deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationDrug_Keylogger
Repository: Yara-Rules/rules
Detects: EquationDrug - Key/clipboard logger driver - msrtvd.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
        $s3 = "\\DosDevices\\Gk" fullword wide
        $s5 = "\\Device\\Gk0" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_Keylogger 
{

    meta:
        description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"

    strings:
        $s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
        $s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
        $s3 = "\\DosDevices\\Gk" fullword wide
        $s5 = "\\Device\\Gk0" fullword wide

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_NetworkSniffer4
Repository: Yara-Rules/rules
Detects: EquationDrug - Network-sniffer/patcher - atmdkdrv.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
        $s1 = "\\systemroot\\" fullword ascii
        $s2 = "RAVISENT Technologies Inc." fullword wide
        $s3 = "Created by VIONA Development" fullword wide
        $s4 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s5 = "\\device\\harddiskvolume" fullword wide
        $s7 = "ATMDKDRV.SYS" fullword wide
        $s8 = "\\Device\\%ws_%ws" fullword wide
        $s9 = "\\DosDevices\\%ws" fullword wide
        $s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
        $s11 = "\\Device\\%ws" fullword wide
        $s13 = "CineMaster C 1.1 WDM" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer4 
{

    meta:
        description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "cace40965f8600a24a2457f7792efba3bd84d9ba"

    strings:
        $s0 = "Copyright 1999 RAVISENT Technologies Inc." fullword wide
        $s1 = "\\systemroot\\" fullword ascii
        $s2 = "RAVISENT Technologies Inc." fullword wide
        $s3 = "Created by VIONA Development" fullword wide
        $s4 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s5 = "\\device\\harddiskvolume" fullword wide
        $s7 = "ATMDKDRV.SYS" fullword wide
        $s8 = "\\Device\\%ws_%ws" fullword wide
        $s9 = "\\DosDevices\\%ws" fullword wide
        $s10 = "CineMaster C 1.1 WDM Main Driver" fullword wide
        $s11 = "\\Device\\%ws" fullword wide
        $s13 = "CineMaster C 1.1 WDM" fullword wide

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_PlatformOrchestrator
Repository: Yara-Rules/rules
Detects: EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "SERVICES.EXE" fullword wide
        $s1 = "\\command.com" fullword wide
        $s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s3 = "LSASS.EXE" fullword wide
        $s4 = "Windows Configuration Services" fullword wide
        $s8 = "unilay.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule EquationDrug_PlatformOrchestrator 
{

    meta:
        description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "febc4f30786db7804008dc9bc1cebdc26993e240"

    strings:
        $s0 = "SERVICES.EXE" fullword wide
        $s1 = "\\command.com" fullword wide
        $s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s3 = "LSASS.EXE" fullword wide
        $s4 = "Windows Configuration Services" fullword wide
        $s8 = "unilay.dll" fullword ascii

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_NetworkSniffer5
Repository: Yara-Rules/rules
Detects: EquationDrug - Network-sniffer/patcher - atmdkdrv.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s2 = "atmdkdrv.sys" fullword wide
        $s4 = "\\Device\\%ws_%ws" fullword wide
        $s5 = "\\DosDevices\\%ws" fullword wide
        $s6 = "\\Device\\%ws" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_NetworkSniffer5 
{

    meta:
        description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "09399b9bd600d4516db37307a457bc55eedcbd17"

    strings:
        $s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
        $s1 = "\\Registry\\User\\CurrentUser\\" fullword wide
        $s2 = "atmdkdrv.sys" fullword wide
        $s4 = "\\Device\\%ws_%ws" fullword wide
        $s5 = "\\DosDevices\\%ws" fullword wide
        $s6 = "\\Device\\%ws" fullword wide

    condition:
        all of them
}
YARA Detection Rule: EquationDrug_FileSystem_Filter
Repository: Yara-Rules/rules
Detects: EquationDrug - Filesystem filter driver – volrec.sys, scsi2mgr.sys
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/

Pattern signatures:
$s0 = "volrec.sys" fullword wide
        $s1 = "volrec.pdb" fullword ascii
        $s2 = "Volume recognizer driver" fullword wide

