deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: qti_certificate
Repository: Yara-Rules/rules
Detects: detects binaries signed with the QTI International Inc certificate
Author: Fireeye Labs
Reference: https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html

Pattern signatures:
$cn = "QTI International Inc"
        $serial = { 2e df b9 fd cf a0 0c cb 5a b0 09 ee 3a db 97 b9 }

Detection condition:
$cn and $serial

Full rule:
rule qti_certificate
{
    meta:
        Author      = "Fireeye Labs"
        Date        = "2014/11/03" 
        Description = "detects binaries signed with the QTI International Inc certificate"
        Reference   = "https://www.fireeye.com/blog/threat-research/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html"

    strings:
        $cn = "QTI International Inc"
        $serial = { 2e df b9 fd cf a0 0c cb 5a b0 09 ee 3a db 97 b9 }

    condition:
        $cn and $serial
}
YARA Detection Rule: CVE_2015_1674_CNGSYS
Repository: Yara-Rules/rules
Detects: Detects exploits for CVE-2015-1674
Author: Florian Roth
Reference: http://www.binvul.com/viewthread.php?tid=508

Pattern signatures:
$s1 = "\\Device\\CNG" fullword wide
		
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "LoadLibrary" ascii
		$s4 = "KERNEL32.dll" fullword ascii
		$s5 = "ntdll.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and all of them

Full rule:
rule CVE_2015_1674_CNGSYS {
	meta:
		description = "Detects exploits for CVE-2015-1674"
		author = "Florian Roth"
		reference = "http://www.binvul.com/viewthread.php?tid=508"
		reference2 = "https://github.com/Neo23x0/Loki/blob/master/signatures/exploit_cve_2015_1674.yar"
		date = "2015-05-14"
		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
	strings:
		$s1 = "\\Device\\CNG" fullword wide
		
		$s2 = "GetProcAddress" fullword ascii
		$s3 = "LoadLibrary" ascii
		$s4 = "KERNEL32.dll" fullword ascii
		$s5 = "ntdll.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and all of them
}
YARA Detection Rule: Pandora
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$a = "Can't get the Windows version"
		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
		$c = "JPEG error #%d" wide
		$d = "Cannot assign a %s to a %s" wide
		$g = "%s, ProgID:"
		$h = "clave"
		$i = "Shell_TrayWnd"
		$j = "melt.bat"
		$k = "\\StubPath"
		$l = "\\logs.dat"
		$m = "1027|Operation has been canceled!"
		$n = "466|You need to plug-in! Double click to install... |"
		$0 = "33|[Keylogger Not Activated!]"

Detection condition:
all of them

Full rule:
rule Pandora
{
	meta:
		author = " Kevin Breen <kevin@techanarchy.net>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/Pandora"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "Can't get the Windows version"
		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
		$c = "JPEG error #%d" wide
		$d = "Cannot assign a %s to a %s" wide
		$g = "%s, ProgID:"
		$h = "clave"
		$i = "Shell_TrayWnd"
		$j = "melt.bat"
		$k = "\\StubPath"
		$l = "\\logs.dat"
		$m = "1027|Operation has been canceled!"
		$n = "466|You need to plug-in! Double click to install... |"
		$0 = "33|[Keylogger Not Activated!]"

	condition:
		all of them
}
YARA Detection Rule: Base64_encoded_Executable
Repository: Yara-Rules/rules
Detects: Detects an base64 encoded executable (often embedded)
Author: Florian Roth

Pattern signatures:
$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive

Detection condition:
1 of them

Full rule:
rule Base64_encoded_Executable {
	meta:
		description = "Detects an base64 encoded executable (often embedded)"
		author = "Florian Roth"
		date = "2015-05-28"
		score = 50
	strings:
		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" // 14 samples in goodware archive
		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" // 26 samples in goodware archive
		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" // 75 samples in goodware archive
		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" // 168 samples in goodware archive
		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" // 28,529 samples in goodware archive
	condition:
		1 of them
}
YARA Detection Rule: CredStealESY
Repository: Yara-Rules/rules
Detects: Generic Rule to detect the CredStealer Malware
Author: IsecG – McAfee Labs

