deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Misdat_Backdoor
Repository: Yara-Rules/rules
Author: Cylance SPEAR Team

Pattern signatures:
$imul = {03 45 F8 69 C0 D9 DB 00 00 05 3B DA 00 00}
        $delphi = {50 45 00 00 4C 01 08 00 19 5E 42 2A}

Detection condition:
$imul and $delphi

Full rule:
rule Misdat_Backdoor
{
   
   meta:
        author = "Cylance SPEAR Team"
        /* Decode Function
        CODE:00406C71 8B 55 F4                  mov     edx, [ebp+var_C]
        CODE:00406C74 8A 54 1A FF               mov     dl, [edx+ebx-1]
        CODE:00406C78 8B 4D F8                  mov     ecx, [ebp+var_8]
        CODE:00406C7B C1 E9 08                  shr     ecx, 8
        CODE:00406C7E 32 D1                     xor     dl, cl
        CODE:00406C80 88 54 18 FF               mov     [eax+ebx-1], dl
        CODE:00406C84 8B 45 F4                  mov     eax, [ebp+var_C]
        CODE:00406C87 0F B6 44 18 FF            movzx   eax, byte ptr [eax+ebx-1]
        CODE:00406C8C 03 45 F8                  add     eax, [ebp+var_8]
        CODE:00406C8F 69 C0 D9 DB 00 00         imul    eax, 0DBD9h
        CODE:00406C95 05 3B DA 00 00            add     eax, 0DA3Bh
        CODE:00406C9A 89 45 F8                  mov     [ebp+var_8], eax
        CODE:00406C9D 43                        inc     ebx
        CODE:00406C9E 4E                        dec     esi
        CODE:00406C9F 75 C9                     jnz     short loc_406C6A
        */
    
    strings:
        $imul = {03 45 F8 69 C0 D9 DB 00 00 05 3B DA 00 00}
        $delphi = {50 45 00 00 4C 01 08 00 19 5E 42 2A}
        
    condition:
        $imul and $delphi
}
YARA Detection Rule: SType_Backdoor
Repository: Yara-Rules/rules
Author: Cylance SPEAR Team

Pattern signatures:
$stype = "stype=info&data="
        $mmid = "?mmid="
        $status = "&status=run succeed"
        $mutex = "_KB10B2D1_CIlFD2C"
        $decode = {8B 1A 8A 1B 80 EB 02 8B 74 24 08 32 1E 8B 31 88 1E 8B 1A 43}

Detection condition:
$stype or ($mmid and $status) or $mutex or $decode

Full rule:
rule SType_Backdoor
{
   
    meta:
        author = "Cylance SPEAR Team"
        
        /* Decode Function
        8B 1A       mov     ebx, [edx]
        8A 1B       mov     bl, [ebx]
        80 EB 02    sub     bl, 2
        8B 74 24 08 mov     esi, [esp+14h+var_C]
        32 1E       xor     bl, [esi]
        8B 31       mov     esi, [ecx]
        88 1E       mov     [esi], bl
        8B 1A       mov     ebx, [edx]
        43          inc     ebx
        89 1A       mov     [edx], ebx
        8B 19       mov     ebx, [ecx]
        43          inc     ebx
        89 19       mov     [ecx], ebx
        48          dec     eax
        75 E2       jnz     short loc_40EAC6
        */

    strings:
        $stype = "stype=info&data="
        $mmid = "?mmid="
        $status = "&status=run succeed"
        $mutex = "_KB10B2D1_CIlFD2C"
        $decode = {8B 1A 8A 1B 80 EB 02 8B 74 24 08 32 1E 8B 31 88 1E 8B 1A 43}
    
    condition:
        $stype or ($mmid and $status) or $mutex or $decode
}
YARA Detection Rule: Zlib_Backdoor
Repository: Yara-Rules/rules
Author: Cylance SPEAR Team

Pattern signatures:
$auth = {C6 45 D8 50 C6 45 D9 72 C6 45 DA 6F C6 45 DB 78 C6 45 DC 79 C6 45 DD 2D}
        $auth2 = {C7 45 FC 00 04 00 00 C6 45 ?? 50 C6 45 ?? 72 C6 45 ?? 6F}
        $ntlm = "NTLM" wide

Detection condition:
($auth or $auth2) and $ntlm

Full rule:
rule Zlib_Backdoor
{
   
    meta:
        author = "Cylance SPEAR Team"
        
