deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts
Repository: Neo23x0/signature-base
Detects: Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity
Author: Zach Stanford - @svch0st, Florian Roth
Reference: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log

Pattern signatures:
$x1 = "ServerInfo~" ascii wide

      $sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide  /* Adjusted to cover MSF exploit https://github.com/rapid7/metasploit-framework/blob/e5c76bfe13acddc4220d7735fdc3434d9c64736e/modules/exploits/windows/http/exchange_proxylogon_rce.rb */

      $s1 = "/ecp/auth/w.js" ascii wide 
      $s2 = "/owa/auth/w.js" ascii wide
      $s3 = "/owa/auth/x.js" ascii wide
      $s4 = "/ecp/main.css" ascii wide
      $s5 = "/ecp/default.flt" ascii wide
      $s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide

Detection condition:
$x1 and 1 of ($s*)

Full rule:
rule EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG {
   meta:
      description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
      author = "Zach Stanford - @svch0st, Florian Roth"
      reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/#scan-log"
      reference_2 = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
      date = "2021-03-10"
      modified = "2021-03-15"
      score = 65
      id = "8b0110a9-fd03-5f7d-bdd8-03ff48bcac68"
   strings:
      $x1 = "ServerInfo~" ascii wide

      $sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide  /* Adjusted to cover MSF exploit https://github.com/rapid7/metasploit-framework/blob/e5c76bfe13acddc4220d7735fdc3434d9c64736e/modules/exploits/windows/http/exchange_proxylogon_rce.rb */

      $s1 = "/ecp/auth/w.js" ascii wide 
      $s2 = "/owa/auth/w.js" ascii wide
      $s3 = "/owa/auth/x.js" ascii wide
      $s4 = "/ecp/main.css" ascii wide
      $s5 = "/ecp/default.flt" ascii wide
      $s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide
   condition:
      $x1 and 1 of ($s*)
}
YARA Detection Rule: LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2
Repository: Neo23x0/signature-base
Detects: Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity
Author: Florian Roth (Nextron Systems)
Reference: https://www.praetorian.com/blog/reproducing-proxylogon-exploit/

Pattern signatures:
$sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/

Detection condition:
$sr1

Full rule:
rule LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG {
   meta:
      description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
      date = "2021-03-10"
      score = 65
      id = "37a26def-b360-518e-a4ab-9604a5b39afd"
   strings:
      $sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/
   condition:
      $sr1
}
YARA Detection Rule: Furtim_nativeDLL
Repository: Neo23x0/signature-base
Detects: Detects Furtim malware - file native.dll
Author: Florian Roth (Nextron Systems)
Reference: MISP 3971

Pattern signatures:
$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii

		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)

Full rule:
rule Furtim_nativeDLL {
	meta:
		description = "Detects Furtim malware - file native.dll"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "MISP 3971"
		date = "2016-06-13"
		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
		id = "4639b637-55d3-5591-9278-5a21de23ac72"
	strings:
		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii

		$op0 = { e0 b3 42 00 c7 84 24 ac } /* Opcode */
		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 } /* Opcode */
		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 } /* Opcode */
	condition:
		uint16(0) == 0x5a4d and filesize < 900KB and $s1 or all of ($op*)
}
YARA Detection Rule: Furtim_Parent_1
Repository: Neo23x0/signature-base
Detects: Detects Furtim Parent Malware
Author: Florian Roth (Nextron Systems)
Reference: https://sentinelone.com/blogs/sfg-furtims-parent/

Pattern signatures:
/* RC4 encryption password */
		$x1 = "dqrChZonUF" fullword ascii
		/* Other strings */
		$s1 = "Egistec" fullword wide
		$s2 = "Copyright (C) 2016" fullword wide
		/* Op Code */
		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }

Detection condition:
( uint16(0) == 0x5a4d and filesize < 900KB and
		( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
		all of them

Full rule:
rule Furtim_Parent_1 {
	meta:
		description = "Detects Furtim Parent Malware"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
		date = "2016-07-16"
		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
		id = "a47719d2-1e4f-50a9-b340-55e13f5a24d5"
	strings:
		/* RC4 encryption password */
		$x1 = "dqrChZonUF" fullword ascii
		/* Other strings */
		$s1 = "Egistec" fullword wide
		$s2 = "Copyright (C) 2016" fullword wide
		/* Op Code */
		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
	condition:
		( uint16(0) == 0x5a4d and filesize < 900KB and
		( $x1 or ( all of ($s*) and all of ($op*) ) ) ) or
		all of them
}
YARA Detection Rule: HTA_with_WScript_Shell
Repository: Neo23x0/signature-base
Detects: Detects WScript Shell in HTA
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/msftmmpc/status/[PII_REDACTED]58560768

