deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Regin_Sample_1
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file-3665415_sys
Author: @MalwrSignatures

Pattern signatures:
$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
        $s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
        $s2 = "External Naming Failed - Status %x" fullword ascii
        $s3 = "------- Same multiport - different interrupts" fullword ascii
        $s4 = "%x occurred prior to the wait - starting the" fullword ascii
        $s5 = "'user registry info - userPortIndex: %d" fullword ascii
        $s6 = "Could not report legacy device - %x" fullword ascii
        $s7 = "entering SerialGetPortInfo" fullword ascii
        $s8 = "'user registry info - userPort: %x" fullword ascii
        $s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
        $s10 = "Kernel debugger is using port at address %X" fullword ascii
        $s12 = "Release - freeing multi context" fullword ascii
        $s13 = "Serial driver will not load port" fullword ascii
        $s14 = "'user registry info - userAddressSpace: %d" fullword ascii
        $s15 = "SerialAd

Detection condition:
all of them and filesize < 110KB and filesize > 80KB

Full rule:
rule Regin_Sample_1 
{

    meta:
        description = "Auto-generated rule - file-3665415_sys"
        author = "@MalwrSignatures"
        date = "26.11.14"
        hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"

    strings:
        $s0 = "Getting PortName/Identifier failed - %x" fullword ascii
        $s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
        $s2 = "External Naming Failed - Status %x" fullword ascii
        $s3 = "------- Same multiport - different interrupts" fullword ascii
        $s4 = "%x occurred prior to the wait - starting the" fullword ascii
        $s5 = "'user registry info - userPortIndex: %d" fullword ascii
        $s6 = "Could not report legacy device - %x" fullword ascii
        $s7 = "entering SerialGetPortInfo" fullword ascii
        $s8 = "'user registry info - userPort: %x" fullword ascii
        $s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
        $s10 = "Kernel debugger is using port at address %X" fullword ascii
        $s12 = "Release - freeing multi context" fullword ascii
        $s13 = "Serial driver will not load port" fullword ascii
        $s14 = "'user registry info - userAddressSpace: %d" fullword ascii
        $s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
        $s20 = "'user registry info - userIndexed: %d" fullword ascii

    condition:
        all of them and filesize < 110KB and filesize > 80KB
}
YARA Detection Rule: Regin_Sample_2
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin
Author: @MalwrSignatures

Pattern signatures:
$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" fullword wide
        $s1 = "atapi.sys" fullword wide
        $s2 = "disk.sys" fullword wide
        $s3 = "IoGetRelatedDeviceObject" fullword ascii
        $s4 = "HAL.dll" fullword ascii
        $s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" fullword ascii
        $s6 = "PsGetCurrentProcessId" fullword ascii
        $s7 = "KeGetCurrentIrql" fullword ascii
        $s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
        $s9 = "KeSetImportanceDpc" fullword ascii
        $s10 = "KeQueryPerformanceCounter" fullword ascii
        $s14 = "KeInitializeEvent" fullword ascii
        $s15 = "KeDelayExecutionThread" fullword ascii
        $s16 = "KeInitializeTimerEx" fullword ascii
        $s18 = "PsLookupProcessByProcessId" fullword ascii
        $s19 = "ExReleaseFastMutexUnsafe" fullword ascii
        $s20 = "ExAcquireFastMutexUnsafe" fullword ascii

Detection condition:
all of them and filesize < 40KB and filesize > 30KB

Full rule:
rule Regin_Sample_2 
{

    meta:
        description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
        author = "@MalwrSignatures"
        date = "26.11.14"
        hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"

