deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CALENDAR_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "content" wide ascii
        $s2 = "title" wide ascii
        $s3 = "entry" wide ascii
        $s4 = "feed" wide ascii
        $s5 = "DownRun success" wide ascii
        $s6 = "%s@gmail.com" wide ascii
        $s7 = "<!--%s-->" wide ascii
        $b8 = "W4qKihsb+So=" wide ascii
        $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
        $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii

Detection condition:
all of ($s*) or all of ($b*)

Full rule:
rule CALENDAR_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
       
    strings:
        $s1 = "content" wide ascii
        $s2 = "title" wide ascii
        $s3 = "entry" wide ascii
        $s4 = "feed" wide ascii
        $s5 = "DownRun success" wide ascii
        $s6 = "%s@gmail.com" wide ascii
        $s7 = "<!--%s-->" wide ascii
        $b8 = "W4qKihsb+So=" wide ascii
        $b9 = "PoqKigY7ggH+VcnqnTcmhFCo9w==" wide ascii
        $b10 = "8oqKiqb5880/uJLzAsY=" wide ascii

    condition:
        all of ($s*) or all of ($b*)
}
YARA Detection Rule: COMBOS_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
        $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
        $s3 = "Delay" wide ascii
        $s4 = "Getfile" wide ascii
        $s5 = "Putfile" wide ascii
        $s6 = "---[ Virtual Shell]---" wide ascii
        $s7 = "Not Comming From Our Server %s." wide ascii

Detection condition:
all of them

Full rule:
rule COMBOS_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Mozilla4.0 (compatible; MSIE 7.0; Win32)" wide ascii
        $s2 = "Mozilla5.1 (compatible; MSIE 8.0; Win32)" wide ascii
        $s3 = "Delay" wide ascii
        $s4 = "Getfile" wide ascii
        $s5 = "Putfile" wide ascii
        $s6 = "---[ Virtual Shell]---" wide ascii
        $s7 = "Not Comming From Our Server %s." wide ascii

    condition:
        all of them
}
YARA Detection Rule: DAIRY_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
        $s2 = "KilFail" wide ascii
        $s3 = "KilSucc" wide ascii
        $s4 = "pkkill" wide ascii
        $s5 = "pklist" wide ascii

Detection condition:
all of them

Full rule:
rule DAIRY_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Mozilla/4.0 (compatible; MSIE 7.0;)" wide ascii
        $s2 = "KilFail" wide ascii
        $s3 = "KilSucc" wide ascii
        $s4 = "pkkill" wide ascii
        $s5 = "pklist" wide ascii

    condition:
        all of them
}
YARA Detection Rule: GLOOXMAIL_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Kill process success!" wide ascii
        $s2 = "Kill process failed!" wide ascii
        $s3 = "Sleep success!" wide ascii
        $s4 = "based on gloox" wide ascii
        $pdb = "glooxtest.pdb" wide ascii

Detection condition:
all of ($s*) or $pdb

Full rule:
rule GLOOXMAIL_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Kill process success!" wide ascii
        $s2 = "Kill process failed!" wide ascii
        $s3 = "Sleep success!" wide ascii
        $s4 = "based on gloox" wide ascii
        $pdb = "glooxtest.pdb" wide ascii

    condition:
        all of ($s*) or $pdb
}
YARA Detection Rule: GOGGLES_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Kill process success!" wide ascii
        $s2 = "Kill process failed!" wide ascii
        $s3 = "Sleep success!" wide ascii
        $s4 = "based on gloox" wide ascii
        $pdb = "glooxtest.pdb" wide ascii

Detection condition:
all of ($s*) or $pdb

Full rule:
rule GOGGLES_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Kill process success!" wide ascii
        $s2 = "Kill process failed!" wide ascii
        $s3 = "Sleep success!" wide ascii
        $s4 = "based on gloox" wide ascii
        $pdb = "glooxtest.pdb" wide ascii

    condition:
        all of ($s*) or $pdb
}
YARA Detection Rule: HACKSFASE1_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = {cb 39 82 49 42 be 1f 3a}

