deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Slingshot_APT_Malware_2
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-2[PII_REDACTED]-623[PII_REDACTED]306204-500\\INFO5" fullword wide
      $x_slingshot = {09 46 BE 57 42 DD 70 35 5E }

      $s1 = "Opening service %s for stop access failed.#" fullword wide
      $s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
      $s3 = "\\DosDevices\\amxpci" wide
      $s4 = "lNTLMqSpPD" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 4 of them )

Full rule:
rule Slingshot_APT_Malware_2 {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      hash1 = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
      id = "b85d3d81-0148-5ea0-9eff-d9bb63e3e75b"
   strings:
      $x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-2[PII_REDACTED]-623[PII_REDACTED]306204-500\\INFO5" fullword wide
      $x_slingshot = {09 46 BE 57 42 DD 70 35 5E }

      $s1 = "Opening service %s for stop access failed.#" fullword wide
      $s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
      $s3 = "\\DosDevices\\amxpci" wide
      $s4 = "lNTLMqSpPD" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 900KB and ( 1 of ($x*) or 4 of them )
}
YARA Detection Rule: Slingshot_APT_Malware_3
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$a1 = "chmhlpr.dll" fullword ascii
      $s2 = "%hc%hc%hc%hc" fullword ascii
      $s3 = "%hc%hc%hc=" fullword ascii
      $s4 = "%hc%hc==" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and (
        pe.imphash() == "2f3b3df466e24e0792e0e90d668856bc" or
        pe.exports("dll_u") or
        ( $a1 and 2 of ($s*) )
      )

Full rule:
rule Slingshot_APT_Malware_3 {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      hash1 = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
      id = "4ef1f9a6-3d80-545e-8ac3-c6d46c71fca1"
   strings:
      $a1 = "chmhlpr.dll" fullword ascii
      $s2 = "%hc%hc%hc%hc" fullword ascii
      $s3 = "%hc%hc%hc=" fullword ascii
      $s4 = "%hc%hc==" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and (
        pe.imphash() == "2f3b3df466e24e0792e0e90d668856bc" or
        pe.exports("dll_u") or
        ( $a1 and 2 of ($s*) )
      )
}
YARA Detection Rule: Slingshot_APT_Malware_4
Repository: Neo23x0/signature-base
Detects: Detects malware from Slingshot APT
Author: Florian Roth (Nextron Systems)
Reference: https://securelist.com/apt-slingshot/84312/

Pattern signatures:
$x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide

      $s1 = "Slingshot" fullword ascii
      $s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
      $s3 = "LineRecs.reloc" fullword ascii
      $s4 = "EXITGNG" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         $x1 or 2 of them
      )

Full rule:
rule Slingshot_APT_Malware_4 {
   meta:
      description = "Detects malware from Slingshot APT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://securelist.com/apt-slingshot/84312/"
      date = "2018-03-09"
      hash1 = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
      id = "0f[PII_REDACTED]-550f-ba5d-fb2bf0dfba7f"
   strings:
      $x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide

      $s1 = "Slingshot" fullword ascii
      $s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
      $s3 = "LineRecs.reloc" fullword ascii
      $s4 = "EXITGNG" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         $x1 or 2 of them
      )
}
YARA Detection Rule: WordDoc_PowerShell_URLDownloadToFile
Repository: Neo23x0/signature-base
Detects: Detects Word Document with PowerShell URLDownloadToFile
Author: Florian Roth (Nextron Systems)
Reference: https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/

Pattern signatures:
$w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
      $w2 = "Microsoft Word 97-2003 Document" fullword ascii

      $p1 = "powershell.exe" fullword ascii
      $p2 = "URLDownloadToFile" fullword ascii

Detection condition:
( uint16(0) == 0xcfd0 and 1 of ($w*) and all of ($p*) )

