deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Linux_Httpsd_malware_i686
Repository: Yara-Rules/rules
Detects: Detects ELF Linux/Httpsd i686

Pattern signatures:
$hexsts01 = { 8d 4c 24 04 83 e4 f0 ff 71 fc 55 89 e5 57 56 53 } // main
		$hexsts02 = { 55 89 e5 57 56 53 81 ec 14 2c 00 00 68 7a 83 05 } // self-rclocal
		$hexsts03 = { 55 89 e5 57 56 53 81 ec 10 04 00 00 68 00 04 00 } // copy-self

Detection condition:
all of them
        	and is__elf
		and is__LinuxHttpsdStrings
		and filesize < 200KB

Full rule:
rule Linux_Httpsd_malware_i686 {

	meta:
		description = "Detects ELF Linux/Httpsd i686"
		date = "2018-01-02"

	
	strings:
		$hexsts01 = { 8d 4c 24 04 83 e4 f0 ff 71 fc 55 89 e5 57 56 53 } // main
		$hexsts02 = { 55 89 e5 57 56 53 81 ec 14 2c 00 00 68 7a 83 05 } // self-rclocal
		$hexsts03 = { 55 89 e5 57 56 53 81 ec 10 04 00 00 68 00 04 00 } // copy-self

	condition:
		all of them
        	and is__elf
		and is__LinuxHttpsdStrings
		and filesize < 200KB 
}
YARA Detection Rule: MALW_KeyBase
Repository: Yara-Rules/rules
Detects: Identifies KeyBase aka Kibex.
Author: @bartblaze

Pattern signatures:
$s1 = " End:]" ascii wide
	$s2 = "Keystrokes typed:" ascii wide
	$s3 = "Machine Time:" ascii wide
	$s4 = "Text:" ascii wide
	$s5 = "Time:" ascii wide
	$s6 = "Window title:" ascii wide
	
	$x1 = "&application=" ascii wide
	$x2 = "&clipboardtext=" ascii wide
	$x3 = "&keystrokestyped=" ascii wide
	$x4 = "&link=" ascii wide
	$x5 = "&username=" ascii wide
	$x6 = "&windowtitle=" ascii wide
	$x7 = "=drowssap&" ascii wide
	$x8 = "=emitenihcam&" ascii wide

Detection condition:
uint16(0) == 0x5a4d and (
		5 of ($s*) or 6 of ($x*) or
		( 4 of ($s*) and 4 of ($x*) )
	)

Full rule:
rule MALW_KeyBase
{
meta:
	description = "Identifies KeyBase aka Kibex."
	author = "@bartblaze"
	date = "2019-02"
	tlp = "White"

strings:	
	$s1 = " End:]" ascii wide
	$s2 = "Keystrokes typed:" ascii wide
	$s3 = "Machine Time:" ascii wide
	$s4 = "Text:" ascii wide
	$s5 = "Time:" ascii wide
	$s6 = "Window title:" ascii wide
	
	$x1 = "&application=" ascii wide
	$x2 = "&clipboardtext=" ascii wide
	$x3 = "&keystrokestyped=" ascii wide
	$x4 = "&link=" ascii wide
	$x5 = "&username=" ascii wide
	$x6 = "&windowtitle=" ascii wide
	$x7 = "=drowssap&" ascii wide
	$x8 = "=emitenihcam&" ascii wide

condition:
	uint16(0) == 0x5a4d and (
		5 of ($s*) or 6 of ($x*) or
		( 4 of ($s*) and 4 of ($x*) )
	)
}
YARA Detection Rule: Backdoor_APT_Mongal
Repository: Yara-Rules/rules
Author: @patrickrolsen
Reference: fd69a799e21ccb308531ce[PII_REDACTED]

Pattern signatures:
$author  = "author user"
        $title   = "title Vjkygdjdtyuj" nocase
        $comp    = "company ooo"
        $cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
        $[CREDENTIAL_REDACTED] 00000000"

Detection condition:
all of them

Full rule:
rule Backdoor_APT_Mongal
{

    meta:
        author = "@patrickrolsen"
        maltype = "Backdoor.APT.Mongall"
        version = "0.1"
        reference = "fd69a799e21ccb308531ce[PII_REDACTED]" 
        date = "01/04/2014"
    
    strings:
        $author  = "author user"
        $title   = "title Vjkygdjdtyuj" nocase
        $comp    = "company ooo"
        $cretime = "creatim\\yr2012\\mo4\\dy19\\hr15\\min10"
        $[CREDENTIAL_REDACTED] 00000000"
    
    condition:
        all of them
}
YARA Detection Rule: MongalCode
Repository: Yara-Rules/rules
Detects: Mongal code features
Author: Seth Hardy