Detection condition:
all of them

Full rule:
rule HACKSFASE1_APT1
{
    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = {cb 39 82 49 42 be 1f 3a}

    condition:
        all of them
}
YARA Detection Rule: HACKSFASE2_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Send to Server failed." wide ascii
        $s2 = "HandShake with the server failed. Error:" wide ascii
        $s3 = "Decryption Failed. Context Expired." wide ascii

Detection condition:
all of them

Full rule:
rule HACKSFASE2_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Send to Server failed." wide ascii
        $s2 = "HandShake with the server failed. Error:" wide ascii
        $s3 = "Decryption Failed. Context Expired." wide ascii

    condition:
        all of them
}
YARA Detection Rule: KURTON_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
        $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
        $s3 = "MyTmpFile.Dat" wide ascii
        $s4 = "SvcHost.DLL.log" wide ascii

Detection condition:
all of them

Full rule:
rule KURTON_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Mozilla/4.0 (compatible; MSIE8.0; Windows NT 5.1)" wide ascii
        $s2 = "!(*@)(!@PORT!(*@)(!@URL" wide ascii
        $s3 = "MyTmpFile.Dat" wide ascii
        $s4 = "SvcHost.DLL.log" wide ascii

    condition:
        all of them
}
YARA Detection Rule: LONGRUN_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
        $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
        $s3 = "wait:" wide ascii
        $s4 = "Dcryption Error! Invalid Character" wide ascii

Detection condition:
all of them

Full rule:
rule LONGRUN_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0; Trident/4.0)" wide ascii
        $s2 = "%s\\%c%c%c%c%c%c%c" wide ascii
        $s3 = "wait:" wide ascii
        $s4 = "Dcryption Error! Invalid Character" wide ascii

    condition:
        all of them
}
YARA Detection Rule: MACROMAIL_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "svcMsn.dll" wide ascii
        $s2 = "RundllInstall" wide ascii
        $s3 = "Config service %s ok." wide ascii
        $s4 = "svchost.exe" wide ascii

Detection condition:
all of them

Full rule:
rule MACROMAIL_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "svcMsn.dll" wide ascii
        $s2 = "RundllInstall" wide ascii
        $s3 = "Config service %s ok." wide ascii
        $s4 = "svchost.exe" wide ascii

    condition:
        all of them
}
YARA Detection Rule: MANITSME_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Install an Service hosted by SVCHOST." wide ascii
        $s2 = "The Dll file that to be released." wide ascii
        $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
        $s4 = "svchost.exe" wide ascii
        $e1 = "Man,it's me" wide ascii
        $e2 = "Oh,shit" wide ascii
        $e3 = "Hallelujah" wide ascii
        $e4 = "nRet == SOCKET_ERROR" wide ascii
        $pdb1 = "rouji\\release\\Install.pdb" wide ascii
        $pdb2 = "rouji\\SvcMain.pdb" wide ascii

Detection condition:
(all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2

Full rule:
rule MANITSME_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Install an Service hosted by SVCHOST." wide ascii
        $s2 = "The Dll file that to be released." wide ascii
        $s3 = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
        $s4 = "svchost.exe" wide ascii
        $e1 = "Man,it's me" wide ascii
        $e2 = "Oh,shit" wide ascii
        $e3 = "Hallelujah" wide ascii
        $e4 = "nRet == SOCKET_ERROR" wide ascii
        $pdb1 = "rouji\\release\\Install.pdb" wide ascii
        $pdb2 = "rouji\\SvcMain.pdb" wide ascii

    condition:
        (all of ($s*)) or (all of ($e*)) or $pdb1 or $pdb2
}
YARA Detection Rule: MINIASP_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "miniasp" wide ascii
        $s2 = "wakeup=" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "command is null!" wide ascii
        $s5 = "device_input.asp?device_t=" wide ascii

