deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Invoke_WMIExec_Gen
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/Kevin-Robertson/Invoke-TheHash

Pattern signatures:
$s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
      $s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
      $s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii

Detection condition:
all of them

Full rule:
rule Invoke_WMIExec_Gen {
   meta:
      description = "Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
      date = "2017-06-14"
      super_rule = 1
      hash1 = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
      hash2 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
      hash3 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
      id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
   strings:
      $s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
      $s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
      $s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii
   condition:
      all of them
}
YARA Detection Rule: apt_win32_dll_rat_hiZorRAT
Repository: Neo23x0/signature-base
Reference: https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf

Pattern signatures:
// Part of the encoded User-Agent = Mozilla
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }

		// XOR to decode User-Agent after string stacking 0x10001630
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }

		// XOR with 0x2E - 0x10002EF6
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }

		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii

Detection condition:
(uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and (all of them)

Full rule:
rule apt_win32_dll_rat_hiZorRAT
{
	meta:
      dexcription = "Detects hiZor RAT"
		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
		hash2 = "d[PII_REDACTED]ccd3b9ea03161566ef18e"
		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
      ref1 = "http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html"
      reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
      id = "06fd02f2-2630-5aac-8011-67d67ff42c3f"
	strings:
		// Part of the encoded User-Agent = Mozilla
		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }

		// XOR to decode User-Agent after string stacking 0x10001630
		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }

		// XOR with 0x2E - 0x10002EF6
		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }

		$s4 = "CmdProcessExited" wide ascii
		$s5 = "rootDir" wide ascii
		$s6 = "DllRegisterServer" wide ascii
		$s7 = "GetNativeSystemInfo" wide ascii
		$s8 = "%08x%08x%08x%08x" wide ascii
	condition:
		(uint16(0) == 0x5A4D or uint32(0) == 0x464c457f) and (all of them)
}
YARA Detection Rule: SUSP_PS1_JAB_Pattern_Jun22_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
/* 
         with spaces : $c = $ 
         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHAgPSAkRW52OnRlbQokeCA9ICRteXZhcjsKJHggPSBJbnZva2Ut
      */
      /* ASCII */ 
      $xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
      /* UTF-16 encoded */
      $xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
      /* 
         without spaces : $c=$ 
         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHA9JEVudjp0ZW0KJHg9JG15dmFyOwokeD1JbnZva2Ut
      */
      /* ASCII */ 
      $xc3 = { 4a 41 42 ?? 41 44 30 41 }
      /* UTF-16 encoded */
      $xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }

Detection condition:
filesize < 30MB and 1 of them

Full rule:
rule SUSP_PS1_JAB_Pattern_Jun22_1 {
   meta:
      description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2022-06-10"
      score= 70
      id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"
   strings:
      /* 
         with spaces : $c = $ 
         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHAgPSAkRW52OnRlbQokeCA9ICRteXZhcjsKJHggPSBJbnZva2Ut
      */
      /* ASCII */ 
      $xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
      /* UTF-16 encoded */
      $xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
      /* 
         without spaces : $c=$ 
         https://gchq.github.io/CyberChef/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Encode_text('UTF-16LE%20(1200)')To_Base64('A-Za-z0-9%2B/%3D')Encode_text('UTF-16LE%20(1200)'/disabled)To_Hex('Space',0)&input=JHA9JEVudjp0ZW0KJHg9JG15dmFyOwokeD1JbnZva2Ut
      */
      /* ASCII */ 
      $xc3 = { 4a 41 42 ?? 41 44 30 41 }
      /* UTF-16 encoded */
      $xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
   condition:
      filesize < 30MB and 1 of them
}
YARA Detection Rule: MAL_WIN_Ralordv1_Apr25
Repository: Neo23x0/signature-base
Detects: This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware
Author: 0x0d4y-Icaro Cesar
Reference: https://ish.com.br/wp-content/uploads/2025/04/RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf

Pattern signatures:
$code_pattern_quarterround = { 4? 31 ?? 48 8b ?? ?? ?? 4? 31 ?? 48 8b ?? ?? ?? 31 e8 4? 31 ?? 41 c1 ?? 0c c1 ?? 0c c1 ?? 0c 48 89 c2 c1 ?? 0c }
        $code_pattern_custom_alg = { 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 48 83 c0 08 48 3d 8? }
        $ralord_str_I = "chacha" ascii
        $ralord_str_II = "scorp" ascii
        $ralord_str_III = "RALord" ascii
        $ralord_str_IV = "onion" ascii
        $ralord_str_V = "/rust" ascii
        $ralord_str_VI = "BCryptGenRandom" ascii

