deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: OilRig_Malware_Campaign_Gen3
Repository: Neo23x0/signature-base
Detects: Detects Oilrig malware samples
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
      $x2 = "\\Libraries\\fireueye.vbs" ascii
      $x3 = "\\Libraries\\fireeye.vbs&" wide

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 100KB and 1 of them )

Full rule:
rule OilRig_Malware_Campaign_Gen3 {
   meta:
      description = "Detects Oilrig malware samples"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      modified = "2023-01-07"
      hash1 = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
      hash2 = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
      hash3 = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
      id = "1cd5f7ea-4ae6-5642-b8b3-050cfe724e69"
   strings:
      $x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
      $x2 = "\\Libraries\\fireueye.vbs" ascii
      $x3 = "\\Libraries\\fireeye.vbs&" wide
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 100KB and 1 of them )
}
YARA Detection Rule: OilRig_Malware_Campaign_Mal2
Repository: Neo23x0/signature-base
Detects: Detects malware from OilRig Campaign
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
      $x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
      $x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
      $x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
      $x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
      $x6 = "2dy53My5vcmcvMjAw" fullword wide /* base64 encoded string 'w.w3.org/200' */

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 200KB and 1 of them )

Full rule:
rule OilRig_Malware_Campaign_Mal2 {
   meta:
      description = "Detects malware from OilRig Campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      hash1 = "65920eaea00764a245acb58a[PII_REDACTED]b78a7bcc9efaec5bf811573084b6cf"
      id = "7a6c38e7-bed9-524b-b4a5-c6c895b9c049"
   strings:
      $x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
      $x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
      $x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
      $x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
      $x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
      $x6 = "2dy53My5vcmcvMjAw" fullword wide /* base64 encoded string 'w.w3.org/200' */
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 200KB and 1 of them )
}
YARA Detection Rule: OilRig_Campaign_Reconnaissance
Repository: Neo23x0/signature-base
Detects: Detects Windows discovery commands - known from OilRig Campaign
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$s1 = "whoami & hostname & ipconfig /all" ascii
      $s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
      $s3 = "net group \"domain admins\" /domain 2>&1 & " ascii

Detection condition:
( filesize < 1KB and 1 of them )

Full rule:
rule OilRig_Campaign_Reconnaissance {
   meta:
      description = "Detects Windows discovery commands - known from OilRig Campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      hash1 = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
      id = "a4fe24b8-290a-5a4a-9f81-bbbd9aae6c6e"
   strings:
      $s1 = "whoami & hostname & ipconfig /all" ascii
      $s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
      $s3 = "net group \"domain admins\" /domain 2>&1 & " ascii
   condition:
      ( filesize < 1KB and 1 of them )
}
YARA Detection Rule: OilRig_Malware_Campaign_Mal3
Repository: Neo23x0/signature-base
Detects: Detects malware from OilRig Campaign
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/QMRZ8K

Pattern signatures:
$x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
      $x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
      $x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii

Detection condition:
( filesize < 10KB and 1 of them )

Full rule:
rule OilRig_Malware_Campaign_Mal3 {
   meta:
      description = "Detects malware from OilRig Campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/QMRZ8K"
      date = "2016-10-12"
      hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
      id = "e5967b39-5d21-5a6a-a1b5-2ec122f16444"
   strings:
      $x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
      $x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
      $x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii
   condition:
      ( filesize < 10KB and 1 of them )
}
YARA Detection Rule: OilRig_Malware_Nov17_13
Repository: Neo23x0/signature-base
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ClearskySec/status/[PII_REDACTED]33018113

Pattern signatures:
$x1 = "\\Release\\dnscat2.pdb" ascii
      $x2 = "cscript.exe //T:20 //Nologo " fullword ascii

      $a1 = "taskkill /F /IM cscript.exe" fullword ascii
      $a2 = "cmd.exe /c " fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 3000KB and (
        pe.imphash() == "0160250adfc97f9d4a12dd067323ec61" or
        1 of ($x*) or
        all of ($a*)
      )

