deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: M_APT_VIRTUALPITA_2
Repository: Neo23x0/signature-base
Detects: Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc
Author: Mandiant

Pattern signatures:
$x = { 85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01 }

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule M_APT_VIRTUALPITA_2 {
   meta:
      author = "Mandiant"
      md5 = "fe34b7c071d96dac498b72a4a07cb246"
      description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
      id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"
   strings:
      $x = { 85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01 }
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: M_APT_VIRTUALPITA_3
Repository: Neo23x0/signature-base
Detects: Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually.
Author: Mandiant

Pattern signatures:
$x = { 4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8 }

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule M_APT_VIRTUALPITA_3 {
   meta:
      author = "Mandiant"
      md5 = "fe34b7c071d96dac498b72a4a07cb246"
      description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
      id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"
   strings:
      $x = { 4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8 }
   condition:
      uint32(0) == 0x464c457f and all of them
}
YARA Detection Rule: M_APT_VIRTUALPITA_4
Repository: Neo23x0/signature-base
Detects: Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs
Author: Mandiant

Pattern signatures:
$x = { 4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04 }

Detection condition:
uint32(0) == 0x464c457f and all of them

Full rule:
rule M_APT_VIRTUALPITA_4 {
   meta:
      author = "Mandiant"
      md5 = "fe34b7c071d96dac498b72a4a07cb246"
      description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
      id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"
   strings:
      $x = { 4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04 }
   condition:
      uint32(0) == 0x464c457f and all of them

}
YARA Detection Rule: M_Hunting_Python_Backdoor_CommandParser_1
Repository: Neo23x0/signature-base
Detects: Finds strings indicative of the vmsyslog.py python backdoor.
Author: Mandiant

Pattern signatures:
$key1 = "self.conn.readInt8()" ascii
      $key2 = "upload" ascii
      $key3 = "download" ascii
      $key4 = "shell" ascii
      $key5 = "execute" ascii
      $re1 = /def\srun.{0,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s

Detection condition:
filesize < 200KB and all of them

Full rule:
rule M_Hunting_Python_Backdoor_CommandParser_1 {
   meta:
      author = "Mandiant"
      md5 = "61ab3f6401d60ec36cd3ac980a8deb75"
      description = "Finds strings indicative of the vmsyslog.py python backdoor."
      id = "15cbca01-24e6-5538-bcfd-c3222337aaf5"
   strings:
      $key1 = "self.conn.readInt8()" ascii
      $key2 = "upload" ascii
      $key3 = "download" ascii
      $key4 = "shell" ascii
      $key5 = "execute" ascii
      $re1 = /def\srun.{0,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s
   condition:
      filesize < 200KB and all of them
}
YARA Detection Rule: SUSP_Unsigned_GoogleUpdate
Repository: Neo23x0/signature-base
Detects: Detects suspicious unsigned GoogleUpdate.exe
Author: Florian Roth (Nextron Systems)
Reference: Internal Research

Pattern signatures:
/* OriginalName GoogleUpdate.exe */
      $ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
               00 65 }

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and $ac1
      and pe.number_of_signatures < 1

Full rule:
rule SUSP_Unsigned_GoogleUpdate {
   meta:
      description = "Detects suspicious unsigned GoogleUpdate.exe"
      author = "Florian Roth (Nextron Systems)"
      reference = "Internal Research"
      date = "2019-08-05"
      score = 60
      hash1 = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
      id = "2575b882-3526-5c42-9d50-83fb0b7df3f5"
   strings:
      /* OriginalName GoogleUpdate.exe */
      $ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
               00 65 }
   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and $ac1
      and pe.number_of_signatures < 1
}
YARA Detection Rule: MAL_WebMonitor_RAT
Repository: Neo23x0/signature-base
Detects: Detects WebMonitor RAT
Author: Florian Roth (Nextron Systems)
Reference: https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/

Pattern signatures:
$x1 = "send_keylog_stream_start" fullword wide
      $x2 = "KEYLOG_STREAM_STOP" fullword wide

      $s1 = "SHELL_EXEC" fullword wide
      $s2 = "send_shell_exec" fullword wide
      $s3 = "send_connections_get" fullword wide

      $a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
      $a2 = "Select * from Win32_Process WHERE handle =" fullword wide
      $a3 = "Select * from Win32_Process where ProcessId=" fullword wide
      $a4 = "Select * from Win32_ComputerSystem" fullword wide
      $a5 = "The service is in the process of being continued" fullword wide
      $a6 = "tcpdump" fullword wide
      $a7 = "memdump" fullword wide
      $a8 = "<val1>Processor</val1>" fullword wide
      $a9 = "Win32 share process" fullword wide

