deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RAT_Greame
Repository: Neo23x0/signature-base
Detects: Detects Greame RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Greame

Pattern signatures:
$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$c = "EditSvr"
		$d = "TLoader"
		$e = "Stroks"
		$f = "Avenger by NhT"
		$g = "####@####"
		$h = "GREAME"

Detection condition:
all of them

Full rule:
rule RAT_Greame
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Greame RAT"
		reference = "http://malwareconfig.com/stats/Greame"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "b90d3747-407a-5552-971f-78ff78f827a6"
	strings:
		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
		$c = "EditSvr"
		$d = "TLoader"
		$e = "Stroks"
		$f = "Avenger by NhT"
		$g = "####@####"
		$h = "GREAME"

	condition:
		all of them
}
YARA Detection Rule: RAT_HawkEye
Repository: Neo23x0/signature-base
Detects: Detects HawkEye RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/HawkEye

Pattern signatures:
$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
		$string5 = "<!-- do not script -->" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "BSPLIT" wide

Detection condition:
$key and $salt and all of ($string*)

Full rule:
rule RAT_HawkEye
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.06.2015"
		description = "Detects HawkEye RAT"
		reference = "http://malwareconfig.com/stats/HawkEye"
		maltype = "KeyLogger"
		filetype = "exe"

		id = "22b1d1e6-feea-5f84-9564-326ad80bbd8d"
	strings:
		$key = "HawkEyeKeylogger" wide
		$salt = "099u787978786" wide
		$string1 = "HawkEye_Keylogger" wide
		$string2 = "holdermail.txt" wide
		$string3 = "wallet.dat" wide
		$string4 = "Keylog Records" wide
		$string5 = "<!-- do not script -->" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "BSPLIT" wide

	condition:
		$key and $salt and all of ($string*)
}
YARA Detection Rule: RAT_Imminent
Repository: Neo23x0/signature-base
Detects: Detects Imminent RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Imminent

Pattern signatures:
$v1a = "DecodeProductKey"
		$v1b = "StartHTTPFlood"
		$v1c = "CodeKey"
		$v1d = "MESSAGEBOX"
		$v1e = "GetFilezillaPasswords"
		$v1f = "DataIn"
		$v1g = "UDPzSockets"
		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

		$v2a = "<URL>k__BackingField"
		$v2b = "<RunHidden>k__BackingField"
		$v2c = "DownloadAndExecute"
		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
		$v2e = "england.png" wide
		$v2f = "Showed Messagebox" wide

Detection condition:
all of ($v1*) or all of ($v2*)

Full rule:
rule RAT_Imminent
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Imminent RAT"
		reference = "http://malwareconfig.com/stats/Imminent"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "deddef60-c309-54e0-a488-ce937ed7eae3"
	strings:
		$v1a = "DecodeProductKey"
		$v1b = "StartHTTPFlood"
		$v1c = "CodeKey"
		$v1d = "MESSAGEBOX"
		$v1e = "GetFilezillaPasswords"
		$v1f = "DataIn"
		$v1g = "UDPzSockets"
		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

		$v2a = "<URL>k__BackingField"
		$v2b = "<RunHidden>k__BackingField"
		$v2c = "DownloadAndExecute"
		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
		$v2e = "england.png" wide
		$v2f = "Showed Messagebox" wide

	condition:
		all of ($v1*) or all of ($v2*)
}
YARA Detection Rule: RAT_Infinity
Repository: Neo23x0/signature-base
Detects: Detects Infinity RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Infinity

Pattern signatures:
$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

Detection condition:
all of them

Full rule:
rule RAT_Infinity
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Infinity RAT"
		reference = "http://malwareconfig.com/stats/Infinity"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "b70f9459-fa84-516f-841d-d9617856eb4d"
	strings:
		$a = "CRYPTPROTECT_PROMPTSTRUCT"
		$b = "discomouse"
		$c = "GetDeepInfo"
		$d = "AES_Encrypt"
		$e = "StartUDPFlood"
		$f = "BATScripting" wide
		$g = "FBqINhRdpgnqATxJ.html" wide
		$i = "magic_key" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_JavaDropper
Repository: Neo23x0/signature-base
Detects: Detects JavaDropper RAT
Author: Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)
Reference: http://malwareconfig.com/stats/JavaDropper

Pattern signatures:
$jar = "META-INF/MANIFEST.MF"

		$b1 = "config.ini"
		$b2 = "password.ini"