Detection condition:
all of them

Full rule:
rule MINIASP_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "miniasp" wide ascii
        $s2 = "wakeup=" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "command is null!" wide ascii
        $s5 = "device_input.asp?device_t=" wide ascii

    condition:
        all of them
}
YARA Detection Rule: NEWSREELS_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
        $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "command is null!" wide ascii
        $s5 = "noclient" wide ascii
        $s6 = "wait" wide ascii
        $s7 = "active" wide ascii
        $s8 = "hello" wide ascii

Detection condition:
all of them

Full rule:
rule NEWSREELS_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "Mozilla/4.0 (compatible; Windows NT 5.1; MSIE 7.0)" wide ascii
        $s2 = "name=%s&userid=%04d&other=%c%s" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "command is null!" wide ascii
        $s5 = "noclient" wide ascii
        $s6 = "wait" wide ascii
        $s7 = "active" wide ascii
        $s8 = "hello" wide ascii

    condition:
        all of them
}
YARA Detection Rule: SEASALT_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
        $s2 = "upfileok" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "upfileer" wide ascii
        $s5 = "fxftest" wide ascii

Detection condition:
all of them

Full rule:
rule SEASALT_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
      
    strings:
        $s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98) KSMM" wide ascii
        $s2 = "upfileok" wide ascii
        $s3 = "download ok!" wide ascii
        $s4 = "upfileer" wide ascii
        $s5 = "fxftest" wide ascii

    condition:
        all of them
}
YARA Detection Rule: STARSYPOUND_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "*(SY)# cmd" wide ascii
        $s2 = "send = %d" wide ascii
        $s3 = "cmd.exe" wide ascii
        $s4 = "*(SY)#" wide ascii

Detection condition:
all of them

Full rule:
rule STARSYPOUND_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "*(SY)# cmd" wide ascii
        $s2 = "send = %d" wide ascii
        $s3 = "cmd.exe" wide ascii
        $s4 = "*(SY)#" wide ascii

    condition:
        all of them
}
YARA Detection Rule: SWORD_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
        $s2 = "sleep:" wide ascii
        $s3 = "down:" wide ascii
        $s4 = "*========== Bye Bye ! ==========*" wide ascii

Detection condition:
all of them

Full rule:
rule SWORD_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
       
    strings:
        $s1 = "@***@*@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@>>>" wide ascii
        $s2 = "sleep:" wide ascii
        $s3 = "down:" wide ascii
        $s4 = "*========== Bye Bye ! ==========*" wide ascii

    condition:
        all of them
}
YARA Detection Rule: thequickbrow_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "thequickbrownfxjmpsvalzydg" wide ascii

Detection condition:
all of them

Full rule:
rule thequickbrow_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "thequickbrownfxjmpsvalzydg" wide ascii

    condition:
        all of them
}
YARA Detection Rule: TABMSGSQL_APT1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$s1 = "letusgohtppmmv2.0.0.1" wide ascii
        $s2 = "Mozilla/4.0 (compatible; )" wide ascii
        $s3 = "filestoc" wide ascii
        $s4 = "filectos" wide ascii
        $s5 = "reshell" wide ascii

Detection condition:
all of them

Full rule:
rule TABMSGSQL_APT1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $s1 = "letusgohtppmmv2.0.0.1" wide ascii
        $s2 = "Mozilla/4.0 (compatible; )" wide ascii
        $s3 = "filestoc" wide ascii
        $s4 = "filectos" wide ascii
        $s5 = "reshell" wide ascii

    condition:
        all of them
}
YARA Detection Rule: CCREWBACK1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "postvalue" wide ascii
        $b = "postdata" wide ascii
        $c = "postfile" wide ascii
        $d = "hostname" wide ascii
        $e = "clientkey" wide ascii
        $f = "start Cmd Failure!" wide ascii
        $g = "sleep:" wide ascii
        $h = "downloadcopy:" wide ascii
        $i = "download:" wide ascii
        $j = "geturl:" wide ascii
        $k = "1.234.1.68" wide ascii

