deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cert_blocklist_62af28a7657ba8ab10fa8e2d47250c69
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AFINA Fintek" and
            pe.signatures[i].serial == "62:af:28:a7:65:7b:a8:ab:10:fa:8e:2d:47:25:0c:69" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_62af28a7657ba8ab10fa8e2d47250c69 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AFINA Fintek" and
            pe.signatures[i].serial == "62:af:28:a7:65:7b:a8:ab:10:fa:8e:2d:47:25:0c:69" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_04c8eca7243208a110dea926c7ad89ce
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, SINGH ADITYA" and
            pe.signatures[i].serial == "04:c8:ec:a7:24:32:08:a1:10:de:a9:26:c7:ad:89:ce" and
           [PII_REDACTED] <= pe.signatures[i]

Full rule:
rule cert_blocklist_04c8eca7243208a110dea926c7ad89ce {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, SINGH ADITYA" and
            pe.signatures[i].serial == "04:c8:ec:a7:24:32:08:a1:10:de:a9:26:c7:ad:89:ce" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_157c3a4a6bcf35cf8453e6b6c0072e1d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Favorite-III" and
            pe.signatures[i].serial == "15:7c:3a:4a:6b:cf:35:cf:84:53:e6:b6:c0:07:2e:1d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_157c3a4a6bcf35cf8453e6b6c0072e1d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Favorite-III" and
            pe.signatures[i].serial == "15:7c:3a:4a:6b:cf:35:cf:84:53:e6:b6:c0:07:2e:1d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_04422f12037bc2032521dbb6ae02ea0e
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Muhammad Lee" and
            pe.signatures[i].serial == "04:42:2f:12:03:7b:c2:03:25:21:db:b6:ae:02:ea:0e" and
           [PII_REDACTED] <= pe.signatures[i]

Full rule:
rule cert_blocklist_04422f12037bc2032521dbb6ae02ea0e {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Muhammad Lee" and
            pe.signatures[i].serial == "04:42:2f:12:03:7b:c2:03:25:21:db:b6:ae:02:ea:0e" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_65eae6c98111dc40bf4f962bf27227f2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, BHARATH KUCHANGI" and
            pe.signatures[i].serial == "65:ea:e6:c9:81:11:dc:40:bf:4f:96:2b:f2:72:27:f2" and
           [PII_REDACTED] <= pe.signature

Full rule:
rule cert_blocklist_65eae6c98111dc40bf4f962bf27227f2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, BHARATH KUCHANGI" and
            pe.signatures[i].serial == "65:ea:e6:c9:81:11:dc:40:bf:4f:96:2b:f2:72:27:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_12d5a4b29fe6156d4195fba55ae0d9a9
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Marc Chapon" and
            pe.signatures[i].serial == "12:d5:a4:b2:9f:e6:15:6d:41:95:fb:a5:5a:e0:d9:a9" and
           [PII_REDACTED] <= pe.signatures[i].

Full rule:
rule cert_blocklist_12d5a4b29fe6156d4195fba55ae0d9a9 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Marc Chapon" and
            pe.signatures[i].serial == "12:d5:a4:b2:9f:e6:15:6d:41:95:fb:a5:5a:e0:d9:a9" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0087d60d1e2b9374eb7a735dce4bbdae56
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing GovRAT malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMO-K Limited Liability Company" and (
                pe.signatures[i].serial == "00:87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56" or
                pe.signatures[i].seria

Full rule:
rule cert_blocklist_0087d60d1e2b9374eb7a735dce4bbdae56 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing GovRAT malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMO-K Limited Liability Company" and (
                pe.signatures[i].serial == "00:87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56" or
                pe.signatures[i].serial == "87:d6:0d:1e:2b:93:74:eb:7a:73:5d:ce:4b:bd:ae:56"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0860c8a7ed18c3f030a32722fd2b220c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Tony Yeh" and
            pe.signatures[i].serial == "08:60:c8:a7:ed:18:c3:f0:30:a3:27:22:fd:2b:22:0c" and
           [PII_REDACTED] <= pe.signatures[i].not

Full rule:
rule cert_blocklist_0860c8a7ed18c3f030a32722fd2b220c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Tony Yeh" and
            pe.signatures[i].serial == "08:60:c8:a7:ed:18:c3:f0:30:a3:27:22:fd:2b:22:0c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_2fdadd[PII_REDACTED]203f8138692c4a83
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, William Zoltan" and
            pe.signatures[i].serial == "2f:da:dd:07:40:57:22:70:20:3f:81:38:69:2c:4a:83" and
           [PII_REDACTED] <= pe.signatures[

Full rule:
rule cert_blocklist_2fdadd[PII_REDACTED]203f8138692c4a83 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, William Zoltan" and
            pe.signatures[i].serial == "2f:da:dd:07:40:57:22:70:20:3f:81:38:69:2c:4a:83" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4fc13d6220c629043a26f81b1cad72d8
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, meicun ge" and
            pe.signatures[i].serial == "4f:c1:3d:62:20:c6:29:04:3a:26:f8:1b:1c:ad:72:d8" and
           [PII_REDACTED] <= pe.signatures[i].no