Pattern signatures:
// gettickcount value checking
        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }

Detection condition:
any of them

Full rule:
rule MongalCode
{
    meta:
        description = "Mongal code features"
        author = "Seth Hardy"
        last_modified = "2014-07-15"
    
    strings:
        // gettickcount value checking
        $ = { 8B C8 B8 D3 4D 62 10 F7 E1 C1 EA 06 2B D6 83 FA 05 76 EB }
        
    condition:
        any of them
}
YARA Detection Rule: MongalStrings
Repository: Yara-Rules/rules
Detects: Mongal Identifying Strings
Author: Seth Hardy

Pattern signatures:
$ = "NSCortr.dll"
        $ = "NSCortr1.dll"
        $ = "Sina.exe"

Detection condition:
any of them

Full rule:
rule MongalStrings
{
    
    meta:
        description = "Mongal Identifying Strings"
        author = "Seth Hardy"
        last_modified = "2014-07-15"
        
    strings:
        $ = "NSCortr.dll"
        $ = "NSCortr1.dll"
        $ = "Sina.exe"
        
    condition:
        any of them
}
YARA Detection Rule: Mongal
Repository: Yara-Rules/rules
Detects: Mongal
Author: Seth Hardy

Detection condition:
MongalCode or MongalStrings

Full rule:
rule Mongal 
{
    
    meta:
        description = "Mongal"
        author = "Seth Hardy"
        last_modified = "2014-07-15"
        
    condition:
        MongalCode or MongalStrings
}
YARA Detection Rule: Mirai_Generic_Arch
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - Generic Architecture
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
$miname and $iptables1 and $iptables2 and $procnet

Full rule:
rule Mirai_Generic_Arch : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - Generic Architecture" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		$miname and $iptables1 and $iptables2 and $procnet
}
YARA Detection Rule: Mirai_MIPS_LSB
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - MIPS LSB
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
$miname and $iptables1 and $iptables2 and $procnet and
		hash.sha1(0,filesize) == "03ecd3b49aa19589599c64e4e7a51206a592b4ef"

Full rule:
rule Mirai_MIPS_LSB : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - MIPS LSB" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5 = "bf650d39eb603d92973052ca80a4fdda"
		SHA1 = "03ecd3b49aa19589599c64e4e7a51206a592b4ef"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		$miname and $iptables1 and $iptables2 and $procnet and
		hash.sha1(0,filesize) == "03ecd3b49aa19589599c64e4e7a51206a592b4ef"
}
YARA Detection Rule: Mirai_MIPS_MSB
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - MIPS MSB
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "18bce2f0107b5fab1b0b7c453e2a6b6505200cbd"

Full rule:
rule Mirai_MIPS_MSB : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - MIPS MSB" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5 = "0eb51d[PII_REDACTED]00ad8e[PII_REDACTED]"	
		SHA1 = "18bce2f0107b5fab1b0b7c453e2a6b6505200cbd"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "18bce2f0107b5fab1b0b7c453e2a6b6505200cbd"
}
YARA Detection Rule: Mirai_ARM_LSB
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - ARM LSB
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "8a25dee4ea7d61692b2b95bd047269543aaf0c81"

Full rule:
rule Mirai_ARM_LSB : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - ARM LSB" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5= "eba670256b816e2d11f107f629d08494"
		SHA1 = "8a25dee4ea7d61692b2b95bd047269543aaf0c81"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "8a25dee4ea7d61692b2b95bd047269543aaf0c81"
}
YARA Detection Rule: Mirai_Renesas_SH
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - Renesas SH LSB
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "bdc86295fad70480f0c6edcc37981e3cf11d838c"

Full rule:
rule Mirai_Renesas_SH : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - Renesas SH LSB" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5 = "863dcf82883c885b0686dce747dcf502"
		SHA1 = "bdc86295fad70480f0c6edcc37981e3cf11d838c"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		$miname and $iptables1 and $iptables2 and $procnet and 
		hash.sha1(0,filesize) == "bdc86295fad70480f0c6edcc37981e3cf11d838c"
}
YARA Detection Rule: Mirai_PPC_Cisco
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - PowerPC or Cisco 4500
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
( $miname and $iptables1 and $iptables2 and $procnet ) and 
		hash.sha1(0,filesize) == "6933d555a008a07b859a55cddb704441915adf68"

