deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Ransom_CryptXXX_Real
Repository: Yara-Rules/rules
Detects: Regla para detectar Ransom.CryptXXX original
Author: CCN-CERT

Pattern signatures:
$a = { 52 59 47 40 4A 41 59 5D 52 00 00 00 FF FF FF FF }
		$b = { 06 00 00 00 52 59 47 40 40 5A 00 00 FF FF FF FF }
		$c = { 0A 00 00 00 52 5C 4B 4D 57 4D 42 4B 5C 52 00 00 }
		$d = { FF FF FF FF 0A 00 00 00 52 5D 57 5D 5A 4B 43 70 }
		$e = { 3F 52 00 00 FF FF FF FF 06 00 00 00 52 4C 41 41 }
		$f = { 5A 52 00 00 FF FF FF FF 0A 00 00 00 52 5C 4B 4D }
		$g = { 41 58 4B 5C 57 52 00 00 FF FF FF FF 0E 00 00 00 }
		$h = { 52 2A 5C 4B 4D 57 4D 42 4B 20 4C 47 40 52 00 00 }
		$i = { FF FF FF FF 0A 00 00 00 52 5E 4B 5C 48 42 41 49 }
		$j = { 5D 52 00 00 FF FF FF FF 05 00 00 00 52 4B 48 47 }
		$k = { 52 00 00 00 FF FF FF FF 0C 00 00 00 52 4D 41 40 }
		$l = { 48 47 49 20 43 5D 47 52 00 00 00 00 FF FF FF FF }
		$m = { 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 3F 52 00 00 }
		$n = { FF FF FF FF 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 }
		$o = { 3C 52 00 00 FF FF FF FF 08 00 00 00 52 49 41 41 }
		$p = { 49 42 4B 52 00 00 00 00 FF FF FF FF 06 00 00 00 }
		$q = { 52 5A 4B 43 5E 52 00 00 FF FF FF FF 08 00 00 00 }

Detection condition:
all of them

Full rule:
rule Ransom_CryptXXX_Real
{
    /*
      Regla para detectar el codigo Ransom.CryptXXX fuera del dropper con MD5 ae06248ab3c02e1c2ca9d53b9a155199
    */
    meta:
        description = "Regla para detectar Ransom.CryptXXX original"
        author      = "CCN-CERT"
        version     = "1.0"
        ref = "https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/4002-publicado-el-informe-del-codigo-danino-ransom-cryptxxx.html"
    strings:
        $a = { 52 59 47 40 4A 41 59 5D 52 00 00 00 FF FF FF FF }
		$b = { 06 00 00 00 52 59 47 40 40 5A 00 00 FF FF FF FF }
		$c = { 0A 00 00 00 52 5C 4B 4D 57 4D 42 4B 5C 52 00 00 }
		$d = { FF FF FF FF 0A 00 00 00 52 5D 57 5D 5A 4B 43 70 }
		$e = { 3F 52 00 00 FF FF FF FF 06 00 00 00 52 4C 41 41 }
		$f = { 5A 52 00 00 FF FF FF FF 0A 00 00 00 52 5C 4B 4D }
		$g = { 41 58 4B 5C 57 52 00 00 FF FF FF FF 0E 00 00 00 }
		$h = { 52 2A 5C 4B 4D 57 4D 42 4B 20 4C 47 40 52 00 00 }
		$i = { FF FF FF FF 0A 00 00 00 52 5E 4B 5C 48 42 41 49 }
		$j = { 5D 52 00 00 FF FF FF FF 05 00 00 00 52 4B 48 47 }
		$k = { 52 00 00 00 FF FF FF FF 0C 00 00 00 52 4D 41 40 }
		$l = { 48 47 49 20 43 5D 47 52 00 00 00 00 FF FF FF FF }
		$m = { 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 3F 52 00 00 }
		$n = { FF FF FF FF 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 }
		$o = { 3C 52 00 00 FF FF FF FF 08 00 00 00 52 49 41 41 }
		$p = { 49 42 4B 52 00 00 00 00 FF FF FF FF 06 00 00 00 }
		$q = { 52 5A 4B 43 5E 52 00 00 FF FF FF FF 08 00 00 00 }
		$v = { 52 48 3A 4C 4D 70 3F 52 00 00 00 00 FF FF FF FF }
		$w = { 0A 00 00 00 52 4F 42 42 5B 5D 4B 70 3F 52 00 00 }
		$x = { FF FF FF FF 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 }
		$y = { 3F 52 00 00 FF FF FF FF 0A 00 00 00 52 5E 5C 41 }
		$z = { 49 5C 4F 70 3C 52 00 00 FF FF FF FF 09 00 00 00 }
		$aa = { 52 4F 5E 5E 4A 4F 5A 4F 52 00 00 00 FF FF FF FF }
		$ab = { 0A 00 00 00 52 5E 5C 41 49 5C 4F 70 3D 52 00 00 }
		$ac = { FF FF FF FF 08 00 00 00 52 5E 5B 4C 42 47 4D 52 }
		