Detection condition:
uint16(0) == 0x5a4d and
        all of ($code_pattern_*) and
        4 of ($ralord_str_*)

Full rule:
rule MAL_WIN_Ralordv1_Apr25 {
    meta:
        description = "This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware"
        author = "0x0d4y-Icaro Cesar"
        date = "2025-04-01"
        score = 80
        reference = "https://ish.com.br/wp-content/uploads/2025/04/RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf"
        hash = "BE15F62D14D1CBE2AECCE8396F4C6289"
        uuid = "[PII_REDACTED]-9806-8b2e26c8f66a"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        rule_matching_tlp = "TLP:WHITE"
        rule_sharing_tlp = "TLP:WHITE"
        malpedia_family = "win.ralord"

    strings:
        $code_pattern_quarterround = { 4? 31 ?? 48 8b ?? ?? ?? 4? 31 ?? 48 8b ?? ?? ?? 31 e8 4? 31 ?? 41 c1 ?? 0c c1 ?? 0c c1 ?? 0c 48 89 c2 c1 ?? 0c }
        $code_pattern_custom_alg = { 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 48 83 c0 08 48 3d 8? }
        $ralord_str_I = "chacha" ascii
        $ralord_str_II = "scorp" ascii
        $ralord_str_III = "RALord" ascii
        $ralord_str_IV = "onion" ascii
        $ralord_str_V = "/rust" ascii
        $ralord_str_VI = "BCryptGenRandom" ascii

    condition:
        uint16(0) == 0x5a4d and
        all of ($code_pattern_*) and
        4 of ($ralord_str_*)
}
YARA Detection Rule: Emdivi_SFX
Repository: Neo23x0/signature-base
Detects: Detects Emdivi malware in SFX Archive
Author: Florian Roth (Nextron Systems) @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "Setup=unsecess.exe" fullword ascii
		$x2 = "Setup=leassnp.exe" fullword ascii

		$s1 = "&Enter password for the encrypted file:" fullword wide
		$s2 = ";The comment below contains SFX script commands" fullword ascii
		$s3 = "Path=%temp%" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))

Full rule:
rule Emdivi_SFX {
	meta:
		description = "Detects Emdivi malware in SFX Archive"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		score = 70
		hash1 = "7a3c81b2b3c14b9cd[PII_REDACTED]19887b607c54152b348d6d3ccd3ecfd406196"
		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
		id = "51367190-2e8d-507c-a19f-996bc6960977"
	strings:
		$x1 = "Setup=unsecess.exe" fullword ascii
		$x2 = "Setup=leassnp.exe" fullword ascii

		$s1 = "&Enter password for the encrypted file:" fullword wide
		$s2 = ";The comment below contains SFX script commands" fullword ascii
		$s3 = "Path=%temp%" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 740KB and (1 of ($x*) and all of ($s*))
}
YARA Detection Rule: Emdivi_Gen1
Repository: Neo23x0/signature-base
Detects: Detects Emdivi Malware
Author: Florian Roth (Nextron Systems) @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
		$x3 = "userControl-v80.exe" fullword ascii

		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
		$s2 = "http://www.msftncsi.com" fullword wide
		$s3 = "net use | find /i \"c$\"" fullword wide
		$s4 = " /del /y & " fullword wide
		$s5 = "\\auto.cfg" wide
		$s6 = "/ncsi.txt" fullword wide
		$s7 = "Dcmd /c" fullword wide
		$s8 = "/PROXY" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and all of them

Full rule:
rule Emdivi_Gen1 {
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		score = 80
		super_rule = 1
		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
		id = "807cf3f9-4f58-5d22-88b2-9adb7866979f"
	strings:
		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
		$x3 = "userControl-v80.exe" fullword ascii

		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
		$s2 = "http://www.msftncsi.com" fullword wide
		$s3 = "net use | find /i \"c$\"" fullword wide
		$s4 = " /del /y & " fullword wide
		$s5 = "\\auto.cfg" wide
		$s6 = "/ncsi.txt" fullword wide
		$s7 = "Dcmd /c" fullword wide
		$s8 = "/PROXY" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and all of them
}
YARA Detection Rule: Emdivi_Gen2
Repository: Neo23x0/signature-base
Detects: Detects Emdivi Malware
Author: Florian Roth (Nextron Systems) @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$s1 = "%TEMP%\\IELogs\\" ascii
		$s2 = "MSPUB.EXE" fullword ascii
		$s3 = "%temp%\\" ascii
		$s4 = "\\NOTEPAD.EXE" ascii
		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them