Detection condition:
4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k

Full rule:
rule CCREWBACK1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "postvalue" wide ascii
        $b = "postdata" wide ascii
        $c = "postfile" wide ascii
        $d = "hostname" wide ascii
        $e = "clientkey" wide ascii
        $f = "start Cmd Failure!" wide ascii
        $g = "sleep:" wide ascii
        $h = "downloadcopy:" wide ascii
        $i = "download:" wide ascii
        $j = "geturl:" wide ascii
        $k = "1.234.1.68" wide ascii

    condition:
        4 of ($a,$b,$c,$d,$e) or $f or 3 of ($g,$h,$i,$j) or $k
}
YARA Detection Rule: TrojanCookies_CCREW
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "sleep:" wide ascii
        $b = "content=" wide ascii
        $c = "reqpath=" wide ascii
        $d = "savepath=" wide ascii
        $e = "command=" wide ascii

Detection condition:
4 of ($a,$b,$c,$d,$e)

Full rule:
rule TrojanCookies_CCREW
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
     strings:
        $a = "sleep:" wide ascii
        $b = "content=" wide ascii
        $c = "reqpath=" wide ascii
        $d = "savepath=" wide ascii
        $e = "command=" wide ascii

    condition:
        4 of ($a,$b,$c,$d,$e)
}
YARA Detection Rule: GEN_CCREW1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "W!r@o#n$g" wide ascii
        $b = "KerNel32.dll" wide ascii

Detection condition:
any of them

Full rule:
rule GEN_CCREW1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "W!r@o#n$g" wide ascii
        $b = "KerNel32.dll" wide ascii

    condition:
        any of them
}
YARA Detection Rule: Elise
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "SetElise.pdb" wide ascii

Detection condition:
$a

Full rule:
rule Elise
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
       
    strings:
        $a = "SetElise.pdb" wide ascii

    condition:
        $a
}
YARA Detection Rule: EclipseSunCloudRAT
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "Eclipse_A" wide ascii
        $b = "\\PJTS\\" wide ascii
        $c = "Eclipse_Client_B.pdb" wide ascii
        $d = "XiaoME" wide ascii
        $e = "SunCloud-Code" wide ascii
        $f = "/uc_server/data/forum.asp" wide ascii

Detection condition:
any of them

Full rule:
rule EclipseSunCloudRAT
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "Eclipse_A" wide ascii
        $b = "\\PJTS\\" wide ascii
        $c = "Eclipse_Client_B.pdb" wide ascii
        $d = "XiaoME" wide ascii
        $e = "SunCloud-Code" wide ascii
        $f = "/uc_server/data/forum.asp" wide ascii

    condition:
        any of them
}
YARA Detection Rule: MoonProject
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "Serverfile is smaller than Clientfile" wide ascii
        $b = "\\M tools\\" wide ascii
        $c = "MoonDLL" wide ascii
        $d = "\\M tools\\" wide ascii

Detection condition:
any of them

Full rule:
rule MoonProject
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
       
    strings:
        $a = "Serverfile is smaller than Clientfile" wide ascii
        $b = "\\M tools\\" wide ascii
        $c = "MoonDLL" wide ascii
        $d = "\\M tools\\" wide ascii

  condition:
        any of them
}
YARA Detection Rule: ccrewDownloader1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}

Detection condition:
any of them

Full rule:
rule ccrewDownloader1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = {DD B5 61 F0 20 47 20 57 D6 65 9C CB 31 1B 65 42}

    condition:
        any of them
}
YARA Detection Rule: ccrewDownloader2
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "3gZFQOBtY3sifNOl" wide ascii
        $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
        $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii

Detection condition:
any of them

Full rule:
rule ccrewDownloader2
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "3gZFQOBtY3sifNOl" wide ascii
        $b = "docbWUWsc2gRMv9HN7TFnvnKcrWUUFdAEem9DkqRALoD" wide ascii
        $c = "6QVSOZHQPCMc2A8HXdsfuNZcmUnIqWrOIjrjwOeagILnnScxadKEr1H2MZNwSnaJ" wide ascii

    condition:
        any of them
}
YARA Detection Rule: ccrewMiniasp
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "MiniAsp.pdb" wide ascii
        $b = "device_t=" wide ascii

