deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: loki2crypto
Repository: Yara-Rules/rules
Detects: Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */
Author: Costin Raiu, Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$modulus={DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}

Detection condition:
(any of them)

Full rule:
rule loki2crypto {

meta:
	
	author = "Costin Raiu, Kaspersky Lab"
	date = "2017-03-21"
	version = "1.0"
	description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	hash = "19fbd8cbfb12482e8020a887d6427315"
	hash = "ea06b213d5924de65407e8931b1e4326"
	hash = "14ecd5e6fc8e501037b54ca263896a11"
	hash = "e079ec947d3d4dacb21e993b760a65dc"
	hash = "edf900cebb70c6d1fcab0234062bfc28"

strings:

	$modulus={DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}

condition:

	(any of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_de_tool
Repository: Yara-Rules/rules
Detects: Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Vnuk: %d" ascii fullword
	$a2="Syn: %d" ascii fullword

	//%s\r%s\r%s\r%s\r ->
	$a3={25 73 0A 25 73 0A 25 73 0A 25 73 0A}

Detection condition:
((2 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_de_tool {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
	hash = "4bc7ed168fb78f0dc688ee2be20c9703"
	hash = "8b56e8552a74133da4bc5939b5f74243"

strings:

	$a1="Vnuk: %d" ascii fullword
	$a2="Syn: %d" ascii fullword

	//%s\r%s\r%s\r%s\r ->
	$a3={25 73 0A 25 73 0A 25 73 0A 25 73 0A}

condition:

	((2 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_cle_tool
Repository: Yara-Rules/rules
Detects: Rule to detect Moonlight Maze 'cle' log cleaning tool
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="./a filename template_file" ascii wide
	$a2="May be %s is empty?"  ascii wide
	$a3="template string = |%s|"   ascii wide
	$a4="No blocks !!!"
	$a5="No data in this block !!!!!!"  ascii wide
	$a6="No good line"

Detection condition:
((3 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_cle_tool {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
	hash = "647d7b711f7b4434145ea30d0ef207b0"

	
strings:

	$a1="./a filename template_file" ascii wide
	$a2="May be %s is empty?"  ascii wide
	$a3="template string = |%s|"   ascii wide
	$a4="No blocks !!!"
	$a5="No data in this block !!!!!!"  ascii wide
	$a6="No good line"

condition:

	((3 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_xk_keylogger
Repository: Yara-Rules/rules
Detects: Rule to detect Moonlight Maze 'xk' keylogger
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Log ended at => %s"
	$a2="Log started at => %s [pid %d]"
	$a3="/var/tmp/task" fullword
	$a4="/var/tmp/taskhost" fullword
	$a5="my hostname: %s"
	$a6="/var/tmp/tasklog"
	$a7="/var/tmp/.Xtmp01" fullword
	$a8="myfilename=-%s-"
	$a9="/var/tmp/taskpid"
	$a10="mypid=-%d-" fullword
	$a11="/var/tmp/taskgid" fullword
	$a12="mygid=-%d-" fullword

Detection condition:
((3 of ($a*)))

Full rule:
rule apt_RU_MoonlightMaze_xk_keylogger {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze 'xk' keylogger"

strings:

	$a1="Log ended at => %s"
	$a2="Log started at => %s [pid %d]"
	$a3="/var/tmp/task" fullword
	$a4="/var/tmp/taskhost" fullword
	$a5="my hostname: %s"
	$a6="/var/tmp/tasklog"
	$a7="/var/tmp/.Xtmp01" fullword
	$a8="myfilename=-%s-"
	$a9="/var/tmp/taskpid"
	$a10="mypid=-%d-" fullword
	$a11="/var/tmp/taskgid" fullword
	$a12="mygid=-%d-" fullword


condition:

	((3 of ($a*)))

}
YARA Detection Rule: apt_RU_MoonlightMaze_encrypted_keylog
Repository: Yara-Rules/rules
Detects: Rule to detect Moonlight Maze encrypted keylogger logs
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1={47 01 22 2A 6D 3E 39 2C}

Detection condition:
($a1 at 0)

Full rule:
rule apt_RU_MoonlightMaze_encrypted_keylog {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Moonlight Maze encrypted keylogger logs"

strings:

	$a1={47 01 22 2A 6D 3E 39 2C}

condition:

	($a1 at 0)

}
YARA Detection Rule: apt_RU_MoonlightMaze_IRIX_exploit_GEN
Repository: Yara-Rules/rules
Detects: Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="stack = 0x%x, targ_addr = 0x%x"
	$a2="execl failed"