Full rule:
rule cert_blocklist_4fc13d6220c629043a26f81b1cad72d8 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, meicun ge" and
            pe.signatures[i].serial == "4f:c1:3d:62:20:c6:29:04:3a:26:f8:1b:1c:ad:72:d8" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_3457a918c6d3701b2eaca6a92474a7cc
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "KONSALTING PLUS OOO" and
            pe.signatures[i].serial == "34:57:a9:18:c6:d3:70:1b:2e:ac:a6:a9:24:74:a7:cc" and
           [PII_REDACTED] <= pe.signatures[i].not_after
     

Full rule:
rule cert_blocklist_3457a918c6d3701b2eaca6a92474a7cc {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "KONSALTING PLUS OOO" and
            pe.signatures[i].serial == "34:57:a9:18:c6:d3:70:1b:2e:ac:a6:a9:24:74:a7:cc" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_621ed8265b0ad872d9f4b4ed6d560513
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fan Li" and
            pe.signatures[i].serial == "62:1e:d8:26:5b:0a:d8:72:d9:f4:b4:ed:6d:56:05:13" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_621ed8265b0ad872d9f4b4ed6d560513 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fan Li" and
            pe.signatures[i].serial == "62:1e:d8:26:5b:0a:d8:72:d9:f4:b4:ed:6d:56:05:13" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_56e22b992b4c7f1afeac1d63b492bf54
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Hetem Ramadani" and
            pe.signatures[i].serial == "56:e2:2b:99:2b:4c:7f:1a:fe:ac:1d:63:b4:92:bf:54" and
           [PII_REDACTED] <= pe.signatures[

Full rule:
rule cert_blocklist_56e22b992b4c7f1afeac1d63b492bf54 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Open Source Developer, Hetem Ramadani" and
            pe.signatures[i].serial == "56:e2:2b:99:2b:4c:7f:1a:fe:ac:1d:63:b4:92:bf:54" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_3bc3bae4118d46f3fdd9beeeab749fee
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "\\xE6\\x9D\\x8E\\xE9\\x9B\\xAA\\xE6\\xA2\\x85" and
            pe.signatures[i].serial == "3b:c3:ba:e4:11:8d:46:f3:fd:d9:be:ee:ab:74:9f:ee" and
           [PII_REDACTED] <= pe.sig

Full rule:
rule cert_blocklist_3bc3bae4118d46f3fdd9beeeab749fee {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "\\xE6\\x9D\\x8E\\xE9\\x9B\\xAA\\xE6\\xA2\\x85" and
            pe.signatures[i].serial == "3b:c3:ba:e4:11:8d:46:f3:fd:d9:be:ee:ab:74:9f:ee" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0f0449f7691e5b4c8e74e71cae822179
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SBO INVEST" and
            pe.signatures[i].serial == "0f:04:49:f7:69:1e:5b:4c:8e:74:e7:1c:ae:82:21:79" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0f0449f7691e5b4c8e74e71cae822179 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SBO INVEST" and
            pe.signatures[i].serial == "0f:04:49:f7:69:1e:5b:4c:8e:74:e7:1c:ae:82:21:79" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_43db4448d870d7bdc275f36a01fba36f
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "3-T TOV" and
            pe.signatures[i].serial == "43:db:44:48:d8:70:d7:bd:c2:75:f3:6a:01:fb:a3:6f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_43db4448d870d7bdc275f36a01fba36f {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "3-T TOV" and
            pe.signatures[i].serial == "43:db:44:48:d8:70:d7:bd:c2:75:f3:6a:01:fb:a3:6f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_2880a7f7ff2d334aa08744a8754fab2c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Garena Online Pte Ltd" and
            pe.signatures[i].serial == "28:80:a7:f7:ff:2d:33:4a:a0:87:44:a8:75:4f:ab:2c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
   

Full rule:
rule cert_blocklist_2880a7f7ff2d334aa08744a8754fab2c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Garena Online Pte Ltd" and
            pe.signatures[i].serial == "28:80:a7:f7:ff:2d:33:4a:a0:87:44:a8:75:4f:ab:2c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0492f5c18e26fa0cd7e15067674aff1c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Ghada Saffarini" and
            pe.signatures[i].serial == "04:92:f5:c1:8e:26:fa:0c:d7:e1:50:67:67:4a:ff:1c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0492f5c18e26fa0cd7e15067674aff1c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Ghada Saffarini" and
            pe.signatures[i].serial == "04:92:f5:c1:8e:26:fa:0c:d7:e1:50:67:67:4a:ff:1c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6aa668cd6a9de1fdd476ea[PII_REDACTED]
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BSCP LIMITED" and
            pe.signatures[i].serial == "6a:a6:68:cd:6a:9d:e1:fd:d4:76:ea:82:25:32:69:37" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_6aa668cd6a9de1fdd476ea[PII_REDACTED] {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BSCP LIMITED" and
            pe.signatures[i].serial == "6a:a6:68:cd:6a:9d:e1:fd:d4:76:ea:82:25:32:69:37" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1cb06dccb[PII_REDACTED]71ea12ac41620
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fangzhen Li" and
            pe.signatures[i].serial == "1c:b0:6d:cc:b4:82:25:57:28:67:1e:a1:2a:c4:16:20" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_1cb06dccb[PII_REDACTED]71ea12ac41620 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fangzhen Li" and
            pe.signatures[i].serial == "1c:b0:6d:cc:b4:82:25:57:28:67:1e:a1:2a:c4:16:20" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}