deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT_MAL_LNX_RedMenshen_BPFDoor_Controller_Generic_May22_1
Repository: Neo23x0/signature-base
Detects: Detects BPFDoor malware
Author: Florian Roth (Nextron Systems)
Reference: https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896

Pattern signatures:
$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
      $op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
      $op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
      $op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
      $op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
      $op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }

Detection condition:
uint16(0) == 0x457f and
      filesize < 200KB and 2 of them or 4 of them

Full rule:
rule APT_MAL_LNX_RedMenshen_BPFDoor_Controller_Generic_May22_1 {
   meta:
      description = "Detects BPFDoor malware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
      date = "2022-05-09"
      score = 90
      hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
      hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e[PII_REDACTED]f4e8345"
      hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
      hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed[PII_REDACTED]d9127c78"
      hash5 = "599ae527f10ddb[PII_REDACTED]b7d3734ee51673b664f2e5d0346e64f85e185683"
      hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
      hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
      hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
      hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
      hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
      hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
      hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
      hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
      hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
      hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
      hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
      hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
      id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
   strings:
      $op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
      $op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45
YARA Detection Rule: TopHat_Malware_Jan18_1
Repository: Neo23x0/signature-base
Detects: Detects malware from TopHat campaign
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix

Pattern signatures:
$s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
      $s2 = "UENCRYPTION" fullword ascii
      $s3 = "TEXPORTAPIS" fullword ascii
      $s4 = "tcustommemorystream" fullword ascii
      $s5 = "tmemorystream" fullword ascii
      $s6 = "ExtrasNoteCONSOLEemb" fullword ascii
      $s7 = "DIALOG INCLUDE" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and (
        pe.imphash() == "c221006b240b1c993217bd61e5ee31b6" or
        6 of them
      )

Full rule:
rule TopHat_Malware_Jan18_1 {
   meta:
      description = "Detects malware from TopHat campaign"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
      date = "2018-01-29"
      hash1 = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
      hash2 = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
      id = "ec290eee-a21e-548d-b7cc-3e25e7c39d22"
   strings:
      $s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
      $s2 = "UENCRYPTION" fullword ascii
      $s3 = "TEXPORTAPIS" fullword ascii
      $s4 = "tcustommemorystream" fullword ascii
      $s5 = "tmemorystream" fullword ascii
      $s6 = "ExtrasNoteCONSOLEemb" fullword ascii
      $s7 = "DIALOG INCLUDE" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and (
        pe.imphash() == "c221006b240b1c993217bd61e5ee31b6" or
        6 of them
      )
}
YARA Detection Rule: TopHat_Malware_Jan18_2
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file e.exe
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix

Pattern signatures:
$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
      $s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
      $s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
      $s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
      $s5 = "UENCRYPTION" fullword ascii
      $s6 = "TEXPORTAPIS" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
        pe.imphash() == "f98cebcae832abc3c46e6e296aecfc03" and
        5 of them
      )

Full rule:
rule TopHat_Malware_Jan18_2 {
   meta:
      description = "Auto-generated rule - file e.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
      date = "2018-01-29"
      modified = "2023-01-06"
      hash1 = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
      id = "a1b8e477-df8a-5ff4-9108-541a0f082f77"
   strings:
      $s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
      $s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
      $s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
      $s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
      $s5 = "UENCRYPTION" fullword ascii
      $s6 = "TEXPORTAPIS" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
        pe.imphash() == "f98cebcae832abc3c46e6e296aecfc03" and
        5 of them
      )
}
YARA Detection Rule: TopHat_BAT
Repository: Neo23x0/signature-base
Detects: Auto-generated rule - file cgen.bat
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix

Pattern signatures:
$s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
      $s2 = "goto Start" fullword ascii
      $s3 = ":Start" fullword ascii

Detection condition:
filesize < 5KB and all of them

Full rule:
rule TopHat_BAT {
   meta:
      description = "Auto-generated rule - file cgen.bat"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
      date = "2018-01-29"
      hash1 = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
      hash2 = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
      id = "81e84f1b-0ee7-530d-91ea-645c0994e68f"
   strings:
      $s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
      $s2 = "goto Start" fullword ascii
      $s3 = ":Start" fullword ascii
   condition:
      filesize < 5KB and all of them
}
YARA Detection Rule: EXPL_RAR_Archive_with_Path_Traversal_Aug25
Repository: Neo23x0/signature-base
Detects: Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218
Author: Arnim Rupp (Nextron Systems)
Reference: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088

