deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EquationGroup_ProcessHide_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file ProcessHide_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "Invalid flag.  Can only hide or unhide" fullword wide
      $x2 = "Process elevation failed" fullword wide
      $x3 = "Unknown error hiding process" fullword wide
      $x4 = "Invalid process links found in EPROCESS" fullword wide
      $x5 = "Unable to find SYSTEM process" fullword wide
      $x6 = "Process hidden, but EPROCESS location lost" fullword wide
      $x7 = "Invalid EPROCESS location for given ID" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 3 of them )

Full rule:
rule EquationGroup_ProcessHide_Lp {
   meta:
      description = "EquationGroup Malware - file ProcessHide_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
      id = "b0842897-f591-5213-9a26-0f8732e6f3b8"
   strings:
      $x1 = "Invalid flag.  Can only hide or unhide" fullword wide
      $x2 = "Process elevation failed" fullword wide
      $x3 = "Unknown error hiding process" fullword wide
      $x4 = "Invalid process links found in EPROCESS" fullword wide
      $x5 = "Unable to find SYSTEM process" fullword wide
      $x6 = "Process hidden, but EPROCESS location lost" fullword wide
      $x7 = "Invalid EPROCESS location for given ID" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( 3 of them )
}
YARA Detection Rule: EquationGroup_pwdump_Implant
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file pwdump_Implant.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = ".?AVFeFinallyFailure@@" fullword ascii
      $s8 = ".?AVFeFinallySuccess@@" fullword ascii
      $s3 = "\\system32\\win32k.sys" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_pwdump_Implant {
   meta:
      description = "EquationGroup Malware - file pwdump_Implant.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
      id = "55984c20-539e-5e51-b3c4-caa6157c993d"
   strings:
      $s1 = ".?AVFeFinallyFailure@@" fullword ascii
      $s8 = ".?AVFeFinallySuccess@@" fullword ascii
      $s3 = "\\system32\\win32k.sys" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_5
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level3_http_dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = "itanium" fullword wide
      $s6 = "Copyright (C) Microsoft" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_5 {
   meta:
      description = "EquationGroup Malware - file PC_Level3_http_dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
      id = "a67655eb-5593-5ac7-a6aa-81f235fa3c33"
   strings:
      $s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s3 = "itanium" fullword wide
      $s6 = "Copyright (C) Microsoft" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_PC_Level3_http_flav_dll
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level3_http_flav_dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s4 = "itanium" fullword wide
      $s5 = "RHTTP/1.0" fullword wide
      $s8 = "Copyright (C) Microsoft" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_PC_Level3_http_flav_dll {
   meta:
      description = "EquationGroup Malware - file PC_Level3_http_flav_dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
      id = "4bc4804b-c6d2-5c94-b451-24bb0f3dba43"
   strings:
      $s1 = "Psxssdll.dll" fullword wide
      $s2 = "Posix Server Dll" fullword wide
      $s4 = "itanium" fullword wide
      $s5 = "RHTTP/1.0" fullword wide
      $s8 = "Copyright (C) Microsoft" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_LSADUMP_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file LSADUMP_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "LSADUMP - - ERROR - - Injected" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )

Full rule:
rule EquationGroup_LSADUMP_Lp {
   meta:
      description = "EquationGroup Malware - file LSADUMP_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
      id = "8068ca41-6365-5c97-82f2-be9ad89628e0"
   strings:
      $x1 = "LSADUMP - - ERROR - - Injected" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_mstcp32
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file mstcp32.sys
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "mstcp32.sys" fullword wide
      $s2 = "p32.sys" fullword ascii
      $s3 = "\\Registry\\User\\CurrentUser\\" wide
      $s4 = "\\DosDevices\\%ws" wide
      $s5 = "\\Device\\%ws_%ws" wide
      $s6 = "sys\\mstcp32.dbg" fullword ascii
      $s7 = "%ws%03d%ws%wZ" fullword wide
      $s8 = "TCP/IP driver" fullword wide
      $s9 = "\\Device\\%ws" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and 7 of them ) or ( all of them )

Full rule:
rule EquationGroup_EquationDrug_mstcp32 {
   meta:
      description = "EquationGroup Malware - file mstcp32.sys"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      modified = "2023-01-06"
      hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
      id = "bed26a7b-933f-5578-b65c[PII_REDACTED]0d"
   strings:
      $s1 = "mstcp32.sys" fullword wide
      $s2 = "p32.sys" fullword ascii
      $s3 = "\\Registry\\User\\CurrentUser\\" wide
      $s4 = "\\DosDevices\\%ws" wide
      $s5 = "\\Device\\%ws_%ws" wide
      $s6 = "sys\\mstcp32.dbg" fullword ascii
      $s7 = "%ws%03d%ws%wZ" fullword wide
      $s8 = "TCP/IP driver" fullword wide
      $s9 = "\\Device\\%ws" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and 7 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup_nethide_Lp
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file nethide_Lp.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
      $x2 = "privilegeRunInKernelMode failed" fullword wide
      $x3 = "Failed to unhide requested connection" fullword wide
      $x4 = "Nethide running in USER_MODE" fullword wide
      $x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )

