deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: apt_c16_win64_dropper
Repository: Yara-Rules/rules
Detects: APT malware used to drop PcClient RAT
Author: @dragonthreatlab
Reference: http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html

Pattern signatures:
$mz = { 4D 5A }
        $str1 = "clbcaiq.dll" ascii
        $str2 = "profapi_104" ascii
        $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
        $str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }

Detection condition:
$mz at 0 and all of ($str*)

Full rule:
rule apt_c16_win64_dropper
{

    meta:
        author = "@dragonthreatlab"
        date = "2015/01/11"
        description = "APT malware used to drop PcClient RAT"
        reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"

    strings:
        $mz = { 4D 5A }
        $str1 = "clbcaiq.dll" ascii
        $str2 = "profapi_104" ascii
        $str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
        $str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }

    condition:
        $mz at 0 and all of ($str*)
}
YARA Detection Rule: apt_hiddencobra_rsakey
Repository: Yara-Rules/rules
Detects: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
Author: US-CERT
Reference: https://www.us-cert.gov/ncas/alerts/TA17-164A

Pattern signatures:
$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94

    A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77

    48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39

    73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2

    AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED

    39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68

    3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13

    B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}

Detection condition:
any of them

Full rule:
rule apt_hiddencobra_rsakey {

meta:

	description = "HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure" 
	author = "US-CERT"
	url = "https://www.us-cert.gov/ncas/alerts/TA17-164A"

strings:

    $rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94

    A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77

    48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39

    73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2

    AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED

    39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68

    3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13

    B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}

condition: 
	any of them
}
YARA Detection Rule: apt_hiddencobra_binaries
Repository: Yara-Rules/rules
Detects: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
Author: US-CERT
Reference: https://www.us-cert.gov/ncas/alerts/TA17-164A

Pattern signatures:
$STR1 = "Wating" wide ascii

   $STR2 = "Reamin" wide ascii

   $STR3 = "laptos" wide ascii

Detection condition:
(uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them

Full rule:
rule apt_hiddencobra_binaries {

meta:

    description = "HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure" 
    author = "US-CERT"
    url = "https://www.us-cert.gov/ncas/alerts/TA17-164A"

strings:

   $STR1 = "Wating" wide ascii

   $STR2 = "Reamin" wide ascii

   $STR3 = "laptos" wide ascii

condition: 
    (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and 2 of them
}
YARA Detection Rule: apt_hiddencobra_urlbuilder
Repository: Yara-Rules/rules
Detects: HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure
Author: US-CERT
Reference: https://www.us-cert.gov/ncas/alerts/TA17-164A

Pattern signatures:
$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 

Detection condition:
$randomUrlBuilder

Full rule:
rule apt_hiddencobra_urlbuilder {

meta:

    description = "HIDDEN COBRA – North Korea’s DDoS Botnet Infrastructure" 
    author = "US-CERT"
    url = "https://www.us-cert.gov/ncas/alerts/TA17-164A"

strings:

$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7 44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41 00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0 6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24 48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89 44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24 18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89 44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00 66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B 6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05 83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00 00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2 49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33 C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83 E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00 8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8 ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4 48 C3 }

condition: 
    $randomUrlBuilder
}
YARA Detection Rule: Malware_Updater
Repository: Yara-Rules/rules
Author: US-CERT Code Analysis Team

Pattern signatures:
$s0 = { 8A4C040480F15D80C171884C04044083F8107CEC }
	$s1 = { 8A4D0080F19580E97C884D00454B75F0 }

Detection condition:
any of them

Full rule:
rule Malware_Updater
{
meta:
	Author="US-CERT Code Analysis Team"
	Date="2017/08/02"
	Incident="10132963"
	MD5_1="8F4FC2E10B6EC15A01E0AF24529040DD"
	MD5_2="584AC94142F0B7C0DF3D0ADDE6E661ED"
	Info="Malware may be used to update multiple systems with secondary payloads"
	super_rule=1
	report = "https://www.us-cert.gov/sites/default/files/publications/MAR-10132963.pdf"
	report = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
strings:
	$s0 = { 8A4C040480F15D80C171884C04044083F8107CEC }
	$s1 = { 8A4D0080F19580E97C884D00454B75F0 }
condition: 
	any of them
}
YARA Detection Rule: Unauthorized_Proxy_Server_RAT
Repository: Yara-Rules/rules
Author: US-CERT Code Analysis Team