		$c1 = "stub/stub.dll"

Detection condition:
$jar and (all of ($b*) or all of ($c*))

Full rule:
rule RAT_JavaDropper
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
		date = "01.10.2015"
		description = "Detects JavaDropper RAT"
		reference = "http://malwareconfig.com/stats/JavaDropper"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$jar = "META-INF/MANIFEST.MF"

		$b1 = "config.ini"
		$b2 = "password.ini"

		$c1 = "stub/stub.dll"

	condition:
		$jar and (all of ($b*) or all of ($c*))
}
YARA Detection Rule: RAT_LostDoor
Repository: Neo23x0/signature-base
Detects: Detects LostDoor RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/LostDoor

Pattern signatures:
$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
		$a1 = "*mlt* = %"
		$a2 = "*ip* = %"
		$a3 = "*victimo* = %"
		$a4 = "*name* = %"
		$b5 = "[START]"
		$b6 = "[DATA]"
		$b7 = "We Control Your Digital World" wide ascii
		$b8 = "RC4Initialize" wide ascii
		$b9 = "RC4Decrypt" wide ascii

Detection condition:
all of ($a*) or all of ($b*)

Full rule:
rule RAT_LostDoor
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LostDoor RAT"
		reference = "http://malwareconfig.com/stats/LostDoor"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "f86ae7a1-2182-5b2e-8f9e-9e8456f574bc"
	strings:
		$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
		$a1 = "*mlt* = %"
		$a2 = "*ip* = %"
		$a3 = "*victimo* = %"
		$a4 = "*name* = %"
		$b5 = "[START]"
		$b6 = "[DATA]"
		$b7 = "We Control Your Digital World" wide ascii
		$b8 = "RC4Initialize" wide ascii
		$b9 = "RC4Decrypt" wide ascii

	condition:
		all of ($a*) or all of ($b*)
}
YARA Detection Rule: RAT_LuminosityLink
Repository: Neo23x0/signature-base
Detects: Detects LuminosityLink RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/LuminosityLink

Pattern signatures:
$a = "SMARTLOGS" wide
		$b = "RUNPE" wide
		$c = "b.Resources" wide
		$d = "CLIENTINFO*" wide
		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
		$f = "Proactive Anti-Malware has been manually activated!" wide
		$g = "REMOVEGUARD" wide
		$h = "C0n1f8" wide
		$i = "Luminosity" wide
		$j = "LuminosityCryptoMiner" wide
		$k = "MANAGER*CLIENTDETAILS*" wide

Detection condition:
all of them

Full rule:
rule RAT_LuminosityLink
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LuminosityLink RAT"
		reference = "http://malwareconfig.com/stats/LuminosityLink"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "163fe10c-38a1-53d3-b3a5-4240229e0306"
	strings:
		$a = "SMARTLOGS" wide
		$b = "RUNPE" wide
		$c = "b.Resources" wide
		$d = "CLIENTINFO*" wide
		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
		$f = "Proactive Anti-Malware has been manually activated!" wide
		$g = "REMOVEGUARD" wide
		$h = "C0n1f8" wide
		$i = "Luminosity" wide
		$j = "LuminosityCryptoMiner" wide
		$k = "MANAGER*CLIENTDETAILS*" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_LuxNet
Repository: Neo23x0/signature-base
Detects: Detects LuxNet RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/LuxNet

Pattern signatures:
$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

Detection condition:
all of them

Full rule:
rule RAT_LuxNet
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects LuxNet RAT"
		reference = "http://malwareconfig.com/stats/LuxNet"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "277db509-5ba0-5d1b-b17a-d5914f1f1650"
	strings:
		$a = "GetHashCode"
		$b = "Activator"
		$c = "WebClient"
		$d = "op_Equality"
		$e = "dickcursor.cur" wide
		$f = "{0}|{1}|{2}" wide

	condition:
		all of them
}
YARA Detection Rule: RAT_NanoCore
Repository: Neo23x0/signature-base
Detects: Detects NanoCore RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/NanoCore

Pattern signatures:
$a = "NanoCore"
		$b = "ClientPlugin"
		$c = "ProjectData"
		$d = "DESCrypto"
		$e = "KeepAlive"
		$f = "IPNETROW"
		$g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
		$key = {43 6f 24 cb 95 30 38 39}