Full rule:
rule EquationGroup_nethide_Lp {
   meta:
      description = "EquationGroup Malware - file nethide_Lp.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
      id = "39e96239-2189-5993-90ba-27e47f7bfdea"
   strings:
      $x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
      $x2 = "privilegeRunInKernelMode failed" fullword wide
      $x3 = "Failed to unhide requested connection" fullword wide
      $x4 = "Nethide running in USER_MODE" fullword wide
      $x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 1 of them ) or ( all of them )
}
YARA Detection Rule: EquationGroup_PC_Level4_flav_dll_x64
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level4_flav_dll_x64
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "wship.dll" fullword wide
      $s2 = "   IP:      " fullword ascii
      $s3 = "\\\\.\\%hs" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_PC_Level4_flav_dll_x64 {
   meta:
      description = "EquationGroup Malware - file PC_Level4_flav_dll_x64"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
      id = "f05dd0b6-106c-5d1d-ba09-4ac3035e7030"
   strings:
      $s1 = "wship.dll" fullword wide
      $s2 = "   IP:      " fullword ascii
      $s3 = "\\\\.\\%hs" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_PC_Level4_flav_exe
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level4_flav_exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "Extended Memory Runtime Process" fullword wide
      $s2 = "memess.exe" fullword wide
      $s3 = "\\\\.\\%hs" fullword ascii
      $s4 = ".?AVOpenSocket@@" fullword ascii
      $s5 = "Corporation. All rights reserved." fullword wide
      $s6 = "itanium" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_PC_Level4_flav_exe {
   meta:
      description = "EquationGroup Malware - file PC_Level4_flav_exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "33ba9f103186b6e52d8d69499512e7fbac9096e7c[PII_REDACTED]488acc3b669a9"
      id = "eb93a798-4e7e-52dc-a39b-bfb63a58d250"
   strings:
      $s1 = "Extended Memory Runtime Process" fullword wide
      $s2 = "memess.exe" fullword wide
      $s3 = "\\\\.\\%hs" fullword ascii
      $s4 = ".?AVOpenSocket@@" fullword ascii
      $s5 = "Corporation. All rights reserved." fullword wide
      $s6 = "itanium" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_processinfo_Implant
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file processinfo_Implant.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "hZwOpenProcessToken" fullword ascii
      $s2 = "hNtQueryInformationProcess" fullword ascii
      $s3 = "No mapping" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 80KB and all of them )

Full rule:
rule EquationGroup_processinfo_Implant {
   meta:
      description = "EquationGroup Malware - file processinfo_Implant.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
      id = "b110d819-2298-507b-91bb-2787bb11322e"
   strings:
      $s1 = "hZwOpenProcessToken" fullword ascii
      $s2 = "hNtQueryInformationProcess" fullword ascii
      $s3 = "No mapping" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 80KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_2
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PortMap_Implant.dll
Author: Auto Generated
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 250KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_2 {
   meta:
      description = "EquationGroup Malware - file PortMap_Implant.dll"
      author = "Auto Generated"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "[PII_REDACTED]40738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
      id = "662ee1cf-b837-5362-84a8-1af7335d5e1b"
   strings:
      $op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
      $op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
      $op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 250KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_ntevt
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file ntevt.sys
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "ntevt.sys" fullword ascii
      $s2 = "c:\\ntevt.pdb" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_ntevt {
   meta:
      description = "EquationGroup Malware - file ntevt.sys"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
      id = "36d23adb-dafe-5e99-8976-b146ceca2f9b"
   strings:
      $s1 = "ntevt.sys" fullword ascii
      $s2 = "c:\\ntevt.pdb" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 500KB and all of them )
}
YARA Detection Rule: EquationGroup_nethide_Implant
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file nethide_Implant.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "\\\\.\\dlcndi" fullword ascii
      $s2 = "s\\drivers\\" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 90KB and all of them )