Detection condition:
(uint32(0)==0x464c457f) and (all of them)

Full rule:
rule apt_RU_MoonlightMaze_IRIX_exploit_GEN {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
	reference2 = "https://www.exploit-db.com/exploits/19274/"
	hash = "008ea82f31f585622353bd47fa1d84be" //df3
	hash = "a26bad2b79075f454c83203fa00ed50c" //log
	hash = "f67fc6e90f05ba13f207c7fdaa8c2cab" //xconsole
	hash = "5937db3896cdd8b0beb3df44e509e136" //xlock
	hash = "f4ed5170dcea7e5ba62537d84392b280" //xterm

strings:

	$a1="stack = 0x%x, targ_addr = 0x%x"
	$a2="execl failed"

condition:

	(uint32(0)==0x464c457f) and (all of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_u_logcleaner
Repository: Yara-Rules/rules
Detects: Rule to detect log cleaners based on utclean.c
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="Hiding complit...n"
	$a2="usage: %s <username> <fixthings> [hostname]"
	$a3="ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"

Detection condition:
(uint32(0)==0x464c457f) and (any of them)

Full rule:
rule apt_RU_MoonlightMaze_u_logcleaner {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect log cleaners based on utclean.c"
	reference2 = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
	hash = "d98796dcda1443a37b124dbdc041fe3b"
	hash = "73a518f0a73ab77033121d[PII_REDACTED]"

strings:

	$a1="Hiding complit...n"
	$a2="usage: %s <username> <fixthings> [hostname]"
	$a3="ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"

condition:

	(uint32(0)==0x464c457f) and (any of them)

}
YARA Detection Rule: apt_RU_MoonlightMaze_wipe
Repository: Yara-Rules/rules
Detects: Rule to detect log cleaner based on wipe.c
Author: Kaspersky Lab
Reference: https://en.wikipedia.org/wiki/Moonlight_Maze

Pattern signatures:
$a1="ERROR: Unlinking tmp WTMP file."
	$a2="USAGE: wipe [ u|w|l|a ] ...options..."
	$a3="Erase acct entries on tty :   wipe a [username] [tty]"
	$a4="Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"

Detection condition:
(uint32(0)==0x464c457f) and (2 of them)

Full rule:
rule apt_RU_MoonlightMaze_wipe {

meta:
	
	author = "Kaspersky Lab"
	date = "2017-03-27"
	version = "1.0"
	last_modified = "2017-03-27"
	reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
	description = "Rule to detect log cleaner based on wipe.c"
	reference2 = "http://www.afn.org/~afn28925/wipe.c"
	hash = "e69efc504934551c6a77b525d5343241"

strings:

	$a1="ERROR: Unlinking tmp WTMP file."
	$a2="USAGE: wipe [ u|w|l|a ] ...options..."
	$a3="Erase acct entries on tty :   wipe a [username] [tty]"
	$a4="Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"

condition:

	(uint32(0)==0x464c457f) and (2 of them)

}
YARA Detection Rule: FavoriteCode
Repository: Yara-Rules/rules
Detects: Favorite code features
Author: Seth Hardy

Pattern signatures:
// standard string hiding
        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }

Detection condition:
any of them

Full rule:
rule FavoriteCode : Favorite Family 
{
    meta:
        description = "Favorite code features"
        author = "Seth Hardy"
        last_modified = "2014-06-24"
    
    strings:
        // standard string hiding
        $ = { C6 45 ?? 3B C6 45 ?? 27 C6 45 ?? 34 C6 45 ?? 75 C6 45 ?? 6B C6 45 ?? 6C C6 45 ?? 3B C6 45 ?? 2F }
        $ = { C6 45 ?? 6F C6 45 ?? 73 C6 45 ?? 73 C6 45 ?? 76 C6 45 ?? 63 C6 45 ?? 65 C6 45 ?? 78 C6 45 ?? 65 }
    
    condition:
        any of them
}
YARA Detection Rule: FavoriteStrings
Repository: Yara-Rules/rules
Detects: Favorite Identifying Strings
Author: Seth Hardy

Pattern signatures:
$string1 = "!QAZ4rfv"
        $file1 = "msupdater.exe"
        $file2 = "FAVORITES.DAT"

Detection condition:
any of ($string*) or all of ($file*)