Detection condition:
6 of them

Full rule:
rule RAT_NanoCore
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects NanoCore RAT"
		reference = "http://malwareconfig.com/stats/NanoCore"
		maltype = "Remote Access Trojan"
		filetype = "exe"

	strings:
		$a = "NanoCore"
		$b = "ClientPlugin"
		$c = "ProjectData"
		$d = "DESCrypto"
		$e = "KeepAlive"
		$f = "IPNETROW"
		$g = "LogClientMessage"
		$h = "|ClientHost"
		$i = "get_Connected"
		$j = "#=q"
		$key = {43 6f 24 cb 95 30 38 39}

	condition:
		6 of them
}
YARA Detection Rule: RAT_NetWire
Repository: Neo23x0/signature-base
Detects: Detects NetWire RAT
Author: Kevin Breen <kevin@techanarchy.net> & David Cannings
Reference: http://malwareconfig.com/stats/NetWire

Pattern signatures:
$exe1 = "%.2d-%.2d-%.4d"
		$exe2 = "%s%.2d-%.2d-%.4d"
		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$exe4 = "wcnwClass"
		$exe5 = "[Ctrl+%c]"
		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
		$exe7 = "%s\\.purple\\accounts.xml"

Detection condition:
all of them

Full rule:
rule RAT_NetWire
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
		date = "01.04.2014"
		description = "Detects NetWire RAT"
		reference = "http://malwareconfig.com/stats/NetWire"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "f0077e8c-3e6a-5a98-9171-b0d81f24d27a"
	strings:
		$exe1 = "%.2d-%.2d-%.4d"
		$exe2 = "%s%.2d-%.2d-%.4d"
		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
		$exe4 = "wcnwClass"
		$exe5 = "[Ctrl+%c]"
		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
		$exe7 = "%s\\.purple\\accounts.xml"

	condition:
		all of them
}
YARA Detection Rule: RAT_Pandora
Repository: Neo23x0/signature-base
Detects: Detects Pandora RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Pandora

Pattern signatures:
$a = "Can't get the Windows version"
		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
		$c = "JPEG error #%d" wide
		$d = "Cannot assign a %s to a %s" wide
		$g = "%s, ProgID:"
		$h = "clave"
		$i = "Shell_TrayWnd"
		$j = "melt.bat"
		$k = "\\StubPath"
		$l = "\\logs.dat"
		$m = "1027|Operation has been canceled!"
		$n = "466|You need to plug-in! Double click to install... |"
		$0 = "33|[Keylogger Not Activated!]"

Detection condition:
all of them

Full rule:
rule RAT_Pandora
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Pandora RAT"
		reference = "http://malwareconfig.com/stats/Pandora"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "d31e4366-8911-5c9c-92dc-a99f5233c626"
	strings:
		$a = "Can't get the Windows version"
		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
		$c = "JPEG error #%d" wide
		$d = "Cannot assign a %s to a %s" wide
		$g = "%s, ProgID:"
		$h = "clave"
		$i = "Shell_TrayWnd"
		$j = "melt.bat"
		$k = "\\StubPath"
		$l = "\\logs.dat"
		$m = "1027|Operation has been canceled!"
		$n = "466|You need to plug-in! Double click to install... |"
		$0 = "33|[Keylogger Not Activated!]"

	condition:
		all of them
}
YARA Detection Rule: RAT_Paradox
Repository: Neo23x0/signature-base
Detects: Detects Paradox RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Paradox

Pattern signatures:
$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

Detection condition:
all of them

Full rule:
rule RAT_Paradox
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Paradox RAT"
		reference = "http://malwareconfig.com/stats/Paradox"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "2f1e6226-799b-54eb-a4a4-6c0f1bf561b4"
	strings:
		$a = "ParadoxRAT"
		$b = "Form1"
		$c = "StartRMCam"
		$d = "Flooders"
		$e = "SlowLaris"
		$f = "SHITEMID"
		$g = "set_Remote_Chat"

	condition:
		all of them
}
YARA Detection Rule: RAT_Plasma
Repository: Neo23x0/signature-base
Detects: Detects Plasma RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Plasma

Pattern signatures:
$a = "Miner: Failed to Inject." wide
		$b = "Started GPU Mining on:" wide
		$c = "BK: Hard Bot Killer Ran Successfully!" wide
		$d = "Uploaded Keylogs Successfully!" wide
		$e = "No Slowloris Attack is Running!" wide
		$f = "An ARME Attack is Already Running on" wide
		$g = "Proactive Bot Killer Enabled!" wide
		$h = "PlasmaRAT" wide ascii
		$i = "AntiEverything" wide ascii

