deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT17_Sample_FXSST_DLL
Repository: Neo23x0/signature-base
Detects: Detects Samples related to APT17 activity - file FXSST.DLL
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/ZiJyQv

Pattern signatures:
$x1 = "Microsoft? Windows? Operating System" fullword wide
		$x2 = "fxsst.dll" fullword ascii

		$y1 = "DllRegisterServer" fullword ascii
		$y2 = ".cSV" fullword ascii

		$s1 = "GetLastActivePopup"
		$s2 = "Sleep"
		$s3 = "GetModuleFileName"
		$s4 = "VirtualProtect"
		$s5 = "HeapAlloc"
		$s6 = "GetProcessHeap"
		$s7 = "GetCommandLine"

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and
			( all of ($x*) or all of ($y*) ) and all of ($s*)

Full rule:
rule APT17_Sample_FXSST_DLL {
	meta:
		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://goo.gl/ZiJyQv"
		date = "2015-05-14"
		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
		id = "e4b9b25e-8895-5ba5-b706-bfb6892c16ae"
	strings:
		$x1 = "Microsoft? Windows? Operating System" fullword wide
		$x2 = "fxsst.dll" fullword ascii

		$y1 = "DllRegisterServer" fullword ascii
		$y2 = ".cSV" fullword ascii

		$s1 = "GetLastActivePopup"
		$s2 = "Sleep"
		$s3 = "GetModuleFileName"
		$s4 = "VirtualProtect"
		$s5 = "HeapAlloc"
		$s6 = "GetProcessHeap"
		$s7 = "GetCommandLine"
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and
			( all of ($x*) or all of ($y*) ) and all of ($s*)
}
YARA Detection Rule: dubseven_file_set
Repository: Neo23x0/signature-base
Detects: Searches for service files loading UP007
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
		$file7 = "\\Microsoft\\Internet Explorer\\mon"
		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		//Just a few of these as they differ
		3 of ($file*)

Full rule:
rule dubseven_file_set
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for service files loading UP007"

		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"
	strings:
		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
		$file7 = "\\Microsoft\\Internet Explorer\\mon"
		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		//Just a few of these as they differ
		3 of ($file*)
}
YARA Detection Rule: dubseven_dropper_registry_checks
Repository: Neo23x0/signature-base
Detects: Searches for registry keys checked for by the dropper
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$reg1 = "SOFTWARE\\360Safe\\Liveup"
		$reg2 = "Software\\360safe"
		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
		$reg5 = "SOFTWARE\\rising\\RAV"
		$reg6 = "SOFTWARE\\JiangMin"
		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		all of ($reg*)

Full rule:
rule dubseven_dropper_registry_checks
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for registry keys checked for by the dropper"

		id = "8369cdbb-53b8-5dc5-9181-fd49747042a7"
	strings:
		$reg1 = "SOFTWARE\\360Safe\\Liveup"
		$reg2 = "Software\\360safe"
		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
		$reg5 = "SOFTWARE\\rising\\RAV"
		$reg6 = "SOFTWARE\\JiangMin"
		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		all of ($reg*)
}
YARA Detection Rule: dubseven_dropper_dialog_remains
Repository: Neo23x0/signature-base
Detects: Searches for related dialog remnants. How rude.
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$dia1 = "fuckMessageBox 1.0" wide
		$dia2 = "Rundll 1.0" wide

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		any of them

Full rule:
rule dubseven_dropper_dialog_remains
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for related dialog remnants. How rude."

		id = "6029ea74-26fc-57d1-aaed-be1ea2138844"
	strings:
		$dia1 = "fuckMessageBox 1.0" wide
		$dia2 = "Rundll 1.0" wide

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		any of them
}
YARA Detection Rule: maindll_mutex
Repository: Neo23x0/signature-base
Detects: Matches on the maindll mutex
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$mutex = "h31415927tttt"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$mutex

Full rule:
rule maindll_mutex
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Matches on the maindll mutex"

		id = "7a89dae3-9e03-5803-9729-78e6e65e91d3"
	strings:
		$mutex = "h31415927tttt"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$mutex
}
YARA Detection Rule: SLServer_dialog_remains
Repository: Neo23x0/signature-base
Detects: Searches for related dialog remnants.
Author: Matt Brooks, @cmatthewbrooks / modified by Florian Roth