Pattern signatures:
// Only look for the users Autostart folder because the most effective attack method
      // Use \ and / to handle archives created on Windows and Linux
      $s1 = "..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
      $s2 = "..//../AppData/Roaming/Microsoft/Windows/Start Menu"
      // CVE-2025-6218:
      $s3 = "/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"

Detection condition:
1 of ( $s* )
      and (
        uint16(0) == 0x4B50         // Yes, Winrar can chocke on ZIPs
        or int32(0) == 0x21726152   // RAR
      )

Full rule:
rule EXPL_RAR_Archive_with_Path_Traversal_Aug25 {
   meta:
      description = "Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218"
      reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088"
      author = "Arnim Rupp (Nextron Systems)"
      date = "2025-08-11"
      score = 70
      hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3"
      hash = "dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab"
      hash = "107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806"
   strings:
      // Only look for the users Autostart folder because the most effective attack method
      // Use \ and / to handle archives created on Windows and Linux
      $s1 = "..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
      $s2 = "..//../AppData/Roaming/Microsoft/Windows/Start Menu"
      // CVE-2025-6218:
      $s3 = "/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"    
   condition:
      1 of ( $s* )
      and (
        uint16(0) == 0x4B50         // Yes, Winrar can chocke on ZIPs
        or int32(0) == 0x21726152   // RAR
      )
}
YARA Detection Rule: Sphinx_Moth_cudacrt
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file cudacrt.dll
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "HPSSOEx.dll" fullword wide
        $s1 = "255.255.255.254" fullword wide
        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide

        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)

Full rule:
rule Sphinx_Moth_cudacrt { 
    meta:
        description = "sphinx moth threat group file cudacrt.dll" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "233f657b-029a-5ed4-b2f7-712851297f18"
    strings:
        $s0 = "HPSSOEx.dll" fullword wide
        $s1 = "255.255.255.254" fullword wide
        $s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide

        $op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b } /* Opcode */ 
        $op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 } /* Opcode */ 
        $op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 } /* Opcode */
    condition:
        uint16(0) == 0x5a4d and filesize < 243KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Sphinx_Moth_h2t
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file h2t.dat
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
        
        $s1 = "[-] Error in connection() %d - %s" fullword ascii
        $s2 = "[-] Child process exit." fullword ascii
        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
        $s4 = "pipe() to" fullword ascii
        $s5 = "pipe() from" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))

Full rule:
rule Sphinx_Moth_h2t { 
    meta:
        description = "sphinx moth threat group file h2t.dat" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)" 
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "62d14efd-7d0b-5f66-9e78-74f3f9e2fd5b"
    strings:
        $x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii 
        
        $s1 = "[-] Error in connection() %d - %s" fullword ascii
        $s2 = "[-] Child process exit." fullword ascii
        $s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
        $s4 = "pipe() to" fullword ascii
        $s5 = "pipe() from" fullword ascii
    condition:
        uint16(0) == 0x5a4d and filesize < 156KB and ($x1 or all of ($s*))
}
YARA Detection Rule: Sphinx_Moth_iastor32
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file iastor32.exe
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and all of them

Full rule:
rule Sphinx_Moth_iastor32 { 
    meta:
        description = "sphinx moth threat group file iastor32.exe" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "5688c598-ea18-578f-bb8a-3729c0502af5"
    strings:
        $s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii /* private key */
        $s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii /* private key */
    condition:
        uint16(0) == 0x5a4d and filesize < 2000KB and all of them
}
YARA Detection Rule: Sphinx_Moth_kerberos32
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file kerberos32.dll
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
        $x3 = "kerberos32.dll" fullword wide
        $x4 = "KERBEROS64.dll" fullword ascii
        $x5 = "kerberos%d.dll" fullword ascii

        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
        $s4 = "getlog" fullword ascii
        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */

Detection condition:
uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))

Full rule:
rule Sphinx_Moth_kerberos32 {
    meta:
        description = "sphinx moth threat group file kerberos32.dll" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "769ee362-2363-511a-8f17-99e66c9bab53"
    strings:
        $x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
        $x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
        $x3 = "kerberos32.dll" fullword wide
        $x4 = "KERBEROS64.dll" fullword ascii
        $x5 = "kerberos%d.dll" fullword ascii