Pattern signatures:
$my_hex_string = "CurrentControlSet\\Control\\Keyboard Layouts\\" wide //malware trying to get keyboard layout
$my_hex_string2 = {89 45 E8 3B 7D E8 7C 0F 8B 45 E8 05 FF 00 00 00 2B C7 89 45 E8} //specific decryption module

Detection condition:
$my_hex_string and $my_hex_string2

Full rule:
rule CredStealESY : For CredStealer
{
 meta:
description = "Generic Rule to detect the CredStealer Malware"
author = "IsecG – McAfee Labs"
date = "2015/05/08"
strings:
$my_hex_string = "CurrentControlSet\\Control\\Keyboard Layouts\\" wide //malware trying to get keyboard layout
$my_hex_string2 = {89 45 E8 3B 7D E8 7C 0F 8B 45 E8 05 FF 00 00 00 2B C7 89 45 E8} //specific decryption module
 condition:
$my_hex_string and $my_hex_string2
}
YARA Detection Rule: Typical_Malware_String_Transforms
Repository: Yara-Rules/rules
Detects: Detects typical strings in a reversed or otherwise modified form
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
/* Executables */
		$e1 = "exe.tsohcvs" fullword ascii
		$e2 = "exe.ssasl" fullword ascii
		$e3 = "exe.rerolpxe" fullword ascii
		$e4 = "exe.erolpxei" fullword ascii
		$e5 = "exe.23lldnur" fullword ascii
		$e6 = "exe.dmc" fullword ascii
		$e7 = "exe.llikksat" fullword ascii

		/* Libraries */
		$l1 = "lld.23lenreK" fullword ascii
		$l2 = "lld.ESABLENREK" fullword ascii
		$l3 = "lld.esabtpyrc" fullword ascii
		$l4 = "lld.trcvsm" fullword ascii
		$l5 = "LLD.LLDTN" fullword ascii

		/* Imports */
		$i1 = "paeHssecorPteG" fullword ascii
		$i2 = "sserddAcorPteG" fullword ascii
		$i3 = "AyrarbiLdaoL" fullword ascii

		/* Registry */
		$r1 = "teSlortnoCtnerruC" fullword ascii
		$r2 = "nuR\\noisreVtnerruC" fullword ascii

		/* Folders */
		$f1 = "\\23metsys\\" ascii
		$f2 = "\\23metsyS\\" ascii
		$f3 = "niB.elcyceR$" fullword ascii
		$f4 = "%tooRmetsyS%" fullword ascii

		/* False Positives */
		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )

Full rule:
rule Typical_Malware_String_Transforms {
	meta:
		description = "Detects typical strings in a reversed or otherwise modified form"
		author = "Florian Roth"
		reference = "Internal Research"
		date = "2016-07-31"
		score = 60
	strings:
		/* Executables */
		$e1 = "exe.tsohcvs" fullword ascii
		$e2 = "exe.ssasl" fullword ascii
		$e3 = "exe.rerolpxe" fullword ascii
		$e4 = "exe.erolpxei" fullword ascii
		$e5 = "exe.23lldnur" fullword ascii
		$e6 = "exe.dmc" fullword ascii
		$e7 = "exe.llikksat" fullword ascii

		/* Libraries */
		$l1 = "lld.23lenreK" fullword ascii
		$l2 = "lld.ESABLENREK" fullword ascii
		$l3 = "lld.esabtpyrc" fullword ascii
		$l4 = "lld.trcvsm" fullword ascii
		$l5 = "LLD.LLDTN" fullword ascii

		/* Imports */
		$i1 = "paeHssecorPteG" fullword ascii
		$i2 = "sserddAcorPteG" fullword ascii
		$i3 = "AyrarbiLdaoL" fullword ascii

		/* Registry */
		$r1 = "teSlortnoCtnerruC" fullword ascii
		$r2 = "nuR\\noisreVtnerruC" fullword ascii