Pattern signatures:
$s0 = {8A043132C288043125FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72DE5E5FC3}
	$s1 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s2 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s3 = {8A043132C288043125FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72DE5E5FC3}
	$s4 = {B91A7900008A140780F29A[PII_REDACTED]F4}
	$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
	$s6 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40600910A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
	$s8 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F24}
	$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F[PII_REDACTED]C7523}
	$s10 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F246685C0}
	$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
	$s12 = {448BE8B84FECC44E41F7EDC1FA

Detection condition:
any of them

Full rule:
rule Unauthorized_Proxy_Server_RAT
{
meta:
	Author="US-CERT Code Analysis Team"
	Incident="10135536"
	MD5_1 = "C74E289AD927E81D2A1A56BC73E394AB"
	MD5_2 = "2950E3741D7AF69E0CA0C5013ABC4209"
	Info="Detects Proxy Server RAT"
	super_rule = 1
	report = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"
	report = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
strings:
	$s0 = {8A043132C288043125FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72DE5E5FC3}
	$s1 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40404900A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s2 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s3 = {8A043132C288043125FF00000003C299F73D5C394100A[PII_REDACTED]D0413BCF72DE5E5FC3}
	$s4 = {B91A7900008A140780F29A[PII_REDACTED]F4}
	$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
	$s6 = {8A[PII_REDACTED]1432C28804318B44241425FF00000003C299F73D40600910A[PII_REDACTED]D0413BCF72D65E5FC3}
	$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
	$s8 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F24}
	$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F[PII_REDACTED]C7523}
	$s10 = {8B063D[PII_REDACTED]353D[PII_REDACTED]2E668B4604663DE8037F246685C0}
	$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
	$s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
	$s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
condition:
	any of them
}
YARA Detection Rule: NK_SSL_PROXY
Repository: Yara-Rules/rules
Author: US-CERT Code Analysis Team

Pattern signatures:
$s0 = {8B4C24088A140880F24780C[PII_REDACTED]03BC67CEF5E}
	$s1 = {568B74240C33C085F67E158B4C24088A140880EA2880F[PII_REDACTED]03BC67CEF5E}
	$s2 = {4775401F[PII_REDACTED][PII_REDACTED]6869375E[PII_REDACTED]}
	$s3 = {[PII_REDACTED]6A[PII_REDACTED][PII_REDACTED]}
	$s4 = {6D2A5E265E[PII_REDACTED]34776572}
	$s5 = {3171617A[PII_REDACTED]337765}
	$s6 = "ghfghjuyufgdgftr"
	$s7 = "q45tyu6hgvhi7^%$sdf"
	$s8 = "m*^&^ghfge4wer"

Detection condition:
($s0 and $s1 and $s2 and $s3 and $s4 and $s5) or ($s6 and $s7 and $s8)

Full rule:
rule NK_SSL_PROXY{
meta:
	Author = "US-CERT Code Analysis Team"
	Date = "2018/01/09"
	MD5_1 = "C6F78AD187C365D117CACBEE140F6230"
	MD5_2 = "C01DC42F65ACAF1C917C0CC29BA63ADC"
	Info= "Detects NK SSL PROXY"
	report = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"
	report = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
strings:
	$s0 = {8B4C24088A140880F24780C[PII_REDACTED]03BC67CEF5E}
	$s1 = {568B74240C33C085F67E158B4C24088A140880EA2880F[PII_REDACTED]03BC67CEF5E}
	$s2 = {4775401F[PII_REDACTED][PII_REDACTED]6869375E[PII_REDACTED]}
	$s3 = {[PII_REDACTED]6A[PII_REDACTED][PII_REDACTED]}
	$s4 = {6D2A5E265E[PII_REDACTED]34776572}
	$s5 = {3171617A[PII_REDACTED]337765}
	$s6 = "ghfghjuyufgdgftr"
	$s7 = "q45tyu6hgvhi7^%$sdf"
	$s8 = "m*^&^ghfge4wer"
condition:
	($s0 and $s1 and $s2 and $s3 and $s4 and $s5) or ($s6 and $s7 and $s8)
}
YARA Detection Rule: r4_wiper_1
Repository: Yara-Rules/rules

Pattern signatures:
$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
	$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }

Detection condition:
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them

Full rule:
rule r4_wiper_1
{
meta:
	source = "NCCIC Partner"
	date = "2017-12-12"
	report = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
	report = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
strings:
	$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
	$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
condition:
	uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and any of them
}
YARA Detection Rule: r4_wiper_2
Repository: Yara-Rules/rules

Pattern signatures:
// BIOS Extended Write
	$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
	$ExtendedWrite = { B4 43 B0 00 CD 13 }

Detection condition:
uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them

Full rule:
rule r4_wiper_2
{
meta:
	source = "NCCIC Partner"
	date = "2017-12-12"
	report = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
	report = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
strings:
	// BIOS Extended Write
	$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
	$ExtendedWrite = { B4 43 B0 00 CD 13 }
condition:
	uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550 and all of them
}
YARA Detection Rule: volgmer
Repository: Yara-Rules/rules
Detects: Malformed User Agent

Pattern signatures:
$s = "Mozillar/"

Detection condition:
(uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $s

Full rule:
rule volgmer
{
meta:
    description = "Malformed User Agent"
    ref = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
strings:
    $s = "Mozillar/"
condition:
    (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and $s
}
YARA Detection Rule: Ransom
Repository: Yara-Rules/rules
Author: @pekeinfo
Reference: https://github.com/pekeinfo/DecryptCrypren

Pattern signatures:
$a = "won't be able to recover your files anymore.</p>"
        $b = {6A 03 68 ?? ?? ?? ?? B9 74 F1 AE 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 98 3A 00 00 FF D6 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ??}
        $c = "Please restart your computer and wait for instructions for decrypting your files"

Detection condition:
any of them

Full rule:
rule Ransom : Crypren{
    meta:
        weight = 1
        Author = "@pekeinfo"
        reference = "https://github.com/pekeinfo/DecryptCrypren"
    strings: 
        $a = "won't be able to recover your files anymore.</p>"
        $b = {6A 03 68 ?? ?? ?? ?? B9 74 F1 AE 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 98 3A 00 00 FF D6 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ??}
        $c = "Please restart your computer and wait for instructions for decrypting your files"
    condition:
        any of them
}
YARA Detection Rule: FVEY_ShadowBrokers_Jan17_Screen_Strings
Repository: Yara-Rules/rules
Detects: Detects strings derived from the ShadowBroker's leak of Windows tools/exploits
Author: Florian Roth
Reference: https://bit.no.com:43110/theshadowbrokers.bit/post/message7/

Pattern signatures:
$x1 = "Danderspritz" ascii wide fullword
      $x2 = "DanderSpritz" ascii wide fullword
      $x3 = "PeddleCheap" ascii wide fullword
      $x4 = "ChimneyPool Addres" ascii wide fullword
      $a1 = "Getting remote time" fullword ascii
      $a2 = "RETRIEVED" fullword ascii
      $b1 = "Added Ops library to Python search path" fullword ascii
      $b2 = "target: z0.0.0.1" fullword ascii
      $c1 = "Psp_Avoidance" fullword ascii
      $c2 = "PasswordDump" fullword ascii
      $c3 = "InjectDll" fullword ascii
      $c4 = "EventLogEdit" fullword ascii
      $c5 = "ProcessModify" fullword ascii
      $d1 = "Mcl_NtElevation" fullword ascii wide
      $d2 = "Mcl_NtNativeApi" fullword ascii wide
      $d3 = "Mcl_ThreatInject" fullword ascii wide
      $d4 = "Mcl_NtMemory" fullword ascii wide

Detection condition:
filesize < 2000KB and (1 of ($x*) or all of ($a*) or 1 of ($b*) or ( uint16(0) == 0x5a4d and 1 of ($c*) ) or 3 of ($c*) or ( uint16(0) == 0x5a4d and 3 of ($d*) ))