    strings:
        $s0 = "\\SYSTEMROOT\\system32\\lsass.exe" fullword wide
        $s1 = "atapi.sys" fullword wide
        $s2 = "disk.sys" fullword wide
        $s3 = "IoGetRelatedDeviceObject" fullword ascii
        $s4 = "HAL.dll" fullword ascii
        $s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" fullword ascii
        $s6 = "PsGetCurrentProcessId" fullword ascii
        $s7 = "KeGetCurrentIrql" fullword ascii
        $s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
        $s9 = "KeSetImportanceDpc" fullword ascii
        $s10 = "KeQueryPerformanceCounter" fullword ascii
        $s14 = "KeInitializeEvent" fullword ascii
        $s15 = "KeDelayExecutionThread" fullword ascii
        $s16 = "KeInitializeTimerEx" fullword ascii
        $s18 = "PsLookupProcessByProcessId" fullword ascii
        $s19 = "ExReleaseFastMutexUnsafe" fullword ascii
        $s20 = "ExAcquireFastMutexUnsafe" fullword ascii
    
    condition:
        all of them and filesize < 40KB and filesize > 30KB
}
YARA Detection Rule: Regin_Sample_3
Repository: Yara-Rules/rules
Detects: Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129
Author: @Malwrsignatures

Pattern signatures:
$hd = { fe ba dc fe }
        $s0 = "Service Pack x" fullword wide
        $s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
        $s3 = "mntoskrnl.exe" fullword wide
        $s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" fullword wide
        $s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
        $s6 = "Service Pack" fullword wide
        $s7 = ".sys" fullword wide
        $s8 = ".dll" fullword wide      
        $s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" fullword wide
        $s11 = "IoGetRelatedDeviceObject" fullword ascii
        $s12 = "VMEM.sys" fullword ascii
        $s13 = "RtlGetVersion" fullword wide
        $s14 = "ntkrnlpa.exe" fullword ascii

Detection condition:
( $hd at 0 ) and all of ($s*) and filesize > 160KB and filesize < 200KB

Full rule:
rule Regin_Sample_3 
{

    meta:
        description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
        author = "@Malwrsignatures"
        date = "27.11.14"
        hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"       
   
    strings:
        $hd = { fe ba dc fe }
        $s0 = "Service Pack x" fullword wide
        $s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
        $s3 = "mntoskrnl.exe" fullword wide
        $s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" fullword wide
        $s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
        $s6 = "Service Pack" fullword wide
        $s7 = ".sys" fullword wide
        $s8 = ".dll" fullword wide      
        $s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" fullword wide
        $s11 = "IoGetRelatedDeviceObject" fullword ascii
        $s12 = "VMEM.sys" fullword ascii
        $s13 = "RtlGetVersion" fullword wide
        $s14 = "ntkrnlpa.exe" fullword ascii
   
    condition:
        ( $hd at 0 ) and all of ($s*) and filesize > 160KB and filesize < 200KB
}
YARA Detection Rule: Regin_Sample_Set_1
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file SHF-000052 and ndisips.sys
Author: @MalwrSignatures

Pattern signatures:
$s0 = "HAL.dll" fullword ascii
        $s1 = "IoGetDeviceObjectPointer" fullword ascii
        $s2 = "MaximumPortsServiced" fullword wide
        $s3 = "KeGetCurrentIrql" fullword ascii
        $s4 = "ntkrnlpa.exe" fullword ascii
        $s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
        $s6 = "ConnectMultiplePorts" fullword wide
        $s7 = "\\SYSTEMROOT" fullword wide
        $s8 = "IoWriteErrorLogEntry" fullword ascii
        $s9 = "KeQueryPerformanceCounter" fullword ascii
        $s10 = "KeServiceDescriptorTable" fullword ascii
        $s11 = "KeRemoveEntryDeviceQueue" fullword ascii
        $s12 = "SeSinglePrivilegeCheck" fullword ascii
        $s13 = "KeInitializeEvent" fullword ascii
        $s14 = "IoBuildDeviceIoControlRequest" fullword ascii
        $s15 = "KeRemoveDeviceQueue" fullword ascii
        $s16 = "IofCompleteRequest" fullword ascii
        $s17 = "KeInitializeSpinLock" fullword ascii
        $s18 = "MmIsNonPagedSystemAd

