deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: OpClandestineWolf
Repository: Yara-Rules/rules
Detects: Operation Clandestine Wolf signature based on OSINT from 06.23.15
Author: NDF

Pattern signatures:
$s0 = "flash.Media.Sound()"
        $s1 = "call Kernel32!VirtualAlloc(0x1f140000hash$=0x10000hash$=0x1000hash$=0x40)"
        $s2 = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
        $s3 = "NetStream"

Detection condition:
all of them

Full rule:
rule OpClandestineWolf 
{
 
   meta:
        alert_severity = "HIGH"
        log = "false"
        author = "NDF"
        weight = 10
        alert = true
        source = " https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"
        version = 1
        date = "2015-06-23"
        description = "Operation Clandestine Wolf signature based on OSINT from 06.23.15"
        hash0 = "1a4b710621ef2e69b1f7790ae9b7a288"
        hash1 = "917c92e8662faf96fffb8ffe7b7c80fb"
        hash2 = "975b458cb80395fa32c9dda759cb3f7b"
        hash3 = "3ed34de8609cd274e49bbd795f21acc4"
        hash4 = "b1a55ec420dd6d24ff9e762c7b753868"
        hash5 = "afd753a42036000ad476dcd81b56b754"
        hash6 = "fad20abf8aa4eda0802504d806280dd7"
        hash7 = "ab621059de2d1c92c3e7514e4b51751a"
        hash8 = "510b77a4b075f09202209f989582dbea"
        hash9 = "d1b1abfcc2d547e1ea1a4bb82294b9a3"
        hash10 = "4692337bf7584f6bda464b9a76d268c1"
        hash11 = "7cae5757f3ba9fef0a22ca0d56188439"
        hash12 = "1a7ba923c6aa39cc9cb289a17599fce0"
        hash13 = "f86db1905b3f4447eb5728859f9057b5"
        hash14 = "37c6d1d3054e554e13d40ea42458ebed"
        hash15 = "3e7430a09a44c0d1000f76c3adc6f4fa"
        hash16 = "98eb249e4ddc4897b8be6fe838051af7"
        hash17 = "1b57a7fad852b1d686c72e96f7837b44"
        hash18 = "ffb84b8561e49a8db60e0001f630831f"
        hash19 = "98eb249e4ddc4897b8be6fe838051af7"
        hash20 = "dfb4025352a80c2d81b84b37ef00bcd0"
        hash21 = "4457e89f4aec692d[PII_REDACTED]e0a3ba"
        hash22 = "48de562acb62b469480b8e29821f33b8"
        hash23 = "7a7eed9f2d1807f55a9308e21d81cccd"
        hash24 = "6817b29e9832d8fd85dcbe4af176efb6"

   strings:
        $s0 = "flash.Media.Sound()"
        $s1 = "call Kernel32!VirtualAlloc(0x1f140000hash$=0x10000hash$=0x1000hash$=0x40)"
        $s2 = "{4D36E972-E325-11CE-BFC1-08002BE10318}"
        $s3 = "NetStream"

    condition:
        all of them
}
YARA Detection Rule: Odinaff_swift
Repository: Yara-Rules/rules
Detects: Odinaff malware
Author: @j0sm1
Reference: https://www.symantec.com/security_response/writeup.jsp?docid=2016[PII_REDACTED]-99

Pattern signatures:
$s1 = "getapula.pdb"
                $i1 = "wtsapi32.dll"
                $i2 = "cmpbk32.dll"
                $i3 = "PostMessageA"
                $i4 = "PeekMessageW"
                $i5 = "DispatchMessageW"
                $i6 = "WTSEnumerateSessionsA"

Detection condition:
($s1 or pe.exports("Tyman32")) and (2 of ($i*))

Full rule:
rule Odinaff_swift : malware odinaff swift raw{
        meta:
                author = "@j0sm1"
                date = "2016/10/27"
                description = "Odinaff malware"
                reference = "https://www.symantec.com/security_response/writeup.jsp?docid=2016[PII_REDACTED]-99"
                filetype = "binary"

        strings:

                $s1 = "getapula.pdb"
                $i1 = "wtsapi32.dll"
                $i2 = "cmpbk32.dll"
                $i3 = "PostMessageA"
                $i4 = "PeekMessageW"
                $i5 = "DispatchMessageW"
                $i6 = "WTSEnumerateSessionsA"

        condition:
                ($s1 or pe.exports("Tyman32")) and (2 of ($i*))
}
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20121
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20121.xml
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
        $s1 = "<name>20121.dll</name>" fullword ascii
        $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<platform type=\"1\">" fullword ascii
        $s5 = "</plugin>" fullword ascii
        $s6 = "</pluginConfig>" fullword ascii
        $s7 = "<pluginConfig>" fullword ascii
        $s8 = "</platform>" fullword ascii
        $s9 = "</lpConfig>" fullword ascii
        $s10 = "<lpConfig>" fullword ascii

