deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT30_Generic_8
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Windows NT4.0" fullword
		$s1 = "Windows NT3.51" fullword
		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
		$s3 = "%s %d.%d Build%d %s" fullword
		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
		$s5 = "SQSRSS" fullword
		$s8 = "WM_COMP" fullword
		$s9 = "WM_MBU" fullword
		$s11 = "WM_GRID" fullword
		$s12 = "WM_RBU" fullword

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_8 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "b47e20ac[PII_REDACTED]dc241f28f4e224070810d2"
		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
		id = "a6845222-0a3e-5327-a448-36e8d54362a5"
	strings:
		$s0 = "Windows NT4.0" fullword
		$s1 = "Windows NT3.51" fullword
		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
		$s3 = "%s %d.%d Build%d %s" fullword
		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
		$s5 = "SQSRSS" fullword
		$s8 = "WM_COMP" fullword
		$s9 = "WM_MBU" fullword
		$s11 = "WM_GRID" fullword
		$s12 = "WM_RBU" fullword
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_9
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "%s\\%s\\$NtRecDoc$" fullword
		$s1 = "%s(%u)%s" fullword
		$s2 = "http://%s%s%s" fullword
		$s3 = "1.9.1.17" fullword wide
		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_9 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		super_rule = 1
		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
		id = "cf259f8d-e0a9-579d-93e7-ec14d99faf81"
	strings:
		$s0 = "%s\\%s\\$NtRecDoc$" fullword
		$s1 = "%s(%u)%s" fullword
		$s2 = "http://%s%s%s" fullword
		$s3 = "1.9.1.17" fullword wide
		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: NK_Miner_Malware_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects Noth Korean Monero Miner mentioned in AlienVault report
Author: Florian Roth (Nextron Systems) (original rule by Chris Doman)
Reference: https://goo.gl/PChE1z

Pattern signatures:
$x0 = "c:\\users\\jawhar\\documents\\" ascii
      $x1 = "C:\\Users\\Jawhar\\documents\\" ascii
      $x2 = "The number of processors on this computer is {0}." fullword wide
      $x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
              00 00 }
      $x4 = "Le fichier Hello txt n'existe pas" fullword wide
      $x5 = "C:\\NewDirectory2\\info2" fullword wide

      /* Incorported from Chris Doman's rule - https://goo.gl/PChE1z*/
      $a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
      $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
      $c = "barjuok.ryongnamsan.edu.kp" wide ascii
      $d = "C:\\SoftwaresInstall\\soft" wide ascii
      $e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
      $f = "C:\\Windows\\Sys64\\updater.exe" wide ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 30KB and 1 of them

Full rule:
rule NK_Miner_Malware_Jan18_1 {
   meta:
      description = "Detects Noth Korean Monero Miner mentioned in AlienVault report"
      author = "Florian Roth (Nextron Systems) (original rule by Chris Doman)"
      reference = "https://goo.gl/PChE1z"
      date = "2018-01-09"
      hash1 = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
      hash2 = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
      id = "40f53c36-9e14-5307-9740-e6f514afc7ec"
   strings:
      $x0 = "c:\\users\\jawhar\\documents\\" ascii
      $x1 = "C:\\Users\\Jawhar\\documents\\" ascii
      $x2 = "The number of processors on this computer is {0}." fullword wide
      $x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
              00 00 }
      $x4 = "Le fichier Hello txt n'existe pas" fullword wide
      $x5 = "C:\\NewDirectory2\\info2" fullword wide

      /* Incorported from Chris Doman's rule - https://goo.gl/PChE1z*/
      $a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
      $b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
      $c = "barjuok.ryongnamsan.edu.kp" wide ascii
      $d = "C:\\SoftwaresInstall\\soft" wide ascii
      $e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
      $f = "C:\\Windows\\Sys64\\updater.exe" wide ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 30KB and 1 of them
}
YARA Detection Rule: Codoso_PlugX_3
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
		$s2 = "mcs.exe" fullword ascii
		$s3 = "McAltLib.dll" fullword ascii
		$s4 = "WinRAR self-extracting archive" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1200KB and all of them

Full rule:
rule Codoso_PlugX_3 {
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
		id = "55066812-3a8e-5099-afb4-ff7a59f1ccb2"
	strings:
		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
		$s2 = "mcs.exe" fullword ascii
		$s3 = "McAltLib.dll" fullword ascii
		$s4 = "WinRAR self-extracting archive" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 1200KB and all of them
}
YARA Detection Rule: Codoso_PlugX_2
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "%TEMP%\\HID" fullword wide
		$s2 = "%s\\hid.dll" fullword wide
		$s3 = "%s\\SOUNDMAN.exe" fullword wide
		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
		$s5 = "%s\\HID.dllx" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them