Pattern signatures:
$slserver = "SLServer" wide fullword

		$fp1 = "Dell Inc." wide fullword
		$fp2 = "ScriptLogic Corporation" wide

		$extra1 = "SLSERVER" wide fullword
		$extra2 = "\\SLServer.pdb" ascii

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		// Reduce false positives
		not 1 of ($fp*) and
		1 of ($extra*) and

		$slserver

Full rule:
rule SLServer_dialog_remains
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
		date = "2016/04/18"
		score = 75
		description = "Searches for related dialog remnants."

		id = "cf199d25-ce5e-52c2-88de-32a48dee4c6f"
	strings:
		$slserver = "SLServer" wide fullword

		$fp1 = "Dell Inc." wide fullword
		$fp2 = "ScriptLogic Corporation" wide

		$extra1 = "SLSERVER" wide fullword
		$extra2 = "\\SLServer.pdb" ascii

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		// Reduce false positives
		not 1 of ($fp*) and
		1 of ($extra*) and

		$slserver
}
YARA Detection Rule: SLServer_mutex
Repository: Neo23x0/signature-base
Detects: Searches for the mutex.
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$mutex = "M&GX^DSF&DA@F"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$mutex

Full rule:
rule SLServer_mutex
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the mutex."

		id = "decdefd0-fe20-5adf-9d8c-0e2b954481a0"
	strings:
		$mutex = "M&GX^DSF&DA@F"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$mutex
}
YARA Detection Rule: SLServer_command_and_control
Repository: Neo23x0/signature-base
Detects: Searches for the C2 server.
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$c2 = "safetyssl.security-centers.com"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$c2

Full rule:
rule SLServer_command_and_control
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the C2 server."

		id = "e4fcda6c-1c9f-5b58-8b07-8d1a0dc4eaf6"
	strings:
		$c2 = "safetyssl.security-centers.com"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$c2
}
YARA Detection Rule: SLServer_campaign_code
Repository: Neo23x0/signature-base
Detects: Searches for the related campaign code.
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$campaign = "wthkdoc0106"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$campaign

Full rule:
rule SLServer_campaign_code
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for the related campaign code."

		id = "672f506e-0cc1-5b09-873b-c3d206486bac"
	strings:
		$campaign = "wthkdoc0106"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$campaign
}
YARA Detection Rule: SLServer_unknown_string
Repository: Neo23x0/signature-base
Detects: Searches for a unique string.
Author: Matt Brooks, @cmatthewbrooks

Pattern signatures:
$string = "test-b7fa835a39"

Detection condition:
//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$string

Full rule:
rule SLServer_unknown_string
{
	meta:
		author = "Matt Brooks, @cmatthewbrooks"
		date = "2016/04/18"
		score = 75
		description = "Searches for a unique string."

		id = "00341604-480f-59aa-9c18-009e7b53928e"
	strings:
		$string = "test-b7fa835a39"

	condition:
		//MZ header
		uint16(0) == 0x5A4D and

		//PE signature
		uint32(uint32(0x3C)) == 0x00004550 and

		$string
}
YARA Detection Rule: SUSP_BAT2EXE_BDargo_Converted_BAT
Repository: Neo23x0/signature-base
Detects: Detects binaries created with BDARGO Advanced BAT to EXE converter
Author: Florian Roth (Nextron Systems)
Reference: https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html

Pattern signatures:
$s1 = "Error #bdembed1 -- Quiting" fullword ascii
      $s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
      $s3 = "\\a.txt" ascii
      $s4 = "command.com" fullword ascii /* Goodware String - occured 91 times */
      $s6 = "DFDHERGDCV" fullword ascii
      $s7 = "DFDHERGGZV" fullword ascii
      $s8 = "%s%s%s%s%s%s%s%s" fullword ascii /* Goodware String - occured 4 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and 5 of them