Detection condition:
9 of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20121 
{

    meta:
        description = "FiveEyes QUERTY Malware - file 20121.xml"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "8263fb58350f3b1d3c4220a602421232d5e40726"

    strings:
        $s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
        $s1 = "<name>20121.dll</name>" fullword ascii
        $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<platform type=\"1\">" fullword ascii
        $s5 = "</plugin>" fullword ascii
        $s6 = "</pluginConfig>" fullword ascii
        $s7 = "<pluginConfig>" fullword ascii
        $s8 = "</platform>" fullword ascii
        $s9 = "</lpConfig>" fullword ascii
        $s10 = "<lpConfig>" fullword ascii
   
    condition:
        9 of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20123_sys
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20123.sys.bin
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "20123.dll" fullword ascii
        $s1 = "kbdclass.sys" fullword wide
        $s2 = "IoFreeMdl" fullword ascii
        $s3 = "ntoskrnl.exe" fullword ascii
        $s4 = "KfReleaseSpinLock" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20123_sys 
{
   
    meta:
        description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
  
    strings:
        $s0 = "20123.dll" fullword ascii
        $s1 = "kbdclass.sys" fullword wide
        $s2 = "IoFreeMdl" fullword ascii
        $s3 = "ntoskrnl.exe" fullword ascii
        $s4 = "KfReleaseSpinLock" fullword ascii
  
    condition:
        all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20123_cmdDef
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20123_cmdDef.xml
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
        $s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
        $s2 = "<commands/>" fullword ascii
        $s3 = "</version>" fullword ascii
        $s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
        $s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
        $s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
        $s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
        $s8 = "<dllDepend>None</dllDepend>" fullword ascii
        $s9 = "<minorType>0</minorType>" fullword ascii
        $s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
        $s11 = "</comments>" fullword ascii
        $s12 = "<comments>" fullword ascii
        $s13 = "<majorType>1</majorType>" fullword ascii
        $s14 = "<files>None</files>"

Detection condition:
14 of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20123_cmdDef 
{
  
    meta:
        description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
   
   strings:
        $s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
        $s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
        $s2 = "<commands/>" fullword ascii
        $s3 = "</version>" fullword ascii
        $s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
        $s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
        $s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
        $s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
        $s8 = "<dllDepend>None</dllDepend>" fullword ascii
        $s9 = "<minorType>0</minorType>" fullword ascii
        $s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
        $s11 = "</comments>" fullword ascii
        $s12 = "<comments>" fullword ascii
        $s13 = "<majorType>1</majorType>" fullword ascii
        $s14 = "<files>None</files>" fullword ascii
        $s15 = "<poc>Erebus</poc>" fullword ascii
        $s16 = "</plugin>" fullword ascii
        $s17 = "<team>None</team>" fullword ascii
        $s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
        $s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
        $s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
  
    condition:
        14 of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20121_dll
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20121.dll.bin
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
        $s1 = "20121.dll" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20121_dll 
{
    
    meta:
        description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "89504d91c5539a366e153894c1bc[PII_REDACTED]b"
    
    strings:
        $s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
        $s1 = "20121.dll" fullword ascii
   
    condition:
        all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20123
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20123.xml
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
        $s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
        $s2 = "<name>20123.sys</name>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
        $s5 = "<platform type=\"1\">" fullword ascii
        $s6 = "</plugin>" fullword ascii
        $s7 = "</pluginConfig>" fullword ascii
        $s8 = "<pluginConfig>" fullword ascii
        $s9 = "</platform>" fullword ascii
        $s10 = "</lpConfig>" fullword ascii
        $s11 = "<lpConfig>" fullword ascii

Detection condition:
9 of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20123 
{

    meta:
        description = "FiveEyes QUERTY Malware - file 20123.xml"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"

    strings:
        $s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
        $s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
        $s2 = "<name>20123.sys</name>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
        $s5 = "<platform type=\"1\">" fullword ascii
        $s6 = "</plugin>" fullword ascii
        $s7 = "</pluginConfig>" fullword ascii
        $s8 = "<pluginConfig>" fullword ascii
        $s9 = "</platform>" fullword ascii
        $s10 = "</lpConfig>" fullword ascii
        $s11 = "<lpConfig>" fullword ascii
   
    condition:
        9 of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwareqwerty_20120
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20120.xml
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
        $s1 = "<name>20120.dll</name>" fullword ascii
        $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<platform type=\"1\">" fullword ascii
        $s5 = "</plugin>" fullword ascii
        $s6 = "</pluginConfig>" fullword ascii
        $s7 = "<pluginConfig>" fullword ascii
        $s8 = "</platform>" fullword ascii
        $s9 = "</lpConfig>" fullword ascii
        $s10 = "<lpConfig>" fullword ascii

