deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Ransom_Alpha
Repository: Yara-Rules/rules
Detects: Regla para detectar Ransom.Alpha (posibles falsos positivos)
Author: CCN-CERT

Pattern signatures:
$a = { 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63 }

Detection condition:
$a

Full rule:
rule Ransom_Alpha
{
meta:
description = "Regla para detectar Ransom.Alpha (posibles falsos positivos)"
author = "CCN-CERT"
version = "1.0"
strings:
$a = { 52 00 65 00 61 00 64 00 20 00 4D 00 65 00 20 00 28 00 48 00 6F 00 77 00 20 00 44 00 65 00 63 }
condition:
$a
}
YARA Detection Rule: Ransom_Alfa
Repository: Yara-Rules/rules
Detects: Regla para detectar W32/Filecoder.Alfa (Posibles falsos positivos)
Author: CCN-CERT

Pattern signatures:
$a = { 8B 0C 97 81 E1 FF FF 00 00 81 F9 19 04 00 00 74 0F 81 F9 } 
$b = { 22 04 00 00 74 07 42 3B D0 7C E2 EB 02 }

Detection condition:
all of them

Full rule:
rule Ransom_Alfa
{
meta:
description = "Regla para detectar W32/Filecoder.Alfa (Posibles falsos positivos)"
author = "CCN-CERT"
version = "1.0"
strings:
$a = { 8B 0C 97 81 E1 FF FF 00 00 81 F9 19 04 00 00 74 0F 81 F9 } 
$b = { 22 04 00 00 74 07 42 3B D0 7C E2 EB 02 }
condition:
all of them
}
YARA Detection Rule: IceID_Bank_trojan
Repository: Yara-Rules/rules
Detects: Detects IcedID..adjusted several times
Author: unixfreaxjp

Pattern signatures:
$header = { 4D 5A }
		$magic1 = { E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? }
		$st01 = "CCmdTarget" fullword nocase wide ascii
		$st02 = "CUserException" fullword nocase wide ascii
		$st03 = "FileType" fullword nocase wide ascii
		$st04 = "FlsGetValue" fullword nocase wide ascii
		$st05 = "AVCShellWrapper@@" fullword nocase wide ascii
		$st06 = "AVCCmdTarget@@" fullword nocase wide ascii
		$st07 = "AUCThreadData@@" fullword nocase wide ascii
		$st08 = "AVCUserException@@" fullword nocase wide ascii

Detection condition:
$header at 0 and all of ($magic*) and 6 of ($st0*)
		and pe.sections[0].name contains ".text"
		and pe.sections[1].name contains ".rdata"
		and pe.sections[2].name contains ".data"
		and pe.sections[3].name contains ".rsrc"
		and pe.characteristics & pe.EXECUTABLE_IMAGE
		and pe.characteristics & pe

Full rule:
rule IceID_Bank_trojan {

	meta:
		description = "Detects IcedID..adjusted several times"
		author = "unixfreaxjp"
		org = "MalwareMustDie"
		date = "2018-01-14"
    
	strings:
		$header = { 4D 5A }
		$magic1 = { E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? }
		$st01 = "CCmdTarget" fullword nocase wide ascii
		$st02 = "CUserException" fullword nocase wide ascii
		$st03 = "FileType" fullword nocase wide ascii
		$st04 = "FlsGetValue" fullword nocase wide ascii
		$st05 = "AVCShellWrapper@@" fullword nocase wide ascii
		$st06 = "AVCCmdTarget@@" fullword nocase wide ascii
		$st07 = "AUCThreadData@@" fullword nocase wide ascii
		$st08 = "AVCUserException@@" fullword nocase wide ascii

	condition:
		$header at 0 and all of ($magic*) and 6 of ($st0*)
		and pe.sections[0].name contains ".text"
		and pe.sections[1].name contains ".rdata"
		and pe.sections[2].name contains ".data"
		and pe.sections[3].name contains ".rsrc"
		and pe.characteristics & pe.EXECUTABLE_IMAGE
		and pe.characteristics & pe.RELOCS_STRIPPED
}
YARA Detection Rule: rovnix_downloader
Repository: Yara-Rules/rules
Detects: Rovnix downloader with sinkhole checks
Author: Intel Security
Reference: https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/

