f[PII_REDACTED]e13b3ebafa90739"
	strings:
		$a1 = "<description>WinRAR SFX module</description>" fullword ascii

		$s1 = "BX-Proxy-Manual-Auth" fullword wide
		$s2 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
		$s3 = "X-HTTP-Attempts" fullword wide
		$s4 = "@CommandLineMode" fullword wide
		$s5 = "X-Retry-After" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and $a1 and 3 of ($s*)
}
YARA Detection Rule: Ransom_Petya
Repository: Yara-Rules/rules
Detects: Regla para detectar Ransom.Petya con md5 AF2379CC4D607A45AC44D62135FB7015
Author: CCN-CERT

Pattern signatures:
$a1 = { C1 C8 14 2B F0 03 F0 2B F0 03 F0 C1 C0 14 03 C2 }
    $a2 = { 46 F7 D8 81 EA 5A 93 F0 12 F7 DF C1 CB 10 81 F6 }
    $a3 = { 0C 88 B9 07 87 C6 C1 C3 01 03 C5 48 81 C3 A3 01 00 00 }

Detection condition:
all of them

Full rule:
rule Ransom_Petya {
meta:
    description = "Regla para detectar Ransom.Petya con md5 AF2379CC4D607A45AC44D62135FB7015"
    author = "CCN-CERT"
    version = "1.0"
strings:
    $a1 = { C1 C8 14 2B F0 03 F0 2B F0 03 F0 C1 C0 14 03 C2 }
    $a2 = { 46 F7 D8 81 EA 5A 93 F0 12 F7 DF C1 CB 10 81 F6 }
    $a3 = { 0C 88 B9 07 87 C6 C1 C3 01 03 C5 48 81 C3 A3 01 00 00 }
condition:
    all of them
}
YARA Detection Rule: PoetRat_Doc
Repository: Yara-Rules/rules
Detects: A yara rule to catch PoetRat Word Document
Author: Nishan Maharjan

Pattern signatures:
$pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings

        // Python file strings in the word documents
        $pythonFile1 = "launcher.py"
        $zipFile = "smile.zip"
        $pythonFile2 = "smile_funs.py"
        $pythonFile3 = "frown.py"
        $pythonFile4 = "backer.py"
        $pythonFile5 = "smile.py"
        $pythonFile6 = "affine.py" 

        // dlls and cmd strings
        $dlls = /\.dll/
        $cmd = "cmd"
        $exe = ".exe"

Detection condition:
all of them

Full rule:
rule PoetRat_Doc
{
    meta:
        Author = "Nishan Maharjan"
        Description = "A yara rule to catch PoetRat Word Document"
        Data = "6th May 2020"
    strings:
        $pythonRegEx = /(\.py$|\.pyc$|\.pyd$|Python)/  // checking for python strings

        // Python file strings in the word documents
        $pythonFile1 = "launcher.py"
        $zipFile = "smile.zip"
        $pythonFile2 = "smile_funs.py"
        $pythonFile3 = "frown.py"
        $pythonFile4 = "backer.py"
        $pythonFile5 = "smile.py"
        $pythonFile6 = "affine.py" 

        // dlls and cmd strings
        $dlls = /\.dll/
        $cmd = "cmd"
        $exe = ".exe"   
    condition:
    all of them        
}