Detection condition:
all of them and filesize < 40KB and filesize > 30KB

Full rule:
rule Regin_Sample_Set_1 
{

    meta:
        description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
        author = "@MalwrSignatures"
        date = "26.11.14"
        hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
        hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"      

    strings:
        $s0 = "HAL.dll" fullword ascii
        $s1 = "IoGetDeviceObjectPointer" fullword ascii
        $s2 = "MaximumPortsServiced" fullword wide
        $s3 = "KeGetCurrentIrql" fullword ascii
        $s4 = "ntkrnlpa.exe" fullword ascii
        $s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
        $s6 = "ConnectMultiplePorts" fullword wide
        $s7 = "\\SYSTEMROOT" fullword wide
        $s8 = "IoWriteErrorLogEntry" fullword ascii
        $s9 = "KeQueryPerformanceCounter" fullword ascii
        $s10 = "KeServiceDescriptorTable" fullword ascii
        $s11 = "KeRemoveEntryDeviceQueue" fullword ascii
        $s12 = "SeSinglePrivilegeCheck" fullword ascii
        $s13 = "KeInitializeEvent" fullword ascii
        $s14 = "IoBuildDeviceIoControlRequest" fullword ascii
        $s15 = "KeRemoveDeviceQueue" fullword ascii
        $s16 = "IofCompleteRequest" fullword ascii
        $s17 = "KeInitializeSpinLock" fullword ascii
        $s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
        $s19 = "IoCreateDevice" fullword ascii
        $s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
   
    condition:
        all of them and filesize < 40KB and filesize > 30KB
}
YARA Detection Rule: Regin_Sample_Set_2
Repository: Yara-Rules/rules
Detects: Detects Regin Backdoor sample[PII_REDACTED]b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be and e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935
Author: @MalwrSignatures

Pattern signatures:
$hd = { fe ba dc fe }    
        $s0 = "d%ls%ls" fullword wide
        $s1 = "\\\\?\\UNC" fullword wide
        $s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
        $s3 = "\\\\?\\UNC\\" fullword wide
        $s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
        $s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
        $s6 = "\\\\.\\Global\\%s" fullword wide
        $s7 = "temp" fullword wide
        $s8 = "\\\\.\\%s" fullword wide
        $s9 = "Memory location: 0x%p, size 0x%08x" fullword wide        
        
        $s10 = "sscanf" fullword ascii
        $s11 = "disp.dll" fullword ascii
        $s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
        $s13 = "%d.%d.%d.%d%c" fullword ascii
        $s14 = "imagehlp.dll" fullword ascii
        $s15 = "%hd %d" fullword ascii

Detection condition:
( $hd at 0 ) and all of ($s*) and filesize < 450KB and filesize > 360KB

Full rule:
rule Regin_Sample_Set_2 
{

    meta:
        description = "Detects Regin Backdoor sample[PII_REDACTED]b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be and e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
        author = "@MalwrSignatures"
        date = "27.11.14"
        hash1 = "[PII_REDACTED]b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
        hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"

    strings:
        $hd = { fe ba dc fe }    
        $s0 = "d%ls%ls" fullword wide
        $s1 = "\\\\?\\UNC" fullword wide
        $s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
        $s3 = "\\\\?\\UNC\\" fullword wide
        $s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
        $s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
        $s6 = "\\\\.\\Global\\%s" fullword wide
        $s7 = "temp" fullword wide
        $s8 = "\\\\.\\%s" fullword wide
        $s9 = "Memory location: 0x%p, size 0x%08x" fullword wide        
        
        $s10 = "sscanf" fullword ascii
        $s11 = "disp.dll" fullword ascii
        $s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
        $s13 = "%d.%d.%d.%d%c" fullword ascii
        $s14 = "imagehlp.dll" fullword ascii
        $s15 = "%hd %d" fullword ascii
   
    condition:
        ( $hd at 0 ) and all of ($s*) and filesize < 450KB and filesize > 360KB
}
YARA Detection Rule: apt_regin_legspin
Repository: Yara-Rules/rules
Detects: Rule to detect Regin's Legspin module
Reference: https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/

Pattern signatures:
$mz="MZ"
        $a1="sharepw"
        $a2="reglist"
        $a3="logdump"
        $a4="Name:" wide
        $a5="Phys Avail:"
        $a6="cmd.exe" wide
        $a7="ping.exe" wide
        $a8="millisecs"