Full rule:
rule Emdivi_Gen2 {
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		modified = "2023-01-27"
		super_rule = 1
		score = 80
		hash1 = "9a351885bf5f6fec466f[PII_REDACTED]4d96e9db10309622ed[PII_REDACTED]7add1"
		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
		id = "9a77c85c-84b0-5e0f-93bc-e17e2aaec095"
	strings:
		$s1 = "%TEMP%\\IELogs\\" ascii
		$s2 = "MSPUB.EXE" fullword ascii
		$s3 = "%temp%\\" ascii
		$s4 = "\\NOTEPAD.EXE" ascii
		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 1300KB and 6 of them
}
YARA Detection Rule: MAL_Emdivi_Gen3
Repository: Neo23x0/signature-base
Detects: Detects Emdivi Malware
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii

      $s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
      $s4 = "\\auto.cfg" ascii
      $s5 = "/ncsi.txt" fullword ascii
      $s6 = "/en-us/default.aspx" fullword ascii
      $s7 = "cmd /c" fullword ascii
      $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */

Detection condition:
uint16(0) == 0x5a4d and filesize < 850KB and
      (
         ( $x1 and 1 of ($s*) ) or
         ( 4 of ($s*) )
      )

Full rule:
rule MAL_Emdivi_Gen3 {
   meta:
      description = "Detects Emdivi Malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
      date = "2015-08-20"
      modified = "2023-01-06"
      super_rule = 1
      score = 80
      hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c[PII_REDACTED]e"
      hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
      id = "c3d712ae-3f8e-578c-81cd-fd3e48213875"
   strings:
      $x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii

      $s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
      $s4 = "\\auto.cfg" ascii
      $s5 = "/ncsi.txt" fullword ascii
      $s6 = "/en-us/default.aspx" fullword ascii
      $s7 = "cmd /c" fullword ascii
      $s9 = "APPDATA" fullword ascii /* Goodware String - occured 25 times */
   condition:
      uint16(0) == 0x5a4d and filesize < 850KB and
      (
         ( $x1 and 1 of ($s*) ) or
         ( 4 of ($s*) )
      )
}
YARA Detection Rule: Emdivi_Gen4
Repository: Neo23x0/signature-base
Detects: Detects Emdivi Malware
Author: Florian Roth (Nextron Systems) @Cyber0ps
Reference: https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/

Pattern signatures:
$s1 = ".http_port\", " fullword wide
		$s2 = "UserAgent: " fullword ascii
		$s3 = "AUTH FAILED" fullword ascii
		$s4 = "INVALID FILE PATH" fullword ascii
		$s5 = ".autoconfig_url\", \"" fullword wide
		$s6 = "FAILED TO WRITE FILE" fullword ascii
		$s7 = ".proxy" fullword wide
		$s8 = "AuthType: " fullword ascii
		$s9 = ".no_proxies_on\", \"" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 853KB and all of them

Full rule:
rule Emdivi_Gen4 {
	meta:
		description = "Detects Emdivi Malware"
		author = "Florian Roth (Nextron Systems) @Cyber0ps"
		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
		date = "2015-08-20"
		super_rule = 1
		score = 80
		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c[PII_REDACTED]e"
		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
		id = "02629873-a797-51ff-83fc-af499cafa1e8"
	strings:
		$s1 = ".http_port\", " fullword wide
		$s2 = "UserAgent: " fullword ascii
		$s3 = "AUTH FAILED" fullword ascii
		$s4 = "INVALID FILE PATH" fullword ascii
		$s5 = ".autoconfig_url\", \"" fullword wide
		$s6 = "FAILED TO WRITE FILE" fullword ascii
		$s7 = ".proxy" fullword wide
		$s8 = "AuthType: " fullword ascii
		$s9 = ".no_proxies_on\", \"" fullword wide
	condition:
		uint16(0) == 0x5a4d and filesize < 853KB and all of them
}
YARA Detection Rule: MAL_Neshta_Generic
Repository: Neo23x0/signature-base
Detects: Detects Neshta malware
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "the best. Fuck off all the rest."
      $x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii

      $s1 = "Neshta" ascii fullword
      $s2 = "Made in Belarus. " ascii fullword

      $op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
      $op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
      $op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }

      $sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
      $sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         1 of ($x*) or 
         all of ($s*) or 
         3 of them or 
         pe.imphash() == "9f4693fc0c[PII_REDACTED]93f2161d1e86"
      )

Full rule:
rule MAL_Neshta_Generic : HIGHVOL {
   meta:
      description = "Detects Neshta malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2018-01-15"
      modified = "2021-04-14"
      hash1 = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
      hash1 = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
      hash2 = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
      hash3 = "1954e06fc952a5a0328774aaf07c23970efd[PII_REDACTED]076c061dffb09a7eb"
      id = "9a3b8369-7e19-5c21-9eba-0bb81507696a"
   strings:
      $x1 = "the best. Fuck off all the rest."
      $x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii

      $s1 = "Neshta" ascii fullword
      $s2 = "Made in Belarus. " ascii fullword

      $op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
      $op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
      $op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }

      $sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
      $sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 3000KB and (
         1 of ($x*) or 
         all of ($s*) or 
         3 of them or 
         pe.imphash() == "9f4693fc0c[PII_REDACTED]93f2161d1e86"
      )
}
YARA Detection Rule: HawkEye_Keylogger_Feb18_1
Repository: Neo23x0/signature-base
Detects: Semiautomatically generated YARA rule
Author: Florian Roth (Nextron Systems)
Reference: https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9

Pattern signatures:
$s1 = "UploadReportLogin.asmx" fullword wide
      $s2 = "tmp.exe" fullword wide
      $s3 = "%appdata%\\" wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule HawkEye_Keylogger_Feb18_1 {
   meta:
      description = "Semiautomatically generated YARA rule"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
      date = "2018-02-12"
      modified = "2023-01-06"
      score = 90
      hash1 = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
      id = "6b4b447f-43d6-5774-a1b9-d53b40364732"
   strings:
      $s1 = "UploadReportLogin.asmx" fullword wide
      $s2 = "tmp.exe" fullword wide
      $s3 = "%appdata%\\" wide
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: MAL_HawkEye_Keylogger_Gen_Dec18
Repository: Neo23x0/signature-base
Detects: Detects HawkEye Keylogger Reborn
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/James_inthe_box/status/[PII_REDACTED]52324870

Pattern signatures:
$s1 = "HawkEye Keylogger" fullword wide
      $s2 = "_ScreenshotLogger" ascii
      $s3 = "_PasswordStealer" ascii

Detection condition:
2 of them

Full rule:
rule MAL_HawkEye_Keylogger_Gen_Dec18 {
   meta:
      description = "Detects HawkEye Keylogger Reborn"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/James_inthe_box/status/[PII_REDACTED]52324870"
      date = "2018-12-10"
      hash1 = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
      id = "1d06f364-a4e2-5632-ad3a-d53a8cddf072"
   strings:
      $s1 = "HawkEye Keylogger" fullword wide
      $s2 = "_ScreenshotLogger" ascii
      $s3 = "_PasswordStealer" ascii
   condition:
      2 of them
}
YARA Detection Rule: APT_MAL_BKA_GoldenSpy_Aug20_1
Repository: Neo23x0/signature-base
Detects: Detects variants of GoldenSpy Malware
Author: BKA
Reference: https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html

Pattern signatures:
$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
		$str02 = "Ryeol HTTP Client Class" ascii
		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
		$str05 = "svmm" ascii
		$str06 = "PROTOCOL_" ascii
		$str07 = "softList" ascii
		$str08 = "excuteExe" ascii

Detection condition:
uint16(0) == 0x5A4D and 5 of ($str*)

Full rule:
rule APT_MAL_BKA_GoldenSpy_Aug20_1 {
	meta:
		description = "Detects variants of GoldenSpy Malware"
        reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
        author = "BKA"
        date = "2020-08-21"
		id = "4f47087e-6e68-53ff-9446-72a1751da359"
	strings:
		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
		$str02 = "Ryeol HTTP Client Class" ascii
		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
		$str05 = "svmm" ascii
		$str06 = "PROTOCOL_" ascii
		$str07 = "softList" ascii
		$str08 = "excuteExe" ascii
	condition:
	 	uint16(0) == 0x5A4D and 5 of ($str*)
}