Full rule:
rule OilRig_Malware_Nov17_13 {
   meta:
      description = ""
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ClearskySec/status/[PII_REDACTED]33018113"
      date = "2017-11-22"
      hash1 = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
      id = "c45b8d30-6a5f-5dac-a202-6748ba7b7bd2"
   strings:
      $x1 = "\\Release\\dnscat2.pdb" ascii
      $x2 = "cscript.exe //T:20 //Nologo " fullword ascii

      $a1 = "taskkill /F /IM cscript.exe" fullword ascii
      $a2 = "cmd.exe /c " fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 3000KB and (
        pe.imphash() == "0160250adfc97f9d4a12dd067323ec61" or
        1 of ($x*) or
        all of ($a*)
      )
}
YARA Detection Rule: Oilrig_IntelSecurityManager_macro
Repository: Neo23x0/signature-base
Detects: Detects OilRig malware
Author: Eyal Sela (slightly modified by Florian Roth)
Reference: Internal Research

Pattern signatures:
$one1 = "$c$m$$d$.$$" ascii wide
      $one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
      $one3 = "$$%$a$$p$p$$d$a$" ascii wide
      $one4 = ".$t$$x$t$$" ascii wide
      $one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
      $one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
      $one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide

      $two1 = "& SchTasks /Delete /F /TN " ascii wide
      $two2 = "SecurityAssist" ascii wide
      $two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
      $two4 = "/Delete /F /TN Conhost & del" ascii wide
      $two5 = "NullRefrencedException" ascii wide
      $two6 = "error has occurred in user32.dll by" ascii wide
      $two7 = "NullRefrencedException" ascii wide

Detection condition:
filesize < 300KB and 1 of ($one*) or 2 of ($two*)

Full rule:
rule Oilrig_IntelSecurityManager_macro {
   meta:
      description = "Detects OilRig malware"
      author = "Eyal Sela (slightly modified by Florian Roth)"
      reference = "Internal Research"
      date = "2018-01-19"
      id = "4cccc0df-a225-5500-be55-f4ae346e066e"
   strings:
      $one1 = "$c$m$$d$.$$" ascii wide
      $one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
      $one3 = "$$%$a$$p$p$$d$a$" ascii wide
      $one4 = ".$t$$x$t$$" ascii wide
      $one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
      $one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
      $one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide

      $two1 = "& SchTasks /Delete /F /TN " ascii wide
      $two2 = "SecurityAssist" ascii wide
      $two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
      $two4 = "/Delete /F /TN Conhost & del" ascii wide
      $two5 = "NullRefrencedException" ascii wide
      $two6 = "error has occurred in user32.dll by" ascii wide
      $two7 = "NullRefrencedException" ascii wide
   condition:
      filesize < 300KB and 1 of ($one*) or 2 of ($two*)
}
YARA Detection Rule: Oilrig_IntelSecurityManager
Repository: Neo23x0/signature-base
Detects: Detects OilRig malware
Author: Eyal Sela
Reference: Internal Research

Pattern signatures:
$one1 = "srvResesponded" ascii wide fullword
      $one2 = "InetlSecurityAssistManager" ascii wide fullword
      $one3 = "srvCheckresponded" ascii wide fullword
      $one4 = "IntelSecurityManager" ascii wide
      $one5 = "msoffice365cdn.com" ascii wide
      $one6 = "\\tmpCa.vbs" ascii wide
      $one7 = "AAZFinish" ascii wide fullword
      $one8 = "AAZUploaded" ascii wide fullword
      $one9 = "ABZFinish" ascii wide fullword
      $one10 = "\\tmpCa.vbs" ascii wide

