deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code

Pattern signatures:
$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RAT_NjRat_0_7d_modded_source_code {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RdpThief
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/0x09AL/RdpThief

Pattern signatures:
$name = "RdpThief" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RdpThief {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/0x09AL/RdpThief"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RdpThief" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RunasCs
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/antonioCoco/RunasCs

Pattern signatures:
$name = "RunasCs" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RunasCs {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/antonioCoco/RunasCs"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RunasCs" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_IP6DNS
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_IP6DNS

Pattern signatures:
$name = "NativePayload_IP6DNS" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_IP6DNS {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "NativePayload_IP6DNS" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_ARP
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_ARP

Pattern signatures:
$name = "NativePayload_ARP" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_ARP {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "NativePayload_ARP" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_C2Bridge
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/cobbr/C2Bridge

Pattern signatures:
$name = "C2Bridge" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_C2Bridge {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/cobbr/C2Bridge"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "C2Bridge" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_Infrastructure_Assessment
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/NyaMeeEain/Infrastructure-Assessment

Pattern signatures:
$name = "Infrastructure-Assessment" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_Infrastructure_Assessment {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "Infrastructure-Assessment" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_shellcodeTester
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/tophertimzen/shellcodeTester

Pattern signatures:
$name = "shellcodeTester" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_shellcodeTester {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/tophertimzen/shellcodeTester"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "shellcodeTester" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_gray_hat_csharp_code
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/brandonprry/gray_hat_csharp_code

Pattern signatures:
$name = "gray_hat_csharp_code" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_gray_hat_csharp_code {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/brandonprry/gray_hat_csharp_code"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "gray_hat_csharp_code" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_NativePayload_ReverseShell
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/DamonMohammadbagher/NativePayload_ReverseShell

Pattern signatures:
$name = "NativePayload_ReverseShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_NativePayload_ReverseShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "NativePayload_ReverseShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_DotNetAVBypass
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mandreko/DotNetAVBypass

Pattern signatures:
$name = "DotNetAVBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_DotNetAVBypass {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mandreko/DotNetAVBypass"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "DotNetAVBypass" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_HexyRunner
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/bao7uo/HexyRunner

Pattern signatures:
$name = "HexyRunner" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_HexyRunner {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/bao7uo/HexyRunner"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "HexyRunner" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_SharpOffensiveShell
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/darkr4y/SharpOffensiveShell

Pattern signatures:
$name = "SharpOffensiveShell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_SharpOffensiveShell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/darkr4y/SharpOffensiveShell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "SharpOffensiveShell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_reconness
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/reconness/reconness

Pattern signatures:
$name = "reconness" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_reconness {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/reconness/reconness"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "reconness" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_tvasion
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/loadenmb/tvasion

Pattern signatures:
$name = "tvasion" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_tvasion {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/loadenmb/tvasion"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "tvasion" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_ibombshell
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Telefonica/ibombshell

Pattern signatures:
$name = "ibombshell" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_ibombshell {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Telefonica/ibombshell"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "ibombshell" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_RemoteProcessInjection
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/Mr-Un1k0d3r/RemoteProcessInjection

Pattern signatures:
$name = "RemoteProcessInjection" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_RemoteProcessInjection {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "RemoteProcessInjection" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_njRAT_0_7d_Stub_CSharp
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/NYAN-x-CAT/njRAT-0.7d-Stub-CSharp

Pattern signatures:
$name = "njRAT-0.7d-Stub-CSharp" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_njRAT_0_7d_Stub_CSharp {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/NYAN-x-CAT/njRAT-0.7d-Stub-CSharp"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "njRAT-0.7d-Stub-CSharp" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_CACTUSTORCH
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/mdsecactivebreach/CACTUSTORCH

Pattern signatures:
$name = "CACTUSTORCH" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_CACTUSTORCH {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "CACTUSTORCH" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_PandaSniper
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/QAX-A-Team/PandaSniper

Pattern signatures:
$name = "PandaSniper" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_PandaSniper {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/QAX-A-Team/PandaSniper"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "PandaSniper" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_xbapAppWhitelistBypassPOC
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/jpginc/xbapAppWhitelistBypassPOC

Pattern signatures:
$name = "xbapAppWhitelistBypassPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_xbapAppWhitelistBypassPOC {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "xbapAppWhitelistBypassPOC" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: HKTL_NET_NAME_StageStrike
Repository: Yara-Rules/rules
Detects: Detects .NET red/black-team tools via name
Author: Arnim Rupp
Reference: https://github.com/RedXRanger/StageStrike

Pattern signatures:
$name = "StageStrike" ascii wide
        $compile = "AssemblyTitle" ascii wide