Full rule:
rule Mirai_PPC_Cisco : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - PowerPC or Cisco 4500" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5= "dbd92b08cbff8455ff76c453ff704dc6"
		SHA1 = "6933d555a008a07b859a55cddb704441915adf68"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		( $miname and $iptables1 and $iptables2 and $procnet ) and 
		hash.sha1(0,filesize) == "6933d555a008a07b859a55cddb704441915adf68"
}
YARA Detection Rule: Mirai_SPARC_MSB
Repository: Yara-Rules/rules
Detects: Mirai Botnet TR-069 Worm - SPARC MSB
Author: Felipe Molina / @felmoltor

Pattern signatures:
$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

Detection condition:
( $miname and $iptables1 and $iptables2 and $procnet ) and 
		hash.sha1(0,filesize) == "3d770480b6410cba39e19b3a2ff3bec774cabe47"

Full rule:
rule Mirai_SPARC_MSB : MALW
{
	meta:
		description = "Mirai Botnet TR-069 Worm - SPARC MSB" 
		author = "Felipe Molina / @felmoltor"
		date = "2016-12-04"
		version = "1.0" 
		MD5= "05891dbabc42a36f33c30535f0931555"
		SHA1 = "3d770480b6410cba39e19b3a2ff3bec774cabe47"
		ref1 = "http://www.theregister.co.uk/2016/11/28/router_flaw_exploited_in_massive_attack/"	
		ref2 = "https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759" 
		ref3 = "https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/"

	strings:
		$miname = "Myname--is:"
		$iptables1 = "busybox iptables -A INPUT -p tcp --destination-port 7547 -j DROP"
		$iptables2 = "busybox iptables -A INPUT -p tcp --destination-port 5555 -j DROP"
		$procnet = "/proc/net/tcp"

	condition:
		( $miname and $iptables1 and $iptables2 and $procnet ) and 
		hash.sha1(0,filesize) == "3d770480b6410cba39e19b3a2ff3bec774cabe47"
}
YARA Detection Rule: Mirai_1
Repository: Yara-Rules/rules
Detects: Mirai Variant 1
Author: Joan Soriano / @joanbtl

Pattern signatures:
$dir1 = "/dev/watchdog"
		$dir2 = "/dev/misc/watchdog"
		$pass1 = "PMMV"
		$pass2 = "FGDCWNV"
		$pass3 = "OMVJGP"

Detection condition:
$dir1 and $pass1 and $pass2 and not $pass3 and not $dir2

Full rule:
rule Mirai_1 : MALW
{
	meta:
		description = "Mirai Variant 1"
		author = "Joan Soriano / @joanbtl"
		date = "2017-04-16"
		version = "1.0"
		MD5 = "655c3cf460489a7d032c37cd5b84a3a8"
		SHA1 = "4dd3803956bc31c8c7c504734bddec47a1b57d58"

	strings:
		$dir1 = "/dev/watchdog"
		$dir2 = "/dev/misc/watchdog"
		$pass1 = "PMMV"
		$pass2 = "FGDCWNV"
		$pass3 = "OMVJGP"
	condition:
		$dir1 and $pass1 and $pass2 and not $pass3 and not $dir2

}
YARA Detection Rule: Mirai_2
Repository: Yara-Rules/rules
Detects: Mirai Variant 2
Author: Joan Soriano / @joanbtl

Pattern signatures:
$dir1 = "/dev/watchdog"
	$dir2 = "/dev/misc/watchdog"
        $s1 = "PMMV"
        $s2 = "ZOJFKRA"
        $s3 = "FGDCWNV"
        $s4 = "OMVJGP"

Detection condition:
$dir1 and $dir2 and $s1 and $s2 and $s3 and not $s4

Full rule:
rule Mirai_2 : MALW
{
meta:
	description = "Mirai Variant 2"
	author = "Joan Soriano / @joanbtl"
	date = "2017-04-16"
	version = "1.0"
	MD5 = "0e5bda9d39b03ce79ab8d421b90c0067"
	SHA1 = "96f42a9fad2923281d21eca7ecdd3161d2b61655"

    strings:
	$dir1 = "/dev/watchdog"
	$dir2 = "/dev/misc/watchdog"
        $s1 = "PMMV"
        $s2 = "ZOJFKRA"
        $s3 = "FGDCWNV"
        $s4 = "OMVJGP"
    condition:
        $dir1 and $dir2 and $s1 and $s2 and $s3 and not $s4 