Detection condition:
($mz at 0) and all of ($a*)

Full rule:
rule apt_regin_legspin 
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Regin's Legspin module"
        version = "1.0"
        last_modified = "2015-01-22"
        reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
        md5 = "29105f46e4d33f66fee346cfd099d1cc"

    strings:
        $mz="MZ"
        $a1="sharepw"
        $a2="reglist"
        $a3="logdump"
        $a4="Name:" wide
        $a5="Phys Avail:"
        $a6="cmd.exe" wide
        $a7="ping.exe" wide
        $a8="millisecs"
   
    condition:
        ($mz at 0) and all of ($a*)
}
YARA Detection Rule: apt_regin_hopscotch
Repository: Yara-Rules/rules
Detects: Rule to detect Regin's Hopscotch module
Reference: https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/

Pattern signatures:
$mz="MZ"
        $a1="AuthenticateNetUseIpc"
        $a2="Failed to authenticate to"
        $a3="Failed to disconnect from"
        $a4="%S\\ipc$" wide
        $a5="Not deleting..."
        $a6="CopyServiceToRemoteMachine"
        $a7="DH Exchange failed"
        $a8="ConnectToNamedPipes"

Detection condition:
($mz at 0) and all of ($a*)

Full rule:
rule apt_regin_hopscotch 
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Regin's Hopscotch module"
        version = "1.0"
        last_modified = "2015-01-22"
        reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
        md5 = "6c34031d7a5fc2b091b623981a8ae61c"

    strings:
        $mz="MZ"
        $a1="AuthenticateNetUseIpc"
        $a2="Failed to authenticate to"
        $a3="Failed to disconnect from"
        $a4="%S\\ipc$" wide
        $a5="Not deleting..."
        $a6="CopyServiceToRemoteMachine"
        $a7="DH Exchange failed"
        $a8="ConnectToNamedPipes"
  
    condition:
        ($mz at 0) and all of ($a*)
}
YARA Detection Rule: apt_regin_2011_32bit_stage1
Repository: Yara-Rules/rules
Detects: Rule to detect Regin 32 bit stage 1 loaders

Pattern signatures:
$key1={331015EA261D38A7}
        $key2={9145A98BA37617DE}
        $key3={EF745F23AA67243D}
        $mz="MZ"

Detection condition:
($mz at 0) and any of ($key*) and filesize < 300000

Full rule:
rule apt_regin_2011_32bit_stage1 
{
    
    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Regin 32 bit stage 1 loaders"
        version = "1.0"
        last_modified = "2014-11-18"
    
    strings:
        $key1={331015EA261D38A7}
        $key2={9145A98BA37617DE}
        $key3={EF745F23AA67243D}
        $mz="MZ"

    condition:
        ($mz at 0) and any of ($key*) and filesize < 300000
}
YARA Detection Rule: apt_regin_rc5key
Repository: Yara-Rules/rules
Detects: Rule to detect Regin RC5 decryption keys

Pattern signatures:
$key1={73 23 1F 43 93 E1 9F 2F 99 0C 17 81 5C FF B4 01}
        $key2={10 19 53 2A 11 ED A3 74 3F C3 72 3F 9D 94 3D 78}

Detection condition:
any of ($key*)

Full rule:
rule apt_regin_rc5key 
{
    
    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Regin RC5 decryption keys"
        version = "1.0"
        last_modified = "2014-11-18"
    
    strings:
        $key1={73 23 1F 43 93 E1 9F 2F 99 0C 17 81 5C FF B4 01}
        $key2={10 19 53 2A 11 ED A3 74 3F C3 72 3F 9D 94 3D 78}

    condition:
        any of ($key*)
}
YARA Detection Rule: apt_regin_vfs
Repository: Yara-Rules/rules
Detects: Rule to detect Regin VFSes
Author: Kaspersky Lab

Pattern signatures:
$a1={00 02 00 08 00 08 03 F6 D7 F3 52}
        $a2={00 10 F0 FF F0 FF 11 C7 7F E8 52}
        $a3={00 04 00 10 00 10 03 C2 D3 1C 93}
        $a4={00 04 00 10 C8 00 04 C8 93 06 D8}