Full rule:
rule SUSP_BAT2EXE_BDargo_Converted_BAT {
   meta:
      description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
      date = "2018-07-28"
      modified = "2022-06-23"
      score = 45
      hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
      hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
      id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"
   strings:
      $s1 = "Error #bdembed1 -- Quiting" fullword ascii
      $s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
      $s3 = "\\a.txt" ascii
      $s4 = "command.com" fullword ascii /* Goodware String - occured 91 times */
      $s6 = "DFDHERGDCV" fullword ascii
      $s7 = "DFDHERGGZV" fullword ascii
      $s8 = "%s%s%s%s%s%s%s%s" fullword ascii /* Goodware String - occured 4 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and 5 of them
}
YARA Detection Rule: HKTL_BruteRatel_Badger_Indicators_Oct22_4
Repository: Neo23x0/signature-base
Detects: Detects Brute Ratel C4 badger indicators
Author: Matthew @embee_research, Florian Roth
Reference: https://twitter.com/embee_research/status/[PII_REDACTED]78953728

Pattern signatures:
$s1 = { b? 89 4d 39 8c }
      $s2 = { b? bd ca 3b d3 }
      $s3 = { b? b2 c1 06 ae } 
      $s4 = { b? 74 eb 1d 4d }

Detection condition:
filesize < 8000KB 
      and all of ($s*)
      and not uint8(0) == 0x02 /* SHC files */

Full rule:
rule HKTL_BruteRatel_Badger_Indicators_Oct22_4 {
   meta:
      description = "Detects Brute Ratel C4 badger indicators"
      author = "Matthew @embee_research, Florian Roth"
      reference = "https://twitter.com/embee_research/status/[PII_REDACTED]78953728"
      date = "2022-10-12"
      score = 75
      id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"
   strings:
      $s1 = { b? 89 4d 39 8c }
      $s2 = { b? bd ca 3b d3 }
      $s3 = { b? b2 c1 06 ae } 
      $s4 = { b? 74 eb 1d 4d }
   condition:
      filesize < 8000KB 
      and all of ($s*)
      and not uint8(0) == 0x02 /* SHC files */
}
YARA Detection Rule: PassCV_Sabre_Malware_1
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
      $x2 = "bin\\oSaberSvc.pdb" ascii

      $s1 = "cmd.exe /c MD " fullword ascii
      $s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
      $s3 = "CloudRun.exe" fullword wide
      $s4 = "SaberSvcB.exe" fullword wide
      $s5 = "SaberSvc.exe" fullword wide
      $s6 = "SaberSvcW.exe" fullword wide
      $s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
      $s8 = "Internet Connect Failed!" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) and 5 of ($s*) ) ) or ( all of them )

Full rule:
rule PassCV_Sabre_Malware_1 {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      hash1 = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
      hash2 = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
      id = "99a26daa-c563-5b23-89b9-965d8ce7229d"
   strings:
      $x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
      $x2 = "bin\\oSaberSvc.pdb" ascii

      $s1 = "cmd.exe /c MD " fullword ascii
      $s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
      $s3 = "CloudRun.exe" fullword wide
      $s4 = "SaberSvcB.exe" fullword wide
      $s5 = "SaberSvc.exe" fullword wide
      $s6 = "SaberSvcW.exe" fullword wide
      $s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
      $s8 = "Internet Connect Failed!" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) and 5 of ($s*) ) ) or ( all of them )
}
YARA Detection Rule: PassCV_Sabre_Malware_Signing_Cert
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$s1 = "WOODTALE TECHNOLOGY INC" ascii
      $s2 = "Flyingbird Technology Limited" ascii
      $s3 = "Neoact Co., Ltd." ascii
      $s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
      $s5 = "EMG Technology Limited" ascii
      $s6 = "Zemi Interactive Co., Ltd" ascii
      $s7 = "337 Technology Limited" ascii
      $s8 = "Runewaker Entertainment0" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )

Full rule:
rule PassCV_Sabre_Malware_Signing_Cert {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      score = 50
      hash1 = "7c32885c258a6d5be37ebe83643f00165da3ebf[PII_REDACTED][PII_REDACTED]4752e"
      id = "2b2d1313-6454-5e3f-9b58-5b1a26739ba8"
   strings:
      $s1 = "WOODTALE TECHNOLOGY INC" ascii
      $s2 = "Flyingbird Technology Limited" ascii
      $s3 = "Neoact Co., Ltd." ascii
      $s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
      $s5 = "EMG Technology Limited" ascii
      $s6 = "Zemi Interactive Co., Ltd" ascii
      $s7 = "337 Technology Limited" ascii
      $s8 = "Runewaker Entertainment0" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 3000KB and 1 of them )
}
YARA Detection Rule: PassCV_Sabre_Malware_2
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$x1 = "ncProxyXll" fullword ascii