Detection condition:
all of them

Full rule:
rule EquationDrug_FileSystem_Filter 
{

    meta:
        description = "EquationDrug - Filesystem filter driver – volrec.sys, scsi2mgr.sys"
        author = "Florian Roth @4nc4p"
        reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
        date = "2015/03/11"
        hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"

    strings:
        $s0 = "volrec.sys" fullword wide
        $s1 = "volrec.pdb" fullword ascii
        $s2 = "Volume recognizer driver" fullword wide

    condition:
        all of them
}
YARA Detection Rule: apt_equation_keyword
Repository: Yara-Rules/rules
Detects: Rule to detect Equation group's keyword in executable file
Author: Florian Roth @4nc4p
Reference: http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/

Pattern signatures:
$a1 = "Backsnarf_AB25" wide
         $a2 = "Backsnarf_AB25" ascii

Detection condition:
uint16(0) == 0x5a4d and 1 of ($a*)

Full rule:
rule apt_equation_keyword 
{

    meta:
        description = "Rule to detect Equation group's keyword in executable file"
        author = "Florian Roth @4nc4p"
        last_modified = "2015-09-26"
        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"

    strings:
         $a1 = "Backsnarf_AB25" wide
         $a2 = "Backsnarf_AB25" ascii

    condition:
         uint16(0) == 0x5a4d and 1 of ($a*)
}
YARA Detection Rule: Upatre_Hazgurut
Repository: Yara-Rules/rules
Detects: Detects Upatre malware - file hazgurut.exe
Author: Florian Roth
Reference: https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3?environmentId=7

Pattern signatures:
$a1 = "barcod" fullword ascii

		$s0 = "msports.dll" fullword ascii
		$s1 = "nddeapi.dll" fullword ascii
		$s2 = "glmf32.dll" fullword ascii
		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
		$s4 = "cmutil.dll" fullword ascii
		$s5 = "mprapi.dll" fullword ascii
		$s6 = "glmf32.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1500KB
		and $a1 in (0..4000)
		and all of ($s*)

Full rule:
rule Upatre_Hazgurut {
	meta:
		description = "Detects Upatre malware - file hazgurut.exe"
		author = "Florian Roth"
		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3?environmentId=7"
		date = "2015-10-13"
		score = 70
		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
		hash5 = "a35f9870f9d4b993eb094460b05ee1f[PII_REDACTED]07abe6264121dd7cc12aa70"
		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e[PII_REDACTED]3e2c0e3"
		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
	strings:
		$a1 = "barcod" fullword ascii

		$s0 = "msports.dll" fullword ascii
		$s1 = "nddeapi.dll" fullword ascii
		$s2 = "glmf32.dll" fullword ascii
		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
		$s4 = "cmutil.dll" fullword ascii
		$s5 = "mprapi.dll" fullword ascii
		$s6 = "glmf32.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1500KB
		and $a1 in (0..4000)
		and all of ($s*)
}
YARA Detection Rule: WimmieShellcode
Repository: Yara-Rules/rules
Detects: Wimmie code features
Author: Seth Hardy

Pattern signatures:
// decryption loop
        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }

Detection condition:
any of them

Full rule:
rule WimmieShellcode : Wimmie Family 
{
    meta:
        description = "Wimmie code features"
        author = "Seth Hardy"
        last_modified = "2014-07-17"
        
    strings:
        // decryption loop
        $ = { 49 30 24 39 83 F9 00 77 F7 8D 3D 4D 10 40 00 B9 0C 03 00 00 }
        $xordecrypt = {B9 B4 1D 00 00 [8] 49 30 24 39 83 F9 00 }
        
    condition:
        any of them
}
YARA Detection Rule: WimmieStrings
Repository: Yara-Rules/rules
Detects: Strings used by Wimmie
Author: Seth Hardy

Pattern signatures:
$ = "\x00ScriptMan"
        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
        $ = "ProbeScriptFint" wide ascii
        $ = "ProbeScriptKids"

Detection condition:
any of them

Full rule:
rule WimmieStrings : Wimmie Family
{
    meta:
        description = "Strings used by Wimmie"
        author = "Seth Hardy"
        last_modified = "2014-07-17"
        
    strings:
        $ = "\x00ScriptMan"
        $ = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" wide ascii
        $ = "ProbeScriptFint" wide ascii
        $ = "ProbeScriptKids"
        
    condition:
        any of them

}
YARA Detection Rule: Wimmie
Repository: Yara-Rules/rules
Detects: Wimmie family
Author: Seth Hardy