    condition:
        all of them
}
YARA Detection Rule: LuckyCatCode
Repository: Yara-Rules/rules
Detects: LuckyCat code tricks
Author: Seth Hardy

Pattern signatures:
$xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
        $commonletters = { B? 63 B? 61 B? 73 B? 65 }

Detection condition:
$xordecrypt or ($dll and $commonletters)

Full rule:
rule LuckyCatCode : LuckyCat Family 
{
    meta:
        description = "LuckyCat code tricks"
        author = "Seth Hardy"
        last_modified = "2014-06-19"
        
    strings:
        $xordecrypt = { BF 0F 00 00 00 F7 F7 ?? ?? ?? ?? 32 14 39 80 F2 7B }
        $dll = { C6 ?? ?? ?? 64 C6 ?? ?? ?? 6C C6 ?? ?? ?? 6C }
        $commonletters = { B? 63 B? 61 B? 73 B? 65 }
        
    condition:
        $xordecrypt or ($dll and $commonletters)
}
YARA Detection Rule: MachO_File_pyinstaller
Repository: Yara-Rules/rules
Detects: Detect Mach-O file produced by pyinstaller
Author: KatsuragiCSL (https://katsuragicsl.github.io)

Pattern signatures:
$a = "pyi-runtime-tmpdir"
        $b = "pyi-bootloader-ignore-signals"

Detection condition:
any of them

Full rule:
rule MachO_File_pyinstaller
{
    meta:
        author = "KatsuragiCSL (https://katsuragicsl.github.io)"
        description = "Detect Mach-O file produced by pyinstaller"
    strings:
        $a = "pyi-runtime-tmpdir"
        $b = "pyi-bootloader-ignore-signals"
    condition:
        any of them
}
YARA Detection Rule: Win7Elevatev2
Repository: Yara-Rules/rules
Detects: Detects Win7Elevate - Windows UAC bypass utility
Author: Florian Roth
Reference: http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html

Pattern signatures:
$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide	
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
		
		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii 
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii

Detection condition:
uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )

Full rule:
rule Win7Elevatev2 {
	meta:
		description = "Detects Win7Elevate - Windows UAC bypass utility"
		author = "Florian Roth"
		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
		date = "2015-05-14"
		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29" /* x64 */
		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1" /* x86 */
		score = 60
	strings:
		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
		$x3 = "Run the command normally (without code injection)" wide	
		$x4 = "Inject file copy && elevate command" fullword wide
		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
		
		$s1 = "\\cmd.exe" wide
		$s2 = "runas" wide
		$s3 = "explorer.exe" wide
		$s4 = "Couldn't load kernel32.dll" wide
		$s5 = "CRYPTBASE.dll" wide
		$s6 = "shell32.dll" wide
		$s7 = "ShellExecuteEx" ascii
		$s8 = "COMCTL32.dll" ascii 
		$s9 = "ShellExecuteEx" ascii
		$s10 = "HeapAlloc" ascii
	condition:
		uint16(0) == 0x5a4d and ( 1 of ($x*) or all of ($s*) )
}
YARA Detection Rule: UACME_Akagi
Repository: Yara-Rules/rules
Detects: Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor
Author: Florian Roth
Reference: https://github.com/hfiref0x/UACME

Pattern signatures:
$x1 = "UACMe injected, Fubuki at your service." wide fullword
		$x3 = "%temp%\\Hibiki.dll" fullword wide
		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
		