Pattern signatures:
$sink1= "control"
			$sink2 = "sink"
			$sink3 = "hole"
			$sink4= "dynadot"
			$sink5= "block"
			$sink6= "malw"
			$sink7= "anti"
			$sink8= "googl"
			$sink9= "hack"
			$sink10= "trojan"
			$sink11= "abuse"
			$sink12= "virus"
			$sink13= "black"
			$sink14= "spam"
			$boot= "BOOTKIT_DLL.dll"
			$mz = { 4D 5A }

Detection condition:
$mz in (0..2) and all of ($sink*) and $boot

Full rule:
rule rovnix_downloader : downloader 
{
	meta:
		author="Intel Security"
		description="Rovnix downloader with sinkhole checks"
		reference = "https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
	strings:
			$sink1= "control"
			$sink2 = "sink"
			$sink3 = "hole"
			$sink4= "dynadot"
			$sink5= "block"
			$sink6= "malw"
			$sink7= "anti"
			$sink8= "googl"
			$sink9= "hack"
			$sink10= "trojan"
			$sink11= "abuse"
			$sink12= "virus"
			$sink13= "black"
			$sink14= "spam"
			$boot= "BOOTKIT_DLL.dll"
			$mz = { 4D 5A }
	condition:
		$mz in (0..2) and all of ($sink*) and $boot
}
YARA Detection Rule: Nanocore_RAT_Gen_1
Repository: Yara-Rules/rules
Detects: Detetcs the Nanocore RAT and similar malware
Author: Florian Roth
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
		$x2 = "RunPE1" fullword ascii
		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
		$x5 = "Monitorinjection" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )

Full rule:
rule Nanocore_RAT_Gen_1 {
	meta:
		description = "Detetcs the Nanocore RAT and similar malware"
		author = "Florian Roth"
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		score = 70
		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
	strings:
		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
		$x2 = "RunPE1" fullword ascii
		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
		$x5 = "Monitorinjection" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 100KB and ( 1 of them ) ) or ( 3 of them )
}
YARA Detection Rule: Nanocore_RAT_Gen_2
Repository: Yara-Rules/rules
Detects: Detetcs the Nanocore RAT
Author: Florian Roth
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "NanoCore.ClientPluginHost" fullword ascii
		$x2 = "IClientNetworkHost" fullword ascii
		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )

Full rule:
rule Nanocore_RAT_Gen_2 {
	meta:
		description = "Detetcs the Nanocore RAT"
		author = "Florian Roth"
		score = 100
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
	strings:
		$x1 = "NanoCore.ClientPluginHost" fullword ascii
		$x2 = "IClientNetworkHost" fullword ascii
		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 1000KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: Nanocore_RAT_Sample_1
Repository: Yara-Rules/rules
Detects: Detetcs a certain Nanocore RAT sample
Author: Florian Roth
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
		$x3 = "popthatkitty.Resources.resources" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )

Full rule:
rule Nanocore_RAT_Sample_1 {
	meta:
		description = "Detetcs a certain Nanocore RAT sample"
		author = "Florian Roth"
		score = 75
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
	strings:
		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
		$x3 = "popthatkitty.Resources.resources" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) ) ) or ( all of them )
}
YARA Detection Rule: Nanocore_RAT_Sample_2
Repository: Yara-Rules/rules
Detects: Detetcs a certain Nanocore RAT sample
Author: Florian Roth
Reference: https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Pattern signatures:
$s1 = "U4tSOtmpM" fullword ascii
		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" fullword wide
		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)

Full rule:
rule Nanocore_RAT_Sample_2 {
	meta:
		description = "Detetcs a certain Nanocore RAT sample"
		author = "Florian Roth"
		score = 75
		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
		date = "2016-04-22"
		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
	strings:
		$s1 = "U4tSOtmpM" fullword ascii
		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" fullword wide
		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 40KB and all of ($s*)
}
YARA Detection Rule: onimiki
Repository: Yara-Rules/rules
Detects: Linux/Onimiki malicious DNS server
Malware family: Linux/Onimiki
Author: Olivier Bilodeau <bilodeau@eset.com>
Reference: http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf

Pattern signatures:
// code from offset: 0x46CBCD
    $a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
    $a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
    $a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
    $a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
    $a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
    $a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
    $a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
    $a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
    $a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}