Full rule:
rule FavoriteStrings : Favorite Family
{
    meta:
        description = "Favorite Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-06-24"
        
    strings:
        $string1 = "!QAZ4rfv"
        $file1 = "msupdater.exe"
        $file2 = "FAVORITES.DAT"
        
    condition:
       any of ($string*) or all of ($file*)
}
YARA Detection Rule: ELF_Linux_Torte
Repository: Yara-Rules/rules
Detects: Detects ELF Linux/Torte infection
Author: @mmorenog,@yararules

Pattern signatures:
$s0 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6)"
        $s1 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)"
        $s2 = "?sessd="
        $s3 = "&sessc="
        $s4 = "&sessk="
        $s5 = "3a08fe7b8c4da6ed09f21c3ef97efce2"
        $s6 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/"
        $s7 = "_ZN11CThreadPool10getBatchesERSt6vectorISt4pairISsiESaIS2_EE"
        $s8 = "_ZNSs4_Rep10_M_destroyERKSaIcE@@GLIBCXX_3.4"
        $s9 = "_ZNSt6vectorImSaImEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPmS1_EERKm"
        $s10 = "_ZNSt6vectorISt4pairISsiESaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_"
        $s11 = "_ZSt20__throw_out_of_rangePKc@@GLIBCXX_3.4"

Detection condition:
is__elf and all of ($s*)

Full rule:
rule ELF_Linux_Torte : Linux ELF

{
    meta:
		author = "@mmorenog,@yararules"
		description = "Detects ELF Linux/Torte infection"
		ref = "http://blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html"
		hash1 = "1faf27f6b8e8a9cadb611f668a01cf73"
		hash2 = "cb0477445fef9c5f1a5b6689bbfb941e"

    strings:
        $s0 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6)"
        $s1 = "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.7.6)"
        $s2 = "?sessd="
        $s3 = "&sessc="
        $s4 = "&sessk="
        $s5 = "3a08fe7b8c4da6ed09f21c3ef97efce2"
        $s6 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/"
        $s7 = "_ZN11CThreadPool10getBatchesERSt6vectorISt4pairISsiESaIS2_EE"
        $s8 = "_ZNSs4_Rep10_M_destroyERKSaIcE@@GLIBCXX_3.4"
        $s9 = "_ZNSt6vectorImSaImEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPmS1_EERKm"
        $s10 = "_ZNSt6vectorISt4pairISsiESaIS1_EE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPS1_S3_EERKS1_"
        $s11 = "_ZSt20__throw_out_of_rangePKc@@GLIBCXX_3.4"
        
        condition:
        is__elf and all of ($s*)
}
YARA Detection Rule: ELF_Linux_Torte_domains
Repository: Yara-Rules/rules
Detects: Detects ELF Linux/Torte infection
Author: @mmorenog,@yararules

Pattern signatures:
$1 = "pages.touchpadz.com" ascii wide nocase
		$2 = "bat.touchpadz.com" ascii wide nocase
		$3 = "stat.touchpadz.com" ascii wide nocase
		$4 = "sk2.touchpadz.com" ascii wide nocase

Detection condition:
any of them

Full rule:
rule ELF_Linux_Torte_domains {
	meta:
		author = "@mmorenog,@yararules"
		description = "Detects ELF Linux/Torte infection"
		ref1 = "http://blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html"
	strings:
		$1 = "pages.touchpadz.com" ascii wide nocase
		$2 = "bat.touchpadz.com" ascii wide nocase
		$3 = "stat.touchpadz.com" ascii wide nocase
		$4 = "sk2.touchpadz.com" ascii wide nocase

	condition:
		any of them
}
YARA Detection Rule: stampado_overlay
Repository: Yara-Rules/rules
Detects: Catches Stampado samples looking for \\r at the beginning of PE overlay section
Author: Fernando Merces, FTR, Trend Micro

Detection condition:
pe.characteristics == 0x122 and
pe.number_of_sections == 5 and
pe.imports("VERSION.dll", "VerQueryValueW") and uint8(pe.sections[4].raw_data_offset + pe.sections[4].raw_data_size) == 0x0d

Full rule:
rule stampado_overlay
{
meta:
description = "Catches Stampado samples looking for \\r at the beginning of PE overlay section"
reference = ""
author = "Fernando Merces, FTR, Trend Micro"
date = "2016-07"
md5 = "a393b9536a1caa34914636d3da7378b5"
md5 = "dbf3707a9cd090853a11dda9cfa78ff0"
md5 = "dd5686ca7ec28815c3cf3ed3dbebdff2"
md5 = "6337f0938e4a9c0ef44ab99deb0ef466"

condition:
pe.characteristics == 0x122 and
pe.number_of_sections == 5 and
pe.imports("VERSION.dll", "VerQueryValueW") and uint8(pe.sections[4].raw_data_offset + pe.sections[4].raw_data_size) == 0x0d