		/* Folders */
		$f1 = "\\23metsys\\" ascii
		$f2 = "\\23metsyS\\" ascii
		$f3 = "niB.elcyceR$" fullword ascii
		$f4 = "%tooRmetsyS%" fullword ascii

		/* False Positives */
		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
	condition:
		( uint16(0) == 0x5a4d and 1 of them and not 1 of ($fp*) )
}
YARA Detection Rule: Invoke_mimikittenz
Repository: Yara-Rules/rules
Detects: Detects Mimikittenz - file Invoke-mimikittenz.ps1
Author: Florian Roth
Reference: https://github.com/putterpanda/mimikittenz

Pattern signatures:
$x1 = "[mimikittenz.MemProcInspector]" ascii

		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii

Detection condition:
( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1

Full rule:
rule Invoke_mimikittenz {
	meta:
		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
		author = "Florian Roth"
		reference = "https://github.com/putterpanda/mimikittenz"
		date = "2016-07-19"
		score = 90
		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
	strings:
		$x1 = "[mimikittenz.MemProcInspector]" ascii

		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
	condition:
		( uint16(0) == 0x7566 and filesize < 60KB and 2 of them ) or $x1
}
YARA Detection Rule: Dubnium_Sample_1
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
        $key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule Dubnium_Sample_1
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"

    strings:
        $key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
        $key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_2
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$x1 = ":*:::D:\\:c:~:" fullword ascii
        $s2 = "SPMUVR" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Dubnium_Sample_2
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"

    strings:
        $x1 = ":*:::D:\\:c:~:" fullword ascii
        $s2 = "SPMUVR" fullword ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: Dubnium_Sample_3
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
        $x2 = "del /f \"%s\" " fullword ascii
        $s1 = "del /f /ah \"%s\" " fullword ascii
        $s2 = "if exist \"%s\" goto Rept " fullword ascii
        $s3 = "\\*.*.lnk" fullword ascii
        $s4 = "Dropped" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them

Full rule:
rule Dubnium_Sample_3
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
        hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
        hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"

    strings:
        $x1 = "copy /y \"%s\" \"%s\" " fullword ascii
        $x2 = "del /f \"%s\" " fullword ascii
        $s1 = "del /f /ah \"%s\" " fullword ascii
        $s2 = "if exist \"%s\" goto Rept " fullword ascii
        $s3 = "\\*.*.lnk" fullword ascii
        $s4 = "Dropped" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 2000KB and 5 of them
}
YARA Detection Rule: Dubnium_Sample_5
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
        $s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_5
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        super_rule = 1
        hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
        hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
        hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
        hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
        hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
        hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
        hash7 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
        hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
        hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"

    strings:
        $s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
        $s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_6
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
        $s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
        $s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 4000KB and all of them

Full rule:
rule Dubnium_Sample_6
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        super_rule = 1
        hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
        hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
        hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"

    strings:
        $s1 = "[PII_REDACTED]abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
        $s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
        $s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 4000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_7
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
        $s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_7
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        super_rule = 1
        hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
        hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
        hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
        hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
        hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
        hash6 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
        hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
        hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"

    strings:
        $s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
        $s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Dubnium_Sample_SSHOpenSSL
Repository: Yara-Rules/rules
Detects: Detects sample mentioned in the Dubnium Report
Author: Florian Roth
Reference: https://goo.gl/AW9Cuu

Pattern signatures:
$s1 = "sshkeypairgen.exe" fullword wide
        $s2 = "OpenSSL: FATAL" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 9000KB and all of them

Full rule:
rule Dubnium_Sample_SSHOpenSSL
{

    meta:
        description = "Detects sample mentioned in the Dubnium Report"
        author = "Florian Roth"
        reference = "https://goo.gl/AW9Cuu"
        date = "2016-06-10"
        hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
        hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
        hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
        hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
        hash5 = "a25715108d[PII_REDACTED]879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
        hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"

    strings:
        $s1 = "sshkeypairgen.exe" fullword wide
        $s2 = "OpenSSL: FATAL" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 9000KB and all of them
}
YARA Detection Rule: Zegost
Repository: Yara-Rules/rules
Detects: Zegost Trojan
Author: Kevin Falcoz