Detection condition:
filesize < 300KB and any of them

Full rule:
rule Oilrig_IntelSecurityManager {
   meta:
      description = "Detects OilRig malware"
      author = "Eyal Sela"
      reference = "Internal Research"
      date = "2018-01-19"
      id = "4cccc0df-a225-5500-be55-f4ae346e066e"
   strings:
      $one1 = "srvResesponded" ascii wide fullword
      $one2 = "InetlSecurityAssistManager" ascii wide fullword
      $one3 = "srvCheckresponded" ascii wide fullword
      $one4 = "IntelSecurityManager" ascii wide
      $one5 = "msoffice365cdn.com" ascii wide
      $one6 = "\\tmpCa.vbs" ascii wide
      $one7 = "AAZFinish" ascii wide fullword
      $one8 = "AAZUploaded" ascii wide fullword
      $one9 = "ABZFinish" ascii wide fullword
      $one10 = "\\tmpCa.vbs" ascii wide
   condition:
      filesize < 300KB and any of them
}
YARA Detection Rule: APT_APT34_PS_Malware_Apr19_1
Repository: Neo23x0/signature-base
Detects: Detects APT34 PowerShell malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656

Pattern signatures:
$x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
      $x2 = "Write-Host \"excepton occured!\"" ascii /* :) */

      $s1 = "Start-Sleep -s 1;" fullword ascii
      $s2 = "Start-Sleep -m 100;" fullword ascii

Detection condition:
1 of ($x*) or 2 of them

Full rule:
rule APT_APT34_PS_Malware_Apr19_1 {
   meta:
      description = "Detects APT34 PowerShell malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656"
      date = "2019-04-17"
      hash1 = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
      id = "6a082c5a-ee5b-5002-9148-61bbcfedfe68"
   strings:
      $x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
      $x2 = "Write-Host \"excepton occured!\"" ascii /* :) */

      $s1 = "Start-Sleep -s 1;" fullword ascii
      $s2 = "Start-Sleep -m 100;" fullword ascii
   condition:
      1 of ($x*) or 2 of them
}
YARA Detection Rule: APT_APT34_PS_Malware_Apr19_2
Repository: Neo23x0/signature-base
Detects: Detects APT34 PowerShell malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656

Pattern signatures:
$x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
      $x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
      $x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii

      $s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
      $s2 = " -eq \"dom\"){$" ascii
      $s3 = " -eq \"srv\"){$" ascii
      $s4 = "+\"<>\" | Set-Content" ascii

Detection condition:
1 of ($x*) and 3 of them

Full rule:
rule APT_APT34_PS_Malware_Apr19_2 {
   meta:
      description = "Detects APT34 PowerShell malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656"
      date = "2019-04-17"
      hash1 = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b[PII_REDACTED]0fcd459"
      id = "c3bdadfd-2164-5e33-be84-d5d5de8eb048"
   strings:
      $x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
      $x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
      $x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii

      $s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
      $s2 = " -eq \"dom\"){$" ascii
      $s3 = " -eq \"srv\"){$" ascii
      $s4 = "+\"<>\" | Set-Content" ascii
   condition:
      1 of ($x*) and 3 of them
}
YARA Detection Rule: APT_APT34_PS_Malware_Apr19_3
Repository: Neo23x0/signature-base
Detects: Detects APT34 PowerShell malware
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656

Pattern signatures:
$x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
      $x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
      $x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
      $x4 = "wscript /b \\`\"${global:$address1" ascii
      $x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
      $x6 = ".run command1, 0, false\" | Out-File " ascii
      $x7 = "\\UpdateTask.vbs" ascii
      $x8 = "hUpdater.ps1" fullword ascii