Full rule:
rule Codoso_PlugX_2 {
	meta:
		description = "Detects Codoso APT PlugX Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "b9510e4484fa7e[PII_REDACTED]768176fce822162ad819539c6ca3631deac043eb"
		id = "0402a0ff-5664-52db-a739-51c5181853f8"
	strings:
		$s1 = "%TEMP%\\HID" fullword wide
		$s2 = "%s\\hid.dll" fullword wide
		$s3 = "%s\\SOUNDMAN.exe" fullword wide
		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
		$s5 = "%s\\HID.dllx" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
}
YARA Detection Rule: Codoso_CustomTCP_4
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "varus_service_x86.dll" fullword ascii

		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s2 = "net start %%1" fullword ascii
		$s3 = "ping 127.1 > nul" fullword ascii
		$s4 = "McInitMISPAlertEx" fullword ascii
		$s5 = "sc start %%1" fullword ascii
		$s6 = "net stop %%1" fullword ascii
		$s7 = "WorkerRun" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
		( $x1 and 2 of ($s*) )

Full rule:
rule Codoso_CustomTCP_4 {
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
	strings:
		$x1 = "varus_service_x86.dll" fullword ascii

		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s2 = "net start %%1" fullword ascii
		$s3 = "ping 127.1 > nul" fullword ascii
		$s4 = "McInitMISPAlertEx" fullword ascii
		$s5 = "sc start %%1" fullword ascii
		$s6 = "net stop %%1" fullword ascii
		$s7 = "WorkerRun" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or
		( $x1 and 2 of ($s*) )
}
YARA Detection Rule: Codoso_CustomTCP_3
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "DnsApi.dll" fullword ascii
		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
		$s6 = "iphlpapi.dll" ascii
		$s7 = "%systemroot%\\Web\\" ascii
		$s8 = "Proxy-Authorization: Negotiate %s" ascii
		$s9 = "CLSID\\{%s}\\InprocServer32" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them

Full rule:
rule Codoso_CustomTCP_3 {
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
	strings:
		$s1 = "DnsApi.dll" fullword ascii
		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
		$s6 = "iphlpapi.dll" ascii
		$s7 = "%systemroot%\\Web\\" ascii
		$s8 = "Proxy-Authorization: Negotiate %s" ascii
		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
}
YARA Detection Rule: Codoso_CustomTCP_2
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "varus_service_x86.dll" fullword ascii
		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s3 = "net start %%1" fullword ascii
		$s4 = "ping 127.1 > nul" fullword ascii
		$s5 = "McInitMISPAlertEx" fullword ascii
		$s6 = "sc start %%1" fullword ascii
		$s7 = "B_WKNDNSK^" fullword ascii
		$s8 = "net stop %%1" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 406KB and all of them

Full rule:
rule Codoso_CustomTCP_2 {
	meta:
		description = "Detects Codoso APT CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
	strings:
		$s1 = "varus_service_x86.dll" fullword ascii
		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
		$s3 = "net start %%1" fullword ascii
		$s4 = "ping 127.1 > nul" fullword ascii
		$s5 = "McInitMISPAlertEx" fullword ascii
		$s6 = "sc start %%1" fullword ascii
		$s7 = "B_WKNDNSK^" fullword ascii
		$s8 = "net stop %%1" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 406KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_6
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PGV_PVID Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "rundll32 \"%s\",%s" fullword ascii
		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and all of them

Full rule:
rule Codoso_PGV_PVID_6 {
	meta:
		description = "Detects Codoso APT PGV_PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
		id = "6d1d8490-fdcb-5263-ae00-0b436e822fc3"
	strings:
		$s0 = "rundll32 \"%s\",%s" fullword ascii
		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 6000KB and all of them
}
YARA Detection Rule: Codoso_Gh0st_3
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "RunMeByDLL32" fullword ascii

		$s1 = "svchost.dll" fullword wide
		$s2 = "server.dll" fullword ascii
		$s3 = "Copyright ? 2008" fullword wide
		$s4 = "testsupdate33" fullword ascii
		$s5 = "Device Protect Application" fullword wide
		$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
		$s7 = "mail-news.eicp.net" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them

Full rule:
rule Codoso_Gh0st_3 {
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
		id = "55fb17c5-ee11-55be-9af3-e9fe8d6160b5"
	strings:
		$x1 = "RunMeByDLL32" fullword ascii