}
YARA Detection Rule: Adwind_JAR_PACKA
Repository: Yara-Rules/rules
Author: Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com
Reference: https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf

Pattern signatures:
$b1 = ".class" ascii
  $b2 = "c/a/a/" ascii
  $b3 = "b/a/" ascii
  $b4 = "a.dat" ascii
  $b5 = "META-INF/MANIFEST.MF" ascii

Detection condition:
int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5)

Full rule:
rule Adwind_JAR_PACKA : binary RAT Frutas Unrecom AlienSpy
{
 meta:
  author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
  reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
  last_modified = "2015-11-30"
 strings:
  $b1 = ".class" ascii
  $b2 = "c/a/a/" ascii
  $b3 = "b/a/" ascii
  $b4 = "a.dat" ascii
  $b5 = "META-INF/MANIFEST.MF" ascii
 condition:
  int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5)
}
YARA Detection Rule: Adwind_JAR_PACKB
Repository: Yara-Rules/rules
Author: Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com
Reference: https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf

Pattern signatures:
$c1 = "META-INF/MANIFEST.MF" ascii
  $c2 = "main/Start.class" ascii
  $a1 = "con g/con g.perl" ascii
  $b1 = "java/textito.isn" ascii

Detection condition:
int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))

Full rule:
rule Adwind_JAR_PACKB : binary RAT Frutas Unrecom AlienSpy {
 meta:
  author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
  reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
  last_modified = "2015-11-30"
 strings:
  $c1 = "META-INF/MANIFEST.MF" ascii
  $c2 = "main/Start.class" ascii
  $a1 = "con g/con g.perl" ascii
  $b1 = "java/textito.isn" ascii
 condition:
  int16(0) == 0x4B50 and ($c1 and $c2 and ($a1 or $b1))
}
YARA Detection Rule: crime_win_rat_AlienSpy
Repository: Yara-Rules/rules
Detects: Alien Spy Remote Access Trojan
Author: General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team

Pattern signatures:
$sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"
		
        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"
		
        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        $sc_4 = "util"
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"
        $sc_8 = "PK"

Detection condition:
uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )

Full rule:
rule crime_win_rat_AlienSpy: binary RAT Frutas Unrecom AlienSpy
{
meta:
	description = "Alien Spy Remote Access Trojan"
	author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
	reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
	reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
	date = "2015-04-04"
	filetype = "Java"
	hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
	hash_2 = "818afea3040a887f191ee9d0579ac6ed"
	hash_3 = "973de705f2f01e82c00db92eaa27912c"
	hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
	hash_5 = "071e[PII_REDACTED]d47a12a8c4b3adfea"
	hash_6 = "a7d50760d49faff3656903c1130fd20b"
	hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
	hash_8 = "3698a3630f80a632c0c7c12e929184fb"
	hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"

   strings:
		
        $sa_1 = "META-INF/MANIFEST.MF"
        $sa_2 = "Main.classPK"
        $sa_3 = "plugins/Server.classPK"
        $sa_4 = "IDPK"
		
        $sb_1 = "config.iniPK"
        $sb_2 = "password.iniPK"
        $sb_3 = "plugins/Server.classPK"
        $sb_4 = "LoadStub.classPK"
        $sb_5 = "LoadStubDecrypted.classPK"
        $sb_7 = "LoadPassword.classPK"
        $sb_8 = "DecryptStub.classPK"
        $sb_9 = "ClassLoaders.classPK"
		
        $sc_1 = "config.xml"
        $sc_2 = "options"
        $sc_3 = "plugins"
        $sc_4 = "util"
        $sc_5 = "util/OSHelper"
        $sc_6 = "Start.class"
        $sc_7 = "AlienSpy"
        $sc_8 = "PK"
	
  condition:
    
	uint16(0) == 0x4B50 and filesize < 800KB and ( (all of ($sa_*)) or (all of ($sb_*)) or (all of ($sc_*)) )
}
YARA Detection Rule: VisualDiscovery_Lonovo_Superfish_SSL_Hijack
Repository: Yara-Rules/rules
Detects: Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe
Author: Florian Roth / improved by kbandla
Reference: https://twitter.com/4nc4p/status/[PII_REDACTED]58272000