        /* String
        C7 45 FC 00 04 00 00          mov     [ebp+Memory], 400h
        C6 45 D8 50                   mov     [ebp+Str], 'P'
        C6 45 D9 72                   mov     [ebp+var_27], 'r'
        C6 45 DA 6F                   mov     [ebp+var_26], 'o'
        C6 45 DB 78                   mov     [ebp+var_25], 'x'
        C6 45 DC 79                   mov     [ebp+var_24], 'y'
        C6 45 DD 2D                   mov     [ebp+var_23], '-'
        C6 45 DE 41                   mov     [ebp+var_22], 'A'
        C6 45 DF 75                   mov     [ebp+var_21], 'u'
        C6 45 E0 74                   mov     [ebp+var_20], 't'
        C6 45 E1 68                   mov     [ebp+var_1F], 'h'
        C6 45 E2 65                   mov     [ebp+var_1E], 'e'
        C6 45 E3 6E                   mov     [ebp+var_1D], 'n'
        C6 45 E4 74                   mov     [ebp+var_1C], 't'
        C6 45 E5 69                   mov     [ebp+var_1B], 'i'
        C6 45 E6 63                   mov     [ebp+var_1A], 'c'
        C6 45 E7 61                   mov     [ebp+var_19], 'a'
        C6 45 E8 74                   mov     [ebp+var_18], 't'
        C6 45 E9 65                   mov     [ebp+var_17], 'e'
        C6 45 EA 3A                   mov     [ebp+var_16], ':'
        C6 45 EB 20                   mov     [ebp+var_15], ' '
        C6 45 EC 4E                   mov     [ebp+var_14], 'N'
        C6 45 ED 54                   mov     [ebp+var_13], 'T'
        C6 45 EE 4C                   mov     [ebp+var_12], 'L'
        C6 45 EF 4D                   mov     [ebp+var_11], 'M'
        C6 45 F0 20                   mov     [ebp+var_10], ' '
        */


    strings:
        $auth = {C6 45 D8 50 C6 45 D9 72 C6 45 DA 6F C6 45 DB 78 C6 45 DC 79 C6 45 DD 2D}
        $auth2 = {C7 45 FC 00 04 00 00 C6 45 ?? 50 C6 45 ?? 72 C6 45 ?? 6F}
        $ntlm = "NTLM" wide
    
    condition
YARA Detection Rule: VirutFileInfector
Repository: Yara-Rules/rules
Detects: Virut (unknown version) fileinfector detection
Author: D00RT <@D00RT_RM>
Reference: http://reversingminds-blog.logdown.com

Pattern signatures:
$sign = { F9 E8 22 00 00 00 ?? 31 EB 56 }
        $func = { 52 C1 E9 1D 68 31 D4 00 00 58 5A 81 C1 94 01 00 00 80 4D 00 F0 89 6C 24 04 F7 D1 81 6C 24 04 }

Detection condition:
$sign and $func

Full rule:
rule VirutFileInfector
{
	meta:
    	author = "D00RT <@D00RT_RM>"
    	data = "2017/08/04"

        description = "Virut (unknown version) fileinfector detection"
        reference = "http://reversingminds-blog.logdown.com"

        infected_sample1 = "5755f09d445a5dcab3ea92d978c7c360"
        infected_sample2 = "68e508108ed94c8c391c70ef1d15e0f8"
        infected_sample2 = "2766e8e78ee10264cf1a3f5f4a16ff00"

	strings:
    	$sign = { F9 E8 22 00 00 00 ?? 31 EB 56 }
        $func = { 52 C1 E9 1D 68 31 D4 00 00 58 5A 81 C1 94 01 00 00 80 4D 00 F0 89 6C 24 04 F7 D1 81 6C 24 04 }       
 
    condition:
    	$sign and $func
}
YARA Detection Rule: Kovter
Repository: Yara-Rules/rules
Detects: fileless malware
Reference: http://blog.airbuscybersecurity.com/post/2016/03/FILELESS-MALWARE-%E2%80%93-A-BEHAVIOURAL-ANALYSIS-OF-KOVTER-PERSISTENCE

Pattern signatures:
$type="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid="4688" wide ascii
		$data="Windows\\System32\\regsvr32.exe" wide ascii
		
		$type1="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid1="4689" wide ascii
		$data1="Windows\\System32\\mshta.exe" wide ascii
		
		$type2="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid2="4689" wide ascii
		$data2="Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" wide ascii

		$type3="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid3="4689" wide ascii
		$data3="Windows\\System32\\wbem\\WmiPrvSE.exe" wide ascii

Detection condition:
all of them

Full rule:
rule Kovter
{ 
	meta:
		maltype = "Kovter"
    reference = "http://blog.airbuscybersecurity.com/post/2016/03/FILELESS-MALWARE-%E2%80%93-A-BEHAVIOURAL-ANALYSIS-OF-KOVTER-PERSISTENCE"
		date = "9-19-2016"
		description = "fileless malware"
	strings:
		$type="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid="4688" wide ascii
		$data="Windows\\System32\\regsvr32.exe" wide ascii
		