Detection condition:
all of them

Full rule:
rule RAT_Plasma
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Plasma RAT"
		reference = "http://malwareconfig.com/stats/Plasma"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "2a19c0de-0078-5487-869c-1bcabea57300"
	strings:
		$a = "Miner: Failed to Inject." wide
		$b = "Started GPU Mining on:" wide
		$c = "BK: Hard Bot Killer Ran Successfully!" wide
		$d = "Uploaded Keylogs Successfully!" wide
		$e = "No Slowloris Attack is Running!" wide
		$f = "An ARME Attack is Already Running on" wide
		$g = "Proactive Bot Killer Enabled!" wide
		$h = "PlasmaRAT" wide ascii
		$i = "AntiEverything" wide ascii

	condition:
		all of them
}
YARA Detection Rule: RAT_PoisonIvy
Repository: Neo23x0/signature-base
Detects: Detects PoisonIvy RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/PoisonIvy

Pattern signatures:
$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
		$string1 = "CONNECT %s:%i HTTP/1.0"
		$string2 = "ws2_32"
		$string3 = "cks=u"
		$string4 = "thj@h"
		$string5 = "advpack"

Detection condition:
$stub at 0x1620 and all of ($string*) or (all of them)

Full rule:
rule RAT_PoisonIvy
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects PoisonIvy RAT"
		reference = "http://malwareconfig.com/stats/PoisonIvy"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "371686d3-878f-56fc-a702-ec49845f486b"
	strings:
		$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
		$string1 = "CONNECT %s:%i HTTP/1.0"
		$string2 = "ws2_32"
		$string3 = "cks=u"
		$string4 = "thj@h"
		$string5 = "advpack"

	condition:
		$stub at 0x1620 and all of ($string*) or (all of them)
}
YARA Detection Rule: RAT_PredatorPain
Repository: Neo23x0/signature-base
Detects: Detects PredatorPain RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/PredatorPain

Pattern signatures:
$string1 = "holderwb.txt" wide
		$string3 = "There is a file attached to this email" wide
		$string4 = "screens\\screenshot" wide
		$string5 = "Disablelogger" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "clearie" wide
		$string8 = "clearff" wide
		$string9 = "emails should be sent to you shortly" wide
		$string10 = "jagex_cache\\regPin" wide
		$string11 = "open=Sys.exe" wide
		$ver1 = "PredatorLogger" wide
		$ver2 = "EncryptedCredentials" wide
		$ver3 = "Predator Pain" wide

Detection condition:
7 of ($string*) and any of ($ver*)

Full rule:
rule RAT_PredatorPain
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects PredatorPain RAT"
		reference = "http://malwareconfig.com/stats/PredatorPain"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "c6670179-871d-5a57-983b-d77354e2ede9"
	strings:
		$string1 = "holderwb.txt" wide
		$string3 = "There is a file attached to this email" wide
		$string4 = "screens\\screenshot" wide
		$string5 = "Disablelogger" wide
		$string6 = "\\pidloc.txt" wide
		$string7 = "clearie" wide
		$string8 = "clearff" wide
		$string9 = "emails should be sent to you shortly" wide
		$string10 = "jagex_cache\\regPin" wide
		$string11 = "open=Sys.exe" wide
		$ver1 = "PredatorLogger" wide
		$ver2 = "EncryptedCredentials" wide
		$ver3 = "Predator Pain" wide

	condition:
		7 of ($string*) and any of ($ver*)
}
YARA Detection Rule: RAT_Punisher
Repository: Neo23x0/signature-base
Detects: Detects Punisher RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/Punisher

Pattern signatures:
$a = "abccba"
		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
		$d = "SpyTheSpy" wide ascii
		$e = "wireshark" wide
		$f = "apateDNS" wide
		$g = "abccbaDanabccb"

Detection condition:
all of them

Full rule:
rule RAT_Punisher
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Punisher RAT"
		reference = "http://malwareconfig.com/stats/Punisher"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "1e16b3c7-9656-5570-afa2-542367aa14d8"
	strings:
		$a = "abccba"
		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
		$d = "SpyTheSpy" wide ascii
		$e = "wireshark" wide
		$f = "apateDNS" wide
		$g = "abccbaDanabccb"

	condition:
		all of them
}
YARA Detection Rule: RAT_PythoRAT
Repository: Neo23x0/signature-base
Detects: Detects Python RAT
Author: Kevin Breen <kevin@techanarchy.net>
Reference: http://malwareconfig.com/stats/PythoRAT

