deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EQGRP_BananaAid
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BananaAid
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
        $x2 = "scp BGLEE-" ascii
        $x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
        $x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_BananaAid 
{

    meta:
        description = "EQGRP Toolset Firewall - file BananaAid"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"

    strings:
        $x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
        $x2 = "scp BGLEE-" ascii
        $x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
        $x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_bo
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file bo
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "ERROR: failed to open %s: %d" fullword ascii
        $s2 = "__libc_start_main@@GLIBC_2.0" fullword ascii
        $s3 = "serial number: %s" fullword ascii
        $s4 = "strerror@@GLIBC_2.0" fullword ascii
        $s5 = "ERROR: mmap failed: %d" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 20KB and all of them )

Full rule:
rule EQGRP_bo 
{

    meta:
        description = "EQGRP Toolset Firewall - file bo"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"

    strings:
        $s1 = "ERROR: failed to open %s: %d" fullword ascii
        $s2 = "__libc_start_main@@GLIBC_2.0" fullword ascii
        $s3 = "serial number: %s" fullword ascii
        $s4 = "strerror@@GLIBC_2.0" fullword ascii
        $s5 = "ERROR: mmap failed: %d" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 20KB and all of them )
}
YARA Detection Rule: EQGRP_SecondDate_2211
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file SecondDate-2211.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "SD_processControlPacket" fullword ascii
        $s2 = "Encryption_rc4SetKey" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 200KB and all of them )

Full rule:
rule EQGRP_SecondDate_2211 
{

    meta:
        description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"

    strings:
        $s1 = "SD_processControlPacket" fullword ascii
        $s2 = "Encryption_rc4SetKey" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 200KB and all of them )
}
YARA Detection Rule: EQGRP_config_jp1_UA
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file config_jp1_UA.pl
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
        $x2 = "Error running config_implant." fullword ascii
        $x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
        $x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_config_jp1_UA 
{

    meta:
        description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"

    strings:
        $x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
        $x2 = "Error running config_implant." fullword ascii
        $x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
        $x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_userscript
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file userscript.FW
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_userscript 
{

    meta:
        description = "EQGRP Toolset Firewall - file userscript.FW"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"

    strings:
        $x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_BBALL_M50FW08_2201
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = ".got_loader" fullword ascii
        $s2 = "LOADED" fullword ascii
        $s3 = "pageTable.c" fullword ascii
        $s4 = "_start_text" fullword ascii
        $s5 = "handler_readBIOS" fullword ascii
        $s6 = "KEEPGOING" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )

Full rule:
rule EQGRP_BBALL_M50FW08_2201 
{

    meta:
        description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"

    strings:
        $s1 = ".got_loader" fullword ascii
        $s2 = "LOADED" fullword ascii
        $s3 = "pageTable.c" fullword ascii
        $s4 = "_start_text" fullword ascii
        $s5 = "handler_readBIOS" fullword ascii
        $s6 = "KEEPGOING" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 40KB and 5 of ($s*) )
}
YARA Detection Rule: EQGRP_BUSURPER_3001_724
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BUSURPER-3001-724.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "IMPLANT" fullword ascii
        $s2 = "KEEPGOING" fullword ascii
        $s3 = "upgrade_implant" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )

Full rule:
rule EQGRP_BUSURPER_3001_724 
{

    meta:
        description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"

    strings:
        $s1 = "IMPLANT" fullword ascii
        $s2 = "KEEPGOING" fullword ascii
        $s3 = "upgrade_implant" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 200KB and 2 of them ) or ( all of them )
}
YARA Detection Rule: EQGRP_workit
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file workit.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "macdef init > /tmp/.netrc;" fullword ascii
        $s2 = "/usr/bin/wget http://" fullword ascii
        $s3 = "HOME=/tmp ftp" fullword ascii
        $s4 = " >> /tmp/.netrc;" fullword ascii
        $s5 = "/usr/rapidstream/bin/tftp" fullword ascii
        $s6 = "created shell_command:" fullword ascii
        $s7 = "rm -f /tmp/.netrc;" fullword ascii
        $s8 = "echo quit >> /tmp/.netrc;" fullword ascii
        $s9 = "echo binary >> /tmp/.netrc;" fullword ascii
        $s10 = "chmod 600 /tmp/.netrc;" fullword ascii
        $s11 = "created cli_command:" fullword ascii