Full rule:
rule WordDoc_PowerShell_URLDownloadToFile {
   meta:
      description = "Detects Word Document with PowerShell URLDownloadToFile"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
      date = "2017-02-23"
      super_rule = 1
      hash1 = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
      hash2 = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
      hash3 = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
      id = "f76c5f91-f67c-5754-b771-73383aba4d64"
   strings:
      $w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
      $w2 = "Microsoft Word 97-2003 Document" fullword ascii

      $p1 = "powershell.exe" fullword ascii
      $p2 = "URLDownloadToFile" fullword ascii
   condition:
      ( uint16(0) == 0xcfd0 and 1 of ($w*) and all of ($p*) )
}
YARA Detection Rule: Suspicious_PowerShell_Code_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious PowerShell code
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = /$[a-z]=new-object net.webclient/ ascii
      $s2 = /$[a-z].DownloadFile\("http:/ ascii
      $s3 = /IEX $[a-zA-Z]{1,8}.downloadstring\(["']http/ ascii nocase
		$s4 = "powershell.exe -w hidden -ep bypass -Enc" ascii
		$s5 = "-w hidden -noni -nop -c \"iex(New-Object" ascii
		$s6 = "powershell.exe reg add HKCU\\software\\microsoft\\windows\\currentversion\\run" nocase

Detection condition:
1 of them

Full rule:
rule Suspicious_PowerShell_Code_1 : FILE {
   meta:
      description = "Detects suspicious PowerShell code"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
		score = 60
      reference = "Internal Research"
      date = "2017-02-22"
      id = "ec3c3682-d2de-52b7-bb49-b021ddf7f8ac"
   strings:
      $s1 = /$[a-z]=new-object net.webclient/ ascii
      $s2 = /$[a-z].DownloadFile\("http:/ ascii
      $s3 = /IEX $[a-zA-Z]{1,8}.downloadstring\(["']http/ ascii nocase
		$s4 = "powershell.exe -w hidden -ep bypass -Enc" ascii
		$s5 = "-w hidden -noni -nop -c \"iex(New-Object" ascii
		$s6 = "powershell.exe reg add HKCU\\software\\microsoft\\windows\\currentversion\\run" nocase
   condition:
      1 of them
}
YARA Detection Rule: Suspicious_PowerShell_WebDownload_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious PowerShell code that downloads from web sites
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
      $s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
      $s3 = "system.net.webclient).downloadfile('http" ascii nocase
      $s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
      $s5 = "GetString([Convert]::FromBase64String(" ascii nocase

      $fp1 = "NuGet.exe" ascii fullword
      $fp2 = "chocolatey.org" ascii
      $fp3 = " GET /"
      $fp4 = " POST /"
      $fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
      $fp6 = " 404 " /* in web server logs */
      $fp7 = "# RemoteSSHConfigurationScript" ascii /* \.vscode\extensions\ms-vscode-remote.remote-ssh */
      $fp8 = "<helpItems" ascii fullword
      $fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
      $fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii

      $fpg1 = "All Rights"
      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg4 = "Copyright"
      $fpg5 = "License"


Detection condition:
1 of ($s*) and not 1 of ($fp*)

Full rule:
rule Suspicious_PowerShell_WebDownload_1 : HIGHVOL FILE {
   meta:
      description = "Detects suspicious PowerShell code that downloads from web sites"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 60
      reference = "Internal Research"
      date = "2017-02-22"
      modified = "2024-04-03"
      nodeepdive = 1
      id = "a763fb82-c840-531b-b631-f282bf035020"
   strings:
      $s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
      $s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
      $s3 = "system.net.webclient).downloadfile('http" ascii nocase
      $s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
      $s5 = "GetString([Convert]::FromBase64String(" ascii nocase

      $fp1 = "NuGet.exe" ascii fullword
      $fp2 = "chocolatey.org" ascii
      $fp3 = " GET /"
      $fp4 = " POST /"
      $fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
      $fp6 = " 404 " /* in web server logs */
      $fp7 = "# RemoteSSHConfigurationScript" ascii /* \.vscode\extensions\ms-vscode-remote.remote-ssh */
      $fp8 = "<helpItems" ascii fullword
      $fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
      $fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii

      $fpg1 = "All Rights"
      $fpg2 = "<html"
      $fpg3 = "<HTML"
      $fpg4 = "Copyright"
      $fpg5 = "License"
      $fpg6 = "<?xml"
      $fpg7 = "Help" fullword
      $fpg8 = "COPYRIGHT" fullword
   condition:
      1 of ($s*) and not 1 of ($fp*)
}
YARA Detection Rule: PowerShell_in_Word_Doc
Repository: Neo23x0/signature-base
Detects: Detects a powershell and bypass keyword in a Word document
Author: Florian Roth (Nextron Systems)
Reference: Internal Research - ME

Pattern signatures:
$s1 = "POwErSHELl.ExE" fullword ascii nocase
      $s2 = "BYPASS" fullword ascii nocase

Detection condition:
( uint16(0) == 0xcfd0 and filesize < 1000KB and all of them )

Full rule:
rule PowerShell_in_Word_Doc {
   meta:
      description = "Detects a powershell and bypass keyword in a Word document"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research - ME"
      date = "2017-06-27"
      score = 50
      hash1 = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
      id = "c9d073ff-25c6-5751-92bf-e22ae7cfd5f5"
   strings:
      $s1 = "POwErSHELl.ExE" fullword ascii nocase
      $s2 = "BYPASS" fullword ascii nocase
   condition:
      ( uint16(0) == 0xcfd0 and filesize < 1000KB and all of them )
}
YARA Detection Rule: Susp_PowerShell_Sep17_1
Repository: Neo23x0/signature-base
Detects: Detects suspicious PowerShell script in combo with VBS or JS 
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
      $x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii

      $s1 = "window.resizeTo 0,0" fullword ascii

Detection condition:
( filesize < 2KB and 1 of them )

Full rule:
rule Susp_PowerShell_Sep17_1 {
   meta:
      description = "Detects suspicious PowerShell script in combo with VBS or JS "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-30"
      score = 60
      hash1 = "8e[PII_REDACTED]5d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
      id = "6d4b9113-173f-5c12-b440-7f1cef9e6ebb"
   strings:
      $x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
      $x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii

      $s1 = "window.resizeTo 0,0" fullword ascii
   condition:
      ( filesize < 2KB and 1 of them )
}
YARA Detection Rule: Susp_PowerShell_Sep17_2
Repository: Neo23x0/signature-base
Detects: Detects suspicious PowerShell script in combo with VBS or JS 
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
$x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
      $x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
      $x3 = "window.moveTo -4000, -4000" fullword ascii

      $s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii

Detection condition:
filesize < 20KB and (
         ( uint16(0) == 0x733c and 1 of ($x*) )
          or 2 of them
      )

Full rule:
rule Susp_PowerShell_Sep17_2 {
   meta:
      description = "Detects suspicious PowerShell script in combo with VBS or JS "
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2017-09-30"
      hash1 = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
      id = "e44d1dfc-0858-5248-a57f-efb5c647f4cc"
   strings:
      $x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
      $x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
      $x3 = "window.moveTo -4000, -4000" fullword ascii

      $s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
   condition:
      filesize < 20KB and (
         ( uint16(0) == 0x733c and 1 of ($x*) )
          or 2 of them
      )
}
YARA Detection Rule: WScript_Shell_PowerShell_Combo
Repository: Neo23x0/signature-base
Detects: Detects malware from Middle Eastern campaign reported by Talos
Author: Florian Roth (Nextron Systems)
Reference: http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html

Pattern signatures:
$s1 = ".CreateObject(\"WScript.Shell\")" ascii

      $p1 = "powershell.exe" fullword ascii
      $p2 = "-ExecutionPolicy Bypass" fullword ascii
      $p3 = "[System.Convert]::FromBase64String(" ascii

      $fp1 = "Copyright: Microsoft Corp." ascii

Detection condition:
filesize < 400KB and $s1 and 1 of ($p*)
      and not 1 of ($fp*)