Pattern signatures:
$s1 = "<hta:application windowstate=\"minimize\"/>"
      $s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii

Detection condition:
all of them

Full rule:
rule HTA_with_WScript_Shell {
   meta:
      description = "Detects WScript Shell in HTA"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/msftmmpc/status/[PII_REDACTED]58560768"
      date = "2017-06-21"
      score = 80
      hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
      id = "2faf74b1-c19c-53f0-ad08-be9caf5640bc"
   strings:
      $s1 = "<hta:application windowstate=\"minimize\"/>"
      $s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii
   condition:
      all of them
}
YARA Detection Rule: HTA_Embedded
Repository: Neo23x0/signature-base
Detects: Detects an embedded HTA file
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/msftmmpc/status/[PII_REDACTED]58560768

Pattern signatures:
$s1 = "<hta:application windowstate=\"minimize\"/>"

Detection condition:
$s1 and not $s1 in (0..50000)

Full rule:
rule HTA_Embedded {
   meta:
      description = "Detects an embedded HTA file"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/msftmmpc/status/[PII_REDACTED]58560768"
      date = "2017-06-21"
      score = 50
      hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
      id = "04d4c718-9dd6-5528-8712-61c9f2a16139"
   strings:
      $s1 = "<hta:application windowstate=\"minimize\"/>"
   condition:
      $s1 and not $s1 in (0..50000)
}
YARA Detection Rule: TSCookie_RAT
Repository: Neo23x0/signature-base
Detects: Detects TSCookie RAT
Author: Florian Roth (Nextron Systems)
Reference: http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html

Pattern signatures:
$x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
      $x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
      $x3 = "--------------- Outlook Passwords ------------------" fullword ascii
      $x4 = "----------------------- IE Passwords ------------------" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         ( pe.exports("DoWork") and pe.exports("PrintF") ) or
         1 of them
      )

Full rule:
rule TSCookie_RAT {
   meta:
      description = "Detects TSCookie RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
      date = "2018-03-06"
      hash1 = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
      id = "a2b6c598-4498-5c0a-9257-b0bf6cd28de9"
   strings:
      $x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
      $x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
      $x3 = "--------------- Outlook Passwords ------------------" fullword ascii
      $x4 = "----------------------- IE Passwords ------------------" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         ( pe.exports("DoWork") and pe.exports("PrintF") ) or
         1 of them
      )
}
YARA Detection Rule: MAL_ZinFoq_Dec25
Repository: Neo23x0/signature-base
Detects: Detects ZinFoq Go-based Linux post-exploitation implant (interactive shell + file ops/exfil) seen in React2Shell intrusions
Author: RussianPanda
Reference: https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell

Pattern signatures:
$s1 = "_FlAg_UuId;;;;;;"
      $s2 = "interactive_shell"
      $s3 = "explorer_download"

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule MAL_ZinFoq_Dec25 {
   meta:
      description = "Detects ZinFoq Go-based Linux post-exploitation implant (interactive shell + file ops/exfil) seen in React2Shell intrusions"
      author = "RussianPanda"
      date = "2025-12-08"
      score = 85
      reference = "https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell"
      hash = "0f0f9c339fcc267ec3d560c7168c56f607232cbeb158cb02a0818720a54e72ce"
   strings:
      $s1 = "_FlAg_UuId;;;;;;"
      $s2 = "interactive_shell"
      $s3 = "explorer_download"
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: HKTL_CowTunnel_Dec25
Repository: Neo23x0/signature-base
Detects: Detects CowTunnel Linux reverse-proxy tunnel (NSS wrapper + FRP client) used for outbound access/pivoting in React2Shell activity
Author: RussianPanda
Reference: https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell

Pattern signatures:
$s1 = "cannot create proxy service, it should not happenned!"
      $s2 = "[nss] encrypt_data"
      $s3 = "[nss] decrypt_data"