Detection condition:
any of them

Full rule:
rule ccrewMiniasp
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        

  strings:
        $a = "MiniAsp.pdb" wide ascii
        $b = "device_t=" wide ascii

  condition:
        any of them
}
YARA Detection Rule: ccrewSSLBack2
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = {39 82 49 42 BE 1F 3A}

Detection condition:
any of them

Full rule:
rule ccrewSSLBack2
{
    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = {39 82 49 42 BE 1F 3A}

    condition:
        any of them
}
YARA Detection Rule: ccrewSSLBack3
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "SLYHKAAY" wide ascii

Detection condition:
any of them

Full rule:
rule ccrewSSLBack3
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "SLYHKAAY" wide ascii

  condition:
        any of them
}
YARA Detection Rule: ccrewSSLBack1
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "!@#%$^#@!" wide ascii
        $b = "64.91.80.6" wide ascii

Detection condition:
any of them

Full rule:
rule ccrewSSLBack1
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "!@#%$^#@!" wide ascii
        $b = "64.91.80.6" wide ascii

  condition:
        any of them
}
YARA Detection Rule: ccrewDownloader3
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "ejlcmbv" wide ascii
        $b = "bhxjuisv" wide ascii
        $c = "yqzgrh" wide ascii
        $d = "uqusofrp" wide ascii
        $e = "Ljpltmivvdcbb" wide ascii
        $f = "frfogjviirr" wide ascii
        $g = "ximhttoskop" wide ascii

Detection condition:
4 of them

Full rule:
rule ccrewDownloader3
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "ejlcmbv" wide ascii
        $b = "bhxjuisv" wide ascii
        $c = "yqzgrh" wide ascii
        $d = "uqusofrp" wide ascii
        $e = "Ljpltmivvdcbb" wide ascii
        $f = "frfogjviirr" wide ascii
        $g = "ximhttoskop" wide ascii

    condition:
        4 of them
}
YARA Detection Rule: ccrewQAZ
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "!QAZ@WSX" wide ascii

Detection condition:
$a

Full rule:
rule ccrewQAZ
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "!QAZ@WSX" wide ascii

  condition:
        $a
}
YARA Detection Rule: metaxcd
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "<meta xcd=" wide ascii

Detection condition:
$a

Full rule:
rule metaxcd
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "<meta xcd=" wide ascii

    condition:
        $a
}
YARA Detection Rule: MiniASP
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$KEY = { 71 30 6E 63 39 77 38 65 64 61 6F 69 75 6B 32 6D 7A 72 66 79 33 78 74 31 70 35 6C 73 36 37 67 34 62 76 68 6A }
        $PDB = "MiniAsp.pdb" nocase wide ascii

Detection condition:
any of them

Full rule:
rule MiniASP
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $KEY = { 71 30 6E 63 39 77 38 65 64 61 6F 69 75 6B 32 6D 7A 72 66 79 33 78 74 31 70 35 6C 73 36 37 67 34 62 76 68 6A }
        $PDB = "MiniAsp.pdb" nocase wide ascii

    condition:
        any of them
}
YARA Detection Rule: DownloaderPossibleCCrew
Repository: Yara-Rules/rules
Author: AlienVault Labs

Pattern signatures:
$a = "%s?%.6u" wide ascii
        $b = "szFileUrl=%s" wide ascii
        $c = "status=%u" wide ascii
        $d = "down file success" wide ascii
        $e = "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" wide ascii

Detection condition:
all of them

Full rule:
rule DownloaderPossibleCCrew
{

    meta:
        author = "AlienVault Labs"
        info = "CommentCrew-threat-apt1"
        
    strings:
        $a = "%s?%.6u" wide ascii
        $b = "szFileUrl=%s" wide ascii
        $c = "status=%u" wide ascii
        $d = "down file success" wide ascii
        $e = "Mozilla/4.0 (compatible; MSIE 6.0; Win32)" wide ascii

  condition:
        all of them
}