		$s1 = "%systemroot%\\system32\\cmd.exe" wide
		$s2 = "D:(A;;GA;;;WD)" wide
		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
		$s5 = "Fubuki.dll" ascii fullword
		
		$l1 = "ntdll.dll" ascii
		$l2 = "Cabinet.dll" ascii
		$l3 = "GetProcessHeap" ascii
		$l4 = "WriteProcessMemory" ascii
		$l5 = "ShellExecuteEx" ascii

Detection condition:
( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) )

Full rule:
rule UACME_Akagi {
	meta:
		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
		author = "Florian Roth"
		reference = "https://github.com/hfiref0x/UACME"
		date = "2015-05-14"
		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
		score = 60
	strings:
		$x1 = "UACMe injected, Fubuki at your service." wide fullword
		$x3 = "%temp%\\Hibiki.dll" fullword wide
		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
		
		$s1 = "%systemroot%\\system32\\cmd.exe" wide
		$s2 = "D:(A;;GA;;;WD)" wide
		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
		$s5 = "Fubuki.dll" ascii fullword
		
		$l1 = "ntdll.dll" ascii
		$l2 = "Cabinet.dll" ascii
		$l3 = "GetProcessHeap" ascii
		$l4 = "WriteProcessMemory" ascii
		$l5 = "ShellExecuteEx" ascii
	condition:
		( 1 of ($x*) ) or ( 3 of ($s*) and all of ($l*) ) 
}
YARA Detection Rule: UACElevator
Repository: Yara-Rules/rules
Detects: UACElevator bypassing UAC - file UACElevator.exe
Author: Florian Roth
Reference: https://github.com/MalwareTech/UACElevator

Pattern signatures:
$x1 = "\\UACElevator.pdb" ascii
		
		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
		$s3 = "Infection module: %s" fullword ascii
		$s4 = "Could not save module to %s" fullword ascii
		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
		$s7 = "Stack around the variable '" fullword ascii
		$s8 = "MSVCR120D.dll" fullword wide
		$s9 = "Address: 0x" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 172KB and 
			( $x1 or 8 of ($s*) )

Full rule:
rule UACElevator {
	meta:
		description = "UACElevator bypassing UAC - file UACElevator.exe"
		author = "Florian Roth"
		reference = "https://github.com/MalwareTech/UACElevator"
		date = "2015-05-14"
		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
	strings:
		$x1 = "\\UACElevator.pdb" ascii
		
		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
		$s3 = "Infection module: %s" fullword ascii
		$s4 = "Could not save module to %s" fullword ascii
		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
		$s7 = "Stack around the variable '" fullword ascii
		$s8 = "MSVCR120D.dll" fullword wide
		$s9 = "Address: 0x" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 172KB and 
			( $x1 or 8 of ($s*) )
}
YARA Detection Rule: s4u
Repository: Yara-Rules/rules
Detects: Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe
Author: Florian Roth
Reference: https://github.com/aurel26/s-4-u-for-windows

Pattern signatures:
// Specific strings (may change)
		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii 
		$x1 = "\\Release\\s4u.pdb" ascii

		// Less specific strings
		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii 
		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii 
		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii 
		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii 
		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii 
		$s5 = "The token does not have the specified privilege (%S)." fullword ascii 
		$s6 = "Unable to parse command line." fullword ascii 
		$s7 = "Unable to find logon SID." fullword ascii 
		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii 
		
		// Generic
		$g1 = "%systemroot%\\system32\\cmd.exe" wide
		$g2 = "SeTcbPrivilege" wide
		$g3 = "winsta0\\default" wide
		$g4 = ".rsrc"
		$g5 = "HeapAlloc"
		$g6 = "GetCurrentProcess"
		$g7 = "HeapFree"


Detection condition:
uint16(0) == 0x5a4d and filesize < 60KB and ( 1 of ($x*) or all of ($s*) or all of ($g*) )

Full rule:
rule s4u {
	meta:
		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
		author = "Florian Roth"
		reference = "https://github.com/aurel26/s-4-u-for-windows"
		date = "2015-06-05"
		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
		score = 50
	strings:
		// Specific strings (may change)
		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii 
		$x1 = "\\Release\\s4u.pdb" ascii

