deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Waterbear_10_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "ADVPACK32.DLL" fullword wide
      $s5 = "ADVPACK32" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 30KB and all of them )

Full rule:
rule Waterbear_10_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
      id = "1219c3e6-1001-5075-b7fc-e0d8a7de6a65"
   strings:
      $s1 = "ADVPACK32.DLL" fullword wide
      $s5 = "ADVPACK32" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 30KB and all of them )
}
YARA Detection Rule: Waterbear_11_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "/Pages/%u.asp" fullword wide
      $s2 = "NVIDIA Corporation." fullword wide
      $s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
      $s4 = "Copyright (C) 2005" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )

Full rule:
rule Waterbear_11_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
      id = "d7eb7561-c84e-5149-920c-35ad225ca8a9"
   strings:
      $s1 = "/Pages/%u.asp" fullword wide
      $s2 = "NVIDIA Corporation." fullword wide
      $s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
      $s4 = "Copyright (C) 2005" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and all of them )
}
YARA Detection Rule: Waterbear_12_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "O_PROXY" fullword ascii
      $s2 = "XMODIFY" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule Waterbear_12_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
      id = "cc0a071c-c409-57a2-80c5-dd93ca7db339"
   strings:
      $s1 = "O_PROXY" fullword ascii
      $s2 = "XMODIFY" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: Waterbear_13_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
      $s2 = "brnew.exe" fullword ascii
      $s3 = "ChangeServiceConfig failed (%d)" fullword ascii
      $s4 = "Proxy %d:%s %d" fullword ascii
      $s5 = "win9807.tmp" fullword ascii
      $s7 = "Service stopped successfully" fullword ascii
      $s8 = "current dns:%s" fullword ascii
      $s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
      $s10 = "[-]send %d: " fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )

Full rule:
rule Waterbear_13_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      super_rule = 1
      hash1 = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
      hash2 = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
      hash3 = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
      id = "425aaed4-879e-5caf-808b-14de98f628e8"
   strings:
      $s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
      $s2 = "brnew.exe" fullword ascii
      $s3 = "ChangeServiceConfig failed (%d)" fullword ascii
      $s4 = "Proxy %d:%s %d" fullword ascii
      $s5 = "win9807.tmp" fullword ascii
      $s7 = "Service stopped successfully" fullword ascii
      $s8 = "current dns:%s" fullword ascii
      $s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
      $s10 = "[-]send %d: " fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and 4 of them )
}
YARA Detection Rule: Waterbear_14_Jun17
Repository: Neo23x0/signature-base
Detects: Detects malware from Operation Waterbear
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/L9g9eR

Pattern signatures:
$s1 = "my.com/msg/util/sgthash" fullword ascii
      $s2 = "C:\\recycled" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 8000KB and all of them )

Full rule:
rule Waterbear_14_Jun17 {
   meta:
      description = "Detects malware from Operation Waterbear"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/L9g9eR"
      date = "2017-06-23"
      hash1 = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
      hash2 = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
      hash3 = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
      id = "515d9400-3e2e-5ee5-a7dd-b313125c6482"
   strings:
      $s1 = "my.com/msg/util/sgthash" fullword ascii
      $s2 = "C:\\recycled" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 8000KB and all of them )
}
YARA Detection Rule: merlinAgent
Repository: Neo23x0/signature-base
Detects: Detects Merlin agent
Author: Hilko Bengen
Reference: https://github.com/Ne0nd0g/merlin

Pattern signatures:
$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
		$x3 = "[-]%d out of %d total failed checkins"
		$x4 = "[!}Unknown AgentControl message type received %s"
		$x5 = "[-]Received Agent Kill Message"
		$x6 = "[-]Received Server OK, doing nothing"
		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
		$x8 = "[-]Sleeping for %s at %s"

		$s1 = "Executing command %s %s %s"
		$s2 = "[+]Host Information:"
		$s3 = "\tHostname: %s"
		$s4 = "\tPlatform: %s"
		$s5 = "\tUser GUID: %s"

Detection condition:
1 of ($x*) or 4 of them

Full rule:
rule merlinAgent {
	meta:
		description = "Detects Merlin agent"
		filetype = "pe, elf, mach"
		author = "Hilko Bengen"
		reference = "https://github.com/Ne0nd0g/merlin"
		date = "2017-12-26"
		id = "92346a3f-dce4-58db-893b-b7797fa20029"
	strings:
		$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
		$x3 = "[-]%d out of %d total failed checkins"
		$x4 = "[!}Unknown AgentControl message type received %s"
		$x5 = "[-]Received Agent Kill Message"
		$x6 = "[-]Received Server OK, doing nothing"
		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
		$x8 = "[-]Sleeping for %s at %s"

		$s1 = "Executing command %s %s %s"
		$s2 = "[+]Host Information:"
		$s3 = "\tHostname: %s"
		$s4 = "\tPlatform: %s"
		$s5 = "\tUser GUID: %s"
	condition:
		1 of ($x*) or 4 of them
}
YARA Detection Rule: MiniDionis_readerView
Repository: Neo23x0/signature-base
Detects: MiniDionis Malware - file readerView.exe / adobe.exe
Author: Florian Roth (Nextron Systems)
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
		$s2 = "dnlibsh" fullword ascii /* score: '7.00' */