Detection condition:
WimmieShellcode or WimmieStrings

Full rule:
rule Wimmie : Family
{
    meta:
        description = "Wimmie family"
        author = "Seth Hardy"
        last_modified = "2014-07-17"
   
    condition:
        WimmieShellcode or WimmieStrings
        
}
YARA Detection Rule: BangatCode
Repository: Yara-Rules/rules
Detects: Bangat code features
Author: Seth Hardy

Pattern signatures:
// dec [ebp + procname], push eax, push edx, call get procaddress
        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }

Detection condition:
any of them

Full rule:
rule BangatCode
{
    
    meta:
        description = "Bangat code features"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
    
    strings:
        // dec [ebp + procname], push eax, push edx, call get procaddress
        $ = { FE 4D ?? 8D 4? ?? 50 5? FF }
    
    condition:
        any of them
}
YARA Detection Rule: BangatStrings
Repository: Yara-Rules/rules
Detects: Bangat Identifying Strings
Author: Seth Hardy

Pattern signatures:
$lib1 = "DreatePipe"
        $lib2 = "HetSystemDirectoryA"
        $lib3 = "SeleaseMutex"
        $lib4 = "DloseWindowStation"
        $lib5 = "DontrolService"
        $file = "~hhC2F~.tmp"
        $mc = "~_MC_3~"

Detection condition:
all of ($lib*) or $file or $mc

Full rule:
rule BangatStrings
{
    
    meta:
        description = "Bangat Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    strings:
        $lib1 = "DreatePipe"
        $lib2 = "HetSystemDirectoryA"
        $lib3 = "SeleaseMutex"
        $lib4 = "DloseWindowStation"
        $lib5 = "DontrolService"
        $file = "~hhC2F~.tmp"
        $mc = "~_MC_3~"

    condition:
       all of ($lib*) or $file or $mc
}
YARA Detection Rule: Bangat
Repository: Yara-Rules/rules
Detects: Bangat
Author: Seth Hardy

Detection condition:
BangatCode or BangatStrings

Full rule:
rule Bangat
{
    meta:
        description = "Bangat"
        author = "Seth Hardy"
        last_modified = "2014-07-10"
        
    condition:
        BangatCode or BangatStrings
}
YARA Detection Rule: DirtJumper_drive
Repository: Yara-Rules/rules
Detects: Identify first version of drive DDoS malware
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "<xmp>"

Detection condition:
4 of ($cmd*) and all of ($str*) and not any of ($newver*)

Full rule:
rule DirtJumper_drive
{
   
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        date = "2013-08-26"
        description = "Identify first version of drive DDoS malware"
        source = "https://github.com/arbor/yara/blob/master/drive.yara"
   
    strings:
        $cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "<xmp>"
   
    condition:
        4 of ($cmd*) and all of ($str*) and not any of ($newver*)
}
YARA Detection Rule: DirtJumper_drive2
Repository: Yara-Rules/rules
Detects: Identify newer version of drive DDoS malware
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "-byte"
        $newver3 = "-long"
        $newver4 = "<xmp>"

Detection condition:
4 of ($cmd*) and all of ($str*) and all of ($newver*)

Full rule:
rule DirtJumper_drive2
{
   
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        date = "2013-08-26"
        description = "Identify newer version of drive DDoS malware"
        source = "https://github.com/arbor/yara/blob/master/drive2.yara"
   
    strings:
        $cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "-byte"
        $newver3 = "-long"
        $newver4 = "<xmp>"
  
    condition:
        4 of ($cmd*) and all of ($str*) and all of ($newver*)
}
YARA Detection Rule: DirtJumper_drive3
Repository: Yara-Rules/rules
Detects: Identify version of Drive DDoS malware using compromised sites
Author: Jason Jones <jasonjones@arbor.net>

Pattern signatures:
$cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "-byte"
        $newver3 = "-long"
        $drive3 = "99=1"

Detection condition:
4 of ($cmd*) and all of ($str*) and all of ($newver*) and $drive3