		// Less specific strings
		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii 
		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii 
		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii 
		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii 
		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii 
		$s5 = "The token does not have the specified privilege (%S)." fullword ascii 
		$s6 = "Unable to parse command line." fullword ascii 
		$s7 = "Unable to find logon SID." fullword ascii 
		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii 
		
		// Generic
		$g1 = "%systemroot%\\system32\\cmd.exe" wide
		$g2 = "SeTcbPrivilege" wide
		$g3 = "winsta0\\default" wide
		$g4 = ".rsrc"
		$g5 = "HeapAlloc"
		$g6 = "GetCurrentProcess"
		$g7 = "HeapFree"
		$g8 = "GetProcessHeap"
		$g9 = "ExpandEnvironmentStrings"
		$g10 = "ConvertStringSidToSid"
		$g11 = "LookupPrivilegeValue"
		$g12 = "AllocateLocallyUniqueId"
		$g13 = "ADVAPI32.dll"
		$g14 = "LsaLookupAuthenticationPackage"
		$g15 = "Secur32.dll"
		$g16 = "MSVCR120.dll"		

	condition:
		uint16(0) == 0x5a4d and filesize < 60KB and ( 1 of ($x*) or all of ($s*) or all of ($g*) ) 
}
YARA Detection Rule: Codoso_PlugX_3
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
        $s2 = "mcs.exe" fullword ascii
        $s3 = "McAltLib.dll" fullword ascii
        $s4 = "WinRAR self-extracting archive" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1200KB and all of them

Full rule:
rule Codoso_PlugX_3
{

    meta:
        description = "Detects Codoso APT PlugX Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"

    strings:
        $s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
        $s2 = "mcs.exe" fullword ascii
        $s3 = "McAltLib.dll" fullword ascii
        $s4 = "WinRAR self-extracting archive" fullword wide

    condition:
        uint16(0) == 0x5a4d and filesize < 1200KB and all of them
}
YARA Detection Rule: Codoso_PlugX_2
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PlugX Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "%TEMP%\\HID" fullword wide
        $s2 = "%s\\hid.dll" fullword wide
        $s3 = "%s\\SOUNDMAN.exe" fullword wide
        $s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
        $s5 = "%s\\HID.dllx" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them

Full rule:
rule Codoso_PlugX_2
{

    meta:
        description = "Detects Codoso APT PlugX Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "b9510e4484fa7e[PII_REDACTED]768176fce822162ad819539c6ca3631deac043eb"

    strings:
        $s1 = "%TEMP%\\HID" fullword wide
        $s2 = "%s\\hid.dll" fullword wide
        $s3 = "%s\\SOUNDMAN.exe" fullword wide
        $s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
        $s5 = "%s\\HID.dllx" fullword wide

    condition:
        ( uint16(0) == 0x5a4d and filesize < 400KB and 3 of them ) or all of them
}
YARA Detection Rule: Codoso_CustomTCP_4
Repository: Yara-Rules/rules
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "varus_service_x86.dll" fullword ascii
        $s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
        $s2 = "net start %%1" fullword ascii
        $s3 = "ping 127.1 > nul" fullword ascii
        $s4 = "McInitMISPAlertEx" fullword ascii
        $s5 = "sc start %%1" fullword ascii
        $s6 = "net stop %%1" fullword ascii
        $s7 = "WorkerRun" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or ( $x1 and 2 of ($s*) )

Full rule:
rule Codoso_CustomTCP_4
{

    meta:
        description = "Detects Codoso APT CustomTCP Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
        hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
        hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
        hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"

    strings:
        $x1 = "varus_service_x86.dll" fullword ascii
        $s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
        $s2 = "net start %%1" fullword ascii
        $s3 = "ping 127.1 > nul" fullword ascii
        $s4 = "McInitMISPAlertEx" fullword ascii
        $s5 = "sc start %%1" fullword ascii
        $s6 = "net stop %%1" fullword ascii
        $s7 = "WorkerRun" fullword ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 400KB and 5 of them ) or ( $x1 and 2 of ($s*) )
}
YARA Detection Rule: Codoso_CustomTCP_3
Repository: Yara-Rules/rules
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "DnsApi.dll" fullword ascii
        $s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
        $s3 = "CONNECT %s:%d hTTP/1.1" ascii
        $s4 = "CONNECT %s:%d HTTp/1.1" ascii
        $s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
        $s6 = "iphlpapi.dll" ascii
        $s7 = "%systemroot%\\Web\\" ascii
        $s8 = "Proxy-Authorization: Negotiate %s" ascii
        $s9 = "CLSID\\{%s}\\InprocServer32" ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them