		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)

Full rule:
rule MiniDionis_readerView {
	meta:
		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		/* Original Hash */
		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
		/* Derived Samples */
		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f[PII_REDACTED]40004"
		hash3 = "88a40d5b679bccf[PII_REDACTED]b3d18b09e68b609ffaf414574a6eca6536e8b8f"
		hash4 = "97d8725e39d263ed21856477ed[PII_REDACTED]4b5c0d0b9ae86ebb1cdd4cdc18b7"
		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
		id = "dc8d4311-2a87-5c9b-95ff-52708f293f01"
	strings:
		$s1 = "%ws_out%ws" fullword wide /* score: '8.00' */
		$s2 = "dnlibsh" fullword ascii /* score: '7.00' */

		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b } /* Opcode */
		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f } /* Opcode */
		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 } /* Opcode */
	condition:
		uint16(0) == 0x5a4d and filesize < 500KB and all of ($s*) and 1 of ($op*)
}
YARA Detection Rule: Malicious_SFX1
Repository: Neo23x0/signature-base
Detects: SFX with voicemail content
Author: Florian Roth (Nextron Systems)
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s1 = ".exe" ascii

Detection condition:
uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80)

Full rule:
rule Malicious_SFX1 {
	meta:
		description = "SFX with voicemail content"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
		id = "7c29dfb0-bbed-5017-80b4-a5c44024cd70"
	strings:
		$s0 = "voicemail" ascii /* PEStudio Blacklist: strings */ /* score: '30.00' */
		$s1 = ".exe" ascii
	condition:
		uint16(0) == 0x4b50 and filesize < 1000KB and $s0 in (3..80) and $s1 in (3..80) 
}
YARA Detection Rule: Malicious_SFX2
Repository: Neo23x0/signature-base
Detects: SFX with adobe.exe content
Author: Florian Roth (Nextron Systems)
Reference: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950

Pattern signatures:
$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
		$s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and all of them

Full rule:
rule Malicious_SFX2 {
	meta:
		description = "SFX with adobe.exe content"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
		date = "2015-07-20"
		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
		id = "ff59d638-4d82-5a14-b346-3df2154d3c34"
	strings:
		$s1 = "adobe.exe" fullword ascii /* PEStudio Blacklist: strings */ /* score: '27.00' */
		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide /* PEStudio Blacklist: strings */ /* score: '26.00' */
		$s3 = "GETPASSWORD1" fullword wide /* PEStudio Blacklist: strings */ /* score: '23.00' */
	condition:
		uint16(0) == 0x5a4d and filesize < 1000KB and all of them
}
YARA Detection Rule: MiniDionis_VBS_Dropped
Repository: Neo23x0/signature-base
Detects: Dropped File - 1.vbs
Author: Florian Roth (Nextron Systems)
Reference: https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/

Pattern signatures:
$s1 = "Wscript.Sleep 5000" ascii
		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
		$s4 = "If(FSO.FileExists(\"" ascii
		$s5 = "then FSO.DeleteFile(\".\\" ascii

Detection condition:
filesize < 1KB and all of them and $s1 in (0..40)

Full rule:
rule MiniDionis_VBS_Dropped {
	meta:
		description = "Dropped File - 1.vbs"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
		date = "2015-07-21"
		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
		id = "f0[PII_REDACTED]-504a-a39b-463e7535a2b3"
	strings:
		$s1 = "Wscript.Sleep 5000" ascii
		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
		$s4 = "If(FSO.FileExists(\"" ascii
		$s5 = "then FSO.DeleteFile(\".\\" ascii
	condition:
		filesize < 1KB and all of them and $s1 in (0..40)
}
YARA Detection Rule: derusbi_kernel
Repository: Neo23x0/signature-base
Detects: Derusbi Driver version
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud

Pattern signatures:
$token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $class = ".?AVPCC_BASEMOD@@"

Detection condition:
uint16(0) == 0x5A4D and $token1 and $token2 and $class

Full rule:
rule derusbi_kernel
{
    meta:
        description = "Derusbi Driver version"
        date = "2015-12-09"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
        id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"
    strings:
        $token1 = "$$$--Hello"
        $token2 = "Wrod--$$$"
        $class = ".?AVPCC_BASEMOD@@"
    condition:
        uint16(0) == 0x5A4D and $token1 and $token2 and $class
}
YARA Detection Rule: derusbi_linux
Repository: Neo23x0/signature-base
Detects: Derusbi Server Linux version
Author: Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud

Pattern signatures:
$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
        $cmd = "unset LS_OPTIONS;uname -a"
        $pname = "[diskio]"
        $rkfile = "/tmp/.secure"
        $ELF = "\x7fELF"