Detection condition:
($a1 at 0) or ($a2 at 0) or ($a3 at 0) or ($a4 at 0)

Full rule:
rule apt_regin_vfs 
{
    
    meta:
        copyright = "Kaspersky Lab"
        author = "Kaspersky Lab"
        description = "Rule to detect Regin VFSes"
        version = "1.0"
        last_modified = "2014-11-18"
    
    strings:
        $a1={00 02 00 08 00 08 03 F6 D7 F3 52}
        $a2={00 10 F0 FF F0 FF 11 C7 7F E8 52}
        $a3={00 04 00 10 00 10 03 C2 D3 1C 93}
        $a4={00 04 00 10 C8 00 04 C8 93 06 D8}
    
    condition:
    ($a1 at 0) or ($a2 at 0) or ($a3 at 0) or ($a4 at 0)
}
YARA Detection Rule: apt_regin_dispatcher_disp_dll
Repository: Yara-Rules/rules
Detects: Rule to detect Regin disp.dll dispatcher
Author: Kaspersky Lab

Pattern signatures:
$mz="MZ"
        $string1="shit"
        $string2="disp.dll"
        $string3="255.255.255.255"
        $string4="StackWalk64"
        $string5="imagehlp.dll"

Detection condition:
($mz at 0) and (all of ($string*))

Full rule:
rule apt_regin_dispatcher_disp_dll 
{

    meta:
        copyright = "Kaspersky Lab"
        author = "Kaspersky Lab"
        description = "Rule to detect Regin disp.dll dispatcher"
        version = "1.0"
        last_modified = "2014-11-18"

    strings:
        $mz="MZ"
        $string1="shit"
        $string2="disp.dll"
        $string3="255.255.255.255"
        $string4="StackWalk64"
        $string5="imagehlp.dll"
    
    condition:
        ($mz at 0) and (all of ($string*))
}
YARA Detection Rule: apt_regin_2013_64bit_stage1
Repository: Yara-Rules/rules
Detects: Rule to detect Regin 64 bit stage 1 loaders

Pattern signatures:
$mz="MZ"
        $a1="PRIVHEAD"
        $a2="\\\\.\\PhysicalDrive%d"
        $a3="ZwDeviceIoControlFile"

Detection condition:
($mz at 0) and (all of ($a*)) and filesize < 100000

Full rule:
rule apt_regin_2013_64bit_stage1 
{
    
    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Regin 64 bit stage 1 loaders"
        version = "1.0"
        last_modified = "2014-11-18"
        filename="wshnetc.dll"
        md5="bddf5afbea2d0eed77f2ad4e9a4f044d"
        filename="wsharp.dll"
        md5="c053a0a3f1edcbbfc9b51bc640e808ce"

    strings:
        $mz="MZ"
        $a1="PRIVHEAD"
        $a2="\\\\.\\PhysicalDrive%d"
        $a3="ZwDeviceIoControlFile"

    condition:
        ($mz at 0) and (all of ($a*)) and filesize < 100000
}
YARA Detection Rule: alina
Repository: Yara-Rules/rules
Detects: Identify Alina
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$s1 = "Alina v1.0"
		$s2 = "POST"
		$s3 = "1[0-2])[0-9]"

Detection condition:
all of them

Full rule:
rule alina
{
	meta:
		author = "Brian Wallace @botnet_hunter"
		author_email = "bwall@ballastsecurity.net"
		date = "2014-08-09"
		description = "Identify Alina"
	strings:
		$s1 = "Alina v1.0"
		$s2 = "POST"
		$s3 = "1[0-2])[0-9]"

	condition:
        	all of them
}
YARA Detection Rule: Bolonyokte
Repository: Yara-Rules/rules
Detects: UnknownDotNet RAT - Bolonyokte
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$campaign1 = "Bolonyokte" ascii wide
		$campaign2 = "donadoni" ascii wide
		
		$decoy1 = "nyse.com" ascii wide
		$decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide
		$decoy3 = "bf13-5d45cb40" ascii wide
		