Pattern signatures:
$a = "TKeylogger"
		$b = "uFileTransfer"
		$c = "TTDownload"
		$d = "SETTINGS"
		$e = "Unknown" wide
		$f = "#@#@#"
		$g = "PluginData"
		$i = "OnPluginMessage"

Detection condition:
all of them

Full rule:
rule RAT_PythoRAT
{
	meta:
		author = "Kevin Breen <kevin@techanarchy.net>"
		date = "01.04.2014"
		description = "Detects Python RAT"
		reference = "http://malwareconfig.com/stats/PythoRAT"
		maltype = "Remote Access Trojan"
		filetype = "exe"

		id = "fc98c513-1abf-5331-b351-f6182e5b19c5"
	strings:
		$a = "TKeylogger"
		$b = "uFileTransfer"
		$c = "TTDownload"
		$d = "SETTINGS"
		$e = "Unknown" wide
		$f = "#@#@#"
		$g = "PluginData"
		$i = "OnPluginMessage"

	condition:
		all of them
}
YARA Detection Rule: RAT_QRat
Repository: Neo23x0/signature-base
Detects: Detects QRAT
Author: Kevin Breen @KevTheHermit
Reference: http://malwareconfig.com

Pattern signatures:
$a0 = "e-data"
		$a1 = "quaverse/crypter"
		$a2 = "Qrypt.class"
		$a3 = "Jarizer.class"
		$a4 = "URLConnection.class"

Detection condition:
4 of them

Full rule:
rule RAT_QRat
{
	meta:
		author = "Kevin Breen @KevTheHermit"
		date = "01.08.2015"
		description = "Detects QRAT"
		reference = "http://malwareconfig.com"
		maltype = "Remote Access Trojan"
		filetype = "jar"

		id = "2ee645a3-1e01-513c-a636-098e445adeca"
	strings:
		$a0 = "e-data"
		$a1 = "quaverse/crypter"
		$a2 = "Qrypt.class"
		$a3 = "Jarizer.class"
		$a4 = "URLConnection.class"

	condition:
		4 of them
}
YARA Detection Rule: RAT_Sakula
Repository: Neo23x0/signature-base
Detects: Detects Sakula v1.0 RAT
Author: Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings
Reference: http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara

Pattern signatures:
$s1 = "%d_of_%d_for_%s_on_%s"
		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
		$s3 = "=%s&type=%d"
		$s4 = "?photoid="
		$s5 = "iexplorer"
		$s6 = "net start \"%s\""
		$s7 = "cmd.exe /c rundll32 \"%s\""

		$v1_1 = "MicroPlayerUpdate.exe"
		$v1_2 = "CCPUpdate"
		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }

		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }

		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
		$opcodes3 = { 8

Detection condition:
uint16(0) == 0x5a4d and (
			(3 of ($s*) and any of ($v1_*)) or
			(any of ($serial0*)) or
			(any of ($opcodes*))
		)
      and not 1 of ($fp*)

Full rule:
rule RAT_Sakula
{
	meta:
		date = "2015-10-13"
		description = "Detects Sakula v1.0 RAT"
		author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings"
		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"

		id = "4be3179c-3b91-56db-bba9-9ccc42066f96"
	strings:
		$s1 = "%d_of_%d_for_%s_on_%s"
		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
		$s3 = "=%s&type=%d"
		$s4 = "?photoid="
		$s5 = "iexplorer"
		$s6 = "net start \"%s\""
		$s7 = "cmd.exe /c rundll32 \"%s\""

		$v1_1 = "MicroPlayerUpdate.exe"
		$v1_2 = "CCPUpdate"
		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }

		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }

		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
		$opcodes3 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
		$opcodes4 = { 30 14 38 8D 0C 38 40 FE C2 3B C6 }
		$opcodes5 = { 30 14 39 8D 04 39 41 FE C2 3B CE }

		$fp1 = "Symantec Corporation" ascii wide
	condition:
		uint16(0) == 0x5a4d and (
			(3 of ($s*) and any of ($v1_*)) or
			(any of ($serial0*)) or
			(any of ($opcodes*))
		)
      and not 1 of ($fp*)
}