Detection condition:
6 of them

Full rule:
rule EQGRP_workit 
{

    meta:
        description = "EQGRP Toolset Firewall - file workit.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"

    strings:
        $s1 = "macdef init > /tmp/.netrc;" fullword ascii
        $s2 = "/usr/bin/wget http://" fullword ascii
        $s3 = "HOME=/tmp ftp" fullword ascii
        $s4 = " >> /tmp/.netrc;" fullword ascii
        $s5 = "/usr/rapidstream/bin/tftp" fullword ascii
        $s6 = "created shell_command:" fullword ascii
        $s7 = "rm -f /tmp/.netrc;" fullword ascii
        $s8 = "echo quit >> /tmp/.netrc;" fullword ascii
        $s9 = "echo binary >> /tmp/.netrc;" fullword ascii
        $s10 = "chmod 600 /tmp/.netrc;" fullword ascii
        $s11 = "created cli_command:" fullword ascii
   
    condition:
        6 of them
}
YARA Detection Rule: EQGRP_tinyhttp_setup
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file tinyhttp_setup.sh
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
        $x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
        $x3 = "killall thttpd" fullword ascii
        $x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii

Detection condition:
( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )

Full rule:
rule EQGRP_tinyhttp_setup 
{

    meta:
        description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
    
    strings:
        $x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
        $x2 = "What is the name of your implant:" fullword ascii /* it's called conscience */
        $x3 = "killall thttpd" fullword ascii
        $x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
    
    condition:
        ( uint16(0) == 0x2123 and filesize < 2KB and 1 of ($x*) ) or ( all of them )
}
YARA Detection Rule: EQGRP_shellcode
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file shellcode.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
        $s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
        $s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii

        $c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
        /* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
        $c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }

Detection condition:
1 of them

Full rule:
rule EQGRP_shellcode 
{

    meta:
        description = "EQGRP Toolset Firewall - file shellcode.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df[PII_REDACTED]98eca8f8b7f"

    strings:
        $s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
        $s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
        $s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii

        $c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
        /* $c2 = { 7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00 02 00 03 00 01 00 00 }  too many fps */
        $c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_EPBA
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file EPBA.script
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
        $x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
        $x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
        $x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
        $x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
        $x6 = "this operation is complete, BananaGlee will" fullword ascii
        $x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii

Detection condition:
( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )

Full rule:
rule EQGRP_EPBA 
{

    meta:
        description = "EQGRP Toolset Firewall - file EPBA.script"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"

    strings:
        $x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
        $x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
        $x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
        $x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
        $x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
        $x6 = "this operation is complete, BananaGlee will" fullword ascii
        $x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii

    condition:
        ( uint16(0) == 0x2023 and filesize < 7KB and 1 of ($x*) ) or ( 3 of them )
}
YARA Detection Rule: EQGRP_BPIE
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BPIE-2201.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "profProcessPacket" fullword ascii
        $s2 = ".got_loader" fullword ascii
        $s3 = "getTimeSlotCmdHandler" fullword ascii
        $s4 = "getIpIpCmdHandler" fullword ascii
        $s5 = "LOADED" fullword ascii
        $s6 = "profStartScan" fullword ascii
        $s7 = "tmpData.1" fullword ascii
        $s8 = "resetCmdHandler" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )

Full rule:
rule EQGRP_BPIE 
{
    meta:
        description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"

    strings:
        $s1 = "profProcessPacket" fullword ascii
        $s2 = ".got_loader" fullword ascii
        $s3 = "getTimeSlotCmdHandler" fullword ascii
        $s4 = "getIpIpCmdHandler" fullword ascii
        $s5 = "LOADED" fullword ascii
        $s6 = "profStartScan" fullword ascii
        $s7 = "tmpData.1" fullword ascii
        $s8 = "resetCmdHandler" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 70KB and 6 of ($s*) )
}
YARA Detection Rule: EQGRP_jetplow_SH
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file jetplow.sh
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
        $s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
        $s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
        $s4 = "*****             Welcome to JetPlow              *****" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_jetplow_SH 
{