Full rule:
rule DirtJumper_drive3
{
  
    meta:
        author = "Jason Jones <jasonjones@arbor.net>"
        date = "2014-03-17"
        description = "Identify version of Drive DDoS malware using compromised sites"
        source = "https://github.com/arbor/yara/blob/master/drive3.yara"
  
    strings:
        $cmd1 = "-get" fullword
        $cmd2 = "-ip" fullword
        $cmd3 = "-ip2" fullword
        $cmd4 = "-post1" fullword
        $cmd5 = "-post2" fullword
        $cmd6 = "-udp" fullword
        $str1 = "login=[1000]&pass=[1000]&password=[50]&log=[50]&passwrd=[50]&user=[50]&username=[50]&vb_login_username=[50]&vb_login_md5password=[50]"
        $str2 = "-timeout" fullword
        $str3 = "-thread" fullword
        $str4 = " Local; ru) Presto/2.10.289 Version/"
        $str5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT"
        $newver1 = "-icmp"
        $newver2 = "-byte"
        $newver3 = "-long"
        $drive3 = "99=1"
  
    condition:
        4 of ($cmd*) and all of ($str*) and all of ($newver*) and $drive3
}
YARA Detection Rule: PoS_Malware_fastpos
Repository: Yara-Rules/rules
Detects: Used to detect FastPOS keyloggger + scraper
Author: Trend Micro, Inc.
Reference: http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf

Pattern signatures:
$string1 = "uniqyeidclaxemain"
$string2 = "http://%s/cdosys.php"
$string3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
$string4 = "\\The Hook\\Release\\The Hook.pdb" nocase

Detection condition:
all of ($string*)

Full rule:
rule PoS_Malware_fastpos : FastPOS POS keylogger
{
meta:
author = "Trend Micro, Inc."
date = "2016-05-18"
description = "Used to detect FastPOS keyloggger + scraper"
reference = "http://documents.trendmicro.com/assets/fastPOS-quick-and-easy-credit-card-theft.pdf"
sample_filetype = "exe"
strings:
$string1 = "uniqyeidclaxemain"
$string2 = "http://%s/cdosys.php"
$string3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
$string4 = "\\The Hook\\Release\\The Hook.pdb" nocase
condition:
all of ($string*)
}
YARA Detection Rule: Trj_Ponmocup
Repository: Yara-Rules/rules
Detects: Ponmocup Installer
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
                $pac = { 48 8F BB 54 5F 3E 4F 4E }
                $unp = { 8B B8 7C 1F 46 00 33 C8 }

Detection condition:
($mz at 0) and ($pac at 0x61F7C) and ($unp at 0x29F0)

Full rule:
rule Trj_Ponmocup {
        meta:
                author = "Centro Criptológico Nacional (CCN)"
                ref ="https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
                description = "Ponmocup Installer"
        strings:
                $mz = { 4d 5a }
                $pac = { 48 8F BB 54 5F 3E 4F 4E }
                $unp = { 8B B8 7C 1F 46 00 33 C8 }
        condition:
                ($mz at 0) and ($pac at 0x61F7C) and ($unp at 0x29F0)
}
YARA Detection Rule: Trj_Ponmocup_Downloader
Repository: Yara-Rules/rules
Detects: Ponmocup Downloader
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
                $vb5 = "VB5" fullword ascii
                $tpb = "www.thepiratebay.org" fullword wide
                $ua = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; SV1)" fullword wide

Detection condition:
($mz at 0) and ($vb5) and ($tpb) and ($ua)

Full rule:
rule Trj_Ponmocup_Downloader {
        meta:
                author = "Centro Criptológico Nacional (CCN)"
                ref ="https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
                description = "Ponmocup Downloader"
        strings:
                $mz = { 4d 5a }
                $vb5 = "VB5" fullword ascii
                $tpb = "www.thepiratebay.org" fullword wide
                $ua = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; SV1)" fullword wide
        condition:
                ($mz at 0) and ($vb5) and ($tpb) and ($ua)
}
YARA Detection Rule: Trj_Ponmocup_dll
Repository: Yara-Rules/rules
Detects: Ponmocup Bot DLL
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$mz = { 4d 5a }
                $pck = { 00 81 23 00 33 3E 00 00 3B F4 56 00 00 00 7D 00 }
                $upk = { 68 F4 14 00 10 A1 6C C0 02 10 FF D0 59 59 E9 7A }

Detection condition:
($mz at 0) and ($pck at 0x8a50) and ($upk at 0x61f)

Full rule:
rule Trj_Ponmocup_dll {
        meta:
                author = "Centro Criptológico Nacional (CCN)"
                ref ="https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
                description = "Ponmocup Bot DLL"
        strings:
                $mz = { 4d 5a }
                $pck = { 00 81 23 00 33 3E 00 00 3B F4 56 00 00 00 7D 00 }
                $upk = { 68 F4 14 00 10 A1 6C C0 02 10 FF D0 59 59 E9 7A }
        condition:
                ($mz at 0) and ($pck at 0x8a50) and ($upk at 0x61f)
}