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule HKTL_CowTunnel_Dec25 {
   meta:
      description = "Detects CowTunnel Linux reverse-proxy tunnel (NSS wrapper + FRP client) used for outbound access/pivoting in React2Shell activity"
      author = "RussianPanda"
      date = "2025-12-08"
      score = 85
      reference = "https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell"
      hash = "776850a1e6d6915e9bf35aa[PII_REDACTED]9acd94e3a3f6673bd6ddaec530f4273"
   strings:
      $s1 = "cannot create proxy service, it should not happenned!"
      $s2 = "[nss] encrypt_data"
      $s3 = "[nss] decrypt_data"
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: MAL_PeerBlight_Dec25
Repository: Neo23x0/signature-base
Detects: Detects PeerBlight Linux backdoor with systemd persistence artifacts and user-mode masquerading strings, linked to React2Shell exploitation
Author: RussianPanda
Reference: https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell

Pattern signatures:
$s1 = "/bin/systemd-daemon"
      $s2 = "/lib/systemd/system/systemd-agent.service"
      $s3 = "group"
      $s4 = "tag"
      $s5 = "arch"
      $s6 = "softirq"

Detection condition:
uint32(0) == 0x464c457f and 5 of them

Full rule:
rule MAL_PeerBlight_Dec25 {
   meta:
      description = "Detects PeerBlight Linux backdoor with systemd persistence artifacts and user-mode masquerading strings, linked to React2Shell exploitation"
      author = "RussianPanda"
      date = "2025-12-07"
      score = 85
      reference = "https://www.huntress.com/blog/peerblight-linux-backdoor-exploits-react2shell"
      hash = "a605a70d031577c83c093803d11ec7c1e29d2ad530f8e95d9a729c3818c7050d"
   strings:
      $s1 = "/bin/systemd-daemon"
      $s2 = "/lib/systemd/system/systemd-agent.service"
      $s3 = "group"
      $s4 = "tag"
      $s5 = "arch"
      $s6 = "softirq"
   condition:
      uint32(0) == 0x464c457f and 5 of them
}
YARA Detection Rule: Fireball_de_svr
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file de_svr.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$s1 = "cmd.exe /c MD " fullword ascii
      $s2 = "rundll32.exe \"%s\",%s" fullword wide
      $s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
      $s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
      $s5 = "Internet Connect Failed!" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them )

Full rule:
rule Fireball_de_svr {
   meta:
      description = "Detects Fireball malware - file de_svr.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      hash1 = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
      id = "29395239-66d8-5340-b884-9b8f036cc27f"
   strings:
      $s1 = "cmd.exe /c MD " fullword ascii
      $s2 = "rundll32.exe \"%s\",%s" fullword wide
      $s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
      $s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
      $s5 = "Internet Connect Failed!" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 3000KB and 4 of them )
}
YARA Detection Rule: Fireball_lancer
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file lancer.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
      $x2 = "lanceruse.dat" fullword wide

      $s1 = "Lancer.dll" fullword ascii
      $s2 = "RunDll32.exe \"" fullword wide
      $s3 = "Micr.dll" fullword wide
      $s4 = "AG64.dll" fullword wide
      $s5 = "\",Start" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )

Full rule:
rule Fireball_lancer {
   meta:
      description = "Detects Fireball malware - file lancer.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      hash1 = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
      id = "2209bcb4-74a6-5c39-962c-ccd4ce62619e"
   strings:
      $x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
      $x2 = "lanceruse.dat" fullword wide

      $s1 = "Lancer.dll" fullword ascii
      $s2 = "RunDll32.exe \"" fullword wide
      $s3 = "Micr.dll" fullword wide
      $s4 = "AG64.dll" fullword wide
      $s5 = "\",Start" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and ( 1 of ($x*) or 3 of ($s*) ) ) or ( 6 of them )
}
YARA Detection Rule: QQBrowser
Repository: Neo23x0/signature-base
Detects: Not malware but suspicious browser - file QQBrowser.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$s1 = "TerminateProcessWithoutDump" fullword ascii
      $s2 = ".Downloader.dll" fullword wide
      $s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
      $s4 = "QQBrowser_Broker.exe" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