Detection condition:
all of them

Full rule:
rule onimiki
{

  meta:
    description = "Linux/Onimiki malicious DNS server"
    malware = "Linux/Onimiki"
    operation = "Windigo"
    author = "Olivier Bilodeau <bilodeau@eset.com>"
    created = "2014-02-06"
    reference = "http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf"
    contact = "windigo@eset.sk"
    source = "https://github.com/eset/malware-ioc/"
    license = "BSD 2-Clause"

  strings:
    // code from offset: 0x46CBCD
    $a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
    $a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
    $a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
    $a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
    $a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
    $a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
    $a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
    $a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
    $a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}

  condition:
    all of them
}
YARA Detection Rule: Win32_Buzus_Softpulse
Repository: Yara-Rules/rules
Detects: Trojan Buzus / Softpulse
Author: Florian Roth

Pattern signatures:
$x1 = "pi4izd6vp0.com" fullword ascii
        $s1 = "SELECT * FROM Win32_Process" fullword wide
        $s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
        $s5 = "Find_RepeatProcess" fullword ascii
        $s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide
        $s7 = "myapp.exe" fullword ascii
        $s14 = "/c ping -n 1 www.google" wide

Detection condition:
uint16(0) == 0x5a4d and ( ( $x1 and 2 of ($s*) ) or all of ($s*) )

Full rule:
rule Win32_Buzus_Softpulse
{

    meta:
        description = "Trojan Buzus / Softpulse"
        author = "Florian Roth"
        date = "2015-05-13"
        hash = "2f6df200e63a[PII_REDACTED]9a74180466d2e99ea9"
        score = 75

    strings:
        $x1 = "pi4izd6vp0.com" fullword ascii
        $s1 = "SELECT * FROM Win32_Process" fullword wide
        $s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
        $s5 = "Find_RepeatProcess" fullword ascii
        $s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" fullword wide
        $s7 = "myapp.exe" fullword ascii
        $s14 = "/c ping -n 1 www.google" wide
    
    condition:
        uint16(0) == 0x5a4d and ( ( $x1 and 2 of ($s*) ) or all of ($s*) )
}
YARA Detection Rule: RooterCode
Repository: Yara-Rules/rules
Detects: Rooter code features
Author: Seth Hardy

Pattern signatures:
// xor 0x30 decryption
        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }

Detection condition:
any of them

Full rule:
rule RooterCode : Rooter Family 
{
    meta:
        description = "Rooter code features"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
    
    strings:
        // xor 0x30 decryption
        $ = { 80 B0 ?? ?? ?? ?? 30 40 3D 00 50 00 00 7C F1 }
    
    condition:
        any of them
}
YARA Detection Rule: RooterStrings
Repository: Yara-Rules/rules
Detects: Rooter Identifying Strings
Author: Seth Hardy

Pattern signatures:
$group1 = "seed\x00"
        $group2 = "prot\x00"
        $group3 = "ownin\x00"
        $group4 = "feed0\x00"
        $group5 = "nown\x00"

Detection condition:
3 of ($group*)

Full rule:
rule RooterStrings : Rooter Family
{
    meta:
        description = "Rooter Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    strings:
        $group1 = "seed\x00"
        $group2 = "prot\x00"
        $group3 = "ownin\x00"
        $group4 = "feed0\x00"
        $group5 = "nown\x00"

    condition:
       3 of ($group*)
}
YARA Detection Rule: Rooter
Repository: Yara-Rules/rules
Detects: Rooter
Author: Seth Hardy

Detection condition:
RooterCode or RooterStrings

Full rule:
rule Rooter : Family
{
    meta:
        description = "Rooter"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    condition:
        RooterCode or RooterStrings
}
YARA Detection Rule: RookieStrings
Repository: Yara-Rules/rules
Detects: Rookie Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "RookIE/1.0"

Detection condition:
any of them

Full rule:
rule RookieStrings : Rookie Family
{
    meta:
        description = "Rookie Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        $ = "RookIE/1.0"
        
    condition:
       any of them
}
YARA Detection Rule: RookieCode
Repository: Yara-Rules/rules
Detects: Rookie code features
Author: Seth Hardy