		$type1="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid1="4689" wide ascii
		$data1="Windows\\System32\\mshta.exe" wide ascii
		
		$type2="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid2="4689" wide ascii
		$data2="Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe" wide ascii

		$type3="Microsoft-Windows-Security-Auditing" wide ascii
		$eventid3="4689" wide ascii
		$data3="Windows\\System32\\wbem\\WmiPrvSE.exe" wide ascii


	condition:
		all of them
}
YARA Detection Rule: NionSpy
Repository: Yara-Rules/rules
Detects: Triggers on old and new variants of W32/NionSpy file infector
Reference: https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector

Pattern signatures:
$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
$variant2013_string = "%s?cstorage=shell&comp=%s"

Detection condition:
uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 1 of ($variant*)

Full rule:
rule NionSpy : win32
{
meta:
description = "Triggers on old and new variants of W32/NionSpy file infector"
reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector"
strings:
$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
$variant2013_string = "%s?cstorage=shell&comp=%s"
condition:
uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and 1 of ($variant*)
}
YARA Detection Rule: Gafgyt_Botnet_generic
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$etcTZ = "/bin/busybox;echo -e 'gayfgt'"
	$s2 = "/proc/net/route"
	$s3 = "admin"
	$s4 = "root"

Detection condition:
$etcTZ and $s2 and $s3 and $s4

Full rule:
rule Gafgyt_Botnet_generic : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-01"
version = "1.0"
MD5 = "e3fac853203c3f1692af0101eaad87f1"
SHA1 = "710781e62d49419a3a73624f4a914b2ad1684c6a"

strings:
	$etcTZ = "/bin/busybox;echo -e 'gayfgt'"
	$s2 = "/proc/net/route"
	$s3 = "admin"
	$s4 = "root"

condition:
	$etcTZ and $s2 and $s3 and $s4
}
YARA Detection Rule: Gafgyt_Botnet_oh
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "busyboxterrorist"
            $s2 = "BOGOMIPS"
            $s3 = "124.105.97.%d"
            $s4 = "fucknet"

Detection condition:
$s1 and $s2 and $s3 and $s4

Full rule:
rule Gafgyt_Botnet_oh : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-025"
version = "1.0"
MD5 = "97f5edac312de349495cb4afd119d2a5"
SHA1 = "916a51f2139f11e8be6247418dca6c41591f4557"

    strings:
            $s1 = "busyboxterrorist"
            $s2 = "BOGOMIPS"
            $s3 = "124.105.97.%d"
            $s4 = "fucknet"
    condition:
            $s1 and $s2 and $s3 and $s4
}
YARA Detection Rule: Gafgyt_Botnet_bash
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "PONG!"
            $s2 = "GETLOCALIP"
            $s3 = "HTTPFLOOD"
            $s4 = "LUCKYLILDUDE"

Detection condition:
$s1 and $s2 and $s3 and $s4

Full rule:
rule Gafgyt_Botnet_bash : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-25"
version = "1.0"
MD5 = "c8d58acfe524a09d4df7ffbe4a43c429"
SHA1 = "b41fefa8470f3b3657594af18d2ea4f6ac4d567f"

    strings:
            $s1 = "PONG!"
            $s2 = "GETLOCALIP"
            $s3 = "HTTPFLOOD"
            $s4 = "LUCKYLILDUDE"
    condition:
            $s1 and $s2 and $s3 and $s4
}
YARA Detection Rule: Gafgyt_Botnet_hoho
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "PING"
            $s2 = "PRIVMSG"
            $s3 = "Remote IRC Bot"
            $s4 = "23.95.43.182"

Detection condition:
$s1 and $s2 and $s3 and $s4

Full rule:
rule Gafgyt_Botnet_hoho : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-25"
version = "1.0"
MD5 = "369c7c66224b343f624803d595aa1e09"
SHA1 = "54519d2c124cb536ed0ddad[PII_REDACTED]d90934f"

    strings:
            $s1 = "PING"
            $s2 = "PRIVMSG"
            $s3 = "Remote IRC Bot"
            $s4 = "23.95.43.182"
    condition:
            $s1 and $s2 and $s3 and $s4
}
YARA Detection Rule: Gafgyt_Botnet_jackmy
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "PING"
            $s2 = "PONG"
            $s3 = "jackmy"         
            $s4 = "203.134.%d.%d"