Full rule:
rule QQBrowser {
   meta:
      description = "Not malware but suspicious browser - file QQBrowser.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      score = 50
      hash1 = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
      id = "457507c5-0411-5d72-891b-ae3e428ea2d6"
   strings:
      $s1 = "TerminateProcessWithoutDump" fullword ascii
      $s2 = ".Downloader.dll" fullword wide
      $s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
      $s4 = "QQBrowser_Broker.exe" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
YARA Detection Rule: chrome_elf
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file chrome_elf.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
      $s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii /* base64 encoded string 'http://dv2m1uumnsgtu.cloudfront.net/v4/gtg/%s?action=visit.chelf.install' */
      $s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
      $s10 = "%s %s,Rundll32_Do %s" fullword wide
      $s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
      $s16 = "Rundll32_Do" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )

Full rule:
rule chrome_elf {
   meta:
      description = "Detects Fireball malware - file chrome_elf.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      hash1 = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
      id = "8680d5b5-e26f-5a3f-aeab-b965afe91027"
   strings:
      $x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
      $s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii /* base64 encoded string 'http://dv2m1uumnsgtu.cloudfront.net/v4/gtg/%s?action=visit.chelf.install' */
      $s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
      $s10 = "%s %s,Rundll32_Do %s" fullword wide
      $s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
      $s16 = "Rundll32_Do" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )
}
YARA Detection Rule: Fireball_regkey
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file regkey.exe
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
      $s2 = "ScreenShot" fullword wide
      $s3 = "WINMAIN" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 300KB and all of them )

Full rule:
rule Fireball_regkey {
   meta:
      description = "Detects Fireball malware - file regkey.exe"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      modified = "2022-12-21"
      hash1 = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
      id = "6e22bb93-8c8b-510f-a9e4-6e57c392c2ae"
   strings:
      $s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
      $s2 = "ScreenShot" fullword wide
      $s3 = "WINMAIN" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 300KB and all of them )
}
YARA Detection Rule: Fireball_winsap
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file winsap.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$s1 = "aHR0cDovL2" ascii /* base64 encoded string 'http://d3i1asoswufp5k.cloudfront.net/v4/gtg/%s?action=visit.winsap.work&update3=version,%s' */
      $s2 = "%s\\svchost.exe -k %s" fullword wide
      $s3 = "\\SETUP.dll" wide
      $s4 = "WinSAP.dll" fullword ascii
      $s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
      $s6 = "UPDATE OVERWRITE" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )

Full rule:
rule Fireball_winsap {
   meta:
      description = "Detects Fireball malware - file winsap.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      hash1 = "c7244d139ef9ea431a5b9cc6a2176a6a[PII_REDACTED]c74e215431b99cd5228359"
      id = "e68e7738-f325-5b73-9e61-4e2413b7b7be"
   strings:
      $s1 = "aHR0cDovL2" ascii /* base64 encoded string 'http://d3i1asoswufp5k.cloudfront.net/v4/gtg/%s?action=visit.winsap.work&update3=version,%s' */
      $s2 = "%s\\svchost.exe -k %s" fullword wide
      $s3 = "\\SETUP.dll" wide
      $s4 = "WinSAP.dll" fullword ascii
      $s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
      $s6 = "UPDATE OVERWRITE" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 600KB and 4 of them )
}
YARA Detection Rule: Fireball_archer
Repository: Neo23x0/signature-base
Detects: Detects Fireball malware - file archer.dll
Author: Florian Roth (Nextron Systems)
Reference: https://goo.gl/4pTkGQ

Pattern signatures:
$x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii

      $s1 = "Archer_Input.dll" fullword ascii
      $s2 = "InstallArcherSvc" fullword ascii
      $s3 = "%s_%08X" fullword wide
      $s4 = "d\\\\.\\PhysicalDrive%d" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 400KB and ( $x1 or 3 of them )

Full rule:
rule Fireball_archer {
   meta:
      description = "Detects Fireball malware - file archer.dll"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://goo.gl/4pTkGQ"
      date = "2017-06-02"
      modified = "2022-12-21"
      hash1 = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
      id = "16bb95c1-af69-5688-8999-f097d02d2ffc"
   strings:
      $x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii

      $s1 = "Archer_Input.dll" fullword ascii
      $s2 = "InstallArcherSvc" fullword ascii
      $s3 = "%s_%08X" fullword wide
      $s4 = "d\\\\.\\PhysicalDrive%d" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 400KB and ( $x1 or 3 of them )
}