Detection condition:
all of them

Full rule:
rule FiveEyes_QUERTY_Malwareqwerty_20120 
{

    meta:
        description = "FiveEyes QUERTY Malware - file 20120.xml"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "597082f05bfd3225587d480c30f54a7a1326a892"

    strings:
        $s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
        $s1 = "<name>20120.dll</name>" fullword ascii
        $s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
        $s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
        $s4 = "<platform type=\"1\">" fullword ascii
        $s5 = "</plugin>" fullword ascii
        $s6 = "</pluginConfig>" fullword ascii
        $s7 = "<pluginConfig>" fullword ascii
        $s8 = "</platform>" fullword ascii
        $s9 = "</lpConfig>" fullword ascii
        $s10 = "<lpConfig>" fullword ascii
   
    condition:
        all of them
}
YARA Detection Rule: FiveEyes_QUERTY_Malwaresig_20121_cmdDef
Repository: Yara-Rules/rules
Detects: FiveEyes QUERTY Malware - file 20121_cmdDef.xml
Author: Florian Roth
Reference: http://www.spiegel.de/media/media-35668.pdf

Pattern signatures:
$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
        $s1 = "<message>Failed to get File Time</message>" fullword ascii
        $s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
        $s3 = "<message>Failed to set File Time</message>" fullword ascii
        $s4 = "</commands>" fullword ascii
        $s5 = "<commands>" fullword ascii
        $s6 = "</version>" fullword ascii
        $s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
        $s8 = "<message>No Comms. with Driver</message>" fullword ascii
        $s9 = "</error>" fullword ascii
        $s10 = "<message>Invalid File Size</message>" fullword ascii
        $s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
        $s12 = "<message>File Size Mismatch</message>" fullword ascii
        $s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
        $s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
        

Detection condition:
12 of them

Full rule:
rule FiveEyes_QUERTY_Malwaresig_20121_cmdDef 
{

    meta:
        description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
        author = "Florian Roth"
        reference = "http://www.spiegel.de/media/media-35668.pdf"
        date = "2015/01/18"
        hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"

    strings:
        $s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
        $s1 = "<message>Failed to get File Time</message>" fullword ascii
        $s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
        $s3 = "<message>Failed to set File Time</message>" fullword ascii
        $s4 = "</commands>" fullword ascii
        $s5 = "<commands>" fullword ascii
        $s6 = "</version>" fullword ascii
        $s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
        $s8 = "<message>No Comms. with Driver</message>" fullword ascii
        $s9 = "</error>" fullword ascii
        $s10 = "<message>Invalid File Size</message>" fullword ascii
        $s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
        $s12 = "<message>File Size Mismatch</message>" fullword ascii
        $s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
        $s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
        $s15 = "<dllDepend>None</dllDepend>" fullword ascii
        $s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
        $s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
        $s18 = "<minorType>0</minorType>" fullword ascii
        $s19 = "<code>00001002</code>" fullword ascii
        $s20 = "<code>00001001</code>" fullword ascii
   
    condition:
        12 of them
}
YARA Detection Rule: Grozlex
Repository: Yara-Rules/rules
Detects: Grozlex Stealer - Possible HCStealer
Author: Kevin Falcoz

Pattern signatures:
$signature={4C 00 6F 00 67 00 73 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 20 00 62 00 79 00 20 00 69 00 43 00 6F 00 7A 00 65 00 6E}

Detection condition:
$signature

Full rule:
rule Grozlex : Stealer
{
	meta:
		author="Kevin Falcoz"
		date="20/08/2013"
		description="Grozlex Stealer - Possible HCStealer"
		
	strings:
		$signature={4C 00 6F 00 67 00 73 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 65 00 64 00 20 00 62 00 79 00 20 00 69 00 43 00 6F 00 7A 00 65 00 6E}
	
	condition:
		$signature
}
YARA Detection Rule: KelihosHlux
Repository: Yara-Rules/rules
Detects: http://malwared.ru
Author: @malpush

Pattern signatures:
$KelihosHlux_HexString = { 73 20 7D 8B FE 95 E4 12 4F 3F 99 3F 6E C8 28 26 C2 41 D9 8F C1 6A 72 A6 CE 36 0F 73 DD 2A 72 B0 CC D1 07 8B 2B 98 73 0E 7E 8C 07 DC 6C 71 63 F4 23 27 DD 17 56 AE AB 1E 30 52 E7 54 51 F7 20 ED C7 2D 4B 72 E0 77 8E B4 D2 A8 0D 8D 6A 64 F9 B7 7B 08 70 8D EF F3 9A 77 F6 0D 88 3A 8F BB C8 89 F5 F8 39 36 BA 0E CB 38 40 BF 39 73 F4 01 DC C1 17 BF C1 76 F6 84 8F BD 87 76 BC 7F 85 41 81 BD C6 3F BC 39 BD C0 89 47 3E 92 BD 80 60 9D 89 15 6A C6 B9 89 37 C4 FF 00 3D 45 38 09 CD 29 00 90 BB B6 38 FD 28 9C 01 39 0E F9 30 A9 66 6B 19 C9 F8 4C 3E B1 C7 CB 1B C9 3A 87 3E 8E 74 E7 71 D1 }