Detection condition:
$ELF at 0 and $PS1 and $cmd and $pname and $rkfile

Full rule:
rule derusbi_linux
{
    meta:
        description = "Derusbi Server Linux version"
        date = "2015-12-09"
        author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
        id = "2b33afb5-be87-5d41-b05e-b99d0c1d8ed9"
    strings:
        $PS1 = "PS1=RK# \\u@\\h:\\w \\$"
        $cmd = "unset LS_OPTIONS;uname -a"
        $pname = "[diskio]"
        $rkfile = "/tmp/.secure"
        $ELF = "\x7fELF"
    condition:
        $ELF at 0 and $PS1 and $cmd and $pname and $rkfile
}
YARA Detection Rule: Derusbi_Kernel_Driver_WD_UDFS
Repository: Neo23x0/signature-base
Detects: Detects Derusbi Kernel Driver
Author: Florian Roth (Nextron Systems)
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
      $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
      $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
      $x5 = "$$$--Hello" fullword ascii
      $x6 = "Wrod--$$$" fullword ascii

		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
		$s2 = "Update.dll" fullword ascii
		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
		$s4 = "\\Driver\\nsiproxy" wide
		$s5 = "HOST: %s" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and
      (
         2 of ($x*) or all of ($s*)
      )

Full rule:
rule Derusbi_Kernel_Driver_WD_UDFS {
	meta:
		description = "Detects Derusbi Kernel Driver"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 80
		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
		id = "51d80d19-f87f-5b09-ac49-08ebcb464013"
	strings:
      $x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
      $x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
      $x3 = "\\??\\pipe\\usbpcex%d" fullword wide
		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
      $x5 = "$$$--Hello" fullword ascii
      $x6 = "Wrod--$$$" fullword ascii

		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
		$s2 = "Update.dll" fullword ascii
		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
		$s4 = "\\Driver\\nsiproxy" wide
		$s5 = "HOST: %s" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 800KB and
      (
         2 of ($x*) or all of ($s*)
      )
}
YARA Detection Rule: Derusbi_Code_Signing_Cert
Repository: Neo23x0/signature-base
Detects: Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious
Author: Florian Roth (Nextron Systems)
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
      $s2 = "XL Games Co.,Ltd.0" fullword ascii
      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 800KB and 1 of them

Full rule:
rule Derusbi_Code_Signing_Cert {
	meta:
		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 60
		id = "d123fde9-0182-5232-a716-b76e8d9830c4"
   strings:
      $s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
      $s2 = "XL Games Co.,Ltd.0" fullword ascii
      $s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 800KB and 1 of them
}
YARA Detection Rule: XOR_4byte_Key
Repository: Neo23x0/signature-base
Detects: Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)
Author: Florian Roth (Nextron Systems)
Reference: http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family

Pattern signatures:
/* Op Code */
      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
      /*
      test    ecx, ecx
      jz      short loc_590170
      xor     [esi], eax
      add     [esi], ebx
      add     esi, 4
      dec     ecx
      jmp     short loc_590162
      */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and all of them

Full rule:
rule XOR_4byte_Key {
	meta:
		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
		date = "2015-12-15"
		score = 60
		id = "77850332-87ce-5ed3-bb09-88e91e5bb5f6"
   strings:
      /* Op Code */
      $s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
      /*
      test    ecx, ecx
      jz      short loc_590170
      xor     [esi], eax
      add     [esi], ebx
      add     esi, 4
      dec     ecx
      jmp     short loc_590162
      */
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and all of them
}
YARA Detection Rule: Derusbi_Backdoor_Mar17_1
Repository: Neo23x0/signature-base
Detects: Detects a variant of the Derusbi backdoor
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
      $x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
      $x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
      $x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
      $x5 = "OfficeUt32.dll" fullword ascii
      $x6 = "\\\\.\\pipe\\usb%so" fullword wide
      $x7 = "\\\\.\\pipe\\usb%si" fullword wide
      $x8 = "\\tmp1.dat" wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )

Full rule:
rule Derusbi_Backdoor_Mar17_1 {
   meta:
      description = "Detects a variant of the Derusbi backdoor"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-03-03"
      hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
      id = "5c8838d6-b9c2-589e-b6a2-a8c7ad6f10cc"
   strings:
      $x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
      $x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
      $x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
      $x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
      $x5 = "OfficeUt32.dll" fullword ascii
      $x6 = "\\\\.\\pipe\\usb%so" fullword wide
      $x7 = "\\\\.\\pipe\\usb%si" fullword wide
      $x8 = "\\tmp1.dat" wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and 1 of them )
}
YARA Detection Rule: Duqu2_Sample1
Repository: Neo23x0/signature-base
Detects: Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/

Pattern signatures:
$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "MSI.dll" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )

Full rule:
rule Duqu2_Sample1 {
	meta:
		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
		date = "2016-07-02"
		score = 80
		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
		hash2 = "8e97c371633d285cd8fc842f[PII_REDACTED]a9409149ee67d97de545030787a192"
		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
		id = "39ba04f1-df45-5513-ab8f-12097a79cdc7"
	strings:
		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
		$s2 = "MSI.dll" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 40KB and $x1 ) or ( all of them )
}