Full rule:
rule FVEY_ShadowBrokers_Jan17_Screen_Strings 
{

   meta:
      description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
      author = "Florian Roth"
      reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
      date = "2017-01-08"

   strings:
      $x1 = "Danderspritz" ascii wide fullword
      $x2 = "DanderSpritz" ascii wide fullword
      $x3 = "PeddleCheap" ascii wide fullword
      $x4 = "ChimneyPool Addres" ascii wide fullword
      $a1 = "Getting remote time" fullword ascii
      $a2 = "RETRIEVED" fullword ascii
      $b1 = "Added Ops library to Python search path" fullword ascii
      $b2 = "target: z0.0.0.1" fullword ascii
      $c1 = "Psp_Avoidance" fullword ascii
      $c2 = "PasswordDump" fullword ascii
      $c3 = "InjectDll" fullword ascii
      $c4 = "EventLogEdit" fullword ascii
      $c5 = "ProcessModify" fullword ascii
      $d1 = "Mcl_NtElevation" fullword ascii wide
      $d2 = "Mcl_NtNativeApi" fullword ascii wide
      $d3 = "Mcl_ThreatInject" fullword ascii wide
      $d4 = "Mcl_NtMemory" fullword ascii wide

   condition:
      filesize < 2000KB and (1 of ($x*) or all of ($a*) or 1 of ($b*) or ( uint16(0) == 0x5a4d and 1 of ($c*) ) or 3 of ($c*) or ( uint16(0) == 0x5a4d and 3 of ($d*) ))
}
YARA Detection Rule: MiniDionis_readerView
Repository: Yara-Rules/rules
Detects: MiniDionis Malware - file readerView.exe / adobe.exe
Author: Florian Roth
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
        $s2 = "dnlibsh" fullword ascii /* score: '7.00' */

        $op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
        $op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
        $op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)

Full rule:
rule MiniDionis_readerView 
{

    meta:
        description = "MiniDionis Malware - file readerView.exe / adobe.exe"
        author = "Florian Roth"
        reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
        date = "2015-07-20"
        /* Original Hash */
        hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
        /* Derived Samples */
        hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f[PII_REDACTED]40004"
        hash3 = "88a40d5b679bccf[PII_REDACTED]b3d18b09e68b609ffaf414574a6eca6536e8b8f"
        hash4 = "97d8725e39d263ed21856477ed[PII_REDACTED]4b5c0d0b9ae86ebb1cdd4cdc18b7"
        hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
        hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"

    strings:
        $s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
        $s2 = "dnlibsh" fullword ascii /* score: '7.00' */

        $op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
        $op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
        $op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Malicious_SFX1
Repository: Yara-Rules/rules
Detects: SFX with voicemail content
Author: Florian Roth
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
        $s1 = ".exe" ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80)

Full rule:
rule Malicious_SFX1 
{

    meta:
        description = "SFX with voicemail content"
        author = "Florian Roth"
        reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
        date = "2015-07-20"
        hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
   
    strings:
        $s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
        $s1 = ".exe" ascii
   
    condition:
        uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80) 
}
YARA Detection Rule: Malicious_SFX2
Repository: Yara-Rules/rules
Detects: SFX with adobe.exe content
Author: Florian Roth
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
        $s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
        $s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule Malicious_SFX2 
{

    meta:
        description = "SFX with adobe.exe content"
        author = "Florian Roth"
        reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
        date = "2015-07-20"
        hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"

    strings:
        $s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
        $s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
        $s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */

    condition:
        uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: MiniDionis_VBS_Dropped
Repository: Yara-Rules/rules
Detects: Dropped File - 1.vbs
Author: Florian Roth
Reference: https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/

Pattern signatures:
$s1 = "Wscript.Sleep 5000" ascii
        $s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
        $s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
        $s4 = "If(FSO.FileExists(\"" ascii
        $s5 = "then FSO.DeleteFile(\".\\" ascii

Detection condition:
filesize < 1KB and all of them and $s1 in (0..40)

Full rule:
rule MiniDionis_VBS_Dropped 
{

    meta:
        description = "Dropped File - 1.vbs"
        author = "Florian Roth"
        reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
        date = "2015-07-21"
        hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"

    strings:
        $s1 = "Wscript.Sleep 5000" ascii
        $s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
        $s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
        $s4 = "If(FSO.FileExists(\"" ascii
        $s5 = "then FSO.DeleteFile(\".\\" ascii

    condition:
        filesize < 1KB and all of them and $s1 in (0..40)
}
YARA Detection Rule: BoousetCode
Repository: Yara-Rules/rules
Detects: Boouset code tricks
Author: Seth Hardy

Pattern signatures:
$boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }

Detection condition:
any of them

Full rule:
rule BoousetCode
{
    
    meta:
        description = "Boouset code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $boousetdat = { C6 ?? ?? ?? ?? 00 62 C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 6F C6 ?? ?? ?? ?? 00 75 }
        
    condition:
        any of them
}