}
YARA Detection Rule: Mirai_3
Repository: Yara-Rules/rules
Detects: Mirai Variant 3
Author: Joan Soriano / @joanbtl

Pattern signatures:
$dir1 = "/dev/watchdog"
            $dir2 = "/dev/misc/watchdog"
            $s1 = "PMMV"
            $s2 = "ZOJFKRA"
            $s3 = "FGDCWNV"
            $s4 = "OMVJGP"
	    $ssl = "ssl3_ctrl"

Detection condition:
$dir1 and $dir2 and $s1 and $s2 and $s3 and $s4 and not $ssl

Full rule:
rule Mirai_3 : MALW
{
    meta:
	description = "Mirai Variant 3"
	author = "Joan Soriano / @joanbtl"
	date = "2017-04-16"
	version = "1.0"
	MD5 = "bb22b1c921ad8fa358d985ff1e51a5b8"
	SHA1 = "432ef83c7692e304c621924bc961d95c4aea0c00"

    strings:
            $dir1 = "/dev/watchdog"
            $dir2 = "/dev/misc/watchdog"
            $s1 = "PMMV"
            $s2 = "ZOJFKRA"
            $s3 = "FGDCWNV"
            $s4 = "OMVJGP"
	    $ssl = "ssl3_ctrl"
    condition:
            $dir1 and $dir2 and $s1 and $s2 and $s3 and $s4 and not $ssl

}
YARA Detection Rule: Mirai_4
Repository: Yara-Rules/rules
Detects: Mirai Variant 4
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "210765"
		$s2 = "qllw"
		$s3 = ";;;;;;"

Detection condition:
$s1 and $s2 and $s3

Full rule:
rule Mirai_4 : MALW
{
	meta:
		description = "Mirai Variant 4"
		author = "Joan Soriano / @joanbtl"
		date = "2017-04-16"
		version = "1.0"
		MD5 = "f832ef7a4fcd252463adddfa14db43fb"
		SHA1 = "4455d237aadaf28aafce57097144beac92e55110"
	strings:
		$s1 = "210765"
		$s2 = "qllw"
		$s3 = ";;;;;;"
	condition:
		$s1 and $s2 and $s3
}
YARA Detection Rule: Mirai_Dwnl
Repository: Yara-Rules/rules
Detects: Mirai Downloader
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "GET /mirai/"
		$s2 = "dvrHelper"

Detection condition:
$s1 and $s2

Full rule:
rule Mirai_Dwnl : MALW
{
	meta:
		description = "Mirai Downloader"
		author = "Joan Soriano / @joanbtl"
		date = "2017-04-16"
		version = "1.0"
		MD5 = "85784b54dee0b7c16c57e3a3a01db7e6"
		SHA1 = "6f6c625ef730beefbc23c7f362af329426607dee"
	strings:
		$s1 = "GET /mirai/"
		$s2 = "dvrHelper"
	condition:
		$s1 and $s2
}
YARA Detection Rule: Mirai_5
Repository: Yara-Rules/rules
Detects: Mirai Variant 5
Author: Joan Soriano / @joanbtl

Pattern signatures:
$dir1 = "/dev/watchdog"
		    $dir2 = "/dev/misc/watchdog"
		    $s1 = "PMMV"
		    $s2 = "ZOJFKRA"
		    $s3 = "FGDCWNV"
		    $s4 = "OMVJGP"
		    $ssl = "ssl3_ctrl"

Detection condition:
$dir1 and $dir2 and $s1 and $s2 and $s3 and $s4 and $ssl

Full rule:
rule Mirai_5 : MALW
{
	meta:
		description = "Mirai Variant 5"
		author = "Joan Soriano / @joanbtl"
		date = "2017-04-16"
		version = "1.0"
		MD5 = "7e17c34cddcaeb6755c457b99a8dfe32"
		SHA1 = "b63271672d6a044704836d542d92b98e2316ad24"

	strings:
		    $dir1 = "/dev/watchdog"
		    $dir2 = "/dev/misc/watchdog"
		    $s1 = "PMMV"
		    $s2 = "ZOJFKRA"
		    $s3 = "FGDCWNV"
		    $s4 = "OMVJGP"
		    $ssl = "ssl3_ctrl"
	condition:
		    $dir1 and $dir2 and $s1 and $s2 and $s3 and $s4 and $ssl

}
YARA Detection Rule: andromeda
Repository: Yara-Rules/rules
Detects: Identify Andromeda
Author: Brian Wallace @botnet_hunter