Detection condition:
(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them

Full rule:
rule HKTL_NET_NAME_StageStrike {
    meta:
        description = "Detects .NET red/black-team tools via name"
        reference = "https://github.com/RedXRanger/StageStrike"
        author = "Arnim Rupp"
        date = "2021-01-22"
    strings:
        $name = "StageStrike" ascii wide
        $compile = "AssemblyTitle" ascii wide
    condition:
        (uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and all of them
}
YARA Detection Rule: QuarksPwDump_Gen
Repository: Yara-Rules/rules
Detects: Detects all QuarksPWDump versions
Author: Florian Roth

Pattern signatures:
$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
		$s2 = "%d dumped" fullword ascii
		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
		$s4 = "\\SAM-%u.dmp" fullword ascii

Detection condition:
all of them

Full rule:
rule QuarksPwDump_Gen : Toolkit  {
	meta:
		description = "Detects all QuarksPWDump versions"
		author = "Florian Roth"
		date = "2015-09-29"
		score = 80
		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
	strings:
		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
		$s2 = "%d dumped" fullword ascii
		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
		$s4 = "\\SAM-%u.dmp" fullword ascii
	condition:
		all of them
}
YARA Detection Rule: Bublik
Repository: Yara-Rules/rules
Detects: Bublik Trojan Downloader
Author: Kevin Falcoz

Pattern signatures:
$signature1={63 6F 6E 73 6F 6C 61 73}
        $signature2={63 6C 55 6E 00 69 6E 66 6F 2E 69 6E 69}

Detection condition:
$signature1 and $signature2

Full rule:
rule Bublik
{
   
    meta:
        author="Kevin Falcoz"
        date="29/09/2013"
        description="Bublik Trojan Downloader"
        
    strings:
        $signature1={63 6F 6E 73 6F 6C 61 73}
        $signature2={63 6C 55 6E 00 69 6E 66 6F 2E 69 6E 69}
        
    condition:
        $signature1 and $signature2
}
YARA Detection Rule: Greenbug_Malware_1
Repository: Yara-Rules/rules
Detects: Detects Malware from Greenbug Incident
Author: Florian Roth
Reference: https://goo.gl/urp4CD

Pattern signatures:
$s1 = "vailablez" fullword ascii
      $s2 = "Sfouglr" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 400KB and all of them )

Full rule:
rule Greenbug_Malware_1 {
   meta:
      description = "Detects Malware from Greenbug Incident"
      author = "Florian Roth"
      reference = "https://goo.gl/urp4CD"
      date = "2017-01-25"
      hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
   strings:
      $s1 = "vailablez" fullword ascii
      $s2 = "Sfouglr" fullword ascii
   condition:
      ( uint16(0) == 0x5a4d and filesize < 400KB and all of them )
}
YARA Detection Rule: Greenbug_Malware_2
Repository: Yara-Rules/rules
Detects: Detects Backdoor from Greenbug Incident
Author: Florian Roth
Reference: https://goo.gl/urp4CD

Pattern signatures:
$x1 = "|||Command executed successfully" fullword ascii
      $x2 = "\\Release\\Bot Fresh.pdb" ascii
      $x3 = "C:\\ddd\\a1.txt" fullword wide
      $x4 = "Bots\\Bot5\\x64\\Release" ascii
      $x5 = "Bot5\\Release\\Ism.pdb" ascii
      $x6 = "Bot\\Release\\Ism.pdb" ascii
      $x7 = "\\Bot Fresh\\Release\\Bot" ascii

      $s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
      $s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
      $s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
      $s4 = "SELECT * FROM AntiVirusProduct" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )

Full rule:
rule Greenbug_Malware_2 {
   meta:
      description = "Detects Backdoor from Greenbug Incident"
      author = "Florian Roth"
      reference = "https://goo.gl/urp4CD"
      date = "2017-01-25"
      hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
      hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
      hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
   strings:
      $x1 = "|||Command executed successfully" fullword ascii
      $x2 = "\\Release\\Bot Fresh.pdb" ascii
      $x3 = "C:\\ddd\\a1.txt" fullword wide
      $x4 = "Bots\\Bot5\\x64\\Release" ascii
      $x5 = "Bot5\\Release\\Ism.pdb" ascii
      $x6 = "Bot\\Release\\Ism.pdb" ascii
      $x7 = "\\Bot Fresh\\Release\\Bot" ascii

      $s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
      $s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
      $s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
      $s4 = "SELECT * FROM AntiVirusProduct" fullword wide
   condition:
      ( uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 2 of them ) ) or ( 3 of them )
}