Pattern signatures:
// hidden AutoConfigURL
        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
        // hidden ProxyEnable
        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
        // xor on rand value?
        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }

Detection condition:
any of them

Full rule:
rule RookieCode : Rookie Family 
{
    meta:
        description = "Rookie code features"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    strings:
        // hidden AutoConfigURL
        $ = { C6 ?? ?? ?? 41 C6 ?? ?? ?? 75 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 43 C6 ?? ?? ?? 6F C6 ?? ?? ?? 6E C6 ?? ?? ?? 66 }
        // hidden ProxyEnable
        $ = { C6 ?? ?? ?? 50 [4] C6 ?? ?? ?? 6F C6 ?? ?? ?? 78 C6 ?? ?? ?? 79 C6 ?? ?? ?? 45 C6 ?? ?? ?? 6E C6 ?? ?? ?? 61 }
        // xor on rand value?
        $ = { 8B 1D 10 A1 40 00 [18] FF D3 8A 16 32 D0 88 16 }

    condition:
        any of them
}
YARA Detection Rule: Rookie
Repository: Yara-Rules/rules
Detects: Rookie
Author: Seth Hardy

Detection condition:
RookieCode or RookieStrings

Full rule:
rule Rookie : Family
{
    meta:
        description = "Rookie"
        author = "Seth Hardy"
        last_modified = "2014-06-25"
        
    condition:
        RookieCode or RookieStrings
}
YARA Detection Rule: ATM_HelloWorld
Repository: Yara-Rules/rules
Detects: Search strings and procedure in HelloWorld ATM Malware
Author: xylitol@temari.fr

Pattern signatures:
$api1 = "CscCngOpen" ascii wide
        $api2 = "CscCngClose" ascii wide
        $string1 = "%d,%02d;" ascii wide
        $string2 = "MAX_NOTES" ascii wide
        $hex_var1 = { FF 15 ?? ?? ?? ?? BF 00 80 00 00 85 C7 }

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule ATM_HelloWorld : malware
{
    meta:
        description = "Search strings and procedure in HelloWorld ATM Malware"
        author = "xylitol@temari.fr"
        date = "2019-01-13"

    strings:
        $api1 = "CscCngOpen" ascii wide
        $api2 = "CscCngClose" ascii wide
        $string1 = "%d,%02d;" ascii wide
        $string2 = "MAX_NOTES" ascii wide
        $hex_var1 = { FF 15 ?? ?? ?? ?? BF 00 80 00 00 85 C7 }

    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: CheshireCat_Sample2
Repository: Yara-Rules/rules
Detects: Auto-generated rule - file dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8
Author: Florian Roth
Reference: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/

Pattern signatures:
$s0 = "mpgvwr32.dll" fullword ascii
        $s1 = "Unexpected failure of wait! (%d)" fullword ascii
        $s2 = "\"%s\" /e%d /p%s" fullword ascii
        $s4 = "error in params!" fullword ascii
        $s5 = "sscanf" fullword ascii
        $s6 = "<>Param : 0x%x" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)

Full rule:
rule CheshireCat_Sample2
{

    meta:
        description = "Auto-generated rule - file dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
        author = "Florian Roth"
        reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
        date = "2015-08-08"
        score = 70
        hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"

    strings:
        $s0 = "mpgvwr32.dll" fullword ascii
        $s1 = "Unexpected failure of wait! (%d)" fullword ascii
        $s2 = "\"%s\" /e%d /p%s" fullword ascii
        $s4 = "error in params!" fullword ascii
        $s5 = "sscanf" fullword ascii
        $s6 = "<>Param : 0x%x" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 100KB and 4 of ($s*)
}
YARA Detection Rule: CheshireCat_Gen2
Repository: Yara-Rules/rules
Detects: Auto-generated rule - from files 32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a, 63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb
Author: Florian Roth
Reference: https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/

Pattern signatures:
$a1 = "Interface\\%s\\info" fullword ascii
        $a2 = "Interface\\%s\\info\\%s" fullword ascii
        $a3 = "CLSID\\%s\\info\\%s" fullword ascii
        $a4 = "CLSID\\%s\\info" fullword ascii
        $b1 = "Windows Shell Icon Handler" fullword wide
        $b2 = "Microsoft Shell Icon Handler" fullword wide
        $s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
        $s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
        $s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
        $s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
        $s5 = "%sMutex" fullword ascii
        $s6 = "\\ShellIconCache" fullword ascii
        $s7 = "+6Service Pack " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)