Pattern signatures:
$signature1={39 2F 66 33 30 4C 69 35 75 62 4F 35 44 4E 41 44 44 78 47 38 73 37 36 32 74 71 59 3D}
		$signature2={00 BA DA 22 51 42 6F 6D 65 00}

Detection condition:
$signature1 and $signature2

Full rule:
rule Zegost : Trojan
{
	meta:
		author="Kevin Falcoz"
		date="10/06/2013"
		description="Zegost Trojan"
		
	strings:
		$signature1={39 2F 66 33 30 4C 69 35 75 62 4F 35 44 4E 41 44 44 78 47 38 73 37 36 32 74 71 59 3D}
		$signature2={00 BA DA 22 51 42 6F 6D 65 00}
		
	condition:
		$signature1 and $signature2
}
YARA Detection Rule: StuxNet_Malware_1
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file malware.exe
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
// 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
         // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
         // 0x10001780 33 c9     xor     ecx, ecx
         // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
         // 0x10001785 89 02     mov     dword ptr [edx], eax
         // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
         $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
         // 0x10002045 74 36     je      0x1000207d
         // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
         // 0x1000204a 83 ff 00  cmp     edi, 0
         // 0x1000204d 74 2e     je      0x1000207d
         // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
         // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
         $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
         // 0x100020cf 74 70     je      0x10002141
         // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
         // 0

Detection condition:
all of them

Full rule:
rule StuxNet_Malware_1 
{

    meta:
        description = "Stuxnet Sample - file malware.exe"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
    
    strings:
         // 0x10001778 8b 45 08  mov     eax, dword ptr [ebp + 8]
         // 0x1000177b 35 dd 79 19 ae    xor     eax, 0xae1979dd
         // 0x10001780 33 c9     xor     ecx, ecx
         // 0x10001782 8b 55 08  mov     edx, dword ptr [ebp + 8]
         // 0x10001785 89 02     mov     dword ptr [edx], eax
         // 0x10001787 89 ?? ??  mov     dword ptr [edx + 4], ecx
         $op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
         // 0x10002045 74 36     je      0x1000207d
         // 0x10002047 8b 7f 08  mov     edi, dword ptr [edi + 8]
         // 0x1000204a 83 ff 00  cmp     edi, 0
         // 0x1000204d 74 2e     je      0x1000207d
         // 0x1000204f 0f b7 1f  movzx   ebx, word ptr [edi]
         // 0x10002052 8b 7f 04  mov     edi, dword ptr [edi + 4]
         $op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
         // 0x100020cf 74 70     je      0x10002141
         // 0x100020d1 81 78 05 8d 54 24 04      cmp     dword ptr [eax + 5], 0x424548d
         // 0x100020d8 75 1b     jne     0x100020f5
         // 0x100020da 81 78 08 04 cd ?? ??      cmp     dword ptr [eax + 8], 0xc22ecd04
         $op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
  
    condition:
        all of them
}
YARA Detection Rule: Stuxnet_Malware_2
Repository: Yara-Rules/rules
Detects: Stuxnet Sample - file 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802
Author: Florian Roth
Reference: Internal Research

Pattern signatures:
$s1 = "\\SystemRoot\\System32\\hal.dll" fullword wide
        $s2 = "http://www.jmicron.co.tw0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 70KB and all of them

Full rule:
rule Stuxnet_Malware_2 
{
   
    meta:
        description = "Stuxnet Sample - file 63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
        author = "Florian Roth"
        reference = "Internal Research"
        date = "2016-07-09"
        hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
   
    strings:
        $s1 = "\\SystemRoot\\System32\\hal.dll" fullword wide
        $s2 = "http://www.jmicron.co.tw0" fullword ascii
   
    condition:
        uint16(0) == 0x5a4d and filesize < 70KB and all of them
}