        $s1 = "\\\\.\\pipe\\lsassp" fullword ascii
        $s2 = "LSASS secure pipe" fullword ascii /* PEStudio Blacklist: strings */ 
        $s3 = "NullSessionPipes" fullword ascii /* PEStudio Blacklist: strings */ 
        $s4 = "getlog" fullword ascii
        $s5 = "startlog" fullword ascii /* PEStudio Blacklist: strings */
        $s6 = "stoplog" fullword ascii /* PEStudio Blacklist: strings */
        $s7 = "Unsupported OS (%d)" fullword ascii /* PEStudio Blacklist: strings */ 
        $s8 = "Unsupported OS (%s)" fullword ascii /* PEStudio Blacklist: strings */
    condition:
        uint16(0) == 0x5a4d and filesize < 300KB and (2 of ($x*) or all of ($s*))
}
YARA Detection Rule: Sphinx_Moth_kerberos64
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file kerberos64.dll
Author: Kudelski Security - Nagravision SA (modified by Florian Roth)
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "KERBEROS64.dll" fullword ascii
        $s1 = "zeSecurityDescriptor" fullword ascii
        $s2 = "SpGetInfo" fullword ascii
        $s3 = "SpShutdown" fullword ascii
        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)

Full rule:
rule Sphinx_Moth_kerberos64 { 
    meta:
        description = "sphinx moth threat group file kerberos64.dll" 
        author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "5a2487e4-cda4-5d45-9351-edd2b69c460a"
    strings:
        $s0 = "KERBEROS64.dll" fullword ascii
        $s1 = "zeSecurityDescriptor" fullword ascii
        $s2 = "SpGetInfo" fullword ascii
        $s3 = "SpShutdown" fullword ascii
        $op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff } /* Opcode */ 
        $op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 } /* Opcode */ 
        $op2 = { 48 8d 3d e3 ee 00 00 ba 58 } /* Opcode */
    condition:
        uint16(0) == 0x5a4d and filesize < 406KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Sphinx_Moth_nvcplex
Repository: Neo23x0/signature-base
Detects: sphinx moth threat group file nvcplex.dat
Author: Kudelski Security - Nagravision SA
Reference: www.kudelskisecurity.com

Pattern signatures:
$s0 = "mshtaex.exe" fullword wide
        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 214KB and all of them

Full rule:
rule Sphinx_Moth_nvcplex { 
    meta:
        description = "sphinx moth threat group file nvcplex.dat" 
        author = "Kudelski Security - Nagravision SA"
        reference = "www.kudelskisecurity.com"
        date = "2015-08-06"
        id = "dd1b4071-adf5-5d54-9b4c-877f0965bdc7"
    strings:
        $s0 = "mshtaex.exe" fullword wide
        $op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 } /* Opcode */ 
        $op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b } /* Opcode */ 
        $op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 } /* Opcode */
    condition:
        uint16(0) == 0x5a4d and filesize < 214KB and all of them
}
YARA Detection Rule: FLAME2_Orchestrator
Repository: Neo23x0/signature-base
Detects: Encrypted resources in Flame2.0 Orchestrators
Author: turla @ Uppercase
Reference: https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0

Detection condition:
for any i in (0..pe.number_of_resources-1):
      ((hash.md5(pe.resources[i].offset,pe.resources[i].length) == "53b19d9863d8ff8cde8e4358d1b57c04") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "4849cc439e524ef6a9964a3666dddb13") or
      (hash.md5(pe.resources[i].offset,pe.res

Full rule:
rule FLAME2_Orchestrator {
   meta:
      desc = "Encrypted resources in Flame2.0 Orchestrators"
      author = "turla @ Uppercase"
      hash1 = "15a9b1d233c02d1fdf80071797ff9077f6ac374958f7d0f2b6e84b8d487c9cd1" 
      hash2 = "426aa55d2afb9eb08b601d373671594f39a1d9d9a73639c4a64f17d674ca9a82" 
      hash3 = "af8ccd0294530c659580f522fcc8492d92c2296dc068f9a42474d52b2b2f16e4"
      reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
   condition: 
      for any i in (0..pe.number_of_resources-1):
      ((hash.md5(pe.resources[i].offset,pe.resources[i].length) == "53b19d9863d8ff8cde8e4358d1b57c04") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "4849cc439e524ef6a9964a3666dddb13") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "62bfe21a8eb76fd07e22326c0073fef5") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "dfed2c71749b04dad46d0ce52834492c") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "9119aa701b39242a98be118d9c237ecc") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "b69d168e29fba6c88ad4e670949815aa") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "4849cc439e524ef6a9964a3666dddb13") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "1933a1e254b1657a6a2eb8ad1fbe6fa3") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "dfed2c71749b04dad46d0ce52834492c") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "9119aa701b39242a98be118d9c237ecc") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "b69d168e29fba6c88ad4e670949815aa") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "17c794f7056349cb82889b5e5b030d15") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "e15187f79b6916cb6763d29d215623c1") or
      (hash.md5(pe.resources[i].offset,pe.resources[i].length) == "923963bb24f2e2ceac9f9759071dba88") or