Pattern signatures:
$config = {1c 1c 1d 03 49 47 46}
        $c1 = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst"

Detection condition:
all of them

Full rule:
rule andromeda
{
    
    meta:
        author = "Brian Wallace @botnet_hunter"
        author_email = "bwall@ballastsecurity.net"
        date = "2014-03-13"
        description = "Identify Andromeda"
    
    strings:
        $config = {1c 1c 1d 03 49 47 46}
        $c1 = "hsk\\ehs\\dihviceh\\serhlsethntrohntcohurrehem\\chsyst"
    
    condition:
        all of them
}
YARA Detection Rule: Worm_Gamarue
Repository: Yara-Rules/rules
Detects: Gamarue_Andromeda
Author: Centro Criptológico Nacional (CCN)

Pattern signatures:
$a = { 69 E1 2A B0 2D 80 44 E3 2D 80 44 E3 2D 80 44 E3 EE 8F 1B E3 2A 80 44 E3 EE 8F 19 E3 3A 80 44 E3 2D 80 45 E3 CD 81 44 E3 0A 46 39 E3 34 80 44 E3 0A 46 29 E3 A5 80 44 E3 0A 46 2A E3 5C 80 44 E3 0A 46 36 E3 2C 80 44 E3 0A 46 3C E3 2C 80 44 E3 }

Detection condition:
$a

Full rule:
rule Worm_Gamarue 
{

    meta:
        author = "Centro Criptológico Nacional (CCN)"
        ref = "https://www.ccn-cert.cni.es/informes/informes-ccn-cert-publicos.html"
        description = "Gamarue_Andromeda"       

    strings:
        $a = { 69 E1 2A B0 2D 80 44 E3 2D 80 44 E3 2D 80 44 E3 EE 8F 1B E3 2A 80 44 E3 EE 8F 19 E3 3A 80 44 E3 2D 80 45 E3 CD 81 44 E3 0A 46 39 E3 34 80 44 E3 0A 46 29 E3 A5 80 44 E3 0A 46 2A E3 5C 80 44 E3 0A 46 36 E3 2C 80 44 E3 0A 46 3C E3 2C 80 44 E3 }
    condition:
        $a 
}
YARA Detection Rule: andromeda_bot
Repository: Yara-Rules/rules
Detects: IOC looks for the creation or termination of a process associated with the Andromeda Trojan. The malware will execute the msiexec.exe within the suspicious directory. Shortly after, it creates and injects itself into the wuauctl.exe (windows update) process. It then attempts to beacon to its C2.
Author: https://github.com/reed1713

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing"
        $eventid="4688"
        $data="AppData\\Local\\Temp\\_.net_\\msiexec.exe"

Detection condition:
all of them

Full rule:
rule andromeda_bot
{ 
    meta:
        maltype = "Andromeda bot"
        author = "https://github.com/reed1713"
        description = "IOC looks for the creation or termination of a process associated with the Andromeda Trojan. The malware will execute the msiexec.exe within the suspicious directory. Shortly after, it creates and injects itself into the wuauctl.exe (windows update) process. It then attempts to beacon to its C2."
   
    strings:
        $type="Microsoft-Windows-Security-Auditing"
        $eventid="4688"
        $data="AppData\\Local\\Temp\\_.net_\\msiexec.exe"

    condition:
        all of them
}
YARA Detection Rule: custom_ssh_backdoor_server
Repository: Yara-Rules/rules
Detects: Custome SSH backdoor based on python and paramiko - file server.py
Author: Florian Roth
Reference: https://goo.gl/S46L3o

Pattern signatures:
$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
        $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
        $s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
        $s3 = "chan.send(command)" fullword ascii
        $s4 = "print '[-] SSH negotiation failed.'" fullword ascii
        $s5 = "except paramiko.SSHException, x:" fullword ascii

Detection condition:
filesize < 10KB and 5 of them

Full rule:
rule custom_ssh_backdoor_server
{

    meta:
        description = "Custome SSH backdoor based on python and paramiko - file server.py"
        author = "Florian Roth"
        reference = "https://goo.gl/S46L3o"
        date = "2015-05-14"
        hash = "0953b6c2181249b94282ca5736471f85d80d41c9"

    strings:
        $s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
        $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
        $s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
        $s3 = "chan.send(command)" fullword ascii
        $s4 = "print '[-] SSH negotiation failed.'" fullword ascii
        $s5 = "except paramiko.SSHException, x:" fullword ascii

    condition:
        filesize < 10KB and 5 of them
}