Full rule:
rule WScript_Shell_PowerShell_Combo {
   meta:
      description = "Detects malware from Middle Eastern campaign reported by Talos"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
      date = "2018-02-07"
      score = 50
      hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
      id = "265ec471-d9ed-5cb6-a32b-cfa62fccdf64"
   strings:
      $s1 = ".CreateObject(\"WScript.Shell\")" ascii

      $p1 = "powershell.exe" fullword ascii
      $p2 = "-ExecutionPolicy Bypass" fullword ascii
      $p3 = "[System.Convert]::FromBase64String(" ascii

      $fp1 = "Copyright: Microsoft Corp." ascii
   condition:
      filesize < 400KB and $s1 and 1 of ($p*)
      and not 1 of ($fp*)
}
YARA Detection Rule: SUSP_PowerShell_String_K32_RemProcess
Repository: Neo23x0/signature-base
Detects: Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/nccgroup/redsnarf

Pattern signatures:
$x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
      $x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
      $s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
      $s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
      $s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
      $s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
      $s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii

Detection condition:
uint16(0) == 0x7566 and filesize < 6000KB and 1 of them

Full rule:
rule SUSP_PowerShell_String_K32_RemProcess {
   meta:
      description = "Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/nccgroup/redsnarf"
      date = "2018-03-31"
      hash3 = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
      hash4 = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
      id = "ad646e19-b132-5594-bea2-d74e96c06ebb"
   strings:
      $x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
      $x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
      $s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
      $s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
      $s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
      $s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
      $s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii
   condition:
      uint16(0) == 0x7566 and filesize < 6000KB and 1 of them
}
YARA Detection Rule: PowerShell_JAB_B64
Repository: Neo23x0/signature-base
Detects: Detects base464 encoded $ sign at the beginning of a string
Author: Florian Roth (Nextron Systems)
Reference: https://twitter.com/ItsReallyNick/status/[PII_REDACTED]22040832

Pattern signatures:
$s1 = "('JAB" ascii wide
      $s2 = "powershell" nocase

Detection condition:
filesize < 30KB and all of them

Full rule:
rule PowerShell_JAB_B64 {
   meta:
      description = "Detects base464 encoded $ sign at the beginning of a string"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/ItsReallyNick/status/[PII_REDACTED]22040832"
      date = "2018-04-02"
      score = 60
      id = "c18fa17b-aaa5-5a89-bc25-3cc51b5af103"
   strings:
      $s1 = "('JAB" ascii wide
      $s2 = "powershell" nocase
   condition:
      filesize < 30KB and all of them
}
YARA Detection Rule: MAL_RANSOM_Ragna_Locker_Apr20_1
Repository: Neo23x0/signature-base
Detects: Detects Ragna Locker Ransomware
Author: Florian Roth (Nextron Systems)
Reference: https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6

Pattern signatures:
$x1 = "---RAGNAR SECRET---" ascii
      $xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
               61 00 67 00 6E 00 61 00 72 00 5F }
      $xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
               00 2E 00 65 00 78 00 65 00 }

      $s1 = "bootfont.bin" wide fullword

      $sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }

      $op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
      $op2 = { 50 c7 85 7a ff ff ff 5c }
      $op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }

Detection condition:
uint16(0) == 0x5a4d and
      filesize < 200KB and
      1 of ($x*) or 4 of them

Full rule:
rule MAL_RANSOM_Ragna_Locker_Apr20_1 {
   meta:
      description = "Detects Ragna Locker Ransomware"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
      date = "2020-04-27"
      hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
      id = "67164cb4-73b7-5c4e-88f9-42379b88c641"
   strings:
      $x1 = "---RAGNAR SECRET---" ascii
      $xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
               61 00 67 00 6E 00 61 00 72 00 5F }
      $xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
               00 2E 00 65 00 78 00 65 00 }

      $s1 = "bootfont.bin" wide fullword

      $sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }

      $op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
      $op2 = { 50 c7 85 7a ff ff ff 5c }
      $op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 200KB and
      1 of ($x*) or 4 of them
}