		$artifact1 = "Backup.zip"  ascii wide
		$artifact2 = "updates.txt" ascii wide
		$artifact3 = "vdirs.dat" ascii wide
		$artifact4 = "default.dat"
		$artifact5 = "index.html"
		$artifact6 = "mime.dat"
		
		$func1 = "FtpUrl"
		$func2 = "ScreenCapture"
		$func3 = "CaptureMouse"
		$func4 = "UploadFile"

		$ebanking1 = "Internet Banking" wide
		$ebanking2 = "(Online Banking)|(Online banking)"
		$ebanking3 = "(e-banking)|(e-Banking)" nocase
		$ebanking4 = "login"
		$ebanking5 = "en ligne" wide
		$ebanking6 = "bancaires" wide
		$ebanking7 = "(eBanking)|(Ebanking)" wide
		$ebanking8 = "Anmeldung" wide
		$ebanking9 = "internet banking" nocase wide
		$ebanking10 = "Banking Online" nocase wide
		$ebanking11 = "Web Banking" wide
		$ebanking12 = "Power"

Detection condition:
any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*)

Full rule:
rule Bolonyokte : rat 
{
	meta:
		description = "UnknownDotNet RAT - Bolonyokte"
		author = "Jean-Philippe Teissier / @Jipe_"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0" 

	strings:
		$campaign1 = "Bolonyokte" ascii wide
		$campaign2 = "donadoni" ascii wide
		
		$decoy1 = "nyse.com" ascii wide
		$decoy2 = "NYSEArca_Listing_Fees.pdf" ascii wide
		$decoy3 = "bf13-5d45cb40" ascii wide
		
		$artifact1 = "Backup.zip"  ascii wide
		$artifact2 = "updates.txt" ascii wide
		$artifact3 = "vdirs.dat" ascii wide
		$artifact4 = "default.dat"
		$artifact5 = "index.html"
		$artifact6 = "mime.dat"
		
		$func1 = "FtpUrl"
		$func2 = "ScreenCapture"
		$func3 = "CaptureMouse"
		$func4 = "UploadFile"

		$ebanking1 = "Internet Banking" wide
		$ebanking2 = "(Online Banking)|(Online banking)"
		$ebanking3 = "(e-banking)|(e-Banking)" nocase
		$ebanking4 = "login"
		$ebanking5 = "en ligne" wide
		$ebanking6 = "bancaires" wide
		$ebanking7 = "(eBanking)|(Ebanking)" wide
		$ebanking8 = "Anmeldung" wide
		$ebanking9 = "internet banking" nocase wide
		$ebanking10 = "Banking Online" nocase wide
		$ebanking11 = "Web Banking" wide
		$ebanking12 = "Power"

	condition:
		any of ($campaign*) or 2 of ($decoy*) or 2 of ($artifact*) or all of ($func*) or 3 of ($ebanking*)
}
YARA Detection Rule: BlackEnergy_BE_2
Repository: Yara-Rules/rules
Detects: Detects BlackEnergy 2 Malware
Author: Florian Roth
Reference: http://goo.gl/DThzLz

Pattern signatures:
$s0 = "<description> Windows system utility service  </description>" fullword ascii
      $s1 = "WindowsSysUtility - Unicode" fullword wide
      $s2 = "msiexec.exe" fullword wide
      $s3 = "WinHelpW" fullword ascii
      $s4 = "ReadProcessMemory" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)

Full rule:
rule BlackEnergy_BE_2 
{
   
   meta:
      description = "Detects BlackEnergy 2 Malware"
      author = "Florian Roth"
      reference = "http://goo.gl/DThzLz"
      date = "2015/02/19"
      hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
   
   strings:
      $s0 = "<description> Windows system utility service  </description>" fullword ascii
      $s1 = "WindowsSysUtility - Unicode" fullword wide
      $s2 = "msiexec.exe" fullword wide
      $s3 = "WinHelpW" fullword ascii
      $s4 = "ReadProcessMemory" fullword ascii
   
   condition:
      uint16(0) == 0x5a4d and filesize < 250KB and all of ($s*)
}