		$s1 = "svchost.dll" fullword wide
		$s2 = "server.dll" fullword ascii
		$s3 = "Copyright ? 2008" fullword wide
		$s4 = "testsupdate33" fullword ascii
		$s5 = "Device Protect Application" fullword wide
		$s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
		$s7 = "mail-news.eicp.net" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
}
YARA Detection Rule: Codoso_Gh0st_2
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$s14 = "%s -r debug 1" fullword ascii
		$s15 = "\\\\.\\keymmdrv1" fullword ascii
		$s17 = "RunMeByDLL32" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and 1 of them

Full rule:
rule Codoso_Gh0st_2 {
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "5402c785037614d09ad41e41e[PII_REDACTED]b53afd55aa054a09a[PII_REDACTED]1"
		id = "5643d028-2a76-5bce-bf2f-8be706ab1fd5"
	strings:
		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$s14 = "%s -r debug 1" fullword ascii
		$s15 = "\\\\.\\keymmdrv1" fullword ascii
		$s17 = "RunMeByDLL32" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and 1 of them
}
YARA Detection Rule: Codoso_CustomTCP
Repository: Neo23x0/signature-base
Detects: Codoso CustomTCP Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s4 = "wnyglw" fullword ascii
		$s5 = "WorkerRun" fullword ascii
		$s7 = "boazdcd" fullword ascii
		$s8 = "wayflw" fullword ascii
		$s9 = "CODETABL" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 405KB and all of them

Full rule:
rule Codoso_CustomTCP {
	meta:
		description = "Codoso CustomTCP Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
	strings:
		$s4 = "wnyglw" fullword ascii
		$s5 = "WorkerRun" fullword ascii
		$s7 = "boazdcd" fullword ascii
		$s8 = "wayflw" fullword ascii
		$s9 = "CODETABL" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 405KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_5
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT PGV PVID Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "/c del %s >> NUL" fullword ascii
		$s2 = "%s%s.manifest" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of them

Full rule:
rule Codoso_PGV_PVID_5 {
	meta:
		description = "Detects Codoso APT PGV PVID Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
		id = "0202d82c-c1f8-59f7-96b6-b21f21c1dc69"
	strings:
		$s1 = "/c del %s >> NUL" fullword ascii
		$s2 = "%s%s.manifest" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and all of them
}
YARA Detection Rule: Codoso_Gh0st_1
Repository: Neo23x0/signature-base
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth (Nextron Systems)
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$x4 = "\\\\.\\keymmdrv1" fullword ascii

		$s1 = "spideragent.exe" fullword ascii
		$s2 = "AVGIDSAgent.exe" fullword ascii
		$s3 = "kavsvc.exe" fullword ascii
		$s4 = "mspaint.exe" fullword ascii
		$s5 = "kav.exe" fullword ascii
		$s6 = "avp.exe" fullword ascii
		$s7 = "NAV.exe" fullword ascii

		$c1 = "Elevation:Administrator!new:" wide
		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
		$c3 = "\\sysprep\\sysprep.exe" wide
		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
		$c7 = "\\sysprep" wide
		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
		1 of ($x*) or
		6 of ($c*)

Full rule:
rule Codoso_Gh0st_1 {
	meta:
		description = "Detects Codoso APT Gh0st Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
		date = "2016-01-30"
		super_rule = 1
		hash1 = "5402c785037614d09ad41e41e[PII_REDACTED]b53afd55aa054a09a[PII_REDACTED]1"
		hash2 = "7dc7cec2c3f7e[PII_REDACTED]1f64060ebd955813002d4db780e68a8f6e7d0a8f8"
		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
		id = "24d9e64c-4b35-5737-92ae-8ec391d494c7"
	strings:
		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
		$x4 = "\\\\.\\keymmdrv1" fullword ascii

		$s1 = "spideragent.exe" fullword ascii
		$s2 = "AVGIDSAgent.exe" fullword ascii
		$s3 = "kavsvc.exe" fullword ascii
		$s4 = "mspaint.exe" fullword ascii
		$s5 = "kav.exe" fullword ascii
		$s6 = "avp.exe" fullword ascii
		$s7 = "NAV.exe" fullword ascii

		$c1 = "Elevation:Administrator!new:" wide
		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
		$c3 = "\\sysprep\\sysprep.exe" wide
		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
		$c7 = "\\sysprep" wide
		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and ( 4 of ($s*) or 4 of ($c*) ) or
		1 of ($x*) or
		6 of ($c*)
}