Detection condition:
1 of them

Full rule:
rule APT_APT34_PS_Malware_Apr19_3 {
   meta:
      description = "Detects APT34 PowerShell malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/0xffff0800/status/[PII_REDACTED]65126656"
      date = "2019-04-17"
      modified = "2023-01-06"
      hash1 = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
      id = "361582e7-94e3-5608-9ba9-31fa20c37cf0"
   strings:
      $x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
      $x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
      $x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
      $x4 = "wscript /b \\`\"${global:$address1" ascii
      $x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
      $x6 = ".run command1, 0, false\" | Out-File " ascii
      $x7 = "\\UpdateTask.vbs" ascii
      $x8 = "hUpdater.ps1" fullword ascii
   condition:
      1 of them
}
YARA Detection Rule: SUSP_RAR_NtdsDIT
Repository: Neo23x0/signature-base
Detects: Detects suspicious RAR file that contains ntds.dit or SAM export
Author: Florian Roth (Nextron Systems)
Reference: https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers

Pattern signatures:
$x1 = "ntds.dit0" ascii fullword
      $x2 = { 0? 53 41 4D 30 01 00 03 }  // SAM0
      $x3 = { 0? 73 61 6D 30 01 00 03 }  // sam0

Detection condition:
uint32(0) == 0x21726152 // Rar!
      and 1 of them

Full rule:
rule SUSP_RAR_NtdsDIT {
   meta:
      description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
      date = "2019-12-16"
      modified = "2022-11-15" // only synced the name with our internal rule
      score = 70
      id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"
   strings:
      $x1 = "ntds.dit0" ascii fullword
      $x2 = { 0? 53 41 4D 30 01 00 03 }  // SAM0
      $x3 = { 0? 73 61 6D 30 01 00 03 }  // sam0
   condition:
      uint32(0) == 0x21726152 // Rar!
      and 1 of them
}
YARA Detection Rule: Suckfly_Nidiran_Gen_1
Repository: Neo23x0/signature-base
Detects: Detects Suckfly Nidiran Trojan
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates

Pattern signatures:
$s1 = "WriteProcessMemory fail at %d " fullword ascii
      $s2 = "CreateRemoteThread fail at %d " fullword ascii
      $s3 = "CreateRemoteThread Succ" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and 2 of them

Full rule:
rule Suckfly_Nidiran_Gen_1 {
   meta:
      description = "Detects Suckfly Nidiran Trojan"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
      date = "2018-01-28"
      hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
      id = "1abc596a-5fb1-55f9-b72d-022bfc6d10c7"
   strings:
      $s1 = "WriteProcessMemory fail at %d " fullword ascii
      $s2 = "CreateRemoteThread fail at %d " fullword ascii
      $s3 = "CreateRemoteThread Succ" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 2 of them
}
YARA Detection Rule: Suckfly_Nidiran_Gen_2
Repository: Neo23x0/signature-base
Detects: Detects Suckfly Nidiran Trojan
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates

Pattern signatures:
$x1 = "WorkDll.dll" fullword ascii
      $x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii

      $s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
      $s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
      $s3 = "before CreateRemoteThread" fullword ascii
      $s4 = "CreateRemoteThread Succ" fullword ascii
      $s5 = "Microsoft Security Accounts Manager" fullword ascii
      $s6 = "DoRunRemote" fullword ascii
      $s7 = "AutoRunFun" fullword ascii
      $s8 = "ServiceMain is called" fullword ascii
      $s9 = "DllRegisterServer is called" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 200KB and (
        1 of ($x*) or
        4 of them
      )

Full rule:
rule Suckfly_Nidiran_Gen_2 {
   meta:
      description = "Detects Suckfly Nidiran Trojan"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
      date = "2018-01-28"
      hash1 = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
      hash2 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf[PII_REDACTED]f3746995f4564046fbdf"
      id = "b090079d-1c22-5931-a25b-e960343a610f"
   strings:
      $x1 = "WorkDll.dll" fullword ascii
      $x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii

      $s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
      $s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
      $s3 = "before CreateRemoteThread" fullword ascii
      $s4 = "CreateRemoteThread Succ" fullword ascii
      $s5 = "Microsoft Security Accounts Manager" fullword ascii
      $s6 = "DoRunRemote" fullword ascii
      $s7 = "AutoRunFun" fullword ascii
      $s8 = "ServiceMain is called" fullword ascii
      $s9 = "DllRegisterServer is called" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and (
        1 of ($x*) or
        4 of them
      )
}
YARA Detection Rule: Suckfly_Nidiran_Gen_3
Repository: Neo23x0/signature-base
Detects: Detects Suckfly Nidiran Trojan
Author: Florian Roth (Nextron Systems)
Reference: https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates

Pattern signatures:
$x1 = "RUN SHELLCODE FAIL" fullword ascii
      $x2 = "RUN PROCESS FAILD!" fullword ascii
      $x3 = "DOWNLOAD FILE FAILD" fullword ascii
      $x4 = "MODIFYCONFIG FAIL!" fullword ascii
      $x5 = "GetFileAttributes FILE FAILD" fullword ascii
      $x6 = "MODIFYCONFIG SUCC!" fullword ascii

      $s1 = "cmd.exe /c %s" fullword ascii
      $s2 = "error to create pipe!" fullword ascii
      $s3 = "%s\\%08x.exe" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (
        pe.imphash() == "ae0f4ebf7e8ce91d6548318a3cf82b7a" or
        1 of ($x*) or
        2 of them
      )

Full rule:
rule Suckfly_Nidiran_Gen_3 {
   meta:
      description = "Detects Suckfly Nidiran Trojan"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
      date = "2018-01-28"
      hash1 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
      hash2 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
      id = "d9daf7e4-2cfa-50c9-84d2-c971734abe5e"
   strings:
      $x1 = "RUN SHELLCODE FAIL" fullword ascii
      $x2 = "RUN PROCESS FAILD!" fullword ascii
      $x3 = "DOWNLOAD FILE FAILD" fullword ascii
      $x4 = "MODIFYCONFIG FAIL!" fullword ascii
      $x5 = "GetFileAttributes FILE FAILD" fullword ascii
      $x6 = "MODIFYCONFIG SUCC!" fullword ascii

      $s1 = "cmd.exe /c %s" fullword ascii
      $s2 = "error to create pipe!" fullword ascii
      $s3 = "%s\\%08x.exe" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and (
        pe.imphash() == "ae0f4ebf7e8ce91d6548318a3cf82b7a" or
        1 of ($x*) or
        2 of them
      )
}
YARA Detection Rule: ce_enfal_cmstar_debug_msg
Repository: Neo23x0/signature-base
Detects: Detects the static debug strings within CMSTAR
Author: rfalcone
Reference: http://goo.gl/JucrP9

Pattern signatures:
$d1 = "EEE\x0d\x0a" fullword
		$d2 = "TKE\x0d\x0a" fullword
		$d3 = "VPE\x0d\x0a" fullword
		$d4 = "VPS\x0d\x0a" fullword
		$d5 = "WFSE\x0d\x0a" fullword
		$d6 = "WFSS\x0d\x0a" fullword
		$d7 = "CM**\x0d\x0a" fullword

Detection condition:
uint16(0) == 0x5a4d and all of ($d*)

Full rule:
rule ce_enfal_cmstar_debug_msg {
	meta:
		author = "rfalcone"
		description = "Detects the static debug strings within CMSTAR"
		reference = "http://goo.gl/JucrP9"
		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
		date = "5/10/2015"
		id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"
	strings:
		$d1 = "EEE\x0d\x0a" fullword
		$d2 = "TKE\x0d\x0a" fullword
		$d3 = "VPE\x0d\x0a" fullword
		$d4 = "VPS\x0d\x0a" fullword
		$d5 = "WFSE\x0d\x0a" fullword
		$d6 = "WFSS\x0d\x0a" fullword
		$d7 = "CM**\x0d\x0a" fullword
	condition:
		uint16(0) == 0x5a4d and all of ($d*)
}