Pattern signatures:
$mz = { 4d 5a }
		//$s1 = "VisualDiscovery.exe" fullword wide
		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
		$s3 = "GetPCProxyHandler" fullword ascii
		$s4 = "StartPCProxy" fullword ascii
		$s5 = "SetPCProxyHandler" fullword ascii

Detection condition:
( $mz at 0 ) and filesize < 2MB and all of ($s*)

Full rule:
rule VisualDiscovery_Lonovo_Superfish_SSL_Hijack {
	meta:
		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
		author = "Florian Roth / improved by kbandla"
		reference = "https://twitter.com/4nc4p/status/[PII_REDACTED]58272000"
		date = "2015/02/19"
		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
	strings:
		$mz = { 4d 5a }
		//$s1 = "VisualDiscovery.exe" fullword wide
		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
		$s3 = "GetPCProxyHandler" fullword ascii
		$s4 = "StartPCProxy" fullword ascii
		$s5 = "SetPCProxyHandler" fullword ascii
	condition:
		( $mz at 0 ) and filesize < 2MB and all of ($s*)
}
YARA Detection Rule: POS_bruteforcing_bot
Repository: Yara-Rules/rules
Detects: botnet bruteforcing POS terms via RDP
Reference: http://www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="\\AppData\\Roaming\\lsacs.exe"

Detection condition:
all of them

Full rule:
rule POS_bruteforcing_bot
{ 
	meta:
		maltype = "botnet"
    ref = "https://github.com/reed1713"
		reference = "http://www.alienvault.com/open-threat-exchange/blog/botnet-bruteforcing-point-of-sale-via-remote-desktop"
		date = "3/11/2014"
		description = "botnet bruteforcing POS terms via RDP"
	strings:
		$type="Microsoft-Windows-Security-Auditing"
		$eventid="4688"
		$data="\\AppData\\Roaming\\lsacs.exe"

	condition:
		all of them
}
YARA Detection Rule: rar_with_js
Repository: Yara-Rules/rules

Pattern signatures:
$h1 = "Rar!" 
  $s1 = ".js" nocase

Detection condition:
$h1 at 0 and $s1

Full rule:
rule rar_with_js
{
  strings:
  $h1 = "Rar!" 
  $s1 = ".js" nocase
    
  condition:
    $h1 at 0 and $s1
}
YARA Detection Rule: RockLoader
Repository: Yara-Rules/rules
Detects: RockLoader Malware
Author: @seanmw

Pattern signatures:
$hdr = {4d 5a 90 00}
$op1 = {39 45 f0 0f 8e b0 00 00 00}
$op2 = {32 03 77 73 70 72 69 6e 74 66 41 00 ce 02 53 65}

Detection condition:
$hdr at 0 and all of ($op*) and filesize < 500KB

Full rule:
rule RockLoader{
meta:
name = "RockLoader"
description = "RockLoader Malware"
author = "@seanmw"
strings:
$hdr = {4d 5a 90 00}
$op1 = {39 45 f0 0f 8e b0 00 00 00}
$op2 = {32 03 77 73 70 72 69 6e 74 66 41 00 ce 02 53 65}
condition:
$hdr at 0 and all of ($op*) and filesize < 500KB
}
YARA Detection Rule: Fareit_Trojan_Oct15
Repository: Yara-Rules/rules
Detects: Detects Fareit Trojan from Sep/Oct 2015 Wave
Author: Florian Roth
Reference: http://goo.gl/5VYtlU

Pattern signatures:
$s1 = "ebai.exe" fullword wide
		$s2 = "Origina" fullword wide

Detection condition:
uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)

Full rule:
rule Fareit_Trojan_Oct15 {
	meta:
		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
		author = "Florian Roth"
		reference = "http://goo.gl/5VYtlU"
		date = "2015-10-18"
		score = 80
		super_rule = 1
		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
		hash3 = "408fa0bd4d44de[PII_REDACTED]b554e8dab42f5d28a6a525b4bc41285e37ab488d"
		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
	strings:
		$s1 = "ebai.exe" fullword wide
		$s2 = "Origina" fullword wide
	condition:
		uint16(0) == 0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
}
YARA Detection Rule: EQGRP_noclient_3_0_5
Repository: Yara-Rules/rules
Detects: Detects tool from EQGRP toolset - file noclient-3.0.5.3
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
        $x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
        $x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
        $x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
        $x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )

Full rule:
rule EQGRP_noclient_3_0_5 
{
    meta:
        description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-15"

    strings:
        $x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
        $x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
        $x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
        $x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
        $x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 700KB and 1 of them ) or ( all of them )
}