Detection condition:
$s1 and $s2 and $s3 and $s4

Full rule:
rule Gafgyt_Botnet_jackmy : MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-25"
version = "1.0"
MD5 = "419b8a10a3ac200e7e8a0c141b8abfba"
SHA1 = "5433a5768c5d22dabc4d133c8a1d192d525939d5"

    strings:
            $s1 = "PING"
            $s2 = "PONG"
            $s3 = "jackmy"         
            $s4 = "203.134.%d.%d"       
    condition:
            $s1 and $s2 and $s3 and $s4
}
YARA Detection Rule: Gafgyt_Botnet_HIHI
Repository: Yara-Rules/rules
Detects: Gafgyt Trojan
Author: Joan Soriano / @joanbtl

Pattern signatures:
$s1 = "PING"
            $s2 = "PONG"
            $s3 = "TELNET LOGIN CRACKED - %s:%s:%s"
            $s4 = "ADVANCEDBOT"
            $s5 = "46.166.185.92"
            $s6 = "LOLNOGTFO"

Detection condition:
$s1 and $s2 and $s3 and $s4 and $s5 and $s6

Full rule:
rule Gafgyt_Botnet_HIHI: MALW
{
meta:
description = "Gafgyt Trojan"
author = "Joan Soriano / @joanbtl"
date = "2017-05-01"
version = "1.0"
MD5 = "cc99e8dd2067fd5702a[PII_REDACTED]c8a"
SHA1 = "b9b316c1cc9f7a1bf8c70400861de08d95716e49"

    strings:
            $s1 = "PING"
            $s2 = "PONG"
            $s3 = "TELNET LOGIN CRACKED - %s:%s:%s"
            $s4 = "ADVANCEDBOT"
            $s5 = "46.166.185.92"
            $s6 = "LOLNOGTFO"

    condition:
            $s1 and $s2 and $s3 and $s4 and $s5 and $s6
}
YARA Detection Rule: apt_equation_exploitlib_mutexes
Repository: Yara-Rules/rules
Detects: Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW
Reference: http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/

Pattern signatures:
$mz="MZ"
        $a1="prkMtx" wide
        $a2="cnFormSyncExFBC" wide
        $a3="cnFormVoidFBC" wide
        $a4="cnFormSyncExFBC"
        $a5="cnFormVoidFBC"

Detection condition:
(($mz at 0) and any of ($a*))

Full rule:
rule apt_equation_exploitlib_mutexes
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
        version = "1.0"
        last_modified = "2015-02-16"
        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"

    strings:
        $mz="MZ"
        $a1="prkMtx" wide
        $a2="cnFormSyncExFBC" wide
        $a3="cnFormVoidFBC" wide
        $a4="cnFormSyncExFBC"
        $a5="cnFormVoidFBC"

    condition:
        (($mz at 0) and any of ($a*))
}
YARA Detection Rule: apt_equation_doublefantasy_genericresource
Repository: Yara-Rules/rules
Detects: Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW
Reference: http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/

Pattern signatures:
$mz="MZ"
        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
        $a2="yyyyyyyyyyyyyyyy"
        $a3="002"

Detection condition:
(($mz at 0) and all of ($a*)) and filesize < 500000

Full rule:
rule apt_equation_doublefantasy_genericresource
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect DoubleFantasy encoded config http://goo.gl/ivt8EW"
        version = "1.0"
        last_modified = "2015-02-16"
        reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"

    strings:
        $mz="MZ"
        $a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00}
        $a2="yyyyyyyyyyyyyyyy"
        $a3="002"

    condition:
        (($mz at 0) and all of ($a*)) and filesize < 500000
}
YARA Detection Rule: apt_equation_equationlaser_runtimeclasses
Repository: Yara-Rules/rules
Detects: Rule to detect the EquationLaser malware
Reference: https://securelist.com/blog/

Pattern signatures:
$a1="?a73957838_2@@YAXXZ"
        $a2="?a84884@@YAXXZ"
        $a3="?b823838_9839@@YAXXZ"
        $a4="?e747383_94@@YAXXZ"
        $a5="?e83834@@YAXXZ"
        $a6="?e929348_827@@YAXXZ"

Detection condition:
any of them

Full rule:
rule apt_equation_equationlaser_runtimeclasses
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect the EquationLaser malware"
        version = "1.0"
        last_modified = "2015-02-16"
        reference = "https://securelist.com/blog/"

    strings:
        $a1="?a73957838_2@@YAXXZ"
        $a2="?a84884@@YAXXZ"
        $a3="?b823838_9839@@YAXXZ"
        $a4="?e747383_94@@YAXXZ"
        $a5="?e83834@@YAXXZ"
        $a6="?e929348_827@@YAXXZ"

    condition:
        any of them
}
YARA Detection Rule: apt_equation_cryptotable
Repository: Yara-Rules/rules
Detects: Rule to detect the crypto library used in Equation group malware
Reference: https://securelist.com/blog/