Detection condition:
$KelihosHlux_HexString

Full rule:
rule KelihosHlux
{
  meta:
	author = "@malpush"
	maltype = "KelihosHlux"
	description = "http://malwared.ru"
	date = "22/02/2014"
  strings:
    $KelihosHlux_HexString = { 73 20 7D 8B FE 95 E4 12 4F 3F 99 3F 6E C8 28 26 C2 41 D9 8F C1 6A 72 A6 CE 36 0F 73 DD 2A 72 B0 CC D1 07 8B 2B 98 73 0E 7E 8C 07 DC 6C 71 63 F4 23 27 DD 17 56 AE AB 1E 30 52 E7 54 51 F7 20 ED C7 2D 4B 72 E0 77 8E B4 D2 A8 0D 8D 6A 64 F9 B7 7B 08 70 8D EF F3 9A 77 F6 0D 88 3A 8F BB C8 89 F5 F8 39 36 BA 0E CB 38 40 BF 39 73 F4 01 DC C1 17 BF C1 76 F6 84 8F BD 87 76 BC 7F 85 41 81 BD C6 3F BC 39 BD C0 89 47 3E 92 BD 80 60 9D 89 15 6A C6 B9 89 37 C4 FF 00 3D 45 38 09 CD 29 00 90 BB B6 38 FD 28 9C 01 39 0E F9 30 A9 66 6B 19 C9 F8 4C 3E B1 C7 CB 1B C9 3A 87 3E 8E 74 E7 71 D1 }
   
  condition:
    $KelihosHlux_HexString
}
YARA Detection Rule: xRAT
Repository: Yara-Rules/rules
Author:  Kevin Breen <kevin@techanarchy.net>

Pattern signatures:
$v1a = "DecodeProductKey"
        $v1b = "StartHTTPFlood"
        $v1c = "CodeKey"
        $v1d = "MESSAGEBOX"
        $v1e = "GetFilezillaPasswords"
        $v1f = "DataIn"
        $v1g = "UDPzSockets"
        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

        $v2a = "<URL>k__BackingField"
        $v2b = "<RunHidden>k__BackingField"
        $v2c = "DownloadAndExecute"
        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
        $v2e = "england.png" wide
        $v2f = "Showed Messagebox" wide

Detection condition:
all of ($v1*) or all of ($v2*)

Full rule:
rule xRAT : RAT
{
    meta:
        author = " Kevin Breen <kevin@techanarchy.net>"
        date = "2014/04"
        ref = "http://malwareconfig.com/stats/xRat"
        maltype = "Remote Access Trojan"
        filetype = "exe"

    strings:
        $v1a = "DecodeProductKey"
        $v1b = "StartHTTPFlood"
        $v1c = "CodeKey"
        $v1d = "MESSAGEBOX"
        $v1e = "GetFilezillaPasswords"
        $v1f = "DataIn"
        $v1g = "UDPzSockets"
        $v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}

        $v2a = "<URL>k__BackingField"
        $v2b = "<RunHidden>k__BackingField"
        $v2c = "DownloadAndExecute"
        $v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
        $v2e = "england.png" wide
        $v2f = "Showed Messagebox" wide
    condition:
        all of ($v1*) or all of ($v2*)
}
YARA Detection Rule: HTMLVariant
Repository: Yara-Rules/rules
Detects: Identifier for html variant of FAKEM
Author: Katie Kleemola

Pattern signatures:
// decryption loop
		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
		$s2 = { C6 45 F? (3?|4?) }

Detection condition:
$s1 and #s2 == 16

Full rule:
rule HTMLVariant : FakeM Family HTML Variant
{
	meta:
		description = "Identifier for html variant of FAKEM"
		author = "Katie Kleemola"
		last_updated = "2014-05-20"
	
	strings:
		// decryption loop
		$s1 = { 8B 55 08 B9 00 50 00 00 8D 3D ?? ?? ?? 00 8B F7 AD 33 C2 AB 83 E9 04 85 C9 75 F5 }
		//mov byte ptr [ebp - x] y, x: 0x10-0x1 y: 0-9,A-F
		$s2 = { C6 45 F? (3?|4?) }

	condition:
		$s1 and #s2 == 16

}