Full rule:
rule Codoso_CustomTCP_3
{

    meta:
        description = "Detects Codoso APT CustomTCP Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"

    strings:
        $s1 = "DnsApi.dll" fullword ascii
        $s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
        $s3 = "CONNECT %s:%d hTTP/1.1" ascii
        $s4 = "CONNECT %s:%d HTTp/1.1" ascii
        $s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
        $s6 = "iphlpapi.dll" ascii
        $s7 = "%systemroot%\\Web\\" ascii
        $s8 = "Proxy-Authorization: Negotiate %s" ascii
        $s9 = "CLSID\\{%s}\\InprocServer32" ascii

    condition:
        ( uint16(0) == 0x5a4d and filesize < 500KB and 5 of them ) or 7 of them
}
YARA Detection Rule: Codoso_CustomTCP_2
Repository: Yara-Rules/rules
Detects: Detects Codoso APT CustomTCP Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s1 = "varus_service_x86.dll" fullword ascii
        $s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
        $s3 = "net start %%1" fullword ascii
        $s4 = "ping 127.1 > nul" fullword ascii
        $s5 = "McInitMISPAlertEx" fullword ascii
        $s6 = "sc start %%1" fullword ascii
        $s7 = "B_WKNDNSK^" fullword ascii
        $s8 = "net stop %%1" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 406KB and all of them

Full rule:
rule Codoso_CustomTCP_2
{

    meta:
        description = "Detects Codoso APT CustomTCP Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"

    strings:
        $s1 = "varus_service_x86.dll" fullword ascii
        $s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
        $s3 = "net start %%1" fullword ascii
        $s4 = "ping 127.1 > nul" fullword ascii
        $s5 = "McInitMISPAlertEx" fullword ascii
        $s6 = "sc start %%1" fullword ascii
        $s7 = "B_WKNDNSK^" fullword ascii
        $s8 = "net stop %%1" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 406KB and all of them
}
YARA Detection Rule: Codoso_PGV_PVID_6
Repository: Yara-Rules/rules
Detects: Detects Codoso APT PGV_PVID Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$s0 = "rundll32 \"%s\",%s" fullword ascii
        $s1 = "/c ping 127.%d & del \"%s\"" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 6000KB and all of them

Full rule:
rule Codoso_PGV_PVID_6
{

    meta:
        description = "Detects Codoso APT PGV_PVID Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"

    strings:
        $s0 = "rundll32 \"%s\",%s" fullword ascii
        $s1 = "/c ping 127.%d & del \"%s\"" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 6000KB and all of them
}
YARA Detection Rule: Codoso_Gh0st_3
Repository: Yara-Rules/rules
Detects: Detects Codoso APT Gh0st Malware
Author: Florian Roth
Reference: https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks

Pattern signatures:
$x1 = "RunMeByDLL32" fullword ascii
        $s1 = "svchost.dll" fullword wide
        $s2 = "server.dll" fullword ascii
        $s3 = "Copyright ? 2008" fullword wide
        $s4 = "testsupdate33" fullword ascii
        $s5 = "Device Protect Application" fullword wide
        $s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
        $s7 = "mail-news.eicp.net" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them

Full rule:
rule Codoso_Gh0st_3
{

    meta:
        description = "Detects Codoso APT Gh0st Malware"
        author = "Florian Roth"
        reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
        date = "2016-01-30"
        hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"

    strings:
        $x1 = "RunMeByDLL32" fullword ascii
        $s1 = "svchost.dll" fullword wide
        $s2 = "server.dll" fullword ascii
        $s3 = "Copyright ? 2008" fullword wide
        $s4 = "testsupdate33" fullword ascii
        $s5 = "Device Protect Application" fullword wide
        $s6 = "MSVCP60.DLL" fullword ascii /* Goodware String - occured 1 times */
        $s7 = "mail-news.eicp.net" fullword ascii

    condition:
        uint16(0) == 0x5a4d and filesize < 195KB and $x1 or 4 of them
}