Pattern signatures:
$a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}

Detection condition:
$a

Full rule:
rule apt_equation_cryptotable
{

    meta:
        copyright = "Kaspersky Lab"
        description = "Rule to detect the crypto library used in Equation group malware"
        version = "1.0"
        last_modified = "2015-02-16"
        reference = "https://securelist.com/blog/"

    strings:
        $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}

    condition:
        $a
}
YARA Detection Rule: Equation_Kaspersky_TripleFantasy_1
Repository: Yara-Rules/rules
Detects: Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
        $s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
        $s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
        $s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
        $s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
        $s5 = "Chrome" fullword wide
        $s6 = "StringIndex" fullword ascii
        $x1 = "itemagic.net@443" fullword wide
        $x2 = "team4heat.net@443" fullword wide
        $x5 = "62.216.152.69@443" fullword wide
        $x6 = "84.233.205.37@443" fullword wide
        $z1 = "www.microsoft.com@80" fullword wide
        $z2 = "www.google.com@80" fullword wide
        $z3 = "127.0.0.1:3128" fullword wide

Detection condition:
( $mz at 0 ) and filesize < 300000 and (( all of ($s*) and all of ($z*) ) or ( all of ($s*) and 1 of ($x*) ))

Full rule:
rule Equation_Kaspersky_TripleFantasy_1
{

    meta:
        description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"

    strings:
        $mz = { 4d 5a }
        $s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
        $s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
        $s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
        $s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
        $s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
        $s5 = "Chrome" fullword wide
        $s6 = "StringIndex" fullword ascii
        $x1 = "itemagic.net@443" fullword wide
        $x2 = "team4heat.net@443" fullword wide
        $x5 = "62.216.152.69@443" fullword wide
        $x6 = "84.233.205.37@443" fullword wide
        $z1 = "www.microsoft.com@80" fullword wide
        $z2 = "www.google.com@80" fullword wide
        $z3 = "127.0.0.1:3128" fullword wide

    condition:
        ( $mz at 0 ) and filesize < 300000 and (( all of ($s*) and all of ($z*) ) or ( all of ($s*) and 1 of ($x*) ))
}
YARA Detection Rule: Equation_Kaspersky_DoubleFantasy_1
Repository: Yara-Rules/rules
Detects: Equation Group Malware - DoubleFantasy
Author: Florian Roth
Reference: http://goo.gl/ivt8EW

Pattern signatures:
$mz = { 4d 5a }
        $z1 = "msvcp5%d.dll" fullword ascii
        $s0 = "actxprxy.GetProxyDllInfo" fullword ascii
        $s3 = "actxprxy.DllGetClassObject" fullword ascii
        $s5 = "actxprxy.DllRegisterServer" fullword ascii
        $s6 = "actxprxy.DllUnregisterServer" fullword ascii
        $x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii
        $x2 = "191H1a1" fullword ascii
        $x3 = "November " fullword ascii
        $x4 = "abababababab" fullword ascii
        $x5 = "January " fullword ascii
        $x6 = "October " fullword ascii
        $x7 = "September " fullword ascii

Detection condition:
( $mz at 0 ) and filesize < 350000 and (( $z1 ) or ( all of ($s*) and 6 of ($x*) ))

Full rule:
rule Equation_Kaspersky_DoubleFantasy_1
{

    meta:
        description = "Equation Group Malware - DoubleFantasy"
        author = "Florian Roth"
        reference = "http://goo.gl/ivt8EW"
        date = "2015/02/16"
        hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"

    strings:
        $mz = { 4d 5a }
        $z1 = "msvcp5%d.dll" fullword ascii
        $s0 = "actxprxy.GetProxyDllInfo" fullword ascii
        $s3 = "actxprxy.DllGetClassObject" fullword ascii
        $s5 = "actxprxy.DllRegisterServer" fullword ascii
        $s6 = "actxprxy.DllUnregisterServer" fullword ascii
        $x1 = "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy" ascii
        $x2 = "191H1a1" fullword ascii
        $x3 = "November " fullword ascii
        $x4 = "abababababab" fullword ascii
        $x5 = "January " fullword ascii
        $x6 = "October " fullword ascii
        $x7 = "September " fullword ascii

    condition:
        ( $mz at 0 ) and filesize < 350000 and (( $z1 ) or ( all of ($s*) and 6 of ($x*) ))
}