Detection condition:
uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         ( 2 of ($s*) and 2 of ($a*) ) or
         7 of them
      )

Full rule:
rule MAL_WebMonitor_RAT {
   meta:
      description = "Detects WebMonitor RAT"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
      date = "2018-04-13"
      hash1 = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
      hash2 = "05111c305028b5d822ecd12de[PII_REDACTED]c42860cc9d448c47886c236648607"
      id = "5378f22e-4bba-50e7-8374-5135e980e06b"
   strings:
      $x1 = "send_keylog_stream_start" fullword wide
      $x2 = "KEYLOG_STREAM_STOP" fullword wide

      $s1 = "SHELL_EXEC" fullword wide
      $s2 = "send_shell_exec" fullword wide
      $s3 = "send_connections_get" fullword wide

      $a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
      $a2 = "Select * from Win32_Process WHERE handle =" fullword wide
      $a3 = "Select * from Win32_Process where ProcessId=" fullword wide
      $a4 = "Select * from Win32_ComputerSystem" fullword wide
      $a5 = "The service is in the process of being continued" fullword wide
      $a6 = "tcpdump" fullword wide
      $a7 = "memdump" fullword wide
      $a8 = "<val1>Processor</val1>" fullword wide
      $a9 = "Win32 share process" fullword wide
   condition:
      uint16(0) == 0x5a4d and filesize < 1000KB and (
         1 of ($x*) or
         ( 2 of ($s*) and 2 of ($a*) ) or
         7 of them
      )
}
YARA Detection Rule: HKTL_Keyword_InjectDLL
Repository: Neo23x0/signature-base
Detects: Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications
Author: Florian Roth (Nextron Systems)
Reference: https://github.com/zerosum0x0/koadic

Pattern signatures:
$s2 = "InjectDLL" fullword ascii
      $s4 = "Kernel32.dll" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and all of them

Full rule:
rule HKTL_Keyword_InjectDLL {
   meta:
      description = "Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://github.com/zerosum0x0/koadic"
      date = "2019-04-04"
      score = 60
      hash1 = "2e7b4141e[PII_REDACTED]a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
      id = "422eed76-7dfa-5490-a866-d337434eaddc"
   strings:
      $s2 = "InjectDLL" fullword ascii
      $s4 = "Kernel32.dll" fullword ascii
   condition:
      uint16(0) == 0x5a4d and all of them
}
YARA Detection Rule: HKTL_Python_sectools
Repository: Neo23x0/signature-base
Detects: Detects code which uses the python lib sectools
Author: Arnim Rupp
Reference: https://github.com/p0dalirius/sectools

Pattern signatures:
$import1 = "from sectools" // might bei "from sectools.windows import ..." or "from sectools import ..."
        $import2 = "import sectools"

Detection condition:
any of ( $import* )

Full rule:
rule HKTL_Python_sectools {
    meta:
        description = "Detects code which uses the python lib sectools"
        author = "Arnim Rupp"
        date = "2023-01-27"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        reference = "https://github.com/p0dalirius/sectools"
        hash ="814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
        hash ="b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
        hash ="8cd205d5380278cff[PII_REDACTED]057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
        score=50
        id = "89a5e0ba-5547-53e4-84a3-d07ee779596e"
    strings:
        $import1 = "from sectools" // might bei "from sectools.windows import ..." or "from sectools import ..."
        $import2 = "import sectools"
    condition:
        any of ( $import* )
}
YARA Detection Rule: crime_win32_parallax_loader_1
Repository: Neo23x0/signature-base
Detects: Detects Parallax Loader
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]27224578

Pattern signatures:
$main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}

     $decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 

Detection condition:
uint16(0) == 0x5a4d and filesize < 2000KB and
      2 of them

Full rule:
rule crime_win32_parallax_loader_1 {
   meta:
      description = "Detects Parallax Loader"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]27224578"
      date = "2020-02-24"
      hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c[PII_REDACTED]d65"
      id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"
   strings:
     $main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}

     $decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}

   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and
      2 of them
}
YARA Detection Rule: crime_win32_parallax_payload_1
Repository: Neo23x0/signature-base
Detects: Detects Parallax Injected Payload v1.01
Author: @VK_Intel
Reference: https://twitter.com/VK_Intel/status/[PII_REDACTED]27224578

Pattern signatures:
$zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}

   $wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }

   $rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? 