    meta:
        description = "EQGRP Toolset Firewall - file jetplow.sh"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"

    strings:
        $s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
        $s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
        $s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
        $s4 = "*****             Welcome to JetPlow              *****" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_BBANJO
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BBANJO-3011.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "get_lsl_interfaces" fullword ascii
        $s2 = "encryptFC4Payload" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "beacon_getconfig" fullword ascii
        $s5 = "LOADED" fullword ascii
        $s6 = "FormBeaconPacket" fullword ascii
        $s7 = "beacon_reconfigure" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 50KB and all of them )

Full rule:
rule EQGRP_BBANJO 
{

    meta:
        description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"

    strings:
        $s1 = "get_lsl_interfaces" fullword ascii
        $s2 = "encryptFC4Payload" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "beacon_getconfig" fullword ascii
        $s5 = "LOADED" fullword ascii
        $s6 = "FormBeaconPacket" fullword ascii
        $s7 = "beacon_reconfigure" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 50KB and all of them )
}
YARA Detection Rule: EQGRP_BPATROL_2201
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file BPATROL-2201.exe
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "dumpConfig" fullword ascii
        $s2 = "getstatusHandler" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "xtractdata" fullword ascii
        $s5 = "KEEPGOING" fullword ascii

Detection condition:
( uint16(0) == 0x457f and filesize < 40KB and all of them )

Full rule:
rule EQGRP_BPATROL_2201 
{

    meta:
        description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"

    strings:
        $s1 = "dumpConfig" fullword ascii
        $s2 = "getstatusHandler" fullword ascii
        $s3 = ".got_loader" fullword ascii
        $s4 = "xtractdata" fullword ascii
        $s5 = "KEEPGOING" fullword ascii

    condition:
        ( uint16(0) == 0x457f and filesize < 40KB and all of them )
}
YARA Detection Rule: EQGRP_extrabacon
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "To disable password checking on target:" fullword ascii
        $x2 = "[-] target is running" fullword ascii
        $x3 = "[-] problem importing version-specific shellcode from" fullword ascii
        $x4 = "[+] importing version-specific shellcode" fullword ascii
        $s5 = "[-] unsupported target version, abort" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_extrabacon 
{

    meta:
        description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"

    strings:
        $x1 = "To disable password checking on target:" fullword ascii
        $x2 = "[-] target is running" fullword ascii
        $x3 = "[-] problem importing version-specific shellcode from" fullword ascii
        $x4 = "[+] importing version-specific shellcode" fullword ascii
        $s5 = "[-] unsupported target version, abort" fullword ascii

    condition:
        1 of them
}
YARA Detection Rule: EQGRP_sploit_py
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file sploit.py
Author: Florian Roth
Reference: Research

Pattern signatures:
$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
        $x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
        $x3 = "[-] no response from health check - target may have crashed" fullword ascii

Detection condition:
1 of them

Full rule:
rule EQGRP_sploit_py 
{

    meta:
        description = "EQGRP Toolset Firewall - file sploit.py"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"

    strings:
        $x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
        $x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
        $x3 = "[-] no response from health check - target may have crashed" fullword ascii
    
    condition:
        1 of them
}
YARA Detection Rule: EQGRP_uninstallPBD
Repository: Yara-Rules/rules
Detects: EQGRP Toolset Firewall - file uninstallPBD.bat
Author: Florian Roth
Reference: Research

Pattern signatures:
$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
        $s2 = "_hidecmd" fullword ascii
        $s3 = "memset 013abd04 1 0d" fullword ascii

Detection condition:
all of them

Full rule:
rule EQGRP_uninstallPBD 
{

    meta:
        description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
        author = "Florian Roth"
        reference = "Research"
        date = "2016-08-16"
        hash1 = "692fdb449f10057a114cf2963000f52ce118d9a[PII_REDACTED]8006c66af159bd0"

    strings:
        $s1 = "memset 00e9a05c 4 38845b88" fullword ascii
        $s2 = "_hidecmd" fullword ascii
        $s3 = "memset 013abd04 1 0d" fullword ascii
    
    condition:
        all of them
}