Full rule:
rule EquationGroup_nethide_Implant {
   meta:
      description = "EquationGroup Malware - file nethide_Implant.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
	  modified = "2023-01-27"
      hash1 = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
      id = "36559b69-1718-5d9b-8d6f-3db4becba0c4"
   strings:
      $s1 = "\\\\.\\dlcndi" fullword ascii
      $s2 = "s\\drivers\\" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 90KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_Gen_4
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file PC_Level4_flav_dll
Author: Auto Generated
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
      $op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
      $op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_Gen_4 {
   meta:
      description = "EquationGroup Malware - file PC_Level4_flav_dll"
      author = "Auto Generated"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
      id = "e3fc376b-f7cc-5dfa-bcf4-4991962a4cf9"
   strings:
      $op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
      $op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
      $op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_tdi6
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file tdi6.sys
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "tdi6.sys" fullword wide
      $s3 = "TDI IPv6 Wrapper" fullword wide
      $s5 = "Corporation. All rights reserved." fullword wide
      $s6 = "FailAction" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_tdi6 {
   meta:
      description = "EquationGroup Malware - file tdi6.sys"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "12c082f74c0916a0e[PII_REDACTED]36de3a12072a18d29c97bead15bb301f4b3f8"
      id = "c6dbc28a-ec52-5256-afff-ab15ed1b90a6"
   strings:
      $s1 = "tdi6.sys" fullword wide
      $s3 = "TDI IPv6 Wrapper" fullword wide
      $s5 = "Corporation. All rights reserved." fullword wide
      $s6 = "FailAction" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_modifyAuthentication_Implant
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file modifyAuthentication_Implant.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "LSASS.EXE" fullword wide
      $s2 = "hsamsrv.dll" fullword ascii
      $s3 = "hZwOpenProcess" fullword ascii
      $s4 = "hOpenProcess" fullword ascii
      $s5 = ".?AVFeFinallyFailure@@" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_modifyAuthentication_Implant {
   meta:
      description = "EquationGroup Malware - file modifyAuthentication_Implant.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
      id = "990035c5-cd9c-59e0-b244-e2caafd2561f"
   strings:
      $s1 = "LSASS.EXE" fullword wide
      $s2 = "hsamsrv.dll" fullword ascii
      $s3 = "hZwOpenProcess" fullword ascii
      $s4 = "hOpenProcess" fullword ascii
      $s5 = ".?AVFeFinallyFailure@@" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_ntfltmgr
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file ntfltmgr.sys
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "ntfltmgr.sys" fullword wide
      $s2 = "ntfltmgr.pdb" fullword ascii
      $s4 = "Network Filter Manager" fullword wide
      $s5 = "Corporation. All rights reserved." fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 100KB and all of them )

Full rule:
rule EquationGroup_ntfltmgr {
   meta:
      description = "EquationGroup Malware - file ntfltmgr.sys"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
      id = "dd7fd371-a097-5df5-9ffd-89babbadee96"
   strings:
      $s1 = "ntfltmgr.sys" fullword wide
      $s2 = "ntfltmgr.pdb" fullword ascii
      $s4 = "Network Filter Manager" fullword wide
      $s5 = "Corporation. All rights reserved." fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 100KB and all of them )
}
YARA Detection Rule: EquationGroup_DXGHLP16
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file DXGHLP16.SYS
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "DXGHLP16.SYS" fullword wide
      $s2 = "P16.SYS" fullword ascii
      $s3 = "\\Registry\\User\\CurrentUser\\" wide
      $s4 = "\\DosDevices\\%ws" wide
      $s5 = "\\Device\\%ws_%ws" wide
      $s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
      $s7 = "%ws%03d%ws%wZ" fullword wide
      $s8 = "TCP/IP driver" fullword wide
      $s9 = "\\Device\\%ws" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 200KB and all of them )

Full rule:
rule EquationGroup_DXGHLP16 {
   meta:
      description = "EquationGroup Malware - file DXGHLP16.SYS"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      modified = "2023-01-06"
      hash1 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
      id = "d9e39c22-f606-5d9c-a5e2-e536b8566595"
   strings:
      $s1 = "DXGHLP16.SYS" fullword wide
      $s2 = "P16.SYS" fullword ascii
      $s3 = "\\Registry\\User\\CurrentUser\\" wide
      $s4 = "\\DosDevices\\%ws" wide
      $s5 = "\\Device\\%ws_%ws" wide
      $s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
      $s7 = "%ws%03d%ws%wZ" fullword wide
      $s8 = "TCP/IP driver" fullword wide
      $s9 = "\\Device\\%ws" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 200KB and all of them )
}
YARA Detection Rule: EquationGroup_EquationDrug_msgkd
Repository: Neo23x0/signature-base
Detects: EquationGroup Malware - file msgkd.ex_
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/tcSoiJ

Pattern signatures:
$s1 = "KEysud" fullword ascii
      $s2 = "XWWWPWS" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule EquationGroup_EquationDrug_msgkd {
   meta:
      description = "EquationGroup Malware - file msgkd.ex_"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/tcSoiJ"
      date = "2017-01-13"
      hash1 = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
      id = "41019119-9bf4-5a45-b74b-f75ab7738821"
   strings:
      $s1 = "KEysud" fullword ascii
      $s2 = "XWWWPWS" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}