Detection condition:
uint16(0) == 0x5a4d and filesize < 100KB and
      2 of them

Full rule:
rule crime_win32_parallax_payload_1 {
   meta:
      description = "Detects Parallax Injected Payload v1.01"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/[PII_REDACTED]27224578"
      date = "2020-02-24"
      hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
      id = "f3a23a28-e322-59ff-85e0-72e44def5c02"
   strings:
   $zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}

   $wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }

   $rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}

   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and
      2 of them
}
YARA Detection Rule: HKTL_Buckeye_Osinfo
Repository: Neo23x0/signature-base
Detects: Detects OSinfo tool used by the Buckeye APT group
Author: Florian Roth (Nextron Systems)
Reference: http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong

Pattern signatures:
$s1 = "-s ShareInfo ShareDir" fullword ascii
		$s2 = "-a Local And Global Group User Info" fullword ascii
		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
		$s4 = "info <\\server> <user>" fullword ascii
		$s5 = "-c Connect Test" fullword ascii
		$s6 = "-gd Group Domain Admins" fullword ascii
		$s7 = "-n NetuseInfo" fullword ascii

Detection condition:
uint16(0) == 0x5a4d and 3 of ($s*)

Full rule:
rule HKTL_Buckeye_Osinfo {
	meta:
		description = "Detects OSinfo tool used by the Buckeye APT group"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
		date = "2016-09-05"
		score = 70
		id = "e40a86d1-fd1a-5430-b7b7-8cc7ca128cc5"
	strings:
		$s1 = "-s ShareInfo ShareDir" fullword ascii
		$s2 = "-a Local And Global Group User Info" fullword ascii
		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
		$s4 = "info <\\server> <user>" fullword ascii
		$s5 = "-c Connect Test" fullword ascii
		$s6 = "-gd Group Domain Admins" fullword ascii
		$s7 = "-n NetuseInfo" fullword ascii
	condition:
		uint16(0) == 0x5a4d and 3 of ($s*)
}
YARA Detection Rule: HKTL_RemoteCmd
Repository: Neo23x0/signature-base
Detects: Detects a remote access tool used by APT groups - file RemoteCmd.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$s1 = "RemoteCmd.exe" fullword wide
		$s2 = "\\Release\\RemoteCmd.pdb" ascii
		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
		$s4 = "http://{0}:65101/CommandEngine" fullword wide
		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii

Detection condition:
( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )

Full rule:
rule HKTL_RemoteCmd {
	meta:
		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		modified = "2022-12-21"
		score = 70
		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
		id = "384f37f3-4562-5d79-9793-0384c43d4602"
	strings:
		$s1 = "RemoteCmd.exe" fullword wide
		$s2 = "\\Release\\RemoteCmd.pdb" ascii
		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
		$s4 = "http://{0}:65101/CommandEngine" fullword wide
		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
	condition:
		( uint16(0) == 0x5a4d and filesize < 50KB and 2 of them ) or ( 4 of them )
}
YARA Detection Rule: HKTL_ChromePass
Repository: Neo23x0/signature-base
Detects: Detects a tool used by APT groups - file ChromePass.exe
Author: Florian Roth (Nextron Systems)
Reference: http://goo.gl/igxLyF

Pattern signatures:
$x1 = "\\Release\\ChromePass.pdb" ascii
		$x2 = "Windows Protect folder for getting the encryption keys" wide
		$x3 = "Chrome User Data folder where the password file is stored" wide

		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
		$s4 = "Windows Login Password:" fullword wide
		$s5 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
		$s6 = "Chrome Password Recovery" fullword wide

Detection condition:
( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )

Full rule:
rule HKTL_ChromePass {
	meta:
		description = "Detects a tool used by APT groups - file ChromePass.exe"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "http://goo.gl/igxLyF"
		date = "2016-09-08"
		modified = "2025-03-10"
		score = 75
		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
		id = "950b9761-bdfd-514b-90ea-a1454d35ce5a"
	strings:
		$x1 = "\\Release\\ChromePass.pdb" ascii
		$x2 = "Windows Protect folder for getting the encryption keys" wide
		$x3 = "Chrome User Data folder where the password file is stored" wide

		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
		$s4 = "Windows Login Password:" fullword wide
		$s5 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
		$s6 = "Chrome Password Recovery" fullword wide
	condition:
		( uint16(0) == 0x5a4d and filesize < 700KB and 1 of ($x*) ) or ( 5 of them )
}