Full rule:
rule CheshireCat_Gen2
{

    meta:
        description = "Auto-generated rule - from files 32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a, 63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
        author = "Florian Roth"
        reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
        date = "2015-08-08"
        super_rule = 1
        score = 70
        hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
        hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
        hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
        hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"

    strings:
        $a1 = "Interface\\%s\\info" fullword ascii
        $a2 = "Interface\\%s\\info\\%s" fullword ascii
        $a3 = "CLSID\\%s\\info\\%s" fullword ascii
        $a4 = "CLSID\\%s\\info" fullword ascii
        $b1 = "Windows Shell Icon Handler" fullword wide
        $b2 = "Microsoft Shell Icon Handler" fullword wide
        $s1 = "\\StringFileInfo\\%s\\FileVersion" fullword ascii
        $s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
        $s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
        $s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
        $s5 = "%sMutex" fullword ascii
        $s6 = "\\ShellIconCache" fullword ascii
        $s7 = "+6Service Pack " fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
}
YARA Detection Rule: Cythosia
Repository: Yara-Rules/rules
Detects: Identify Cythosia
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$str1 = "HarvesterSocksBot.Properties.Resources" wide

Detection condition:
all of them

Full rule:
rule Cythosia
{

    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2015-03-21"
        description = "Identify Cythosia"

    strings:
        $str1 = "HarvesterSocksBot.Properties.Resources" wide

    condition:
        all of them
}
YARA Detection Rule: Predator_The_Thief
Repository: Yara-Rules/rules
Detects: Yara rule for Predator The Thief v2.3.5 & +
Author: Fumik0_

Pattern signatures:
$mz = { 4D 5A }

        $hex1 = { BF 00 00 40 06 } 
        $hex2 = { C6 04 31 6B }
        $hex3 = { C6 04 31 63 }
        $hex4 = { C6 04 31 75 }
        $hex5 = { C6 04 31 66 }

        $s1 = "sqlite_" ascii wide

Detection condition:
$mz at 0 and all of ($hex*) and all of ($s*)

Full rule:
rule Predator_The_Thief : Predator_The_Thief {
   meta:
        description = "Yara rule for Predator The Thief v2.3.5 & +"
        author = "Fumik0_"
        date = "2018/10/12"
        source = "https://fumik0.com/2018/10/15/predator-the-thief-in-depth-analysis-v2-3-5/"
   strings:
        $mz = { 4D 5A }

        $hex1 = { BF 00 00 40 06 } 
        $hex2 = { C6 04 31 6B }
        $hex3 = { C6 04 31 63 }
        $hex4 = { C6 04 31 75 }
        $hex5 = { C6 04 31 66 }

        $s1 = "sqlite_" ascii wide
   condition:
        $mz at 0 and all of ($hex*) and all of ($s*)
}
YARA Detection Rule: LogPOS
Repository: Yara-Rules/rules
Detects: Detects Versions of LogPOS
Author: Morphick Security

Pattern signatures:
$mailslot = "\\\\.\\mailslot\\LogCC"
        $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process="
        //64A130000000      mov eax, dword ptr fs:[0x30]
        //8B400C        mov eax, dword ptr [eax + 0xc]
        //8B401C        mov eax, dword ptr [eax + 0x1c]
        //8B4008        mov eax, dword ptr [eax + 8]
        $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 }

Detection condition:
$sc and 1 of ($mailslot,$get)

Full rule:
rule LogPOS
{
    meta:
        author = "Morphick Security"
        description = "Detects Versions of LogPOS"
        md5 = "af13e7583ed1b27c4ae219e344a37e2b"
    strings:
        $mailslot = "\\\\.\\mailslot\\LogCC"
        $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process="
        //64A130000000      mov eax, dword ptr fs:[0x30]
        //8B400C        mov eax, dword ptr [eax + 0xc]
        //8B401C        mov eax, dword ptr [eax + 0x1c]
        //8B4008        mov eax, dword ptr [eax + 8]
        $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 }
    condition:
        $sc and 1 of ($mailslot,$get)
}