      $s1 = "Uniscribe.dll" fullword ascii
      $s2 = "WS2_32.dll" ascii
      $s3 = "ProxyDll" fullword ascii
      $s4 = "JDNSAPI.dll" fullword ascii
      $s5 = "x64.dat" fullword ascii
      $s6 = "LSpyb2" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 4000KB and $x1 ) or ( all of them )

Full rule:
rule PassCV_Sabre_Malware_2 {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      hash1 = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
      hash2 = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
      hash3 = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
      hash4 = "0c7b952c64db7add5b8b50b1199fc7d82e9b6ac07193d9ec30e5b8d353b1f6d2"
      id = "dd9eb5f6-9faa-584d-b3b5-6dcfdc3f359c"
   strings:
      $x1 = "ncProxyXll" fullword ascii

      $s1 = "Uniscribe.dll" fullword ascii
      $s2 = "WS2_32.dll" ascii
      $s3 = "ProxyDll" fullword ascii
      $s4 = "JDNSAPI.dll" fullword ascii
      $s5 = "x64.dat" fullword ascii
      $s6 = "LSpyb2" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 4000KB and $x1 ) or ( all of them )
}
YARA Detection Rule: PassCV_Sabre_Malware_Excalibur_1
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$x1 = "F:\\Excalibur\\Excalibur\\" ascii
      $x2 = "Excalibur\\bin\\Shell.pdb" ascii
      $x3 = "SaberSvc.exe" wide

      $s1 = "BBB.exe" fullword wide
      $s2 = "AAA.exe" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of ($x*) or all of ($s*) )
      or 3 of them

Full rule:
rule PassCV_Sabre_Malware_Excalibur_1 {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      hash1 = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
      hash2 = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"

      id = "eadad36c-49c8-50e1-8334-813d2e760fe9"
   strings:
      $x1 = "F:\\Excalibur\\Excalibur\\" ascii
      $x2 = "Excalibur\\bin\\Shell.pdb" ascii
      $x3 = "SaberSvc.exe" wide

      $s1 = "BBB.exe" fullword wide
      $s2 = "AAA.exe" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and 1 of ($x*) or all of ($s*) )
      or 3 of them
}
YARA Detection Rule: PassCV_Sabre_Malware_3
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$x1 = "NXKILL" fullword wide

      $s1 = "2OLE32.DLL" fullword ascii
      $s2 = "localspn.dll" fullword wide
      $s3 = "!This is a Win32 program." fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 8000KB and $x1 and 2 of ($s*) )

Full rule:
rule PassCV_Sabre_Malware_3 {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      hash1 = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
      id = "03e5efc0-6076-501f-a600-b3d9008a8711"
   strings:
      $x1 = "NXKILL" fullword wide

      $s1 = "2OLE32.DLL" fullword ascii
      $s2 = "localspn.dll" fullword wide
      $s3 = "!This is a Win32 program." fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 8000KB and $x1 and 2 of ($s*) )
}
YARA Detection Rule: PassCV_Sabre_Malware_4
Repository: Neo23x0/signature-base
Detects: PassCV Malware mentioned in Cylance Report
Author: Florian Roth (Nextron Systems)
Reference: https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies

Pattern signatures:
$s1 = "QWNjZXB0On" fullword ascii /* base64 encoded string 'Accept:' */
      $s2 = "VXNlci1BZ2VudDogT" fullword ascii /* b64: User-Agent: */
      $s3 = "dGFzay5kbnME3luLmN" fullword ascii /* b64: task.dns[ */

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )

Full rule:
rule PassCV_Sabre_Malware_4 {
   meta:
      description = "PassCV Malware mentioned in Cylance Report"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
      date = "2016-10-20"
      hash1 = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
      id = "f182064d-3a91-5a61-aa0f-2ce491a60126"
   strings:
      $s1 = "QWNjZXB0On" fullword ascii /* base64 encoded string 'Accept:' */
      $s2 = "VXNlci1BZ2VudDogT" fullword ascii /* b64: User-Agent: */
      $s3 = "dGFzay5kbnME3luLmN" fullword ascii /* b64: task.dns[ */
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 2 of them )
}